AWS Shield

AWS Shield protects against Distributed Denial of Service (DDoS) attacks. It comes in two tiers:

Shield Standard (Free)

• Automatic protection for all AWS customers at no extra cost
• Protects against common Layer 3 (network) and Layer 4 (transport) DDoS attacks
• SYN floods, UDP reflection attacks, and other volumetric attacks
• Always-on detection and inline mitigation

Shield Advanced ($3,000/month)

• Enhanced L3/L4 protection plus Layer 7 (application) attack mitigation
• Shield Response Team (SRT, formerly DRT): 24/7 access to AWS DDoS experts who can create WAF rules for you during an attack
• Cost Protection: credits for scaling charges (EC2, ELB, CloudFront, Route 53) caused by DDoS attacks
• Health-based Detection: integrates with Route 53 health checks for faster, more accurate detection
• Visibility: real-time metrics, detailed attack diagnostics, and post-attack reports
• Protects: CloudFront, Route 53, ELB, EC2, Global Accelerator
• Requires a 1-year subscription commitment, plus usage fees on data transfer out from the protected services

How It Goes Wrong in Practice

The most common DDoS-resilience failure on AWS is not a missing Shield subscription, it is origin exposure. A team puts CloudFront and AWS WAF in front of the application, which is exactly right: the edge absorbs and filters attack traffic across AWS's global capacity. But the origin, an ALB or EC2 instance, still has a public IP and a security group that accepts traffic from anywhere. Attackers do not politely go through your CDN. They find the origin address (old DNS records, certificate transparency logs, response headers) and aim the flood directly at it, bypassing every edge protection you paid for. The architecture only works if the origin accepts traffic exclusively from your edge layer: lock origin security groups down so only CloudFront or your load balancer can reach them, and rotate origin addresses if they were ever public.

The second pattern is paying for Shield Advanced and using it as an insurance sticker. The subscription alone does not protect anything: you must associate the specific resources (CloudFront distributions, Route 53 hosted zones, ALBs, Elastic IPs, Global Accelerator) as protected resources, and the higher-value features need setup too: WAF associations for application-layer mitigation, Route 53 health checks for health-based detection, and proactive engagement contacts so the response team can actually reach you mid-attack. Teams discover during their first real attack that they bought the service but never wired it up.

A Practical Check

Confirm whether the account actually has an active Shield Advanced subscription:

aws shield get-subscription-state

The response is a single field, SubscriptionState, either ACTIVE or INACTIVE. If your incident runbook assumes Shield Advanced (DRT access, cost protection claims), this one-liner belongs in the runbook's verification steps, because assuming an inactive subscription during an attack is how teams lose hours.

Frequently Asked Questions

What does Shield Advanced actually cost? 3,000 US dollars per month with a 1-year subscription commitment, plus usage fees based on data transfer out from the protected services (as published on the AWS Shield pricing page: 0.025 USD per GB for CloudFront and 0.050 USD per GB for ELB, with EC2 and Global Accelerator also metered). For many workloads the decisive line items are not the fee but the cost protection credits for attack-driven scaling and the response team access.

Do I already have DDoS protection without paying anything? Yes. Shield Standard is automatic for every AWS customer at no extra cost and mitigates the common network and transport layer attacks (SYN floods, UDP reflection). What it does not give you is application-layer mitigation depth, the Shield Response Team, cost protection, or attack diagnostics. A well-architected setup on CloudFront plus WAF under Shield Standard is already resilient against most volumetric attacks.

When is Shield Advanced worth it? When downtime is expensive enough that you want humans from AWS in the loop during an attack, when you need cost protection against scaling charges a large attack can generate, or when compliance and customers demand documented DDoS response capability. If your exposure is a small workload behind CloudFront, Standard plus good architecture usually covers it; if you run revenue-critical public endpoints, the calculation changes.

Does Shield protect resources it does not front? Shield protections apply to supported resource types: CloudFront, Route 53, ELB, EC2 (Elastic IPs), and Global Accelerator. Anything reachable outside those paths, including an origin exposed directly to the internet, is outside the umbrella, which is why closing the direct-to-origin path is step one regardless of tier.