AWS Shield Advanced¶

What Is This Service?¶

AWS Shield Advanced is AWS’s managed enterprise DDoS protection service that provides advanced attack detection, mitigation, visibility, cost protection, and response support for internet-facing AWS applications.

Protects against:

Layer 3 DDoS
Layer 4 DDoS
Layer 7 DDoS (via WAF)
Reflection attacks
SYN floods
UDP floods
Volumetric attacks

Mental model:
Shield Advanced = enterprise DDoS protection + attack operations + financial protection.

Extends:

Shield Standard
+
Advanced Detection
+
Shield Response Team
+
Cost Protection
+
WAF Integration

Why It Matters for Security¶

Availability is a security objective.

DDoS attacks cause:

Revenue loss
Application outages
Scaling explosions
Operational disruption

Security goals:

Maintain availability
Reduce mitigation effort
Improve attack visibility
Lower financial impact
Enable faster response

Security outcomes:

Automated mitigation
Improved resilience
Reduced operational burden
Stronger incident response

Typical use cases:

Internet applications
Financial platforms
APIs
Global applications
High-value workloads

Architecture Example¶

flowchart LR

Internet

Shield[Shield Advanced]

WAF[AWS WAF]

FMS[Firewall Manager]

SRT[Shield Response Team]

CF[CloudFront]

GA[Global Accelerator]

R53[Route 53]

ALB[ALB]

EIP[Elastic IP]

CW[CloudWatch]

Internet --> Shield

Shield --> WAF

Shield --> FMS

Shield --> SRT

Shield --> CF

Shield --> GA

Shield --> R53

Shield --> ALB

Shield --> EIP

Shield --> CW

Core architecture:

Traffic
 ↓
Detection
 ↓
Mitigation
 ↓
Protected Resource

Workflow(s)¶

Network DDoS Mitigation¶

sequenceDiagram

participant Client
participant Shield
participant Resource

Client->>Shield: Attack traffic

Shield->>Shield: Detect anomaly

Shield->>Resource: Mitigate

Resource-->>Client: Service remains available

Automatic Layer 7 Mitigation¶

sequenceDiagram

participant User
participant Shield
participant WAF
participant App

User->>Shield: HTTP flood

Shield->>WAF: Create temporary mitigation rule

alt Count Mode
WAF->>App: Observe attack
else Block Mode
WAF-->>User: Reject traffic
end

WAF->>Shield: Attack subsides

Shield->>WAF: Remove temporary rule

Shield Response Workflow¶

sequenceDiagram

participant Customer
participant Shield
participant SRT

Customer->>Shield: Escalate event

Shield->>SRT: Engage

SRT-->>Customer: Guidance & mitigation

Core Concepts¶

Shield Standard vs Shield Advanced (MOST TESTED)¶

Shield Standard¶

Included by default.

Protects:

L3/L4

No additional charge.

Shield Advanced¶

Adds:

Enhanced detection
Shield Response Team
Cost protection
Visibility
WAF integration

Paid offering.

Protected Resources¶

Supported:

CloudFront
Route 53
Global Accelerator
ALB
NLB
Elastic IP

Exam trap:

EC2 is protected via:

Elastic IP

NOT:

Instance ID

Classic exam trap.

DDoS Detection¶

Detects:

Traffic anomalies
Volumetric attacks
Behavioral attacks

Attack Visibility¶

Provides:

Diagnostics
Event analysis
Metrics

Important Integrations¶

AWS WAF (VERY HIGH VALUE)¶

Critical integration.

Pattern:

Shield
+
WAF
=
L7 Protection

Supports:

Automatic mitigation
Rule injection

AWS Firewall Manager (HIGH VALUE)¶

Supports:

Organization-wide governance

Massive cost nuance:

When Shield Advanced is enabled:

WAF
+
Firewall Manager

are included for protected resources.

Exam scenario:

Many WAF deployments
+
DDoS protection

Shield Advanced may reduce total cost.

Route 53¶

Protects:

DNS availability

CloudFront¶

Recommended edge architecture.

Pattern:

Internet
 ↓
CloudFront
 ↓
Shield
 ↓
Origin

Global Accelerator¶

Supports:

Global resilience

Elastic Load Balancing¶

Protects:

Public applications

CloudWatch¶

Provides:

Health signals
Detection improvements

Security Features¶

Automatic DDoS Mitigation¶

Responds automatically.

Advanced Detection¶

Identifies:

Attack anomalies

DDoS Cost Protection (VERY HIGH VALUE)¶

Protects against:

Unexpected scaling charges

Examples:

EC2
ELB
CloudFront
Route 53

Exam shortcut:

Attack
+
Scaling
+
Cost reimbursement

Shield Response Team (SRT)¶

Formerly:

DRT

Same team.

Provides:

DDoS experts
Mitigation guidance

Requires:

Business
or
Enterprise Support

Exam trap:

SRT and DRT mean the same thing.

Health-Based Detection¶

Uses:

CloudWatch

Improves:

Detection quality
Mitigation accuracy

Automatic Layer 7 Mitigation (HIGH VALUE)¶

Mechanism:

Shield detects
 ↓
Create temporary WAF rule
 ↓
Mitigate attack
 ↓
Remove rule

Mode options:

Count
or
Block

Massive exam topic.

Global Threat Dashboard¶

Provides:

Visibility
Threat telemetry

Advanced Security and Operational Concepts¶

Shield Is Primarily L3/L4 (MOST TESTED)¶

Shield:

Network DDoS

WAF:

Application filtering

Free WAF Benefit (VERY HIGH VALUE)¶

Shield Advanced includes:

WAF
+
Firewall Manager

for protected resources.

Exam scenario:

Large WAF deployment

Shield Advanced may become cost-effective.

Health-Based Detection¶

Pattern:

CloudWatch Alarm
 ↓
Shield
 ↓
Adaptive mitigation

Reduces false positives.

Proactive Engagement (HIGH VALUE)¶

Allows:

SRT contacts customer

Requirements:

Contacts configured
Supported plan

DDoS Cost Protection Pattern¶

Attack
 ↓
Auto Scaling
 ↓
Unexpected Cost
 ↓
Cost Protection

Firewall Manager Governance¶

Pattern:

Organizations
 ↓
Firewall Manager
 ↓
Shield Policies

EC2 Protection Nuance¶

Protect directly:

Elastic IP

Protect indirectly:

ALB
CloudFront

Cannot directly protect:

Dynamic Public IP

Shield Does NOT Replace Architecture¶

Still design with:

Multi-AZ
Auto Scaling
CloudFront
WAF

Defense in depth.

Comparisons¶

Service	Layer	Purpose	Included
Shield Standard	L3/L4	Basic DDoS	Yes
Shield Advanced	L3/L4 + WAF	Enterprise DDoS	No
AWS WAF	L7	Application Filtering	No
Security Groups	L3/L4	Instance Filtering	Yes
Network Firewall	L3–L7	Network Security	No

Common Exam Traps¶

Shield Standard included by default.
Shield Advanced is paid.
WAF required for Layer 7.
Shield Advanced includes WAF benefits.
SRT requires Business/Enterprise Support.
EC2 protection uses Elastic IP.
Health-based detection uses CloudWatch.
Automatic mitigation injects WAF rules.
Count mode allows observation.
Shield protects resources—not accounts.
Firewall Manager centralizes deployment.
Shield does not replace architecture.

5-Second Recall¶

Shield = DDoS protection
Standard included
Advanced = SRT + cost protection
WAF handles Layer 7
WAF + Firewall Manager included
EC2 protected via EIP
Shield injects temporary WAF rules

Quick Revision Notes¶

Enterprise DDoS protection
Automatic mitigation
WAF enables Layer 7 defense
SRT provides expert response
Cost protection reimburses scaling
Health signals improve detection
EC2 protected via EIP
Automatic WAF rule creation
Firewall Manager governance
Availability-first security