Shield and DDoS resilience
Lesson 4 of 4 in Protecting the Edge.
AWS Shield Standard is on right now, in every account, at no cost: always-on detection and inline mitigation of the common, frequently occurring network and transport layer attacks against AWS services. You do not enable it, configure it, or see its dashboard. Most volumetric floods against a CloudFront distribution or an Elastic Load Balancer are absorbed by it and by the sheer capacity of the AWS edge, and you never hear about them.
AWS Shield Advanced is a different kind of thing — a paid subscription (around US$3,000 per month per organization plus data-transfer fees, as of October 2026, on a 12-month commitment) that you then apply to specific resources. That is the sentence the exam builds questions around. Subscribing changes nothing by itself; you add protections to the resources that matter: CloudFront distributions, Route 53 hosted zones, Global Accelerator accelerators, Application, Network and Classic Load Balancers, and Elastic IP addresses. A question where "we subscribed to Shield Advanced but the new load balancer was not protected" is not describing a product defect — it is describing the step that was skipped, and at organization scale the answer is a Firewall Manager Shield Advanced policy that protects in-scope resources automatically, including ones created tomorrow.
| Capability | Shield Standard | Shield Advanced |
|---|---|---|
Cost and activation | free, automatic, all accounts | paid subscription, then per-resource protections you configure |
Attack coverage | common and most frequent L3/L4 attacks — SYN and UDP floods, reflection | the same, plus resource-specific detection tuned to your traffic baseline and automatic application-layer mitigation on protected web resources |
Visibility | no per-attack detail; aggregate global view only | per-attack diagnostics, attack vectors and top talkers, plus the global threat environment dashboard |
Availability signal | none | health-based detection — associate a Route 53 health check so detection is tuned by whether the application is actually unhealthy, which cuts false positives sharply |
Human help | AWS Support, on your plan’s terms | the Shield Response Team (SRT) — engage during an event, or configure proactive engagement so they contact you; requires Business or Enterprise Support |
Financial exposure | you pay for the traffic and the scaling | cost protection: request credits for charges from scaling triggered by a verified DDoS event |
AWS WAF | priced separately | WAF usage included for protected resources — which is why Advanced and a well-engineered web ACL are a package, not alternatives |
Organization rollout | nothing to roll out | a Firewall Manager policy applies protections across accounts and to new resources automatically |
A five-layer stack of DDoS resilience, bottom to top. Layer one, reduce the attack surface: no public IP addresses on origins, private subnets, security groups scoped to the CloudFront origin-facing prefix list, origins reachable only through the CDN. Layer two, absorb at the edge: Route 53 for DNS, CloudFront and Global Accelerator so traffic terminates on the AWS edge network rather than in your VPC. Layer three, scale to absorb: load balancers across multiple Availability Zones and auto scaling so capacity grows rather than failing. Layer four, filter at layer seven: AWS WAF rate-based rules and managed rule groups removing request floods and malicious payloads. Layer five, emphasized, know and respond: Shield Advanced resource protections with health-based detection, per-attack diagnostics, the Shield Response Team and cost protection.
Three Shield Advanced details earn their own sentences, because each one is a question waiting to be asked.
Health-based detection associates a Route 53 health check with a protected resource. Shield then knows whether the application is actually suffering, which makes detection both faster for real attacks and quieter for ordinary traffic spikes. AWS recommends it for every protected resource; on the exam, "reduce false-positive DDoS detection on a resource with bursty legitimate traffic" means this.
The Shield Response Team is people. You can engage them during an event, and with proactive engagement configured they contact you when a protected resource's health check fails during a detected event. Two prerequisites that make good distractors: SRT access requires Business or Enterprise Support, and proactive engagement needs health checks associated. You can also pre-authorize the SRT to act on your WAF web ACLs, which is what lets them write mitigation rules at 3 a.m. without waiting for your approval.
Cost protection refunds, as service credits, the scaling charges caused by a verified DDoS event against a protected resource — the CloudFront data transfer, the Route 53 queries, the load-balancer capacity units, the EC2 instances Auto Scaling added. It is a financial control, not a technical one, and it is also the reason "just let it autoscale" is a legitimate DDoS strategy on AWS rather than an expensive mistake.
Interactive sorting exercise: An alert lands on your desk. Which control actually answers it?
Key terms: AWS Shield Standard, AWS Shield Advanced, Shield Response Team (SRT), Firewall Manager policy
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.