• AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS.
• AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency
• AWS Shield detects the following classes of attacks
  • Network Volumetric Attacks (Layer 3)
    • This is a sub category of infrastructure layer attack vectors.
    • These vectors attempt to saturate the capacity of the targeted network or resource, to deny service to legitimate users.
  • Network Protocol Attacks (Layer 4)
    • This is a sub category of infrastructure layer attack vectors.
    • These vectors abuse a protocol to deny service to the targeted resource.
    • A common example of a network protocol attack is a TCP SYN flood, which can exhaust connection state on resources like servers, load balancers, or firewalls.
    • A network protocol attack can also be volumetric for e.g., a larger TCP SYN flood may intend to saturate the capacity of a network while also exhausting the state of the targeted resource or intermediate resources.
  • Application Layer Attacks (Layer 7)
    • This category of attack vector attempts to deny service to legitimate users by flooding an application with queries that are valid for the target, such as web request floods.

AWS Shield Tiers

AWS Shield Standard

• provides automatic protections to all customers at no additional charge
• defends against the most common, frequently occurring network and transport layer DDoS attacks that target website or applications.
• with CloudFront and Route 53 comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks is provided.
• uses techniques such as deterministic packet filtering and priority-based traffic shaping to automatically mitigate basic network layer attacks.

AWS Shield Advanced

• is a managed service that helps protect the application against external threats, like DDoS attacks, volumetric bots, and vulnerability exploitation attempts.
• provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks,
• provides integration with AWS WAF, a web application firewall, at no additional charge. It can create WAF rules in the WebACLs to automatically mitigate an attack, or activate them in count-only mode.
• also gives 24×7 access to the AWS Shield Response Team (SRT) and protection against DDoS related spikes in the EC2, ELB, CloudFront, AWS Global Accelerator and Route 53 charges.
• provides DDoS cost protection to safeguard against scaling charges resulting from DDoS-related usage spikes on protected resources.
• in addition to the network and transport layer attacks, it also detects application layer (Layer 7) attacks such as HTTP floods or DNS query floods by baselining traffic on the application and identifying anomalies.
• is available globally on all CloudFront, Global Accelerator, and Route 53 edge locations.
• includes centralized protection management using Firewall Manager, that can automatically
  • configure policies covering multiple accounts and resources
  • audits accounts to find new or unprotected resources, and ensures that Shield Advanced and AWS WAF protections are universally applied.
• provides complete visibility into DDoS attacks with near real-time notification through CloudWatch and detailed diagnostics on the AWS WAF and AWS Shield console or APIs.