AWS Shield · Managed DDoS protection
AWS Shield is a managed service that protects applications running on AWS against DDoS attacks. Every customer gets L3 · L4 protection automatically at no additional cost. With a Shield Advanced subscription, the resources you designate also get automatic L7 mitigation, Shield Response Team support, and cost protection.
Anti-DDoShealthL3/L4healthgroup: SUMnot protectedProtect only the entry-point resource so the same traffic isn't charged the data transfer usage fee twice.
Tiers (Shield Standard · Shield Advanced)
Attack layers covered by Shield Advanced
Default protections per resource type per account
Shield Response Team (requires Business · Enterprise Support)
Why Shield
DDoS attacks saturate bandwidth (L3), exhaust connection state (L4), or flood you with legitimate-looking requests (L7). Shield detects and mitigates this traffic on the AWS edge and Regional infrastructure.
With no configuration, Shield Standard automatically mitigates common L3 · L4 attacks such as SYN floods, UDP floods, and reflection attacks.
Shield Advanced combines each protected resource's traffic baseline with Route 53 health checks to catch smaller attacks, faster.
During an attack, the Shield Response Team analyzes AWS WAF logs and writes custom rules, then provides post-attack analysis and architecture recommendations.
Standard vs Advanced
Shield Standard applies automatically to every AWS customer. Shield Advanced is subscribed per account and only takes effect on resources you explicitly add protection to.
| Item | Shield Standard | Shield Advanced |
|---|---|---|
| How it applies | Automatic for all customers · no additional cost | Subscribe, then add protection per resource · 1-year commitment |
| L3 · L4 detection and inline mitigation | Yes | Yes + additional mitigation capacity for large attacks |
| Application traffic monitoring | — | Per-resource baselines · health-based detection |
| L7 mitigation | Build it yourself with AWS WAF rules · paid Anti-DDoS rule group | Anti-DDoS managed rule group included in subscription (transitioning from legacy automatic L7 mitigation) + SRT support |
| Event notifications · reporting | — | L3 · L4 · L7 event notifications, CloudWatch metrics, historical reports |
| Shield Response Team | Self-service best practices | Custom mitigation, post-attack analysis, proactive engagement (Business · Enterprise Support) |
| DDoS cost protection | — | Credits for protected-resource usage charges increased by an attack |
| AWS WAF charges | Billed separately | Standard WAF charges for protected resources included (with limits) |
Shield Advanced features
L7 DDoS
L7 protection is moving to the AWS WAF AWSManagedRulesAntiDDoSRuleSet (50 WCU). It establishes a baseline within minutes without health checks, and you set Block and Challenge sensitivity separately. Legacy automatic L7 mitigation (150 WCU) is migrated automatically starting October 25, 2026, and support ends on January 29, 2027.
Health-based
Associate a Route 53 health check with a protection, and when the health check is unhealthy, Shield detects and mitigates faster at lower thresholds. Use it with every resource type except Route 53 hosted zones.
SRT
Grant an IAM role that trusts drt.shield.amazonaws.com, and the SRT reviews WAF logs and creates or updates web ACL rules on your behalf. It acts only with your explicit authorization.
Proactive engagement
If an associated health check becomes unhealthy during a detected event, the SRT contacts your registered contacts first. Associated health checks are a prerequisite.
Protection groups
Group multiple protected resources into one unit for combined detection and reporting. Choose a pattern from ALL · ARBITRARY · BY_RESOURCE_TYPE and an aggregation from SUM · MEAN · MAX.
At scale
An AWS Firewall Manager Shield Advanced policy automatically applies protection to in-scope resources across all accounts in your organization, including newly created ones.
Cost protection: charges from protected resources scaling due to a DDoS attack can be reimbursed as service credits by request to AWS Support. This applies when you fulfill the 1-year subscription commitment.
Protected resources
Shield Advanced protects only the resources you designate. Some types are protected directly, others through an associated Elastic IP. Only IPv4 is supported.
Resources that receive traffic at edge locations. CloudFront also gets L7 protection through a web ACL; for Global Accelerator, only standard accelerators are protected.
CloudFront distributionRoute 53 hosted zoneGA standard acceleratorALBs and Classic Load Balancers are protected directly; an NLB is protected by protecting its associated Elastic IPs. ALBs also get L7 protection through a web ACL.
ALBCLBNLB via EIPProtecting an Elastic IP also protects the EC2 instance or NLB associated with that address. Use it for servers that face the internet directly.
Elastic IPEC2 via EIPOther types, such as Gateway Load Balancer and Global Accelerator custom routing accelerators, cannot be protected. NAT gateways are outbound-only and are not eligible.
Reference architecture
Web traffic flows through CloudFront and AWS WAF to the ALB origin; TCP · UDP traffic flows through Global Accelerator to the NLB. Apply Shield Advanced protection to the entry-point resources, and use health checks and protection groups to improve detection accuracy.
On narrow screens, swipe the diagram sideways.
Getting started
Subscribe to Shield Advanced in the account that owns the resources to protect. It is a 1-year commitment that renews automatically.
Select entry-point resources and add protection. For multiple accounts, use a Firewall Manager policy.
Add the Anti-DDoS managed rule group to the CloudFront · ALB web ACL and associate Route 53 health checks.
Create the SRT access role and register proactive engagement contacts.
Create protection groups and set SNS alarms on the CloudWatch DDoSDetected metric (DDoSAttackRequests for L7).
Pricing
Shield Standard has no additional charge. Shield Advanced consists of a monthly subscription fee and a data transfer usage fee on data out of protected resources.
| Billing item | Billing basis | Notes |
|---|---|---|
| Shield Standard | None | Included by default with the AWS services you use. |
| Advanced subscription fee | Fixed monthly fee · 1-year commitment | Billed once per organization (payer account). Accounts under the same consolidated billing incur no additional subscription fee when each subscribes. |
| Data transfer usage fee | Per GB of Data Transfer Out from protected resources | Rates vary by resource type. Protecting only the entry point, for example not the ELB behind CloudFront, avoids double charges. |
| AWS WAF | Standard charges included for protected resources | Includes web ACL, rule, and request charges (within the default 1,500 WCU, up to 50 billion requests per month per payer) and the Anti-DDoS managed rule group. Requests detected as DDoS do not count toward the limit. Bot Control, Fraud Control, Marketplace rules, and similar are extra. |
| Underlying services | Each service's pricing | Standard charges for CloudFront, ELB, Route 53, Global Accelerator, and EC2 are billed separately. |
Rates depend on resource type and usage. To cancel the subscription, contact AWS Support between 30 and 5 days before the renewal date. For current rates, see the AWS Shield pricing page.
See also: Shield network security director (preview) analyzes the network topology of your accounts and organization and reports missing or misconfigured WAF, security group, and NACL settings as findings by severity. A delegated administrator account can analyze the whole organization, and findings are also available in AWS Security Hub. It is not part of the Shield Advanced subscription; there is no additional cost during the preview, and features and supported Regions may change.
Next step
Bring your internet-facing entry points, traffic volume, support plan, and incident contact process, and we'll review together what to protect and whether to adopt Shield Advanced.