AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. AWS Shield Standard provides protection for all AWS customers from common, most frequently occurring network and transport layer DDoS attacks that target a web site or application at no additional charge.

AWS Shield Standard Features:

Static threshold DDoS protection for underlying AWS services
Inline attack mitigation

AWS Shield Advanced is a paid service that provides additional protections for internet-facing applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53.

AWS Shield Advanced Features:

Tailored detection based on application traffic patterns
Health-based detection
Advanced attack mitigation
Automatic application layer DDoS mitigation
Proactive event response
Protection groups
Visibility and attack notification
DDoS cost protection
Specialized support
Global availability
Centralized protection management

AWS Shield Advanced is available to all customers; however, to contact the AWS Shield Response Team customers will need the Enterprise or Business Support levels of AWS Premium Support. It requires a 1-year subscription commitment and charges a monthly fee, plus a usage fee based on data transfer out from Amazon CloudFront, Elastic Load Balancing (ELB), Amazon Elastic Compute (EC2), and AWS Global Accelerator.

AWS Shield Advanced is available on:

Amazon Route 53
Amazon CloudFront
Elastic Load Balancing
AWS Global Accelerator
Elastic IP (Amazon Elastic Compute Cloud and Network Load Balancer)

AWS Shield

What is AWS Shield?

Categories & Use Cases

Related Products