AWS Shield
AWS Shield is a managed Distributed Denial of Service (DDoS) protection service of Amazon Web Services that safeguards applications against network-based DDoS attacks.
Key points
- Protects applications from network- and transport-layer (layer 3/4) DDoS attacks, with near real-time visibility into attacks on protected resources.
- Always-on detection and automatic inline mitigation; no need to engage AWS Support to benefit from DDoS protection.
- Shield Standard is free and automatically active for every AWS customer, defending against the most common, frequently occurring DDoS attacks on Amazon CloudFront and Amazon Route 53.
- Shield Advanced is a paid subscription — a 1-year commitment, billed monthly at $3,000/month per organization (per payer account) plus data-transfer-out usage fees, that renews automatically — that adds Shield Response Team (SRT) access (the current name for the former “DDoS Response Team”/DRT; requires Business or Enterprise Support to engage), cost protection against scaling charges caused by DDoS attacks, and expanded coverage for Amazon CloudFront, Amazon Route 53, Elastic Load Balancing (ELB), AWS Global Accelerator, and Amazon EC2 Elastic IP addresses.
- Shield Advanced includes AWS WAF at no additional cost for protected resources — up to 50 billion AWS WAF requests per month are included before extra charges apply — and can be managed centrally through AWS Firewall Manager.