AWS Shield
- What it is
- Managed Distributed Denial of Service (DDoS) protection.
- Two tiers
- Shield Standard — free and automatic for every AWS customer. Defends against common Layer 3/4 attacks (SYN floods, UDP reflection).
- Shield Advanced — paid (~$3,000/month, 1-year commitment). Adds:
- 24/7 access to the AWS Shield Response Team (SRT).
- Cost protection: AWS credits back scaling charges caused by an attack.
- Advanced Layer 7 detection, and AWS WAF included at no extra cost.
- Enhanced attack visibility and health-based detection.
- Not to be confused with
- AWS WAF — inspects request content for application-layer exploits. Shield absorbs volumetric floods.
- Exam signal
- “Every customer already has it” → Shield Standard. “DDoS cost protection / 24-7 expert response” → Shield Advanced.