ShieldAWS Shield
DDoS protection: Shield Standard guards every AWS customer against common network and transport layer attacks at no extra charge, and Shield Advanced adds more for the resources you choose.
Where Shield takes you5 steps, all open
- I know the problem it solves
- I can picture it
- I know when to choose it
- I can use it in a design
- I can answer an exam question
What & why
Staying up under a floodAWS Shield protects applications against distributed denial of service (DDoS) attacks at their perimeter: the first place traffic from outside enters. For users sent through Route 53 to CloudFront or Global Accelerator, that is the edge of the AWS network; for anything reached directly in a Region, it is your VPC.
Standard for everyone, Advanced by choice. Shield Standard is automatic, at no extra charge, and defends against the most common network and transport layer attacks. Shield Advanced is a subscription that adds application layer protection, the Shield Response Team, and credits for bills an attack runs up.
Reach for it when
- a site must stay up through large DDoS attacks
- the team wants DDoS specialists to call at any hour
- an attack must not leave a scaling bill behind
- EC2, load balancers, CloudFront, Route 53 or Global Accelerator need more than the default
It is the wrong tool when
- requests must be blocked by what they contain, such as SQL injection: that is WAF
- you only want the common layer 3 and 4 protection: Standard is already on, with nothing to buy
Mental model
A city's flood defencesA city's flood defences. Every street has the river walls, built for the floods that come every year, and nobody pays extra for them. A waterfront district can pay for more: extra barriers, an engineering crew on call day and night, and a promise to cover the pumping bill if a flood gets through.
Shield StandardShield AdvancedShield Response TeamCost protectionWAF web ACLPerimeterHow it works
Standard by default, Advanced on top- Standard is already onEvery AWS customer is protected against the most common network and transport layer attacks, automatically.
- Put the perimeter at the edgeRoute 53, CloudFront and Global Accelerator get Standard's fullest protection against known layer 3 and 4 attacks.
- Subscribe to AdvancedA one-year commitment; then add the resources to protect: EC2, load balancers, CloudFront, Route 53 or Global Accelerator.
- Add health checks and a web ACLRoute 53 health checks speed up detection, and a web ACL lets Advanced mitigate application layer attacks automatically.
- Standard
- No extra chargeautomatic, for every customer
- Standard covers
- Layers 3 and 4network and transport
- Advanced covers
- Layers 3, 4 and 7for the resources you add
- Commitment
- One yearAdvanced, billed monthly
- Response team
- Advanced plus supportBusiness or Enterprise Support
- WAF requests included
- 50 billiona month, on protected resources
- Shield Standard
Is it one of the common network or transport layer attacks, such as a flood of packets? Standard stops those for every customer.
- Web ACL
Does a rule in the web ACL match the request, such as a rate-based rule for one address sending too many?
- Shield Advanced
On a resource Advanced protects, with automatic mitigation on, is the request part of an application layer attack Advanced has detected?
- The servers
Can the servers take whatever gets this far?
Pick a case to follow the traffic through each check.
Architecture
Protecting every way inMove the perimeter to the edge. With users sent by Route 53 to CloudFront, the perimeter begins at the edge of the AWS network, where Standard gives its fullest protection.
Advanced on each way in. Protect the distribution, the hosted zone and the load balancer; a protection group treats them as one application for detection and mitigation.
Health checks speed things up. Route 53 health checks on protected resources make detection faster, and proactive engagement, where the SRT contacts you, needs them.
Security
Working with the response teamThe right support plan. Working with the Shield Response Team needs Shield Advanced and the Business or Enterprise Support plan.
What they can do. Analyse your WAF logs and, with your approval, change the web ACL; write custom network mitigations; and recommend changes to the architecture.
Proactive engagement. If a protected resource's health check turns unhealthy during an event Advanced has detected, the SRT contacts you directly.
Across accounts. Firewall Manager can apply Shield Advanced protections to new accounts and resources automatically, and its Shield Advanced policies cost Advanced customers nothing extra.
Cost
How you are charged, not what it costs todayShield Standard costs nothing extra.
Shield Advanced is a monthly fee with a one-year commitment, billed to the organization's payer account; one fee covers the subscribed accounts that the organization owns.
Data transfer out usage fees for Advanced, by protected resource type: EC2, Elastic Load Balancing, CloudFront and Global Accelerator.
WAF is included for protected resources: web ACLs, rules and up to 50 billion requests a month, but not Bot Control, CAPTCHA, or more than 1,500 WCUs.
Cost protection arrives as Shield Advanced service credits for the spikes an attack causes.
Prices change, so none are printed here. Check the Shield pricing page on aws.amazon.com.
Comparison
Standard, Advanced, and the neighbours| Feature | Shield Standard | Shield Advanced |
|---|---|---|
| Cost | No extra charge | Monthly fee, one-year commitment |
| Turned on | Automatically, for everyone | By subscribing, then adding resources |
| Layers | 3 and 4 | 3, 4 and 7 |
| Resources | All; fullest at Route 53, CloudFront, Global Accelerator | EC2, ELB, CloudFront, Route 53, Global Accelerator |
| Expert help | Your usual support plan | The SRT, with Business or Enterprise Support |
| An attack's bill | Yours | Service credits for attack-driven spikes |
| Service | Protects against | Choose it when |
|---|---|---|
| Shield | DDoS attacks | Staying up under a flood |
| WAF | Requests that match your rules | Blocking exploits, bad addresses and too many requests |
| Firewall Manager | Protection that differs from account to account | The same WAF and Shield setup in every account |
SAA traps
The phrase in the question, and what it meansDDoS protection at no additional costShield Standard
It is automatic for every AWS customer.
24/7 access to DDoS experts during an attackShield Advanced with Business or Enterprise Support
The Shield Response Team needs both.
cover the scaling charges a DDoS attack causedShield Advanced cost protection
It gives service credits for the spikes an attack causes.
mitigate an application layer DDoS attack automaticallyShield Advanced automatic mitigation
It adds and manages WAF rules against the attack, using 150 WCUs of the web ACL.
Advanced protection for EC2 instances and load balancers, not just the edgeSupported
Advanced covers EC2, Elastic Load Balancing, CloudFront, Route 53 and Global Accelerator.
stop SQL injection attemptsWAF, not Shield
Shield deals with floods, not with what a request contains.
Shield Advanced for every account in the organizationOne subscription fee
It covers the subscribed accounts in the consolidated billing family.
the SRT should call us when the site turns unhealthyProactive engagement
It needs a Route 53 health check on the protected resource.
WAF charges on resources Shield Advanced protectsThe standard ones are covered
Web ACLs, rules and inspection up to 1,500 WCUs are; Bot Control and CAPTCHA are not.
Scenario
Exam style, marked when you answerA news company's site on CloudFront and an Application Load Balancer is hit by large DDoS attacks several times a month. It wants specialists to help during attacks, automatic mitigation of application layer floods, and protection from the charges the attacks cause. What should a solutions architect recommend?
Practice
Fill the gap, the way the challenges workA news site on CloudFront and a load balancer is hit by large DDoS attacks every month. The company wants attacks mitigated at every layer, specialists to call at any hour, and protection from the charges an attack runs up. What protects the distribution?
Quick revision
The night before the exam- What
- DDoS protection at the perimeter of your application.
- Standard
- Automatic, no extra charge, layers
3and4. - Advanced
- A subscription for a year; layers
3,4and7. - Resources
- EC2, ELB, CloudFront, Route 53, Global Accelerator.
- SRT
- Needs Advanced plus Business or Enterprise Support.
- Cost protection
- Service credits for attack-driven spikes.
- WAF
- Standard WAF charges covered on protected resources.
- Health checks
- Faster detection, and needed for proactive engagement.
This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Checked against
Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.