3.1.4. AWS Shield (DDoS Protection)

AWS Shield provides managed Distributed Denial of Service (DDoS) protection across various layers, ensuring application availability and minimizing the impact of large-scale network attacks.

Scenario: You are managing a critical public-facing web application that is vulnerable to DDoS attacks, which could lead to significant downtime and revenue loss. You need a managed solution to protect against both common and sophisticated DDoS attacks.

Distributed Denial of Service (DDoS) attacks are a common threat to online applications, aiming to overwhelm a service with traffic to make it unavailable to legitimate users. AWS Shield provides managed protection against these attacks.

Key Features of AWS Shield:

• Managed DDoS Protection: AWS automatically detects and mitigates DDoS attacks without manual intervention.
• Two Tiers:
  • AWS Shield Standard:
    • What it is: Automatically included with all AWS accounts at no additional cost.
    • Protection: Provides always-on detection and inline mitigation of common, most frequent network and transport layer (Layer 3 and 4) DDoS attacks (e.g., SYN floods, UDP floods).
  • AWS Shield Advanced:
    • What it is: A paid service for higher-level protection for critical applications.
    • Protection: Enhanced detection and mitigation against larger and more sophisticated DDoS attacks.
    • Cost Protection: Protects against scaling charges due to DDoS attacks on ELB, CloudFront, and Route 53.
    • DDoS Response Team (DRT): Access to 24/7 specialized DDoS response experts.
    • AWS WAF integration: Provides custom DDoS rules at the application layer.
    • Detection Alerts: Shield Advanced publishes CloudWatch metrics for each protected resource — DDoSDetected (non-zero during an event) plus attack-volume metrics. Create a CloudWatch alarm on DDoSDetected with an SNS topic as its action; subscribe email addresses, and a chat integration (Amazon Q Developer in chat applications, formerly AWS Chatbot, or a Lambda webhook) to reach Slack.
• Shield plus WAF: Shield absorbs Layer 3/4 floods such as UDP floods at the edge. A flood of HTTP requests against one endpoint (e.g., a login API) needs an AWS WAF rate-based rule on the CloudFront distribution or ALB (see 3.1.3). A network ACL cannot stop a flood without also blocking legitimate traffic of the same protocol, and GuardDuty only detects; it blocks nothing.

Practical Implementation: Enabling Shield Advanced (Conceptual)

# Shield Advanced is typically enabled via the AWS Management Console
# or through AWS Support. There isn't a direct CLI command to "enable" it
# as it's a subscription service.

# You would associate resources with Shield Advanced after subscription:
aws shield associate-proactive-engagement-details \
  --emergency-contact-list '{"EmailAddress":"security@example.com"}'

aws shield create-protection \
  --name "MyWebAppProtection" \
  --resource-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/abcdef1234567890"

⚠️ Common Pitfall: Assuming Shield Standard is sufficient for all DDoS attacks. While it provides baseline protection, sophisticated or large-volume attacks often require Shield Advanced for effective mitigation and access to the DRT.

Key Trade-Offs:

• Cost (Advanced) vs. Comprehensive Protection: Shield Standard is free but offers basic protection. Shield Advanced is a paid service but provides significantly enhanced protection, cost guarantees, and expert support for critical workloads.

Reflection Question: How does AWS Shield (both Standard and Advanced tiers), by providing managed DDoS protection across various network layers and offering specialized support, fundamentally ensure application availability and minimize the impact of large-scale network attacks?