AWS Shield
- It is a managed DDoS protection service
- Protects against
- Volumetric attacks
- Application and network attacks
- State-exhaustion or protocol attacks
- User Datagram Protocol (UDP) reflection attacks
- SYN flood
- DNS query flood
- HTTP flood/cache-busting (layer 7) attacks
- Available in two tiers: Standard and Advanced.
- Shield Standard version provides
- on detection and inline mitigation techniques
- deterministic packet filtering and priority-based traffic shaping are provided
- included automatically to ELB load balancers, CloudFront and Route 53 resources, free of cost
- Shield Advanced version provides
- access to near real-time metrics and reports
- gives detailed reporting into infrastructure layer and application layer DDoS attacks.
- granular detection of DDoS attacks like detect HTTP floods or DNS query floods.
- includes 24×7 access to AWS DDoS Response Team (DRT)
- Directly create or update AWS WAF rules
- Receive improvements to AWS architectures
- Combine with WAF metrics for comprehensive CloudWatch monitoring and alarming strategy.