AWS Shield

A protection service that defends AWS services from DDoS attacks.

AWS Shield is a service that protects applications running on AWS from DDoS attacks.

• DDoS protection for CloudFront distributions
• Protecting public web applications
• Preparing for high-volume traffic attacks

• A DDoS protection service
• Shield Standard is available at no additional cost
• Shield Advanced is for more sophisticated protection

• Combine with CloudFront and Route 53 to defend at the edge
• Differs from WAF in protection target
• Verify cost before adopting Advanced

AWS Shield is a managed service that protects applications on AWS from distributed denial of service (DDoS) attacks. It is offered in two tiers, Shield Standard and Shield Advanced, with Standard automatically applied to all AWS users at no additional cost. For workloads that use edge and boundary services such as CloudFront, Route 53, AWS Global Accelerator, and Elastic Load Balancing, basic protection against network-layer (L3/L4) attacks such as SYN floods and UDP reflection attacks is always enabled. Shield Advanced is a paid upper-tier plan that is used by explicitly registering protected resources (CloudFront distributions, Route 53 hosted zones, ALBs/NLBs, Global Accelerator, and Elastic IPs). It adds more advanced L3/L4 attack mitigation, Layer 7 attack defense (such as HTTP floods), 24/7 access to the AWS Shield Response Team (SRT) during attacks, cost protection against EC2, ELB, CloudFront, and Route 53 billing spikes caused by DDoS attacks, and bundled AWS WAF usage fees (for protected resources). Typical use cases include standard DDoS protection for CloudFront + S3 / ALB delivery based on Shield Standard, as well as contracting Shield Advanced for large-scale public services that require advanced defense and 24/7 support. From a pricing perspective, Shield Advanced incurs a monthly fixed organizational fee with a one-year commitment, so individual developers and MVP-stage projects typically rely on Shield Standard. In CLF-C02, the differences between Shield Standard and Advanced, and the division of roles with AWS WAF (which provides rule-based defense at the application layer through Web ACLs) — Shield for DDoS protection and WAF for application-layer rules — are frequent topics.

• What are AWS WAF, AWS Shield, and AWS Firewall Manager (AWS Official Documentation)
• AWS Shield (AWS Official)

Last updated: 2026-06-07