Shield
AWS Shield protects against distributed denial-of-service (DDoS) attacks, floods of traffic meant to overwhelm a public endpoint. Every AWS account gets Shield Standard for free; the platform relies on it and keeps the paid Shield Advanced tier built but switched off.
What it does
Shield Standard is always on for every AWS customer. It absorbs the common network- and transport-layer attacks (SYN floods, reflection attacks) at the AWS edge, in front of CloudFront, Route 53 and load balancers, with no configuration. Shield Advanced is a subscription that adds detection tuned to your specific resources, larger-scale mitigation, application-layer DDoS protection through WAF, cost protection against scaling caused by an attack, and access to the AWS DDoS response team. It requires listing the protected resources, and a protection group lets several resources be monitored as one.
How BuiltForProd uses it
Shield Standard needs nothing from the platform. The internet-facing application load balancers, the CloudFront distributions serving the frontend and the public Route 53 zones are all covered by it automatically.
Shield Advanced is provided by the shield unit (module modules/shield), listed by the core/security/global stack file because the subscription is an account-level, global resource. It is controlled by one switch in environments/core/security/security.hcl:
enable_shield_advanced = false # @optional: Shield Advanced DDoS protection ($3,000/month, 1-year commitment)
With the switch off, nothing is created and nothing is billed. With it on, the module creates:
| Resource | Setting |
|---|---|
aws_shield_subscription | Auto-renew enabled |
Protection group acme-all-resources | Pattern ALL, aggregation MAX, so every protected resource is watched together |
One aws_shield_protection per entry in protected_resources | A name-to-ARN map in the unit, with commented examples for a production ALB and a CloudFront distribution |
The design decisions are direct about why the default is off: Shield Advanced costs $3,000 per month with a one-year commitment, and is justified only for high-value public targets. A small organization gets Shield Standard, the Firewall Manager WAF policy and per-AZ redundancy for free and pays for Advanced when its exposure warrants it.
Shield Advanced and WAF are complementary. Shield handles volume; WAF handles request content. When Shield Advanced is on, its application-layer mitigation uses the web ACL that Firewall Manager has already attached to each load balancer.
Terms you will see
| Term | Meaning |
|---|---|
| DDoS | A distributed denial-of-service attack: traffic from many sources meant to exhaust a service. |
| Shield Standard | The free, always-on protection against common network-layer attacks. |
| Shield Advanced | The paid subscription with resource-specific detection, cost protection and response support. |
| Protected resource | A load balancer, distribution, Elastic IP or hosted zone enrolled in Shield Advanced. |
| Protection group | A set of protected resources monitored together; ALL with MAX aggregation here. |
| DDoS response team | The AWS team that Shield Advanced subscribers can engage during an attack. |
| Cost protection | Credits for scaling charges caused by a DDoS attack on a protected resource. |
Where to read more
- AWS Baseline overview for the security switches and their prices.
- CloudFront and Elastic Load Balancing for the public endpoints Shield covers.
- WAF for the request-level layer above Shield.