AWS Shield

Managed DDoS protection for AWS applications — Standard is free and always on, Advanced is a paid subscription with expert support.

Verified against AWS documentation · 2026-09-09

Key facts

01Standard: free, automatic, every AWS customer — nothing to enable, defends layer 3/4 (network and transport) attacks
02Advanced: paid subscription — adds layer 7 (application) protection via AWS WAF, 24/7 Shield Response Team, and DDoS cost protection
03Advanced protects a fixed list: CloudFront, Route 53, Global Accelerator, ELB, and EC2 — that's the whole list
04SRT engagement requires a Business or Enterprise Support plan on top of the Advanced subscription
05Reality check: AWS now markets Shield as two capabilities — Shield Advanced and network security director (posture analysis, still in preview). CLF-C02 only tests Standard vs. Advanced.

Phrases and scenarios that point here.

"DDoS", "flood of traffic", "layer 3/4 attack", "protect availability" → Shield
"Already included", "no additional cost", "automatic" → Shield Standard (Advanced is the trap answer)
"24/7 expert help during an attack" or "credits for attack-driven scaling costs" → Shield Advanced
SQL injection, XSS, bad bots, block by IP or country → AWS WAF, not Shield

Blocking malicious request content — SQLi, XSS, rate limiting → AWS WAF
Detecting compromised instances or unusual API activity → GuardDuty
Filtering traffic inside your VPC at subnet or instance level → security groups, NACLs, Network Firewall

01A ticketing site on sale day — Standard already absorbs SYN floods and reflection attacks at the edge, and nobody on the team ever knew it happened
02A gaming company whose tournament weekends attract paid DDoS-for-hire from rivals — Advanced with the SRT pre-authorized and on standby
03A lender behind CloudFront + WAF hit by a layer 7 flood of expensive search queries, where the damage lands on Lambda and RDS bills rather than bandwidth — Advanced's automatic L7 mitigation
04A news site during a breaking story, where a legitimate traffic spike and an attack look identical — Advanced's attack diagnostics tell you which one you're having before you scale into it
05Any public endpoint fronted by Auto Scaling — Advanced's cost protection is the difference between a bad afternoon and a five-figure surprise invoice

01Standard is free — baked into CloudFront, Route 53, ELB, EC2, and Global Accelerator; it never appears as a line item
02Advanced is a flat $3,000/month per organization with a 1-year commitment — one fee covers every account under the payer, so cost per account drops as you add accounts
03On top of the flat fee, Advanced bills per-GB data transfer out on the resources you choose to protect; protect selectively, not everything
04Advanced covers standard AWS WAF costs on protected resources (up to 1,500 WCUs and 50 billion requests/month) — Bot Control, CAPTCHA, and overage still bill separately
05DDoS cost protection is a credit, not an automatic discount — you open a Support case after the attack and AWS decides