Defending Against DDoS Using AWS Shield
A public application can be hit by a distributed denial of service attack, where an attacker floods it with traffic so real users cannot get through. The attacker does not break in; they try to make the service unavailable. The team needs protection that absorbs these floods.
AWS Shield does that. It provides managed DDoS protection for applications running on AWS. This post covers what it is, how it fits, how it works, and a short example.
What AWS Shield is
AWS Shield is a managed service that protects applications against DDoS attacks. A DDoS attack tries to exhaust a target with traffic so legitimate users cannot reach it. Availability is a security goal, and Shield helps keep applications reachable during such an attack.
Shield has two tiers. Shield Standard is included automatically for all AWS customers at no additional cost and defends against common and most frequent network and transport layer attacks. Shield Advanced is a paid tier that adds protection for larger and more sophisticated attacks, more visibility, and access to the Shield Response Team. Shield focuses on availability, while AWS WAF filters the content of web requests.
The main parts
- Shield Standard: automatic protection for all customers against common network and transport layer attacks.
- Shield Advanced: a paid tier with protection for larger attacks, more visibility, and response support.
- Always-on detection: continuous monitoring of traffic to identify and mitigate DDoS activity.
- Shield Response Team: experts available to assist during an attack for Shield Advanced customers.
- Protected resources: CloudFront, Elastic Load Balancing, Global Accelerator, and others.
Where Shield is used
- Public websites: Shield absorbs traffic floods so the site stays reachable for real users.
- Revenue-critical services: protection helps avoid downtime during a deliberate attack.
- High-profile events: Shield Advanced adds protection and support for likely targets during launches.
- Edge-delivered apps: Shield works with CloudFront and Global Accelerator at the edge.
- Availability goals: Shield addresses the availability part of a security program.
How it works
Get AXIOMIO Social’s stories in your inbox
Join Medium for free to get updates from this writer.
Shield Standard monitors traffic automatically for all AWS customers. When a DDoS attack sends a flood of traffic, Shield detects the abnormal pattern and mitigates the malicious traffic at the network and transport layers, so legitimate traffic continues to reach the protected resource. With Shield Advanced, the team gets additional protections, more visibility, response support, and some cost protection for covered events.
A real example
Setup: a company serves its application through CloudFront and Elastic Load Balancing. Shield Standard is active automatically, and the company uses Shield Advanced because it is a likely target during a major product launch.
What happens: on launch day, an attacker starts a DDoS attack, sending a large volume of traffic to make the site unavailable at its most visible moment.
Result: the flood reaches the AWS edge, and Shield’s always-on detection identifies the abnormal pattern as a DDoS attack. Shield mitigates the malicious traffic so it does not overwhelm the application, and legitimate requests continue to pass through. With Shield Advanced, the team sees attack metrics and can engage the Shield Response Team.
Response: the team reviews the attack metrics, works with the Shield Response Team if needed, and tunes WAF rules to handle any application-layer component of the attack.
Key takeaways
- Shield is a managed service that protects against DDoS attacks.
- Shield Standard is automatic for all customers at no additional cost.
- Shield Advanced adds protection for larger attacks, visibility, and support.
- Shield addresses availability, while WAF filters web request content.
- It works with CloudFront, Elastic Load Balancing, and Global Accelerator.
- Shield and WAF are commonly used together for layered protection.
