Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS Shield is a managed Distributed Denial of Service (DDoS) protection service. It detects and helps mitigate attacks intended to exhaust network, transport, or application resources by sending large volumes of malicious or malformed traffic.
For SAP-C02, the most important distinction is between AWS Shield Standard and AWS Shield Advanced, including their capabilities, service integration, and operational support.
Key Concepts
DDoS attacks
A DDoS attack uses traffic from many distributed sources—often compromised systems or bots—to overwhelm an application or its supporting infrastructure. The attack may target different layers of the network stack and may use malformed or carefully crafted requests intended to evade basic filtering.
Potential consequences include:
- Resource exhaustion
- Application downtime
- Increased latency
- Higher infrastructure or data-transfer costs
- Degraded customer experience
DDoS protection must continuously detect evolving attack patterns and apply mitigations without unnecessarily blocking legitimate users.
AWS Shield as a managed service
AWS Shield provides always-on DDoS detection and automated, inline mitigation. It is designed to reduce the likelihood that an attack causes downtime or excessive latency.
Shield is closely associated with Amazon CloudFront and is presented alongside AWS WAF, although the services address different security concerns:
- AWS Shield: Managed DDoS protection
- AWS WAF: Configurable web application firewall for filtering HTTP and HTTPS requests using rules
- Amazon CloudFront: Global content delivery and edge service that can absorb and filter traffic closer to users
Shield and WAF are complementary. Shield is not a replacement for application-layer WAF rules.
Shield Standard
Shield Standard is included at no additional charge and is enabled by default for eligible AWS edge services, including Amazon CloudFront. It provides baseline DDoS protection and network-flow monitoring for supported AWS services.
Standard is appropriate when an application needs the default AWS DDoS protections but does not require the additional visibility, customization, cost protections, or response support available with Advanced.
Shield Advanced
Shield Advanced provides additional DDoS protection and operational capabilities for organizations with higher availability requirements or greater exposure to attacks. Capabilities associated with Advanced include:
- More extensive monitoring, including application-layer traffic monitoring
- Additional protection and mitigation capabilities
- Greater visibility into detected events
- Access to the AWS Shield Response Team for qualifying incidents and assistance
- Features intended to help address certain cost impacts associated with DDoS attacks
The source material identifies Shield Advanced as a paid service priced at approximately $3,000 USD per month with a one-year commitment. Always verify current AWS pricing and terms before making a production decision.
Exam-Relevant Takeaways
- AWS Shield protects against DDoS attacks.
- Shield Standard is included at no additional cost and provides baseline protection.
- Shield Standard is integrated with and enabled by default for Amazon CloudFront.
- Shield Advanced is required for advanced monitoring and additional protection features.
- Shield Advanced includes access to specialized AWS DDoS response support.
- AWS WAF and AWS Shield solve different problems: WAF filters web requests according to configured rules, while Shield provides managed DDoS protection.
- Choose Shield Advanced when the scenario emphasizes mission-critical public applications, enhanced DDoS visibility, application-layer monitoring, specialized AWS response assistance, or concern about attack-related cost impact.
- Do not accidentally subscribe to Shield Advanced without confirming the pricing model and commitment.
Architecture Decision Guide
| Requirement | Recommended capability | Reason |
|---|---|---|
| Baseline DDoS protection for a CloudFront distribution | Shield Standard | Included by default and provides foundational protection |
| No-cost, always-on protection for supported AWS edge services | Shield Standard | Standard protection is automatically available |
| Application-layer traffic monitoring for DDoS events | Shield Advanced | Advanced provides additional monitoring capabilities |
| Specialized AWS assistance during a significant DDoS event | Shield Advanced | Includes access to the AWS Shield Response Team |
| Filtering requests based on IPs, headers, URI paths, rate patterns, or application rules | AWS WAF, potentially with Shield | WAF provides configurable web request filtering; Shield handles DDoS protection |
| Global traffic absorption and edge-based protection | CloudFront with Shield | CloudFront places the application at AWS edge locations and integrates with Shield |
| Protection against a broad range of application security threats | WAF plus appropriate AWS security controls | Shield alone is not a general-purpose web application firewall |
Common Exam Traps
- Confusing Shield with WAF: Shield is primarily a DDoS protection service. WAF uses explicit rules to control web requests.
- Assuming Standard requires a subscription: Shield Standard is included at no additional charge for supported services.
- Assuming Standard provides every Shield feature: Advanced monitoring, response support, and other enhanced capabilities require Shield Advanced.
- Treating CloudFront as optional in every DDoS design: CloudFront is commonly part of a resilient public application architecture because it distributes traffic globally and integrates with Shield.
- Selecting Shield Advanced solely because an application is public: Public exposure alone does not automatically justify the cost. Look for requirements such as enhanced monitoring, response assistance, or stronger DDoS-related cost protection.
- Using Shield as a replacement for WAF: Shield does not replace carefully designed WAF rules for application-layer request filtering.
- Ignoring the Advanced pricing commitment: A scenario may test whether the organization understands that Advanced is a significant paid commitment rather than a free feature toggle.
Real-World Engineer Notes
- Put internet-facing applications behind an appropriate edge architecture, commonly Amazon CloudFront, and use AWS WAF for application-specific filtering.
- Treat DDoS protection as one layer of defense. Combine it with secure application design, least-privilege IAM, network controls, logging, monitoring, and capacity planning.
- Define an incident process before an attack occurs. Identify escalation contacts, dashboards, runbooks, and criteria for engaging AWS support or the Shield Response Team.
- Monitor for both availability impact and unexpected cost changes. An attack can degrade service even when the application remains technically reachable.
- Confirm current Shield Advanced pricing, eligibility, and cost-protection terms directly in AWS documentation because commercial details can change.
Quick Reference Summary
- AWS Shield: Managed DDoS protection service.
- Shield Standard: Free, enabled by default for supported AWS services such as CloudFront, and provides baseline protection.
- Shield Advanced: Paid tier with enhanced monitoring, additional protection capabilities, and AWS DDoS response assistance.
- AWS WAF: Configurable web application firewall; complementary to Shield.
- CloudFront: Global edge service commonly used with Shield to distribute and absorb public traffic.
- Core exam rule: Standard provides baseline protection; Advanced is required for enhanced DDoS capabilities and response support.
Flashcards
- Q: What problem does AWS Shield address?
A: Distributed Denial of Service attacks that attempt to exhaust application or infrastructure resources.
- Q: What is AWS Shield Standard?
A: The baseline, no-additional-cost DDoS protection tier that is enabled by default for supported AWS services.
- Q: Which AWS service is Shield Standard integrated with by default?
A: Amazon CloudFront.
- Q: What is the primary difference between Shield Standard and Advanced?
A: Advanced provides additional monitoring, protection capabilities, and operational response support beyond Standard.
- Q: Which Shield tier provides application-layer traffic monitoring?
A: Shield Advanced.
- Q: What is the role of the AWS Shield Response Team?
A: It provides specialized AWS assistance during qualifying DDoS events for Shield Advanced customers.
- Q: Does AWS Shield replace AWS WAF?
A: No. Shield provides DDoS protection, while WAF applies configurable rules to web requests.
- Q: Why is CloudFront useful in a DDoS protection architecture?
A: It distributes traffic across AWS edge locations and integrates with Shield, helping protect origins from direct traffic concentration.
- Q: What should be verified before selecting Shield Advanced?
A: Current pricing, commitment terms, required features, and whether the organization needs enhanced monitoring or response support.
Practice Questions
Question 1
A company hosts a public HTTPS application behind an Amazon CloudFront distribution. It wants baseline DDoS protection without adding a separate monthly subscription. Which option best meets the requirement?
A. Subscribe to Shield Advanced
B. Enable Shield Standard
C. Replace CloudFront with AWS WAF
D. Deploy a network ACL with deny rules for all unknown IP addresses
Correct answer: B. Enable Shield Standard
Explanation: Shield Standard is included at no additional cost and provides baseline DDoS protection for supported services, including CloudFront. AWS WAF and network ACLs do not replace managed DDoS protection.
Question 2
A financial services application requires application-layer DDoS traffic monitoring and access to specialized AWS assistance during a major attack. Which solution should the architect recommend?
A. Shield Standard only
B. AWS WAF only
C. Shield Advanced, optionally combined with AWS WAF
D. Security groups attached to the application servers
Correct answer: C. Shield Advanced, optionally combined with AWS WAF
Explanation: Shield Advanced provides enhanced monitoring and access to the AWS Shield Response Team. WAF may be added for configurable HTTP and HTTPS request filtering, but it does not provide the full Shield Advanced capability set by itself.
Question 3
An architect is reviewing a design that proposes AWS WAF to protect an application from all DDoS attacks. Which correction is most accurate?
A. WAF should be removed because Shield automatically handles all web filtering.
B. WAF and Shield are complementary; WAF filters requests and Shield provides managed DDoS protection.
C. WAF only protects private subnets, while Shield protects public subnets.
D. WAF provides DDoS protection only when Shield Advanced is disabled.
Correct answer: B. WAF and Shield are complementary; WAF filters requests and Shield provides managed DDoS protection.
Explanation: AWS WAF uses configured rules to inspect and control web requests. AWS Shield is designed to detect and mitigate DDoS attacks. A robust public application may use both.
Question 4
A company is considering Shield Advanced solely because its application is internet-facing. The application currently uses CloudFront and has no requirement for enhanced monitoring, AWS DDoS response assistance, or additional DDoS-related protections. What is the best initial recommendation?
A. Use Shield Standard and reassess Advanced against explicit business requirements.
B. Purchase Shield Advanced because all public applications require it.
C. Disable CloudFront because Shield Standard cannot protect edge services.
D. Use only security groups because DDoS traffic is always blocked at the instance level.
Correct answer: A. Use Shield Standard and reassess Advanced against explicit business requirements.
Explanation: Shield Standard provides baseline protection at no additional cost. Advanced is a significant paid commitment and should be selected when its enhanced capabilities and support justify the expense.