Skip to main content
This lesson explains how AWS Shield protects against DDoS attacks and when to use Shield Standard vs Shield Advanced. DDoS (Distributed Denial of Service) is a malicious attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. Attacks aim to exhaust network, compute, or application resources so legitimate users cannot access the service.
A diagram titled "DDoS Attack" showing a hacker on the left controlling multiple robot/bot icons that send dotted arrows to a target server on the right. It illustrates bots flooding the target with traffic to overwhelm it.
AWS Shield is a managed DDoS protection service for applications hosted on AWS. It operates at the AWS edge to detect and automatically mitigate common volumetric and protocol-layer attacks. Shield is available in two tiers: Shield Standard and Shield Advanced.
AWS Shield Standard is enabled automatically and at no extra cost for all AWS customers. It provides protection against the most common network- and transport-layer DDoS attacks at the AWS edge.
An AWS architecture diagram titled "AWS Shield and Shield Advanced." It shows attacker and legitimate user traffic flowing through AWS services (DNS, WAF/CDN, etc.) protected by Shield into a VPC public subnet hosting compute instances.

​
Shield Standard vs Shield Advanced — Quick Comparison

​
When to choose which tier

  • Choose Shield Standard if:
    • You run low-to-moderate risk workloads on AWS edge services such as CloudFront or Route 53.
    • You want basic, automatic protection against large, common network- and transport-layer attacks at no cost.
  • Choose Shield Advanced if:
    • You operate production or business-critical workloads that require higher SLAs and rapid support during incidents.
    • You need 24/7 access to the AWS DDoS Response Team (DRT) and proactive incident planning.
    • You require DDoS cost protection to mitigate unexpected scaling charges.
    • You want integrated, automated Layer 7 protections with AWS WAF and advanced telemetry with Route 53.
Shield Advanced is a paid subscription. Evaluate current AWS Shield pricing and your expected coverage before enabling it, and review the eligibility and configuration requirements for DDoS cost protection. See the official AWS Shield pricing and documentation for details.

​
Key capabilities & integrations

​
Practical guidance

  • Start by ensuring Shield Standard protections are active (they are automatic). Monitor traffic and set up logging/metrics for unusual patterns.
  • For production workloads that cannot tolerate downtime or unexpected costs, evaluate Shield Advanced and consult AWS for a preparedness plan.
  • Combine Shield (edge-level mitigation) with AWS WAF (application-layer rules) and CloudFront/Global Accelerator to harden the entire traffic path.
  • Document runbooks and test failover/route configurations with Route 53 health checks to validate responses during simulated incidents.
Always review the current AWS documentation and pricing before making protection and procurement decisions, as service features and billing terms can change.

Watch Video