Flash card
AWS Shield Advanced: subscription DDoS protection with expert response, cost protection, and richer visibility.
- Shield Standard is automatic and free for all customers, defending common layer 3 and layer 4 attacks; Advanced is a paid subscription with a term commitment.
- Includes access to the Shield Response Team during an attack, which is one of the things the subscription actually buys.
- Cost protection refunds scaling charges caused by a protected attack, which is often the deciding argument in a scenario about the bill.
- Protects specific resource types, including CloudFront distributions, Route 53 hosted zones, Global Accelerator, ALBs and Elastic IPs.
- Includes AWS WAF at no additional charge on protected resources, plus health-based detection for lower false positives.
Pick it when
Pick it when the scenario names a business that cannot absorb downtime or the scaling bill from an attack, and wants someone to call. Pick it over WAF alone when the concern is flood volume rather than the content of requests.
It's the wrong answer when
It is the wrong answer for application-layer exploits, which are WAF rules whether or not Shield is present, and for a workload whose exposure does not justify a standing subscription. Any option offering Shield Advanced to stop SQL injection is a distractor.