AWS Shield
DDoS protection
DDoS protection: Shield Standard is free and automatically enabled for every customer at layers 3/4; Shield Advanced is paid and adds layer 7 protection, support from the DDoS response team, and cost protection for scaling caused by attacks.
- Cost$$$ High
- Difficulty●●●●●
- Costs money when idle?Yes
- Serverless
- In examsCLF · SAA · SOA
Think of it asLike a seawall: everyone gets the basic version, and the advanced version adds a rescue team.
When to use it
✓ Use it when
Critical Internet-facing apps that need advanced DDoS protection (Advanced).
✗ Avoid it when
Blocking application attacks like SQLi/XSS → WAF.
Common uses
- Protect CloudFront/Route 53 from SYN floods
- Shield Advanced for a large e-commerce site
- Get scaling costs credited back during an attack
What does it cost?
- Pricing model: Standard is free; Advanced charges a fixed monthly fee per Organization (1-year commitment) plus data transfer out fees.
⚠️ Cost traps
Advanced has a 1-year commitment — you can't just turn it on to try and then turn it off.
Related services
SAA-C03 study guide
Shield is covered in these study modules: