c3.18 Mitigate DDoS attacks
AWS Shield Standard is free and on by every account, protecting against common layer 3/4 volumetric attacks. For higher-value workloads, Shield Advanced adds layer 7 protection, a 24x7 response team, cost protection, and unlimited AWS WAF and Firewall Manager.
Implementation guidance
Shield Standard is always on
AWS Shield Standard is enabled on every account at no cost and defends against common network and transport layer (layer 3/4) volumetric attacks such as SYN floods and UDP reflection.
When to add Shield Advanced
AWS Shield Advanced is worth enabling for higher-value, internet-facing workloads. It adds:
- Layer 7 (and layer 6) protection against HTTP floods, DNS query floods, and TLS abuse.
- A 24x7 Shield Response Team that helps analyze and filter attack traffic and reviews your architecture's resilience.
- Cost protection that credits back scaling charges caused by a DDoS attack.
- CloudWatch metrics and a global DDoS threat dashboard.
- Unlimited use of AWS WAF and AWS Firewall Manager (some conditions apply).
Register your protected resources (ALBs, CloudFront, API Gateway, etc.) — you can do this at scale, at no additional cost, with AWS Firewall Manager.
Third-party alternatives
For layer 7 DDoS mitigation, prefer an elastic service over self-hosted appliances (attack volume can overwhelm autoscaling). If you use a third-party CDN (CloudFront alternative, Cloudflare, Akamai), confirm DDoS mitigation is included, and note that pointing your domains there makes that provider a dependency in the traffic path.
How to validate
- Is Shield Advanced enabled for your high-value, internet-facing workloads?
- Are all relevant resources (ALB, CloudFront, API Gateway) registered as protected (for example via Firewall Manager)?
- Have you configured health checks and automatic application-layer mitigation?
- If using a third-party service, is DDoS mitigation actually included and applied consistently?
Threats addressed
- A distributed denial-of-service attack can take an internet-facing application offline and drive up cost through forced scaling; layer 7 attacks in particular can slip past network-layer defenses.
AWS services
AWS Shield 
AWS WAF 
AWS Firewall Manager Pricing
See AWS Shield pricing.