AWS Shield

AWS Shield Advanced

AWS Shield Advanced is a service that provides us with advanced protection from external threats as compared to the AWS Shield Standard. Following are some of the main features of AWS Shield Advanced:

When to use AWS Shield Advanced

AWS Shield Advanced provides expanded protection against DDoS attacks on our applications and resources. In the case of web applications hosted on the AWS cloud, we should consider using AWS Shield Advanced if the following is our applications’ requirement:

• If we want to guarantee availability for our application users at all times.

• If we require access to DDoS mitigation experts in case our application is compromised by a DDoS attack.

• If the cost for the cloud resources used by our application is predictable, and we’ll face drastic effects in case of a DDoS attack.

Following are some of the scenarios where we should opt for AWS Shield Advanced to protect our AWS resources:

• In case external users are accessing our AWS resource over the internet.

• The AWS resource is being protected using an AWS WAF web ACL.

• The resource can be accessed through the internet and is a major component of our application.

Types of DDoS attacks prevented

Following are the main types of attacks AWS Shield and AWS Shield Advanced can detect:

• Network volumetric attacks: These are the attacks that deny legitimate users access to a service by flooding it with traffic and saturating the resource’s capacity. This corresponds to a layer 3 attack.

• Network protocol attacks: In these attacks, a specific protocol to access the service is compromised to deny service to the resource. This corresponds to a layer 4 attack.

• Application layer attacks (AWS Shield Advanced only): This is a layer 7 attack that floods an application with valid queries to deny access to legitimate users.

Event detection in AWS Shield

In the case of web applications, AWS Shield detects attacks by inspecting every traffic packet that tries to access our application. However, to protect our AWS resources from various attacks, AWS Shield monitors the traffic for these resources every minute, and if it detects an increase in the normal traffic for the resource, it performs additional checks to ensure the AWS resource is not facing a DDoS attack.

AWS Shield Advanced provides additional protection on the application layer by integrating with AWS WAF and using its web ACLs. Here, AWS Shield monitors the incoming traffic with the traffic received in the past to detect any unusual traffic.