AWS Shield: Standard vs Advanced, Pricing, and AWS WAF

The simple explanation

A DDoS attack floods your application with so much junk traffic that real users cannot get through. Picture a restaurant where a thousand fake customers pack the lobby so paying diners can never reach a table. That is what a DDoS attack does to your servers.

AWS Shield is the bouncer at the door. It inspects incoming traffic at the edge of AWS’s network and turns away the obvious fakes before they reach your resources. Shield Standard is the bouncer every restaurant gets for free: it handles the rowdy crowds and obvious troublemakers. Shield Advanced is the premium security team: they monitor cameras in real time, call in specialists during a crisis, and cover the cost if someone trashes the place.

How AWS Shield works

Shield protection operates at multiple layers of the AWS global network:

• Edge protection. Traffic entering AWS first passes through edge locations, the same network that powers Route 53 and CloudFront. Shield filters obvious volumetric floods here, before they ever reach your region.
• Regional protection. Within an AWS region, Shield monitors traffic to your Application Load Balancers, EC2 instances, and other resources for patterns that indicate an attack.

Layer 3/4 vs Layer 7: what that means

Think of your application as a building. Layer 3/4 attacks try to block the roads leading to it (flooding the network pipes). Layer 7 attacks walk through the front door and waste everyone’s time with fake requests (overloading your application logic).

• Layer 3/4 (network attacks) try to overwhelm your bandwidth or exhaust connection limits. Examples: SYN floods, UDP reflection attacks, DNS amplification. Both Shield Standard and Advanced handle these.
• Layer 7 (application attacks) send requests that look like real traffic but are designed to overload your application. Examples: HTTP floods, slowloris attacks, requests targeting expensive API endpoints. These require AWS WAF rules to detect and block. Shield Advanced integrates directly with WAF for this layer.

AWS Shield Standard vs Shield Advanced

AWS Shield vs AWS WAF

This is one of the most common points of confusion for beginners. Shield and WAF are complementary, not interchangeable.

Think of it this way: Shield is the flood barrier that keeps the river from washing away your building. WAF is the security checkpoint at the front door that inspects every person walking in. You would not replace one with the other.

• Shield protects against volumetric and protocol-level DDoS attacks, the kind that try to overwhelm your network capacity or exhaust connection state. Think floods of raw packets.
• WAF (Web Application Firewall) inspects HTTP/HTTPS requests and blocks malicious patterns: SQL injection, cross-site scripting, HTTP floods, bot traffic, and custom rules you define.

For a broader view of how these services fit into your overall AWS security posture, see AWS Security Hub.

Which resources can Shield protect?

Shield Standard (automatic)

These resource types are protected automatically for every AWS account. No configuration needed:

• Amazon EC2 instances
• Elastic Load Balancers (ALB, NLB, CLB)
• Amazon CloudFront distributions
• AWS Global Accelerator accelerators
• Amazon Route 53 hosted zones

Shield Advanced (explicit enrollment required)

The same resource types are eligible, but you must explicitly add each resource to a Shield Advanced protection. Subscribing to Advanced does not automatically protect everything. Resources you do not enroll receive only Standard-level coverage.

• Amazon EC2 Elastic IP addresses
• Elastic Load Balancers (Application and Network)
• Amazon CloudFront distributions
• AWS Global Accelerator accelerators
• Amazon Route 53 hosted zones

When Shield Standard is enough

For many AWS workloads, Shield Standard combined with good architecture is sufficient:

• Internal or low-traffic applications. APIs serving a known set of clients, admin dashboards, staging environments.
• Applications behind CloudFront. CloudFront absorbs a significant amount of volumetric traffic before it reaches your origin. For sites that are not high-value DDoS targets, this is often enough.
• Workloads with low business impact from brief outages. If a few hours of degraded performance would not cause major financial or reputational damage.
• Small teams without dedicated security operations. If nobody on your team would use the real-time metrics or DRT access, those Advanced features go unused.

When Shield Advanced is worth it

• High-value internet-facing applications. E-commerce, financial services, gaming, media streaming, or any app where minutes of downtime mean real revenue loss.
• Revenue-sensitive workloads with SLAs. If downtime triggers SLA penalties or customer churn.
• Public-facing services likely to be targeted. Government, healthcare, or organizations that attract politically motivated attacks.
• Teams that need real-time attack visibility. The metrics, dashboards, and attack summaries Advanced provides are valuable for incident response and post-attack analysis.
• Workloads where attack-driven scaling costs are a risk. A large DDoS attack can cause auto-scaling to spin up resources that generate a massive bill. Shield Advanced’s financial protection covers these costs with credits.
• Organizations without 24/7 DDoS expertise. The DDoS Response Team provides expert support during attacks without requiring in-house specialists.

Pricing and billing gotchas

Shield Standard is free. No charges, no signup.

Shield Advanced pricing has two components:

• $3,000 per month per organization. This is the base subscription. It covers all accounts in your AWS Organization under one fee (not per-account or per-resource).
• Data transfer fees. Shield Advanced charges for data transfer out (DTO) on protected resources beyond what you would normally pay. The exact rates depend on the resource type and region. Check the AWS Shield pricing page for current DTO rates.

The subscription auto-renews and has a one-year commitment. You cannot cancel mid-year without continuing to be billed for the remainder.

Financial protection

During a DDoS attack, auto-scaling and traffic absorption can spike your bill for EC2, ELB, CloudFront, Global Accelerator, and Route 53. Shield Advanced offers cost credits for charges directly caused by a DDoS event. You submit a request through AWS Support, and AWS reviews whether the charges qualify.

Operational prerequisites most guides skip

Two details that materially affect how you use Shield Advanced:

How to enable Shield Advanced

You can enable Shield Advanced through the AWS console (Shield > Getting started > Subscribe to Shield Advanced) or through the CLI. Here is the CLI workflow:

Subscribe and add protections

# Step 1: Subscribe your account/organization to Shield Advanced.
# This starts the $3,000/month billing and one-year commitment.
aws shield create-subscription

# Step 2: Add a protection for a specific resource.
# Replace the ARN with your actual ALB, CloudFront distribution, EIP, etc.
aws shield create-protection \
  --name "Production ALB Protection" \
  --resource-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/prod-alb/xxxxxxxxxxxxxxxx

# Step 3: Verify your protections are in place.
aws shield list-protections

# Step 4: Inspect a specific protection.
aws shield describe-protection \
  --protection-id protection-id-here

Enable proactive engagement

Proactive engagement lets the DRT contact you automatically when a Route 53 health check detects degradation on a protected resource. You need to associate a health check first, then enable the feature and set emergency contacts.

# Enable proactive engagement (requires health checks on protected resources)
aws shield enable-proactive-engagement

# Share your CloudFront or ALB access logs with the DRT for faster analysis
aws shield associate-drt-log-bucket \
  --log-bucket my-cloudfront-access-logs-bucket

# Set emergency contacts so the DRT can reach your team during an attack
aws shield update-emergency-contact-settings \
  --emergency-contact-list EmailAddress=security@company.com PhoneNumber="+12125551234"