Distributed Denial-of-Service (DDoS) attacks are a growing concern for organizations of all sizes. These attacks aim to overwhelm the target with massive amounts of traffic from multiple sources, rendering the service unavailable to legitimate users.
AWS Shield is a managed DDoS protection service that provides continuous monitoring and automatic mitigation of DDoS attacks on AWS resources. This tutorial will guide you through the steps to enable AWS Shield Standard and AWS Shield Advanced on your AWS accounts, and how to use AWS Shield to defend against DDoS attacks.
Prerequisites
To use AWS Shield, you need to have an AWS account. If you don’t have an AWS account, sign up at https://aws.amazon.com/.
You also need to have the required permissions to enable and configure AWS Shield. If you are the account owner, you should have these permissions by default. If you are not the account owner, you need to be granted these permissions by the account owner or an administrator.
Enable AWS Shield Standard
AWS Shield Standard is a free service that provides basic protection against common DDoS attacks for all AWS customers. Enabling AWS Shield Standard is easy and can be done in a few clicks.
- Log in to the AWS Management Console.
- Navigate to the AWS Shield console at https://console.aws.amazon.com/wafv2/home?#ddos.
- Click the Enable AWS Shield Standard button.
- Follow the on-screen instructions to enable AWS Shield Standard on your AWS account.
Once AWS Shield Standard is enabled, it provides automatic detection and mitigation of common DDoS attacks, such as SYN floods, UDP floods, and HTTP floods. AWS Shield Standard can also protect against some application-layer attacks, such as HTTP request floods.
AWS Shield Standard provides protection for all AWS resources that are publicly accessible over the internet, such as Amazon EC2 instances, Elastic Load Balancers, and Amazon S3 buckets.
While AWS Shield Standard provides basic protection against DDoS attacks, it may not be sufficient for organizations that require more advanced protection against sophisticated attacks. To enable advanced DDoS protection, you can upgrade to AWS Shield Advanced.
Upgrade to AWS Shield Advanced
AWS Shield Advanced is a paid service that provides additional features and protections beyond AWS Shield Standard. AWS Shield Advanced is designed for organizations that require advanced protection against sophisticated DDoS attacks, such as those that have the ability to bypass AWS Shield Standard protections.
Enabling AWS Shield Advanced requires a few more steps than enabling AWS Shield Standard, and comes with additional costs.
- Log in to the AWS Management Console.
- Navigate to the AWS Shield console at https://console.aws.amazon.com/wafv2/home?#ddos.
- Click the Upgrade to AWS Shield Advanced button.
- Follow the on-screen instructions to upgrade to AWS Shield Advanced.
To use AWS Shield Advanced, you also need to have Amazon CloudFront and Amazon Route 53 enabled in your AWS account. If you don’t have them enabled, follow the on-screen instructions to enable them.
AWS Shield Advanced provides the following additional features and protections:
- 24/7 access to AWS DDoS Response Team (DRT) for proactive guidance and emergency response to DDoS attacks.
- Access to AWS WAF (Web Application Firewall), which provides fine-grained control over traffic to your resources, and can block malicious traffic before it reaches your applications.
- Customized mitigation controls, which allow you to configure advanced mitigation strategies tailored to your specific needs.
- Cost protection, which provides automatic refunds for charges associated with using AWS Shield Advanced during a DDoS attack.
AWS Shield Advanced is billed based on the number of protected resources and the level of protection. For more information on AWS Shield Advanced pricing, see https://aws.amazon.com/shield/pricing/.
Using AWS Shield for DDoS Mitigation
Once AWS Shield Standard or AWS Shield Advanced is enabled, it provides continuous monitoring and automatic mitigation of DDoS attacks on your AWS resources.
AWS Shield detects DDoS attacks on your resources and automatically applies mitigations to block traffic from the attacking sources. AWS Shield uses a combination of techniques, such as rate limiting, throttling, and dropping invalid traffic, to mitigate DDoS attacks.
AWS Shield also provides detailed metrics and logging to help you understand the nature and scope of DDoS attacks, and to assist you in the investigation and reporting of incidents.
In addition to automatic mitigation, AWS Shield provides options for fine-tuning mitigation controls and customizing mitigation strategies based on your specific requirements.
AWS Shield Advanced provides access to AWS WAF, which allows you to create custom rules to block or allow traffic based on various criteria, such as IP addresses, user agents, or request methods. AWS WAF also provides protection against application-layer attacks by inspecting the content of HTTP requests and blocking malicious requests before they reach your applications.
Conclusion
DDoS attacks are a growing threat to organizations of all sizes, and can result in significant downtime, loss of revenue, and damage to reputation. AWS Shield is a managed DDoS protection service that provides continuous monitoring and automatic mitigation of DDoS attacks on AWS resources.
In this tutorial, we covered the steps to enable AWS Shield Standard and AWS Shield Advanced on your AWS accounts, and how to use AWS Shield to defend against DDoS attacks.
By enabling AWS Shield and following the best practices for DDoS mitigation, you can help protect your AWS resources from DDoS attacks and ensure the availability and performance of your applications and services.