What is AWS Shield? A plain-English explainer
AWS Shield is AWS’s managed service for protecting applications against distributed denial-of-service (DDoS) attacks. A Standard tier is switched on automatically for every AWS customer at no extra step, and an Advanced tier is a paid option that adds more extensive protection, visibility and dedicated support for larger or more exposed workloads. Shield exists because DDoS attacks target availability rather than data, so the defence for them looks different from the access controls and encryption that protect against most other threats. Here is what a DDoS attack actually is, what Shield does about it, and how it relates to AWS WAF, the service it is most often paired with.
What a DDoS attack is
A distributed denial-of-service attack tries to make a service unavailable to legitimate users by overwhelming it with traffic, typically sent from many sources at once so it cannot easily be traced back to or blocked at a single point. The goal is not to steal data or break in — it is to exhaust capacity, whether that is network bandwidth, server resources, or the application itself, so real users cannot get through.
Because the traffic can arrive from a huge number of distributed sources simultaneously, defending against it is largely about absorbing and filtering traffic at scale, which is difficult for an individual customer to build for themselves.
What AWS Shield protects
Shield Standard protects against the most common, frequently occurring network and transport-layer DDoS attacks, and it applies automatically to resources like Elastic Load Balancing, Amazon CloudFront and Amazon Route 53 — there is nothing to turn on and no separate cost.
Shield Advanced adds broader protection against larger and more sophisticated attacks, near real-time visibility into what is happening during an event, and access to a dedicated response team, aimed at organisations running large-scale or high-profile applications where extended downtime carries a real cost.
How Shield relates to AWS WAF
Shield and AWS WAF are frequently used together, but they defend against different things. Our what-is-aws-waf explainer covers WAF in depth: it filters individual web requests at the application layer, blocking things like malicious payloads or requests that match rules you define. Shield instead protects against DDoS attacks — traffic aimed at exhausting capacity rather than crafted application-layer requests.
Put simply: Shield defends availability against volumetric and network-layer flooding; WAF defends the application against malicious individual requests. Many architectures that face the internet use both, because “too much traffic” and “bad traffic” are different problems.
Common uses
Shield Standard is relevant to essentially every internet-facing AWS workload, since it applies automatically. Shield Advanced tends to matter most for applications where availability is business-critical — public-facing sites and APIs with a large user base, organisations that have previously been targeted, or workloads where sustained downtime has a serious financial or reputational cost.
Pricing model, in one line
Shield Standard is included automatically at no extra charge; Shield Advanced is a paid subscription tier layered on top for organisations that need its broader protection and support — check AWS’s own pricing pages for current detail.
Where AWS Shield appears in certification study
Shield is core content on AWS Certified Security Specialty, where it sits alongside WAF and other edge-security services as part of a defence-in-depth architecture. It is also introduced at a lighter, conceptual level on AWS Certified Solutions Architect – Associate, mainly so learners can recognise when DDoS protection is the right service for a given scenario.
This article covers what Shield is and why it exists — the syllabus depth on Shield Advanced’s specific protections and its integration with other services belongs in the exam guide itself, which our /revision study library covers lesson by lesson.
Original practice questions, timed mock exams and revision notes. No card, nothing to pay.