Description
AWS provides baseline protection against common DDoS attacks. Shield Advanced is a paid service adding detection, mitigation, and response capabilities for supported resources; it is not mandatory for every resource.
Potential impact
A service that needs additional protection may otherwise fall short of its availability and response requirements during a large attack.
Remediation
Assess Shield Advanced against service criticality and cost. If adopted, verify actual protection enrollment for supported resources and the scope of Firewall Manager policies.
Examples
The hosted zone and EIP protection policy are separate configuration examples. The policy targets EIPs in the specified account and requires a Shield Advanced subscription and Firewall Manager prerequisites.
Before
yaml
Resources:
HostedZone:
Type: AWS::Route53::HostedZone
Properties:
Name: "example.com"
After
yaml
Resources:
MyEIP:
Type: AWS::EC2::EIP
Policy2:
Type: AWS::FMS::Policy
Properties:
PolicyName: EipShieldProtection
ExcludeResourceTags: false
RemediationEnabled: true
IncludeMap:
ACCOUNT:
- !Ref AWS::AccountId
ResourceType: ResourceTypeList
ResourceTypeList:
- AWS::EC2::EIP
SecurityServicePolicyData:
Type: SHIELD_ADVANCED