Review the need for AWS Shield Advanced

Evaluate additional protection against the service’s DDoS response needs.

Description

AWS Shield Standard provides baseline protection against common DDoS attacks. A separate Shield Advanced subscription adds detection, mitigation, and response support for eligible resources.

Potential impact

A critical service that needs this additional protection cannot use the corresponding response capabilities and support without Shield Advanced.

Remediation

Evaluate service risk and cost to choose which resources need Shield Advanced. After subscribing, associate eligible resource ARNs with aws_shield_protection and verify protection status.

Examples

The examples configure Shield Advanced protection for an Elastic IP. The actual service association is omitted, and a valid subscription is required.

Before

hcl
resource "aws_eip" "service_ip" {
  domain = "vpc"
}

After

hcl
data "aws_region" "current" {}
data "aws_caller_identity" "current" {}

resource "aws_eip" "service_ip" {
  domain = "vpc"
}

resource "aws_shield_protection" "service_ip" {
  name         = "example"
  resource_arn = "arn:aws:ec2:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:eip-allocation/${aws_eip.service_ip.id}"
}

References