Description
AWS Shield Standard provides baseline protection against common DDoS attacks. A separate Shield Advanced subscription adds detection, mitigation, and response support for eligible resources.
Potential impact
A critical service that needs this additional protection cannot use the corresponding response capabilities and support without Shield Advanced.
Remediation
Evaluate service risk and cost to choose which resources need Shield Advanced. After subscribing, associate eligible resource ARNs with aws_shield_protection and verify protection status.
Examples
The examples configure Shield Advanced protection for an Elastic IP. The actual service association is omitted, and a valid subscription is required.
Before
hcl
resource "aws_eip" "service_ip" {
domain = "vpc"
}
After
hcl
data "aws_region" "current" {}
data "aws_caller_identity" "current" {}
resource "aws_eip" "service_ip" {
domain = "vpc"
}
resource "aws_shield_protection" "service_ip" {
name = "example"
resource_arn = "arn:aws:ec2:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:eip-allocation/${aws_eip.service_ip.id}"
}