# AWS Shield

> AWS's protection against DDoS attacks, on by default for everyone.

- Level: Intermediate
- Topics: AWS, Security
- URL: https://tidbit.legios.com.ar/aws-shield/
- In Spanish: [AWS Shield](https://tidbit.legios.com.ar/es/aws-shield/)

A **DDoS** attack tries to knock a site offline by burying it in traffic from thousands of hijacked machines at once. **AWS Shield** is the AWS service that absorbs and filters those floods before they reach your servers. It works at the edges of the AWS network, where there is far more capacity than any single website has.

It comes in two tiers. **Shield Standard** is free and automatic for every AWS customer: it protects against the most common network-level attacks, like floods of junk packets or half-open connections, without you doing anything. **Shield Advanced** is a paid subscription for organizations that are likely targets. It adds detection tuned to your own traffic, detailed reports during an attack, access to an AWS response team that can step in around the clock, and protection against the surprise bill when an attack makes your services scale up.

Shield and AWS WAF are usually used together. Shield handles brute-force volume at the network level; WAF handles smarter attacks that look like real web requests, such as one bot hammering the login page. Putting the site behind Amazon CloudFront helps both, since traffic then meets AWS's large edge network first.

## An analogy

A sea wall in front of a harbor town. The ordinary wall is there for everyone and stops everyday waves; towns that expect storms pay for a taller wall plus a crew on call and insurance for the damage.

## Keep in mind

- Defends against DDoS floods before they reach your resources.
- Shield Standard is free and on for every AWS account.
- Shield Advanced adds tailored detection, a response team and cost protection.
- Pairs with AWS WAF for attacks that look like normal web requests.

## Go deeper

- [How AWS Shield works (official docs)](https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html)
- [AWS Shield](https://aws.amazon.com/shield/)

## Related terms

- [DDoS](https://tidbit.legios.com.ar/ddos/): Knocking a site offline by flooding it with more traffic than it can handle.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Packet](https://tidbit.legios.com.ar/packet/): The small chunk every piece of internet data is cut into before it travels.
- [AWS WAF](https://tidbit.legios.com.ar/aws-waf/): A filter in front of your website that reads each request and blocks the bad ones.
- [Brute-force attack](https://tidbit.legios.com.ar/brute-force-attack/): Breaking into an account by trying passwords, one after another, until one works.
- [Amazon CloudFront](https://tidbit.legios.com.ar/amazon-cloudfront/): AWS's CDN: copies of your content kept close to users all over the world.
- [AWS account and billing](https://tidbit.legios.com.ar/aws-account-and-billing/): What an AWS account is, how you get charged, and how to avoid a surprise bill.