AWS Shield for DDoS protection - Commands & Configuration

Introduction

DDoS attacks try to overwhelm your website or app with too much traffic, making it slow or unreachable. AWS Shield helps protect your resources by automatically blocking these attacks so your service stays available.

When you run a website that must stay online even if attacked by many fake visitors.

When you host an online game that needs to prevent cheating or disruption from traffic floods.

When you operate an API that clients rely on and cannot afford downtime from attacks.

When you manage a web application behind a load balancer and want automatic attack protection.

When you want simple, automatic defense without needing to configure complex firewall rules.

Commands

This command enables AWS Shield protection on your load balancer by specifying its ARN. It activates automatic DDoS defense for that resource.

Terminal

aws shield create-protection --name my-web-app-protection --resource-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188

Expected Output

{

    "ProtectionId": "1234abcd-12ab-34cd-56ef-1234567890ab",

    "ProtectionArn": "arn:aws:shield::123456789012:protection/1234abcd-12ab-34cd-56ef-1234567890ab"

}

→

--name - Sets a friendly name for the protection to identify it later

→

--resource-arn - Specifies the exact AWS resource to protect

This command lists all the resources currently protected by AWS Shield in your account, so you can verify your protections.

Terminal

aws shield list-protections

Expected Output

{

    "Protections": [

        {

            "Id": "1234abcd-12ab-34cd-56ef-1234567890ab",

            "Name": "my-web-app-protection",

            "ResourceArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188"

        }

    ]

}

This command removes the AWS Shield protection from the specified resource when you no longer want automatic DDoS defense on it.

Terminal

aws shield delete-protection --protection-id 1234abcd-12ab-34cd-56ef-1234567890ab

Expected Output

No output (command runs silently)

→

--protection-id - Specifies which protection to delete by its unique ID

Key Concept

If you remember nothing else from this pattern, remember: AWS Shield automatically protects your AWS resources from DDoS attacks by enabling protection on specific resource ARNs.

Common Mistakes

Trying to protect a resource without specifying the correct ARN.

AWS Shield needs the exact ARN to know which resource to protect; without it, the command fails.

Find the resource ARN in the AWS console or CLI and use it exactly in the create-protection command.

Assuming AWS Shield protection is enabled by default on all resources.

AWS Shield Standard protects some services automatically, but advanced protection must be enabled per resource.

Explicitly run the create-protection command for resources needing AWS Shield Advanced protection.

Deleting protection without confirming the protection ID.

Deleting the wrong protection can leave critical resources unprotected or remove protection unintentionally.

Use list-protections to verify the protection ID before deleting.

Summary

Use 'aws shield create-protection' with the resource ARN to enable DDoS protection on that resource.

Verify active protections with 'aws shield list-protections' to see which resources are protected.

Remove protection when no longer needed using 'aws shield delete-protection' with the protection ID.

Practice

1. What is the main purpose of AWS Shield?

easy

A. To protect AWS resources from DDoS attacks

B. To store data securely in the cloud

C. To monitor user activity on AWS

D. To manage AWS billing and costs

Solution

1. Step 1: Understand AWS Shield's function

   AWS Shield is designed to protect AWS resources from Distributed Denial of Service (DDoS) attacks that try to overwhelm services.

2. Step 2: Compare options with AWS Shield's purpose

   Only To protect AWS resources from DDoS attacks correctly describes AWS Shield's main role as protection against DDoS attacks.

3. Final Answer:

   To protect AWS resources from DDoS attacks -> Option A

4. Quick Check:

   AWS Shield = DDoS protection [OK]

Hint: AWS Shield = DDoS defense for AWS resources [OK]

Common Mistakes:

• Confusing AWS Shield with storage services
• Thinking AWS Shield manages billing
• Assuming AWS Shield monitors user activity

2. Which AWS Shield tier provides additional support and advanced protections?

easy

A. AWS Shield Standard

B. AWS Shield Basic

C. AWS Shield Advanced

D. AWS Shield Premium

Solution

1. Step 1: Identify AWS Shield tiers

   AWS Shield has two main tiers: Basic and Advanced. Basic offers automatic protection, Advanced adds extra features and support.

2. Step 2: Match tier with advanced features

   Only AWS Shield Advanced provides additional protections and 24/7 support.

3. Final Answer:

   AWS Shield Advanced -> Option C

4. Quick Check:

   Advanced tier = extra protection and support [OK]

Hint: Advanced = extra protection and support [OK]

Common Mistakes:

• Confusing Basic with Advanced tier
• Assuming Standard or Premium tiers exist
• Mixing up tier names

3. Given this AWS Shield setup code snippet, what resource is being protected?

aws_shield_protection = {
  "Name": "MyCloudFrontDistribution",
  "ResourceArn": "arn:aws:cloudfront::123456789012:distribution/EDFDVBD632BHDS5"
}

medium

A. An EC2 instance

B. An RDS database

C. An S3 bucket

D. A CloudFront distribution

Solution

1. Step 1: Analyze the ResourceArn

   The ARN contains "cloudfront" and "distribution", indicating the resource is a CloudFront distribution.

2. Step 2: Match resource type to options

   Only A CloudFront distribution matches a CloudFront distribution; others are different AWS services.

3. Final Answer:

   A CloudFront distribution -> Option D

4. Quick Check:

   ResourceArn with cloudfront = CloudFront distribution [OK]

Hint: Look for 'cloudfront' in ARN to identify resource type [OK]

Common Mistakes:

• Assuming EC2 or S3 from ARN without checking
• Ignoring ARN format details
• Confusing resource types

4. You configured AWS Shield Advanced but your Elastic Load Balancer (ELB) is still not protected. What is the likely issue?

medium

A. AWS Shield does not support ELB protection

B. You forgot to associate the ELB with AWS Shield protection

C. You need to enable AWS Shield Basic first

D. AWS Shield only protects EC2 instances

Solution

1. Step 1: Understand AWS Shield Advanced usage

   AWS Shield Advanced requires you to explicitly associate resources like ELB to enable protection.

2. Step 2: Evaluate options for ELB protection

   You forgot to associate the ELB with AWS Shield protection correctly identifies the missing association step. Options B, C, and D are incorrect because ELB is supported, Basic is automatic, and Shield protects multiple resource types.

3. Final Answer:

   You forgot to associate the ELB with AWS Shield protection -> Option B

4. Quick Check:

   Associate resources to Shield Advanced for protection [OK]

Hint: Associate ELB explicitly with Shield Advanced [OK]

Common Mistakes:

• Assuming ELB is auto-protected
• Thinking Shield only protects EC2
• Believing Shield Basic must be enabled first

5. Your company wants to protect a global web application using AWS Shield Advanced. Which combination of AWS services should you protect to ensure best DDoS defense?

hard

A. Protect CloudFront distributions and Elastic Load Balancers

B. Protect only EC2 instances running the web servers

C. Protect S3 buckets storing static content

D. Protect RDS databases and DynamoDB tables

Solution

1. Step 1: Identify key services for global web app delivery

   CloudFront distributes content globally and ELB balances traffic to servers, both critical for DDoS protection.

2. Step 2: Evaluate protection targets

   Protecting CloudFront and ELB covers edge and traffic distribution points. Protecting only EC2 misses edge protection. S3 and databases are less exposed to DDoS.

3. Final Answer:

   Protect CloudFront distributions and Elastic Load Balancers -> Option A

4. Quick Check:

   Shield Advanced protects CloudFront + ELB for best defense [OK]

Hint: Protect edge (CloudFront) and traffic points (ELB) [OK]

Common Mistakes:

• Protecting only backend servers
• Ignoring CloudFront's role
• Trying to protect databases for DDoS