AWS Shield for DDoS protection - Mini Project: Build & Apply

AWS Shield for DDoS Protection

📖 Scenario: You are managing a web application hosted on AWS. To protect your application from Distributed Denial of Service (DDoS) attacks, you want to enable AWS Shield Advanced for enhanced security.

🎯 Goal: Set up AWS Shield Advanced protection for your AWS resource by creating a protection resource and associating it with your web application's Elastic Load Balancer (ELB).

📋 What You'll Learn

Create a protection resource in AWS Shield named MyWebAppProtection

Associate the protection with an existing Elastic Load Balancer named MyWebAppELB

Use AWS CloudFormation syntax for the configuration

Follow AWS best practices for resource naming and configuration

💡 Why This Matters

🌍 Real World

Protecting web applications and APIs from DDoS attacks is critical to maintain availability and performance. AWS Shield Advanced provides enhanced detection and mitigation.

💼 Career

Cloud engineers and security specialists often configure AWS Shield to safeguard infrastructure and ensure business continuity.

1

Create the AWS Shield Protection Resource

Create a CloudFormation resource of type AWS::Shield::Protection with the name MyWebAppProtection. Set the Name property to MyWebAppProtection. Do not add any other properties yet.

AWS

# Define AWS Shield Protection resource with name MyWebAppProtection
# Your code here

Hint

Use the Resources section to define the Shield protection resource with the exact name MyWebAppProtection.

2

Add the Resource ARN for the Elastic Load Balancer

Add the ResourceArn property to the MyWebAppProtection resource. Set its value to the ARN of the Elastic Load Balancer named MyWebAppELB using the CloudFormation intrinsic function !Sub with the pattern arn:aws:elasticloadbalancing:${AWS::Region}:${AWS::AccountId}:loadbalancer/app/MyWebAppELB/1234567890abcdef.

AWS

Resources:
  MyWebAppProtection:
    Type: AWS::Shield::Protection
    Properties:
      Name: MyWebAppProtection
      # Add ResourceArn property here
      # Your code here

Hint

Use !Sub to build the ARN dynamically with region and account ID.

3

Add the Protection Group for Better Management

Create a new resource of type AWS::Shield::ProtectionGroup named MyWebAppProtectionGroup. Set the Aggregation property to SUM, the Pattern property to ARBITRARY, and the ProtectionGroupId to MyWebAppGroup. Then, update the MyWebAppProtection resource to include the ProtectionGroupId property set to MyWebAppGroup.

AWS

Resources:
  MyWebAppProtection:
    Type: AWS::Shield::Protection
    Properties:
      Name: MyWebAppProtection
      ResourceArn: !Sub arn:aws:elasticloadbalancing:${AWS::Region}:${AWS::AccountId}:loadbalancer/app/MyWebAppELB/1234567890abcdef
      # Add ProtectionGroupId here
  # Define ProtectionGroup resource here
  # Your code here

Hint

Define the protection group first, then link it in the protection resource.

4

Enable Automatic Response with Shield Advanced

Add the HealthCheckArns property to the MyWebAppProtection resource. Set it to a list containing the ARN of a health check with the value arn:aws:route53:::healthcheck/abcdef12-3456-7890-abcd-ef1234567890. This enables AWS Shield to monitor your resource health automatically.

AWS

Resources:
  MyWebAppProtectionGroup:
    Type: AWS::Shield::ProtectionGroup
    Properties:
      Aggregation: SUM
      Pattern: ARBITRARY
      ProtectionGroupId: MyWebAppGroup
  MyWebAppProtection:
    Type: AWS::Shield::Protection
    Properties:
      Name: MyWebAppProtection
      ResourceArn: !Sub arn:aws:elasticloadbalancing:${AWS::Region}:${AWS::AccountId}:loadbalancer/app/MyWebAppELB/1234567890abcdef
      ProtectionGroupId: MyWebAppGroup
      # Add HealthCheckArns property here
      # Your code here

Hint

Use a list for HealthCheckArns even if it contains only one ARN.

Practice

1. What is the main purpose of AWS Shield?

easy

A. To protect AWS resources from DDoS attacks

B. To store data securely in the cloud

C. To monitor user activity on AWS

D. To manage AWS billing and costs

Solution

1. Step 1: Understand AWS Shield's function

   AWS Shield is designed to protect AWS resources from Distributed Denial of Service (DDoS) attacks that try to overwhelm services.

2. Step 2: Compare options with AWS Shield's purpose

   Only To protect AWS resources from DDoS attacks correctly describes AWS Shield's main role as protection against DDoS attacks.

3. Final Answer:

   To protect AWS resources from DDoS attacks -> Option A

4. Quick Check:

   AWS Shield = DDoS protection [OK]

Hint: AWS Shield = DDoS defense for AWS resources [OK]

Common Mistakes:

• Confusing AWS Shield with storage services
• Thinking AWS Shield manages billing
• Assuming AWS Shield monitors user activity

2. Which AWS Shield tier provides additional support and advanced protections?

easy

A. AWS Shield Standard

B. AWS Shield Basic

C. AWS Shield Advanced

D. AWS Shield Premium

Solution

1. Step 1: Identify AWS Shield tiers

   AWS Shield has two main tiers: Basic and Advanced. Basic offers automatic protection, Advanced adds extra features and support.

2. Step 2: Match tier with advanced features

   Only AWS Shield Advanced provides additional protections and 24/7 support.

3. Final Answer:

   AWS Shield Advanced -> Option C

4. Quick Check:

   Advanced tier = extra protection and support [OK]

Hint: Advanced = extra protection and support [OK]

Common Mistakes:

• Confusing Basic with Advanced tier
• Assuming Standard or Premium tiers exist
• Mixing up tier names

3. Given this AWS Shield setup code snippet, what resource is being protected?

aws_shield_protection = {
  "Name": "MyCloudFrontDistribution",
  "ResourceArn": "arn:aws:cloudfront::123456789012:distribution/EDFDVBD632BHDS5"
}

medium

A. An EC2 instance

B. An RDS database

C. An S3 bucket

D. A CloudFront distribution

Solution

1. Step 1: Analyze the ResourceArn

   The ARN contains "cloudfront" and "distribution", indicating the resource is a CloudFront distribution.

2. Step 2: Match resource type to options

   Only A CloudFront distribution matches a CloudFront distribution; others are different AWS services.

3. Final Answer:

   A CloudFront distribution -> Option D

4. Quick Check:

   ResourceArn with cloudfront = CloudFront distribution [OK]

Hint: Look for 'cloudfront' in ARN to identify resource type [OK]

Common Mistakes:

• Assuming EC2 or S3 from ARN without checking
• Ignoring ARN format details
• Confusing resource types

4. You configured AWS Shield Advanced but your Elastic Load Balancer (ELB) is still not protected. What is the likely issue?

medium

A. AWS Shield does not support ELB protection

B. You forgot to associate the ELB with AWS Shield protection

C. You need to enable AWS Shield Basic first

D. AWS Shield only protects EC2 instances

Solution

1. Step 1: Understand AWS Shield Advanced usage

   AWS Shield Advanced requires you to explicitly associate resources like ELB to enable protection.

2. Step 2: Evaluate options for ELB protection

   You forgot to associate the ELB with AWS Shield protection correctly identifies the missing association step. Options B, C, and D are incorrect because ELB is supported, Basic is automatic, and Shield protects multiple resource types.

3. Final Answer:

   You forgot to associate the ELB with AWS Shield protection -> Option B

4. Quick Check:

   Associate resources to Shield Advanced for protection [OK]

Hint: Associate ELB explicitly with Shield Advanced [OK]

Common Mistakes:

• Assuming ELB is auto-protected
• Thinking Shield only protects EC2
• Believing Shield Basic must be enabled first

5. Your company wants to protect a global web application using AWS Shield Advanced. Which combination of AWS services should you protect to ensure best DDoS defense?

hard

A. Protect CloudFront distributions and Elastic Load Balancers

B. Protect only EC2 instances running the web servers

C. Protect S3 buckets storing static content

D. Protect RDS databases and DynamoDB tables

Solution

1. Step 1: Identify key services for global web app delivery

   CloudFront distributes content globally and ELB balances traffic to servers, both critical for DDoS protection.

2. Step 2: Evaluate protection targets

   Protecting CloudFront and ELB covers edge and traffic distribution points. Protecting only EC2 misses edge protection. S3 and databases are less exposed to DDoS.

3. Final Answer:

   Protect CloudFront distributions and Elastic Load Balancers -> Option A

4. Quick Check:

   Shield Advanced protects CloudFront + ELB for best defense [OK]

Hint: Protect edge (CloudFront) and traffic points (ELB) [OK]

Common Mistakes:

• Protecting only backend servers
• Ignoring CloudFront's role
• Trying to protect databases for DDoS