AWS Shield for DDoS protection - Step-by-Step Execution

Process Flow - AWS Shield for DDoS protection

Traffic arrives at AWS

↓

AWS Shield detects traffic pattern

↓

Is traffic normal?

No→Activate DDoS mitigation

↓

Mitigate attack

↓

Allow traffic

↓

Traffic reaches resources

AWS Shield monitors incoming traffic, detects unusual patterns, and activates protection to block DDoS attacks before traffic reaches your resources.

Execution Sample

AWS

1. Traffic arrives at AWS endpoint
2. AWS Shield analyzes traffic
3. If attack detected, mitigation starts
4. Normal traffic allowed
5. Attack traffic blocked

This flow shows how AWS Shield processes incoming traffic to protect resources from DDoS attacks.

Process Table

Step	Traffic Pattern	Detection Result	Action Taken	Effect on Traffic
1	Normal traffic	No attack detected	Allow traffic	Traffic passes to resources
2	Sudden traffic spike	Potential DDoS detected	Activate mitigation	Attack traffic blocked
3	Attack traffic continues	Mitigation active	Continue blocking	Only normal traffic allowed
4	Traffic normalizes	Attack ends	Stop mitigation	All traffic allowed
5	Normal traffic	No attack detected	Allow traffic	Traffic passes to resources

💡 Traffic is allowed only when no attack is detected or after mitigation ends

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Traffic Pattern	None	Normal	Spike detected	Attack ongoing	Normalizing	Normal
Detection Result	None	No attack	Attack detected	Mitigation active	Attack ended	No attack
Action Taken	None	Allow	Activate mitigation	Block attack	Stop mitigation	Allow
Effect on Traffic	None	Pass	Block attack traffic	Block attack traffic	Pass all	Pass

Key Moments - 3 Insights

How does AWS Shield decide when to activate mitigation?

AWS Shield analyzes traffic patterns each step; when a sudden spike or unusual pattern is detected (see Step 2 in execution_table), it activates mitigation to block attack traffic.

What happens to normal traffic during an active DDoS attack?

During mitigation (Step 3), AWS Shield blocks only attack traffic and allows normal traffic to pass through, ensuring service availability.

When does AWS Shield stop the mitigation process?

Once the attack traffic ends and traffic normalizes (Step 4), AWS Shield stops mitigation and allows all traffic again.

Visual Quiz - 3 Questions

Look at the execution_table, what is the Detection Result at Step 2?

A Potential DDoS detected

B No attack detected

C Mitigation active

D Attack ended

💡 Hint

Check the 'Detection Result' column for Step 2 in the execution_table.

At which step does AWS Shield stop mitigation?

A Step 2

B Step 4

C Step 3

D Step 5

💡 Hint

Look at the 'Action Taken' column to find when mitigation stops.

If traffic never spikes, how would the 'Action Taken' column change?

A Mitigation activates at Step 3

B Mitigation activates at Step 1

C Mitigation never activates

D Mitigation activates at Step 5

💡 Hint

Refer to the 'Traffic Pattern' and 'Action Taken' columns to see when mitigation activates.

Concept Snapshot

AWS Shield protects AWS resources from DDoS attacks.
It monitors incoming traffic continuously.
When attack patterns appear, it activates mitigation.
Mitigation blocks attack traffic but allows normal traffic.
After attack ends, mitigation stops and all traffic flows normally.

Full Transcript

AWS Shield is a service that protects your AWS resources from DDoS attacks by monitoring incoming traffic. When traffic arrives, AWS Shield checks if the pattern is normal or suspicious. If it detects a potential attack, it activates mitigation to block harmful traffic while allowing normal users through. Once the attack ends and traffic returns to normal, AWS Shield stops mitigation and lets all traffic pass. This process helps keep your applications available and responsive even during attacks.

Practice

1. What is the main purpose of AWS Shield?

easy

A. To protect AWS resources from DDoS attacks

B. To store data securely in the cloud

C. To monitor user activity on AWS

D. To manage AWS billing and costs

Solution

1. Step 1: Understand AWS Shield's function

   AWS Shield is designed to protect AWS resources from Distributed Denial of Service (DDoS) attacks that try to overwhelm services.

2. Step 2: Compare options with AWS Shield's purpose

   Only To protect AWS resources from DDoS attacks correctly describes AWS Shield's main role as protection against DDoS attacks.

3. Final Answer:

   To protect AWS resources from DDoS attacks -> Option A

4. Quick Check:

   AWS Shield = DDoS protection [OK]

Hint: AWS Shield = DDoS defense for AWS resources [OK]

Common Mistakes:

• Confusing AWS Shield with storage services
• Thinking AWS Shield manages billing
• Assuming AWS Shield monitors user activity

2. Which AWS Shield tier provides additional support and advanced protections?

easy

A. AWS Shield Standard

B. AWS Shield Basic

C. AWS Shield Advanced

D. AWS Shield Premium

Solution

1. Step 1: Identify AWS Shield tiers

   AWS Shield has two main tiers: Basic and Advanced. Basic offers automatic protection, Advanced adds extra features and support.

2. Step 2: Match tier with advanced features

   Only AWS Shield Advanced provides additional protections and 24/7 support.

3. Final Answer:

   AWS Shield Advanced -> Option C

4. Quick Check:

   Advanced tier = extra protection and support [OK]

Hint: Advanced = extra protection and support [OK]

Common Mistakes:

• Confusing Basic with Advanced tier
• Assuming Standard or Premium tiers exist
• Mixing up tier names

3. Given this AWS Shield setup code snippet, what resource is being protected?

aws_shield_protection = {
  "Name": "MyCloudFrontDistribution",
  "ResourceArn": "arn:aws:cloudfront::123456789012:distribution/EDFDVBD632BHDS5"
}

medium

A. An EC2 instance

B. An RDS database

C. An S3 bucket

D. A CloudFront distribution

Solution

1. Step 1: Analyze the ResourceArn

   The ARN contains "cloudfront" and "distribution", indicating the resource is a CloudFront distribution.

2. Step 2: Match resource type to options

   Only A CloudFront distribution matches a CloudFront distribution; others are different AWS services.

3. Final Answer:

   A CloudFront distribution -> Option D

4. Quick Check:

   ResourceArn with cloudfront = CloudFront distribution [OK]

Hint: Look for 'cloudfront' in ARN to identify resource type [OK]

Common Mistakes:

• Assuming EC2 or S3 from ARN without checking
• Ignoring ARN format details
• Confusing resource types

4. You configured AWS Shield Advanced but your Elastic Load Balancer (ELB) is still not protected. What is the likely issue?

medium

A. AWS Shield does not support ELB protection

B. You forgot to associate the ELB with AWS Shield protection

C. You need to enable AWS Shield Basic first

D. AWS Shield only protects EC2 instances

Solution

1. Step 1: Understand AWS Shield Advanced usage

   AWS Shield Advanced requires you to explicitly associate resources like ELB to enable protection.

2. Step 2: Evaluate options for ELB protection

   You forgot to associate the ELB with AWS Shield protection correctly identifies the missing association step. Options B, C, and D are incorrect because ELB is supported, Basic is automatic, and Shield protects multiple resource types.

3. Final Answer:

   You forgot to associate the ELB with AWS Shield protection -> Option B

4. Quick Check:

   Associate resources to Shield Advanced for protection [OK]

Hint: Associate ELB explicitly with Shield Advanced [OK]

Common Mistakes:

• Assuming ELB is auto-protected
• Thinking Shield only protects EC2
• Believing Shield Basic must be enabled first

5. Your company wants to protect a global web application using AWS Shield Advanced. Which combination of AWS services should you protect to ensure best DDoS defense?

hard

A. Protect CloudFront distributions and Elastic Load Balancers

B. Protect only EC2 instances running the web servers

C. Protect S3 buckets storing static content

D. Protect RDS databases and DynamoDB tables

Solution

1. Step 1: Identify key services for global web app delivery

   CloudFront distributes content globally and ELB balances traffic to servers, both critical for DDoS protection.

2. Step 2: Evaluate protection targets

   Protecting CloudFront and ELB covers edge and traffic distribution points. Protecting only EC2 misses edge protection. S3 and databases are less exposed to DDoS.

3. Final Answer:

   Protect CloudFront distributions and Elastic Load Balancers -> Option A

4. Quick Check:

   Shield Advanced protects CloudFront + ELB for best defense [OK]

Hint: Protect edge (CloudFront) and traffic points (ELB) [OK]

Common Mistakes:

• Protecting only backend servers
• Ignoring CloudFront's role
• Trying to protect databases for DDoS