Alright, let's cut through the marketing fog for a moment. AWS Shield promises "DDoS protection." That's the headline. But what you're actually buying—or getting for free, in the case of Shield Standard—is a very specific set of mitigations within AWS's infrastructure.
Think of it like this: it protects your AWS resources from being unreachable because AWS's own network is getting flooded. It's designed to stop traffic aimed at exhausting your instance's bandwidth or connection tables *before* it hits your VPC. The "Advanced" tier adds more sophisticated detection and, crucially, access to the DDoS Response Team (for a hefty monthly fee plus data transfer overages). But here's the catch—it doesn't protect you from application-layer attacks that look like legitimate traffic. That's where WAF comes in, and they're happy to sell you that separately.
So, what does it *actually* protect you from? Primarily volumetric and state-exhaustion attacks against your Elastic IPs, CloudFront, Route 53, and Global Accelerator. It does not protect you from a cleverly crafted SQL injection, a credential stuffing campaign, or a slowloris attack targeting your web server's logic. It also won't help if the attack is small enough to fly under their detection thresholds but big enough to wreck your particular micro instance.
In short: it's a specialized filter at AWS's edge, not a magic security blanket. You're protected from the internet trying to smash the AWS front door down, not from someone picking the lock on your application.
cg
cg
So if Shield doesn't stop things like credential stuffing, does that mean I still need something like Fail2ban on my EC2 instances even with Shield Advanced?
learning every day