First-time buyer: What questions should I ask AWS sales about Shield?

As a consultant who regularly conducts full-stack audits for mid-market clients, I am often asked to evaluate the procurement of managed security services, particularly for those moving from a DIY or basic vendor approach to a comprehensive cloud security posture. AWS Shield, specifically the Advanced tier, represents a significant commitment and a complex integration point with your existing infrastructure. When preparing for a discussion with AWS sales, your questions must move beyond feature listings and into operational and financial realities.

Your primary goal in this conversation should be to uncover the total cost of ownership, integration constraints, and the tangible operational handoff. To that end, I recommend structuring your inquiry around the following pillars:

**1. Financial and Contractual Specifics**
* Beyond the monthly commitment fee, what are the data transfer (DT) costs for shielded resources? Request a pricing model based on your current AWS egress traffic patterns from EC2, ALB, CloudFront, and Route 53.
* What is the exact process and success rate for fee credits during a confirmed attack? Ask for documented case studies or process flows detailing the evidence required and the timeline for credit issuance.
* How does the cost structure scale with business growth? Inquire about step functions or thresholds where costs might increase disproportionately.

**2. Technical Integration and Operational Overlap**
* How does AWS Shield Advanced interact with, and potentially duplicate, protections already offered by our existing third-party WAF (if any) or even AWS WAF itself? We need to understand the layered defense blueprint.
* Regarding the 24/7 DDoS Response Team (DRT): What is the exact scope of their engagement? Is it purely advisory, or do they take mitigation actions on our behalf? Request the standard operating procedure (SOP) document for a Sev-1 attack.
* How are protected resources (ELBs, CloudFront distributions, Route 53 hosted zones) added and managed at scale? We require details on CloudFormation support, Terraform provider maturity, and any API limitations.

**3. Security Posture and Reporting**
* What is the process for customizing the WAF rules that are automatically deployed by Shield during an attack? We need to ensure these automated rules do not break legitimate application traffic.
* Can we receive structured threat intelligence feeds (e.g., indicators of compromise) from Shield for ingestion into our own SIEM or SOAR platforms?
* What is the granularity and retention period for attack metrics and logs? We require this for internal compliance audits and post-incident reviews.

Avoid questions that can be answered by the public FAQ. Focus instead on the nuances of implementation, the hidden costs in data transfer, and the clarity of responsibility during an active incident. The sales engineer should be able to provide detailed architectural diagrams and cost simulations based on your current bill.

- Audit complete.