Hi everyone. I’ve been managing the infrastructure for our marketing platforms on AWS for about eight months now, and we decided to purchase Shield Advanced a few months back. The main selling point for us was the 24/7 access to the DRT and the promise of rapid response during an attack.
Last week, we experienced a significant DDoS attack targeting our main campaign landing pages. Our internal alerts went off immediately, and I opened a case via the AWS Support Center, selecting the “Shield Advanced” category. I was pretty anxious, but I figured the dedicated team would be on it quickly.
To my surprise, it took 45 minutes to get a first substantive response from the DRT. The attack was mitigated by AWS infrastructure before that (the always-on protections), but the wait for consultation and guidance felt incredibly long while it was happening. We were scrambling internally the whole time.
I wanted to ask: is this a typical response time for Shield Advanced? I’ve read the documentation stating they “work to respond within minutes,” but my experience was quite different. For those using this service, have you found that engagement speed depends on how you structure your initial ticket, or is there a specific contact method I might have missed?
I’m also curious about what happens during that window. Should we have been implementing WAF rule changes ourselves immediately, or is the protocol to always wait for their direct guidance? I’m trying to set better internal playbooks for my team.