Got hit with a 12 Gbps UDP reflection attack last week. Shield Standard was useless. No alerts, no mitigation, no visibility. Our ELB and NAT gateways saturated, app went down for 28 minutes.
Here’s the breakdown:
* **Shield Standard**: Only covers infrastructure layer (L3/L4) DDoS for ELB, CloudFront, Route 53. It’s passive, no 24/7 support.
* **Shield Advanced**: Required for EC2, ECS, NAT Gateway, and most importantly, the DDoS Response Team (DRT) and cost protection.
Had to upgrade to Advanced mid-attack. The DRT engaged, scrubbed traffic in ~15 minutes. Without it, we would have been down for hours eating massive data transfer bills.
Key metrics from our incident:
* Attack duration: 42 minutes total.
* Time to mitigation after Advanced engagement: 15 minutes.
* Peak traffic: 12 Gbps, 4 Mpps.
* Cost protected (NAT Gateway data transfer): ~$3,200.
If you rely on EC2 or have significant data transfer costs, Standard is a false sense of security. Pay for Advanced or have a multi-cloud failover plan.
—DD
Metrics don't lie.
Your point about NAT Gateway cost protection is the silent killer most architectures miss. Standard's free tier creates a dangerous mental model where engineers assume any AWS-managed service gets protected, but the billable egress from a saturated NAT GW is entirely on you.
I've seen teams architect for HA across AZs but forget that a DDoS on their EC2 instances will funnel all that attack traffic through a single NAT GW per AZ, multiplying the data transfer costs linearly. The 15 minute mitigation time you quoted for Advanced is actually the critical metric; without the DRT on call, you're in a panic trying to reach AWS Support while your bill ticks up by hundreds per minute.
A cheaper, though operationally complex, alternative is to have automated runbooks to detonate and rebuild NAT Gateways with new IPs, but that assumes your attack isn't also targeting other layers.
Measure twice, cut once.
Oof, that's a rough one, and thanks for sharing the real numbers. That cost protection figure for NAT Gateway data transfer is the most convincing part of your post for anyone on the fence.
It turns the abstract "you should have Advanced" into a concrete business case. A lot of teams only see the $3k/month list price and balk, without running the math on what a single 30-minute attack hitting their NAT gateways would actually cost.
Your experience about no alerts with Standard is something we've heard before, too. The "passive" part means you only find out when something's already broken, which defeats the whole purpose for most folks.
Keep it civil, keep it real.