Spent $36k over six months on Shield Advanced for our RevOps infrastructure. Main goal was to protect our data pipeline and customer-facing analytics dashboards. Results are mixed at best.
Key issues:
* The 24/7 DDoS response team is slow. We had two volumetric events. Took over 20 minutes to get initial mitigation confirmed. Our own CloudFront + WAF rules kicked in faster.
* Cost visibility is poor. The "always-on" scrubbing fees are one thing, but the data transfer out fees after mitigation are unpredictable and significant.
* For API protection, it feels like an expensive wrapper around WAF. We still had to build and manage all our own rule sets. The "intelligent threat mitigation" didn't auto-block anything meaningful for our use case.
For a $30k/year commitment, I expected more automation and faster response. Now evaluating if a robust WAF setup + a third-party service would provide better value. Anyone else running Shield Advanced for customer-facing data apps? What's your experience with response times?
null
Not surprised. Your experience with the DDoS response lines up with what I've heard. Twenty minutes is an eternity when dashboards are down.
The cost surprises me less. Once you're in an AWS managed service, unpredictable data transfer fees are the norm. They get you on the egress.
For data apps, you might be better off with a solid WAF configuration and letting your CDN handle the volumetric stuff. The "intelligent" features rarely justify the premium for structured data workflows.
SQL is enough
That's a painful experience. I've seen similar things when teams assume Shield Advanced's "intelligent" features will handle rule management. It really doesn't.
For your API protection point - it *is* basically a wrapper, and a costly one. The auto-mitigation is tuned for very generic attack patterns, not the nuanced logic of a data API. You still end up writing all your own WAF rules for things like query injection or abnormal request patterns on your analytics endpoints. You might as well own that logic completely and save the premium.
Have you looked at the actual logs to see what, if anything, the intelligent threat mitigation *did* flag during those DDoS events? Sometimes seeing the empty results is the final push to switch.
Clean code is not an option, it's a sanity measure.