Back to Details

shieldadvanced

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

AWS Shield Advanced

AWS Shield Advanced

Overview

概述

Domain expertise for configuring AWS Shield Advanced, the paid tier that adds enhanced Distributed Denial of Service (DDoS) protection, automatic application layer mitigation, attack visibility, expert support, and cost protection on top of the always-on AWS Shield Standard. Covers subscribing and protecting resources, automatic application layer mitigation, health-based detection, Shield Response Team (SRT) access and proactive engagement, event review and cost protection credits, and protection groups.
This skill is a router. Each customer task maps to a procedure file under 
references/
. Read the matching reference in full before acting, then follow its constraints and steps. The reference files are self-contained: each carries its own decision tables, constraints, procedure, and troubleshooting.
Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging, observability). Fall back to the AWS CLI otherwise. Shield Advanced is a global service: its control-plane API calls run in 
us-east-1
, so pass 
--region us-east-1
on every 
aws shield
command.
本技能专注于配置AWS Shield Advanced——这是付费层级的防护服务，在始终启用的AWS Shield Standard基础上，新增了增强型分布式拒绝服务（DDoS）防护、自动应用层缓解、攻击可见性、专家支持以及成本保护功能。涵盖内容包括订阅服务与资源保护、自动应用层缓解、基于健康状态的检测、Shield响应团队（SRT）访问与主动参与、事件查看与成本保护credits申请，以及保护组配置。
本技能作为路由工具，每个客户任务都会映射到
references/
下的对应流程文件。执行操作前请完整阅读匹配的参考文档，然后遵循其约束条件与步骤。参考文件是独立完整的：每个文件都包含自身的决策表、约束条件、操作流程和故障排查指南。
连接AWS MCP服务器时，请使用该服务器执行命令（沙箱执行、审计日志、可观测性）；否则使用AWS CLI作为备选方案。Shield Advanced是一项全局服务：其控制平面API调用在
us-east-1
区域运行，因此所有
aws shield
命令都需传入
--region us-east-1
参数。

Which Shield Advanced task do you need?

您需要执行哪项Shield Advanced任务？

GoalReference
Decide whether Shield Advanced is needed at all (vs Shield Standard + AWS WAF)deciding between Shield Standard and Advanced
Subscribe an account and add resources to protectionsubscribing to Shield Advanced and protecting resources
Respond to layer 7 floods automatically through AWS WAFenabling automatic application layer mitigation
Feed resource health into detection with a Route 53 health checkconfiguring health-based detection
Get the Shield Response Team to act or reach out during an attacksetting up SRT support and proactive engagement
Review a DDoS event and recover attack-driven scaling chargesreviewing DDoS events and requesting cost protection
Treat related resources as one unit for detectionaggregating resources into protection groups
目标参考文档
判断是否需要Shield Advanced（对比Shield Standard + AWS WAF）Shield Standard与Advanced的选择
订阅账户并添加受保护资源订阅Shield Advanced并保护资源
通过AWS WAF自动应对第7层洪水攻击启用自动应用层缓解
通过Route 53健康检查将资源健康状态纳入检测机制配置基于健康状态的检测
在攻击期间让Shield响应团队采取行动或主动联系设置SRT支持与主动参与机制
查看DDoS事件并追回由攻击导致的扩容费用查看DDoS事件并申请成本保护
将相关资源视为一个单元进行检测将资源聚合到保护组

Routing notes

路由说明

  • Decide before you subscribe. Shield Advanced is a paid subscription that auto-renews on a one-year commitment. Before subscribing, confirm the customer actually needs it: Shield Standard (free, always on) plus AWS WAF rate-based rules and the AWS WAF Anti-DDoS managed rule group (
    AWSManagedRulesAntiDDoSRuleSet
    ) covers many layer 7 cases at lower cost. Route to the deciding reference first when the customer has not made that call; route to the waf skill for the WAF rules themselves.
  • Subscribe and protect comes first. A subscription protects nothing on its own; resources have to be added explicitly. Every other task here assumes the resource is already subscribed and protected. Run the subscribing reference before any of the others if the customer is starting from scratch.
  • Automatic mitigation vs health-based detection. These are different controls and customers conflate them. Automatic application layer mitigation deploys AWS WAF rules during a layer 7 attack. Health-based detection feeds a Route 53 health check into Shield Advanced's detection so it reacts sooner. A customer can run either, both, or neither. Pick the reference that matches what they actually want.
  • Health check is also an SRT prerequisite. Proactive engagement (SRT reaching out) requires a Route 53 health check on the protected resource. If the customer wants proactive engagement, configuring health-based detection is the groundwork. The SRT reference points back to the health-based detection reference for that step.
  • Protection groups are detection-only. A protection group changes how Shield Advanced detects across a set of resources. It does not apply shared mitigation; automatic mitigation still works per resource. Use the protection-groups reference for detection tuning, not as a mitigation control.
  • WAF rules, health checks, and org rollout live elsewhere. Authoring the AWS WAF rules, the rate-based rule, or the web ACL is the waf skill. Creating the Route 53 health check is the route53 skill. Rolling Shield Advanced across an organization with Firewall Manager is the firewallmanager skill. This skill wires Shield Advanced to those pieces; it does not build them. AWS WAF is not optional alongside Shield Advanced: you SHOULD recommend an AWS WAF web ACL on every internet-facing protected resource (CloudFront distributions and Application Load Balancers) as defense in depth — Shield Advanced and AWS WAF are complementary layer 3/4 and layer 7 controls, and the rate-based rule that AWS WAF provides is also what cost protection requires.
  • 先决策再订阅：Shield Advanced是付费订阅服务，默认按一年期限自动续费。订阅前，请确认客户确实需要该服务：Shield Standard（免费、始终启用）加上AWS WAF速率规则和AWS WAF防DDoS托管规则组（
    AWSManagedRulesAntiDDoSRuleSet
    ）已能覆盖许多第7层场景，且成本更低。若客户尚未做出决策，先引导至选择参考文档；WAF规则本身的配置则引导至waf skill。
  • 先订阅并保护资源：仅订阅服务不会保护任何资源，必须显式添加资源。此处的所有其他任务都假定资源已完成订阅并受到保护。若客户从零开始，需先执行订阅参考文档中的流程，再进行其他操作。
  • 自动缓解与基于健康状态的检测的区别：这是两种不同的控制机制，客户可能会混淆。自动应用层缓解会在第7层攻击期间部署AWS WAF规则；基于健康状态的检测则将Route 53健康检查数据传入Shield Advanced的检测系统，使其更快做出响应。客户可以选择其中一种、两种都选，或都不选。请根据客户实际需求选择对应的参考文档。
  • 健康检查也是SRT的先决条件：主动参与（SRT主动联系）要求受保护资源配置Route 53健康检查。若客户需要主动参与机制，配置基于健康状态的检测是基础步骤。SRT参考文档会指向基于健康状态的检测参考文档完成该步骤。
  • 保护组仅用于检测：保护组会改变Shield Advanced对一组资源的检测方式，但不会应用共享缓解措施；自动缓解仍按单个资源生效。保护组参考文档仅用于检测调优，而非缓解控制。
  • WAF规则、健康检查和组织级部署需前往对应技能：编写AWS WAF规则、速率规则或Web ACL属于waf skill的范畴；创建Route 53健康检查属于route53 skill；通过Firewall Manager在组织范围内部署Shield Advanced属于firewallmanager skill。本技能负责将Shield Advanced与这些组件关联，而非构建它们。AWS WAF是Shield Advanced的配套组件：您应当建议在每个面向互联网的受保护资源（CloudFront分发和应用负载均衡器）上配置AWS WAF Web ACL，实现纵深防御——Shield Advanced和AWS WAF是互补的第3/4层和第7层控制，且AWS WAF提供的速率规则也是成本保护的必要条件。

Logging and monitoring

日志与监控

Visibility into both configuration changes and attack activity matters for every task here.
  • You SHOULD recommend enabling AWS CloudTrail so all Shield Advanced API calls (subscription, protection, SRT, and protection-group changes) are logged for audit purposes.
  • You SHOULD recommend enabling SSE-KMS encryption on the CloudTrail log bucket and CloudWatch Logs log group, since CloudTrail records sensitive API metadata (caller identities, resource ARNs, parameters) that must be encrypted at rest.
  • You SHOULD recommend CloudWatch alarms on Shield Advanced metrics (for example 
    DDoSDetected
    and 
    DDoSAttackBitsPerSecond
    ) so operations staff are alerted when an event is detected.
  • You SHOULD recommend encrypting any SNS topics used for those alarms with SSE-KMS, since the notifications carry sensitive event data.
  • You SHOULD recommend confirming that all SNS topic subscribers for Shield Advanced alarms are authorized personnel approved to receive sensitive DDoS event notifications.
配置变更和攻击活动的可见性对所有任务都至关重要。
  • 您应当建议启用AWS CloudTrail，以便所有Shield Advanced API调用（订阅、保护、SRT和保护组变更）都被记录下来，用于审计目的。
  • 您应当建议对CloudTrail日志存储桶和CloudWatch Logs日志组启用SSE-KMS加密，因为CloudTrail会记录敏感API元数据（调用方身份、资源ARN、参数），这些数据必须在静态存储时加密。
  • 您应当建议针对Shield Advanced指标（例如
    DDoSDetected
    和
    DDoSAttackBitsPerSecond
    ）配置CloudWatch告警，以便运维人员在检测到事件时收到通知。
  • 您应当建议对这些告警使用的SNS主题启用SSE-KMS加密，因为通知中包含敏感事件数据。
  • 您应当建议确认所有接收Shield Advanced告警的SNS主题订阅者都是经授权的人员，有权接收敏感DDoS事件通知。

Security considerations

安全注意事项

Shield Advanced setup creates IAM trust relationships and exposes log data, so call out the risks and the controls that contain them.
  • SRT role is a third-party principal. Granting SRT access creates an IAM role that 
    drt.shield.amazonaws.com
    assumes to act in the account. Scope its trust policy with an 
    aws:SourceAccount
    condition equal to the account ID to prevent confused-deputy assumption, grant it only the actions it needs, and revoke it with 
    disassociate-drt-role
    when no longer required.
  • Log buckets shared with the SRT can leak data. AWS WAF and access logs capture request URIs, headers, and client IPs. Confirm those buckets have server-side encryption and carry no clear-text PII or secrets before sharing them with the SRT.
  • Least privilege for the operator. Scope the caller's IAM permissions to the minimum each procedure needs rather than broad Shield or administrator access.
  • Audit trail. Keep AWS CloudTrail enabled and logging 
    shield:*
    calls so every configuration change leaves a record.
Shield Advanced的配置会创建IAM信任关系并暴露日志数据，因此需要明确相关风险及对应的控制措施。
  • SRT角色是第三方主体：授予SRT访问权限会创建一个IAM角色，供
    drt.shield.amazonaws.com
    在账户中执行操作。需通过
    aws:SourceAccount
    条件将其信任策略限定为对应账户ID，防止混淆代理问题；仅授予其所需的操作权限；不再需要时，使用
    disassociate-drt-role
    撤销该角色。
  • 与SRT共享的日志存储桶可能泄露数据：AWS WAF和访问日志会捕获请求URI、标头和客户端IP。在与SRT共享这些存储桶之前，请确认它们已启用服务器端加密，且不包含明文PII或机密信息。
  • 操作人员的最小权限原则：将调用方的IAM权限限定为每个流程所需的最小范围，而非宽泛的Shield权限或管理员权限。
  • 审计跟踪：保持AWS CloudTrail启用并记录
    shield:*
    调用，确保所有配置变更都留有记录。

Additional Resources

额外资源