shieldadvanced

SKILL.md

AWS Shield Advanced

Overview

Domain expertise for configuring AWS Shield Advanced, the paid tier that adds enhanced Distributed
Denial of Service (DDoS) protection, automatic application layer mitigation, attack visibility, expert support, and
cost protection on top of the always-on AWS Shield Standard. Covers subscribing and protecting
resources, automatic application layer mitigation, health-based detection, Shield Response Team
(SRT) access and proactive engagement, event review and cost protection credits, and protection
groups.

This skill is a router. Each customer task maps to a procedure file under references/. Read the
matching reference in full before acting, then follow its constraints and steps. The reference
files are self-contained: each carries its own decision tables, constraints, procedure, and
troubleshooting.
Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging,
observability). Fall back to the AWS CLI otherwise. Shield Advanced is a global service: its
control-plane API calls run in us-east-1, so pass --region us-east-1 on every aws shield
command.

Which Shield Advanced task do you need?

Goal
Reference

Decide whether Shield Advanced is needed at all (vs Shield Standard + AWS WAF)
deciding between Shield Standard and Advanced

Subscribe an account and add resources to protection
subscribing to Shield Advanced and protecting resources

Respond to layer 7 floods automatically through AWS WAF
enabling automatic application layer mitigation

Feed resource health into detection with a Route 53 health check
configuring health-based detection

Get the Shield Response Team to act or reach out during an attack
setting up SRT support and proactive engagement

Review a DDoS event and recover attack-driven scaling charges
reviewing DDoS events and requesting cost protection

Treat related resources as one unit for detection
aggregating resources into protection groups

Routing notes

Decide before you subscribe. Shield Advanced is a paid subscription that auto-renews on a
one-year commitment. Before subscribing, confirm the customer actually needs it: Shield Standard
(free, always on) plus AWS WAF rate-based rules and the AWS WAF Anti-DDoS managed rule group
(AWSManagedRulesAntiDDoSRuleSet) covers many layer 7 cases at lower cost. Route to the deciding
reference first when the customer has not made that call; route to the waf skill for the WAF rules
themselves.

Subscribe and protect comes first. A subscription protects nothing on its own; resources have
to be added explicitly. Every other task here assumes the resource is already subscribed and
protected. Run the subscribing reference before any of the others if the customer is starting
from scratch.

Automatic mitigation vs health-based detection. These are different controls and customers
conflate them. Automatic application layer mitigation deploys AWS WAF rules during a layer 7
attack. Health-based detection feeds a Route 53 health check into Shield Advanced's detection so it
reacts sooner. A customer can run either, both, or neither. Pick the reference that matches what they
actually want.

Health check is also an SRT prerequisite. Proactive engagement (SRT reaching out) requires a
Route 53 health check on the protected resource. If the customer wants proactive engagement,
configuring health-based detection is the groundwork. The SRT reference points back to the
health-based detection reference for that step.

Protection groups are detection-only. A protection group changes how Shield Advanced detects
across a set of resources. It does not apply shared mitigation; automatic mitigation still works per
resource. Use the protection-groups reference for detection tuning, not as a mitigation control.

WAF rules, health checks, and org rollout live elsewhere. Authoring the AWS WAF rules, the
rate-based rule, or the web ACL is the waf skill. Creating the Route 53 health check is the
route53 skill. Rolling Shield Advanced across an organization with Firewall Manager is the
firewallmanager skill. This skill wires Shield Advanced to those pieces; it does not build them.
AWS WAF is not optional alongside Shield Advanced: you SHOULD recommend an AWS WAF web ACL on
every internet-facing protected resource (CloudFront distributions and Application Load Balancers)
as defense in depth — Shield Advanced and AWS WAF are complementary layer 3/4 and layer 7
controls, and the rate-based rule that AWS WAF provides is also what cost protection requires.

Logging and monitoring

Visibility into both configuration changes and attack activity matters for every task here.

You SHOULD recommend enabling AWS CloudTrail so all Shield Advanced API calls (subscription,
protection, SRT, and protection-group changes) are logged for audit purposes.

You SHOULD recommend enabling SSE-KMS encryption on the CloudTrail log bucket and CloudWatch Logs
log group, since CloudTrail records sensitive API metadata (caller identities, resource ARNs,
parameters) that must be encrypted at rest.

You SHOULD recommend CloudWatch alarms on Shield Advanced metrics (for example DDoSDetected and
DDoSAttackBitsPerSecond) so operations staff are alerted when an event is detected.

You SHOULD recommend encrypting any SNS topics used for those alarms with SSE-KMS, since the
notifications carry sensitive event data.

You SHOULD recommend confirming that all SNS topic subscribers for Shield Advanced alarms are
authorized personnel approved to receive sensitive DDoS event notifications.

Security considerations

Shield Advanced setup creates IAM trust relationships and exposes log data, so call out the risks
and the controls that contain them.

SRT role is a third-party principal. Granting SRT access creates an IAM role that
drt.shield.amazonaws.com assumes to act in the account. Scope its trust policy with an
aws:SourceAccount condition equal to the account ID to prevent confused-deputy assumption, grant
it only the actions it needs, and revoke it with disassociate-drt-role when no longer required.

Log buckets shared with the SRT can leak data. AWS WAF and access logs capture request URIs,
headers, and client IPs. Confirm those buckets have server-side encryption and carry no clear-text
PII or secrets before sharing them with the SRT.

Least privilege for the operator. Scope the caller's IAM permissions to the minimum each
procedure needs rather than broad Shield or administrator access.

Audit trail. Keep AWS CloudTrail enabled and logging shield:* calls so every configuration
change leaves a record.

Additional Resources

AWS Shield Advanced overview (AWS WAF, AWS Firewall Manager, and AWS Shield Advanced Developer Guide)

How AWS Shield works (AWS WAF, AWS Firewall Manager, and AWS Shield Advanced Developer Guide)

AWS Shield Advanced pricing

2f