Deciding Between Shield Standard And Advanced

Domain expertise for the question that comes before any AWS Shield Advanced setup: does the customer actually need Shield Advanced, or do AWS Shield Standard plus AWS WAF cover the requirement at lower cost. Covers what Shield Standard already provides for free, the AWS WAF baseline (rate-based rules and the Anti-DDoS managed rule group) that does not require a Shield Advanced subscription, the Advanced-only differentiators that justify the paid tier, and the auto-renewing one-year commitment the customer takes on by subscribing.

Does not cover the subscription mechanics themselves (see the subscribing reference), automatic application layer mitigation, health-based detection, SRT setup, event review, or protection groups; those are separate references and all assume the decision to use Shield Advanced has already been made. Authoring the AWS WAF rate-based rule or the Anti-DDoS managed rule group is the waf skill.

This reference is advisory only; it runs no AWS commands. It helps choose between Shield Standard and Shield Advanced, then routes to the subscribing reference (for Advanced) or the waf skill (for Shield Standard plus AWS WAF) for any execution.

Table of Contents

• Overview
• Workflow
• What Shield Standard already covers
• The AWS WAF baseline that does not need Shield Advanced
• Decision: Shield Standard plus AWS WAF vs Shield Advanced
• Advanced is a paid auto-renewing commitment
• Troubleshooting
• Procedure
• Security considerations
• Additional Resources

Workflow

To decide between Shield Standard and Shield Advanced end to end, follow the procedure exactly. See the Procedure section below.

The procedure covers:

• Establishing what the customer is actually trying to protect and against what
• Confirming whether the free Shield Standard plus AWS WAF baseline already meets the need
• Identifying whether any Advanced-only differentiator (cost protection, SRT, automatic application layer mitigation, health-based detection, attack reporting) is genuinely required
• Routing the customer to subscribing (Advanced) or to the waf skill (Standard plus WAF)

What Shield Standard already covers

Shield Standard is on for every AWS account at no additional cost. Customers often reach for Advanced without knowing what they already have, and pay for protection they did not need.

Constraints:

• You MUST tell the customer that Shield Standard is always on and free, and provides automatic protection against common, most frequently occurring network and transport layer (layer 3 and layer 4) DDoS attacks for all AWS resources
• You MUST NOT present Shield Advanced as the only source of DDoS protection; the layer 3 and 4 baseline already exists under Standard

The AWS WAF baseline that does not need Shield Advanced

For layer 7 (HTTP/HTTPS) flood protection, AWS WAF provides capabilities that do not require a Shield Advanced subscription. A customer whose concern is HTTP floods may be fully served by WAF alone.

Constraints:

• You MUST present AWS WAF rate-based rules and the AWS WAF Anti-DDoS managed rule group (AWSManagedRulesAntiDDoSRuleSet) as a layer 7 protection baseline that is available as a standard AWS WAF cost and does NOT require a Shield Advanced subscription
• You SHOULD point the customer at the waf skill to author the rate-based rule and add the Anti-DDoS managed rule group, rather than treating layer 7 flood protection as Advanced-only
• You SHOULD note that a Shield Advanced subscription does also include access to the Anti-DDoS managed rule group, so this rule group is not itself a reason to subscribe

Decision: Shield Standard plus AWS WAF vs Shield Advanced

Constraints:

• You MUST recommend Shield Standard plus AWS WAF when the customer’s need is ordinary layer 3/4 protection or layer 7 flood throttling and none of the Advanced-only differentiators apply, rather than defaulting to a subscription
• You MUST recommend Shield Advanced when the customer needs any Advanced-only differentiator: DDoS cost-protection credits, Shield Response Team access or proactive engagement, automatic application layer mitigation, health-based detection, or detailed attack reporting
• You SHOULD treat cost protection and SRT access as the two differentiators customers most often actually need, and confirm whether either applies before recommending the subscription

Advanced is a paid auto-renewing commitment

Subscribing is not a reversible toggle. A customer who subscribes without knowing the commitment is surprised at renewal.

Constraints:

• You MUST state before recommending a subscription that Shield Advanced is a paid subscription that auto-renews by default on a one-year commitment, and that fully unsubscribing requires contacting AWS Support
• You MUST NOT invent a dollar figure for the subscription fee or usage rates; point the customer at the current Shield pricing page
• You SHOULD note that one subscription fee covers all accounts in the same AWS Organizations consolidated billing family, so the decision is per organization, not per account

Troubleshooting

Customer only needs to stop an HTTP flood

That is a layer 7 need AWS WAF covers without Advanced. Use rate-based rules and the Anti-DDoS managed rule group (The AWS WAF baseline that does not need Shield Advanced); route to the waf skill.

Customer wants attack-driven scaling charges refunded

Cost protection credits are an Advanced-only feature. That need justifies the subscription (Decision: Shield Standard plus AWS WAF vs Shield Advanced).

Customer wants AWS experts to act during an attack

SRT access and proactive engagement are Advanced-only. That need justifies the subscription (Decision: Shield Standard plus AWS WAF vs Shield Advanced).

Customer already has Shield Advanced and is asking what else to do

The decision is made; route to the subscribing reference to confirm protections are in place, then to the task the customer actually wants.

Procedure

Overview

This procedure establishes the customer’s protection need, checks it against the free Standard plus AWS WAF baseline, identifies any Advanced-only requirement, and routes accordingly. It makes no AWS changes itself.

Parameters

• protection_target (required): What the customer wants to protect (for example a CloudFront distribution, an Application Load Balancer, a Global Accelerator accelerator).
• threat (required): What they are protecting against (layer 3/4 volumetric, layer 7 HTTP flood, or both).
• needs (required): Whether any Advanced-only outcome is wanted — cost-protection credits, SRT help, automatic application layer mitigation, health-based detection, or attack reporting.

Constraints for parameter acquisition:

• You MUST ask for all required parameters upfront in a single prompt
• You MUST NOT recommend a subscription before confirming whether any Advanced-only differentiator is actually required

Steps

1. Establish the need

Constraints:

• You MUST confirm what resource is being protected and against which layer of attack before recommending a tier
• You MUST confirm whether any Advanced-only differentiator (cost protection, SRT, automatic application layer mitigation, health-based detection, attack reporting) is required

2. Check against the free baseline

Constraints:

• You MUST confirm whether Shield Standard (free layer 3/4) plus AWS WAF (rate-based rules and the Anti-DDoS managed rule group, standard WAF cost) already meets the need
• You MUST recommend the baseline and route to the waf skill when no Advanced-only differentiator applies, rather than defaulting to a subscription

3. Recommend and route

Constraints:

• You MUST recommend Shield Advanced only when an Advanced-only differentiator is required, and MUST state the auto-renewing one-year commitment before doing so
• You MUST route to the subscribing reference when the customer chooses Advanced, and to the waf skill when Standard plus AWS WAF is sufficient
• You MUST NOT invent pricing; point the customer at the Shield pricing page

Example

Example input

Example output

Troubleshooting

The need is only an HTTP flood

AWS WAF covers it without Advanced. Route to the waf skill (Step 2).

An Advanced-only outcome is required

Cost protection, SRT, automatic mitigation, health-based detection, or attack reporting justifies the subscription. State the commitment and route to subscribing (Step 3).

Security considerations

This reference makes no AWS changes; it advises on tier selection. The security-relevant point is that the choice determines which controls exist.

• Do not leave internet-facing resources without layer 7 protection by deciding against Advanced. When the recommendation is Standard plus AWS WAF, you MUST ensure the customer follows through with the WAF rate-based rule and Anti-DDoS managed rule group via the waf skill, so declining Advanced does not leave the application with layer 3/4 protection only.
• Right-size the commitment. Recommend Shield Advanced only when an Advanced-only differentiator is genuinely required, so the customer is not committed to a paid auto-renewing subscription beyond what they need.
• Audit trail. When the customer proceeds to subscribe, the subscribing reference covers enabling AWS CloudTrail on shield:* calls; no control-plane change is made in this reference.

Additional Resources

• Deciding whether to subscribe to AWS Shield Advanced and apply additional protections (AWS WAF, AWS Firewall Manager, and AWS Shield Advanced Developer Guide) (opens in a new tab)
• How AWS Shield works (AWS WAF, AWS Firewall Manager, and AWS Shield Advanced Developer Guide) (opens in a new tab)
• Advanced Anti-DDoS protection using the AWS WAF Anti-DDoS managed rule group (AWS WAF, AWS Firewall Manager, and AWS Shield Advanced Developer Guide) (opens in a new tab)
• AWS Shield Advanced pricing (opens in a new tab)