- Now let's talk about AWS Shield.
With AWS Shield, we gain access to a
Distributed Denial of Service protection service.
And so, this service can help protect us against
common attacks based on layers three and four,
so networking level attacks.
And some of these attacks might be things like
UDP reflection attacks, DNS reflection, NTP reflection,
other things like SSL renegotiation, Slowloris attacks.
And so with AWS Shield, we gain a very powerful
again DDoS protection service.
And this is available for free to everyone
or AWS Shield Standard is available for free to everyone,
and there's nothing for us to do.
We get the standard level of AWS Shield
without really even having to opt into anything.
It's already there when we use things like CloudFront,
Elastic Load Balancing, VPCs and security groups,
and Elastic IPs.
And so, if we need an additional layer of mitigation
and protection, we can subscribe to AWS Shield Advanced.
Now with advanced again, we get that additional detection
and mitigation against more sophisticated
and larger attacks.
And we also get near real-time visibility into those attacks
so that we can be up to speed as far as you know,
the nature of the attack,
what the progress is in helping to mitigate that attack,
and so on.
We also get DDoS cost protection.
So when we apply AWS Shield Advanced to certain things
like our load balancers, our Route 53 DNS zones.
When we apply Shield Advanced to things like our
Elastic IPs and our EC2 instances,
our auto scaled fleet of instances.
If any of those services were to scale
as a result of that DDoS attack,
then we could get service credits for that.
Another nice feature of Shield Advanced
is that it integrates with the Web Application Firewall.
And so, we can get automatic rule creation based on
you know, what's happening with that DDoS attack.
We also gain access to a 24-hour a day, seven-day a week
DDoS Response Team and so or what we might call the DRT.
And so the the DDoS response team can help us mitigate that,
they can actively help us mitigate a DDoS attack.
They can also write what were firewall rules for us.
Now it does require a subscription.
So AWS Shield Standard is available for free to everyone,
but Shield Advanced requires a subscription.
And once you subscribe to that Shield Advanced,
it will cover all of the accounts for that organization.
You don't, you don't have to do it per account,
you do it per organization.
And so any account that is linked underneath that
organization can be protected by Shield Advanced.
So let's take a look at this diagram.
And you can see here that we're using CloudFront.
We're also using, we have an Elastic Load Balancer here,
we have EC2 instances running our application.
And we want ultimately, we want to prevent these instances
from coming down as a result of an attack.
And so you can see that all of these,
we are leveraging Amazon CloudFront.
We have all of those,
you know edge locations all over the globe, right.
And, AWS Shield is working alongside the AWS WAF,
both of those are working at the edge location.
So as this flood of attacks are coming in,
some of the benefits here are that,
one, because we do have those 100 edge locations,
more than 100 edge locations, all over the globe,
there's a much wider footprint to absorb that attack.
The attack is not concentrated right here
at the load balancer or on any one, EC2 instance.
The attack can be absorbed by many machines across those
edge locations all over the globe.
And so, like I say, a number of those attacks are already
mitigated by AWS Shield working alongside CloudFront at the,
at the edge location.
And then of course, we can leverage
AWS Web Application Firewall to help further mitigate
and block request based on IP and HTTP headers, and so on.
And then of course, back here,
on the load balancer, we would,
we would of course have a security group
on the load balancer.
We would also have security groups around our EC2 instances.
And we can use those tools to help mitigate different types
of attacks as well, such as UDP reflections,
and UDP flooding, Sign flooding, and so on.
Now, CloudFront is really great for HTTP based applications,
applications doing streaming such as RTMP and HLS.
CloudFront also supports web sockets,
but it, but it is specifically for TCP based applications.
If we have applications that are not based on TCP,
if we have applications that are using things like UDP,
or SIP, then we cannot use CloudFront.
We also cannot use Elastic Load Balancing.
So remember that CloudFront and Elastic Load Balancing
are both specifically for TCP based applications.
And so for non-TCP based applications,
UDP, SAP whatever the case may be,
then we would need to run an EC2 instance
that is directly available from the internet.
So when in this example,
you can see we have an EC2 instance.
And we would also in this region, we would of course,
have a VPC, we would have an Internet gateway.
We would have routing tables that allow this instance to be
directly reachable from the Internet.
And so when we have that, AWS Shield Standard is already
protecting this EC2 instance against those common
infrastructure attacks on layers three and four.
So we do get some protection, you know,
certain types of UDP reflections and NTP reflections,
DNS reflections, those kinds of things.
Those common attacks are already mitigated
by AWS Shield Standard for that instance.
If we wanted to leverage AWS shield Advanced,
then we could enable Shield Advanced on in
an Elastic IP address.
And of course, that Elastic IP address would be attached
to the instance or associated with that instance.
And so by attaching AWS shield to the Elastic IP address,
then we could, we could gain access to Shield Advanced,
which would automatically, it would actually,
AWS Shield Advanced would, would will detect
the size and type of that EC2 instance
and automatically apply predefined mitigation profiles.
And then we could also work with the
DDoS Response Team to help create custom mitigation profiles
for our particular scenario.
So either way, if you're using you know,
TCP based applications behind CloudFront,
if you're using UDP or SIP based applications,
you know, on an EC2 publicly available EC2 instance,
then we can still get DDoS protection using AWS shield.
So, if your organization is concerned about some kind of
DDoS attack, then one, you can rest assured knowing that
you already get a notable level of protection
with Shield Standard, without having to do anything.
And then of course, if you want further protection,
if you want that more deeper protection,
if you want access to some type of DDoS support team,
then take a look at Shield Advanced.