Welcome to this comprehensive guide on getting started with AWS Shield Advanced. As you embark on your journey to fortify your cloud infrastructure against cyber threats, I, Ian Olson, a Senior Technical Account Manager at AWS, am here to walk you through the process step by step. In this guide, we will cover everything from subscribing to Shield Advanced to configuring protected resources, monitoring events, and more. Let’s dive in!
Subscribing to Shield Advanced
The first step in enhancing your security posture with AWS Shield Advanced is to subscribe to the service. Let’s go through what this entails and understand key considerations:
- Pricing: Shield Advanced comes with a subscription fee of $3,000 per month, covering your entire organization, not per account. Additional data transfer out fees for protected resources apply. Contact your AWS representative for multi-payer setups.
- Commitment: Subscribing to Shield Advanced involves a 12-month commitment. However, you have the flexibility to disable auto-renewal if needed.
- Resource Protection: Shield Advanced is global and covers your entire AWS infrastructure. There’s no need to configure it regionally.
Configuring Protected Resources
Protecting your resources involves associating AWS Shield Advanced with them. Follow these steps to configure protected resources:
- Web ACL Configuration: Associate a Web Application Firewall (WAF) Web ACL with your resource. A default rate-based rule for DDoS protection is automatically added.
- Health Checks: Configure optional health checks to ensure the resource’s availability. Route 53 health checks help proactively engage AWS Shield Advanced during potential DDoS attacks.
- SRT Support Access: Establish AWS SRT (Shield Response Team) Support Access to allow timely updates to your WAF Web ACL in case of an attack.
- Contacts for Proactive Engagement: Add contacts who can work with AWS SRT during DDoS attacks. Having multiple contacts listed ensures efficient communication.
- Enable Proactive Engagement: Turn on proactive engagement to allow AWS SRT to collaborate with your contacts during potential DDoS events.
Monitoring and Events
AWS Shield Advanced provides insightful monitoring and event management capabilities:
- Event Dashboard: The event dashboard displays ongoing and past DDoS events. It showcases mitigated and ongoing attacks, with details such as attack vector and duration.
- CloudWatch Metrics: The AWS DDoS Protection namespace in CloudWatch Metrics offers granular insights into attack traffic, mitigations, and more.
- CloudWatch Alarms: Configure CloudWatch Alarms to notify you when a DDoS attack is detected. Customize alarm thresholds and actions based on your requirements.
Supplementary AWS Services
Enhance your Shield Advanced setup with supplementary AWS services:
- Firewall Manager: Leverage Firewall Manager to automatically configure WAF rules and Shield protection for your resources, ensuring consistent security across your organization.
- WAF Rules: Explore AWS Managed Rules and custom rule groups to tailor your WAF protection to your application’s needs.
- Security Hub Integration: Utilize Security Hub to centralize event monitoring and alerts across multiple AWS accounts, providing a holistic view of your security posture.
Additional Resources and Best Practices
- DDoS Resiliency White Paper: Dive into AWS’s white paper on DDoS resiliency and best practices. Learn about architectural considerations and technology concepts to strengthen your defenses.
- Security Blog: Gain insights from the security blog, focusing on top WAF rate-based rules and how to configure them effectively.
As you embark on your journey with AWS Shield Advanced, keep these resources in mind to ensure robust protection and preparedness against DDoS attacks. Remember, security is an ongoing process, and AWS is committed to helping you stay ahead in the ever-evolving landscape of cybersecurity.
Thank you for joining me on this comprehensive guide to getting started with AWS Shield Advanced. Your dedication to securing your cloud environment is commendable, and with the right tools and practices, you’re well on your way to building a robust defense against DDoS attacks.