Security, Identity, and Compliance
AWS Shield
Managed DDoS protection for internet-facing AWS resources.
Key points
- Shield provides managed DDoS protection for supported internet-facing AWS resources.
- It addresses network and transport availability attacks, not application-layer request rules or backend authorization.
Best-known use cases
- Protect internet-facing ingestion APIs from distributed denial-of-service attacks.
- Improve availability for public dashboards and data endpoints during network attacks.
What candidates often confuse it with
- Shield mitigates DDoS attacks; WAF filters Layer 7 requests and API Gateway governs API behavior.
Key takeaway
Use Shield when public ingestion or reporting endpoints require managed DDoS protection.
Relevant exam tasks
- D1.2 — Task 1.2: Transform and process data
- 1.2.8 — Create data APIs to make data available to other systems by using AWS services.