shieldadvanced

Subscribe the owning account with aws shield create-subscription in us-east-1, then explicitly add each resource with create-protection. Subscribing alone protects nothing; resources like CloudFront distributions, load balancers, Elastic IPs, Global Accelerator, and Route 53 hosted zones must be added individually.

Shield Standard is free and always on for layer 3/4 attacks, and AWS WAF rate-based rules plus the Anti-DDoS managed rule group cover layer 7 floods without a subscription. Choose Shield Advanced only if you need cost protection credits, SRT access, automatic mitigation, health-based detection, or detailed attack reporting.

Shield Advanced needs a baseline of roughly 24 to 30 days of traffic before it can tailor custom rules. Run in Count mode during the baseline, confirm an AWS WAF v2 web ACL is associated, and never remove the ShieldMitigationRuleGroup from the web ACL.

File a Billing support case with "DDoS Concession" in the subject within 15 days after the billing month of the attack closes. Eligibility requires that protection predated the attack and that a rate-based AWS WAF rule was in Block mode on CloudFront and Application Load Balancer resources.

Proactive engagement requires a Business or Enterprise Support plan, an associated Route 53 health check on each protected resource, and configured emergency contacts. SRT access itself uses an IAM role with the AWSShieldDRTAccessPolicy and a trust policy scoped with an aws:SourceAccount condition.

No, protection groups are detection and reporting only; automatic mitigation still applies per individual resource. Every member must already be individually protected before joining, or the group shows zero members and aggregates nothing.