A Complete Guide in 2024

Posted on August 25, 2024August 25, 2024 by cloudmatrix.website

At its simplest, the primary difference between AWS Shield vs WAF is that Shield protects against distributed denial-of-service (DDoS) attacks, whereas WAF protects web apps from harmful web requests. AWS Shield works at the network, transport and application layers, but AWS WAF (Web Application Firewall) works at the application layer only.

AWS Shield and AWS WAF fall under the “network and application protection” category of AWS security tools. However, their primary functions are distinct, and understanding these differences is crucial to their proper usage.

Factor:	AWS Shield	AWS WAF
Function	Protects against DDoS attacks	Protects web applications from unauthorized traffic
Protection Layer	Network, transport & application layers	Application layer
Blocked Attacks	DDoS attacks	Cross-site scripting, SQL injection attacks & other common web exploits due to unauthorized ingress; may also provide some protection against DDoS attacks
Configuration	Requires less configuration because it’s a managed service	Requires more configuration, such as conditions & rules
Cost	Shield Advanced requires a 1-year commitment with a $3,000 monthly fee, plus data transfer usage that varies based on the service that’s using Shield. Shield Standard is free.	Cost depends on the number of access control lists (ACLs), rules & requests. CAPTCHA attempts & challenge responses come with extra charges. Bot control and fraud control incur a $10 monthly subscription fee per Web ACL, along with request charges.
DDoS Protection	Provides DDoS protection at layers 3, 4 & 7	Can provide some degree of DDoS protection at layer 7
Managed Service	Shield is a managed service.	WAF isn’t a managed service, but it has a “managed rules” feature.

What Is AWS Shield?

AWS Shield is a network security service that provides protection against DDoS attacks.

What is a DDoS attack? A DDoS attack is a situation where a resource is overwhelmed with illegitimate traffic, leaving it unavailable to legitimate users.

AWS Shield monitors, detects and weakens DDoS-related activities in an AWS account.

AWS Shield is a managed service available in two tiers: Standard and Advanced. The Standard version comes at no extra cost, but AWS Shield Advanced offers more security features.

How Does AWS Shield Work?

AWS Shield works to protect against network, application and transport layer DDoS attacks: layers 3, 7 and 4 of the OSI model, respectively. An attack vector is the method that an attacker uses to exploit a system, and AWS Shield detects and mitigates various DDoS and zero-day attack vectors.

How does AWS Shield detect attacks? In the network and transport layers, AWS Shield detects attacks by inspecting packets coming into the AWS Cloud, checking for traffic elevations, performing health checks and scanning for time to live (TTL) elevations.

In the application layer, Shield creates a baseline for an application based on the app’s request volume. After that, it monitors incoming traffic and app requests, and compares them against the known baseline.

AWS Shield primarily mitigates attacks using packet validation, suspicion scoring, rate distribution, a TCP SYN proxy, access control lists (ACLs) and traffic shaping.

What Does AWS Shield Protect From?

AWS Shield protects against three main categories of attacks: network volumetric attacks, network protocol attacks and application layer attacks. These attacks affect the network, transport and application layers, respectively.

Network volumetric attacks: AWS Shield protects against network volumetric attacks like a DNS query flood, using mechanisms like rate limiting and query filtering.
Network protocol attacks: To defend against network protocol attacks, such as TCP SYN flood attacks, AWS Shield uses a TCP SYN proxy.
Application layer attacks: Shield mitigates application layer attacks, including HTTP flood and cache-busting attacks, using mechanisms like WAF ACLs, rate limiting and traffic shaping.

What Levels of Protection Does AWS Shield Provide Against DDoS Attacks?

AWS Shield provides automatic attack mitigation and static thresholds for DDoS attacks in the AWS Shield Standard tier. However, the Advanced tier offers advanced attack mitigation, health-based detection, custom DDoS thresholds and many more levels of protection.

AWS Shield Standard

AWS Shield Standard is enabled by default on all AWS accounts, and it’s completely free. It offers protection based on static DDoS thresholds against common attacks, particularly those that target the network and transport layers. It also offers inline attack mitigation.

Static DDoS Protection Threshold

AWS Shield Standard monitors traffic coming into your AWS services, enabling you to set fixed thresholds for monitoring. However, you can’t use tailored configurations for application protection.

Inline Attack Mitigation

AWS Shield Standard’s inline attack mitigation allows for the attenuation of DDoS attacks without introducing extra latency into the network. Some of these inline attack mitigation techniques include priority-based traffic shaping and deterministic packet filtering.

AWS Shield Advanced

AWS Shield Advanced provides an even higher level of protection than Shield Standard, with additional detection and mitigation features at the application layer. It also comes with round-the-clock access to the AWS Shield Response Team for customers on the Enterprise or Business Support plans.

Health-Based Detection

You can configure Shield Advanced to detect DDoS attacks affecting your application’s health. This makes for increased accuracy in threat detection and even supports mitigation.

Advanced Attack Mitigation

Shield Advanced’s attack mitigation offers more protection against sophisticated DDoS attacks compared to Shield Standard. For example, you get advanced routing techniques, which automatically deploy extra resources that help route DDoS traffic away from your application. Shield Advanced can also set up AWS WAF rules to proactively mitigate DDoS attacks.

The Shield Advanced’s attack mitigation techniques are tailored to protect applications running on Amazon Elastic Compute Cloud (EC2), CloudFront, Elastic Load Balancing, Amazon Route 53 and AWS Global Accelerator.

Tailored Detection

You can configure DDoS thresholds based on the traffic patterns of protected services. This increases detection accuracy and sensitivity.

Automatic Mitigation at Application Layer

Shield Advanced automatically responds to DDoS threats at the application layer without manual intervention. It can also create AWS WAF security rules to weaken DDoS threats.

Visibility and Attack

With Shield Advanced, you can get summarized or detailed information and notifications about DDoS threats in near real-time.

Protection Groups

With Shield Advanced, you can add resources to a protection group. In a protection group, the resources are handled as a single unit, making for efficient detection and mitigation, accurate detections and reduced false positives.

Specialized Support

AWS customers on the Enterprise and Business support plans can access the AWS Shield Response Team when using Shield Advanced.

Cost Protection

Shield Advanced protects against costs that may be incurred due to resource scaling triggered by DDoS attacks.

Centralized Protection Management

You can manage AWS Shield Advanced and AWS WAF centrally from the AWS Firewall Manager.

Global Availability

Shield Advanced is available in all CloudFront, Global Accelerator and Route 53 locations worldwide. You can also protect resources behind Elastic Load Balancing and Elastic IPs in any AWS region.

Proactive Event Response

Shield Advanced’s “proactive engagement” feature lets the Shield Response Team contact you when your resource’s Route 53 health check fails during a DDoS attack. This allows you to gain rapid access to expert support while ensuring quick resolution and sustained uptime.

How Much Does AWS Shield Cost?

AWS Shield Standard is free of charge and available to all users. However, a Shield Advanced subscription costs $3,000 per month and requires a one-year commitment. It also comes with “data transfer out” usage fees, which are charged per gigabyte. The unit price for these usage fees varies by region and depends on the service that’s utilizing AWS Shield Advanced.

What Are the Use Cases of AWS Shield?

AWS Shield’s use cases include any scenario where DDoS protection is essential. Of course, Shield Advanced is better than Shield Standard thanks to its higher levels of protection and customization, and its ability to provide application layer protection.

Here are some ways you can use AWS Shield:

Protecting TCP-based apps against TCP SYN floods: You can protect a TCP-based app, such as a file transfer protocol service, from a TCP SYN flood using AWS Shield’s TCP SYN proxy.
Providing HTTP flood protection to web apps: Shield can protect your web app against HTTP flood attacks using AWS WAF rate limiting rules, traffic isolation and ACLs.
Protecting UDP-based games from UDP reflection attacks: Through a combination of features, like packet validation, rate limiting and UDP-exposure limiting, AWS Shield can attenuate UDP reflection attacks.

What Are the Pros of AWS Shield?

The pros of AWS Shield include automated protection, free usage, ease of use, cost protection, attack visibility, expert support and customizability on the Advanced plan. AWS Shield offers thorough protection against DDoS attacks, ensuring the uptime, safety and accessibility of infrastructure and applications in the AWS Cloud.

Here’s a deeper dive into the benefits of AWS Shield:

Automated protection: Shield automatically mitigates common DDoS attacks.
Available for free: AWS Shield Standard comes at no extra cost.
Ease of use: Since it’s a managed service, you don’t have to do much to get AWS Shield to work.
Cost protection: When you opt for Shield Advanced, you’re covered if your costs increase as your resources scale up due to DDoS attacks.
Attack visibility: Shield Advanced provides near real-time insights on DDoS attacks.
Expert support: With Shield Advanced, customers on the Business or Enterprise support plans get 24/7 access to the AWS DDoS response team.
Customizability: There’s more room for custom configurations when you get Shield Advanced.

What Are the Cons of AWS Shield?

The cons of AWS Shield include a lack of expert support and limited customizability on the standard plan, lengthy commitments, and a costly advanced plan. AWS Shield Advanced requires a one-year commitment, and AWS Shield Standard doesn’t offer expert support.

The following are some cons of AWS Shield:

Lack of expert support: Shield Standard doesn’t provide access to the AWS Shield Response Team.
Lengthy commitments: An AWS Shield Advanced subscription requires you to make a one-year commitment.
Costly payments: Besides the one-year commitment, some organizations may find the $3,000 monthly payments to be pricey.
Limited customizability: Unlike Shield Advanced, Shield Standard offers limited custom configurations.

What Are the Advantages of AWS Shield Over AWS WAF?

AWS Shield doesn’t necessarily have an advantage over AWS WAF — in fact, using both services together makes for better protection. That said, Shield is the better option for DDoS attacks, while WAF is best for web application attacks like SQL injection.

What Is AWS WAF (Web Application Firewall)?

AWS WAF is short for AWS Web Application Firewall. Being a firewall, it stands between a web application and the network traffic that traverses the app. AWS WAF protects against common web app exploits due to unauthorized ingress. Such exploits include SQL injection, cross-site scripting and even DDoS attacks.

Besides protecting against web exploits, AWS WAF offers bot control and fraud prevention related to account creation and account takeovers. It’s also integrated with AWS CloudWatch, so you can monitor its activities in real time.

How Does AWS WAF Work?

AWS WAF works by describing and controlling how an application responds to web queries. It primarily achieves this through web access control lists (web ACLs). Web ACLs are made up of rules, and those rules have their own conditions.

Here are some more insights regarding web ACLs, rules and conditions:

Web ACLs: At their simplest, web ACLs control the traffic going into your application based on custom rules. They can allow or block certain requests depending on the conditions and actions stated in their rules.
Rules: Rules can either be managed or user-defined. They set conditions for how a web ACL should inspect a request, and define what action to take based on those conditions. You can create a rule group to collect WAF rules that you want to reuse. You may also get rule groups from AWS Managed Rules and sellers on AWS Marketplace.
Conditions: A condition is an identifier for the request you want WAF to allow or block. This could be an IP address, string match and so on.

What Does AWS WAF Protect From?

AWS WAF protects from common web threats like DDoS attacks in layer 7, SQL injection, cross-site scripting, bot traffic control and many others.

DDoS attacks: With WAF, you can write rules to block requests with unexpected patterns. This reduces HTTP flood attacks, which are a type of DDoS attack. You can also add rate-limiting rules to shut out voluminous traffic within a certain duration.
SQL injection: WAF lets you add rules that inspect for malicious SQL codes, such as those that try to steal data from your database.
Cross-site scripting: To prevent cross-site scripting, configure WAF rules to monitor for harmful scripts. These rules may contain conditions for query or URI string matching.

What Layer Is WAF in AWS?

AWS WAF is in the application layer (layer 7), where it filters web traffic (HTTP and HTTPS) to prevent common web exploits.

What Are the Features of AWS WAF?

AWS Web Application (WAF) features include web traffic filtering, bot control, fraud control, real-time visibility, AWS Firewall Manager integration and full feature API.

Web traffic filtering: WAF features custom and managed rules that determine which HTTP/HTTPS queries are allowed or blocked.
Bot control: Bot control is a WAF managed rule group that protects against persistent bot traffic.
Fraud control: This managed rule group offers two types of fraud prevention: account takeover and account creation. Account takeover fraud prevention monitors the app’s login page to prevent unauthorized access. Account creation fraud prevention monitors the signup page to prevent the creation of suspicious accounts.
Real-time visibility: AWS WAF captures web requests and provides details, such as IP addresses, referrers, metrics, URIs and so on. It can also send notifications based on defined thresholds through its integration with CloudWatch.
AWS Firewall Manager integration: Like AWS Shield Advanced, you can centrally manage AWS WAF from AWS Firewall Manager.
Full feature API: All WAF features are available via the AWS WAF API.

How Much Does AWS WAF Cost?

AWS WAF offers monthly pricing based on the number of access control lists (ACLs), rules and requests (prorated per hour). CAPTCHA attempts and challenge responses cost extra based on the volume.

AWS WAF bot control has a monthly subscription fee of $10 per web ACL. You’re also charged per million requests, with targeted bot control being more expensive than common bot control. Like regular WAF rules, extra charges are incurred for CAPTCHA attempts and challenge responses.

The “fraud control” feature also has a $10 monthly subscription per web ACL. You get charged per million requests analyzed, with larger request volumes having lower unit costs compared to smaller ones. However, you don’t pay separately for CAPTCHA attempts and challenge responses.

What Are the Use Cases of AWS WAF?

AWS WAF has many use cases, including preventing common web app attacks such as SQL injection and cross-site scripting.

Here are some examples of WAF’s roles and use cases:

Protecting web apps against HTTP flood attacks: WAF can protect against flood attacks using rate limiting and traffic isolation, and by blocking out requests with unusual patterns.
Stopping SQL codes from extracting data from databases: WAF looks out for and blocks SQL codes that may try to gain unauthorized access to your app’s database.
Controlling bot traffic into web apps: You can create rules to block traffic from specific bots. However, if reducing traffic is your main goal, then you can limit bot traffic using rate-based rules. You may also use WAF’s “bot control” feature.

What Are the Pros of AWS WAF?

The primary pros of AWS WAF is increased protection against common web application threats, high customizability, reasonable costs, third-party integrations and managed rule groups.

Here’s a breakdown of these benefits:

Protection from common web threats: AWS WAF effectively protects web apps from common web vulnerabilities like XSS (cross-site scripting) and SQL injection.
High customizability: You get to create custom rules and conditions based on the types of threats you want to prevent.
Reasonable costs: The pricing is generally based on usage volume.
Integrations with other security services: WAF integrates seamlessly with services like CloudFront, Application Load Balancing and API Gateway.
Managed rule groups: Managed rule groups provide quick and easy access to ACL rules.

What Are the Cons of AWS WAF?

The main cons of AWS WAF is that configuration can be complex, and the service gets more expensive with increased requests.

Complexity: Configuring WAF can be difficult if the rules are complex.
Limited DDoS protection: WAF provides some degree of DDoS protection, but it’s limited to layer 7.
Body inspection size limits: AWS WAF can inspect only request bodies up to 64KB.

What Are the Advantages of AWS WAF Over AWS Shield?

AWS WAF and AWS Shield are suited for different purposes, so WAF doesn’t necessarily have an advantage over Shield. In spite of that, AWS WAF is the better option to protect against web attacks such as SQL injection and cross-site scripting.

Can AWS WAF and AWS Shield Be Used Together?

Yes, AWS WAF and AWS Shield can be used together. In fact, AWS Shield Advanced employs some AWS WAF features for DDoS protection in the application layer.

What Are the Other AWS Security Services?

Other AWS services related to network and application security include AWS Firewall Manager, AWS Network Firewall, AWS Verified Access, and Route 53 Resolver DNS Firewall.

AWS Firewall Manager: Firewall Manager allows for the central configuration and management of firewalls across AWS accounts.
AWS Network Firewall: Network Firewall controls traffic between layer 3 and layer 7, providing extra protection to a VPC.
AWS Verified Access: AWS Verified Access facilitates secure access to corporate resources without requiring a VPN.
Route 53 Resolver DNS Firewall: Amazon’s Route 53 Resolver DNS Firewall controls and filters outgoing VPC DNS traffic.

What Is the Difference Between AWS WAF and Network Firewall?

AWS WAF and Network Firewall differ in that WAF functions at the application layer to protect web apps, whereas Network Firewall filters traffic between the network and application layers (layers 3 to 7) to provide VPC security.

What Is the Difference Between AWS WAF and Firewall Manager?

AWS WAF controls and filters web application traffic to an app in an AWS account, while Firewall Manager centrally configures and manages firewalls across multiple AWS accounts.

What Is the Difference Between AWS Shield and GuardDuty?

AWS Shield provides DDoS protection, but Amazon GuardDuty uses machine learning to continuously monitor, detect and remediate various security threats in an AWS account.

Final Thoughts

AWS WAF is a security service that protects web apps in an AWS environment from regular web threats by filtering app requests. On the other hand, AWS Shield is a different security service that defends AWS resources against DDoS attacks.

Between AWS Shield and WAF, which do you think is more vital to network security? Have you used any of the other AWS security services mentioned in this guide? What was your experience with it? Let us know your thoughts in the comments. Thank you for reading.

FAQ

AWS WAF and AWS Shield differ in that WAF protects against web exploits by controlling web traffic, while Shield detects and mitigates DDoS attacks.
WAF is an AWS service, while Site Shield is an Akamai service. WAF filters malicious web traffic, whereas Site Shield removes apps from the public IP address space, therefore reducing the attack surface.
AWS Shield is used for spotting and attenuating DDoS attacks in the network, transport and application layers.
Shield Advanced includes WAF features, such as web ACLs, rules and rule groups.