AWS Shield Advanced

Overview

An AWS Shield Advanced NSM policy turns on Shield Advanced protection for each resource in its scope. It doesn't contain NSM rules, and it doesn't configure Shield Advanced itself. For the recommended Shield Advanced NSM policy, its priority, and its scope, see Shield Advanced in the AWS WAF Recommended Design.

Configure Shield Advanced outside NSM

Before NSM can turn on protection, each account must subscribe to Shield Advanced. Configure the subscription and account-level settings, such as Shield Response Team (SRT) access and proactive engagement, outside NSM. The AWS Shield Advanced One-Click Deployment repository has code examples that show how to automatically configure the parts of Shield Advanced beyond resource protection, such as the subscription and SRT access.

Configure layer 7 DDoS protection with an AWS WAF NSM rule

Configure layer 7 DDoS protection with the Anti-DDoS AMR rule group in an AWS WAF NSM rule, not with the Shield Advanced NSM policy. For the NSM rule, see Anti-DDoS in the AWS WAF Rule Examples. For the NSM policy that contains it, see Anti-DDoS in the AWS WAF Recommended Design.