Build Shield Advanced protection configurations with protection groups, automatic response, and health check associations.
Build Shield Advanced protection configurations with protection groups, automatic response, and health check associations.
Required Fields
NameResourceArnOutput will appear here...Build an AWS Shield Advanced protection configuration, associating a resource (ALB, EIP, CloudFront distribution) with a protection group for aggregated attack-pattern detection, enabling ApplicationLayerAutomaticResponse to auto-block Layer 7 attacks, and linking a Route 53 health check for accurate availability signaling during an active DDoS mitigation. The Aggregation field on a protection group matters more than it looks: SUM treats the group's members as one large surface for volumetric threshold detection, which is right for scaling a fleet-wide detection baseline, while a lower-traffic critical single resource is often better protected on its own or in a MAX-aggregated group instead, so it isn't statistically diluted by high-traffic siblings.
It's possible but is mitigated by the health check association: linking a Route 53 health check lets Shield factor in actual resource health when deciding how aggressively to respond, rather than reacting purely on traffic-pattern anomaly. Even so, automatic Layer 7 blocking carries real false-positive risk for a resource with unusual-but-legitimate traffic spikes (a flash sale, a viral post), test and tune WAF rules alongside this rather than enabling it blind on a business-critical resource.
Without a protection group, Shield evaluates each protected resource's traffic baseline independently. With a SUM-aggregated group, the combined traffic across all members is evaluated as one baseline, which is appropriate when the resources are functionally part of one logical application tier (an ALB plus the EIPs it's associated with) and you want anomaly detection tuned to their combined normal traffic pattern, not each piece in isolation.
No, protection needs to be associated with a resource before an attack begins to provide its full detection-baseline and automatic-mitigation benefit, Shield needs time to establish what 'normal' traffic looks like for that resource. Enabling protection mid-attack still helps (Shield's core always-on infrastructure-level protection applies regardless), but the tuned automatic response and accurate anomaly detection work best with an established baseline.
The builder validates that Name and ResourceArn resolve before accepting the JSON as a valid CreateProtection request, the minimum needed to know what's being protected and under what label; protection group membership, automatic response, and health check association are validated as well-formed JSON but their tuning (aggregation strategy, whether auto-block is safe for this specific resource) depends on your actual traffic pattern.
EmergencyContact needs to be an actually-monitored address and phone number, not a generic team alias nobody checks in real time, the Shield Response Team's outreach during a live incident is time-sensitive and a stale contact defeats the point of having SRT access at all.
Grouping resources with very different traffic profiles under SUM aggregation can dilute anomaly detection for the lower-traffic member, a critical low-traffic resource sharing a group with a high-traffic one may not trigger detection thresholds tuned to the group's combined (much larger) baseline.
ApplicationLayerAutomaticResponse's Block action is a real production risk during a false-positive, pair it with a health check association and, ideally, a period of monitoring in count-only mode before trusting it to auto-block on a genuinely business-critical resource.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.