Lecture 229: AWS Shield and Shield Advanced (DDoS protection)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：09:04
- 来源：Udemy Lecture 42734228
- Slide 数量：6
- 画面切换：02:01、04:02、04:33、05:43、07:01
扫描说明
逐条读取了 Udemy 页面中的 120 条英文 Transcript cue，并按时间轴扫描全长约 09:04 的视频。依据 DDoS 原理、常见攻击、Shield+WAF 分层、Standard/Advanced 对比、SRT/Cost Protection、Advanced 考点总结划分为 6 个小节。6 张截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。价格与 Support Plan 条件按视频口径记录，实际采用前应核对 AWS 当前条款。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. DDoS 以 Availability 为目标，用分布式 Bot 压垮资源
时间范围：00:00–02:01
总结 / Summary
中文
Denial of Service 的目标通常不是直接取得 Unauthorized Access，而是破坏 Availability：攻击流量耗尽 Server 的 CPU、Memory、Connection Table 或 Network Bandwidth，使 Legitimate User 无法访问。Distributed DoS 由 Attacker 控制多个 Controller/Bot，成千上万个来源同时请求，规模更大且更难按单一 IP 阻断。攻击可能发生在 Infrastructure Layer（常见 Layer 3/4）或 Application Layer（Layer 7）。
English
Denial of service usually aims not to gain unauthorized access but to destroy availability by exhausting CPU, memory, connection tables, or network bandwidth so legitimate users cannot reach the application. Distributed DoS uses controllers and large bot populations to send traffic from many sources at once, making the attack larger and harder to stop by blocking one IP. Attacks can target infrastructure layers, commonly Layers 3 and 4, or the application layer at Layer 7.
Transcript
00:00 Hi.
00:05 So in this lecture let's talk about another firewall that is AWS shield.
00:09 Now earlier we talked about web application firewall which works at layer seven.
00:17 your data so that user can't run, say, cross site scripting and those kind of attacks.
00:23 But the purpose of AWS shield service is to protect your resources from the DDoS attack.
00:28 That is denial of service.
00:30 So again, the purpose is not to have the unauthorized access, but to affect the availability of your
00:38 application.
00:39 So for an example, if your users are using your application, your website, then the attacker will
00:46 just send too many requests to your application server so that your application is overwhelmed with
00:51 respect to the CPU, memory and the network, and your legitimate users cannot access your application.
00:58 So that is called denial of service attack.
01:00 And very common denial of service attack is called DDoS attack that is distributed denial of service
01:06 attack, which is much larger in volume.
01:10 So on the right side you have application server and there are normal users who are accessing your application.
01:15 Now attacker will come in and then attacker will just have few controllers.
01:21 Now this controllers can then amplify these attacks by using the bots.
01:25 So there will be thousands of bots.
01:27 And all these are making requests to your application server at the same time.
01:32 So your application server will be too busy to, you know, serve all these requests and your legitimate
01:37 users may not be able to, you know, access your application or it will be very, very slow.
01:42 So that's the DDoS attack.
01:45 And typically DDoS attacks happens at layer three and layer four or layer six and seven of the OSI network
01:53 layer.
01:53 So layer three and four are called the infrastructure layer attacks.
01:57 And six and seven are called application layer attacks.
2. SYN/UDP Flood、Reflection、DNS Flood 与 Slowloris
时间范围：02:01–04:02
总结 / Summary
中文
SYN Flood 发起大量 TCP Handshake 却不完成 ACK，迫使 Server 保留 Half-open Connection；UDP/ICMP Flood 用海量 Packet 消耗 Network/Compute；UDP Reflection 伪造 Victim Source IP，借第三方 Server 把放大 Response 反射给 Victim；DNS Flood 压垮 Name Resolution，使用户无法取得 Application IP；Slowloris 则建立大量看似合法但极慢的 HTTP Connection，长期占用 Server Slot。不同 Vector 需要 Network 与 Application 两层检测。
English
A SYN flood starts many TCP handshakes without completing the ACK, forcing the server to retain half-open connections. UDP or ICMP floods consume network and compute capacity. UDP reflection spoofs the victim's source IP so third-party servers amplify responses toward the victim. DNS floods overwhelm name resolution, preventing users from finding the application. Slowloris holds many apparently legitimate HTTP connections open by progressing very slowly. These vectors require protection at both network and application layers.
Transcript
02:01 And just for your information, what are the common type of the DDoS attacks?
02:05 So there are something called syn flood attacks.
02:08 In this case, client sends the TCP handshake request to the server but never completes that request.
02:14 So server sends back the Syn acknowledgement request and then client never sends back the Ack signal
02:20 back to the server.
02:21 So those TCP connections are kept open.
02:24 And if there are millions of such connections, then of course server has to maintain those many open
02:30 TCP connections and it can't accept any more, so your users can't access your application server.
02:36 Similarly, clients send the UDP request to scan your ports or ICMP requests to your server, and if
02:43 there are millions of such requests, then server is again overwhelmed.
02:47 Then there is UDP reflection attack.
02:49 In this case, client spoofs your IP as if you are sending requests to the internet server, and all
02:57 these internet server will send you back the response.
03:00 Even though you haven't initiated those requests.
03:03 So that's called UDP reflection attack.
03:06 Then there is DNS flood attack, which targets your DNS server.
03:10 And you know that DNS are like phone books.
03:13 So if you don't have DNS resolution for your DNS query, you don't get the IP address of the application
03:19 server and no one can reach to your server.
03:22 So it is very important that your DNS can handle all these attacks.
03:27 And finally, there is a slow loris attack.
03:29 And this is a very common attack and very difficult to detect.
03:34 This is because all the traffic that comes to your server looks very legitimate.
03:39 So for example, if you provide the login pages, the client will ask for the login page but will just
03:46 not respond with the next step.
03:48 So they are very, very slow and they will try to be as slow as possible.
03:53 So your server thinks that it is a legitimate traffic, but then has to keep all those connections open.
03:59 So that's a slow loris attack.
3. Shield 与 WAF 可叠加：DDoS Mitigation 不替代 Web Attack Filtering
时间范围：04:02–04:33
总结 / Summary
中文
AWS Shield/Shield Advanced 放在受保护 AWS Resource 的前方缓解 DDoS，AWS WAF 则检查 HTTP(S) Layer 7 Request，例如 XSS、SQLi、Bot 与 Rate Pattern。两者不是互斥选择：Edge/Application 可以同时启用 Shield 与 WAF。考试需先识别题目目标——Availability/Volumetric Attack 倾向 Shield，Application Payload Exploit 倾向 WAF，复杂场景通常组合。
English
AWS Shield and Shield Advanced mitigate DDoS before protected AWS resources, while AWS WAF inspects HTTP(S) Layer 7 requests for issues such as XSS, SQL injection, bots, and rate patterns. The services are complementary rather than mutually exclusive. Exam scenarios should distinguish availability or volumetric attacks, which point toward Shield, from application-payload exploits, which point toward WAF; sophisticated designs use both.
Transcript
04:02 And as you might have guessed, in order to protect your AWS resources and services from this attack,
04:08 you need AWS shield service.
04:11 So there is AWS shield and there is a variation to that.
04:15 That is shield advance, which you put in the front of the traffic.
04:19 And then all your AWS resources sit behind this firewall and you can use AWS WAF as well along with
04:27 the shield.
04:27 So these are not mutually exclusive service, but you can use them together.
4. Shield Standard 自动启用；Shield Advanced 扩大 Resource 与响应能力
时间范围：04:33–05:43
总结 / Summary
中文
Shield Standard 对所有 AWS Customer 自动启用且不单独收费，主要缓解常见 Layer 3/4 DDoS，并原生保护 CloudFront、Route 53、ELB 等受支持 Service。Shield Advanced 是订阅服务，覆盖更复杂攻击并允许为 Route 53、CloudFront、ELB、Global Accelerator 以及绑定 Elastic IP 的 EC2/NAT 等 Resource 建立 Protection。本视频给出的价格示例是每个 Organization 每月 3,000 美元；价格/承诺期属于时效性信息，实施前需复核。
English
Shield Standard is automatically enabled for AWS customers at no separate charge, primarily mitigating common Layer 3/4 DDoS attacks for supported services such as CloudFront, Route 53, and ELB. Shield Advanced is a subscription that covers more sophisticated attacks and lets customers protect resources including Route 53, CloudFront, ELB, Global Accelerator, and Elastic-IP-associated resources such as EC2 or NAT. The lecture quotes $3,000 per organization per month; pricing and commitment terms are time-sensitive and should be rechecked before adoption.
Transcript
04:33 So what is shield and shield advanced?
04:35 So of course AWS shield is the standard service and it comes free.
04:41 That means it is enabled for all AWS customers automatically.
04:44 You don't have to do anything.
04:47 So shields typically protect you from the layer three and layer four infrastructure layer attacks.
04:54 That is sin and UDP floods reflection attacks likewise.
04:57 And these are automatically enabled if you are using AWS services like Application Load Balancer, CloudFront
05:04 or route 53.
05:07 But AWS shield doesn't protect your resources from all types of the DDoS attacks.
05:12 So if you need protection from layer seven attacks as well, then you should use AWS Shield Advanced.
05:18 And of course it's a paid service.
05:20 For this, you have to pay $3,000 per month at AWS organization level, so all the accounts within AWS
05:28 organization will be protected by AWS Shield Advance.
05:32 Now it protects all your resources, whether they are EC2 machines with public IPS, Load Balancer,
05:39 CloudFront Global Accelerator, or AWS route 53.
5. SRT 事件响应与 DDoS Cost Protection 降低攻击运营风险
时间范围：05:43–07:01
总结 / Summary
中文
Shield Advanced 提供 24×7 Shield Response Team（SRT）参与 Attack Triage、Root Cause Identification 与 Mitigation。组织可授权 SRT 使用 IAM Role，在需要时帮助部署或调整 WAF Web ACL Rule。DDoS 也可能触发 Auto Scaling 或带宽增长而造成费用峰值；符合条件的 Shield Advanced Cost Protection 可对特定受保护资源的 DDoS-related Scaling Charge 提供 AWS Credit，降低攻击带来的财务影响。
English
Shield Advanced provides 24×7 access to the Shield Response Team for attack triage, root-cause identification, and mitigation. An organization can authorize SRT through an IAM role to help deploy or adjust WAF web ACL rules when needed. DDoS can also trigger Auto Scaling or bandwidth growth and create a billing spike; eligible Shield Advanced cost protection can provide AWS credits for DDoS-related scaling charges on protected resources, reducing financial impact.
Transcript
05:43 And additionally, you get access to AWS SRT team that is Shield Response Team.
05:51 So if there is a possible attack on your resources, then you can engage with this SRT team of AWS and
05:58 they will help you identify the attack, identify the root cause, and also apply the mitigations on
06:05 your behalf.
06:07 And one more benefit of using the shield advance is that generally you have auto scaling configured
06:14 in your application, which means if your CPU reaches, say, 70%, you might scale out, right?
06:20 And if there is a DDoS, then also your application will scale because it will think that it's a legitimate
06:26 traffic.
06:26 So your application will just go on scaling.
06:30 That means due to DDoS attack, you are going to pay extra money because there is a scaling happening
06:37 now.
06:38 AWS Shield Advance also protect you from this kind of additional cost when there is a DDoS attack on
06:45 your AWS resources.
06:46 So in this case, AWS will provide you AWS credit, which is nothing but AWS usage fees that you pay
06:54 so that you can handle this kind of spikes.
06:57 So that's another benefit of using the shield advance.
6. Shield Advanced 考点：Protected Resource、Support、Forensics、WAF 与 Credit
时间范围：07:01–09:04
总结 / Summary
中文
总结 Advanced 能力：针对大规模、复杂 DDoS；保护 Route 53、CloudFront、ELB、Global Accelerator 及 Elastic IP Resource；按本视频口径，Business/Enterprise Support Customer 可 24×7 联系 SRT；SRT 能分析 Layer 7 Pattern，并在授予 IAM Role 后协助下发 WAF Rule；Customer 可获得 Attack Forensic Report；符合条件时获得 DDoS Billing Spike Credit。Advanced 也包含与 DDoS 防护相关的部分 WAF Benefit，但仍需正确配置 Web ACL 与 Resource Protection。
English
Key Advanced capabilities are protection from large, sophisticated DDoS attacks; coverage for Route 53, CloudFront, ELB, Global Accelerator, and Elastic-IP resources; 24×7 SRT engagement under the lecture's stated support-plan conditions; Layer 7 pattern analysis and assisted WAF-rule deployment when an IAM role is granted; attack forensic reports; and eligible credits for DDoS-related billing spikes. Advanced also includes WAF-related DDoS benefits, but web ACLs and protected resources must still be configured correctly.
Transcript
07:01 So that's AWS Shield Advanced.
07:04 Now for your exam you just need to know that there is this service AWS shield.
07:08 And it protects you from the DDoS attack.
07:11 So just to summarize, AWS Shield Advanced provides the protection against more sophisticated DDoS attacks.
07:18 And it protects your resources like route 53, CloudFront, ELB, Global Accelerator, and any resources
07:25 which are using the elastic IP addresses.
07:28 Then for using the shield, advanced customer has to subscribe to business or enterprise support plan
07:35 so that they can engage with AWS Shield Response team that is called SRT.
07:41 Now SRT team helps you to identify layer seven attacks and patterns, and they can also automatically
07:48 deploy the corresponding web application firewall that is WAF rules, so that all these application
07:55 layer attacks can be protected.
07:56 Now for that they need to use IAM role in your account.
08:00 So you have to grant that permission to the SRT team.
08:03 Now we haven't specifically talked about this, but when you enable the AWS shield advance, you also
08:09 get some of the features of AWS Web Application Firewall as free, which are related to DDoS attacks.
08:16 So you don't have to pay separately for all these WAF rules.
08:20 Now, as you engage with the SRT team, you also get the complete forensic report of the attack from
08:27 this SRT.
08:27 And as I said, you get AWS credits against any spike usage due to the DDoS attack, right?
08:35 So I think these are the important things that you need to know about the DDoS protection using AWS
08:41 shield and for your projects.
08:43 If you are interested to know more to apply this in real life, then I would encourage to read this
08:49 white paper which talks about all the best practices for DDoS protection.
08:55 But for your exam?
08:56 I don't think so.
08:57 You need to read this white paper.
08:59 So that's it about this lecture.
09:01 Thanks for watching and stay tuned.
整讲总结 / Overall Summary
中文
AWS Shield Standard 自动缓解受支持 Edge Service 的常见 Layer 3/4 DDoS；Shield Advanced 是面向关键 Workload 的付费扩展，提供更广 Resource Protection、SRT、Forensic Report、WAF 协助与符合条件的 Cost Protection。它与 AWS WAF 互补：Shield 主要守 Availability/DDoS，WAF 主要过滤 Layer 7 Web Request。题目中还要根据 SYN/UDP/Reflection/DNS/Slowloris 等 Vector 判断攻击层与控制点。
English
AWS Shield Standard automatically mitigates common Layer 3/4 DDoS attacks for supported edge services. Shield Advanced is the paid extension for critical workloads, adding broader resource protection, SRT access, forensic reporting, WAF assistance, and eligible cost protection. It complements AWS WAF: Shield primarily protects availability from DDoS, while WAF filters Layer 7 web requests. Scenarios also require mapping vectors such as SYN, UDP, reflection, DNS flood, and Slowloris to the relevant attack layer and control point.
返回顶部 ↑