AWS Shield Standard vs Advanced: DDoS Layers, SRT आणि Cost Protection

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. रोजचे उदाहरण

Lucas Meyer (Berlin): UDP flood → CF+Shield Standard. App-layer → WAF rate. survey.

2. Shield का?

हे का लागतं?

DDoS = bandwidth/pps/connections/workers. WAF = HTTP. Shield = volumetric/protocol + Advanced extras.

3. Shield Standard काय?

हे काय आहे?

Automatic, free — common L3/L4 DDoS. CF, R53, AGA, इतर. On करायला नको — आहेच.

4. Shield Advanced काय?

Paid: enhanced mitigation, SRT, cost protection, health-based detection, protection groups, visibility. Pricing आधी वाचा.

5. DDoS layers 3/4/7

• L3: volumetric — Shield.
• L4: SYN/connections.
• L7: HTTP — WAF (+ Advanced).

6. SRT

Advanced = SRT engage. On-call बदली नाही — multiplier. Black Friday आधी tabletop.

7. Cost protection

Eligible DDoS-driven charges → cost protection terms. Fine print वाचा. Budgets ठेवाच.

8. Health-based detection

R53 health checks → Advanced detection. “Large traffic” पेक्षा unhealthy signal.

9. Protection groups

Resources bundle — एक unit म्हणून mitigate/visibility.

10. Advanced केव्हा घ्यावे

• Revenue-critical + threat
• Regulated + SRT
• Bill-shock fear
• Internal-only → wait

11. Lab: inventory + decision memo

Org block नसेल तर ap-south-1 (Mumbai). आधी budget alert.

कसं करायचं (step by step)

1. List entry points.
2. Standard screenshot.
3. Decision memo.
4. List protections.

Cleanup (billing थांबवा)

1. No surprise Advanced.
2. Wiki memo.

12. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

13. Troubleshooting checklist

1. Scope check.
2. Sampled requests.
3. Priority order.
4. curl -v.
5. Log ruleId.
6. CF region.
7. ALB ARN.
8. Shield health.
9. Layer triage.
10. Shield metrics.
11. SRT path.

14. FAQ

15. Interview Q&A

16. Tips — English, मराठी आणि हिंदी

17. Publish करण्याआधी WAF checklist

1. Threat एका वाक्यात.
2. Global vs regional scope.
3. Default action.
4. Priority bands.
5. Count first.
6. CAPTCHA for humans.
7. Logging first.
8. Allow + 403 tests.
9. On-call owner.
10. CF+WAF survey link.

18. Copy-paste WAF CLI runbook

# Region for REGIONAL Web ACL (ALB / API GW). Use --scope CLOUDFRONT + us-east-1 for CDN.
export AWS_REGION=ap-south-1
export NAME=rb-waf-lab-$(date +%s)

# IP set (office allowlist example)
aws wafv2 create-ip-set --name $NAME-office --scope REGIONAL --region $AWS_REGION \
  --ip-address-version IPV4 --addresses 203.0.113.10/32

# Web ACL skeleton (default Allow; add rules in console or JSON)
aws wafv2 create-web-acl --name $NAME --scope REGIONAL --region $AWS_REGION \
  --default-action Allow={} --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=$NAME \
  --rules file://rules.json

# Associate to ALB
aws wafv2 associate-web-acl --web-acl-arn $WEB_ACL_ARN --resource-arn $ALB_ARN --region $AWS_REGION

# Logging
aws wafv2 put-logging-configuration --logging-configuration \
  ResourceArn=$WEB_ACL_ARN,LogDestinationConfigs=$LOG_BUCKET_ARN

# Test
curl -s -o /dev/null -w "%{http_code}\n" https://app.example.com/
# expect 200 for allow path; 403 for blocked path

19. Interview-friendly priority bands

• 0–99: emergency Block
• 100–199: Allow exceptions
• 200–499: geo/bot
• 500–799: Managed Rules
• 800–899: custom
• 900–999: rate-based

छोटा number = उच्च priority. पहिला terminating action जिंकतो. Count terminate होत नाही.

20. Industry story bank

एकच WAF pattern; फक्त IP/geo/URI/rate बदला.

• Fintech: /login /otp rate + CAPTCHA.
• Healthcare: geo + SQLi.
• EdTech: Challenge scrapers.
• Ecommerce: Bot + 429.
• Media: search rate.
• SaaS: webhook allowlist.
• Logistics: geo + rate.
• Gov: CRS + CAPTCHA.
• Gaming: Shield + rate.
• Travel: geo + card-test block.

21. False-positive unlock runbook

1. Sampled / logs → rule id.
2. curl -v reproduce.
3. Block→Count.
4. Narrow Allow above.
5. Label exclusions.
6. Retest + ticket.
7. Default Allow + empty नको.

22. PR review checklist

• Correct scope.
• Priority table.
• Count → Block date.
• Logs encrypted.
• 200 + 403 proofs.
• Survey link.
• Shield decision.

23. या site वरील related chapters

• CF+WAF survey: chapter
• Well-Architected — पुढचा.
• S3 policy projects.

24. Metric आणि alarm starter pack

Day-one alarms. Thresholds = starting points.

• BlockedRequests spike
• CountedRequests review
• ALB 5xx
• ASG at max
• DDoSDetected
• CF error rate
• R53 unhealthy
• Log delivery

25. Sampled requests वाचन

1. Sampled → rule.
2. Action/URI/country.
3. TP/FP/CAPTCHA.
4. Request ids → ticket.
5. Samples+logs.

26. Glossary

27. 15-minute tabletop

1. Scenario inject.
2. Classify.
3. First clicks + page.
4. Comms.
5. Gap note.

28. Cost notes

WAF = ACL+rules+requests; Bot/ATP जास्त. Shield Advanced = monthly+usage. Logs = storage. Budgets ठेवा.

29. WAF पलीकडे hygiene

• No CF bypass.
• IAM least privilege.
• Log bucket BPA.
• Quarterly IP/geo.
• Redact secrets.
• Break-glass doc.

30. इतर chapters शी pairing

Origin OAC = S3 projects. Security pillar = Well-Architected. CDN/HTTPS = CF+WAF survey.

31. Request flow deep dive

Browser → R53 → CF → WAF → (ALB WAF) → app. Shield पहातो. Logs → SOC.

1. DNS+TLS (Shield).
2. Edge WAF.
3. Cache.
4. Origin + regional WAF.
5. ASG serve.
6. Metrics/logs/SRT.

32. Rule JSON anatomy

{
  "Name": "RateLogin1000",
  "Priority": 900,
  "Action": {"Block": {"CustomResponse": {"ResponseCode": 429}}},
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "RateLogin1000"
  },
  "Statement": {
    "RateBasedStatement": {
      "Limit": 1000,
      "AggregateKeyType": "IP",
      "ScopeDownStatement": {
        "ByteMatchStatement": {
          "SearchString": "/login",
          "FieldToMatch": {"UriPath": {}},
          "TextTransformations": [{"Priority": 0, "Type": "LOWERCASE"}],
          "PositionalConstraint": "STARTS_WITH"
        }
      }
    }
  }
}

33. Text transformations

• LOWERCASE
• URL_DECODE
• HTML_ENTITY_DECODE
• CMD_LINE
• Compress/Strip
• Ordered transforms

34. Office-hours drills

1. Drill 1 Count.
2. Drill 2 priority.
3. Drill 3 curl.
4. Drill 4 Shield.
5. Drill 5 runbook.
6. Drill 6 region.
7. Drill 7 order.
8. Drill 8 redact.

35. Change calendar

• Day 0
• Day 1
• Day 2–3
• Day 4
• Day 5
• Day 7
• Day 14
• Day 30

उजळणी, मुलाखत आणि तुलना cards

हा lesson काही मिनिटांत revise करा. Cards phone वर save करा किंवा PNG download करा. प्रत्येक card वरचा QR हा lesson उघडतो.

अजून cards: Ravi Sir's Cards.