How do I check if Shield Advanced is protecting my resources from DDoS attacks?

Short description

To verify that Shield Advanced is protecting your resources, use the AWSPremiumSupport-DDoSResiliencyAssessment runbook to automate a resource check.

The runbook generates a report that shows whether you configured Shield Advanced based on the best practices for your resources.

Note: The runbook publishes a file in the Amazon Simple Storage Service (Amazon S3) bucket and might incur charges. For more information, see Amazon S3 pricing.

Resolution

To run the AWSPremiumSupport-DDoSResiliencyAssessment runbook, complete the following steps:

1. Open the AWS Systems Manager console.
2. Access the AWSPremiumSupport-DDoSResiliencyAssessment runbook.
3. Choose the AWS Region for the AWS account where you want to run the automation.
4. Choose Execute Automation.
5. Enter the following values for the input parameters:
   (Optional) AutomationAssumeRole. The ARN of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf. If you don't specify a role, then Systems Manager Automation uses the permissions of the user that started the runbook.
   (Optional) AssessmentType. The type of resources that you want to evaluate. By default, the runbook evaluates global and Regional resources. 
   S3BucketName. The name of the Amazon S3 bucket where you want to save the assessment report.
   S3BucketOwnerAccount. The ID of the account that owns the Amazon S3 bucket. This is required only when the bucket belongs to a different account from the account where you're running the automation.
   (Optional) S3BucketPrefix. The prefix for the path in the Amazon S3 bucket where you want to store the report.
   (Optional) S3BucketOwnerRoleArn. The ARN of the IAM role that has permissions to describe the Amazon S3 bucket. If the bucket is in a different account, then the IAM role can also control the public access configuration. If you don't specify S3BucketOwnerRoleArn, then the runbook uses AutomationAssumeRole or the IAM user that started the runbook.
6. Choose Execute.
7. Locate the Amazon S3 bucket URL in the Output section of the report.
8. Open the URL in a web browser to view the HTML assessment report file.
9. On the report, you can view the resources that have Shield Advanced protection activated. To review additional information, choose a resource from the list.

To turn on Shield Advanced protection for your resources, choose Add Resources to Shield Protected List on the report.

Related information

AWS best practices for DDoS resiliency

Run an automation step by step

Setting up Automation

AWS Support Automation Workflows (SAW)