- Newest
- Most votes
- Most comments
First, I'm not sure the answer is yes or no, as there are various considerations. According to Amazon if you are distributing from behind CloudFront and Route 53 then Shield standard provides comprehensive coverage on layer 3 and 4 DDoS attacks.
AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. AWS Shield
AWS Shield standard is automatically enabled and included with various AWS services. However, to benefit from that protection you should consider the architecture of your application (which it sounds like you are). The AWS Shield FAQ says:
Q. How many resources can I enable for AWS Shield Standard protection? There is no limit on the number of resources subject to AWS Shield Standard protection. You can get the full benefits of AWS Shield Standard protections by following the best practices of DDoS resiliency on AWS.
I highly recommend reviewing the full Shield documentation or at a minimum the AWS Best Practices for DDoS Resiliency whitepaper documentation.
Finally, Amazon provides additional guidance for making the decision whether you may need Shield Advanced.
While your bucket may be protected using OAI, you will still be charged for requests that reach the bucket, even if they are blocked (403 response) by OAI. I'm afraid 'security via obscurity' becomes important - make sure that no-one malicious knows the name of your bucket.
Shield Standard is enabled by default however it protects only against L3/4 attacks and not from request flood-type attacks. If someone is making malicious requests towards CloudFront make sure you are caching in CloudFront so that you are not double charged for CloudFront and S3 requests. If malicious requests are causing an increase in CloudFront DTO, consider using CloudFront geo-blocking or AWS WAF with a rate-based rule, however there are additional charges for the latter.
Relevant content
- AWS OFFICIALUpdated 2 months ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 5 months ago