Enabling Shield Advanced on an Internet-Facing NLB Without Elastic IPs

Question

I have an internet-facing Network Load Balancer (NLB) currently provisioned without Elastic IP addresses. I want to enable AWS Shield Advanced for enhanced DDoS protection. However, I want to achieve this without causing downtime to my application.

Could you kindly suggest the optimal solution for enabling Shield Advanced in this scenario?

Riku_Kobayashi · Answer

Hello.

I think you need to configure an Elastic IP address to protect NLB with Shield Advanced.  
Therefore, if you do not configure an Elastic IP for your NLB, it will not be protected in the first place.  
https://docs.aws.amazon.com/waf/latest/developerguide/ddos-advanced-summary-protected-resources.html  
https://repost.aws/questions/QUTKp1debUTxmhzT1xljB8_w/how-can-we-add-nlb-s-eip-for-shield-advanced-protection-for-aws-auto-assigned-ips#AN_Peu3OHaSiq_A1DEWOl-CQ

It is unclear how you are accessing your NLB from the client, but if you do not currently have an Elastic IP configured, setting one will change the IP address, which may result in a momentary failure to connect.  
https://repost.aws/knowledge-center/elb-attach-elastic-ip-to-public-nlb

Enabling Shield Advanced on an Internet-Facing NLB Without Elastic IPs

Add your answer

Relevant content