How to trigger a Lambda function when AWS Shield Advanced detects a DDoS attack?

Create a CloudWatch Alarm associated with the DDoSDetected metric. The alarm will trigger a Lambda function.

1. Go to the CloudWatch Console, and select All Alarms from the left sidebar.
2. Click on Create Alarm.
3. Click on Select metric, then from AWS/DDoSProtection / ResourceArn, select the DDoSDetected metric of the specific resource and click on Select metric.
4. When specifying metric and conditions, make sure that
   • Metric name is DDoSDetected,
   • ResourceArn is valid,
   • for Statistic, select Maximum,
   • for Period, select either 1 minute or lower,
   • use Static threshold type, and define the alarm condition whenever DDoSDetected is Greater than 0.
5. When configuring actions:
   • configure the default notification action, or remove it if you don’t want to receive SNS notifications when the alarm is triggered,
   • click on Add Lambda action,
   • Choose a function from the dropdown or reference it by the ARN if cross-account.
6. Click on Next at the bottom of the page, add alarm name, click on Next again, then review and create the alarm.