AWS Certified Cloud Practitioner
AWS Shield vs WAF vs GuardDuty: which one does what
AWS Shield protects against DDoS attacks; Shield Standard covers every AWS customer at no additional cost and Shield Advanced adds more. AWS WAF is a web application firewall that allows or blocks HTTP(S) requests by rules you set. Amazon GuardDuty does not block traffic; it watches AWS logs and creates findings about suspicious activity.
AWS Shield: DDoS protection
AWS Shield Standard protects all AWS customers at no additional cost. It covers common infrastructure-layer attacks such as UDP floods, state exhaustion attacks such as TCP SYN floods, and reflection attacks.
AWS Shield Advanced is a paid subscription. It adds DDoS protection at layers 3, 4 and 7 for the resources you choose to protect: Amazon EC2, Elastic Load Balancing, Amazon CloudFront, AWS Global Accelerator and Route 53 resources. It also gives 24/7 access to the Shield Response Team (SRT) and protection against scaling charges caused by a DDoS attack.
To engage the SRT you need Shield Advanced and a Business or Enterprise support plan.
AWS WAF: filter web requests
AWS WAF is a web application firewall. It watches the HTTP(S) requests sent to resources such as an Amazon CloudFront distribution, an Application Load Balancer or an Amazon API Gateway REST API.
You set the criteria, such as the IP addresses requests come from or the values of query strings. Each request then gets the content, an HTTP 403 Forbidden response, or a custom response.
For application-layer floods such as HTTP GET or POST floods, AWS points customers to AWS WAF. Shield Standard targets the network and transport layers.
Amazon GuardDuty: detect threats
Amazon GuardDuty is a threat detection service. It continuously monitors and analyzes AWS data sources and logs, and uses threat intelligence such as lists of malicious IP addresses and domains, plus machine learning, to find suspicious activity.
When you turn it on it starts reading AWS CloudTrail management events, VPC flow logs and DNS logs with no other setup. Example threats it finds are compromised AWS credentials, unauthorized cryptomining on EC2 instances, and malware.
GuardDuty produces findings for you to review. To dig into the root cause of a finding, AWS points to Amazon Detective.
Where the exam catches people
- Believing AWS Shield Standard must be bought: it protects all AWS customers at no additional cost; only Shield Advanced is a paid subscription.
- Believing Shield Standard stops HTTP GET floods: AWS directs customers to AWS WAF for application-layer floods.
- Believing GuardDuty blocks malicious traffic: it detects and reports threats as findings; it is not a firewall.
- Believing any Shield Advanced customer can call the Shield Response Team: engaging the SRT also needs a Business or Enterprise support plan.
- Believing Shield Advanced protects every resource in the account automatically: it covers the resources you add as protected.