AWS Shield vs AWS WAF: DDoS Protection and Web Application Filtering

AWS Shield and AWS WAF (Web Application Firewall) both protect applications from attacks, but they defend against different threats. AWS Shield protects against Distributed Denial of Service (DDoS) attacks: floods of traffic designed to overwhelm your infrastructure. AWS WAF inspects individual web requests and blocks malicious ones, such as SQL injection attempts, cross-site scripting payloads, or traffic from unwanted countries. The short version for the CLF-C02 exam: volume-based attacks point to Shield, request-content attacks point to WAF.

What AWS Shield is

AWS Shield is a managed DDoS protection service. A DDoS attack does not try to steal data or exploit a code flaw. It simply hammers a target with so much traffic, from so many sources, that legitimate users cannot get through. Shield exists to absorb and deflect that flood before it takes your application down.

Shield comes in two tiers, and the exam expects you to know both.

AWS Shield Standard is enabled automatically for every AWS customer at no additional cost. You do not sign up for it, configure it, or see a line item for it. It defends against the most common network-layer and transport-layer attacks (layers 3 and 4 of the OSI model), such as SYN floods and UDP reflection attacks, on services like Amazon CloudFront and Amazon Route 53.

AWS Shield Advanced is a paid subscription with a monthly fee and a commitment term. It adds capabilities that matter to organizations running high-visibility, internet-facing workloads:

• Enhanced detection and mitigation for larger and more sophisticated DDoS attacks, including some application-layer (layer 7) attacks.
• 24/7 access to the Shield Response Team (SRT), AWS DDoS experts who help you during and after an attack.
• Cost protection: if a DDoS attack causes your protected resources (such as Amazon EC2, Elastic Load Balancing, CloudFront, AWS Global Accelerator, or Route 53) to scale up and generate extra charges, you can request credits for those attack-driven costs.
• Visibility into attacks through detailed diagnostics and reporting.

A useful mental model: Shield Standard is the seatbelt everyone gets for free; Shield Advanced is the full crash-protection package you pay for when the stakes are high.

What AWS WAF is

AWS WAF is a web application firewall. Instead of watching traffic volume, it reads the content of individual HTTP and HTTPS requests at the application layer (layer 7) and decides, request by request, whether to allow, block, or count each one.

You configure WAF with a web ACL (web access control list), which is a container of rules. Rules can match on things like:

• Request patterns associated with SQL injection (attempts to smuggle database commands through form fields or URLs).
• Patterns associated with cross-site scripting (XSS) (attempts to inject malicious scripts into pages served to other users).
• IP addresses or IP ranges you want to allow or deny.
• Geographic origin, so you can block or allow requests from specific countries.
• Rate-based rules, which automatically block an IP address that sends more requests than a threshold you set. This is how WAF contributes to defense against application-layer floods.

AWS also publishes managed rule groups: pre-built rule sets maintained by AWS and by third-party vendors, so you get protection against common threats without writing rules yourself.

WAF attaches to specific resource types rather than sitting in front of everything. The ones worth remembering at Cloud Practitioner depth are Amazon CloudFront distributions, Application Load Balancers, and Amazon API Gateway. If a scenario involves filtering web requests to one of those, WAF is the tool. Filtering by IP address, port, and protocol at the network level belongs instead to security groups and network ACLs, covered in Amazon VPC basics.

One related service rounds out the picture: AWS Firewall Manager centrally manages WAF rules (and Shield Advanced protections) across many accounts in an AWS Organization. When a question asks how to apply consistent firewall rules across an entire multi-account organization, Firewall Manager is the answer, not WAF alone.

Shield vs WAF: the core distinctions

	AWS Shield	AWS WAF
Threat addressed	DDoS attacks (traffic floods)	Malicious request content (SQL injection, XSS, bad IPs)
Layer of operation	Primarily network/transport (layers 3-4); Advanced adds layer 7 help	Application layer (layer 7) only
How it decides	Traffic volume and attack signatures	Rules you define in a web ACL, inspecting each request
Cost model	Standard: free and automatic; Advanced: paid subscription	Pay for web ACLs, rules, and requests inspected
Configuration required	Standard: none	Yes: you build or subscribe to rules
Human support	Shield Advanced includes the Shield Response Team	No dedicated response team

The services are complementary, not competing. A production web application commonly runs both: Shield absorbing volumetric floods underneath, WAF filtering hostile requests on top. Shield Advanced subscribers also get WAF usage for protected resources included in the subscription, which reinforces the point that AWS designed them to work together.

Both services sit on the AWS side of day-to-day operation, but choosing to enable WAF rules or purchase Shield Advanced is a customer decision. That split, security of the cloud versus security in the cloud, is the heart of the AWS shared responsibility model. For threat detection after something gets through, a different family of services takes over, covered in GuardDuty vs Inspector vs Macie.

How the CLF-C02 exam tests this

• A scenario describes protecting an application from DDoS attacks “at no additional cost” or “automatically, with no setup.” The answer is Shield Standard. The free-and-automatic phrasing is the giveaway.
• A scenario mentions SQL injection, cross-site scripting, blocking requests from a specific country, or filtering HTTP requests by rules. The answer is AWS WAF. Any question about the content of a web request belongs to WAF.
• A scenario asks which service provides 24/7 access to a DDoS response team, or reimburses scaling costs incurred during an attack. The answer is Shield Advanced. The response team and cost protection are its two most-tested features.
• A scenario asks how to manage firewall rules consistently across all accounts in an organization. The answer is AWS Firewall Manager. Distractors will include WAF and Shield by themselves.

Quick reference

• AWS Shield defends against DDoS attacks; AWS WAF filters malicious web requests by content.
• Shield Standard: free, automatic, on for every AWS customer, covers common layer 3 and 4 attacks.
• Shield Advanced: paid, adds the Shield Response Team, DDoS cost protection, and enhanced detection for critical workloads.
• WAF uses web ACLs with rules for SQL injection, XSS, IP blocking, geo blocking, and rate limiting.
• WAF attaches to CloudFront, Application Load Balancer, and API Gateway (among others).
• Rate-based WAF rules throttle abusive clients; they are the WAF-side answer to request floods.
• AWS Firewall Manager centrally manages WAF and Shield Advanced protections across an AWS Organization.
• The two services complement each other; hardened production apps typically use both.