AWS Shield DDoS

AWS Shield is the DDoS protection service with two tiers: Standard (free, automatic layer 3/4 protection on CloudFront/Route53/ELB) and Advanced (managed protection, layer 7 protection, DDoS response team, cost guarantees). Understand DDoS attack types (volumetric, protocol, application-layer), mitigation strategies (traffic filtering, rate limiting, IP reputation), and integration with WAF (web application firewall). Why it matters: a single DDoS attack can take down a service and cost $100k+ in downstream damage. Large companies mandate Shield Advanced for critical services. Learning path: 1 week basics (attack types, Standard protection), 1 week intermediate (Advanced features, WAF integration), ongoing production monitoring.