AWS-Shield-Shield-Protections

Severity : High

Description: This controls identify if AWS Shield feature is enable on the account and member accounts. AWS Shield Standard defends against the most common, frequently occurring network and transport layer DDoS attacks that target your website or applications. AWS Shield advance provides protection against DDoS attacks for resources like CloudFront distribution, Route S3 hosted zones, ELBs, Global accelerator, EIPs etc. To use proactive engagement, configure Shield Advanced health-based detection for a resource needed the SRT to monitor.

Remediation Steps:

Perform following to Subscribe to AWS Shield:

1. Login to the AWS Management Console at https://console.aws.amazon.com.

2. Navigate to AWS Shield console.

3. Choose Getting started, Choose Subscribe to Shield Advanced.

4. In Overview page, under Proactive engagement and contacts, in the contacts area, choose Edit.

5. In the Edit contacts, provide the contact information for the people that you want the SRT to contact for proactive engagement.

6. Choose Save.

7. Choose Edit proactive engagement feature, choose Enable, and then choose Save.

8. Choose Add resources to protect.

9. Choose Protected Resources and then choose Add resources to protect.

10. In the Choose resources to protect with Shield Advanced, select the Regions and resource types to protect, then choose Load resources.

11. Select the resources that you want to protect, then choose Protect with Shield Advanced.

Important:

• Shield Advanced protects only resources that have specified either in Shield Advanced or through a Firewall Manager Shield Advanced policy. It doesn't automatically protect resources.

• Shield Advanced does not support Amazon EC2 Classic.

• to protect an Amazon EC2 instance or a Network Load Balancer, you first must associate an Elastic IP address to it, and then choose the Elastic IP address as the resource to protect.

Reference:

• https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html