AWS::Shield::Protection - Amazon CloudFormation
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).


Enables Amazon Shield Advanced for a specific Amazon resource. The resource can be an Amazon CloudFront distribution, Amazon Route 53 hosted zone, Amazon Global Accelerator standard accelerator, Elastic IP Address, Application Load Balancer, or a Classic Load Balancer. You can protect Amazon EC2 instances and Network Load Balancers by association with protected Amazon EC2 Elastic IP addresses.

Configure a single AWS::Shield::Protection

Use this protection to protect a single resource at a time.

To configure this Shield Advanced protection through Amazon CloudFormation, you must be subscribed to Shield Advanced. You can subscribe through the Shield Advanced console and through the APIs. For more information, see Subscribe to Amazon Shield Advanced.

See example templates for Shield Advanced in Amazon CloudFormation at aws-samples/aws-shield-advanced-examples.

Configure Shield Advanced using Amazon CloudFormation and Amazon Firewall Manager

You might be able to use Firewall Manager with Amazon CloudFormation to configure Shield Advanced across multiple accounts and protected resources. To do this, your accounts must be part of an organization in Amazon Organizations. You can use Firewall Manager to configure Shield Advanced protections for any resource types except for Amazon Route 53 or Amazon Global Accelerator.

For an example of this, see the one-click configuration guidance published by the Amazon technical community at One-click deployment of Shield Advanced.

Configure multiple protections through the Shield Advanced console

You can add protection to multiple resources at once through the Shield Advanced console. For more information see Getting Started with Amazon Shield Advanced and Managing resource protections in Amazon Shield Advanced.


To declare this entity in your Amazon CloudFormation template, use the following syntax:


{ "Type" : "AWS::Shield::Protection", "Properties" : { "ApplicationLayerAutomaticResponseConfiguration" : ApplicationLayerAutomaticResponseConfiguration, "HealthCheckArns" : [ String, ... ], "Name" : String, "ResourceArn" : String, "Tags" : [ Tag, ... ] } }



The automatic application layer DDoS mitigation settings for the protection. This configuration determines whether Shield Advanced automatically manages rules in the web ACL in order to respond to application layer events that Shield Advanced determines to be DDoS attacks.

If you use Amazon CloudFormation to manage the web ACLs that you use with Shield Advanced automatic mitigation, see the additional guidance about web ACL management in the AWS::WAFv2::WebACL resource description.

Required: No

Type: ApplicationLayerAutomaticResponseConfiguration

Update requires: No interruption


The ARN (Amazon Resource Name) of the health check to associate with the protection. Health-based detection provides improved responsiveness and accuracy in attack detection and mitigation.

You can use this option with any resource type except for Route 53 hosted zones.

For more information, see Configuring health-based detection using health checks in the Amazon Shield Advanced Developer Guide.

Required: No

Type: Array of String

Minimum: 1

Maximum: 2048 | 1

Update requires: No interruption


The name of the protection. For example, My CloudFront distributions.


If you change the name of an existing protection, Shield Advanced deletes the protection and replaces it with a new one. While this is happening, the protection isn't available on the Amazon resource.

Required: Yes

Type: String

Pattern: [ a-zA-Z0-9_\.\-]*

Minimum: 1

Maximum: 128

Update requires: Replacement


The ARN (Amazon Resource Name) of the Amazon resource that is protected.

Required: Yes

Type: String

Minimum: 1

Maximum: 2048

Update requires: Replacement


Key:value pairs associated with an Amazon resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each Amazon resource.

Required: No

Type: Array of Tag

Maximum: 200

Update requires: No interruption

Return values


When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the ARN (Amazon Resource Name) of the protection.

For more information about using the Ref function, see Ref.


The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.


The ARN (Amazon Resource Name) of the new protection.


The ID of the new protection.


Create a network layer protection

The following shows an example protection configuration for an Amazon EC2 Elastic IP address.


Resources: EIP: Type: AWS::EC2::EIP Protection: Type: AWS::Shield::Protection Properties: Name: 'MyEIPProtection' ResourceArn: !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:eip-allocation/${EIP.AllocationId}'


{ "Resources": { "EIP": { "Type": "AWS::EC2::EIP" }, "Protection": { "Type": "AWS::Shield::Protection", "Properties": { "Name": "MyEIPProtection", "ResourceArn": { "Fn::Sub": "arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:eip-allocation/${EIP.AllocationId}" } } } } }

Create an application layer protection

The following shows an example layer 7 protection configuration for an application load balancer. The protection includes a health check and has application layer automatic response enabled. The load balancer must be associated with an Amazon WAF web ACL that has a rate-based rule defined in it.


Resources: # Create L7 Protection Protection: Type: AWS::Shield::Protection DependsOn: - WebACLAssociation Properties: Name: 'MyL7Protection' ResourceArn: !Ref ALB HealthCheckArns: - !Sub 'arn:${AWS::Partition}:route53:::healthcheck/${HealthCheck}' ApplicationLayerAutomaticResponseConfiguration: Status: ENABLED Action: Block: { }


{ "Resources": { "Protection": { "Type": "AWS::Shield::Protection", "DependsOn": [ "WebACLAssociation" ], "Properties": { "Name": "MyL7Protection", "ResourceArn": { "Ref": "ALB" }, "HealthCheckArns": [ { "Fn::Sub": "arn:${AWS::Partition}:route53:::healthcheck/${HealthCheck}" } ], "ApplicationLayerAutomaticResponseConfiguration": { "Status": "ENABLED", "Action": { "Block": {} } } } } } }