AWS::Shield::Protection

Enables Amazon Shield Advanced for a specific Amazon resource. The resource can be an Amazon CloudFront distribution, Amazon Route 53 hosted zone, Amazon Global Accelerator standard accelerator, Elastic IP Address, Application Load Balancer, or a Classic Load Balancer. You can protect Amazon EC2 instances and Network Load Balancers by association with protected Amazon EC2 Elastic IP addresses.

Configure a single AWS::Shield::Protection

Use this protection to protect a single resource at a time.

To configure this Shield Advanced protection through Amazon CloudFormation, you must be subscribed to Shield Advanced. You can subscribe through the Shield Advanced console and through the APIs. For more information, see Subscribe to Amazon Shield Advanced.

See example templates for Shield Advanced in Amazon CloudFormation at aws-samples/aws-shield-advanced-examples.

Configure Shield Advanced using Amazon CloudFormation and Amazon Firewall Manager

You might be able to use Firewall Manager with Amazon CloudFormation to configure Shield Advanced across multiple accounts and protected resources. To do this, your accounts must be part of an organization in Amazon Organizations. You can use Firewall Manager to configure Shield Advanced protections for any resource types except for Amazon Route 53 or Amazon Global Accelerator.

For an example of this, see the one-click configuration guidance published by the Amazon technical community at One-click deployment of Shield Advanced.

Configure multiple protections through the Shield Advanced console

You can add protection to multiple resources at once through the Shield Advanced console. For more information see Getting Started with Amazon Shield Advanced and Managing resource protections in Amazon Shield Advanced.

Syntax

To declare this entity in your Amazon CloudFormation template, use the following syntax:

{
  "Type" : "AWS::Shield::Protection",
  "Properties" : {
      "ApplicationLayerAutomaticResponseConfiguration" : ApplicationLayerAutomaticResponseConfiguration,
      "HealthCheckArns" : [ String, ... ],
      "Name" : String,
      "ResourceArn" : String,
      "Tags" : [ Tag, ... ]
    }
}

Type: AWS::Shield::Protection
Properties:
  ApplicationLayerAutomaticResponseConfiguration: 
    ApplicationLayerAutomaticResponseConfiguration
  HealthCheckArns: 
    - String
  Name: String
  ResourceArn: String
  Tags: 
    - Tag

Properties

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the ARN (Amazon Resource Name) of the protection.

For more information about using the Ref function, see Ref.

Fn::GetAtt

The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.

Examples

Create a network layer protection

The following shows an example protection configuration for an Amazon EC2 Elastic IP address.

Resources:
  EIP:
    Type: AWS::EC2::EIP
  Protection:
    Type: AWS::Shield::Protection
    Properties:
      Name: 'MyEIPProtection'
            ResourceArn: !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:eip-allocation/${EIP.AllocationId}' 

{
    "Resources": {
        "EIP": {
            "Type": "AWS::EC2::EIP"
        },
        "Protection": {
            "Type": "AWS::Shield::Protection",
            "Properties": {
                "Name": "MyEIPProtection",
                "ResourceArn": {
                    "Fn::Sub": "arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:eip-allocation/${EIP.AllocationId}"
                }
            }
        }
    }
} 

Create an application layer protection

The following shows an example layer 7 protection configuration for an application load balancer. The protection includes a health check and has application layer automatic response enabled. The load balancer must be associated with an Amazon WAF web ACL that has a rate-based rule defined in it.

Resources:
  # Create L7 Protection
  Protection:
    Type: AWS::Shield::Protection
    DependsOn:
    - WebACLAssociation
    Properties:
      Name: 'MyL7Protection'
      ResourceArn: !Ref ALB
      HealthCheckArns:
        - !Sub 'arn:${AWS::Partition}:route53:::healthcheck/${HealthCheck}'
      ApplicationLayerAutomaticResponseConfiguration:
        Status: ENABLED
        Action:
          Block: { } 

{
    "Resources": {
        "Protection": {
            "Type": "AWS::Shield::Protection",
            "DependsOn": [
                "WebACLAssociation"
            ],
            "Properties": {
                "Name": "MyL7Protection",
                "ResourceArn": {
                    "Ref": "ALB"
                },
                "HealthCheckArns": [
                    {
                        "Fn::Sub": "arn:${AWS::Partition}:route53:::healthcheck/${HealthCheck}"
                    }
                ],
                "ApplicationLayerAutomaticResponseConfiguration": {
                    "Status": "ENABLED",
                    "Action": {
                        "Block": {}
                    }
                }
            }
        }
    }
}