skills.rest
richardnroman
richardnromanCOMMUNITY
Explore all skills by this author →
GitHub

shieldadvanced

Configures AWS Shield Advanced DDoS protection, mitigation, SRT access, and cost protection.

Updated Jul 21, 2026
Search Tags:#security#aws#waf#srt#cloudfront#ddos protection#shield advanced
One-click install
npx skills add https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform --skill shieldadvanced-richardnroman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: shieldadvanced
Source: https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform/tree/main/.agents/skills/shieldadvanced
Command: npx skills add https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform --skill shieldadvanced-richardnroman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Setting up AWS Shield Advanced correctly is error-prone: subscriptions auto-renew on a one-year commitment, subscribing alone protects nothing, automatic layer 7 mitigation needs a 24-30 day baseline, and cost protection claims are silently voided by misconfigured WAF rules. This Skill routes each Shield Advanced task to a vetted procedure so nothing critical is missed. ## Core Features & Use Cases - Task Routing: Maps seven Shield Advanced tasks (tier decision, subscribing and protecting resources, automatic application layer mitigation, health-based detection, SRT access and proactive engagement, event review and cost protection, protection groups) to dedicated reference procedures. - Guardrails and Decision Tables: Each procedure carries decision tables (Block vs Count, SUM/MEAN/MAX aggregation), eligibility rules (protection predating the attack, rate-based rule in Block mode, 15-day filing deadline), and security constraints (SRT role trust scoping, SSE-KMS log encryption, least-privilege IAM). - Use Case: After a DDoS attack spikes your AWS bill, use this Skill to review the Shield event, confirm cost protection eligibility, and file a "DDoS Concession" billing case within the deadline. ## Quick Start Ask the assistant to subscribe your account to AWS Shield Advanced and protect your CloudFront distribution, then enable automatic application layer mitigation in Count mode.

Frequently Asked Questions about shieldadvanced

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I subscribe to AWS Shield Advanced and protect resources?▼

Run aws shield create-subscription in us-east-1, confirm with get-subscription-state, then call create-protection for each resource ARN. Subscribing alone protects nothing; every resource must be added explicitly before coverage exists.

Shield Standard vs Shield Advanced: which do I need?▼

Shield Standard is free and always on for layer 3/4 attacks, and AWS WAF rate-based rules plus the Anti-DDoS managed rule group cover layer 7 floods without a subscription. Choose Advanced only for cost protection credits, SRT access, automatic mitigation, health-based detection, or detailed attack reporting.

How do I enable automatic application layer DDoS mitigation?▼

Associate an AWS WAF v2 web ACL with the protected resource, then run enable-application-layer-automatic-response with Count or Block mode. Start in Count during the roughly 24-30 day baseline, and never remove the ShieldMitigationRuleGroup from the web ACL.

How do I request a Shield Advanced cost protection credit?▼

File a Billing support case with "DDoS Concession" in the subject within 15 days after the billing month of the attack closes. Eligibility requires protection to predate the attack and a rate-based WAF rule in Block mode on CloudFront or Application Load Balancer resources.

Why does proactive engagement fail to enable in Shield Advanced?▼

Proactive engagement requires a Route 53 health check associated with each protected resource and a Business or Enterprise Support plan. Associate the health check first, set emergency contacts, then run enable-proactive-engagement.

Do Shield Advanced protection groups apply shared mitigation?▼

No. Protection groups are detection and reporting only; automatic mitigation still applies per individual resource. Every member must already be individually protected before joining, or the group shows zero members.

Related Skills

Explore More Software Engineering Skills→
awsaws
2.5k

shieldadvanced

Configures AWS Shield Advanced DDoS protection, mitigation, SRT access, and cost protection.

Official
Advanced
Ouaish-LabsOuaish-Labs

create-issue

Creates GitHub issues and epics with audit-first workflows using the gh CLI.

Official
Intermediate
zeaburzeabur
40

zeabur-domain-url

Manage Zeabur service domains and URL configurations via CLI commands.

Official
Intermediate
Integra-BeautyIntegra-Beauty

integra-code-style

Enforce Integra code-style conventions for arrays, objects, iteration, and formatting.

Official
Intermediate