AWS Shield Advanced DDoS Protection Pricing
Understand AWS DDoS protection pricing including the free AWS Shield Standard and enterprise-grade AWS Shield Advanced subscription plans.
Pricing overview
AWS Shield Advanced DDoS protection service pricing is structured in two tiers, so you can choose the level of DDoS mitigation that best fits your applications and budget.
AWS Shield Standard
Provides DDoS protection at no additional cost for all AWS customers, defending against common network and transport layer DDoS events that target your website or application. No need to enable — it's already configured for your applications, delivering automatic DDoS protection service coverage from day one.
AWS Shield Advanced
Provides enterprise-grade DDoS protection with a paid subscription for internet-facing applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53. This managed DDoS mitigation service is available for customers with Enterprise or Business Support levels of AWS Premium Support. It requires a 1-year subscription commitment and charges a monthly fee, plus a usage fee based on data transfer out from Amazon CloudFront, Elastic Load Balancing (ELB), Amazon Elastic Compute (EC2), and AWS Global Accelerator. The AWS Shield Advanced subscription includes access to the application layer (L7) DDoS protection AWS Managed Rule group. As part of your subscription, you will get up to 50 billion requests per subscribed payer ID to AWS Shield protected WAF resources in a calendar month. The limit applies to all WAF requests made under the payer ID organization. Requests beyond 50 billion will be billed as stated in the pricing table. Requests that AWS Shield Advanced detects as DDoS do not count towards the 50 billion. AWS Shield Advanced does not include AWS Shield network security director.
Pricing details
Notes:
- This DDoS protection service fee is billed per payer account where that payer account, or at least one linked account, is subscribed to AWS Shield Advanced. You will pay the monthly fee once as long as your payer account owns the AWS accounts and resources in those accounts that are linked to it. AWS Channel Resellers will pay a separate monthly fee for each member account. AWS Channel Resellers who resell AWS Shield Advanced to customers with more than one member account may contact us for additional billing support and, with respect to such AWS Channel Resellers, AWS reserves the right to modify the monthly fee for AWS Shield Advanced.
- In addition to standard fees on Elastic Load Balancing (ELB), Amazon CloudFront, Amazon Route 53, AWS Global Accelerator, and Amazon Elastic Compute Cloud (EC2).
- The Shield Advanced subscription includes certain AWS WAF usage for Shield protected resources at no additional cost for up to 50 billion AWS WAF requests per month. This includes the monthly fees for WebACLs, rules, and request fees for WebACLs with default (1,500) WCU limits. The other WAF features, such as Bot and Fraud Control or WebACL WCU limits greater than the default (1,500) WCUs, will still incur WAF charges. See AWS WAF Pricing for more details.
AWS Shield Advanced Data Transfer Out Usage Fees (per GB)
Notes:
- If you have deployed Amazon CloudFront in front of ELB, and the ELB receives all its traffic from CloudFront, you only need to enable protection for Amazon CloudFront.
- AWS Shield Advanced is offered only for the protection of eligible AWS resources directly owned and managed by the subscribing AWS Account holder.
- AWS Shield Advanced subscriptions auto-renew annually. You will be notified at least 30 days prior to your renewal date of the upcoming annual renewal cycle. At any time within 30 days prior and 5 days prior to your renewal date, you may contact us at the AWS Support Center to cancel your upcoming subscription renewal. If you elect to cancel your subscription prior to your renewal date, you agree to pay any subscription fees up to and including the effective date of termination of the subscription. Please note we may ask for feedback to improve the product before processing your unsubscribe request.
- Fees associated with managed rules including managed rules from the AWS Marketplace are not waived for AWS Shield Advanced customers.
*All AWS Shield Advanced benefits, including DDoS cost protection, are subject to your fulfillment of the 1-year subscription commitment.
Pricing examples
Example 1: AWS Shield Standard
AWS Shield Standard DDoS protection is automatically enabled when you use AWS services like Elastic Load Balancing (ELB), Application Load Balancer, Amazon CloudFront, and Amazon Route 53. AWS customers receive this cloud DDoS protection at no additional cost.
Example 2: AWS Shield Standard with AWS WAF
Let’s assume you enable AWS WAF protections in addition to AWS Shield Standard.
Under this scenario, you pay the standard AWS WAF fees as described in the AWS WAF Pricing page.
Example 3: AWS Shield Advanced DDoS Protection For Application Load Balancer
Let’s assume that you have Application Load Balancer with Regional Data Transfer out usage of 1,000 GB per month. You subscribe to AWS Shield Advanced for your AWS account and enable protection for your Application Load Balancer.
Under this scenario, at the end of the month, you will pay the AWS Shield Advanced monthly fee of $3,000. In addition to the monthly fee you will be charged $50 on the 1,000 GB of Regional Data Transfer out at $0.050 per GB (as AWS Shield Data Transfer Out usage fees). Your total AWS Shield charges for the month will be $3,000 + $50 = $3,050.
In addition, you will pay standard Application Load Balancer fees as described in the Application Load Balancer Pricing page.
Example 4: AWS Shield Advanced DDoS Protection For Amazon CloudFront
Let’s assume that you deploy an Amazon CloudFront Distribution in front of the Application Load Balancer from Example 3. You then enable AWS Shield Advanced protection for your Amazon CloudFront Distribution, and remove it from your Application Load Balancer. (If you have deployed Amazon CloudFront in front of Application Load Balancer and the Application Load Balancer receives all its traffic from CloudFront, you only need to enable protection for Amazon CloudFront.)
Under this scenario, at the end of the month, you will pay the AWS Shield Advanced monthly fee of $3,000. In addition to the monthly fee, you will be charged the AWS Shield Advanced usage based fee of $25 for the 1,000 GB of Regional Data Transfer out at $0.025 per GB. Your total AWS Shield charges for the month will be $3,000 + $25 = $3,025.
In addition, you will pay standard Application Load Balancer and Amazon CloudFront fees as described in the Application Load Balancer Pricing and Amazon CloudFront Pricing pages.
Example 5: AWS Shield Advanced For Amazon CloudFront With AWS WAF
Let’s assume that you enable AWS WAF on the Amazon CloudFront Distribution from Example 4. Because the Amazon CloudFront Distribution is already protected under AWS Shield Advanced, there are no additional charges for AWS WAF web ACL, rule or request fees. Your total AWS Shield charges for the month remain at $3,025.
In addition, you will pay standard Application Load Balancer and Amazon CloudFront fees as described in the Application Load Balancer Pricing and Amazon CloudFront Pricing pages.
Example 6: AWS Shield Advanced with AWS WAF on unprotected resource
Let’s assume you disable AWS Shield Advanced protection on the Amazon CloudFront distribution from Example 5 but still have AWS WAF protections in place.
Under this scenario, at the end of the month, you will pay the AWS Shield Advanced monthly fee of $3,000 and no AWS Shield Advanced Data Transfer Out Usage Fees.
However, you will pay the standard AWS WAF fees as described in the AWS WAF Pricing page.
Example 7: AWS Shield Advanced with AWS WAF Bot/Fraud Control enabled on a protected resource
Let’s assume you enable AWS WAF Bot/Fraud Control on a Shield protected resource.
Under this scenario, there are no additional charges for AWS WAF WebACL, rule, or request fees. Your total AWS Shield charges for the month remain at $3,025. However, you will be billed standard fees for AWS WAF Bot/Fraud control described in the AWS WAF Pricing page.
Example 8: Existing AWS Shield Advanced customer has 60B WAF requests and less than 1500 WCU enabled application layer (L7) DDoS protection
AWS Shield Advanced monthly fee = $3000.00
Additional request charges = $0.15/ million requests * 10 billion = $1,500.00
Total combined charges = $4,500.00/month
Example 9: Existing AWS Shield Advanced customer has 60B WAF requests and 2000 WCUs.
Extra WCUs = 2000-1500 = 500
Cost per million requests for 500 WCUS = $0.20 per million requests
AWS Shield Advanced monthly fee = $3,000.00
Additional WCU charges = $0.20 * 60 billion requests = $12,000
Total combined charges = $15,000.00/month
Example 10: Existing AWS Shield Advanced customer has 30B WAF requests with 2000 WCU in one region and 30B in another region with 1500 WCU.
AWS Shield Advanced monthly fee = $3,000.00
Increased WCU request charges = $0.20/ million requests * 30 billion = $6,000.00
No additional cost for requests with default 1500 WCU quota
Total combined charges = $10,500.00/month
Frequently asked questions
How much does DDoS protection cost?
DDoS protection costs vary depending on the level of protection you need. AWS Shield Standard provides automatic DDoS protection for all AWS customers at no additional cost. AWS Shield Advanced is available as a monthly subscription starting at $3,000/month with a one-year commitment, plus usage-based charges for data transfer and DDoS-related scaling. The total cost depends on your protected resources and traffic volume.
Do I need AWS Shield Advanced if I already have AWS Shield Standard?
AWS Shield Standard provides protection against common network and transport layer DDoS attacks and is automatically included with all AWS services. Shield Advanced is recommended for organizations that require enhanced detection for DDoS events, 24/7 access to the AWS Shield Response Team (SRT), DDoS cost protection, and real-time attack visibility. If your applications are business-critical or high-traffic, Shield Advanced provides the additional protection and support needed for enterprise-grade DDoS defense.
What is included in AWS Shield Advanced DDoS protection pricing?
AWS Shield Advanced pricing includes a monthly subscription fee, which covers enhanced DDoS detection, automatic mitigation, and 24/7 access to the Shield Response Team (SRT). Additional usage-based charges apply for data transfer out (DTO) associated with protected resources. Shield Advanced also includes DDoS cost protection, AWS WAF per request fees at no additional cost up to 50B requests a month, $0.15 per million over 50B monthly requests, and the AWS WAF DDoS AMR at no additional cost.
How is AWS Shield pricing calculated?
AWS Shield Standard is free and automatically applied to all AWS resources. Shield Advanced pricing is calculated based on a monthly subscription fee plus usage charges. The subscription covers the base service, while usage charges are based on data transfer out from protected resources. You can use the AWS Pricing Calculator to estimate your monthly Shield Advanced costs based on your specific resource configuration and expected traffic.
How is the recent price change for AWS Shield Advanced customers using AWS WAF calculated?
AWS Shield Advanced customers did not have to pay the $.60 per million request fee charged per AWS WAF request for all AWS Shield Advanced protected traffic. Now, nothing changes for customers under 50B monthly AWS WAF requests. For customers over 50B monthly AWS WAF requests, customers have to pay $0.15 per million requests for all requests over 50B a month.
Are private pricing agreements (PPAs) available for AWS Shield Advanced?
Yes, if the volume exceeds the pricing page or for unique situations.
If I need AWS WAF but have a high volume of requests, does it make sense for me to subscribe to AWS Shield Advanced to pay less?
It depends. AWS WAF is priced per request. AWS Shield Advanced is priced by Data Transfer Out (DTO). So if requests are high and DTO is low, the best option could be subscribing to Shield Advanced after taking into consideration the $0.15 per million requests for all AWS WAF requests over 50B a month. If DTO is high and requests are low, the best option would point to AWS Shield Advanced. AWS Shield Advanced and AWS WAF complement each other and it is recommended to use both for optimal DDoS protection.
Additional pricing resources
Easily calculate your monthly costs with AWS.
Contact AWS specialists to get a personalized quote.