AWS WAF AntiDDoS AMR vs Shield Advanced: When You Need Each

TL;DR: Enable the AWS WAF AntiDDoS managed rule group (AMR) as your baseline Layer 7 DDoS protection — it detects and mitigates application-layer attacks in seconds with no commitment required. Place CloudFront in front of your ALB so the AMR blocks attack traffic at the edge before it reaches your infrastructure. Evaluate Shield Advanced when you need 24/7 DDoS Response Team access, infrastructure cost protection, proactive engagement, or centralized protection management via Firewall Manager.

Key Terms: AMR = AntiDDoS managed rule group, AWS WAF's automatic L7 DDoS detection and mitigation | DRT = DDoS Response Team, AWS's 24/7 human DDoS experts (Shield Advanced only) | WCU = Web ACL Capacity Unit, measures rule processing cost (AMR uses 50 WCUs)

If you're running AWS WAF to protect your web applications, AntiDDoS managed rule group (AMR) is the recommended starting point for Layer 7 DDoS protection. The AMR profiles your traffic in minutes, detects and mitigates attacks in seconds, and is available to all WAF customers. The question is whether you need Shield Advanced's additional capabilities on top of it.

All AWS customers already receive AWS Shield Standard at no cost, which provides automatic protection against common Layer 3/4 DDoS attacks (SYN floods, UDP reflection, etc.). This article focuses on Layer 7 (application layer) protection — where the AMR comes in — and helps you decide whether the AMR alone is sufficient or whether Shield Advanced is the right fit.

This article covers:

• How the AMR detects and mitigates L7 DDoS attacks
• What Shield Advanced adds beyond automated mitigation
• An architecture pattern that stops attack traffic before it reaches your origin
• A capability-based decision framework
• How to enable each option

Part 1 : What the AntiDDoS AMR Does — and Doesn't Do

The AntiDDoS managed rule group (AMR) is AWS WAF's automatic Layer 7 DDoS detection and mitigation engine. It baselines your traffic within minutes, detects anomalies using suspicion-level labeling, and mitigates attacks within seconds using a combination of silent JavaScript challenges (soft mitigation) and blocking (hard mitigation). No thresholds to configure, no health checks required, no commitment.

For full details on how the AMR works — detection mechanics, label system, sensitivity tuning, Exempt URI configuration, and deployment best practices — see:

• How to customize your response to layer 7 DDoS attacks using AWS WAF Anti-DDoS AMR
• Configuring the AWS WAF Anti-DDoS managed rule group for your resources and clients
• Shield Advanced customers and the L7 anti-DDoS managed rulegroup

What the AMR Does NOT Do:

• No human escalation — Fully automated. If an attack evades detection (sophisticated low-and-slow, credential stuffing that mimics legitimate traffic), there is no human DDoS expert to engage.
• No infrastructure cost protection — Eliminates WAF charges on mitigated DDoS requests, but does not cover cost spikes from traffic that reaches your infrastructure (ALB scaling, EC2 Auto Scaling, Data Transfer Out).
• No proactive engagement — Does not monitor application health checks. It reacts to traffic anomalies, not degraded application performance.
• No centralized management — Each web ACL requires individual AMR configuration. Organization-wide deployment requires Firewall Manager (included with Shield Advanced).

---

Part 2: What Shield Advanced Adds Beyond the AMR

Shield Advanced is not a replacement for the AMR — it's a layer on top. Shield Advanced subscribers still use the AMR for automated L7 DDoS detection and mitigation. The difference is what you get when automation isn't enough.

DDoS Response Team (DRT)

24/7 access to AWS's dedicated DDoS response engineers. You can engage the DRT during an active event when:

• Automated mitigation isn't fully effective against a sophisticated attack

• You need expert guidance on custom WAF rules to address a novel attack pattern

• You want assistance analyzing attack traffic patterns post-event

  The DRT can directly access and modify your WAF rules (with your permission) to respond to attacks in real time.

Proactive Engagement

Shield Advanced monitors your Route 53 health checks. If a health check transitions to unhealthy — indicating your application is degraded — Shield Advanced can automatically engage the DRT on your behalf, even before you notice the issue. This closes the gap between "attack started" and "human expert engaged."

Requirements:

• Route 53 health checks must be configured and associated with your Shield-protected resources
• Proactive engagement must be explicitly enabled per protected resource

Infrastructure Cost Protection

During a DDoS attack, traffic that reaches your infrastructure generates charges: CloudFront request fees, ALB processing, EC2 Auto Scaling, Data Transfer Out. Shield Advanced's DDoS cost protection provides credits for these scaling charges when they result from a confirmed DDoS attack.

Key details:

• Credit requests must be filed through AWS Support within 15 days of the billing month end
• For CloudFront and ALB resources: a rate-based rule in Block mode must be present in the web ACL — this is a prerequisite for credit eligibility, in addition to the web ACL association.
• Each resource must be explicitly added as a Shield-protected resource
• Covers: CloudFront, ALB/NLB/CLB, EC2, Elastic IP, Route 53, Global Accelerator

Firewall Manager Integration

Shield Advanced includes AWS Firewall Manager at no additional cost, enabling:

• Organization-wide WAF policy deployment
• Centralized Shield Advanced protection management across all accounts
• Automatic protection of new resources as they're created

Subscription Model

• Flat monthly fee regardless of request volume (up to 50 billion requests/month)
• 12-month commitment, per organization (payer account) — one subscription covers all accounts
• Requires Business or Enterprise Support plan

When Shield Advanced makes financial sense

if your monthly WAF charges already approach Shield Advanced's flat fee, evaluate it — you get predictable billing regardless of traffic volume (up to 50B requests/month), plus DRT, cost protection, and Firewall Manager included. With standalone WAF + AMR, your bill scales with every request; with Shield Advanced, it doesn't (up to 50B requests/month).

Shield Advanced covers standard WAF fees (web ACLs, rules, request inspection) up to 1,500 WCUs. It does not cover Bot Control, Fraud Control, CAPTCHA actions, or web ACLs exceeding 1,500 WCUs — those incur separate charges. See AWS Shield Pricing

---

Part 3: Architecture — CloudFront + AMR at the Edge

Where you place the AMR in your architecture significantly affects how much attack traffic reaches your origin infrastructure.

The Recommended Pattern

Internet → CloudFront → WAF (with AMR) → ALB → EC2/ECS/Lambda

When the AMR blocks attack traffic at the CloudFront edge:

• No origin load — Blocked requests never reach your ALB, EC2, or containers
• No CloudFront request charges — Since November 2024 (https://aws.amazon.com/about-aws/whats-new/2024/11/amazon-cloudfront-charges-requests-blocked-aws-waf/), CloudFront does not charge for requests blocked by WAF
• No WAF charges on mitigated DDoS — The AMR waives processing charges on traffic it identifies and mitigates as DDoS
• Reduced blast radius — Attack traffic is absorbed at AWS's globally distributed edge, far from your application

Without CloudFront (ALB Direct) Internet → ALB → WAF (with AMR) → EC2/ECS/Lambda

In this architecture, even when the AMR blocks attack traffic at the WAF level:

• ALB still processes and scales for the incoming request volume
• Auto Scaling groups may still scale out in response to connection counts
• Data Transfer In charges still apply

The AMR still provides value here — it eliminates WAF charges on mitigated traffic and prevents malicious requests from reaching your application. But infrastructure load reduction only occurs when traffic is blocked before it reaches the load balancer.

Architecture Decision

If you're already using CloudFront (or plan to), associating your WAF web ACL with the CloudFront distribution rather than ALB gives you the maximum DDoS resilience benefit from the AMR. If you cannot use CloudFront (regulatory constraints, internal-only applications), the AMR on the ALB still provides automatic detection and mitigation — you just retain the infrastructure scaling exposure that only Shield Advanced's cost protection covers.

---

Part 4: Decision Framework

Use these questions to determine which option fits your requirements:

• Do you need 24/7 access to human DDoS response experts? → Yes → Shield Advanced (the AMR is automated only — no human escalation path)(<br>)
• Do you need proactive engagement (automatic DRT engagement when health checks degrade)? → Yes → Shield Advanced(<br>)
• Do you need infrastructure cost protection during DDoS attacks? → Yes → Shield Advanced (the AMR waives WAF charges but not CloudFront, ALB, EC2, or Data Transfer Out charges from traffic that reaches your infrastructure)
• Do you need centralized protection management across an AWS Organization? → Yes → Shield Advanced (includes Firewall Manager)
• Do you need predictable monthly billing regardless of traffic volume? → Yes → Shield Advanced (flat fee up to 50B requests/month)
• None of the above? → Start with WAF + AntiDDoS AMR. Re-evaluate if your risk profile changes, you experience a DDoS event where automated mitigation was insufficient, or you need the operational capabilities above.

Capability Comparison

Capability	WAF Only	WAF + AMR	Shield Advanced
L7 DDoS detection & mitigation	Manual (rate-based rules)	Automatic (seconds)	Automatic (seconds)
WAF charges on mitigated DDoS traffic	Full price	Not charged	Not charged
Infrastructure cost protection (CloudFront, ALB, EC2)	No	No (reduced with CloudFront architecture)	Yes (DDoS Cost Protection)
24/7 DDoS Response Team	No	No	Yes
Proactive engagement	No	No	Yes
Firewall Manager Included	No	No	Yes
Commitment	None	None	12 Months
Cost Model	Pay per request	Pay per request	$3000/mo Flat (up to 50B req)

Note: "WAF Only" without the AMR is included for comparison but is not recommended as a DDoS strategy. Without the AMR, L7 DDoS mitigation is entirely manual — you're responsible for detecting attacks and writing rules in real time.

---

Part 5: How to Enable Each Option

Enabling the AntiDDoS AMR (low effort)

• Add the AMR to your web ACL — it consumes 50 WCUs against your web ACL's 1,500 WCU limit.
• Place it at the top of your rule list, or directly below any Allow-list rules. It needs to inspect as much traffic as possible for accurate baselining.
• Allow approximately 15 minutes for the AMR to establish a traffic baseline before it's fully effective.
• Do not enable during an active attack — the baseline will be inaccurate and mitigation will be unreliable.
• No commitment or subscription required — you can add or remove it at any time.

Onboarding Shield Advanced (moderate effort)

• Requires a Business or Enterprise Support plan. If you're not already on one, factor that into your evaluation.
• 12-month commitment. Subscription is per organization (payer account) — one subscription covers all accounts under the payer.
• Simply subscribing is not enough. Each resource you want covered — CloudFront distributions, ALBs, EC2 instances, Elastic IPs, Route 53 hosted zones, Global Accelerators — must be explicitly added as a protected resource in the Shield console or via API.
• A WAF web ACL must be associated with each protected resource for Layer 7 coverage and DDoS cost protection eligibility.
• Add a rate-based rule in Block mode to each web ACL protecting CloudFront and ALB resources — this is required for DDoS cost protection credit eligibility
• Configure Route 53 health checks for proactive engagement.
• Establish an internal process for filing DDoS cost protection credit requests through AWS Support within 15 days of the billing month end.

Stepping Down from Shield Advanced (evaluate before cancelling)

• Review the past 12 months: did you use DRT access, file cost protection credits, or rely on Firewall Manager policies?
• Test that the AMR's automated mitigation is sufficient for your traffic patterns. You lose the human escalation path if an attack evades automated detection.
• Consider your DDoS history and industry risk profile — stepping down removes the infrastructure cost safety net and human escalation path.

Additional Resources

• AntiDDoS AMR Documentation
• Introducing new L7 DDoS protections for AWS WAF and Shield Advanced
• Shield Advanced customers and the L7 anti-DDoS managed rulegroup
• AWS WAF Rule DDoS Best practice
• Requesting a credit in AWS Shield Advanced
• AWS WAF Pricing
• AWS Shield Pricing
• CloudFront no longer charges for requests blocked by AWS WAF