Elastic IP address is protected by AWS Shield Advanced

Check ID: shield_advanced_protection_in_associated_elastic_ips
Provider: AWS
Service: shield
Severity: MEDIUM
Categories: resilience, internet-exposed
Resource type: AwsEc2Eip

What this check verifies

Elastic IP addresses are assessed for AWS Shield Advanced coverage by verifying they are listed as protected resources.

Risk

Without Shield Advanced, internet-facing EIPs are more susceptible to DDoS, threatening availability and driving cost spikes. Volumetric or protocol floods can saturate bandwidth or exhaust connection state, disrupting services behind the EIP and slowing incident response.

Recommendation

Register critical EIPs as Shield Advanced protected resources. Apply defense in depth: minimize public exposure, use application-layer controls (WAF, rate limiting), monitor telemetry, and review protections regularly, aligning network access with least privilege.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws shield create-protection —name <example_resource_name> —resource-arn arn:aws:ec2:<REGION>:<ACCOUNT_ID>:elastic-ip/eipalloc-<ALLOCATION_ID>

# Terraform: Add Shield Advanced protection to an Elastic IP
resource "aws_shield_protection" "<example_resource_name>" {
  name         = "<example_resource_name>"
  resource_arn = "arn:aws:ec2:<REGION>:<ACCOUNT_ID>:elastic-ip/eipalloc-<ALLOCATION_ID>" # Critical: ARN of the Elastic IP to protect
}

# CloudFormation: Add Shield Advanced protection to an Elastic IP
Resources:
  Protection:
    Type: AWS::Shield::Protection
    Properties:
      Name: <example_resource_name>
      ResourceArn: arn:aws:ec2:<REGION>:<ACCOUNT_ID>:elastic-ip/eipalloc-<ALLOCATION_ID>  # Critical: ARN of the Elastic IP to protect

References

https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = shield_advanced_protection_in_associated_elastic_ips. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

SES identity resource policy does not allow public access Classic Load Balancer is protected by AWS Shield Advanced

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires