CloudFront distribution is protected by AWS Shield Advanced

Check ID: shield_advanced_protection_in_cloudfront_distributions
Provider: AWS
Service: shield
Severity: MEDIUM
Categories: resilience, internet-exposed
Resource type: AwsCloudFrontDistribution

What this check verifies

CloudFront distributions are associated with AWS Shield Advanced as protected resources. The assessment identifies distributions that lack this protection mapping.

Risk

Missing Shield Advanced leaves distributions exposed to large DDoS that degrade availability via L3/L4 floods and L7 request surges. Effects include edge saturation, latency, and outages, plus loss of cost protection and expert support, causing unexpected spend and longer recovery.

Recommendation

Enroll critical CloudFront distributions in AWS Shield Advanced and keep them listed as protected resources. Adopt layered defense: AWS WAF, rate limiting, and continuous monitoring. Maintain DDoS runbooks and use DRT support. Apply least privilege to who can modify protections.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws shield create-protection —region us-east-1 —name <example_resource_name> —resource-arn <example_resource_arn>

# Add Shield Advanced protection to a CloudFront distribution
resource "aws_shield_protection" "example" {
  name         = "<example_resource_name>"
  resource_arn = "<example_resource_arn>"  # Critical: associates Shield Advanced protection with the CloudFront distribution ARN
}

# CloudFormation: Add Shield Advanced protection to a CloudFront distribution
Resources:
  ShieldProtection:
    Type: AWS::Shield::Protection
    Properties:
      Name: <example_resource_name>
      ResourceArn: <example_resource_arn>  # Critical: associates Shield Advanced protection with the CloudFront distribution ARN

References

https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = shield_advanced_protection_in_cloudfront_distributions. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Classic Load Balancer is protected by AWS Shield Advanced Global Accelerator is protected by AWS Shield Advanced

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires