Global Accelerator is protected by AWS Shield Advanced

Check ID: shield_advanced_protection_in_global_accelerators
Provider: AWS
Service: shield
Severity: MEDIUM
Categories: resilience
Resource type: Other

What this check verifies

AWS Global Accelerator accelerators are assessed for enrollment in Shield Advanced as protected resources, indicating whether enhanced DDoS coverage is configured for each accelerator.

Risk

Without Shield Advanced, Global Accelerators are more vulnerable to volumetric and protocol DDoS that can exhaust capacity, causing availability loss, elevated latency, and disrupted failover. Limited visibility and no SRT support prolong incidents and can trigger unexpected cost spikes from malicious traffic.

Recommendation

Add each Global Accelerator as a protected resource in Shield Advanced. Apply defense in depth with AWS WAF where applicable, enable proactive monitoring and alerting, and use Firewall Manager to enforce coverage across accounts. Follow least privilege to restrict who can modify protections.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws shield create-protection —name <example_resource_name> —resource-arn <example_resource_id>

# Enable Shield Advanced protection for a Global Accelerator accelerator
resource "aws_shield_protection" "protection" {
  name         = "<example_resource_name>"
  resource_arn = "<example_resource_id>"  # Critical: ARN of the Global Accelerator accelerator to protect
}

# CloudFormation: Add Shield Advanced protection to a Global Accelerator accelerator
Resources:
  ShieldProtection:
    Type: AWS::Shield::Protection
    Properties:
      Name: <example_resource_name>
      ResourceArn: <example_resource_id>  # Critical: ARN of the Global Accelerator accelerator to protect

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = shield_advanced_protection_in_global_accelerators. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudFront distribution is protected by AWS Shield Advanced Internet-facing ALB is protected by Shield Advanced

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires