AWS::Shield::Protection

Enables AWS Shield Advanced for a specific AWS resource. The resource can be an Amazon CloudFront distribution, Amazon Route 53 hosted zone, AWS Global Accelerator standard accelerator, Elastic IP Address, Application Load Balancer, or a Classic Load Balancer. You can protect Amazon EC2 instances and Network Load Balancers by association with protected Amazon EC2 Elastic IP addresses.

Configure a single AWS::Shield::Protection

Use this protection to protect a single resource at a time.

To configure this Shield Advanced protection through AWS CloudFormation, you must be subscribed to Shield Advanced. You can subscribe through the Shield Advanced console and through the APIs. For more information, see Subscribe to AWS Shield Advanced.

See example templates for Shield Advanced in AWS CloudFormation at aws-samples/aws-shield-advanced-examples.

Configure Shield Advanced using AWS CloudFormation and AWS Firewall Manager

You might be able to use Firewall Manager with AWS CloudFormation to configure Shield Advanced across multiple accounts and protected resources. To do this, your accounts must be part of an organization in AWS Organizations. You can use Firewall Manager to configure Shield Advanced protections for any resource types except for Amazon Route 53 or AWS Global Accelerator.

For an example of this, see the one-click configuration guidance published by the AWS technical community at One-click deployment of Shield Advanced.

Configure multiple protections through the Shield Advanced console

You can add protection to multiple resources at once through the Shield Advanced console. For more information see Getting Started with AWS Shield Advanced and Managing resource protections in AWS Shield Advanced.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

{
  "Type" : "AWS::Shield::Protection",
  "Properties" : {
      "ApplicationLayerAutomaticResponseConfiguration" : ApplicationLayerAutomaticResponseConfiguration,
      "HealthCheckArns" : [ String, ... ],
      "Name" : String,
      "ResourceArn" : String,
      "Tags" : [ Tag, ... ]
    }
}

Type: AWS::Shield::Protection
Properties:
  ApplicationLayerAutomaticResponseConfiguration: 
    ApplicationLayerAutomaticResponseConfiguration
  HealthCheckArns: 
    - String
  Name: String
  ResourceArn: String
  Tags: 
    - Tag

Properties

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the ARN (Amazon Resource Name) of the protection.

For more information about using the Ref function, see Ref.

Fn::GetAtt

The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.

Examples

Create a network layer protection

The following shows an example protection configuration for an Amazon EC2 Elastic IP address.

Resources:
  EIP:
    Type: AWS::EC2::EIP
  Protection:
    Type: AWS::Shield::Protection
    Properties:
      Name: 'MyEIPProtection'
            ResourceArn: !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:eip-allocation/${EIP.AllocationId}' 

{
    "Resources": {
        "EIP": {
            "Type": "AWS::EC2::EIP"
        },
        "Protection": {
            "Type": "AWS::Shield::Protection",
            "Properties": {
                "Name": "MyEIPProtection",
                "ResourceArn": {
                    "Fn::Sub": "arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:eip-allocation/${EIP.AllocationId}"
                }
            }
        }
    }
} 

Create an application layer protection

The following shows an example layer 7 protection configuration for an application load balancer. The protection includes a health check and has application layer automatic response enabled. The load balancer must be associated with an AWS WAF web ACL that has a rate-based rule defined in it.

Resources:
  # Create L7 Protection
  Protection:
    Type: AWS::Shield::Protection
    DependsOn:
    - WebACLAssociation
    Properties:
      Name: 'MyL7Protection'
      ResourceArn: !Ref ALB
      HealthCheckArns:
        - !Sub 'arn:${AWS::Partition}:route53:::healthcheck/${HealthCheck}'
      ApplicationLayerAutomaticResponseConfiguration:
        Status: ENABLED
        Action:
          Block: { } 

{
    "Resources": {
        "Protection": {
            "Type": "AWS::Shield::Protection",
            "DependsOn": [
                "WebACLAssociation"
            ],
            "Properties": {
                "Name": "MyL7Protection",
                "ResourceArn": {
                    "Ref": "ALB"
                },
                "HealthCheckArns": [
                    {
                        "Fn::Sub": "arn:${AWS::Partition}:route53:::healthcheck/${HealthCheck}"
                    }
                ],
                "ApplicationLayerAutomaticResponseConfiguration": {
                    "Status": "ENABLED",
                    "Action": {
                        "Block": {}
                    }
                }
            }
        }
    }
}