AWS Shield Advanced, a managed service that protects applications from external threats, is adding the Anti-DDoS managed rule group, designed for application-layer (L7) DDoS protection, to eligible web access control lists (ACLs) in Count mode. The addition preserves traffic flow and runs alongside existing L7 automatic mitigation and AWS WAF rules. The rule group is available to all AWS WAF customers, and is included with AWS Shield Advanced subscriptions.
Migration timeline
Between July 27 and August 7, 2026, AWS will add the Anti-DDoS managed rule group in Count mode to eligible Shield Advanced web ACLs. Customers can evaluate the rule group and migrate as soon as it is added to their web ACL, before the automatic upgrade in October.
AWS recommends reviewing the new Anti-DDoS dashboard in the AWS WAF console, comparing the DDoSDetected and DDoSAttackRequests metrics to validate detection, and using AWS WAF labels to analyze suspicious requests.
During the evaluation period, customers should start with the Low sensitivity setting for Block actions, then adjust settings based on dashboard data and labels, review rule priority, configure URI exemptions for unsupported paths, and update infrastructure-as-code (IaC) templates after the rule group is added automatically.
The Shield Advanced L7 protection upgrade is rolled out in five phases. Existing automatic mitigation remains active throughout the process until the rule group takes over. Beginning January 1, 2027, AWS will discontinue Shield Advanced application-layer automatic mitigation. Resources that have not migrated to the rule group will lose automatic application-layer DDoS protection.
Anti-DDoS rule group capabilities
The managed rule group expands Shield Advanced automatic mitigation by learning normal traffic patterns, responding to attacks, and operating independently of health checks.
It introduces a Challenge action alongside Block and Count. Challenge decisions are based on AMR labels and support silent browser verification. Block and Challenge sensitivity can be configured independently, and unsupported paths can be configured to fall back to Block.
The update reduces the web ACL capacity requirement from 150 to 50 WCUs, adds a dashboard with DDoS events and traffic insights, and labels every inspected request for use in custom AWS WAF rules.
Blocked DDoS requests during active mitigation are excluded from AWS WAF and Shield Advanced request charges.
“AWS Shield Advanced isn’t required to use any of these features. Shield Advanced subscribers receive the rule group at no additional cost with AWS WAF, and any AWS WAF customer can enable it independently,” Eitav Arditti, Senior Solutions Architect, Andrew Chen, Senior Product Manager, and Justin Kurpius, Security Go-to-Market Specialist at AWS, explained.
Monitoring and visibility
The rule group introduces new Amazon CloudWatch metrics and labels for monitoring attacks. Existing DDoSDetected metrics continue to report Layer 3 and Layer 4 events. The new DDoSAttackRequests metric tracks application-layer attacks.
During the transition, customers can use both metrics to validate detection before migrating alerts.
Every inspected request receives labels indicating the detected event, suspicion level, and mitigation decision for use in AWS WAF rules, CloudWatch dashboards, AWS WAF logs, CloudWatch Logs Insights, and Amazon Athena.
Additional metrics show how requests were handled, including whether they were challenged, blocked, or counted. They help teams evaluate mitigation during an attack and adjust rule sensitivity when needed.
Infrastructure updates
Organizations using AWS CloudFormation, AWS CDK, Terraform, or other infrastructure-as-code tools need to update their templates. AWS configures the rule group through AWS WAF, requiring existing Shield automatic mitigation settings to be replaced with an AWS WAF managed rule group. After AWS applies the upgrade, teams should import the updated web ACL into their IaC tooling to prevent future deployments from reverting the change.
AntiDDoS enabled (Source: AWS)
AWS Firewall Manager users should add the AWSManagedRulesAntiDDoSRuleSet to an AWS WAF Firewall Manager policy because application-layer protection is moving from Shield Advanced policies to AWS WAF. Firewall Manager-managed web ACLs must be updated through the policy, either in the console or through infrastructure as code.
“Whichever path you take, scope the policy to the same accounts and resources your Shield Advanced policy already covers so that no resource loses application-layer protection during the migration,” the authors added.
Pricing
Shield Advanced includes the rule group for up to 50 billion requests per month across an organization. During active mitigation in Block or Challenge mode, blocked DDoS traffic is excluded from AWS WAF, the rule group, and Shield Advanced request charges.
Eligible web ACLs updated through the automatic rollout between July 27 and September 30, 2026, incur no per-request fees or WCU consumption during the evaluation period, including while operating in Count mode. The waiver does not apply to rule groups added manually, which are billed under standard AWS WAF pricing.
