Which AWS service will help protect applications running on AWS from DDoS attacks?

AWS Shield is AWS’s managed Distributed Denial of Service (DDoS) protection service. Shield Standard is automatically enabled on all AWS endpoints and defends against common network- and transport-layer attacks, while Shield Advanced adds broader detection, larger capacity mitigation, and 24×7 access to the DDoS Response Team. Therefore, it is the purpose-built service for safeguarding applications running on AWS from DDoS attacks.

A. Amazon GuardDuty – Detects anomalous or malicious activity in AWS accounts and workloads; it does not block or mitigate DDoS traffic.

B. AWS WAF – Filters HTTP/S requests based on user-defined rules; although it can rate-limit traffic, primary DDoS mitigation is delivered by Shield, not WAF alone.

D. Amazon Inspector – Assesses EC2 instances and container images for vulnerabilities and misconfigurations; it offers no network-layer attack protection.

1. AWS Shield Developer Guide

“What is AWS Shield?” §1.1 (https://docs.aws.amazon.com/shield/latest/developerguide/welcome.html)

2. AWS Whitepaper “AWS Best Practices for DDoS Resiliency

” p. 5–6

§“AWS Shield” (https://d1.awsstatic.com/whitepapers/Security/DDoSWhitePaper.pdf)

3. Amazon GuardDuty User Guide

“How Amazon GuardDuty Works

” §Overview (https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html)

4. AWS WAF Developer Guide

“How AWS WAF Works

” §Introduction (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html)

5. Amazon Inspector User Guide

“What is Amazon Inspector?” §1 (https://docs.aws.amazon.com/inspector/latest/user/inspectorintroduction.html)