Back to Checks
aws

Elastic IP address is protected by AWS Shield Advanced

shield_advanced_protection_in_associated_elastic_ips
Service: shieldSeverity: medium
OfficialBuilt-inVerified
Categories:resilienceinternet-exposed
Resource Type:AwsEc2Eip

Elastic IP addresses are assessed for AWS Shield Advanced coverage by verifying they are listed as protected resources.

Prowler logoProwlerprowler-provider-aws

Risk

Without Shield Advanced, internet-facing EIPs are more susceptible to DDoS, threatening availability and driving cost spikes.

Volumetric or protocol floods can saturate bandwidth or exhaust connection state, disrupting services behind the EIP and slowing incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks shield_advanced_protection_in_associated_elastic_ips

Recommendation

Register critical EIPs as Shield Advanced protected resources.

Apply defense in depth: minimize public exposure, use application-layer controls (WAF, rate limiting), monitor telemetry, and review protections regularly, aligning network access with least privilege.

Remediation

CLI

aws shield create-protection --name <example_resource_name> --resource-arn arn:aws:ec2:<REGION>:<ACCOUNT_ID>:elastic-ip/eipalloc-<ALLOCATION_ID>

Terraform

# Terraform: Add Shield Advanced protection to an Elastic IP
resource "aws_shield_protection" "<example_resource_name>" {
  name         = "<example_resource_name>"
  resource_arn = "arn:aws:ec2:<REGION>:<ACCOUNT_ID>:elastic-ip/eipalloc-<ALLOCATION_ID>" # Critical: ARN of the Elastic IP to protect
}

NativeIaC

# CloudFormation: Add Shield Advanced protection to an Elastic IP
Resources:
  Protection:
    Type: AWS::Shield::Protection
    Properties:
      Name: <example_resource_name>
      ResourceArn: arn:aws:ec2:<REGION>:<ACCOUNT_ID>:elastic-ip/eipalloc-<ALLOCATION_ID>  # Critical: ARN of the Elastic IP to protect

Other

1Open the AWS WAF & Shield console
2Go to AWS Shield > Protected resources
3Click Add resources to protect
4Select the Region and resource type: EC2 Elastic IP, then Load resources
5Select the target Elastic IP
6Click Protect with Shield Advanced

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.shield.shield_client import shield_client


class shield_advanced_protection_in_associated_elastic_ips(Check):
    def execute(self):
        findings = []
        if shield_client.enabled:
            for elastic_ip in ec2_client.elastic_ips:
                report = Check_Report_AWS(metadata=self.metadata(), resource=elastic_ip)
                report.region = shield_client.region
                report.resource_id = elastic_ip.allocation_id
                report.status = "FAIL"
                report.status_extended = f"Elastic IP {elastic_ip.allocation_id} is not protected by AWS Shield Advanced."

                for protection in shield_client.protections.values():
                    if elastic_ip.arn == protection.resource_arn:
                        report.status = "PASS"
                        report.status_extended = f"Elastic IP {elastic_ip.allocation_id} is protected by AWS Shield Advanced."
                        break

                findings.append(report)

        return findings

References