Back to Checks
aws

CloudFront distribution is protected by AWS Shield Advanced

shield_advanced_protection_in_cloudfront_distributions
Service: shieldSeverity: medium
OfficialBuilt-inVerified
Categories:resilienceinternet-exposed
Resource Type:AwsCloudFrontDistribution

CloudFront distributions are associated with AWS Shield Advanced as protected resources.

The assessment identifies distributions that lack this protection mapping.

Prowler logoProwlerprowler-provider-aws

Risk

Missing Shield Advanced leaves distributions exposed to large DDoS that degrade availability via L3/L4 floods and L7 request surges. Effects include edge saturation, latency, and outages, plus loss of cost protection and expert support, causing unexpected spend and longer recovery.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks shield_advanced_protection_in_cloudfront_distributions

Recommendation

Enroll critical CloudFront distributions in AWS Shield Advanced and keep them listed as protected resources.

Adopt layered defense: AWS WAF, rate limiting, and continuous monitoring. Maintain DDoS runbooks and use DRT support. Apply least privilege to who can modify protections.

Remediation

CLI

aws shield create-protection --region us-east-1 --name <example_resource_name> --resource-arn <example_resource_arn>

Terraform

# Add Shield Advanced protection to a CloudFront distribution
resource "aws_shield_protection" "example" {
  name         = "<example_resource_name>"
  resource_arn = "<example_resource_arn>"  # Critical: associates Shield Advanced protection with the CloudFront distribution ARN
}

NativeIaC

# CloudFormation: Add Shield Advanced protection to a CloudFront distribution
Resources:
  ShieldProtection:
    Type: AWS::Shield::Protection
    Properties:
      Name: <example_resource_name>
      ResourceArn: <example_resource_arn>  # Critical: associates Shield Advanced protection with the CloudFront distribution ARN

Other

1In the AWS Console, open WAF & Shield
2Go to AWS Shield > Protected resources
3Click Add resources to protect
4Set Scope to Global and select CloudFront distributions, then Load resources
5Select the target distribution
6Click Protect with Shield Advanced

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudfront.cloudfront_client import (
    cloudfront_client,
)
from prowler.providers.aws.services.shield.shield_client import shield_client


class shield_advanced_protection_in_cloudfront_distributions(Check):
    def execute(self):
        findings = []
        if shield_client.enabled:
            for distribution in cloudfront_client.distributions.values():
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=distribution
                )
                report.region = shield_client.region
                report.status = "FAIL"
                report.status_extended = f"CloudFront distribution {distribution.id} is not protected by AWS Shield Advanced."

                for protection in shield_client.protections.values():
                    if distribution.arn == protection.resource_arn:
                        report.status = "PASS"
                        report.status_extended = f"CloudFront distribution {distribution.id} is protected by AWS Shield Advanced."
                        break

                findings.append(report)

        return findings

References