Back to Checks
aws

Global Accelerator accelerator is protected by AWS Shield Advanced

shield_advanced_protection_in_global_accelerators
Service: shieldSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

AWS Global Accelerator accelerators are assessed for enrollment in Shield Advanced as protected resources, indicating whether enhanced DDoS coverage is configured for each accelerator.

Prowler logoProwlerprowler-provider-aws

Risk

Without Shield Advanced, Global Accelerators are more vulnerable to volumetric and protocol DDoS that can exhaust capacity, causing availability loss, elevated latency, and disrupted failover. Limited visibility and no SRT support prolong incidents and can trigger unexpected cost spikes from malicious traffic.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks shield_advanced_protection_in_global_accelerators

Recommendation

Add each Global Accelerator as a protected resource in Shield Advanced. Apply defense in depth with AWS WAF where applicable, enable proactive monitoring and alerting, and use Firewall Manager to enforce coverage across accounts. Follow least privilege to restrict who can modify protections.

Remediation

CLI

aws shield create-protection --name <example_resource_name> --resource-arn <example_resource_id>

Terraform

# Enable Shield Advanced protection for a Global Accelerator accelerator
resource "aws_shield_protection" "protection" {
  name         = "<example_resource_name>"
  resource_arn = "<example_resource_id>"  # Critical: ARN of the Global Accelerator accelerator to protect
}

NativeIaC

# CloudFormation: Add Shield Advanced protection to a Global Accelerator accelerator
Resources:
  ShieldProtection:
    Type: AWS::Shield::Protection
    Properties:
      Name: <example_resource_name>
      ResourceArn: <example_resource_id>  # Critical: ARN of the Global Accelerator accelerator to protect

Other

1In the AWS Console, open AWS WAF & Shield
2Under AWS Shield, select Protected resources
3Click Add resources to protect
4Set Scope to Global and select the Global Accelerator resource type
5Select the target accelerator and click Protect with Shield Advanced

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.globalaccelerator.globalaccelerator_client import (
    globalaccelerator_client,
)
from prowler.providers.aws.services.shield.shield_client import shield_client


class shield_advanced_protection_in_global_accelerators(Check):
    def execute(self):
        findings = []
        if shield_client.enabled:
            for accelerator in globalaccelerator_client.accelerators.values():
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=accelerator
                )
                report.region = shield_client.region
                report.status = "FAIL"
                report.status_extended = f"Global Accelerator {accelerator.name} is not protected by AWS Shield Advanced."

                for protection in shield_client.protections.values():
                    if accelerator.arn == protection.resource_arn:
                        report.status = "PASS"
                        report.status_extended = f"Global Accelerator {accelerator.name} is protected by AWS Shield Advanced."
                        break

                findings.append(report)

        return findings

References