The denial-of-service defences that are actually attached to the internet-facing resources — the Shield Advanced subscription and the list of resources it protects, the web ACL's rate-based rules and their limits, whether web ACL logging is on — plus what those defences observed: the attacks Shield recorded over the period and the CloudWatch detection and block counts underneath them
The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.
Fetch
$ aws shield describe-subscription --region us-east-1 --query 'Subscription.{Start:StartTime,End:EndTime,AutoRenew:AutoRenew,ProactiveEngagement:ProactiveEngagementStatus}'$ aws shield list-protections --region us-east-1 --query 'Protections[].{Name:Name,Resource:ResourceArn,AutoAppLayerResponse:ApplicationLayerAutomaticResponseConfiguration.Status}'$ aws shield list-attacks --region us-east-1 --start-time FromInclusive=2026-04-27T00:00:00Z,ToExclusive=2026-07-27T00:00:00Z --query 'AttackSummaries[].{Attack:AttackId,Resource:ResourceArn,Start:StartTime,End:EndTime,Vectors:AttackVectors}'$ aws wafv2 list-web-acls --scope REGIONAL --query 'WebACLs[].{Name:Name,Id:Id,Arn:ARN}'$ aws wafv2 get-web-acl --name <WEB_ACL_NAME> --scope REGIONAL --id <WEB_ACL_ID> --query 'WebACL.{Default:DefaultAction,Rules:Rules[].{Name:Name,Priority:Priority,Action:Action,RateBased:Statement.RateBasedStatement}}'$ aws configservice get-compliance-details-by-config-rule --config-rule-name wafv2-logging-enabled --compliance-types NON_COMPLIANT$ aws cloudwatch get-metric-statistics --namespace AWS/DDoSProtection --metric-name DDoSDetected --dimensions Name=ResourceArn,Value=<PROTECTED_RESOURCE_ARN> --start-time <START_TIME> --end-time <END_TIME> --period 3600 --statistics Maximum$ aws cloudwatch get-metric-statistics --namespace AWS/WAFV2 --metric-name BlockedRequests --dimensions Name=WebACL,Value=<WEB_ACL_NAME> Name=Rule,Value=<RATE_LIMIT_RULE_NAME> Name=Region,Value=<REGION> --start-time <START_TIME> --end-time <END_TIME> --period 3600 --statistics SumExpected output
A Shield Advanced subscription whose EndTime is in the future and AutoRenew is ENABLED, and a Protections list that names every internet-facing resource in your boundary — a resource missing from that list has Shield Standard only and no protection record to show an assessor. A web ACL whose Rules include at least one RateBasedStatement carrying the Limit, EvaluationWindowSec and aggregation you documented, with a Block action rather than Count, and a DefaultAction you meant. An empty NON_COMPLIANT set from wafv2-logging-enabled, meaning every web ACL is logging (and, if you passed KinesisFirehoseDeliveryStreamArns, to the destination you named). Then the observation half: an AttackSummaries array — often empty, which is itself the finding for a quiet quarter — and CloudWatch series in which DDoSDetected stays at 0 except during events, and BlockedRequests shows the rate-based rule doing work. Managed rule identifiers: WAFV2_LOGGING_ENABLED, SHIELD_ADVANCED_ENABLED_AUTORENEW. Namespaces: AWS/DDoSProtection (DDoSDetected, DDoSAttackBitsPerSecond, DDoSAttackPacketsPerSecond, DDoSAttackRequestsPerSecond), AWS/WAFV2 (AllowedRequests, BlockedRequests, CountedRequests)
Map — what it proves
- recipe1
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:SC 13/35 →
GovCloud
AWS WAF is available in both AWS GovCloud (US) Regions, with one documented difference: only AWS-provided managed rule groups are usable — AWS Marketplace third-party rule groups are not. Shield is the awkward one: the Shield Response Team documentation states the SRT serves customers in AWS GovCloud (US-East) and (US-West), but the AWS General Reference lists a single Shield endpoint, shield.us-east-1.amazonaws.com, with no GovCloud entry, and the shield-advanced-enabled-autorenew managed rule is documented as available only in US East (N. Virginia) — so run the aws shield calls and that Config rule against us-east-1 and confirm your own account's GovCloud Shield coverage before you claim it. Web ACL and load-balancer ARNs use partition arn:aws-us-gov
Notes & assertions
This proves the mechanism, not the outcome. SC-5 asks that denial-of-service attacks be protected against or their effects limited: the configuration calls prove rate limiting and Shield are attached to the right resources, and list-attacks plus the DDoSProtection metrics prove detection and mitigation fired — but 'the effect on availability was limited' is a judgement you make against your own application health, error rates and capacity headroom, which are not in this output. Two honest gaps. Shield Standard, which protects every AWS customer automatically, has no API and no record to collect; if you are not subscribed to Shield Advanced there is nothing here to show beyond the WAF half, and describe-subscription simply errors. And the rate limit itself is a number you chose: a RateBasedStatement set far above real traffic passes every check while limiting nothing, so put the documented threshold next to the configured Limit. Note also that Shield Advanced reports metrics once a minute during an event but only once a day when nothing is happening, so a sparse series is normal and a missing data point is not an outage; and that engaging the SRT requires a Business or Enterprise Support plan. list-attacks covers the window you pass — keep the collected output, since the API's own history is not your retention policy.
References
- AWS CLI: shield describe-subscription (AutoRenew, ProactiveEngagementStatus) https://docs.aws.amazon.com/cli/latest/reference/shield/describe-subscription.html
- AWS CLI: shield list-protections https://docs.aws.amazon.com/cli/latest/reference/shield/list-protections.html
- AWS CLI: shield list-attacks (AttackSummaries, AttackVectors) https://docs.aws.amazon.com/cli/latest/reference/shield/list-attacks.html
- AWS CLI: wafv2 list-web-acls https://docs.aws.amazon.com/cli/latest/reference/wafv2/list-web-acls.html
- AWS CLI: wafv2 get-web-acl (Rules, DefaultAction) https://docs.aws.amazon.com/cli/latest/reference/wafv2/get-web-acl.html
- AWS WAF: using rate-based rule statements https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html
- AWS Config managed rule: wafv2-logging-enabled https://docs.aws.amazon.com/config/latest/developerguide/wafv2-logging-enabled.html
- AWS Config managed rule: shield-advanced-enabled-autorenew (us-east-1 only) https://docs.aws.amazon.com/config/latest/developerguide/shield-advanced-enabled-autorenew.html
- AWS Shield Advanced metrics (AWS/DDoSProtection namespace) https://docs.aws.amazon.com/waf/latest/developerguide/shield-metrics.html
- AWS WAF metrics and dimensions (AWS/WAFV2 namespace) https://docs.aws.amazon.com/waf/latest/developerguide/waf-metrics.html
- Managed DDoS event response with the Shield Response Team (GovCloud Regions) https://docs.aws.amazon.com/waf/latest/developerguide/ddos-srt-support.html
- AWS Shield Advanced endpoints and quotas https://docs.aws.amazon.com/general/latest/gr/shield.html
- AWS WAF in AWS GovCloud (US) https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-waf.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Cloud Native Architecture run (7)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under CNA, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialAWS Config compliance results proving the network boundary is controlled — no security group exposes SSH to the internet, groups open to 0.0.0.0/0 only allow authorized ports, and every VPC's default security group denies all trafficcontinuousconfig-network-boundary-protectionAWS Config · Amazon VPC · Amazon EC2
- partialEvery route in or out of the boundary, named and counted — internet gateways, NAT gateways, VPC endpoints and Site-to-Site VPN tunnels — alongside what each boundary device does with traffic that matched no rule: the network ACL entries, the closed default security group, subnets that hand out public IPs, and the firewall policy's stateless and stateful default actionsweeklyboundary-access-points-and-default-denyAmazon VPC · Amazon EC2 · AWS Network Firewall · AWS Config
- partialThe denial-of-service defences that are actually attached to the internet-facing resources — the Shield Advanced subscription and the list of resources it protects, the web ACL's rate-based rules and their limits, whether web ACL logging is on — plus what those defences observed: the attacks Shield recorded over the period and the CloudWatch detection and block counts underneath themyou are heredailyddos-protection-and-rate-limitingAWS Shield Advanced · AWS WAF · Amazon CloudWatch · AWS Config
- partialWhether malware scanning is switched on for compute and for the buckets that accept uploads, plus the scan-by-scan record of what was actually examined and what came back INFECTEDweeklymalicious-code-protectionAmazon GuardDuty · Amazon EC2 · Amazon S3 · AWS Config
- partialThe machine-generated inventory of every plane on which one part of the system reaches another — VPC peering connections, Transit Gateway attachments, the interface and gateway endpoints this account consumes, the endpoint connections other accounts have made INTO your endpoint service, and the security-group rules that name another group rather than a CIDR — each narrowed to the states that are actually livecontinuousinternal-connection-inventory-and-authorizationAmazon VPC · AWS Transit Gateway · AWS PrivateLink
- partialWhich taint-tracking ruleset actually ran over this repository — the query suite, the languages selected, and the threat model that decides what counts as an untrusted source — together with whether the recurring scan is still scheduled, when it last ran per analysed language, and how many rules were in the run; and then the open findings in the injection families SI-10 is about, identified by the CWE tags the queries carry. The ruleset and the freshness are the load-bearing half: a finding names a sink that exists, but only the run record says the absence of findings means anything at all.continuousinput-validation-taint-analysis-coverageGitHub code scanning · GitHub CodeQL
- partialWhether the queries that find information disclosure through an error message or a stack trace ran over this part of the boundary — which languages were selected, whether the recurring scan is still scheduled and when it last completed — and then the open findings those queries produced, identified by the CWE tags the queries carry rather than by their names. The run record is the load-bearing half here as it is on every scanning recipe: a finding names a leak that exists, and only the record of a scan having run over a selected language makes the absence of findings a statement about anything.continuouserror-handling-information-exposure-scanningGitHub code scanning · GitHub CodeQL · GitHub code security configurations