# The denial-of-service defences that are actually attached to the internet-facing resources — the Shield Advanced subscription and the list of resources it protects, the web ACL's rate-based rules and their limits, whether web ACL logging is on — plus what those defences observed: the attacks Shield recorded over the period and the CloudWatch detection and block counts underneath them

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/ddos-protection-and-rate-limiting

Recipe id: `ddos-protection-and-rate-limiting` · cadence daily · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-CNA-RVP`
- control `sc-5`

## Collection

Kind: `cli`

```sh
# describe-subscription
aws shield describe-subscription --region us-east-1 --query 'Subscription.{Start:StartTime,End:EndTime,AutoRenew:AutoRenew,ProactiveEngagement:ProactiveEngagementStatus}'
# list-protections
aws shield list-protections --region us-east-1 --query 'Protections[].{Name:Name,Resource:ResourceArn,AutoAppLayerResponse:ApplicationLayerAutomaticResponseConfiguration.Status}'
# list-attacks
aws shield list-attacks --region us-east-1 --start-time FromInclusive=2026-04-27T00:00:00Z,ToExclusive=2026-07-27T00:00:00Z --query 'AttackSummaries[].{Attack:AttackId,Resource:ResourceArn,Start:StartTime,End:EndTime,Vectors:AttackVectors}'
# list-web-acls
aws wafv2 list-web-acls --scope REGIONAL --query 'WebACLs[].{Name:Name,Id:Id,Arn:ARN}'
# get-web-acl
aws wafv2 get-web-acl --name <WEB_ACL_NAME> --scope REGIONAL --id <WEB_ACL_ID> --query 'WebACL.{Default:DefaultAction,Rules:Rules[].{Name:Name,Priority:Priority,Action:Action,RateBased:Statement.RateBasedStatement}}'
# wafv2-logging-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name wafv2-logging-enabled --compliance-types NON_COMPLIANT
# ddos-detected-metric
aws cloudwatch get-metric-statistics --namespace AWS/DDoSProtection --metric-name DDoSDetected --dimensions Name=ResourceArn,Value=<PROTECTED_RESOURCE_ARN> --start-time <START_TIME> --end-time <END_TIME> --period 3600 --statistics Maximum
# waf-blocked-requests-metric
aws cloudwatch get-metric-statistics --namespace AWS/WAFV2 --metric-name BlockedRequests --dimensions Name=WebACL,Value=<WEB_ACL_NAME> Name=Rule,Value=<RATE_LIMIT_RULE_NAME> Name=Region,Value=<REGION> --start-time <START_TIME> --end-time <END_TIME> --period 3600 --statistics Sum
```

## Expected output

A Shield Advanced subscription whose EndTime is in the future and AutoRenew is ENABLED, and a Protections list that names every internet-facing resource in your boundary — a resource missing from that list has Shield Standard only and no protection record to show an assessor. A web ACL whose Rules include at least one RateBasedStatement carrying the Limit, EvaluationWindowSec and aggregation you documented, with a Block action rather than Count, and a DefaultAction you meant. An empty NON_COMPLIANT set from wafv2-logging-enabled, meaning every web ACL is logging (and, if you passed KinesisFirehoseDeliveryStreamArns, to the destination you named). Then the observation half: an AttackSummaries array — often empty, which is itself the finding for a quiet quarter — and CloudWatch series in which DDoSDetected stays at 0 except during events, and BlockedRequests shows the rate-based rule doing work. Managed rule identifiers: WAFV2_LOGGING_ENABLED, SHIELD_ADVANCED_ENABLED_AUTORENEW. Namespaces: AWS/DDoSProtection (DDoSDetected, DDoSAttackBitsPerSecond, DDoSAttackPacketsPerSecond, DDoSAttackRequestsPerSecond), AWS/WAFV2 (AllowedRequests, BlockedRequests, CountedRequests)

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

AWS WAF is available in both AWS GovCloud (US) Regions, with one documented difference: only AWS-provided managed rule groups are usable — AWS Marketplace third-party rule groups are not. Shield is the awkward one: the Shield Response Team documentation states the SRT serves customers in AWS GovCloud (US-East) and (US-West), but the AWS General Reference lists a single Shield endpoint, shield.us-east-1.amazonaws.com, with no GovCloud entry, and the shield-advanced-enabled-autorenew managed rule is documented as available only in US East (N. Virginia) — so run the aws shield calls and that Config rule against us-east-1 and confirm your own account's GovCloud Shield coverage before you claim it. Web ACL and load-balancer ARNs use partition arn:aws-us-gov

## Notes

This proves the mechanism, not the outcome. SC-5 asks that denial-of-service attacks be protected against or their effects limited: the configuration calls prove rate limiting and Shield are attached to the right resources, and list-attacks plus the DDoSProtection metrics prove detection and mitigation fired — but 'the effect on availability was limited' is a judgement you make against your own application health, error rates and capacity headroom, which are not in this output. Two honest gaps. Shield Standard, which protects every AWS customer automatically, has no API and no record to collect; if you are not subscribed to Shield Advanced there is nothing here to show beyond the WAF half, and describe-subscription simply errors. And the rate limit itself is a number you chose: a RateBasedStatement set far above real traffic passes every check while limiting nothing, so put the documented threshold next to the configured Limit. Note also that Shield Advanced reports metrics once a minute during an event but only once a day when nothing is happening, so a sparse series is normal and a missing data point is not an outage; and that engaging the SRT requires a Business or Enterprise Support plan. list-attacks covers the window you pass — keep the collected output, since the API's own history is not your retention policy.

## References

- {"title":"AWS CLI: shield describe-subscription (AutoRenew, ProactiveEngagementStatus)","url":"https://docs.aws.amazon.com/cli/latest/reference/shield/describe-subscription.html"}
- {"title":"AWS CLI: shield list-protections","url":"https://docs.aws.amazon.com/cli/latest/reference/shield/list-protections.html"}
- {"title":"AWS CLI: shield list-attacks (AttackSummaries, AttackVectors)","url":"https://docs.aws.amazon.com/cli/latest/reference/shield/list-attacks.html"}
- {"title":"AWS CLI: wafv2 list-web-acls","url":"https://docs.aws.amazon.com/cli/latest/reference/wafv2/list-web-acls.html"}
- {"title":"AWS CLI: wafv2 get-web-acl (Rules, DefaultAction)","url":"https://docs.aws.amazon.com/cli/latest/reference/wafv2/get-web-acl.html"}
- {"title":"AWS WAF: using rate-based rule statements","url":"https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html"}
- {"title":"AWS Config managed rule: wafv2-logging-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/wafv2-logging-enabled.html"}
- {"title":"AWS Config managed rule: shield-advanced-enabled-autorenew (us-east-1 only)","url":"https://docs.aws.amazon.com/config/latest/developerguide/shield-advanced-enabled-autorenew.html"}
- {"title":"AWS Shield Advanced metrics (AWS/DDoSProtection namespace)","url":"https://docs.aws.amazon.com/waf/latest/developerguide/shield-metrics.html"}
- {"title":"AWS WAF metrics and dimensions (AWS/WAFV2 namespace)","url":"https://docs.aws.amazon.com/waf/latest/developerguide/waf-metrics.html"}
- {"title":"Managed DDoS event response with the Shield Response Team (GovCloud Regions)","url":"https://docs.aws.amazon.com/waf/latest/developerguide/ddos-srt-support.html"}
- {"title":"AWS Shield Advanced endpoints and quotas","url":"https://docs.aws.amazon.com/general/latest/gr/shield.html"}
- {"title":"AWS WAF in AWS GovCloud (US)","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-waf.html"}