Tools/AWS_Shield
AWS Shield
Managed DDoS protection — Standard is automatic for all customers, Advanced adds 24/7 SRT access and cost protection for L3/L4 (and with WAF, L7) attacks. No credible open-source equivalent exists at network-absorption scale — volumetric DDoS mitigation requires massive backbone capacity that self-hosted software can't replicate. Software-level mitigations like fail2ban or rate-limiting in AWS_WAF/NGINX only address application-layer abuse, not true volumetric attacks — this is the one category where "run it yourself" genuinely isn't viable.