DDoS (Distributed Denial of Service) is often summarized as "an attack that sends large amounts of traffic to paralyze a service," but the critical security insight is that the defense mechanism differs completely depending on which layer the attack targets. SYN flood (L3/L4 resource exhaustion) and HTTP flood (L7 application exhaustion) are both "floods," but they cannot be blocked by the same tools. AWS Shield is designed around this layering principle.
Shield divides into two tiers. Shield Standard is automatically and freely applied to all AWS customers, absorbing common L3/L4 attacks