AWS Shield Advanced pricing and cost (2026)

AWS Shield Advanced costs $3,000 a month on a one-year commitment, which makes it $36,000 before a single byte of data transfer is metered. It absorbs the base AWS WAF charges on protected resources, but at AWS's own WAF rates those only reach the fee at about five billion requests a month. The case for it is cost protection and the response team, not WAF savings.

How much does AWS Shield Advanced cost per month?

The fixed part is $3,000. The AWS Shield FAQ states it plainly: "With AWS Shield Advanced, you pay a monthly fee of $3,000 per month per organization." The AWS Shield pricing page adds the term and the second meter: "It requires a 1-year subscription commitment and charges a monthly fee, plus a usage fee based on data transfer out from Amazon CloudFront, Elastic Load Balancing (ELB), Amazon Elastic Compute (EC2), and AWS Global Accelerator."

Shield Standard, by contrast, costs nothing and needs no setup. The same page: "AWS customers receive AWS Shield Standard at no additional cost."

The data transfer out fee comes on top of the normal data transfer those resources already pay. Two pricing examples state their rates:

Putting CloudFront in front halves the Shield usage fee, and then "you only need to enable protection for Amazon CloudFront." The FAQ: "You will only be charged for AWS Shield Advanced Data Transfer on these protected resources."

Network Load Balancers and EC2 instances have a structural cost of their own. Shield Advanced cannot protect them directly: per the EC2 and NLB protection guide, "You can protect Amazon EC2 instances and Network Load Balancers by first attaching these resources to Elastic IP addresses, and then protecting the Elastic IP addresses in Shield Advanced." Every one of those Elastic IPs is a public IPv4 address, and the Amazon VPC pricing page says any public IPv4 address associated with a resource in a VPC is "charged as in-use public IPv4 address." The hourly rate is in what public IPv4 addresses cost on AWS, and the load balancer side is in Network Load Balancer pricing.

Is AWS Shield Advanced free with Business or Enterprise Support?

No. The support plan is a separate condition for one feature. The pricing page: "AWS Shield Advanced is available to all customers; however, to contact the AWS Shield Response Team customers will need the Enterprise or Business Support levels of AWS Premium Support." The FAQ repeats it: "you need a Business or Enterprise support plan in order to escalate to or engage the AWS Shield Response Team (SRT)." Without one, you pay the $3,000 and cannot reach the response team.

Does one AWS Shield Advanced fee cover every account in an organization?

Yes, with an ownership condition. The pricing page: "This fee is billed per payer account where that payer account, or at least one linked account, is subscribed to AWS Shield Advanced." The Shield Advanced subscription guide sets out three rules:

• The bill goes to the payer: "AWS bills the Shield Advanced subscriptions against the payer account for the organization, regardless of whether the payer account itself is subscribed."
• One fee covers the family, but only if you own everything in it: "one subscription price covers all subscribed accounts in the family. The organization must own all of the AWS accounts and all of their resources."
• Several organizations can share one fee, but not automatically. You must "request a fee waiver on the AWS Shield Advanced subscription charges for all but one of the organizations."

AWS Channel Resellers "will pay a separate monthly fee for each member account." How the payer and linked accounts share everything else is in what consolidated billing does and does not save.

There is also an exit trap. If you automate subscriptions with a Firewall Manager policy and later move an account out of the organization, the Firewall Manager Shield policy guide warns that "it will continue to be subscribed to Shield Advanced. Because the account is no longer part of the consolidated billing family, the account will incur a prorated Shield Advanced subscription fee." Cancelling is no quick exit: "to unsubscribe you must contact AWS Support", and the pricing page says you "agree to pay any subscription fees up to and including the effective date of termination of the subscription."

Firewall Manager itself costs nothing extra here. The Firewall Manager pricing page: "For AWS Shield Advanced customers, AWS Firewall Manager protection policy is included at no additional charge." The next sentence says Shield Advanced customers "will be charged for the AWS Config rules created to monitor any changes in resource configurations", which is a meter covered in what AWS Config actually costs.

Does AWS Shield Advanced include AWS WAF charges?

Only the base meters, and only on protected resources. The Shield Advanced guide to deciding whether to subscribe names them: "the cost per protection pack (web ACL), the cost per rule, and the base price per million requests for web request inspection, up to 1,500 WCUs and up to the default body size."

The exclusions are stated in the same guide: "Examples of non-standard AWS WAF costs are those for Bot Control, for the CAPTCHA rule action, for web ACLs that use more than 1,500 WCUs, and for inspecting the request body beyond the default body size." The pricing page goes wider on managed rules: "Fees associated with managed rules including managed rules from the AWS Marketplace are not waived for AWS Shield Advanced customers." The guide only says the cost per rule is covered, so the two pages do not agree on whether a managed rule group's $1.00 fee is absorbed; budget it as billable. On web ACLs above 1,500 WCUs, the pricing page's Examples 9 and 10 bill only the WCU surcharge, not the base request fee. Its Example 7 confirms Bot and Fraud Control stay billable on a protected resource: "you will be billed standard fees for AWS WAF Bot/Fraud control described in the AWS WAF Pricing page." The Bot Control numbers, which can exceed the web ACL by a multiple, are worked through in AWS WAF pricing and what it costs.

The 50 billion allowance is per payer, not per account: "The limit applies to all WAF requests made under the payer ID organization." Attack traffic is not held against it: "Requests that AWS Shield Advanced detects as DDoS do not count towards the 50 billion." Turning on automatic application layer mitigation also spends WCUs. The Shield Advanced rule group reference lists its cost as 150 WCUs, which "count against the WCU usage in your web ACL." A web ACL sitting at 1,400 WCUs goes over 1,500 the moment you enable it. The WAF pricing page charges the surcharge "for each 500 WCUs the Web ACL uses beyond the default allocation of 1500" without saying how a partial block of 500 is billed, so check before you enable it.

AWS's own examples disagree about how that surcharge stacks. Example 8 bills the 10 billion requests over the allowance as "$0.15/ million requests * 10 billion = $1,500.00". Example 10 has the same 60 billion requests, half above 1,500 WCUs, and totals $10,500: the fee, $6,000 of WCU charges and an unlisted $1,500 overage. Example 9 also has 60 billion requests, all above 1,500 WCUs, and stops at "Total combined charges = $15,000.00/month" with no overage. By Examples 8 and 10 it should be $16,500. Budget with the overage included.

At what WAF bill does AWS Shield Advanced pay for itself?

At about five billion requests a month, if WAF savings were the only benefit. The AWS WAF pricing page charges $5.00 per web ACL, $1.00 per rule and "$0.60/million" requests. Solving for a WAF bill equal to $3,000:

Rules barely move the break-even: a rule is a dollar and the fee is three thousand. Below, AWS's WAF Case A, which ends at "Total combined charges = $30.00/month", sits beside two hypothetical estates at the same rates:

Even a billion inspected requests a month recovers under a quarter of the fee. Below billions of requests, the WAF inclusion is a side benefit, and the decision rests on cost protection and access to the response team.

At the full 50 billion requests the base request fee would be $30,000 a month under plain WAF, and past the allowance the $0.15 overage is a quarter of WAF's $0.60 rate.

How does AWS Shield Advanced DDoS cost protection work?

As a service credit you have to request, on a short list of charges, and it can only be spent on Shield. The Shield Advanced credit request guide covers these charges only:

• Shield Advanced data transfer out
• Amazon CloudFront HTTP/HTTPS requests and CloudFront data transfer out
• Amazon Route 53 queries
• AWS Global Accelerator standard accelerator data transfer
• Load balancer capacity units for Application Load Balancer
• Instance costs for protected EC2 instances created by an auto scaling policy in response to the attack

Network Load Balancer capacity units are not on that list, even though the FAQ describes cost protection as covering "Elastic Load Balancing (ELB)" as a whole. ALB capacity units are the one load balancer meter named; what drives them is in what an ALB LCU actually is.

The same guide then limits where the credit goes: "You can apply any credits received through this process only to Shield Advanced usage. Shield Advanced credits are not available for use with other services." A credit for an EC2 scale-out or a CloudFront bill therefore does not reduce your EC2 or CloudFront line. It offsets Shield Advanced usage instead, and "Credits are valid for 12 months." It is a credit against Shield charges, not a refund of the scaled service's bill.

The prerequisites have to be in place before the attack starts:

• The resource must already be protected: "Protected resources added during an attack are not eligible for cost protection."
• For CloudFront and ALB resources, "you must have associated an AWS WAF web ACL and implemented a rate-based rule in the web ACL in Block mode."
• The application must follow AWS's DDoS resiliency best practices.
• The request is a billing case with "DDoS Concession" in the subject, and "you must submit your credit request within the 15 day period immediately following the billing month in which the attack occurred."

One more condition sits on the pricing page and not in the guide: "All AWS Shield Advanced benefits, including DDoS cost protection, are subject to your fulfillment of the 1-year subscription commitment."

Can you cancel an AWS Shield Advanced subscription before it renews?

Not before the year is up, and the renewal is on by default. The pricing page: "AWS Shield Advanced subscriptions auto-renew annually. You will be notified at least 30 days prior to your renewal date of the upcoming annual renewal cycle." It gives a Support-case window: "At any time within 30 days prior and 5 days prior to your renewal date, you may contact us at the AWS Support Center to cancel your upcoming subscription renewal."

Two other AWS pages describe a different route. The subscription guide says "To disable autorenewal for your subscription, you must use the Shield API operation UpdateSubscription or the CLI command update-subscription." The UpdateSubscription API reference says "When you initally create a subscription, AutoRenew is set to ENABLED", and rejects changes before the last month with a LockedSubscriptionException: "You can change the AutoRenew parameter during the last 30 days of your subscription." So the pricing page sends you to a Support case, the guide says you must use the API or CLI, and the API reference only allows the change in the last 30 days. Use the API early in that window and open a Support case as well.

Shield Advanced is rarely the only security line on the bill. For two of the others, see why GuardDuty bills flow logs you never made and AWS Security Hub pricing.