AWS Shield Advanced is embracing the AWS WAF Anti-DDoS managed rule group: What changes and how to prepare

AWS Shield Advanced is adopting the AWS WAF Anti-DDoS managed rule group as its default application-layer DDoS protection, with a phased rollout beginning July 27, 2026.

• Anti-DDoS managed rule group detects and mitigates application-layer DDoS attacks within seconds using traffic profiling and machine learning
• Offers Challenge action (silent browser verification) alongside Block and Count, with configurable Low/Medium/High sensitivity levels
• Reduces WCU consumption from 150 to 50, eliminating need for health checks and providing built-in dashboard visibility
• Phased migration: Count mode deployment (July 27–Aug 7), free evaluation period (July 27–Sept 30), auto-upgrade (Oct 1), guided migration available, and automatic mitigation sunset (Jan 1, 2027)
• DDoS traffic blocked during active mitigation is excluded from billing for AWS WAF, Anti-DDoS, and Shield Advanced charges
• Requires updating infrastructure-as-code templates and AWS Firewall Manager policies to move protection from Shield API to WAF API

The migration provides faster detection, granular visibility through labels and dashboards, and cost savings through reduced capacity consumption and attack traffic billing exclusions.