IAM / security / shield

AWS Shield (IAM)

JSON →
AWSshieldsecurity

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS.

iamaws
docs ↗
Permissions
Actions in this service
shield:ListAttacks
shield:DescribeAttack
shield:ListProtections
shield:DescribeProtection
shield:CreateProtection
shield:DeleteProtection
shield:DescribeSubscription
shield:GetSubscriptionState
Policy
Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "shield:ListAttacks", "shield:DescribeAttack", "shield:ListProtections", "shield:DescribeProtection", "shield:CreateProtection", "shield:DeleteProtection", "shield:DescribeSubscription", "shield:GetSubscriptionState" ], "Resource": "*" } ] }
SDK mapping
Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns
Known gotchas
Avoid shield:* — grants full control including delete and modify operations.
Avoid shield:DeleteProtection — can remove DDoS protection from resources.
Resources
docshttps://servicereference.us-east-1.amazonaws.com/v1/shield/shield.json ↗