Shield stops the flood; WAF stops the well-formed attack.

Neither replaces the other — a serious edge runs both.

Shield Standard / Advanced

Layer 3/4 DDoS. Standard: free, automatic. Advanced: paid, larger-scale, dedicated response team.

AWS WAF

Layer 7, in front of ALB/CloudFront/API Gateway. 650+ bot signatures now include AI crawlers, with an AI Activity Dashboard.

Shield defends the network layer before the application ever sees traffic; WAF defends against attacks that look like legitimate HTTP requests. Removing either is a real, specific gap.