Create a DDoS dashboard in CloudWatch and set CloudWatch alarms

You can monitor potential DDoS activity using Amazon CloudWatch, which collects raw data from Shield Advanced and processes it into readable, near real-time metrics. You can use statistics in CloudWatch to gain a perspective on how your web application or service is performing. For more information about using CloudWatch, see What is CloudWatch in the Amazon CloudWatch User Guide.

• For instructions for creating a CloudWatch dashboard, see Monitoring with Amazon CloudWatch.

• For descriptions of the Shield Advanced metrics that you can add to your dashboard, see AWS Shield Advanced metrics.

Shield Advanced reports resource metrics to CloudWatch more frequently during DDoS events than while no events are underway. Shield Advanced reports metrics once a minute during an event, and then once right after the event ends. While no events are underway, Shield Advanced reports metrics once a day, at a time assigned to the resource. This periodic report keeps the metrics active and available for use in your custom CloudWatch alarms.

This completes the tutorial for getting started with Shield Advanced. To take full advantage of the protections you've chosen, continue exploring the features and options of Shield Advanced. To start, familiarize yourself with your options for viewing and responding to events at Visibility into DDoS events and Responding to DDoS events.