To find out if this integration is available in your organization, see your Datadog Integrations page or ask your organization administrator.
To initiate an exception request to enable this integration for your organization, email support@ddog-gov.com.
Overview
AWS provides Shield Standard and Shield Advanced for protection against DDoS attacks.
Enable this integration to see all your AWS Shield metrics in Datadog.
Setup
Installation
If you haven’t already, set up the Amazon Web Services integration first.
Metric collection
- In the AWS integration page, ensure that
DDoSProtection is enabled under the Metric Collection tab. - Install the Datadog - AWS Shield integration.
Log collection
Enable logging
Configure AWS Shield to send logs either to a S3 bucket or to CloudWatch.
Note: If you log to a S3 bucket, make sure that amazon_shield is set as Target prefix.
Send logs to Datadog
If you haven’t already, set up the Datadog Forwarder Lambda function.
Once the Lambda function is installed, manually add a trigger on the S3 bucket or CloudWatch log group that contains your AWS Shield logs in the AWS console:
Data Collected
Metrics
| |
|---|
aws.ddosprotection.ddos_attack_bits_per_second
(gauge) | The number of bits observed during a DDoS event for a particular Amazon Resource Name (ARN). This metric is available only for network and transport layer (layer 3 and layer 4) DDoS events. This metric has a non-zero value during an event.
Shown as bit |
aws.ddosprotection.ddos_attack_packets_per_second
(gauge) | The number of packets observed during a DDoS event for a particular Amazon Resource Name (ARN). This metric is available only for network and transport layer (layer 3 and layer 4) DDoS events. This metric has a non-zero value during an event.
Shown as packet |
aws.ddosprotection.ddos_attack_requests_per_second
(gauge) | The number of requests observed during a DDoS event for a particular Amazon Resource Name (ARN). This metric is available only for layer 7 DDoS events and is reported only for the most significant layer 7 events. This metric has a non-zero value during an event.
Shown as request |
aws.ddosprotection.ddos_detected
(count) | Indicates whether a DDoS event is underway for a particular Amazon Resource Name (ARN). This metric has a non-zero value during an event. |
aws.ddosprotection.volume_bits_per_second
(gauge) | The number of bits per second for a top contributor.
Shown as bit |
aws.ddosprotection.volume_packets_per_second
(gauge) | The number of packets per second for a top contributor, or dropped or passed by a mitigation deployed in response to a detected event.
Shown as packet |
Events
The AWS Shield integration does not include any events.
Service Checks
The AWS Shield integration does not include any service checks.
Troubleshooting
Need help? Contact Datadog support.
