# Ensure AWS Shield is Advanced Enabled with Auto-Renew Check

- Source: https://support.icompaas.com/support/solutions/articles/62000223564-ensure-aws-shield-is-advanced-enabled-with-auto-renew-check
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Description:**

AWS Shield Advanced provides enhanced protections for your applications running on protected Amazon EC2, Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator, and Route 53 resources against more sophisticated and larger attacks. AWS Shield Advanced protection provides always-on, flow-based monitoring of network traffic and active application monitoring to provide near real-time notifications of suspected DDoS incidents.

### **Rationale:**

AWS Shield Standard tier, which provides basic DDoS protection, is automatically enabled for all AWS customers at no additional charge, however, the AWS Shield Advanced, the service that provides advanced DDoS protection, but comes with pricing. If the Auto renew check is `DISABLED`,it may not offer advanced DDoS protection after the subscription period.

### **Impact:**

 If the Auto Renew check is `ENABLED`, the subscription will be automatically renewed at the end of the existing subscription period.

### **Default Value:**

 When you initially create a subscription, `AutoRenew` is set to `ENABLED` .

**Pre-Requisite:**

The API endpoint of AWS Shield Advanced is only available in US East (N. Virginia) Region. This rule should only be scheduled to run in the US East (N. Virginia) Region.

### **Remediation:**

### **Test Plan:**

Using AWS  console: 

1.  Sign in to AWS Management console [https://console.aws.amazon.com/wafv2/shieldv2#/](https://console.aws.amazon.com/wafv2/shieldv2#/ "https://console.aws.amazon.com/wafv2/shieldv2#/")
    
2.  Navigate to AWS Shield on left and click on overview ![](https://support.icompaas.com/assets/kb/8d68a162ab7e3e5b.png) 
    
3.  check whether auto renewal is enabled ![](https://support.icompaas.com/assets/kb/281267c6e98db12a.png) 
    
4.  If not follow implementation steps to enable
    

**Using AWS CLI:**

To view details about the Shield Advanced subscription for an account.

aws shield describe-subscription

This returns details about the AWS Shield Advanced tier subscription for your AWS account. 

Look for auto-renew attribute in the output.`"AutoRenewal": "DISABLED",`

Then follow the Implementation steps

**Implementation steps:**

Using AWS  console: 

1.  Sign in to AWS Management console [https://console.aws.amazon.com/wafv2/shieldv2#/](https://console.aws.amazon.com/wafv2/shieldv2#/ "https://console.aws.amazon.com/wafv2/shieldv2#/")
    
2.  Navigate to AWS Shield on left and click on Getting started.![](https://support.icompaas.com/assets/kb/4df81529df533a74.png)
    
3.  Choose to **Subscribe to Shield Advanced.![](https://support.icompaas.com/assets/kb/0caa76ea01b50fe7.png)**
    
4.  Agree to Auto renewal and click on Subscribe to Shield Advanced.![](https://support.icompaas.com/assets/kb/12e66c2cd8ddeca2.png)
    

**Using AWS CLI:**

Updates the details of an existing subscription. Only enter values for parameters you want to change. Empty parameters are not updated.

aws shield update-subscription
  --auto-renew ENABLE

### **Backout Plan:**

Follow implementation steps upto 3rd and then disable the check box of auto renewal and click on subscribe to shield advance

**Using AWS CLI:**

 To revoke changes, specify the value of auto-renew to DISABLE

aws shield update-subscription
  --auto-renew DISABLE

### **Note:**

-   Only enter values for parameters you want to change. 
    
-   Empty parameters are not updated.
    

### **Reference:**

[![](https://support.icompaas.com/assets/kb/f3a8b9b04ddfb166.png)Actions - AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_Operations.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.