AWS Shield Advanced L7 DDoS Migration: What Changes Before the January 2027 Sunset

By AiCybr Editorial · Published August 8, 2026

AWS has reached the end of the scheduled window for the first rollout phase in its migration away from the legacy Shield Advanced application-layer automatic mitigation system. AWS said the gradual deployment, running from July 27 through August 7, 2026, was expected to add the AWS WAF Anti-DDoS managed rule group to eligible Shield Advanced web ACLs in Count mode, allowing customers to compare the new detection system against the existing protection before any blocking behavior changes. Customers should confirm the rule group actually reached each expected web ACL rather than treating the August 7 date as proof of enrollment.

The transition matters because the old Layer 7 automatic mitigation feature is scheduled to retire on January 1, 2027. Customers that still depend on it need to migrate before then or lose automatic application-layer DDoS mitigation.

The new managed rule group is AWSManagedRulesAntiDDoSRuleSet. AWS documents it as a 50-WCU rule group that detects DDoS events, labels suspicious requests by confidence level, and can either challenge or block traffic during an attack.

The migration timeline

AWS divided the transition into five phases:

The August 7 milestone does not mean AWS has already switched every customer into active blocking with the new rule group. For web ACLs reached by the automatic rollout, the rule group is placed in Count mode, where it observes and labels traffic while the old automatic mitigation continues protecting the resource.

What changed technically

The legacy Shield Advanced Layer 7 feature and the newer WAF Anti-DDoS managed rule group solve the same broad problem but expose different controls and telemetry.

AWS says the managed rule group can establish a traffic baseline within minutes and react to attacks within seconds. It also exposes more granular request-level information through AWS WAF labels and logs.

AWS documents three principal rules inside AWSManagedRulesAntiDDoSRuleSet:

• ChallengeAllDuringEvent can challenge requests that are capable of handling the browser challenge while the protected resource is under attack.
• ChallengeDDoSRequests can challenge requests that meet the configured suspicion threshold.
• DDoSRequests blocks requests that meet or exceed the configured block-sensitivity threshold.

The rule group also applies labels such as event-detected, ddos-request, and low-, medium- or high-suspicion classifications. Those labels can be used for investigation or for follow-on WAF rules.

Sensitivity is not a simple “more secure” slider

The rule group’s block sensitivity can be set to Low, Medium or High, but the names describe how broadly the rule matches suspicion labels rather than the severity of the attack.

AWS documents the behavior this way:

The default block sensitivity is Low. Raising sensitivity increases the set of requests eligible for mitigation, which can improve protection during difficult events but also increases the importance of validating legitimate traffic patterns.

AWS recommends using the evaluation window to compare detection and tune the rule group before relying on it as the only application-layer mitigation mechanism.

What Shield Advanced customers should check now

The immediate task is not simply to confirm that a new managed rule group appears in a web ACL. Customers should verify that the rollout reached the expected ACLs, that the new telemetry is visible, and that infrastructure-as-code definitions match the state AWS has introduced automatically.

A practical validation pass should include:

1. Confirm enrollment. Check eligible web ACLs for AWSManagedRulesAntiDDoSRuleSet in Count mode.
2. Compare detections. AWS recommends comparing the existing DDoSDetected metric in the AWS/DDoSProtection namespace with DDoSAttackRequests in AWS/WAFV2.
3. Enable or review WAF logging. Inspect awswaf:managed:aws:anti-ddos: labels to understand which requests are being classified as suspicious.
4. Review web ACL priority. AWS recommends placing the Anti-DDoS managed rule group at high priority, normally below custom Allow rules that intentionally fast-path known-good traffic.
5. Check challenge compatibility. Browser challenges are not appropriate for every endpoint. APIs, machine-to-machine paths and other non-HTML traffic may need URI exemptions or different handling.
6. Synchronize infrastructure as code. If AWS automatically modifies a web ACL that is also managed through Terraform, CloudFormation or CDK, refresh or import the resulting state before the next deployment so automation does not accidentally remove the managed rule group.
7. Identify web ACLs that will not auto-upgrade. Mixed-mode or otherwise ineligible configurations may require the guided migration path before December 31.

That last point is important: being included in the Count-mode rollout and being eligible for the October automatic upgrade are not necessarily the same thing. AWS says the October phase applies stricter eligibility criteria.

The October handoff is designed to avoid a protection gap

For web ACLs that qualify for automatic migration, AWS says the October upgrade will mirror the existing automatic-mitigation configuration. A legacy Block configuration is brought across as Block; Count is brought across as Count.

AWS describes the transition as a single operation: the Anti-DDoS managed rule group takes over as the older automatic mitigation is disabled rather than leaving an interval with neither protection mechanism active.

Customers that do not want the automatic upgrade can contact AWS Support before the migration date.

Pricing has several important exceptions

Shield Advanced subscriptions include use of the Layer 7 Anti-DDoS managed rule group for up to 50 billion requests per month across Shield Advanced-protected WAF resources in the organization or payer-account context described by AWS. Usage above that threshold is billed according to Shield/WAF pricing.

For eligible web ACLs that AWS automatically enrolled during the July 27-August 7 rollout, AWS says Anti-DDoS managed-rule request fees and WCU charges are waived during the July 27-September 30 evaluation period.

That waiver does not automatically apply if a customer independently adds the managed rule group outside the rollout path. Standard pricing can begin immediately in that case.

AWS also states that DDoS attack traffic is not charged while the managed rule group is actively mitigating through Block or Challenge mode. Count mode is observability, not mitigation, so its billing treatment differs outside the temporary evaluation waiver.

The safest way to estimate cost is to use the current AWS WAF and Shield pricing pages rather than relying on a static per-request number, particularly for large organizations with multiple web ACLs and shared payer accounts.

Why AWS is replacing the older system

AWS made the WAF Anti-DDoS managed rule group the default direction for HTTP request-flood protection in 2026. Its documentation says the newer system supersedes the older Layer 7 automatic-mitigation feature. AWS says it can establish a traffic baseline in minutes rather than hours and react to an attack within seconds.

The larger architectural change is that DDoS mitigation is becoming a first-class WAF rule group instead of a more opaque Shield-managed response layer. That gives operators direct access to sensitivity settings, request labels, WAF logs, rule ordering and Challenge behavior.

It also shifts more responsibility to the customer. A configurable WAF rule can be observed and tuned more precisely, but teams need to understand which endpoints can tolerate browser challenges, how rule priority interacts with existing policies, and how automatically introduced configuration is represented in infrastructure-as-code systems.

Key dates to keep on the calendar

• August 7, 2026: AWS’s expected completion date for the gradual automatic Count-mode rollout to eligible Shield Advanced web ACLs; verify actual enrollment in each expected ACL.
• September 30, 2026: end of the free evaluation period for eligible auto-enrolled ACLs.
• October 1, 2026: automatic upgrades begin for eligible configurations.
• December 31, 2026: end of the guided migration window described by AWS.
• January 1, 2027: legacy Shield Advanced application-layer automatic mitigation is retired.

The most important operational deadline is January 1. Any environment still depending exclusively on the legacy feature needs a completed migration before that date.

Sources

• AWS Security Blog — Shield Advanced is embracing the AWS WAF Anti-DDoS managed rule group
• AWS WAF Developer Guide — Anti-DDoS managed rule group
• AWS WAF API Reference — AWSManagedRulesAntiDDoSRuleSet
• AWS WAF Developer Guide — Advanced Anti-DDoS protection
• AWS WAF pricing