AWS Shield Advance support

[z-mani]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Hi there,

I'm wanting to enable AWS Shield Advance and enable shield advance protection on a NLB resource. Is this possible through the current Terraform AWS options? I see there is a shield option (not advance) that allows us to add protection to a resource, but shield doesn't have support for NLBs, only shield advanced does.

The resource I'm trying to attach shield advance to is an NLB

There currently is support for aws_shield_protection. This doesn't seem to have the option for shield advance resources.

Potential Terraform Configuration

resource "aws_shield_advance_protection" "example" {
  name         = "example"
  resource_arn = "arn:aws:elasticloadbalancer:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:eip-allocation/${aws_eip.example.id}"

  tags = {
    Environment = "Dev"
  }
}

References

• #0000

[justinretzolk]

Hey @z-mani 👋 Thank you for taking the time to raise this! I took a quick look, and based on the documentation, I believe the aws_shield_protection resource is actually what you're looking for. From the documentation page:

Enables AWS Shield Advanced for a specific AWS resource. The resource can be an Amazon CloudFront distribution, Elastic Load Balancing load balancer, AWS Global Accelerator accelerator, Elastic IP Address, or an Amazon Route 53 hosted zone.

This seems to line up with how Amazon describes Shield Advanced. If I've misunderstood, I'd be happy to take another look.

[ewbankkit]

Closed via #33328.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.