Skip to main content

More Info:

Ensure auto renew is enabled for shield

Risk Level

Medium

Address

Configuration

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of AWS Shield Advanced setting not being set to auto-renew, follow these steps using the AWS Management Console:
  1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/) and log in to your AWS account.
  2. Navigate to AWS Shield Console: In the AWS Management Console, search for “Shield” in the services search bar and click on “AWS Shield” under the Security, Identity, & Compliance category.
  3. Select the Shield Advanced Service: In the AWS Shield console, click on the “Shield Advanced” service.
  4. Navigate to Advanced Settings: In the Shield Advanced dashboard, locate the “Advanced settings” section and click on it to view the current settings.
  5. Enable Auto-Renewal: Look for the setting related to auto-renewal of the AWS Shield Advanced subscription. If it is not already set to auto-renew, you will see an option to enable auto-renewal. Click on the option to enable auto-renewal for the subscription.
  6. Review and Confirm: Review the changes you have made to ensure that the auto-renewal setting is now enabled for your AWS Shield Advanced subscription.
  7. Save Changes: Once you have confirmed that the auto-renewal setting is enabled, click on the “Save” or “Update” button to save the changes.
By following these steps, you have successfully remediated the misconfiguration of AWS Shield Advanced setting not being set to auto-renew. This ensures that your AWS Shield Advanced subscription will automatically renew at the end of its term, providing continuous protection for your AWS resources against DDoS attacks.

To remediate the misconfiguration of the Shield Advanced setting not being set to auto-renew in AWS using the AWS CLI, follow these steps:
  1. Open a terminal or command prompt window.
  2. Use the AWS CLI command to enable auto-renewal for Shield Advanced. Run the following command:
  1. Verify that the setting has been updated successfully by running the following command to describe the Shield subscription:
  1. Check the output to confirm that the AutoRenew field is set to True, indicating that auto-renewal is now enabled for Shield Advanced.
By following these steps, you have successfully remediated the misconfiguration by setting the Shield Advanced subscription to auto-renew using the AWS CLI.
To remediate the misconfiguration of AWS Shield Advanced setting not being set to auto renew, you can use the AWS SDK for Python (Boto3) to update the Shield Advanced configuration. Here are the step-by-step instructions to remediate this issue:
  1. Install Boto3: Make sure you have Boto3 installed. You can install it using pip:
  2. Configure AWS Credentials: Ensure that you have AWS credentials configured on the machine where you will be running the Python script. You can set up your AWS credentials using AWS CLI by running:
  3. Write a Python script to update the Shield Advanced configuration: Create a Python script with the following code snippet to update the Shield Advanced configuration to enable auto-renewal:
  4. Run the Python script: Save the Python script with a meaningful name (e.g., update_shield_auto_renew.py) and run it using the following command:
  5. Verify the Shield Advanced configuration: After running the script, verify that the Shield Advanced setting has been updated to auto-renew by checking the AWS Management Console or by running describe_shield_subscription API call.
By following these steps, you can remediate the misconfiguration of AWS Shield Advanced setting not being set to auto renew using Python and Boto3.
This setting cannot currently be managed via Terraform: the AWS provider does not expose any resource or argument to control the Shield Advanced subscription auto‑renew flag.Use the CLI or console instead, with care about charges and account scope:
Or in the AWS Console: AWS Shield → Advanced → Subscription settings → enable Auto‑renew.