Which AWS service provides protection specifically against distributed denial of service (DDoS) attacks?

The service that provides protection specifically against distributed denial of service (DDoS) attacks is AWS Shield. This service is designed to safeguard applications running on AWS from DDoS attacks, which can overwhelm a service by flooding it with excessive traffic. AWS Shield includes two tiers: Standard and Advanced, providing automatic protection for all AWS customers and enhanced protections for those with the Advanced tier, including advanced detection and mitigation techniques.

AWS Shield is crucial for maintaining application availability and performance, especially for businesses that rely heavily on web applications. By utilizing AWS Shield, organizations can effectively minimize downtime and maintain service continuity even in the face of potential DDoS threats.

In contrast, while Amazon GuardDuty focuses on threat detection and continuous monitoring of account activity, AWS Config manages configurations and compliance, and Amazon CloudWatch serves to monitor resource utilization and performance metrics. They do not specifically target DDoS attack mitigation like AWS Shield does.