Selecting your resources to protect  

Once you have activated AWS Shield, you must then determine which resources and services you would like to protect using the ARNs of the resources. If you are looking to protect an EC2 instance, then you should be aware that you must first associate an elastic IP address (EIP) with the instance. AWS Shield can then be associated with the EIP and will protect whatever resource that particular EIP is associated with.