[whi-tw]

What problem does this pull request solve?

Trello card: https://trello.com/c/t0XWPXLU/3329-use-only-anti-ddos-managed-rule-group-not-shields-application-layer-mitigation

AWS' app-level ddos protection is no longer offered via
Shield Advanced. We have already configured the new offering,
so this is just tidying up.

Things to consider when reviewing

• Ensure that you consider the wider context.
• Does it work when run on your machine?
• Is it clear what the code is doing?
• Do the commit messages explain why the changes were made?
• Are there all the unit tests needed?
• Has all relevant documentation been updated?

Reminders

If you've made changes to the deployer role (files in modules/deployer-access):

• Remember to run make <environment> forms/account apply on the relevant environments (dev, staging and/or prod)
• Check the #govuk-forms-deployment-notifications Slack channel to ensure the apply-forms-terraform-<environment> pipelines have run successfully

[Copilot]

🟢 Approval recommended

Replacement protection is configured, no dangling references remain, and no blocking issues were identified.

No open issues 🎉

What changed in this PR

Removes the legacy Shield Advanced application-layer automatic response now that replacement anti-DDoS managed rules are configured.

Changes:

• Deletes the CloudFront automatic-response resource.
• Leaves Shield protection and response-team configuration unchanged.

File	Description
infra/​deployments/​forms/​health/​shield.tf	Removes the legacy CloudFront application-layer automatic response.

_{Review effort: Balanced}