And I don't understand which traffic they bill. Usually AWS bills outgoing traffic, but for DDOS costs only occur ingress, or am I wrong? Can't see from the price list what they'll actually bill (ingress or egress).
Let’s assume that you deploy an Amazon CloudFront Distribution in front of the Application Load Balancer from Example 3. You then enable AWS Shield Advanced protection for your Amazon CloudFront Distribution, and remove it from your Application Load Balancer. (If you have deployed Amazon CloudFront in front of Application Load Balancer, you only need to enable protection for Amazon CloudFront).
Under this scenario, at the end of the month, you will pay the AWS Shield Advanced monthly fee of $3,000. In addition to the monthly fee, you will be charged the AWS Shield Advanced usage based fee of $25 for the 1,000 GB of Regional Data Transfer out at $0.025 per GB. Your total AWS Shield charges for the month will be $3,000 + $25 = $3,025.
In addition, you will pay standard Application Load Balancer and Amazon CloudFront fees as described in the Application Load Balancer Pricing and Amazon CloudFront Pricing pages.
Sure, protections like what OVH "already offers" when a DDOS attack downs their entire administrative portal?
It's clear to heavy AWS users that Amazon was already providing certain DDoS protections before this announcement.
For people who host their own servers or systems (or who cloud but not on AWS), this doesn't appear to be an option and you still have to go with Cloudflare.
And at Amazon that's just the ddos costs, the cdn and traffic cost extra.
As if their existing margins on bandwidth aren't high enough.