Serverless Vulnerable to Financial DOS like Attack

theregister.com

11 pointskokanator5 comments

A simple botnet can cost a serverless based architecture a $40k bill.

Thoughts on guarding against this type of threat? A WAF can detect some of this but the rotating IPs would make that less effective.

Limits?

My thought is if we use Limits it could actually turn to a true DOS meaning customers could not access as well.

I guess one has to consider what's more costly: temporary service disruption, or an inflated bill? There is also the option or rate limiting per IP: https://stackoverflow.com/questions/38444923/aws-api-gateway...

Regular DoS protection should handle all large volumes of traffic, regardless of whether they attack a serverless endpoint or a regular server.

If a too-small-to-trigger-DoS-protection volume of traffic can cause you excessive costs, rethink your usage of extremely overpriced serverless platforms :)

Reply on news.ycombinator.com