Hacker News Reader

Comment by jsheard | Hacker News Reader

A bored or malicious actor can also just DDoS your CloudFront endpoint and run up an effectively unlimited bill on your end. That exposure is par for the course with AWS, they don't have a spending hard-stop and at this point they probably never will, you just have to hope that they have mercy and waive the bill if you get a surprise extra few zeroes on the end.

View on HN

Shield Advanced claims cost protection, although as always, the devil is in the details... - https://aws.amazon.com/shield/features/

"AWS Shield Advanced comes with DDoS cost protection to safeguard against scaling charges resulting from DDoS-related usage spikes on protected EC2, ELB, CloudFront, Global Accelerator, and Route 53 resources. If any of these protected resources scale up in response to a DDoS attack, you can request Shield Advanced service credits through your regular AWS Support channel."

Shield Advanced is $3000 per month with a 1 year commitment, plus extra bandwidth fees on top of your existing bandwidth fees, I somehow doubt that many of the users who would be impacted the most by an unexpectedly large bill (individuals and smaller businesses) are proactively paying that much for DDoS insurance just in case.

I think CloudWatch billing alarms [1] are the only viable "solution" for an average joe here. Of course, they do not actually stop the usage, but at least they bring automated awareness.

Even with that, there's no easy way to rename an S3 bucket [2], plus doing so would commonly require updating config + re-deploying any apps using the bucket too...

All of this to say, the customer level really feels like the wrong layer of abstraction to solve this problem.

[1]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitori...

[2]: https://stackoverflow.com/questions/41511034/how-to-rename-a...

Agree on that. Was not claiming that Shield Advanced is the solution for this nutty request Rodeo...or maybe we should call it 404 festival...

and their bills cost up to 100x what they should (and then other services that run on top of AWS may inflate it 10x again)

Reply on news.ycombinator.com