4 ms·

With AWS WAF you pay only for what you use. AWS WAF pricing is based on how many rules you deploy and how many web requests your web application receives. There

With AWS WAF you pay only for what you use. AWS WAF pricing is based on how many rules you deploy and how many web requests your web application receives. There are no minimum fees and no upfront commitments. Does this mean the amount would increase exponentially during a DDOS attack? Could I sink my theoretical competitor into bankruptcy if I know they are an AWS WAF client simply by DDOSing them?

dangrossman 11y ago
A site on AWS is already paying per-request or per-GB for instance count, load balancing, data transfer, etc. Adding the WAF would reduce the cost of a DDOS by discarding requests at the edge, before they can generate additional compute, IO and data transfer costs for your backend.
- Domenic_S 11y ago
  That's the question, is discarding traffic at the edge a billable event? If so what's the savings over spinning up new instances?
  - dangrossman 11y ago
    Let's say someone with a botnet is downloading a 5MB file from your server a million times a day. The WAF rule to block those requests would cost you $1 + (1 * $0.60 per million requests) = $1.60. The data transfer if you don't block those requests would cost $450. You save $448.40 per day, or 99.6%, on just the data transfer.
balls187 11y ago
> Does this mean the amount would increase exponentially during a DDOS attack? Could I sink my theoretical competitor into bankruptcy if I know they are an AWS WAF client simply by DDOSing them? One call to Amazon and they'll forgive the bill. More attempts at DDOS Amazon services would likely trigger FBI investigation.
- throwaway2048 11y ago
  its cute you think thats any kind of deterrant.
maerF0x0 11y ago
Yes, if you cheaply command resources. AFAIK the only way to make this economically viable is to illegally use others' resources (eg botnets)
- dsl 11y ago
  Hold on, you're telling me someone willing to launch a DDoS attack against a competitor might use illegally gained resources to do so?
takeda 11y ago
Yeah, I guess much more sensible (for customer) is to only count the traffic that passes WAF successfully.

dangrossman 11y ago

A site on AWS is already paying per-request or per-GB for instance count, load balancing, data transfer, etc. Adding the WAF would reduce the cost of a DDOS by discarding requests at the edge, before they can generate additional compute, IO and data transfer costs for your backend.

Domenic_S 11y ago
That's the question, is discarding traffic at the edge a billable event? If so what's the savings over spinning up new instances?
- dangrossman 11y ago
  Let's say someone with a botnet is downloading a 5MB file from your server a million times a day. The WAF rule to block those requests would cost you $1 + (1 * $0.60 per million requests) = $1.60. The data transfer if you don't block those requests would cost $450. You save $448.40 per day, or 99.6%, on just the data transfer.

balls187 11y ago

> Does this mean the amount would increase exponentially during a DDOS attack? Could I sink my theoretical competitor into bankruptcy if I know they are an AWS WAF client simply by DDOSing them? One call to Amazon and they'll forgive the bill. More attempts at DDOS Amazon services would likely trigger FBI investigation.

throwaway2048 11y ago
its cute you think thats any kind of deterrant.

maerF0x0 11y ago

Yes, if you cheaply command resources. AFAIK the only way to make this economically viable is to illegally use others' resources (eg botnets)

dsl 11y ago
Hold on, you're telling me someone willing to launch a DDoS attack against a competitor might use illegally gained resources to do so?

takeda 11y ago

Yeah, I guess much more sensible (for customer) is to only count the traffic that passes WAF successfully.