Has any one dealt with DDoS attack on a static hosting (S3 + Couldfront) set up? I sometimes fear that if something like this happens the bandwidth bill will b

Has any one dealt with DDoS attack on a static hosting (S3 + Couldfront) set up? I sometimes fear that if something like this happens the bandwidth bill will be too much to handle for small personal projects. Also it's a pain that AWS doesn't allow one to set hard limits on cloud spending. Yes, they allow to set up some billing alarms, but no hard limits. No guarantee that no matter what, the month's hosting bill will not exceed $10 for this project. For small personal projects a tiny VPS seems to be safer from this angle. At max a DDoS will cripple the VPS but the hosting bill will stay the same. If you have been through this, did you get any discounts from AWS for resources being used during DDoS attack or you had to pay the full amount.