10 ms·

AWS Shield – Managed DDoS Protection

233 points by irs 10y ago

dx034 10y ago
Finally. The basic offer is something a lot of other providers already have. Not sure about the advanced one. Sounds quite expensive. $3,000/month plus extra traffic costs. And I don't understand which traffic they bill. Usually AWS bills outgoing traffic, but for DDOS costs only occur ingress, or am I wrong? Can't see from the price list what they'll actually bill (ingress or egress).
- jgrahamc 10y ago
  Pricing Example 4: AWS Shield Advanced For Amazon CloudFront Let’s assume that you deploy an Amazon CloudFront Distribution in front of the Application Load Balancer from Example 3. You then enable AWS Shield Advanced protection for your Amazon CloudFront Distribution, and remove it from your Application Load Balancer. (If you have deployed Amazon CloudFront in front of Application Load Balancer, you only need to enable protection for Amazon CloudFront). Under this scenario, at the end of the month, you will pay the AWS Shield Advanced monthly fee of $3,000. In addition to the monthly fee, you will be charged the AWS Shield Advanced usage based fee of $25 for the 1,000 GB of Regional Data Transfer out at $0.025 per GB. Your total AWS Shield charges for the month will be $3,000 + $25 = $3,025. In addition, you will pay standard Application Load Balancer and Amazon CloudFront fees as described in the Application Load Balancer Pricing and Amazon CloudFront Pricing pages.
- pktgen 10y ago
  > $3,000/month plus extra traffic costs. As if their existing margins on bandwidth aren't high enough.
- matt_wulfeck 10y ago
  > Finally. The basic offer is something a lot of other providers already have. Sure, protections like what OVH "already offers" when a DDOS attack downs their entire administrative portal? It's clear to heavy AWS users that Amazon was already providing certain DDoS protections before this announcement.
  - dx034 10y ago
    Was more thinking of ovh, in the recent attack the admin interface and network weren't affected as it seems.
- dangrossman 10y ago
  That's $2000/month cheaper than Cloudflare Enterprise. I imagine they have the same target customer?
  - danudey 10y ago
    This seems to be only for people on AWS, which is why Amazon can charge less for it: they're already making a profit on you elsewhere. For people who host their own servers or systems (or who cloud but not on AWS), this doesn't appear to be an option and you still have to go with Cloudflare.
  - dx034 10y ago
    Do you have a source for the $5000 number? Heard it's more around 3k. But guess it's on an individual basis. And at Amazon that's just the ddos costs, the cdn and traffic cost extra.
    - dangrossman 10y ago
      https://support.cloudflare.com/hc/en-us/articles/200170326-How-much-does-the-Enterprise-Plan-cost- https://support.cloudflare.com/hc/en-us/articles/200170326-H...
jedberg 10y ago
I've been saying for years that AWS has secret DDOS protection. Never confirmed, but I'm pretty sure the basic level is just them admitting that they've always had that service.
- matt_wulfeck 10y ago
  I wondered about this as well. At the very least, AWS provided admin protection during a DDOS attack. Unlike other providers their administration portion of the website was always online and accessible. This was an important and unsung benefit to using AWS.
- kyledrake 10y ago
  This is not true. The reality is that they have never had a "secret strat" for dealing with DDoS attacks except to pass the buck to their customers. And the lack of a clearly defined policy, combined with their exorbitant bandwidth costs, has made it far too dangerous to anyone without a massive budget to build services on their infrastructure. They have decided to "resolve" this problem by using it as an opportunity to further gouge their customers on bandwidth (which is already 12x+ more expensive than market rate for IP transit), instead of absorbing it into their existing cost structure. Which still would have meant their bandwidth was overpriced, and still would be way higher than what you can get pretty much everywhere else. For a contrast, OVH provides this protection as an included feature in all of their offerings. Before everyone writes it off as junk in comparison to the glorious AWS black box (AWS is amazing at marketing), bear in mind that the OVH scrubber just took a terabit DDoS attack against it and survived: http://www.securityweek.com/hosting-provider-ovh-hit-1-tbps-ddos-attack http://www.securityweek.com/hosting-provider-ovh-hit-1-tbps-... OVH correctly realizes that the only way to solve this problem is to make sure everybody gets access to it. Otherwise you're just encouraging the democratization of censorship for those without the means to protect themselves against it. I hope the "cloud" providers follow their example.
- breser 10y ago
  Your comment was addressed in the session on Shield at AWS re:Invent. You were indeed correct they've been doing it for a while.
- 10y ago
Artemis2 10y ago
> AWS Shield Advanced comes with “DDoS cost protection”, a safeguard from scaling charges as a result of a DDoS attack that cause usage spikes on Elastic Load Balancing (ELB), Amazon CloudFront or Amazon Route 53. If any of these services scale up in response to a DDoS attack, AWS will provide service credits for charges due to usage spikes. This is a very big deal!
- mtberatwork 10y ago
  AWS Shield Advanced though...so what does this mean if you are on Standard? One of the biggest fears is launching an EC2 instance (or some other service) only to get hit at some random point in time with a DDoS attack and a large bill at the end of the month. I've read stories of AWS forgiving events like this, but are you now up a creek if you don't subscribe to their "Advanced" tier?
  - gyey 10y ago
    Precisely. The majority of people who are be afraid of using AWS services for the risk of a bill shock due to a DDoS would be small customers who won't be able to afford the 3,000$ per month price tag for the advanced shield anyways. For them, it's still risky to use AWS.
    - toomuchtodo 10y ago
      Unless you're spending $xx,xxx or above monthly with AWS, you're probably better off using Cloudflare for DDOS protection. EDIT: Number is professional opinion from my experience running large AWS accounts over the last 10 years.
      - deleted 10y ago
        [deleted]
  - swozey 10y ago
    I hear this all the time, people being surprised by an $80k bill when they're used to $5k. Step one of using any of these services, whether it's AWS, GCP, Azure, etc. ENABLE BILLING ALERTS. You can be notified as soon as you're being charged x%, or $x over last months bill, or set your own amounts and hop on and investigate what's going on. Please set this up. If you don't have this on right now, stop what you're doing and turn it on. This is the first thing that I do any time I'm involved with a new infrastructure.
benevol 10y ago
Hetzner has this for quite a while now.
- dx034 10y ago
  The problem is that the whole Hetzner network is only 1.4tbit/s. Recent attacks were large than that and would've likely saturated their network.
  - boulos 10y ago
    Source? When I search for 'hetzner tbps' I only see one unsubstantiated forum post claiming 1.2 Tbps [1]. There are other reports about new peering arrangements, submarine cables, etc. so I'm curious if you have something more concrete. Disclosure: I work at Google Cloud (but not in networking / would know the answer) [1] https://www.lowendtalk.com/discussion/70274/hetzner-new-ex41-line https://www.lowendtalk.com/discussion/70274/hetzner-new-ex41...
    - dx034 10y ago
      They state it on their homepage, it's 1.46Tbps [1]. They upgraded a bit recently, still too small to handle attacks that are unfortunately common nowadays. I don't have numbers for OVH, but they should be closer to 5-10Tbps, as they stated that their scrubbing centres will be able to handle 5Tbps in the next months. [1] https://www.hetzner.de/en/hosting/unternehmen/rechenzentrum https://www.hetzner.de/en/hosting/unternehmen/rechenzentrum
- tbarbugli 10y ago
  I am surprised to hear someone saying anything positive about Hetzner. My only experience with them was a nightmare with terrible support and very inconsistent network performance.
  - warrenm 10y ago
    I've never heard anything bad about them Been a Hetzner customer for years now
nate_martin 10y ago
So many new named services. AWS will soon get to a point where their product dropdown wont fit on a laptop screen. Maybe it's time to consolidate some of these services into more general products.
- mifreewil 10y ago
  They did just re-organize that dropdown in AWS, it's actually much easier to search and find things. You can also pin commonly-used services to the top menu bar too.
  - nate_martin 10y ago
    For someone familiar with the products, yes. But for someone new to AWS most of these options don't make sense. I'm looking at a menu with hundreds of options like Snowglobe and Beanstalk and I have no idea where to start. Are they trying to brand their trademarks as the defacto name for the service (like Kleenex and ChapStick have done)?
    - NikolaeVarius 10y ago
      99% of their products aren't useful to the individual computer guy, and are geared toward enterprise. Ignore them and use the specific ones you need.
    - madeofpalk 10y ago
      Oh, all of AWS is terribly not-intuitive to use. Just creating an EC2 instance is amazingly complicated.
      - bloomark 10y ago
        Made so much easier with lightsail - https://lightsail.aws.amazon.com/ls/webapp/home/resources https://lightsail.aws.amazon.com/ls/webapp/home/resources
  - vacri 10y ago
Rapzid 10y ago
I have a lot of questions/problems with this. Here are two. 1.) They mention in the compare tiers "Application traffic monitoring" for Advanced. However in the FAQ: "In addition, customers can also use AWS WAF to protect against Application layer attacks". WAF is only available through CloudFront, and CloudFront charges 600 dollars a month for a custom SSL certificate with dedicated IP. So do they have "Application traffic monitoring" outside of WAF? I'm lead to believe not. 2.) They mentioned multiple times you can call on the DRT team to help you. However buried in the FAQ is this little gem: "Response times for DRT depends on the AWS Support plan you are subscribed to". So for 3k/mo I can't get better than 24/hr turnaround when I'm under attack without ALSO having a business/enterprise support plan?
- carterehsmith 10y ago
  As per the pricing page, looks like you _do_ need support plan: "AWS Shield Advanced is available to customers who are enrolled in either the Enterprise or Business Support levels of AWS Premium Support." https://aws.amazon.com/shield/pricing/ https://aws.amazon.com/shield/pricing/
  - Rapzid 10y ago
    Oh wow, thanks! I hadn't noticed that yet :| So many caveats to this thing. Look like I'd need to pony up >1k/mo on top of 3k to get access to the service then...
    - toomuchtodo 10y ago
      AWS is not the place to be if you're on a budget
      - RhodesianHunter 10y ago
        How often are people on a budget the target of serious ddos attacks?
        10y ago
foobar16372883 10y ago
So credits are limited to specific services > usage spikes on Elastic Load Balancing (ELB) If traffic has reached the load balancer than it's probably reached your app. No ec2 / storage / traffic credits here. > Amazon CloudFront Neat. Like cloudflare but with less features though. > or Amazon Route 53 DNS... Not really sure what to make of this one.
- stevekemp 10y ago
  > DNS... Not really sure what to make of this one. You only have to think back a couple of weeks to recall the DDos that took down Dyn: https://news.ycombinator.com/item?id=12759697 https://news.ycombinator.com/item?id=12759697 DDos attacks DNS servers are pretty common, not least because a lot of hosting companies regard DNS as low priority. I have an interest in Amazon's DNS setup, as I use it to provide my own git-based DNS hosting <https://dns-api.com> https://dns-api.com> so I'll be curious to see how this works in practice myself.
mrwnmonm 10y ago
you don't have to do anything to get this, right? it is on by default?
snowwrestler 10y ago
If you are willing to pay $thousands per month for DDOS protection, do yourself a favor and talk to DOSArrest. They have been specializing in DDOS protection since 2007, always answer tickets in minutes, and are aggressively committed to beating DDOS attacks. Not sure of their current pricing but I think it is in this range or lower.
bigjohn99 10y ago
A lot of people are missing the point. AWS has the ability to handle the largest attacks like the one that took out dns for half the net. Its not meant to be compared with the smaller players with limited abilities such as dosarrest and what not. If you are on AWS, you are already protected up to a certain size for free. This you can compare to a dosarrest, small 10,20,30 gbps attacks and yet you are getting it for free, at no cost! The advance opens you up to a team of actual ddos experts 24/7, this is meant for the serious players that cant afford interuptions or downtime. If your worried about blogs and wiki stuff, use google's ddos shield which is free for bloggers and news outfits. This is a huge deal people, i cant understand why there are people out here bashing it, what a joke.
dgudkov 10y ago
I'm reading all the recent new product announcements from Amazon and can't stop thinking that AWS is what IBM should have been. AWS is becoming "everything IT that a business needs".

233 points by irs 10y ago

dx034 10y ago

Finally. The basic offer is something a lot of other providers already have. Not sure about the advanced one. Sounds quite expensive. $3,000/month plus extra traffic costs. And I don't understand which traffic they bill. Usually AWS bills outgoing traffic, but for DDOS costs only occur ingress, or am I wrong? Can't see from the price list what they'll actually bill (ingress or egress).

jgrahamc 10y ago
Pricing Example 4: AWS Shield Advanced For Amazon CloudFront Let’s assume that you deploy an Amazon CloudFront Distribution in front of the Application Load Balancer from Example 3. You then enable AWS Shield Advanced protection for your Amazon CloudFront Distribution, and remove it from your Application Load Balancer. (If you have deployed Amazon CloudFront in front of Application Load Balancer, you only need to enable protection for Amazon CloudFront). Under this scenario, at the end of the month, you will pay the AWS Shield Advanced monthly fee of $3,000. In addition to the monthly fee, you will be charged the AWS Shield Advanced usage based fee of $25 for the 1,000 GB of Regional Data Transfer out at $0.025 per GB. Your total AWS Shield charges for the month will be $3,000 + $25 = $3,025. In addition, you will pay standard Application Load Balancer and Amazon CloudFront fees as described in the Application Load Balancer Pricing and Amazon CloudFront Pricing pages.
pktgen 10y ago
> $3,000/month plus extra traffic costs. As if their existing margins on bandwidth aren't high enough.
matt_wulfeck 10y ago
> Finally. The basic offer is something a lot of other providers already have. Sure, protections like what OVH "already offers" when a DDOS attack downs their entire administrative portal? It's clear to heavy AWS users that Amazon was already providing certain DDoS protections before this announcement.
- dx034 10y ago
  Was more thinking of ovh, in the recent attack the admin interface and network weren't affected as it seems.
dangrossman 10y ago
That's $2000/month cheaper than Cloudflare Enterprise. I imagine they have the same target customer?
- danudey 10y ago
  This seems to be only for people on AWS, which is why Amazon can charge less for it: they're already making a profit on you elsewhere. For people who host their own servers or systems (or who cloud but not on AWS), this doesn't appear to be an option and you still have to go with Cloudflare.
- dx034 10y ago
  Do you have a source for the $5000 number? Heard it's more around 3k. But guess it's on an individual basis. And at Amazon that's just the ddos costs, the cdn and traffic cost extra.
  - dangrossman 10y ago
    https://support.cloudflare.com/hc/en-us/articles/200170326-How-much-does-the-Enterprise-Plan-cost- https://support.cloudflare.com/hc/en-us/articles/200170326-H...

jedberg 10y ago

I've been saying for years that AWS has secret DDOS protection. Never confirmed, but I'm pretty sure the basic level is just them admitting that they've always had that service.

matt_wulfeck 10y ago
I wondered about this as well. At the very least, AWS provided admin protection during a DDOS attack. Unlike other providers their administration portion of the website was always online and accessible. This was an important and unsung benefit to using AWS.
kyledrake 10y ago
This is not true. The reality is that they have never had a "secret strat" for dealing with DDoS attacks except to pass the buck to their customers. And the lack of a clearly defined policy, combined with their exorbitant bandwidth costs, has made it far too dangerous to anyone without a massive budget to build services on their infrastructure. They have decided to "resolve" this problem by using it as an opportunity to further gouge their customers on bandwidth (which is already 12x+ more expensive than market rate for IP transit), instead of absorbing it into their existing cost structure. Which still would have meant their bandwidth was overpriced, and still would be way higher than what you can get pretty much everywhere else. For a contrast, OVH provides this protection as an included feature in all of their offerings. Before everyone writes it off as junk in comparison to the glorious AWS black box (AWS is amazing at marketing), bear in mind that the OVH scrubber just took a terabit DDoS attack against it and survived: http://www.securityweek.com/hosting-provider-ovh-hit-1-tbps-ddos-attack http://www.securityweek.com/hosting-provider-ovh-hit-1-tbps-... OVH correctly realizes that the only way to solve this problem is to make sure everybody gets access to it. Otherwise you're just encouraging the democratization of censorship for those without the means to protect themselves against it. I hope the "cloud" providers follow their example.
breser 10y ago
Your comment was addressed in the session on Shield at AWS re:Invent. You were indeed correct they've been doing it for a while.
10y ago

Artemis2 10y ago

> AWS Shield Advanced comes with “DDoS cost protection”, a safeguard from scaling charges as a result of a DDoS attack that cause usage spikes on Elastic Load Balancing (ELB), Amazon CloudFront or Amazon Route 53. If any of these services scale up in response to a DDoS attack, AWS will provide service credits for charges due to usage spikes. This is a very big deal!

mtberatwork 10y ago
AWS Shield Advanced though...so what does this mean if you are on Standard? One of the biggest fears is launching an EC2 instance (or some other service) only to get hit at some random point in time with a DDoS attack and a large bill at the end of the month. I've read stories of AWS forgiving events like this, but are you now up a creek if you don't subscribe to their "Advanced" tier?
- gyey 10y ago
  Precisely. The majority of people who are be afraid of using AWS services for the risk of a bill shock due to a DDoS would be small customers who won't be able to afford the 3,000$ per month price tag for the advanced shield anyways. For them, it's still risky to use AWS.
  - toomuchtodo 10y ago
    Unless you're spending $xx,xxx or above monthly with AWS, you're probably better off using Cloudflare for DDOS protection. EDIT: Number is professional opinion from my experience running large AWS accounts over the last 10 years.
    - deleted 10y ago
      [deleted]
- swozey 10y ago
  I hear this all the time, people being surprised by an $80k bill when they're used to $5k. Step one of using any of these services, whether it's AWS, GCP, Azure, etc. ENABLE BILLING ALERTS. You can be notified as soon as you're being charged x%, or $x over last months bill, or set your own amounts and hop on and investigate what's going on. Please set this up. If you don't have this on right now, stop what you're doing and turn it on. This is the first thing that I do any time I'm involved with a new infrastructure.

benevol 10y ago

Hetzner has this for quite a while now.

dx034 10y ago
The problem is that the whole Hetzner network is only 1.4tbit/s. Recent attacks were large than that and would've likely saturated their network.
- boulos 10y ago
  Source? When I search for 'hetzner tbps' I only see one unsubstantiated forum post claiming 1.2 Tbps [1]. There are other reports about new peering arrangements, submarine cables, etc. so I'm curious if you have something more concrete. Disclosure: I work at Google Cloud (but not in networking / would know the answer) [1] https://www.lowendtalk.com/discussion/70274/hetzner-new-ex41-line https://www.lowendtalk.com/discussion/70274/hetzner-new-ex41...
  - dx034 10y ago
    They state it on their homepage, it's 1.46Tbps [1]. They upgraded a bit recently, still too small to handle attacks that are unfortunately common nowadays. I don't have numbers for OVH, but they should be closer to 5-10Tbps, as they stated that their scrubbing centres will be able to handle 5Tbps in the next months. [1] https://www.hetzner.de/en/hosting/unternehmen/rechenzentrum https://www.hetzner.de/en/hosting/unternehmen/rechenzentrum
tbarbugli 10y ago
I am surprised to hear someone saying anything positive about Hetzner. My only experience with them was a nightmare with terrible support and very inconsistent network performance.
- warrenm 10y ago
  I've never heard anything bad about them Been a Hetzner customer for years now

nate_martin 10y ago

So many new named services. AWS will soon get to a point where their product dropdown wont fit on a laptop screen. Maybe it's time to consolidate some of these services into more general products.

mifreewil 10y ago
They did just re-organize that dropdown in AWS, it's actually much easier to search and find things. You can also pin commonly-used services to the top menu bar too.
- nate_martin 10y ago
  For someone familiar with the products, yes. But for someone new to AWS most of these options don't make sense. I'm looking at a menu with hundreds of options like Snowglobe and Beanstalk and I have no idea where to start. Are they trying to brand their trademarks as the defacto name for the service (like Kleenex and ChapStick have done)?
  - NikolaeVarius 10y ago
    99% of their products aren't useful to the individual computer guy, and are geared toward enterprise. Ignore them and use the specific ones you need.
  - madeofpalk 10y ago
    Oh, all of AWS is terribly not-intuitive to use. Just creating an EC2 instance is amazingly complicated.
    - bloomark 10y ago
      Made so much easier with lightsail - https://lightsail.aws.amazon.com/ls/webapp/home/resources https://lightsail.aws.amazon.com/ls/webapp/home/resources
- vacri 10y ago

Rapzid 10y ago

I have a lot of questions/problems with this. Here are two. 1.) They mention in the compare tiers "Application traffic monitoring" for Advanced. However in the FAQ: "In addition, customers can also use AWS WAF to protect against Application layer attacks". WAF is only available through CloudFront, and CloudFront charges 600 dollars a month for a custom SSL certificate with dedicated IP. So do they have "Application traffic monitoring" outside of WAF? I'm lead to believe not. 2.) They mentioned multiple times you can call on the DRT team to help you. However buried in the FAQ is this little gem: "Response times for DRT depends on the AWS Support plan you are subscribed to". So for 3k/mo I can't get better than 24/hr turnaround when I'm under attack without ALSO having a business/enterprise support plan?

carterehsmith 10y ago
As per the pricing page, looks like you _do_ need support plan: "AWS Shield Advanced is available to customers who are enrolled in either the Enterprise or Business Support levels of AWS Premium Support." https://aws.amazon.com/shield/pricing/ https://aws.amazon.com/shield/pricing/
- Rapzid 10y ago
  Oh wow, thanks! I hadn't noticed that yet :| So many caveats to this thing. Look like I'd need to pony up >1k/mo on top of 3k to get access to the service then...
  - toomuchtodo 10y ago
    AWS is not the place to be if you're on a budget
    - RhodesianHunter 10y ago
      How often are people on a budget the target of serious ddos attacks?
      - 10y ago

foobar16372883 10y ago

So credits are limited to specific services > usage spikes on Elastic Load Balancing (ELB) If traffic has reached the load balancer than it's probably reached your app. No ec2 / storage / traffic credits here. > Amazon CloudFront Neat. Like cloudflare but with less features though. > or Amazon Route 53 DNS... Not really sure what to make of this one.

stevekemp 10y ago
> DNS... Not really sure what to make of this one. You only have to think back a couple of weeks to recall the DDos that took down Dyn: https://news.ycombinator.com/item?id=12759697 https://news.ycombinator.com/item?id=12759697 DDos attacks DNS servers are pretty common, not least because a lot of hosting companies regard DNS as low priority. I have an interest in Amazon's DNS setup, as I use it to provide my own git-based DNS hosting <https://dns-api.com> https://dns-api.com> so I'll be curious to see how this works in practice myself.

mrwnmonm 10y ago

you don't have to do anything to get this, right? it is on by default?

snowwrestler 10y ago

If you are willing to pay $thousands per month for DDOS protection, do yourself a favor and talk to DOSArrest. They have been specializing in DDOS protection since 2007, always answer tickets in minutes, and are aggressively committed to beating DDOS attacks. Not sure of their current pricing but I think it is in this range or lower.

bigjohn99 10y ago

A lot of people are missing the point. AWS has the ability to handle the largest attacks like the one that took out dns for half the net. Its not meant to be compared with the smaller players with limited abilities such as dosarrest and what not. If you are on AWS, you are already protected up to a certain size for free. This you can compare to a dosarrest, small 10,20,30 gbps attacks and yet you are getting it for free, at no cost! The advance opens you up to a team of actual ddos experts 24/7, this is meant for the serious players that cant afford interuptions or downtime. If your worried about blogs and wiki stuff, use google's ddos shield which is free for bloggers and news outfits. This is a huge deal people, i cant understand why there are people out here bashing it, what a joke.

dgudkov 10y ago

I'm reading all the recent new product announcements from Amazon and can't stop thinking that AWS is what IBM should have been. AWS is becoming "everything IT that a business needs".