4 ms·

> AWS Shield Advanced comes with “DDoS cost protection”, a safeguard from scaling charges as a result of a DDoS attack that cause usage spikes on Elastic Load B

> AWS Shield Advanced comes with “DDoS cost protection”, a safeguard from scaling charges as a result of a DDoS attack that cause usage spikes on Elastic Load Balancing (ELB), Amazon CloudFront or Amazon Route 53. If any of these services scale up in response to a DDoS attack, AWS will provide service credits for charges due to usage spikes. This is a very big deal!

mtberatwork 10y ago
AWS Shield Advanced though...so what does this mean if you are on Standard? One of the biggest fears is launching an EC2 instance (or some other service) only to get hit at some random point in time with a DDoS attack and a large bill at the end of the month. I've read stories of AWS forgiving events like this, but are you now up a creek if you don't subscribe to their "Advanced" tier?
- gyey 10y ago
  Precisely. The majority of people who are be afraid of using AWS services for the risk of a bill shock due to a DDoS would be small customers who won't be able to afford the 3,000$ per month price tag for the advanced shield anyways. For them, it's still risky to use AWS.
  - toomuchtodo 10y ago
    Unless you're spending $xx,xxx or above monthly with AWS, you're probably better off using Cloudflare for DDOS protection. EDIT: Number is professional opinion from my experience running large AWS accounts over the last 10 years.
    - deleted 10y ago
      [deleted]
- swozey 10y ago
  I hear this all the time, people being surprised by an $80k bill when they're used to $5k. Step one of using any of these services, whether it's AWS, GCP, Azure, etc. ENABLE BILLING ALERTS. You can be notified as soon as you're being charged x%, or $x over last months bill, or set your own amounts and hop on and investigate what's going on. Please set this up. If you don't have this on right now, stop what you're doing and turn it on. This is the first thing that I do any time I'm involved with a new infrastructure.
nilved 10y ago
Not really. Now your $1K DDOS bill is a $1K AWS credit. Hardly any better. AWS desperately needs a way to turn off pay-by-use services through billing alerts. I don't believe this is possible right now.
- skwirl 10y ago
  >Now your $1K DDOS bill is a $1K AWS credit. Nice! >Hardly any better. ...what?
  - wbl 10y ago
    Cash is king. Loaning money to Amazon you could be using to pay suppliers or salaries or returning to investors is a cost.
- akerl_ 10y ago
  You appear to be assuming that the credit applies after they charge your card, which is not what it reads as to me. The process sounds like "$1k line item for traffic -> $1k credit -> $0 charged to card". Additionally: you can totally set up CloudWatch Alarms for billing events, it's one of the categories they provide out-of-the-box, and alarms can trigger notifications, lambdas, SQS, etc. So you can totally wire alarm -> lambda and have lambda spin down the thing costing you the money.
  - nilved 10y ago
    Right, I see how I could have been wrong about that assumption. I assumed it would be after-the-fact credits. And doing it through Lambda is possible, but the friction there almost feels deliberate. They should make it a first-class option you don't need to wire together yourself.
    - bigiain 10y ago
      They should make it a first class option - to spend less money with them? AWS is the ultimate "wire it together yourself" tool. If that's _not_ what you're after, there are many other vendors eager to take your money.

mtberatwork 10y ago

AWS Shield Advanced though...so what does this mean if you are on Standard? One of the biggest fears is launching an EC2 instance (or some other service) only to get hit at some random point in time with a DDoS attack and a large bill at the end of the month. I've read stories of AWS forgiving events like this, but are you now up a creek if you don't subscribe to their "Advanced" tier?

gyey 10y ago
Precisely. The majority of people who are be afraid of using AWS services for the risk of a bill shock due to a DDoS would be small customers who won't be able to afford the 3,000$ per month price tag for the advanced shield anyways. For them, it's still risky to use AWS.
- toomuchtodo 10y ago
  Unless you're spending $xx,xxx or above monthly with AWS, you're probably better off using Cloudflare for DDOS protection. EDIT: Number is professional opinion from my experience running large AWS accounts over the last 10 years.
  - deleted 10y ago
    [deleted]
swozey 10y ago
I hear this all the time, people being surprised by an $80k bill when they're used to $5k. Step one of using any of these services, whether it's AWS, GCP, Azure, etc. ENABLE BILLING ALERTS. You can be notified as soon as you're being charged x%, or $x over last months bill, or set your own amounts and hop on and investigate what's going on. Please set this up. If you don't have this on right now, stop what you're doing and turn it on. This is the first thing that I do any time I'm involved with a new infrastructure.

nilved 10y ago

Not really. Now your $1K DDOS bill is a $1K AWS credit. Hardly any better. AWS desperately needs a way to turn off pay-by-use services through billing alerts. I don't believe this is possible right now.

skwirl 10y ago
>Now your $1K DDOS bill is a $1K AWS credit. Nice! >Hardly any better. ...what?
- wbl 10y ago
  Cash is king. Loaning money to Amazon you could be using to pay suppliers or salaries or returning to investors is a cost.
akerl_ 10y ago
You appear to be assuming that the credit applies after they charge your card, which is not what it reads as to me. The process sounds like "$1k line item for traffic -> $1k credit -> $0 charged to card". Additionally: you can totally set up CloudWatch Alarms for billing events, it's one of the categories they provide out-of-the-box, and alarms can trigger notifications, lambdas, SQS, etc. So you can totally wire alarm -> lambda and have lambda spin down the thing costing you the money.
- nilved 10y ago
  Right, I see how I could have been wrong about that assumption. I assumed it would be after-the-fact credits. And doing it through Lambda is possible, but the friction there almost feels deliberate. They should make it a first-class option you don't need to wire together yourself.
  - bigiain 10y ago
    They should make it a first class option - to spend less money with them? AWS is the ultimate "wire it together yourself" tool. If that's _not_ what you're after, there are many other vendors eager to take your money.