3 ms·

Does AWS or any other large cloud provider offer this type of service?

RL_Quine 7y ago
AWS has strong DOS protection and just doesn’t tend to shout about it. Putting services behind AWS for some basically free protection has been a trick against basic volumetric attacks for a while.
- Something1234 7y ago
  So how does that actually work? Doesn't AWS charge an arm and a leg for traffic?
  - pansa2 7y ago
    Yes - this is my main concern about moving a website from a fixed-price service to S3+CloudFront.
  - dylz 7y ago
    Basic volumetric - which is what the smaller providers can't handle, AWS can eat easily. I don't believe I've been charged for this type of attack. The one you should look out for if you are new to AWS and trying to do this "trick" is L7 repeated downloads of high-file-size content to consume your budget rapidly.
    - pansa2 7y ago
      > L7 repeated downloads of high-file-size content to consume your budget rapidly. How an one protect against this type of attack?
  - toast0 7y ago
    AWS charges an arm and a leg for outbound traffic, inbound traffic is free. Volumetric attacks are all about overwhelming your inbound; if AWS will swallow that at their ACL layer for you, that's seems pretty useful, and shouldn't generate billing.
    - dragonwriter 7y ago
      OTOH, it's tricky to direct your inbound to AWS without involving them in your outbound...
      - judge2020 7y ago
        In terms of running a data lake or keeping stuff for a long time, it's great, but of course they're banking on you moving a bunch of data to AWS to either train ML off of (compute costs) or keep it there and rack up storage space charges.
      - toast0 7y ago
        Certainly... It was more of a if you're on AWS and you attract a volumetric attack, it's not going to cost you an arm and a leg. Maybe you could run www on AWS and your real service somewhere with reasonable prices for traffic. In my experience, people who randomly DDoS tend to hit www rather than useful parts of a service.
    - mekster 7y ago
      Seems to benefit AWS as well when if it's not blocked, your server can respond with some payload which means useless outbound traffic for AWS to pay and to charge customer to make them unhappy but instead if AWS drops them, good for both.
nerdbaggy 7y ago
When using services where the IP is shared by multiple users they really have to have good protection. They can’t nullroute all the tenants
pm90 7y ago
I don’t believe GCP has such a service explicitly, although in 2 years of using them I’ve never seen any DDoS like behavior despite having multiple public endpoints. I am assuming there is some kind of automatic remediation that happens, or else I’ve just been extremely lucky.
- mekster 7y ago
  DDoS isn't free from the attacker as well, unless your service means something to competitor or someone, why would you get one?
- dward 7y ago
  https://cloud.google.com/armor/ https://cloud.google.com/armor/ GCP Network has built in DoS mitigation as well (e.g. in the load balancing layer) so you get some protection from that for free.
dragonwriter 7y ago
All of them have both automatic and add-on DDoS protection, for example of branded offerings (which doesn't cover all of the built-in protection): GCP: https://cloud.google.com/armor/ https://cloud.google.com/armor/ AWS: https://aws.amazon.com/shield/ https://aws.amazon.com/shield/
- hombre_fatal 7y ago
  Last I used AWS Shield years ago, you had to open up a support ticket to tell them about your DDoS to get a refund every time. Is that still true?
acetheface 7y ago
Not sure if DigitalOcean falls under big providers, but they offer the same solution as Linode, but made a business decision to not advertise it. Even though they haven't advertised it the reduction of null routes and better customer experience has paid for the cost.

AWS has strong DOS protection and just doesn’t tend to shout about it. Putting services behind AWS for some basically free protection has been a trick against basic volumetric attacks for a while.

Something1234 7y ago
So how does that actually work? Doesn't AWS charge an arm and a leg for traffic?
- pansa2 7y ago
  Yes - this is my main concern about moving a website from a fixed-price service to S3+CloudFront.
- dylz 7y ago
  Basic volumetric - which is what the smaller providers can't handle, AWS can eat easily. I don't believe I've been charged for this type of attack. The one you should look out for if you are new to AWS and trying to do this "trick" is L7 repeated downloads of high-file-size content to consume your budget rapidly.
  - pansa2 7y ago
    > L7 repeated downloads of high-file-size content to consume your budget rapidly. How an one protect against this type of attack?
- toast0 7y ago
  AWS charges an arm and a leg for outbound traffic, inbound traffic is free. Volumetric attacks are all about overwhelming your inbound; if AWS will swallow that at their ACL layer for you, that's seems pretty useful, and shouldn't generate billing.
  - dragonwriter 7y ago
    OTOH, it's tricky to direct your inbound to AWS without involving them in your outbound...
    - judge2020 7y ago
      In terms of running a data lake or keeping stuff for a long time, it's great, but of course they're banking on you moving a bunch of data to AWS to either train ML off of (compute costs) or keep it there and rack up storage space charges.
    - toast0 7y ago
      Certainly... It was more of a if you're on AWS and you attract a volumetric attack, it's not going to cost you an arm and a leg. Maybe you could run www on AWS and your real service somewhere with reasonable prices for traffic. In my experience, people who randomly DDoS tend to hit www rather than useful parts of a service.
  - mekster 7y ago
    Seems to benefit AWS as well when if it's not blocked, your server can respond with some payload which means useless outbound traffic for AWS to pay and to charge customer to make them unhappy but instead if AWS drops them, good for both.

nerdbaggy 7y ago

When using services where the IP is shared by multiple users they really have to have good protection. They can’t nullroute all the tenants

pm90 7y ago

I don’t believe GCP has such a service explicitly, although in 2 years of using them I’ve never seen any DDoS like behavior despite having multiple public endpoints. I am assuming there is some kind of automatic remediation that happens, or else I’ve just been extremely lucky.

mekster 7y ago
DDoS isn't free from the attacker as well, unless your service means something to competitor or someone, why would you get one?
dward 7y ago
https://cloud.google.com/armor/ https://cloud.google.com/armor/ GCP Network has built in DoS mitigation as well (e.g. in the load balancing layer) so you get some protection from that for free.

dragonwriter 7y ago

All of them have both automatic and add-on DDoS protection, for example of branded offerings (which doesn't cover all of the built-in protection): GCP: https://cloud.google.com/armor/ https://cloud.google.com/armor/ AWS: https://aws.amazon.com/shield/ https://aws.amazon.com/shield/

hombre_fatal 7y ago
Last I used AWS Shield years ago, you had to open up a support ticket to tell them about your DDoS to get a refund every time. Is that still true?

acetheface 7y ago

Not sure if DigitalOcean falls under big providers, but they offer the same solution as Linode, but made a business decision to not advertise it. Even though they haven't advertised it the reduction of null routes and better customer experience has paid for the cost.