3 ms·
Serverless Vulnerable to Financial DOS like Attack
- kokanator 6y agoA simple botnet can cost a serverless based architecture a $40k bill. Thoughts on guarding against this type of threat? A WAF can detect some of this but the rotating IPs would make that less effective.
- whb07 6y agoLimits?
- kokanator 6y agoMy thought is if we use Limits it could actually turn to a true DOS meaning customers could not access as well.
- yrgulation 5y agoI guess one has to consider what's more costly: temporary service disruption, or an inflated bill? There is also the option or rate limiting per IP: https://stackoverflow.com/questions/38444923/aws-api-gateway-limit-requests-from-a-single-ip https://stackoverflow.com/questions/38444923/aws-api-gateway...
- pornel 6y agoRegular DoS protection should handle all large volumes of traffic, regardless of whether they attack a serverless endpoint or a regular server. If a too-small-to-trigger-DoS-protection volume of traffic can cause you excessive costs, rethink your usage of extremely overpriced serverless platforms :)