5 ms·

A bad actor could hammer any publicity available services, and you could be hit with an enormous egress bandwidth bill. Spend alerts can help with this, but sp

A bad actor could hammer any publicity available services, and you could be hit with an enormous egress bandwidth bill. Spend alerts can help with this, but spend is only calculated every 24h or so, so it's far from a panacea.

gonzo41 5y ago
Not if you're doing simple and sensible things like using Cloud Front, and setting limits with API Gateway.
- arriu 5y ago
  What if you're using something like grpc?
triska 5y ago
This is also one of the things I fear most when running a service in the cloud: A huge bill due to excessive network usage triggered for example by a search engine, web scraper etc. I consider it very unfortunate that "capped cost" has gone somewhat out of fashion, and nowadays many major cloud providers bill excess usage rather than cutting off or slowing down traffic etc. Here is a simple Bash script that monitors outgoing eth0 traffic (once per second) and automatically shuts down the instance once it is greater than 1 TB: #!/bin/bash # shut down instance if outgoing traffic > 1 TB # 1 MB limit=$((10**6)) # 10 MB limit=$((10**7)) # 1 GB limit=$((10**9)) # 1 TB limit=$((10**12)) while true do date tx=$(< /sys/class/net/eth0/statistics/tx_bytes) echo "$tx (limit: $limit)" if (( tx > limit )) then echo cutting systemctl poweroff fi sleep 1 done If you save it as cutnetwork.sh in /home/admin/cutnetwork.sh, you can run it as a systemd service: [Unit] Description=Cut Network [Service] UMask=022 Environment=LANG=en_US.utf8 Restart=on-abort StartLimitInterval=60 StartLimitBurst=5 WorkingDirectory=/home/admin ExecStart=bash cutnetwork.sh [Install] WantedBy=multi-user.target This simplistic approach may require adjustments depending on network settings and operating environment, and will not work for example if the instance is rebooted during the billing period, since that resets the counter. I would much prefer a hard-coded setting that reliable works on the instance itself, or a reliable hard billing limit that reliably turns off the service if the accumulated cost exceeds the set amount.
- arriu 5y ago
  Thanks for sharing this.
belter 5y ago
You can mitigate that, for enterprise projects, using AWS Shield Advanced as it comes with DDoS cost protection: https://aws.amazon.com/shield/features/ https://aws.amazon.com/shield/features/ I say for enterprise projects because although it's cost is reasonable for corporate projects, not probably something you can justify for most personal/private deployments.

gonzo41 5y ago

Not if you're doing simple and sensible things like using Cloud Front, and setting limits with API Gateway.

arriu 5y ago
What if you're using something like grpc?

triska 5y ago

This is also one of the things I fear most when running a service in the cloud: A huge bill due to excessive network usage triggered for example by a search engine, web scraper etc. I consider it very unfortunate that "capped cost" has gone somewhat out of fashion, and nowadays many major cloud providers bill excess usage rather than cutting off or slowing down traffic etc. Here is a simple Bash script that monitors outgoing eth0 traffic (once per second) and automatically shuts down the instance once it is greater than 1 TB: #!/bin/bash # shut down instance if outgoing traffic > 1 TB # 1 MB limit=$((10**6)) # 10 MB limit=$((10**7)) # 1 GB limit=$((10**9)) # 1 TB limit=$((10**12)) while true do date tx=$(< /sys/class/net/eth0/statistics/tx_bytes) echo "$tx (limit: $limit)" if (( tx > limit )) then echo cutting systemctl poweroff fi sleep 1 done If you save it as cutnetwork.sh in /home/admin/cutnetwork.sh, you can run it as a systemd service: [Unit] Description=Cut Network [Service] UMask=022 Environment=LANG=en_US.utf8 Restart=on-abort StartLimitInterval=60 StartLimitBurst=5 WorkingDirectory=/home/admin ExecStart=bash cutnetwork.sh [Install] WantedBy=multi-user.target This simplistic approach may require adjustments depending on network settings and operating environment, and will not work for example if the instance is rebooted during the billing period, since that resets the counter. I would much prefer a hard-coded setting that reliable works on the instance itself, or a reliable hard billing limit that reliably turns off the service if the accumulated cost exceeds the set amount.

arriu 5y ago
Thanks for sharing this.

belter 5y ago

You can mitigate that, for enterprise projects, using AWS Shield Advanced as it comes with DDoS cost protection: https://aws.amazon.com/shield/features/ https://aws.amazon.com/shield/features/ I say for enterprise projects because although it's cost is reasonable for corporate projects, not probably something you can justify for most personal/private deployments.