3 ms·

A bored or malicious actor can also just DDoS your CloudFront endpoint and run up an effectively unlimited bill on your end. That exposure is par for the course

A bored or malicious actor can also just DDoS your CloudFront endpoint and run up an effectively unlimited bill on your end. That exposure is par for the course with AWS, they don't have a spending hard-stop and at this point they probably never will, you just have to hope that they have mercy and waive the bill if you get a surprise extra few zeroes on the end.

immibis 3y ago
and their bills cost up to 100x what they should (and then other services that run on top of AWS may inflate it 10x again)
- deleted 3y ago
  [deleted]
belter 3y ago
Shield Advanced claims cost protection, although as always, the devil is in the details... - https://aws.amazon.com/shield/features/ https://aws.amazon.com/shield/features/ "AWS Shield Advanced comes with DDoS cost protection to safeguard against scaling charges resulting from DDoS-related usage spikes on protected EC2, ELB, CloudFront, Global Accelerator, and Route 53 resources. If any of these protected resources scale up in response to a DDoS attack, you can request Shield Advanced service credits through your regular AWS Support channel."
- jsheard 3y ago
  Shield Advanced is $3000 per month with a 1 year commitment, plus extra bandwidth fees on top of your existing bandwidth fees, I somehow doubt that many of the users who would be impacted the most by an unexpectedly large bill (individuals and smaller businesses) are proactively paying that much for DDoS insurance just in case.
  - belter 3y ago
    Agree on that. Was not claiming that Shield Advanced is the solution for this nutty request Rodeo...or maybe we should call it 404 festival...
  - tedmiston 3y ago
    I think CloudWatch billing alarms [1] are the only viable "solution" for an average joe here. Of course, they do not actually stop the usage, but at least they bring automated awareness. Even with that, there's no easy way to rename an S3 bucket [2], plus doing so would commonly require updating config + re-deploying any apps using the bucket too... All of this to say, the customer level really feels like the wrong layer of abstraction to solve this problem. [1]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/monitor_estimated_charges_with_cloudwatch.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitori... [2]: https://stackoverflow.com/questions/41511034/how-to-rename-aws-s3-bucket https://stackoverflow.com/questions/41511034/how-to-rename-a...
    - deleted 3y ago
      [deleted]

immibis 3y ago

and their bills cost up to 100x what they should (and then other services that run on top of AWS may inflate it 10x again)

deleted 3y ago
[deleted]

belter 3y ago

Shield Advanced claims cost protection, although as always, the devil is in the details... - https://aws.amazon.com/shield/features/ https://aws.amazon.com/shield/features/ "AWS Shield Advanced comes with DDoS cost protection to safeguard against scaling charges resulting from DDoS-related usage spikes on protected EC2, ELB, CloudFront, Global Accelerator, and Route 53 resources. If any of these protected resources scale up in response to a DDoS attack, you can request Shield Advanced service credits through your regular AWS Support channel."

jsheard 3y ago
Shield Advanced is $3000 per month with a 1 year commitment, plus extra bandwidth fees on top of your existing bandwidth fees, I somehow doubt that many of the users who would be impacted the most by an unexpectedly large bill (individuals and smaller businesses) are proactively paying that much for DDoS insurance just in case.
- belter 3y ago
  Agree on that. Was not claiming that Shield Advanced is the solution for this nutty request Rodeo...or maybe we should call it 404 festival...
- tedmiston 3y ago
  I think CloudWatch billing alarms [1] are the only viable "solution" for an average joe here. Of course, they do not actually stop the usage, but at least they bring automated awareness. Even with that, there's no easy way to rename an S3 bucket [2], plus doing so would commonly require updating config + re-deploying any apps using the bucket too... All of this to say, the customer level really feels like the wrong layer of abstraction to solve this problem. [1]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/monitor_estimated_charges_with_cloudwatch.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitori... [2]: https://stackoverflow.com/questions/41511034/how-to-rename-aws-s3-bucket https://stackoverflow.com/questions/41511034/how-to-rename-a...
  - deleted 3y ago
    [deleted]