> its probably a trade secret or something You can do auto-scaling without Amazon's secret sauce (or Google's), it just relies on triggers to spin up new boxes

> its probably a trade secret or something You can do auto-scaling without Amazon's secret sauce (or Google's), it just relies on triggers to spin up new boxes. I'm not very familiar with the Google setup, but you could use the Amazon API to pull metrics about boxes, then send a request to add another box to the auto-scaling group manually if you wanted. > How do you prevent oscillations in resource allocations when the traffic is fluctuating? Oscillation is kind of the point -- if you need x servers to serve y hits per hour, you'll have x servers when you need it. But when you're down to y/2 hits per hour, you don't need to be paying for x servers anymore. It just depends on load -- for example, you can set the group to add a box when average CPU rises above 70 percent, and then set it to remove a box when average CPU falls below 30 percent. > How do you know if e.g. an adversary is just DDoS'ing your application to make it more expensive to run your application? I guess there must be some kind of threshold that you can set? But then this would cut off the website for the real customers... This isn't a problem for auto-scaling, it's a problem for web stacks – the whole point of the "auto" part of it is that increase traffic means increased resources. Going counter to that gets complicated quickly. I'm sure there are folks who know more about DDoS mitigation than I do, but putting protection in front of your app with something like Akamai should help, as can keeping an eye out for bizarre spikes from certain IP ranges.