Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Shield – Managed DDoS Protection

aws.amazon.com

Post reply on HN
Print view View original

11–20 of 79 posts

Re: AWS Shield – Managed DDoS Protection

#11

Post by mtberatwork »

Artemis2 wrote: post #8

> AWS Shield Advanced comes with “DDoS cost protection”, a safeguard from scaling charges as a result of a DDoS attack that cause usage spikes on Elastic Load Balancing (ELB), Amazon CloudFront or Amazon Route 53. If any of these services scale up in response to a DDoS attack, AWS will provide service credits for charges due to usage spikes. This is a very big deal!

AWS Shield Advanced though...so what does this mean if you are on Standard? One of the biggest fears is launching an EC2 instance (or some other service) only to get hit at some random point in time with a DDoS attack and a large bill at the end of the month. I've read stories of AWS forgiving events like this, but are you now up a creek if you don't subscribe to their "Advanced" tier?

Re: AWS Shield – Managed DDoS Protection

#12

Post by danudey »

dangrossman wrote: post #9
dx034 wrote: post #2

Finally. The basic offer is something a lot of other providers already have. Not sure about the advanced one. Sounds quite expensive. $3,000/month plus extra traffic costs. And I don't understand which traffic they bill. Usually AWS bills outgoing traffic, but for DDOS costs only occur ingress, or am I wrong? Can't see from the price list what they'll actually bill (ingress or egress).

That's $2000/month cheaper than Cloudflare Enterprise. I imagine they have the same target customer?

This seems to be only for people on AWS, which is why Amazon can charge less for it: they're already making a profit on you elsewhere.

For people who host their own servers or systems (or who cloud but not on AWS), this doesn't appear to be an option and you still have to go with Cloudflare.

Re: AWS Shield – Managed DDoS Protection

#13

Post by gyey »

mtberatwork wrote: post #11
Artemis2 wrote: post #8

> AWS Shield Advanced comes with “DDoS cost protection”, a safeguard from scaling charges as a result of a DDoS attack that cause usage spikes on Elastic Load Balancing (ELB), Amazon CloudFront or Amazon Route 53. If any of these services scale up in response to a DDoS attack, AWS will provide service credits for charges due to usage spikes. This is a very big deal!

AWS Shield Advanced though...so what does this mean if you are on Standard ? One of the biggest fears is launching an EC2 instance (or some other service) only to get hit at some random point in time with a DDoS attack and a large bill at the end of the month. I've read stories of AWS forgiving events like this, but are you now up a creek if you don't subscribe to their "Advanced" tier?

Precisely. The majority of people who are be afraid of using AWS services for the risk of a bill shock due to a DDoS would be small customers who won't be able to afford the 3,000$ per month price tag for the advanced shield anyways. For them, it's still risky to use AWS.

Re: AWS Shield – Managed DDoS Protection

#14

Post by nilved »

Artemis2 wrote: post #8

> AWS Shield Advanced comes with “DDoS cost protection”, a safeguard from scaling charges as a result of a DDoS attack that cause usage spikes on Elastic Load Balancing (ELB), Amazon CloudFront or Amazon Route 53. If any of these services scale up in response to a DDoS attack, AWS will provide service credits for charges due to usage spikes. This is a very big deal!

Not really. Now your $1K DDOS bill is a $1K AWS credit. Hardly any better.

AWS desperately needs a way to turn off pay-by-use services through billing alerts. I don't believe this is possible right now.

Re: AWS Shield – Managed DDoS Protection

#15

Post by skwirl »

nilved wrote: post #14
Artemis2 wrote: post #8

> AWS Shield Advanced comes with “DDoS cost protection”, a safeguard from scaling charges as a result of a DDoS attack that cause usage spikes on Elastic Load Balancing (ELB), Amazon CloudFront or Amazon Route 53. If any of these services scale up in response to a DDoS attack, AWS will provide service credits for charges due to usage spikes. This is a very big deal!

Not really. Now your $1K DDOS bill is a $1K AWS credit. Hardly any better. AWS desperately needs a way to turn off pay-by-use services through billing alerts. I don't believe this is possible right now.

>Now your $1K DDOS bill is a $1K AWS credit.

Nice!

>Hardly any better.

...what?

Re: AWS Shield – Managed DDoS Protection

#17

Post by akerl_ »

nilved wrote: post #14
Artemis2 wrote: post #8

> AWS Shield Advanced comes with “DDoS cost protection”, a safeguard from scaling charges as a result of a DDoS attack that cause usage spikes on Elastic Load Balancing (ELB), Amazon CloudFront or Amazon Route 53. If any of these services scale up in response to a DDoS attack, AWS will provide service credits for charges due to usage spikes. This is a very big deal!

Not really. Now your $1K DDOS bill is a $1K AWS credit. Hardly any better. AWS desperately needs a way to turn off pay-by-use services through billing alerts. I don't believe this is possible right now.

You appear to be assuming that the credit applies after they charge your card, which is not what it reads as to me. The process sounds like "$1k line item for traffic -> $1k credit -> $0 charged to card".

Additionally: you can totally set up CloudWatch Alarms for billing events, it's one of the categories they provide out-of-the-box, and alarms can trigger notifications, lambdas, SQS, etc. So you can totally wire alarm -> lambda and have lambda spin down the thing costing you the money.

Re: AWS Shield – Managed DDoS Protection

#18

Post by breser »

jedberg wrote: post #4

I've been saying for years that AWS has secret DDOS protection. Never confirmed, but I'm pretty sure the basic level is just them admitting that they've always had that service.

Your comment was addressed in the session on Shield at AWS re:Invent. You were indeed correct they've been doing it for a while.

Re: AWS Shield – Managed DDoS Protection

#19

Post by Florin_Andrei »

jedberg wrote: post #4

I've been saying for years that AWS has secret DDOS protection. Never confirmed, but I'm pretty sure the basic level is just them admitting that they've always had that service.

One obvious thing they've always had is monstrous amounts of bandwidth. That will help with some attacks.

But yeah, it's interesting to learn there's a baseline anti-DDoS thing that's on by default.

Re: AWS Shield – Managed DDoS Protection

#20

Post by dx034 »

dangrossman wrote: post #9
dx034 wrote: post #2

Finally. The basic offer is something a lot of other providers already have. Not sure about the advanced one. Sounds quite expensive. $3,000/month plus extra traffic costs. And I don't understand which traffic they bill. Usually AWS bills outgoing traffic, but for DDOS costs only occur ingress, or am I wrong? Can't see from the price list what they'll actually bill (ingress or egress).

That's $2000/month cheaper than Cloudflare Enterprise. I imagine they have the same target customer?

Do you have a source for the $5000 number? Heard it's more around 3k. But guess it's on an individual basis.

And at Amazon that's just the ddos costs, the cdn and traffic cost extra.

Post reply on HN