Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 348 posts

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#171

Post by jlmorton »

bilekas wrote: post #166
jlmorton wrote: post #147

Earlier quoted context omitted.

I'm a fan of boring technology too, but I would like to suggest to you that Serverless _is_ kind of boring. Essentially you just upload a ZIP of your application, and register a handler function that takes a JSON payload. Obviously this is quite a bit more boring than a K8s cluster, with a bunch of nodes, networking, Helm charts, etc. I would posit that even compared to something like a DO Droplet, Serverless is stil…

> your cost for doing a couple million, 2-second-long requests is about four cents. This seems wrong to me ? Can you explain a bit more ? Are these just API requests or ?

It's admittedly a simplification and a best case. For AWS Lambda, the price is in GB-seconds, and the amount of CPU available to your function is itself a function of the memory allocated.

The price is $0.0000166667 for every GB-second on X86. So it looks like I've also misplaced a decimal. It's $0.20 per 1M requests with 1GB of memory.

Lambdas can be sized from 128MB to 10GB, and pricing depends on the resources allotted.

Ultimately, this pricing just represents the compute time for a function to complete. That function can do whatever it wants.

There are additional costs to put an API Gateway in front of it, for instance, to make it a publicly accessible API.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#172

Post by iforgotpassword »

Mo3 wrote: post #143
razemio wrote: post #136

Earlier quoted context omitted.

Pretty easy, OP sounds exactly like a guy who would have been perfectly fine with a single (Hetzner) server. Then these arguments popup and they are most of the time right. I agree with you, that it always depends on the use. However, hurr durr Hetzner Server seems to be the more reasonable choice here (once again).

Why? If you had the choice between complete redundancy and infinite scaling by default while having almost zero work, or using a dedicated server that you need to configure and constantly maintain, what would you choose?

If with one thing, a single mistake can result in a $5k bill, and with the other I have a guaranteed fixed bill of 50 bucks a month, then unless I have enough money to burn, the choice is crystal clear. Maybe you wipe your butt with 100$ bills. Others aren't that lucky.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#173

Post by peterangular »

kif wrote: post #120
sirwitti wrote: post #74

I'm very much on the boring technology side of things with respect to hosting. 40€ / month gets you a very powerful dedicated server that can easily handle millions of requests per day and performs incredibly well and can be managed easily. If you also use containers you even get quite a bit of flexibility and agility. To be honest I don't really understand the sentiment that developers can get away with not knowing…

Reading some replies here, it’s no wonder some startups go bankrupt while investing so much in infrastructure — all while not having enough users to justify more than a single dedicated server. Scalability should be the last thing in mind if your product sucks.

[dead]

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#174

Post by huksley »

eranation wrote: post #90

First, based on my experience, they usually are able to waive this, if it's an honest mistake and from a small company. Second, you can apply for credits, you can get at least $1,000 founders credits for AWS Activate, and if you work with any VC, you can get up to $100,000. Lastly, note that Lambda@edge is (much) more expensive than Lambda, the tech stack I personally pick for any new product, is pure old lambda, ser…

I keep my fingers crossed!

We also applied for AWS Activate sometime ago, as a member of YCombinator Startup School.

I would really like to deploy to regular Lambdas, they are per region and easier to monitor, but unfortunately there is no support for this in serverless-nextjs right now.

Good thing about is it almost automatic - static frontend, SSR and API are deployed appropriately and work perfectly, without too much fuzz.

I try to balance between bringing customer value and doing infrastructure work, and now it is clear I should have spend more time on making a better architecture.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#175

Post by cft »

booi wrote: post #167
cft wrote: post #137

Earlier quoted context omitted.

I ran a website with 37 million users and 3.6Gbps peak bandwidth (JavaScript+thumbnails, no video) from my own two racks of Linux servers thay i have not systematically updated for years. The OSes were beyond the lts support winows. I manually compiled my own updates, but very rarely and only those that i deemed critical. Granted, the site stack was completely custom so the standard automated hacks didn't work. In 15…

I dont think this should be standard. It sounds like you’re saying you ran a service with 37 million people’s information on a software stack that was so old that not even the vendor is supporting it anymore and could be riddled with security issues that you wouldn’t even know much less be able to detect? It may work but certainly not going to get any security certifications this way..

I hardly stored any PII. Also, this was a high profile site that you know: if it was hacked, they would probably try to deny access and extort: it would make a lot of monetary sense. We would also have lost our merchant accounts very quickly (although CC numbers were not stored, only MD5s, but i suppose they could have been captured from the application's memory after TLS decryption but before MD5 hashing, although this would have been a difficult task even on a rooted server). I am 99.999% confident by observing and recording loads, traffic, logs and other parameters of all servers that there were no intrusions. I understand that there's market size and appeal for bureaucracy and certifications, but i have my own data.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#176

Post by bombcar »

noasaservice wrote: post #41
bombcar wrote: post #36

Earlier quoted context omitted.

Given how easily they reimburse customers, I suspect it's intentional - one can be "fixed after the fact" and the other can't - if your site goes down during a slashdotting and you lose sales, etc, there's no getting those back, but if you inadvertently run costs high, they can just refund/cancel those costs.

Azure HAS this hard limit feature already. Ive seen nobody on HN, twitter, reddit complain about "my site was down during heavy business since i turned on hard billing setting". Not a single person. However, I see frantic after frantic post of "I was testing something on AWS and it caused me a $X000 or $X0000 bill." But as the posts in here are apt to suggest - you can always beg AWS support for a reversal. Great pla…

The first is obviously customer error and unless you're posting to get laughed at, you're likely not to gain traction.

(Also one could make the "nobody uses Azure" joke here.)

Personally I think that much of AWS is "way overpowered" for the normal person/business, and you shouldn't be playing with it if a $X0k bill would be impactful (as likely other solutions are much better tuned to your needs and money).

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#177

Post by gkapur »

jlmorton wrote: post #147
sirwitti wrote: post #74

I'm very much on the boring technology side of things with respect to hosting. 40€ / month gets you a very powerful dedicated server that can easily handle millions of requests per day and performs incredibly well and can be managed easily. If you also use containers you even get quite a bit of flexibility and agility. To be honest I don't really understand the sentiment that developers can get away with not knowing…

I'm a fan of boring technology too, but I would like to suggest to you that Serverless _is_ kind of boring. Essentially you just upload a ZIP of your application, and register a handler function that takes a JSON payload. Obviously this is quite a bit more boring than a K8s cluster, with a bunch of nodes, networking, Helm charts, etc. I would posit that even compared to something like a DO Droplet, Serverless is stil…

The challenge with serverless is building systems that rely on more complex backend processes and existing code and doing things like testing using most of an existing codebase. Serverless is great for nodejs/javascript stacks that are database and front-end heavy but don't need more complexity like queueing, event streaming, or more complex architectures. Then serverless becomes a huge mess normally and the developer experience becomes a giant catastrophe, as well.

Here the OP kind of got caught by the terrible DX that is almost natural to serverless IMO.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#178

Post by mfrye0 »

huksley wrote: post #153
mfrye0 wrote: post #133

I started off using Lambda as well and made the same sort of mistake. I can't remember exactly how much my bill was, but it was enough that it would have drained all my savings and effectively kill my startup. AWS was kind enough to write off most of it. We now use Lambda only for simple cron / background tasks, or consuming from Kinesis. We use ECS for everything else. ECS is nice because it's relatively simple comp…

Thank your for ECS suggestion. I am definitely considering it, but struggling to choose between ECS, Elastic Beanstalk or EC2. My past experience with ECS was a bit frustrating because I was forced to use CodeCommit to deploy and I didn't liked that. I would prefer to deploy directly from CI, for example from GitHub actions.

ECS runs on EC2. You basically register available servers and ECS automatically puts containers onto the instances where space is available.

We have it setup with Github actions to automatically deploy to ECS as well.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#179

Post by peterangular »

itsmemattchung wrote: post #142
sirwitti wrote: post #74

I'm very much on the boring technology side of things with respect to hosting. 40€ / month gets you a very powerful dedicated server that can easily handle millions of requests per day and performs incredibly well and can be managed easily. If you also use containers you even get quite a bit of flexibility and agility. To be honest I don't really understand the sentiment that developers can get away with not knowing…

Amen. I've consulted for companies that went all in on AWS Lambda + AWS SQS, only to transition them to an EC2 instance that performs the same computations at a fraction of the cost. No — you do not need K8 on day one.

> EC2 instance that performs the same computations at a fraction of the cost

And typically with much lower latency/request times.

GCP functions, AWS Lambdas, etc... my anecdotal experience is that they are way slower for request times vs a $20 VPS running the exact same workload.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#180

Post by Mo3 »

iforgotpassword wrote: post #168
Mo3 wrote: post #119

Earlier quoted context omitted.

I don’t know about that, the hedge fund I work for is US-based and AWS can be fully SEC and FINRA compliant. We also have a few dedicated servers, but mostly only for infrequently accessed data and logging that doesn’t need to be highly available. I really can’t understand why this argument keeps coming up. Different solutions for different usecases. Yet anytime Kubernetes or cloud functions are discussed people come…

Nobody says there isn't any use case for AWS. The point is that "the cool kids" like to start their side projects on AWS. Nothing about it is mission critical. I guarantee you op is not working on some Fintech stuff.

How's that bad? Isn't this how we all learned? By playing with cool modern technology?
Post reply on HN