Maximum cost of cloud hosting solutions (AWS, Azure, Google Cloud, etc.)

Question

Does someone know of theoretical worst case expenditure when using instances (e.g. EC2) to host some publicly accessible content? I mean instance cost itself can be estimated but what happens in case a malicious entity would start downloading at a rate, order of magnitudes higher than normal (for instance through a botnet). Outbound traffic is billed and cannot be controlled unless specifically implemented by the host - which is rarely the case, let's be honest. I guess at some point DDoS protection and the likes would kick in but that might also take a while.

As I see it no cloud provider supports hard-budget limits (they willingly avoid it, in turn this means that it must cost customers a significant amount) so my question is, has anyone thought about this or even experienced such scenarios? Is there any technical protection from the cloud provider or is this entirely left to the user?

It's kind of odd that in CS we are always talking about worst-case complexity but apparently that doesn't apply to money...

Answer 1

You could use a serverless service (Lambda or Azure functions) as a content delivery system, there you can implement some rate limiting features and a temp ip-ban system, then funnel the whole thing through CloudFlare and its DDoS protection logic, while it seems like a gas factory solution, it at least provides a more white-box approach to the whole CDN service.

Answer 2

I can only speak for AWS - you can use AWS Shield, a Managed DDoS Protection.

It comes in two flavours

• AWS Shield Standard which is enabled by default and is designed to protect other customers when your services are DDoS'ed.

• AWS Shield Advanced is a paid service designed to protect your services from DDoS.

With AWS Shield Advanced customers get AWS WAF and AWS Firewall Manager at no additional cost for usage on resources protected by AWS Shield Advanced. Additionally, you get "DDoS cost protection for scaling", a feature that protects your AWS bill from usage spikes on your AWS Shield Advanced protected EC2, Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 resources as a result of a DDoS attack.

(Highlights are mine)

So with AWS Shield Advanced your usage bill will be capped in case of DDoS.

---

Obviously Shield Advanced comes at a cost and is not worth it for small or hobby deployments. On the other hand these small scale services are not that likely to be targeted by DDoS and if they are the architecture would probably not withstand the load and crash, effectively stopping the DDoS and protecting your bill.

As always it's a trade-off - either you want to keep your services up during DDoS and are ready to pay for it, of you prefer to protect your wallet at the cost of your service going down. You can't have it both ways sadly.

Azure and GCP may have services similar to Shield, I don't know. If they do they will very likely come at a cost too. The general trade-off points are valid regardless of your cloud provider.

Hope that helps :)

Answer 3

From an Azure perspective

You can set budgets and if your cost exceed these limits it can trigger workflows that shut down, scale down, notify you, anything you want really.

In this scenario, a monthly budget of $1000 for the subscription is set. Also, notification thresholds are set to trigger a few orchestrations. This scenario starts with an 80% cost threshold, which will stop all VMs in the resource group Optional. Then, at the 100% cost threshold, all VM instances will be stopped. To configure this scenario, you will complete the following actions by following the steps provided in each section of this tutorial.

https://docs.microsoft.com/en-us/azure/billing/billing-cost-management-budget-scenario

So there are ways to control your costs before they go rampage for any reason.

Answer 4

On Azure

if you're talking about making static content available publicly, you probably want to use Azure CDN. This contains basic DDoS protection free of charge: https://docs.microsoft.com/en-us/azure/cdn/cdn-ddos

If you're talking about dynamically generated content, you could use Application Gateway to have a single point to control access. This service can additionally be protected with Azure DDoS: https://docs.microsoft.com/en-us/azure/virtual-network/ddos-protection-overview

Answer 5

On Google Cloud you can set budgets and budget alerts:

After you've set a budget amount, you set budget alert threshold rules that are used to trigger email notifications. Budget alert emails help you stay informed about how your spend is tracking against your budget. You can also use budgets to automate cost control responses.

whenever you received a budget alert email you can do some actions to prevent spending too much money.

To estimate your future spendings in advance you can use Google Cloud Pricing Calculator.

GCP also offers you WAF Google Cloud Armor:

• Benefit from DDoS protection and WAF at Google scale
• Detect and mitigate attacks against your Cloud Load Balancing workloads
• Mitigate OWASP Top 10 risks and help protect workloads on-premises or in the cloud

In addition, you can analyse your networking with VPC Flow Logs and control your cloud infrastructure with integrated Cloud Monitoring and Cloud Logging.