I feel like Brian Krebs is a public good at this point. Would love to see Google foster a better web by hosting him!

They should, and get agreements with CDN's / ISP's to forego charges in case of a DDOS. If anyone could pioneer such an agreement, it would be Google.

You want them to push the idea that isp and other middle men networks should not be dumb pipes, but charge a different pricing depending on traffic type and intent?

Your comment may have the best of intentions, but that's how you take net neutrality out the window.

New way to get on google for free: make an AMP site. Until they start charging for that at least.

Considering they charge per GB data transfer, even if your site survive the attack you'll get an amazingly expensive bill at the end of the month.

For both Google and Amazon the cheapest transfer you can have is 0.02 USD/GB, which in case of such attach gives 5.5k USD / hour, or 400k USD for three days of the attack.

That's for outgoing (egress) transfer. Incoming (ingress) transfer is free with both Google and Amazon, and a DDoS attack is mostly incoming.

Amazon's actual ELB IPs can handle relatively little traffic, "prewarming" is required in order to add more ELB instances--during a DDOS attack, you'll be overwhelmed almost instantly. Route 53 uses DNS round robin, which is trivial to bypass if you're planning on a DDOS attack (by targeting a specific IP). Google actually gives you an anycast IP, so they're a better option.

All that being said: the idea that only ingress traffic matters during a DDOS attack isn't quite right. If the connections are legitimate, you either need to be able to detect the attack attempts (requires expensive coordination and mitigation techniques, especially if the attack is much larger than what a single NIC can handle) or actually serve back the content (which will make your egress skyrocket).

You just have to make sure your infrastructure doesn't try to auto-scale up to actually handle all the traffic or suddenly you have thousands of high-powered instances to pay for...

There could be something like a DDoS insurance.

Insurance only works when you can get good coverage (lots of premiums being paid). Akamai and CloudFlare are DDoS insurance, and BK just got dropped.

You don't see insurance companies rushing in after a disaster, this is no different.

The enterprise doesn't care. It'd take a hellluva an event to get marketing behind such a stunt: