AWS Shield Advanced though...so what does this mean if you are on Standard? One of the biggest fears is launching an EC2 instance (or some other service) only to get hit at some random point in time with a DDoS attack and a large bill at the end of the month. I've read stories of AWS forgiving events like this, but are you now up a creek if you don't subscribe to their "Advanced" tier?

Precisely. The majority of people who are be afraid of using AWS services for the risk of a bill shock due to a DDoS would be small customers who won't be able to afford the 3,000$ per month price tag for the advanced shield anyways. For them, it's still risky to use AWS.

Unless you're spending $xx,xxx or above monthly with AWS, you're probably better off using Cloudflare for DDOS protection.

EDIT: Number is professional opinion from my experience running large AWS accounts over the last 10 years.

I hear this all the time, people being surprised by an $80k bill when they're used to $5k. Step one of using any of these services, whether it's AWS, GCP, Azure, etc. ENABLE BILLING ALERTS. You can be notified as soon as you're being charged x%, or $x over last months bill, or set your own amounts and hop on and investigate what's going on. Please set this up. If you don't have this on right now, stop what you're doing and turn it on.

This is the first thing that I do any time I'm involved with a new infrastructure.

Not really. Now your $1K DDOS bill is a $1K AWS credit. Hardly any better.

AWS desperately needs a way to turn off pay-by-use services through billing alerts. I don't believe this is possible right now.

You appear to be assuming that the credit applies after they charge your card, which is not what it reads as to me. The process sounds like "$1k line item for traffic -> $1k credit -> $0 charged to card".

Additionally: you can totally set up CloudWatch Alarms for billing events, it's one of the categories they provide out-of-the-box, and alarms can trigger notifications, lambdas, SQS, etc. So you can totally wire alarm -> lambda and have lambda spin down the thing costing you the money.

Right, I see how I could have been wrong about that assumption. I assumed it would be after-the-fact credits.

And doing it through Lambda is possible, but the friction there almost feels deliberate. They should make it a first-class option you don't need to wire together yourself.

They should make it a first class option - to spend less money with them?

AWS is the ultimate "wire it together yourself" tool. If that's _not_ what you're after, there are many other vendors eager to take your money.

This is really just apologizing for bad UX. Bad UX in the best case, dark pattern in the worst case.

I don't think so - from my perspective it's more like a misunderstanding on some people's part of what AWS is.

It's a practically unlimited scale-to-the-moon platform that allows you to provision hundreds or thousands of virtualised bits of internet infrastructure in seconds or minutes - and automate it all.

All their "light pattern" UX is laser focused on allowing you to instantly provision all the capacity you ask for.

If you expect a UX oriented to "cost minimisation" or "potential user error protection", AWS is the wrong choice of tool. You can still use it, but what seems to you to be "Bad UX" or "dark patterns" can easily be explained as "you chose the wrong tool" if you view AWS from a different angle (and I'd argue, that angle is the one all AWS's 7 digit per month customers see it from, and hence the way the AWS team builds and prioritises everything)

>Now your $1K DDOS bill is a $1K AWS credit.

Nice!

>Hardly any better.

...what?

Cash is king. Loaning money to Amazon you could be using to pay suppliers or salaries or returning to investors is a cost.

Billing alerts are Cloudwatch alarms, capable of queueing SNS events. You can use those to scale down.