Last I used AWS Shield years ago, you had to open up a support ticket to tell them about your DDoS to get a refund every time. Is that still true?