You don't mean literally distributed denial of service attack, right? It's super easy to keep serving a static resource, so I think you'd need a huge amount of traffic to put a dent in Firebase's static hosting capacity.

I've had spikes of up to 300k visitors to my Firebase blog in a month, and the bill was like $150. It seems hard to get bitten by huge surprise costs from a blog on Firebase static hosting, even if someone's using a botnet to try to drive up your bill.

Edit: Thinking about it a little more, I guess you could find the largest resource on a blog and direct your botnet to download it nonstop repeatedly, and that would be orders of magnitude more expensive than even large organic traffic.

That is... $150 you definitely didn't have to spend.

> so I think you'd need a huge amount of traffic to put a dent in Firebase's static hosting capacity.

No, I was referring to your bill, when your resource usage spikes (really spikes, as in sustained Gbps+ traffic spikes). Many people were taken aback by the unexpected bills.

You can, it's just very convoluted.

You can set up billing alarms and use alarms as triggers for actions.

One of those stories that get posted every other month about "How I racked up $xx000 bill for Firebase" explained that they had billing alarms but they weren't exactly real time.

Also, you might be the main/only site administrator, in which case falling asleep might end up badly for you.