This is also one of the things I fear most when running a service in the cloud: A huge bill due to excessive network usage triggered for example by a search engine, web scraper etc. I consider it very unfortunate that "capped cost" has gone somewhat out of fashion, and nowadays many major cloud providers bill excess usage rather than cutting off or slowing down traffic etc.

Here is a simple Bash script that monitors outgoing eth0 traffic (once per second) and automatically shuts down the instance once it is greater than 1 TB:

    #!/bin/bash

    # shut down instance if outgoing traffic > 1 TB

    # 1 MB
    limit=$((10**6))

    # 10 MB
    limit=$((10**7))

    # 1 GB
    limit=$((10**9))

    # 1 TB
    limit=$((10**12))

    while true
    do
        date
        tx=$(< /sys/class/net/eth0/statistics/tx_bytes)
        echo "$tx (limit: $limit)"
        if (( tx > limit ))
        then
            echo cutting
            systemctl poweroff
        fi
        sleep 1
    done

If you save it as cutnetwork.sh in /home/admin/cutnetwork.sh, you can run it as a systemd service:

    [Unit]
    Description=Cut Network

    [Service]
    UMask=022
    Environment=LANG=en_US.utf8
    Restart=on-abort
    StartLimitInterval=60
    StartLimitBurst=5
    WorkingDirectory=/home/admin
    ExecStart=bash cutnetwork.sh

    [Install]
    WantedBy=multi-user.target

This simplistic approach may require adjustments depending on network settings and operating environment, and will not work for example if the instance is rebooted during the billing period, since that resets the counter. I would much prefer a hard-coded setting that reliable works on the instance itself, or a reliable hard billing limit that reliably turns off the service if the accumulated cost exceeds the set amount.

Thanks for sharing this.

You can mitigate that, for enterprise projects, using AWS Shield Advanced as it comes with DDoS cost protection:

https://aws.amazon.com/shield/features/

I say for enterprise projects because although it's cost is reasonable for corporate projects, not probably something you can justify for most personal/private deployments.

Not if you're doing simple and sensible things like using Cloud Front, and setting limits with API Gateway.

What if you're using something like grpc?