It's even worse nowadays than it used to be, due to "Serverless" and "Infinite Scalability"/"Auto-scaling".

One of the most fascinating things I've read recently is the rise of "Denial-of-Capital" attacks.

Essentially, you DDoS a competitor, but not directly in the interest of just taking them offline.

Instead (hopefully) running up a massive cloud bill and putting them out of business. Or a similarly critical financial hit.

If you don't have billing limits enforced for all of your services, and you run auto-scale/serverless workloads in any part -- if someone can pass enough traffic to your services they can cause you potentially incredible financial grief.

Most recent (publicized) one I can think of is this one. Fathom Analytics attacks:

https://news.ycombinator.com/item?id=25194795

There was an initial cloud bill, but now they're paying $3,000/mo for AWS to have a Cloud Protection team on standby for them.

  "$36,000 & my call with Fola"

    "I don’t know anybody who has signed up for this $3,000/month service from AWS… it’s called AWS Shield Advanced. The big value of this service to us is that we have access to some of the world’s best DDoS mitigation experts. In the event of an attack, we can page them, and they’ll help us mitigate the attack, creating firewall rules, identifying bad actors, and offering advice. So instead of just two of us responding to DDoS attacks, we have genius engineers we can speak with, and that feels good."

Ouch.