Home / server / Questions / 365922
Accepted
Jonathan Rioux
Asked: 2012-03-03 20:14:36 +0800 CST

CloudFront - Users requests static files non-stop to make your bill high?

  • 772

I had this weird wondering once.

If I am using CloudFront as my CDN, I pay per requests made on my static files.

enter image description here

So here comes the wondering. Can one keep requesting the same file in a non-stop fashion (with a script or something), in order to make your bill high? It seems to me to be a pretty fair question, isn't it?

http amazon-s3 amazon-cloudfront cdn

3 Answers

  1. Best Answer

    Sure -- it's called "Economic Denial of Sustainability". Not a huge amount you can do about it. Don't expect any CDN provider that bills by the byte to aggressively deploy any countermeasures, either, because it's in their interest to serve (and bill you for) as much traffic as possible.

    • 10

  2. The answer is a bit dated. In 2017, CloudFront does offer DOS protections through AWS Shield. The Standard tier is offered free to all AWS customers, including CloudFront. For additional features, you can move up to AWS Shield Advanced. From the docs:

    AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards web applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced.

    All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications.

    For higher levels of protection against attacks targeting your web applications running on Elastic Load Balancing (ELB), Amazon CloudFront, and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the common network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your ELB, CloudFront or Route 53 charges.

    AWS Shield Advanced is available globally on all Amazon CloudFront and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon EC2, Elastic Load Balancing, or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on Elastic Load Balancing in the following AWS Regions - Northern Virginia, Oregon, Ireland, and Tokyo.

    There are also individual network policies available for CloudFront if you like to do things by hand as well.

    • 2

  3. Take a look at CloudFlare -- I think it wouldn't be an issue with their CDN in place.

    • 0