Ok, so I'm using AWS and with a serverless architecture, it's very practical since AWS Lambda will run functions as microsservices and I don't have to deal with servers.
Not only that, but it's also auto-scalable, and they charge in this 'pay-as-you-go' format. Everything seems good, but...
Well, thinking in terms of security and possible attacks, I can imagine one type of attack where it's not necessarily a DDoS, but an attacker would just repetitively request data from my servers from multiple clients spread throughout a month (so it won't trigger API rate limits), so that my costs will increase drastically (because of pay-as-you-go + auto scaling) and essentially leaving me with a $10.000 bill at the end of the month.
I understand the term "cost attack" probably doesn't exist yet, but it can become more common as services move to serverless environments (AWS, Google Cloud, Azure, etc.)
Ideas on how to deal with it or prevent it?