36

Ok, so I'm using AWS and with a serverless architecture, it's very practical since AWS Lambda will run functions as microsservices and I don't have to deal with servers.

Not only that, but it's also auto-scalable, and they charge in this 'pay-as-you-go' format. Everything seems good, but...

Well, thinking in terms of security and possible attacks, I can imagine one type of attack where it's not necessarily a DDoS, but an attacker would just repetitively request data from my servers from multiple clients spread throughout a month (so it won't trigger API rate limits), so that my costs will increase drastically (because of pay-as-you-go + auto scaling) and essentially leaving me with a $10.000 bill at the end of the month.

I understand the term "cost attack" probably doesn't exist yet, but it can become more common as services move to serverless environments (AWS, Google Cloud, Azure, etc.)

Ideas on how to deal with it or prevent it?

Improve this question
5
  • 5
    I think cost attack is a very good term. Is there a way to distinguish valid and cost attack use? I'd assume it could be very hard.
    – Tero Lahtinen
    Commented Apr 14, 2018 at 18:31
  • 9
    This is not just an issue with server-less architectures, but is an attack model that has existed since the early days of the Internet. The oldest attacks I can think of are when attackers would maliciously drive up bandwidth-bills by repeatedly downloading very large files.
    – Xander
    Commented Apr 14, 2018 at 19:23
  • 1
    I believe the correct term for this is DoW as opposed to the common DoS. The W stands for wallet.
    – Sandy Chapman
    Commented Apr 15, 2018 at 3:13
  • "AWS allows you to set budgets (so your services would shut down instead of getting a $10k bill at the end of the month)," - there's no built-in budget feature of Amazon which results in shutting down services. One can program it manually though.
    – Grzegorz Oledzki
    Commented Apr 15, 2018 at 12:25
  • @Xander It seems we're going full circle
    – sigmaxf
    Commented Jan 3, 2020 at 19:38

1 Answer 1

Reset to default
32

AWS allows you to set budgets, and alarms based on your current rate of spending. Those would be useful to control your spending. In theory, you could also set billing-based automation to start scaling down services to avoid a $10k bill at the end of the month.

AWS Budgets Tutorial

If your spending alarms go off, then you'd take a look and see why your costs are abnormal this month and determine what needs to be done to mitigate the attack. At that time, your actions will depend on what's driving your costs up.

It may be difficult to differentiate whether the costs are legitimate use or an attack. Following standard threat modelling practices will help you to identify parts of your application susceptible to this type of attack. In particular, try to limit the ability of unauthenticated users to access parts of the application that are resource intensive.

Improve this answer
8
  • 4
    "try to limit the ability of unauthenticated users to access parts of the application that are resource intensive" - I like this. Do you know if unauthenticated calls that are denied by the API gateway count as traffic usage?
    – sigmaxf
    Commented Apr 14, 2018 at 19:14
  • I'm not that familiar with the specific service. That advice is more of a general security principle that helps to prevent any kind of Denial of Service attack. A cost attack is still DoS, except in this case the resource they're using up is your bank account. 🤑
    – nbering
    Commented Apr 14, 2018 at 19:16
  • To provide a more specific example, if you're using Lambda, try to exit as quickly as possible if the user is not logged in. Don't even make a database call if it can be avoided.
    – nbering
    Commented Apr 14, 2018 at 19:18
  • 2
    You can actually use AWS cognito to authenticate and check, so you don't even write a custom lambda for auth, I'm just not sure if these calls stack up in the costs. Also, minimally, one would have to serve a login page through S3.
    – sigmaxf
    Commented Apr 14, 2018 at 19:50
  • Isn't it the case that AWS Budgets only allow notifications but don't allow the scenario whereby "your services would shut down instead of getting a 10k bill ..."?
    – Ronald Monson
    Commented Apr 14, 2018 at 23:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .