In classic hosting we have a virtual machine with limited resources allocated by hosting provider for running our web application. But with serverless code such as AWS Lambda or Azure Functions, our code is executed by hosting provider (Amazon or Microsoft) itself in response to events. Theoretically speaking, there is no limit for resources that will be allocated to a Lambda function, so doesn't that mean if attacker wanted to take down a serverless app with DDoS he would have to first take down entire AWS/Azure which is just impossible?
There is always something that will break
While, theoretically, serverless systems can scale up your application to very high levels, there is always something that will break. Likely candidates:
- Your database!
- Other internal services
- 3rd party services you call while responding to requests
- Your bank account
Even with a stateless endpoint that doesn't use a database or external services, a large-scale DDoS attack can still run up such a large bill from your cloud provider that you chose to shut off the service until the DDoS attack ends. It's not a new concept. Here's a discussion about it:
Theoretically speaking, there is no limit for resources that will be allocated to a Lambda function ...
There is - it's the budget and the quotas. Lambda functions are not free to execute, so a DDoS causing lots of executions of Lambda functions will eventually exhaust the given quotas and cause throttling - which as a result is a reduction or even denial of service. While one might increase the quotas it will cost, in which case the available budget is a new limit.
In short: all-in-all serverless is not a protection against any kind of attack.
Note that "serverless" doesn’t mean servers are not involved. It only means that you have delegated server management to someone else (Amazon, Microsoft, ...) and they setup their servers for you.
Many things can still happen. Servers can still break, the service provider can stop your account, your contract can be invalidated for some reasons, you can go over your quota, ecc.
The assumption is that the underlying software will move your code to another server automatically and scale it for you. The goal of DDoS attacks is to hurt your business. Given all of that - DDoS on serverless is still a threat. It can cause degraded quality of service (i.e. intermittent errors while underlying software shuffles your code) or can blow up your bills to 1000x of normal usage.
There are always some limits. For example for AWS Lambdas there are limits how many can be executing concurrently (e.g few 1000 concurrent executions) for a single AWS account. With DDoS you could take down a single AWS account, not the whole AWS infra. And, of course, generate a large bill in the process for the account owner.