Attention brings traffic you did not want: credential stuffing, fake sign-ups, SMS fraud billed per message, scripts draining your AI budget, the occasional flood. What AWS and Cloudflare protect by default, what AWS WAF costs, and the limits we would add before the launch post.
The first abuse most apps see is not dramatic. It is someone creating thousands of accounts for the free tier, a script calling your AI endpoint in a loop, or a bot requesting SMS codes to premium-rate numbers. Each one costs money directly.
AWS Shield Standard protects every AWS customer at no extra charge against the most common network and transport layer (3 and 4) DDoS attacks, with the most benefit on Route 53, CloudFront and Global Accelerator.
Cloudflare provides unmetered DDoS protection at layers 3, 4 and 7 on all plans, including Free.
Neither stops traffic that looks like normal use, such as a bot signing up or calling your API at a modest rate. That needs rules you write.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
AWS WAF is $5 a month per web ACL, $1 per rule and $0.60 per million requests. Bot Control adds $10 a month, with the first 10 million requests free at the common level and $1 per million after. CAPTCHA is $0.40 per thousand attempts. Account takeover and account creation fraud prevention are $10 a month each plus per-request fees. CloudFront's flat-rate plans include WAF in a fixed monthly price.
AWS End User Messaging's SMS protect can filter messages it scores as artificially inflated traffic, or run in monitor mode first to show what it would block. It costs $0.01 per message on top of SMS fees, and blocked messages are not charged SMS fees. AWS calls country blocking the simplest defence, and it is: most apps serve a handful of countries.
Put a rate-based rule in front of sign-up, sign-in, password reset and every endpoint that spends money.
Give each AI feature a per-user quota and a global daily cap that alerts someone when it trips.
Set billing alerts in AWS Budgets and with every other provider, at amounts that would surprise you.
Turn off SMS to countries you do not serve.
Log enough (IP, user, route, outcome) to reconstruct an attack afterwards.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Rate Limiting: Token Buckets, Per-User Limits and Answering With 429
Rate limits protect your service from abuse, your bill from runaway clients, and your users from each other. The algorithms (fixed window, sliding window, token bucket), where to enforce limits (edge, gateway, application), what to key them on, and how to tell clients to back off properly.
Read
AWS WAF or Cloudflare vs Filtering Bad Traffic in Your Code: What a Bot Flood Costs on Serverless
One post gets shared, the bots arrive, and every request runs your code: API Gateway charges for it, Lambda bills the time, and the whole Region shares 1,000 concurrent executions. Worked numbers for a six-hour flood with no firewall, with filtering in code, and with AWS WAF or Cloudflare in front, and why the third is about availability more than money.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.