[mike_hearn]

Sure, probably there are no people mounting such attacks today.

My point was more like - the moment it becomes known that people are doing that sort of thing, they would implement mitigations. Sucks if you're literally the first victim who detects what happened, but that's not many people, especially because this sort of "flood the server with data and measure timing" attacks are so noisy and visible.

[ericpauley]

Unfortunately under the shared responsibility model the cloud provider won’t necessarily take actions in this case because of the precedent it sets.