[mcherm]

Yes, there is a way to protect against that attack!

All you need to do is have triggers in place that will shut down or slow down your service when the costs are exceeding some amount.

(If you get a moment of viral growth, you can always disable the trigger.)

Unfortunately, AWS makes it extremely difficult to build such a trigger, and I'm not sure about other cloud providers.

[mlhpdx]

There’s always rate limiting. Cloudfront supports it, API gateway support it, and it’s super easy to set up.