AWS can actually do a setting for max bandwidth per hour or so & alert early if there is suspicious activity.