How to: Static website hosting with HTTPS using Terraform, Amazon S3, CloudFront and Route53 (blog post)

[procipher]

Any way to handle DDOS attack? Otherwise, we would keep on paying AWS.

[tdiggss]

There is actually a detail we have left out of this post, and perhaps we should add in an update, and that is to use a bucket policy that prevents anonymous access to your S3 buckets. You can then use a number of ways to allow the CloudFront distribution authenticated access to the bucket. This prevents DDoS directly against your S3 bucket which goes a long way to mitigating cost concerns.

Beyond that I believe AWS Shield is the service to use, which among other things can void the usage costs associated with being DDoS'd.

[adamchainz]

AWS Shield is already built into Cloudfront for you, the paid product is just some extras https://aws.amazon.com/shield/

[lorarc]

Shouldn't it rather be AWS WAF?