oof yeah...denial-of-wallet is still alive and well on AWS.
AFAIK there's nothing cheap/free you can do within AWS really. And I mean it kind of makes sense. It's still legitimate traffic hitting their CDN and producing load. If it were actual DoS traffic, there'd be safeguards, but since this looks like legitimate traffic those won't trigger.
A weird workaround that would require stacking cloud service providers could go like this:
- Put the content your CDN serves behind a random release tag, eg. /img/fa34cb1/...
- Get Cloudflare free tier WAF (you get 5 free WAF rules)
- make that rule drop/deny anything that matches
not starts_with(
http.request.uri.path,
"/img/fa34cb1"
)
- proxy everything else to CloudFront
- make CloudFront only reachable from Cloudflare
For Cloudflare Free tier your authoritative DNS will have to move to Cloudflare though
wall-e
npub1xn…msnn2
2026-10-19 05:11:32 UTC
in reply to nevent1q…zf5e
Author Public Key
npub1xnutzx0g8gkqtyjtq05fm24k26kj3cmpryejzrpesa8efn4wz72s0msnn2Published at
2026-10-19 05:11:32 UTCEvent JSON
{
"id": "fe44fdb8b7f779f33de2bed3428d36d1151a8974a9d94a1561f53b1774cef938",
"pubkey": "34f8b119e83a2c05924b03e89daab656ad28e3611933210c39874f94ceae1795",
"created_at": 1792386692,
"kind": 1,
"tags": [
[
"e",
"cd8fdbc1bfb03a5308053ba54565c3f8912354e3b1c8d69d290f54b25f0005a1",
"",
"root",
"8e10c71d95b93c41fb37c3ef057b75c43bf22965355da78642065f84df3065d2"
],
[
"p",
"8e10c71d95b93c41fb37c3ef057b75c43bf22965355da78642065f84df3065d2"
],
[
"proxy",
"https://ioc.exchange/@wall_e/117465854271862886",
"web"
],
[
"proxy",
"https://ioc.exchange/users/wall_e/statuses/117465854271862886",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://ioc.exchange/users/wall_e/statuses/117465854271862886",
"pink.momostr"
],
[
"-"
]
],
"content": "oof yeah...denial-of-wallet is still alive and well on AWS.\n\nAFAIK there's nothing cheap/free you can do within AWS really. And I mean it kind of makes sense. It's still legitimate traffic hitting their CDN and producing load. If it were actual DoS traffic, there'd be safeguards, but since this looks like legitimate traffic those won't trigger.\n\nA weird workaround that would require stacking cloud service providers could go like this:\n\n- Put the content your CDN serves behind a random release tag, eg. /img/fa34cb1/... \n- Get Cloudflare free tier WAF (you get 5 free WAF rules)\n- make that rule drop/deny anything that matches\nnot starts_with(\n http.request.uri.path,\n \"/img/fa34cb1\"\n)\n- proxy everything else to CloudFront\n- make CloudFront only reachable from Cloudflare \n\nFor Cloudflare Free tier your authoritative DNS will have to move to Cloudflare though",
"sig": "6db69b134d91c34909d84692acbf6a99d7ac8287f8691e289482613809852ca4e0a946d4c55af9b13c711ddb7e7f6c544ee71f794675cd603fefc376a6cecbac"
}