Running a few k3s clusters on bare metal at the edge, exposing some HTTP APIs. My ingress-nginx nodes can handle about 10 Gbps before they start sweating. Looking at managed protection.
Cloudflare's magic is in the proxy model—traffic gets scrubbed at their edge before it hits my origin. With Spectrum for non-HTTP/S, maybe. But AWS Shield Advanced integrates with my existing AWS WAF and Route 53, plus I'm already in a VPC with Direct Connect.
For a scenario where the attack surface is purely these 10 Gbps of HTTP/HTTPS traffic, which one actually makes more sense operationally?
I care about:
* Real cost during an attack (not just the sticker price)
* Integration complexity with a K8s GitOps pipeline
* False positive rate messing with real user traffic
My gut says Cloudflare for simplicity, but the AWS integration is tempting. Anyone been through a real attack with both?
yaml all the things
I run RevOps for a mid-market SaaS that does about 8M monthly API calls, with our main customer-facing app hosted on AWS but our internal tools on bare metal k8s like you. I've had to scope DDoS protection for both environments.
Here's my direct comparison for your 10 Gbps HTTP/S scenario:
1. **Real Attack Cost**: Cloudflare's Pro/Business plans have a fixed monthly fee. During an attack, your bill doesn't change. AWS Shield Advanced has a $3k/month base plus data transfer out (DTO) charges from the AWS edge to your origin, which can spike massively during an attack. For 10 Gbps sustained, that DTO could add thousands per hour.
2. **GitOps Integration Complexity**: Cloudflare requires managing DNS records and proxy states via Terraform or their API, which is straightforward but adds another vendor config layer. AWS Shield Advanced integrates directly with AWS WAFv2, which you can manage via Terraform Helm provider for your ingress-nginx annotations, keeping everything inside your existing AWS/GitOps loop.
3. **False Positive & User Impact**: Cloudflare's managed rulesets are aggressive. I've seen them block legitimate geo-traffic patterns during high-volume periods, requiring manual adjustment of security levels. AWS Shield Advanced, when paired with AWS WAF and your own custom rate-based rules, gives finer-grained control. You can tune rules per ingress controller and scope them to specific paths.
4. **Operational Overhead During an Attack**: With Cloudflare, attacks are often mitigated before your team gets an alert. Their SOC handles it. With AWS Shield Advanced, you get the DRT (DDoS Response Team) support, but in my experience, you're still the one analyzing CloudWatch metrics and potentially adjusting WAF rules while on the call with them.
I'd pick Cloudflare for your setup. The cost predictability and truly hands-off mitigation for HTTP/S traffic outweigh the AWS integration benefit. If your attack surface included non-HTTP services or you were already spending $15k+/month on AWS data transfer, I'd lean AWS. To be sure, tell us your current monthly AWS DTO bill and if any of those APIs are latency-sensitive below 50ms.