What the DDoS Attack on Bitbucket.org really means for the Amazon Cloud

Well, I guess it was inevitable - a successful DDoS attack on a moderately popular service hosted in the Amazon cloud. Blog posts from Jasper detailing the attack are here.

For starters, Amazon tried to hush it over, although the different outages amounted to more than a few hours, with the excuse that disclosure would enable more effective attacks (and hence the corporate idiocy tag). The hubris of the Amazon team being significant, I never thought they'd stoop to a level like that of effectively not listening to their customer, or telling them not to explain something so plainly obvious.

There are some issues here that address some of the more fundamental aspects of cloud computing generally glossed over as scenarios like this "will never happen":

1. That users will be able to scale their EC2 (or other) virtual machines quickly enough to absorb these attacks.
2. More fundamentally, that users will be able to afford to scale their systems up. Remember that pay-as-you-go for CPU time and bandwidth? Guess what a DDoS attack attacks? There are significant financial ramifications for attacks of this type given the billing model of the Amazon cloud.
3. Transparency - the Amazon statement aside, the DDoS attack manifested itself as an issue with the storage system. This leaves one to wonder how they really run their wiring over there, and how much transparency is appropriate for a hosted service.
4. Which brings one to the Achilles' heel of Cloud systems: network I/O. Cloud systems are dependent on network I/O especially when it comes to the Amazon system, and coupled with a shared I/O infrastructure there are potential issues, including this one that can prop up. If Amazon's people aren't coming clean with that, that makes it all the much worse.
   

One of the key things to understand here is that for all the wonderful technology and ideas the cloud computing model embraces, transparency is not one of them. As one outsources one's understanding to an ever increasing degree, the questions remain:

How much can you trust a vendor?

How much due diligence should you do?

And vendors, how much should you tell your customers about how the internal plumbing of your systems really works?