# Cost-Based Attack Control Checklist (July 2026)

## Edge

- [ ] CloudFront + WAF (COUNT→BLOCK); rate rules on login/OTP/expensive routes
- [ ] Bot Control scoped (model CAPTCHA/Challenge cost)
- [ ] Origin not publicly reachable without CloudFront (or second WAF on ALB)

## Compute ceilings

- [ ] Lambda reserved concurrency on public/async paths
- [ ] ASG / ECS max capacity set
- [ ] No naked Lambda Function URLs without CloudFront+WAF

## Money backstops

- [ ] AWS Budgets + Budget Actions (alert → tighten → nuclear)
- [ ] Cost Anomaly Detection / FinOps Agent wired to on-call
- [ ] SNS SMS monthly spend limit if OTP exists

## IAM

- [ ] No public `sqs:SendMessage` / `s3:PutObject` on sensitive buckets