“My site wouldn’t have gone down if I was still using that setup.”
Somebody aimed about 34 million requests over 72 hours at one blog’s front page. Organic traffic for the viral post was 130,000 hits. The attack cost him nothing because Hetzner doesn’t bill for bandwidth and Cloudflare doesn’t bill for DDoS. The surprise is that Cloudflare doesn’t cache HTML by default, so the S3 setup he’d abandoned would have stayed up and sent him a huge AWS bill instead.