Elastic protection bandwidth is the maximum DDoS attack mitigation capacity of an Anti-DDoS Pro or Anti-DDoS Premium instance. When peak inbound traffic exceeds your basic protection bandwidth but stays within the elastic protection bandwidth, elastic protection activates and you're charged based on how much traffic it absorbs. This document explains when charges apply, how the daily fee is calculated, and how to configure elastic protection.
Supported instance types
Elastic protection bandwidth is available for Anti-DDoS Pro (Chinese Mainland): Professional Edition.
Elastic protection bandwidth must be greater than basic protection bandwidth. Setting them equal disables elastic protection and incurs no pay-as-you-go charges.
Billing conditions
You're charged for elastic protection only when the peak inbound traffic of your public IP assets exceeds the basic protection bandwidth but stays within the elastic protection bandwidth.960USD 960
Two situations do not trigger a charge:
Peak traffic ≤ basic protection bandwidth: Elastic protection is not activated, so no fee is incurred.
Peak traffic > elastic protection bandwidth: The attacked asset's IP address enters blackhole filtering because the instance cannot mitigate the attack. Elastic protection is not activated, so no fee is incurred. For details, see Alibaba Cloud blackhole filtering policy.
How fees are calculated
The daily fee is determined by the highest peak inbound traffic that triggered elastic protection during that calendar day, regardless of how many attacks occurred. Subtract the basic protection bandwidth from that value to get the billable amount, then look up the applicable tier in the table below.
Billing tiers (USD/day)
| Peak inbound traffic − basic protection bandwidth | Fee |
|---|---|
| (0 Gbps, 5 Gbps] | $120 |
| (5 Gbps, 10 Gbps] | $180 |
| (10 Gbps, 20 Gbps] | $330 |
| (20 Gbps, 30 Gbps] | $540 |
| (30 Gbps, 40 Gbps] | $730 |
| (40 Gbps, 50 Gbps] | $960 |
| (50 Gbps, 60 Gbps] | $1,170 |
| (60 Gbps, 70 Gbps] | $1,380 |
| (70 Gbps, 80 Gbps] | $1,590 |
| (80 Gbps, 100 Gbps] | $1,770 |
| (100 Gbps, 150 Gbps] | $2,190 |
| (150 Gbps, 200 Gbps] | $3,240 |
| (200 Gbps, 300 Gbps] | $4,200 |
| (300 Gbps, 400 Gbps] | $6,000 |
| (400 Gbps, 500 Gbps] | $7,510 |
| (500 Gbps, 600 Gbps] | $9,010 |
| (600 Gbps, 700 Gbps] | $10,510 |
| (700 Gbps, 800 Gbps] | $12,010 |
| (800 Gbps, 900 Gbps] | $13,510 |
| (900 Gbps, 1000 Gbps] | $15,010 |
| (1000 Gbps, 1100 Gbps] | $16,510 |
| (1100 Gbps, 1200 Gbps] | $18,010 |
| (1200 Gbps, 1300 Gbps] | $19,510 |
| (1300 Gbps, 1400 Gbps] | $21,010 |
| (1400 Gbps, 2000 Gbps] | $22,520 |
Billing cycle
Elastic protection is billed on a pay-as-you-go basis with daily billing. Bills are generated between 08:00 and 09:00 the following day.
Billing example
Setup: An Anti-DDoS Pro or Anti-DDoS Premium instance with a basic protection bandwidth of 30 Gbps and an elastic protection bandwidth of 100 Gbps experiences four DDoS attacks in a single day with peak inbound traffic of 20 Gbps, 80 Gbps, 40 Gbps, and 120 Gbps.
| Attack | Peak traffic | Result |
|---|---|---|
| Attack 1 | 20 Gbps | Below the 30 Gbps basic bandwidth — elastic protection not triggered, no charge |
| Attack 2 | 80 Gbps | Between 30 Gbps and 100 Gbps — elastic protection triggered, charge applies |
| Attack 3 | 40 Gbps | Between 30 Gbps and 100 Gbps — elastic protection triggered, charge applies |
| Attack 4 | 120 Gbps | Exceeds the 100 Gbps elastic bandwidth — IP enters blackhole filtering, no charge |
Fee calculation: The highest peak that triggered elastic protection is 80 Gbps. Subtract the basic protection bandwidth: 80 − 30 = 50 Gbps. This falls in the (40 Gbps, 50 Gbps] tier, so the daily fee is $960.
Enable elastic protection bandwidth
When purchasing an instance
On the Anti-DDoS Proxy purchase page, set the elastic protection bandwidth to a value greater than the basic protection bandwidth.
After purchasing an instance
Log on to the Instances page in the Anti-DDoS Proxy console.
In the Protection Bandwidth: section, set the elastic protection bandwidth to a value greater than the basic protection bandwidth.
