ApexVideo runs a global streaming platform fronted by Amazon CloudFront with an origin Application Load Balancer. A recent DDoS caused aggressive scaling and elevated egress charges. The CISO wants to minimize financial exposure from future DDoS events without changing the application architecture. What should the security team do to ensure AWS credits for unexpected scaling charges tied to DDoS events?

AWS Shield Advanced provides DDoS cost protection, which offers credits for scaling charges incurred due to DDoS attacks on protected resources. To benefit from this, you must subscribe to Shield Advanced and protect the CloudFront distribution and Application Load Balancer (ALB). During an attack, engaging the DDoS Response Team and opening a billing support case are necessary steps to initiate the credit request process. Enabling AWS WAF rate-based rules helps mitigate attacks but does not automatically refund CloudFront charges; Shield Advanced is required for cost protection. Purchasing Compute Savings Plans reduces general compute costs but doesn't specifically address or credit unexpected DDoS-driven scaling charges. Upgrading to Enterprise Support provides faster access to experts but doesn't automatically waive DDoS-related service charges; Shield Advanced is the service designed for this.