How can we avoid unexpected cloud bills with our startup?

It's smart to set pricing alerts and keep an eye on your Lambda function usage. To defend against DDoS attacks, consider putting Cloudflare in front of your stack. Also, be wary of infinite loops in your Lambdas—they can drive up costs quickly.

In terms of cost management, I'd recommend launching your MVP on a single EC2 instance and scaling it vertically at first. This way, you can better understand your needs before diving into a more complex setup with services like Lambda.

I'd suggest setting up multiple billing alerts based on your accounts or services. This way, you'll get notified when your costs reach certain thresholds. You can also automate responses like shutting down services or stopping the creation of new instances if spending gets out of hand.

You can use WAF for DDoS protection, but remember, it's important to set a country whitelist to restrict requests from regions where you don't have customers. For instance, if you don’t expect traffic from places like Russia, China, or India, don’t allow requests from those countries.

For a safety net in your experimental phase, consider an automation tool that can help terminate resources based on certain triggers. Look into tools like Cloud Nuke for a structured approach to managing costs effectively.