Ask HN: Is a static site hosted on AWS S3 'hackable'?

Sure, strong credentials can still be leaked due to a simple phishing email to the right person.

There is no such thing as an unhackable system, only more and less difficult to hack systems.

Yes - but probably only for quite small values of yes.

Who's your threat?

Your attacker would need a backdoor or 0day into AWS itself - which while you'd be a fool to assume such a thing doesn't exist, its very unlikely to get "burned" on a run-of-the-mill website hack or defacement.

If your site is ISIS or Wikileaks or DeSpiegel or The Guardian (or some other well known considered-by-the-NSA-to-be-a-terrorist-organisation) - you wouldn't bet against the NSA having firmware backdoors in the network cards and hard drive controllers underneath AWS (as well as the hypervisor and all the available deployed virtualised images, and all the internal Amazon network hardware and the core routers at both ends of Amazon's datacenter's optical fibres).

If your threat model is closer to Anonymous or GamerGate, you're probably more at risk of your "unhackable" credentials being social engineered than a purely software hack.

But in a purely binary interpretation of your question - Yes. _Everything_ is "hackable" given a sufficiently motivated and resourced attacker.

A static website that is served over HTTPS only[1], and lets say for the sake of argument, HTTPS secure enough not to MITM, and no services outside of your control (DNS, etc) are MITMable, and your credentials to Amazon can't be stolen...

The only way to hack your site is to actually be at Amazon with access to whatever disk array stores your data. As in, I'm pretty sure "inside job" is the only route left.

[1]: http://www.troyhunt.com/2015/06/understanding-http-strict-tr...

I believe this comment is the most correct answer.

Anything is theoretically "hackable" given enough time. What we can do is to make things difficult enough to hack that they are not worth the time.

Not through a web application vulnerability it can't (there is no application code to break!).

Your biggest issues with that setup will be:

1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it.

2. Getting that green lock (e.g. HTTPS). You can pay $800/month or something insane to Cloudfront to get a custom TLS cert on their CDN, or you can get Cloudflare's "universal ssl" for $20.

3. DDoS is not really a concern. It would be nearly impossible to DDoS an HTML-only website hosted in an S3 bucket. I'd really like to see someone try. The only thing that could happen is you get charged a bit more that month while people are DDoS'ing you. But if you're behind a CDN like Cloudfront or Cloudflare (which can cache everything because it's plain HTML), then the impact would be reduced.

4. Your Registrar suddenly becomes a huge risk. Make sure you use a secure domain registrar (ie. NOT GODADDY!), that the registrar has a "Registrar-Lock" turned on for your domain, and that your account with them has 2FA. If you screw that up, then someone might be able to socially engineer the phone rep at the registrar to transfer the domain, change the nameservers, etc. This happens depressingly often.

5. 3rd party services you use could get hacked. You'll likely import a bunch of JavaScript from other websites onto your own. If any of those websites get compromised, it might affect your website too. Make sure to use 2FA on every service you can (https://twofactorauth.org/) and minimize the amount of JavaScript/fonts/css/whatever that you load from 3rd parties (re-host it locally).

I highly recommend setting up websites this way. It's fast, easy to maintain, and incredibly secure. We do this for the trailofbits.com website and we're very happy with it. Jekyll FTW.

ps. don't forget you can use Github Pages too.