How an empty S3 bucket can make your AWS bill explode
1–10 of 118 posts
Re: How an empty S3 bucket can make your AWS bill explode
#2I don't use S3, but it's kind of insane that unauthorized requests contribute to your bill... couldn't a bored/malicious actor with a botnet just spam common bucket names?
Re: How an empty S3 bucket can make your AWS bill explode
#3uf, aws should definitly not count the requests against a bucket that is not configured for public use.
Edit: if they do that, they should make it possible to firewall buckets via ips so that they are only accessible via certain ips
Re: How an empty S3 bucket can make your AWS bill explode
#4I don't use S3, but it's kind of insane that unauthorized requests contribute to your bill... couldn't a bored/malicious actor with a botnet just spam common bucket names?
This is exactly where my mind went. I assume most people, myself included, didn't realize this. This is absolutely going to turn into the economic equivalent of a ddos.
Re: How an empty S3 bucket can make your AWS bill explode
#5A quick answer is to put the bucket behind cloudfront so that the denial is cached, but that's not totally free either.
If they actually charge for unauth'd requests that's absurd
Re: How an empty S3 bucket can make your AWS bill explode
#6There are so many things that can make your AWS bill explode, so it probably should be included into your budget. Like, $1000/mo is not actually $60K in 10 years, but $60K + some random $20K that may or may not be waived by AWS support.
Re: How an empty S3 bucket can make your AWS bill explode
#7A quick answer is to put the bucket behind cloudfront so that the denial is cached, but that's not totally free either. If they actually charge for unauth'd requests that's absurd
> Other than deleting the bucket, there’s nothing you can do to prevent it. You can’t protect your bucket with services like CloudFront or WAF when it’s being accessed directly through the S3 API.
Re: How an empty S3 bucket can make your AWS bill explode
#8A quick answer is to put the bucket behind cloudfront so that the denial is cached, but that's not totally free either. If they actually charge for unauth'd requests that's absurd
You can't protect your bucket with CloudFront if it's being access using S3 api.
Re: How an empty S3 bucket can make your AWS bill explode
#9A quick answer is to put the bucket behind cloudfront so that the denial is cached, but that's not totally free either. If they actually charge for unauth'd requests that's absurd
That doesn't work, the standard endpoint always remains available.
Re: How an empty S3 bucket can make your AWS bill explode
#10Crazy, I wonder what AWS's margin is on these unauthorized requests? Questionable incentives.