Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How an empty S3 bucket can make your AWS bill explode

medium.com

Post reply on HN
Print view View original

21–30 of 118 posts

Re: How an empty S3 bucket can make your AWS bill explode

#21

Post by immibis »

jsheard wrote: post #15
tazu wrote: post #2

I don't use S3, but it's kind of insane that unauthorized requests contribute to your bill... couldn't a bored/malicious actor with a botnet just spam common bucket names?

A bored or malicious actor can also just DDoS your CloudFront endpoint and run up an effectively unlimited bill on your end. That exposure is par for the course with AWS, they don't have a spending hard-stop and at this point they probably never will, you just have to hope that they have mercy and waive the bill if you get a surprise extra few zeroes on the end.

and their bills cost up to 100x what they should (and then other services that run on top of AWS may inflate it 10x again)

Re: How an empty S3 bucket can make your AWS bill explode

#22

Post by immibis »

robertlagrant wrote: post #18

This isn't obviously a scam to me. Cloudflare have guarantees around pricing per request, and I'd expect them to honour it. AWS have different prices. I'd expect them to honour them. The problem is the cloud priorities availability over cost savings. We used to run our own infrastructure, that would just fall over if it got too many requests. This infrastructure never falls over; it just bills more. I don't know the…

The right way is for unauthorized requests to not cost anything.

Re: How an empty S3 bucket can make your AWS bill explode

#23

Post by cjk2 »

Ok I'm actually going to delete my web site and cloudfront distribution over this. It gets no traffic (at the moment).

The bucket is the same name as the domain so I can imagine this could be exploited quietly very easily as PUTs are so expensive.

Literally a $5 VPS could cost someone $1k.

Re: How an empty S3 bucket can make your AWS bill explode

#25

Post by infecto »

skinner927 wrote: post #20
t0mas88 wrote: post #9

Earlier quoted context omitted.

That doesn't work, the standard endpoint always remains available.

I assume random names are the only way forward. Unfortunately a bucket name can’t be longer than 63 characters.

Surprising people are not already doing this. Something that has been beat into me for at least a decade.

Re: How an empty S3 bucket can make your AWS bill explode

#26

Post by robertlagrant »

immibis wrote: post #22
robertlagrant wrote: post #18

This isn't obviously a scam to me. Cloudflare have guarantees around pricing per request, and I'd expect them to honour it. AWS have different prices. I'd expect them to honour them. The problem is the cloud priorities availability over cost savings. We used to run our own infrastructure, that would just fall over if it got too many requests. This infrastructure never falls over; it just bills more. I don't know the…

The right way is for unauthorized requests to not cost anything.

That makes no sense, though. Some network and compute are running for this to happen. Someone needs to pay the bill. It's not obvious it should be the cloud service, if that's not the agreement.

Re: How an empty S3 bucket can make your AWS bill explode

#28

Post by [deleted] »

immibis wrote: post #21
jsheard wrote: post #15

Earlier quoted context omitted.

A bored or malicious actor can also just DDoS your CloudFront endpoint and run up an effectively unlimited bill on your end. That exposure is par for the course with AWS, they don't have a spending hard-stop and at this point they probably never will, you just have to hope that they have mercy and waive the bill if you get a surprise extra few zeroes on the end.

and their bills cost up to 100x what they should (and then other services that run on top of AWS may inflate it 10x again)

[deleted]

Re: How an empty S3 bucket can make your AWS bill explode

#29

Post by notnmeyer »

cjk2 wrote: post #23

Ok I'm actually going to delete my web site and cloudfront distribution over this. It gets no traffic (at the moment). The bucket is the same name as the domain so I can imagine this could be exploited quietly very easily as PUTs are so expensive. Literally a $5 VPS could cost someone $1k.

i doubt it. i would imagine any single ip address would get rate-limited/throttle before doing much. the situation the article is describing is much more like a botnet — there were hundreds or thousands (or more?) of unique instances making requests.

Re: How an empty S3 bucket can make your AWS bill explode

#30

Post by mdasen »

tazu wrote: post #2

I don't use S3, but it's kind of insane that unauthorized requests contribute to your bill... couldn't a bored/malicious actor with a botnet just spam common bucket names?

This kinda happened with Netlify recently (https://www.reddit.com/r/webdev/comments/1b14bty/netlify_jus..., https://news.ycombinator.com/item?id=39520776). They got a bill over $100,000 via spam requests.

Unauthorized requests are a weird thing. They still do cost money for a web service to handle and if you (the customer) have screwed things up that's kinda on you. I've run SaaS where a customer forgot to send their key and their software would just keep retrying requests to the point that they were sending thousands of requests per second with no key. However, it's kinda crappy when it's happening through no fault of your own.

One doesn't even have to make unauthorized requests to run up a bill. One can simply make lots of spam requests to a real file in a bucket - run up the request total and bandwidth at the same time.

Post reply on HN