Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How an empty S3 bucket can make your AWS bill explode

medium.com

Post reply on HN
Print view View original

31–40 of 118 posts

Re: How an empty S3 bucket can make your AWS bill explode

#31

Post by kolanos »

robertlagrant wrote: post #14
kolanos wrote: post #11

Earlier quoted context omitted.

Or at the very least the requester should b charged for the failed auth.

How is that possible? AWS can't bill anyone on the planet.

This is an unauthorized S3 API request. If there is a valid access id and secret attached, bill them for the request.

Re: How an empty S3 bucket can make your AWS bill explode

#33

Post by dvfjsdhgfv »

tazu wrote: post #2

I don't use S3, but it's kind of insane that unauthorized requests contribute to your bill... couldn't a bored/malicious actor with a botnet just spam common bucket names?

That's why, even though during the day I work on AWS for people who pay me to do so, in the evening I work on my startups hosted on Hetzner where I know in advance what my bill will be not only this month but also this year.

Re: How an empty S3 bucket can make your AWS bill explode

#34

Post by cjk2 »

notnmeyer wrote: post #29
cjk2 wrote: post #23

Ok I'm actually going to delete my web site and cloudfront distribution over this. It gets no traffic (at the moment). The bucket is the same name as the domain so I can imagine this could be exploited quietly very easily as PUTs are so expensive. Literally a $5 VPS could cost someone $1k.

i doubt it. i would imagine any single ip address would get rate-limited/throttle before doing much. the situation the article is describing is much more like a botnet — there were hundreds or thousands (or more?) of unique instances making requests.

I very run big buckets in production that have single addresses hammering them hard all day every day. I've never seen any restrictions or throttling.

Re: How an empty S3 bucket can make your AWS bill explode

#36

Post by dvfjsdhgfv »

notnmeyer wrote: post #29
cjk2 wrote: post #23

Ok I'm actually going to delete my web site and cloudfront distribution over this. It gets no traffic (at the moment). The bucket is the same name as the domain so I can imagine this could be exploited quietly very easily as PUTs are so expensive. Literally a $5 VPS could cost someone $1k.

i doubt it. i would imagine any single ip address would get rate-limited/throttle before doing much. the situation the article is describing is much more like a botnet — there were hundreds or thousands (or more?) of unique instances making requests.

> i would imagine any single ip address would get rate-limited/throttle before doing much

Yes, you would imagine, because without relevant WAF rules in place there would be no throttling.

Re: How an empty S3 bucket can make your AWS bill explode

#39

Post by belter »

tazu wrote: post #2

I don't use S3, but it's kind of insane that unauthorized requests contribute to your bill... couldn't a bored/malicious actor with a botnet just spam common bucket names?

First of all, I agree this is all bananas:-) but it seems is the same with GCP and Azure. For Backblaze B2 it seems its unclear in the documentation. Willing to be corrected on this....
Post reply on HN