The AWS S3 Denial of Wallet Amplification Attack
blog.limbus-medtec.com
The AWS S3 Denial of Wallet Amplification Attack
1–10 of 97 posts
Re: The AWS S3 Denial of Wallet Amplification Attack
#2> Potential remedies
- Stop using S3 and other AWS (perhaps it stands for Amazon Web Scams?) things already and switch to Cloudflare R2...
Re: The AWS S3 Denial of Wallet Amplification Attack
#3The way billing is calculated should be clearly labeled along with the pricing. Azure does this too, it's super unclear what metric they're using to determine what will be billed for requests. We're having to find out via trial and error. If we request 0-2GB on a 6GB file, but the client cancels after 400MB. Are we paying 2GB or 400MB or 6GB?
Is there a billed difference between Range: 0-, no "Range" header, and Range: 0-1GB if the client downloads 400MB in each scenario?
Re: The AWS S3 Denial of Wallet Amplification Attack
#4"Thank you to everyone who brought this article to our attention. We agree that customers should not have to pay for unauthorized requests that they did not initiate. We’ll have more to share on exactly how we’ll help prevent these charges shortly." — Jeff Barr, Chief Evangelist, Amazon Web Services
Re: The AWS S3 Denial of Wallet Amplification Attack
#5"With range requests, the client can request to retrieve a part of a file, but not the entire file. ... Due to the way AWS calculates egress costs the transfer of the entire file is billed." WTF if true.
Re: The AWS S3 Denial of Wallet Amplification Attack
#6Re: The AWS S3 Denial of Wallet Amplification Attack
#7"Thank you to everyone who brought this article to our attention. We agree that customers should not have to pay for unauthorized requests that they did not initiate. We’ll have more to share on exactly how we’ll help prevent these charges shortly." — Jeff Barr, Chief Evangelist, Amazon Web Services https://twitter.com/jeffbarr/status/1785386554372042890
Note that there are two separate issues being discussed.
Re: The AWS S3 Denial of Wallet Amplification Attack
#8"Thank you to everyone who brought this article to our attention. We agree that customers should not have to pay for unauthorized requests that they did not initiate. We’ll have more to share on exactly how we’ll help prevent these charges shortly." — Jeff Barr, Chief Evangelist, Amazon Web Services https://twitter.com/jeffbarr/status/1785386554372042890
Don't think that's the same problem - that's about the failed puts still costing a dev money [0](272 points, 2 days ago, 99 comments).
Re: The AWS S3 Denial of Wallet Amplification Attack
#9"With range requests, the client can request to retrieve a part of a file, but not the entire file. ... Due to the way AWS calculates egress costs the transfer of the entire file is billed." WTF if true.
That sounds egregious enough that I have trouble believing this can be correct. My understanding is that AWS bills for egress for every service, parts of the file that aren't transferred are not part of this so can't be billed. There could certainly be S3-specific charges that affect cases like this, no idea. But if AWS bills the full egress traffic costs for a range request I'd consider that essentially fraud.
Re: The AWS S3 Denial of Wallet Amplification Attack
#10"With range requests, the client can request to retrieve a part of a file, but not the entire file. ... Due to the way AWS calculates egress costs the transfer of the entire file is billed." WTF if true.
That sounds egregious enough that I have trouble believing this can be correct. My understanding is that AWS bills for egress for every service, parts of the file that aren't transferred are not part of this so can't be billed. There could certainly be S3-specific charges that affect cases like this, no idea. But if AWS bills the full egress traffic costs for a range request I'd consider that essentially fraud.