Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 110 posts

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#101

Post by nam17887 »

ujetin wrote: post #7

I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…

Have you tried the billing explorer? It shows a pretty detailed report of what you use.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#102

Post by danial »

smackeyacky wrote: post #8

I know it's easy to get lazy about checking your AWS billing dashboard but I do it once a week - you can set up alerts and whatnot but I find it easier just to go look at the current usage to make sure nothing has gone awry.

I agree that you have to make it a daily or weekly habit to check because 30 days is too long a time to incur costs you're not aware of. That's why I built Billgist.com, same idea but it sends a daily email with usage amount right in the subject, like: $16.56 XYZAccount – Daily AWS billing alert.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#103

Post by danial »

digitalsushi wrote: post #70
smackeyacky wrote: post #8

I know it's easy to get lazy about checking your AWS billing dashboard but I do it once a week - you can set up alerts and whatnot but I find it easier just to go look at the current usage to make sure nothing has gone awry.

I think the point is that someone could bankrupt the average hobbyist in an hour or two, if they were expected to pay it.

I think that rate of usage would trigger EC2 abuse alerts. Usually it's something that looks plausible but accumulated over 30 days.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#105

Post by halilduygulu »

Osiris wrote: post #95
ujetin wrote: post #7

I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…

I'm really surprised that people immediately jump to cloud providers even for personal projects when you can lease VPS and server instances for much cheaper. A buddy of mine runs a crypto currency validator in AWS and pays over $1600 a month. You can rent a dedicated server with 32 cores, 256GB RAM and 2TB of NVMe storage for $400 a month. Tent two in different data centers for redundancy and you'll still paying half…

how is it still profitable after 1600 cost?

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#106

Post by aborsy »

halotrope wrote: post #19
blibble wrote: post #14

their hardware MFA functionality is worse than useless it only permits a single hardware token to be registered to an account so good luck if you misplace or break your hardware token

When setting up the token you can scan the QR with multiple devices. E.g YubiKey and Authenticator App. This at least allows for a backup in case one goes missing. I agree it is kind of incredible that multiple tokens are not supported.

You create several users with admin privileges each with separate MFA.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#108

Post by notreallyserio »

oneplane wrote: post #51
notreallyserio wrote: post #44

Earlier quoted context omitted.

Does AWS require distinct billing accounts for each project? I use GCP, I can attach the same account to multiple projects. (It also lacks this basic billing limit feature, unfortunately.)

No, that's why it would be silly to have to change it for every account. (and also problematic for a team with a bunch of child accounts to then have to gain access to the org's card or something like that to change settings for their childs)

I don't follow. But they could make the quota feature a toggle (that has the same mechanic to unlock). Easy, easy enough for a junior dev. And I'm sure folks spending more than a few minutes chatting about it could come up with an even better solution.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#109

Post by nurettin »

toomanydoubts wrote: post #46
caslon wrote: post #37

Earlier quoted context omitted.

Don't use a "cloud" vendor then? Just use a VPS vendor.

Should I just rewrite and host stuff like S3, RDS, ECS, Route53, Cloudwatch, Cloudfront, Lambda, etc. just because I want a spending limit? Your argument makes no sense at all. You may feel like using production-ready hosted cloud services and still want a spending limit. Renting a single VPS might not solve all your issues.

Some people just want to use aws because it is convenient. I could just set up a vps with rabbitmq, nexus and postgres, setup cron to post systemd status and use the provider's cdn offering to accomplish most of that. Probably doesn't suit your requirements.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#110

Post by jackson1442 »

staticassertion wrote: post #24
jackson1442 wrote: post #3

@aws, why not mandate MFA for a root user? in child org accounts where this is less feasible, you could allow access to the root user only from the parent account, no direct login at all.

One option is to set your root user's password to some random 64 character string and forget it. Any time you want root access (rare) you go through a reset flow, which means your root auth is tied to your email. Something like GMail has pretty strict controls so this is actually imo the safest option available.

While this may be safest, it doesn’t make sense why Amazon doesn’t save themselves a couple (hundred) grand in refunds by locking down root accounts.
Post reply on HN