[deleted]
Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
21–30 of 110 posts
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#22Well, yeah, of course they're stuck with the bill. I feel like people think AWS is supposed to have infinite guard rails regardless of what the engineers using it do, like when people write code that infinite loops and it blows up their bill.
AWS gives money back in a lot of cases that I think they legitimately aren't responsible for.
I don't know that other cloud providers are going to do any better - an attacker who has your credentials and spins up 10's of thousands of dollars of infra will cost you thousands of dollars.
I'll certainly echo the advice for 2FA but, more importantly, use a strong, unique password.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#23MFA is good advice
Also, I'd create a IAM user and severely limit your usage of the root account, and over time stop using the root completely.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#24@aws, why not mandate MFA for a root user? in child org accounts where this is less feasible, you could allow access to the root user only from the parent account, no direct login at all.
One option is to set your root user's password to some random 64 character string and forget it. Any time you want root access (rare) you go through a reset flow, which means your root auth is tied to your email. Something like GMail has pretty strict controls so this is actually imo the safest option available.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#25their hardware MFA functionality is worse than useless it only permits a single hardware token to be registered to an account so good luck if you misplace or break your hardware token
That's bad and annoying but it is not at all worse than useless. A hardware token is a very worthwhile investment.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#26Well, yeah, of course they're stuck with the bill. I feel like people think AWS is supposed to have infinite guard rails regardless of what the engineers using it do, like when people write code that infinite loops and it blows up their bill. AWS gives money back in a lot of cases that I think they legitimately aren't responsible for. I don't know that other cloud providers are going to do any better - an attacker wh…
Yep, buying goodwill is very effective.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#27their hardware MFA functionality is worse than useless it only permits a single hardware token to be registered to an account so good luck if you misplace or break your hardware token
The point is to block unauthorized access. It is not less than useless. It absolutely does that. You really think if your lost your token Amazon would lock you out forever? Wrong assumption Besides, just use AUTHY if that's your concern
FWIW, at a workplace I'm familiar with, the hardware MFA devices for a group 'disappeared' from the office during COVID and despite the company having an active relationship and contracts with AWS, it was taking over a year to get access to the root accounts in question reset. It is not an easy process.
That said, I have to imagine this is the wrong procedure and there's some way to duplicate hardware MFA devices to have redundancy for such a case...
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#28Good reminder to completely close my AWS account. I have TOTP MFA on it but having a AWS account that had the same root login as my Amazon retail account was risky and a mistake from the beginning. Luckily I haven't used it for anything in years so it was as simple as following the "Close account" procedure.
I'll use Digital Ocean for anything small if I need to spin up a server in the future.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#29The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.
That is not true, you can setup a budget, and billing alerts.
Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill
#30Well, yeah, of course they're stuck with the bill. I feel like people think AWS is supposed to have infinite guard rails regardless of what the engineers using it do, like when people write code that infinite loops and it blows up their bill. AWS gives money back in a lot of cases that I think they legitimately aren't responsible for. I don't know that other cloud providers are going to do any better - an attacker wh…
I don't feel that some kind of quota management or predictable pricing is a significant ask. Most people or orgs do not need instant and infinite scaling. And would rather a 1 hour outage while they sort things out rather than a $100,000 bill for a minor bug.