Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 110 posts

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#51

Post by oneplane »

notreallyserio wrote: post #44
oneplane wrote: post #42

Earlier quoted context omitted.

That is super impractical when you run 200 AWS accounts in production.

Does AWS require distinct billing accounts for each project? I use GCP, I can attach the same account to multiple projects. (It also lacks this basic billing limit feature, unfortunately.)

No, that's why it would be silly to have to change it for every account. (and also problematic for a team with a bunch of child accounts to then have to gain access to the org's card or something like that to change settings for their childs)

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#52

Post by cortesoft »

46756e wrote: post #45
cortesoft wrote: post #41

Earlier quoted context omitted.

Why should a customer be stuck with the bill in the case of fraud? If someone fraudulently buys something in a store with my stolen credit card, I am not liable to pay for those purchases. Why would it be different for AWS services?

Right, but if someone buys say a shirt with your stolen card, it isn’t the store that picks up the bill. It’s the credit card company.

It depends on the merchant agreement, but merchants are often liable for the fraudulent charge, especially for online sales.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#53

Post by toomanydoubts »

YPPH wrote: post #40
spekcular wrote: post #12

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

They should either add technical measures to prevent overcharging on these types of accounts, or amend the terms of service to explicitly say that the account owner is not liable for charges incurred by an unauthorised user who obtains user credentials. I find it hard to fathom that a company which sells machine learning as a service cannot detect that an account sitting dormant for months, which suddenly spins up se…

Jeff Bezos did not become a billionaire by being user-friendly. Guess anyone trying to cancel their Amazon Prime subscription would agree.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#54

Post by halpert »

karmasimida wrote: post #50
spekcular wrote: post #12

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

Limiting billing is ambiguous. The computation spent is spent, unless AWS can predict how much you are going to cost by even initiating certain operation, which is not going to be straightforward for all the services they provided.

They bill by the request or minute for most of the services. Billing for storage is a little more complicated, but many services could easily be limited.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#55

Post by caslon »

toomanydoubts wrote: post #46
caslon wrote: post #37

Earlier quoted context omitted.

Don't use a "cloud" vendor then? Just use a VPS vendor.

Should I just rewrite and host stuff like S3, RDS, ECS, Route53, Cloudwatch, Cloudfront, Lambda, etc. just because I want a spending limit? Your argument makes no sense at all. You may feel like using production-ready hosted cloud services and still want a spending limit. Renting a single VPS might not solve all your issues.

The entire point of AWS is to avoid downtime at the expense of convenience and cash. There's no reason to use it if you're willing to sacrifice its reason for existence.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#56

Post by gruez »

karmasimida wrote: post #50
spekcular wrote: post #12

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

Limiting billing is ambiguous. The computation spent is spent, unless AWS can predict how much you are going to cost by even initiating certain operation, which is not going to be straightforward for all the services they provided.

azure seems to manage that just fine with their free azure credit that they give to MSDN subscribers ($150/month spending limit, refilled every month, no chance of going over).

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#57

Post by hexedpackets »

46756e wrote: post #45
cortesoft wrote: post #41

Earlier quoted context omitted.

Why should a customer be stuck with the bill in the case of fraud? If someone fraudulently buys something in a store with my stolen credit card, I am not liable to pay for those purchases. Why would it be different for AWS services?

Right, but if someone buys say a shirt with your stolen card, it isn’t the store that picks up the bill. It’s the credit card company.

Sometimes the merchant does pay for a fraudulent transaction, and sometimes the issuing bank does. The credit card networks never pay. It depends on several factors including whether the card was physically present and whether it was swiped or used a chip.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#58

Post by gruez »

toomanydoubts wrote: post #53
YPPH wrote: post #40

Earlier quoted context omitted.

They should either add technical measures to prevent overcharging on these types of accounts, or amend the terms of service to explicitly say that the account owner is not liable for charges incurred by an unauthorised user who obtains user credentials. I find it hard to fathom that a company which sells machine learning as a service cannot detect that an account sitting dormant for months, which suddenly spins up se…

Jeff Bezos did not become a billionaire by being user-friendly. Guess anyone trying to cancel their Amazon Prime subscription would agree.

>Guess anyone trying to cancel their Amazon Prime subscription would agree.

The unsubscribe button was easy enough to find, but had to maybe go through 2 nag screens before letting me cancel. I guess it's not pro-user, but it's also not exactly a roadblock to me canceling.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#59

Post by poxrud »

poxrud wrote: post #29
spekcular wrote: post #12

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

That is not true, you can setup a budget, and billing alerts.

You can execute Budget Actions to stop services and revoke permissions. It’s not simple but it’s possible.
Post reply on HN