Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 110 posts

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#81

Post by toomanydoubts »

stackbutterflow wrote: post #66
ujetin wrote: post #7

I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…

It says here that closing your account isn't enough: > Closing your account might not automatically terminate all your active resources. You might continue to incur charges for some of your active resources even after you close your account. https://aws.amazon.com/premiumsupport/knowledge-center/termi...

Is that even legal? How is it the user fault that aws can't properly track and terminate the account resources? (Altough they seem very efficient in tracking usage when the goal is to charge credit cards).

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#83

Post by heavyset_go »

spekcular wrote: post #12

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

This is the reason I refuse to use AWS for anything that I work on in my own time. I don't want to wake up to a $20k bill because someone thought it would be funny to DDoS my weekend project.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#84

Post by heavyset_go »

karmasimida wrote: post #50
spekcular wrote: post #12

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

Limiting billing is ambiguous. The computation spent is spent, unless AWS can predict how much you are going to cost by even initiating certain operation, which is not going to be straightforward for all the services they provided.

Somehow Oracle of all companies is able to get this right with their free tiers for their cloud services.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#85

Post by 300bps »

Sebb767 wrote: post #34
ujetin wrote: post #7

I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…

AWS is great if you have a very large infrastructure budget. Playing around on a test AWS account where thousand dollars plus or minus is no big deal is a lot of fun. Playing around while trying to keep the bill under 10$ is just torture.

AWS has a free tier that lasts for a year. I actually used it to get hands-on experience with enough services that I was able to get my AWS Certified Solutions Architect, Cloud Practitioner and Certified Developer certifications. I easily spent 60 hours creating and deleting services and it didn't cost me a cent.

I don't even know how you'd accidentally get to thousands of dollars accidentally unless you were doing something more complicated like setting up an autoscaling group.

Spin up a t3a.micro EC2 instance and run it as much as you like - it's free. If you go into it (as I did many years ago) thinking, "Let me just spin up a 16 core server with 128 GB of RAM" because that's what you'd set up in your on-prem data center then of course you're going to have a big bill.

But that's not what cloud is about. It's about resources popping in and out of existence for the minimal time and resources needed to accomplish a task.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#86

Post by poxrud »

simcop2387 wrote: post #32
poxrud wrote: post #29

Earlier quoted context omitted.

That is not true, you can setup a budget, and billing alerts.

This does not stop the high bills from your account being hacked. Just reduces the amount before you notice. spinngin up gpu and ec2 resources until limits are hit in how many are created is an operation that takes seconds.

Can be stopped with Budget Actions.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#87

Post by remram »

toomanydoubts wrote: post #81
stackbutterflow wrote: post #66

Earlier quoted context omitted.

It says here that closing your account isn't enough: > Closing your account might not automatically terminate all your active resources. You might continue to incur charges for some of your active resources even after you close your account. https://aws.amazon.com/premiumsupport/knowledge-center/termi...

Is that even legal? How is it the user fault that aws can't properly track and terminate the account resources? (Altough they seem very efficient in tracking usage when the goal is to charge credit cards).

They can do it but not instantly. This is similar to any other account, if you close your checking account but someone cashes one of your checks you're on the hook, if you return your rental car but there's highway fees they'll charge you, if you order food from Seamless but requested extra guacamole in a comment they'll add it to the initial bill, ...

Likewise here if your EC2 takes a little while to stop, or if S3 is a little behind in adding up your bandwidth usage, or if the billing for any other of the myriad of AWS products is not quite real-time, I don't see why that would be illegal. Expecting that an accurate statement can be presented within a few seconds of clicking "close account" and guaranteed to be exact just because they are "online services" is a little peculiar.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#88

Post by vmception »

heavyset_go wrote: post #82
vmception wrote: post #63

This happened to me, the bill was so ridiculous that I wasnt even bothered by it. It got voided by aws support as predicted. MFA does not prevent this. Its IAM keys.

How big was the bill?

Like $120,000 after paying like $.30 for cloudfront for 10 months

It was pretty obviously uncharacteristic

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#89

Post by toomanydoubts »

remram wrote: post #87
toomanydoubts wrote: post #81

Earlier quoted context omitted.

Is that even legal? How is it the user fault that aws can't properly track and terminate the account resources? (Altough they seem very efficient in tracking usage when the goal is to charge credit cards).

They can do it but not instantly. This is similar to any other account, if you close your checking account but someone cashes one of your checks you're on the hook, if you return your rental car but there's highway fees they'll charge you, if you order food from Seamless but requested extra guacamole in a comment they'll add it to the initial bill, ... Likewise here if your EC2 takes a little while to stop, or if S3…

I agree it's reasonable in the circumstances you mentioned(as in, being charged for the resources until they are actually terminated, even if it might take a couple of minutes/hours for them to be terminated after closing the account), but the way I read it was like it could keep unterminated services running indefinitely.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#90

Post by smackeyacky »

300bps wrote: post #85
Sebb767 wrote: post #34

Earlier quoted context omitted.

AWS is great if you have a very large infrastructure budget. Playing around on a test AWS account where thousand dollars plus or minus is no big deal is a lot of fun. Playing around while trying to keep the bill under 10$ is just torture.

AWS has a free tier that lasts for a year. I actually used it to get hands-on experience with enough services that I was able to get my AWS Certified Solutions Architect, Cloud Practitioner and Certified Developer certifications. I easily spent 60 hours creating and deleting services and it didn't cost me a cent. I don't even know how you'd accidentally get to thousands of dollars accidentally unless you were doing s…

It's quite easy to burn more money than you want to. My startup had $15k in AWS credits and the other guy in the business set fire to it in no time, running windows based EC2 instances is a sure fire way to go through a lot more money than you realise.
Post reply on HN