Live data from Hacker News

Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

news.ycombinator.com

91–100 of 110 posts

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#91

The fact that AWS has no way to limit billing seems insane to me. Your only recourse for an accidental (or malicious) overcharge is beg customer support. It's an incredible liability.

Limiting billing is ambiguous. The computation spent is spent, unless AWS can predict how much you are going to cost by even initiating certain operation, which is not going to be straightforward for all the services they provided.

It's not hard to invert the transaction, ask the billing service if an action can be done instead of bill upon completion. Done. This isn't that hard. If your credits won't make it to the end of the month, send out the email warnings to top up - which should be predictable unless there's a large spike hitting the account. If you prefer invoice billing because you never want your services going down, it's trivial to accommodate with this system design.

Sure, big warnings about data loss/services down in the event of zeroing out your credits.

Having such a safety net would really help the thousands of people who sign up for transient reasons. I don't recommend a noob set up an AWS account. I also don't let my kids play on the freeway.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#92

@aws, why not mandate MFA for a root user? in child org accounts where this is less feasible, you could allow access to the root user only from the parent account, no direct login at all.

One option is to set your root user's password to some random 64 character string and forget it. Any time you want root access (rare) you go through a reset flow, which means your root auth is tied to your email. Something like GMail has pretty strict controls so this is actually imo the safest option available.

You can keep the password unset as well.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#93

This happened to me, the bill was so ridiculous that I wasnt even bothered by it. It got voided by aws support as predicted. MFA does not prevent this. Its IAM keys.

This is an underrated point. Every "best security practices" guide you read has you setup MFA for console access, then create IAM keys with no such protection.

The credentials I'm using with Terraform require MFA in order to call 'AssumeAdmin'. Everyone I've ever shown this configuration has complained about it being overkill and tried to argue Terraform should just have IAM keys sitting on disk, one desktop compromise away from taking everything. And since it's used to provision basically everything it's a highly privileged account.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#94

@aws, why not mandate MFA for a root user? in child org accounts where this is less feasible, you could allow access to the root user only from the parent account, no direct login at all.

You can create rootless organisation-managed child accounts. This is a solved problem.

Organization child accounts are not rootless, they're just seeded with a random password

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#95
post #7

I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…

I'm really surprised that people immediately jump to cloud providers even for personal projects when you can lease VPS and server instances for much cheaper.

A buddy of mine runs a crypto currency validator in AWS and pays over $1600 a month.

You can rent a dedicated server with 32 cores, 256GB RAM and 2TB of NVMe storage for $400 a month. Tent two in different data centers for redundancy and you'll still paying half, not to mention no surprise monthly bills due to increased traffic or creating an expensive snapshot of your DB.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#96
post #85
post #34

Earlier quoted context omitted.

AWS is great if you have a very large infrastructure budget. Playing around on a test AWS account where thousand dollars plus or minus is no big deal is a lot of fun. Playing around while trying to keep the bill under 10$ is just torture.

AWS has a free tier that lasts for a year. I actually used it to get hands-on experience with enough services that I was able to get my AWS Certified Solutions Architect, Cloud Practitioner and Certified Developer certifications. I easily spent 60 hours creating and deleting services and it didn't cost me a cent. I don't even know how you'd accidentally get to thousands of dollars accidentally unless you were doing s…

Egress fees is one way to get a large bill on unrestricted static-file servers

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#97
post #7

I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…

> It is obviously catered towards large organisations

And yet it seems that only the big cloud providers offer a reasonable authentication and authorization approach.

For many other providers, api keys lend full account access (no resource limitation, no read-only/subset of actions), which is unacceptable from a security pov.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#98
post #7

I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn't really fit into my use case. I tried to just shut down the services that were using money but wasn't even sure I had found them all so I just closed the whole account. I don't even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, i…

In AWS, you can create everything under a Cloudformation stack, once you delete the stack, all its resources will be deleted automatically.

The problem however is all the beginner guides including those coming from AWS team themselves teach people to create resources via console without using a Cloudformation stack.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#99

Earlier quoted context omitted.

You can create rootless organisation-managed child accounts. This is a solved problem.

Organization child accounts are not rootless, they're just seeded with a random password

Sure 'technically' you could call support and have them setup an email address for the root account and then it wouldn't be rootless anymore.

But if you setup your child account with something that cannot resolve as an email address it is no longer a working root account and won't be until you contact AWS support. You cannot change the email address setting yourself either, you cannot login and you cannot 'assume' root either (as if it were an IAM user). So in essence: no root access for anyone.

Then you add an SCP to deny support access from that account (or the entire OU or all org child accounts) and it can't self-contact AWS support either for good measure.

Re: Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill

#100

This happened to me, the bill was so ridiculous that I wasnt even bothered by it. It got voided by aws support as predicted. MFA does not prevent this. Its IAM keys.

This is an underrated point. Every "best security practices" guide you read has you setup MFA for console access, then create IAM keys with no such protection. The credentials I'm using with Terraform require MFA in order to call 'AssumeAdmin'. Everyone I've ever shown this configuration has complained about it being overkill and tried to argue Terraform should just have IAM keys sitting on disk, one desktop compromi…

aws-vault works too
Post reply on HN