How an empty S3 bucket can make your AWS bill explode
How an empty S3 bucket can make your AWS bill explode
Imagine you create an empty, private AWS S3 bucket in a region of your preference. What will your AWS bill be the next morning?
“By design” AWS bills project owners for unauthorized calls to the public S3 API.
So what I’m reading from this is you can do a billing attack on anything hosted in AWS so long as you know one of their bucket names.
Seriously, now that this is more widely known, it'll for sure be taken advantage of a lot, to the point AWS will begrudgingly protect their customers once the damage is done.
You shouldn't be charged for unauthorized requests to your buckets. Currently if you know any person's bucket name, which is easily discoverable if you know what you're doing, that means you can maliciously rack up their bill just to hurt them financially by spamming it with anonymous requests.
That’s a rare vintage
As it turns out, one of the popular open-source tools had a default configuration to store their backups in S3. And, as a placeholder for a bucket name, they used… the same name that I used for my bucket.
It's completely insane that the tool would attempt to connect to a nonexistent bucket for backups by default instead of just... having them disabled completely?
AWS was kind enough to cancel my S3 bill. However, they emphasized that this was done as an exception.
Dicks.
Please use scribe.rip instead of medium.com for articles
It's fine if you dislike a site. But the correct thing to do is not consume their content, not to work around it.
Or use a browser extension to implement your preferences rather than push them onto others in a way that makes it harder for them to implement theirs.
If an article links to
medium.commy redirects kick in, my link flagging kicks in and everything else. If everyone uses some different service to "fix" medium I am stuck with what they like. There is valuable to keeping the canonical URL.I would also love to see domain blocks as a user preference in Lemmy. Just hide these sites that I don't like.
A great post, interesting and to the point.
I woke up yesterday morning and felt a little bit hazy. My feet tingled a little and that was an indication of what was going to happen. My podometric senses were tingling! Hahaha, get it? So anyway, after having a light breakfast and sitting down in front of my desk to check my emails, one in particular stood out. Being in a hurry however, I left for work and....
Article written like this are reason for me to stop reading. So annoying. This article is a breath of fresh air.
Wow, makes one fearful to even use AWS. Yikes!
Definately required reading for those who use AWS.
Chilling with nothing but my homeserver here. Backed up to the NAS, mirrored to my grandparents house. No charges, no misconfigurations, just Arch testing being more stable than any commercial service I know lol