Post from an AWS S3 user, who on the second day had an invoice for $1000 dollars and it was empty. Apparently the problem lies mainly in the bucket calls, which create a cost, but the problem was that this user created a bucket with a name like “bucket-crap”, said name was the one that came by default in an application, apparently widely used by companies. However, all this revealed that this service could have a serious problem, since it could cause what they now call “DoW” “Denial of Wallet”, since any malicious user, knowing the name of said bucket could create thousands of calls to said bucket. bucket and create an exacerbated cost, because even if you do not have access to said bucket, calls to it, even if they are denied, generate a cost. Detailed information in: https://medium.com/@maciej.pocwierz/how-an-empty-s3-bucket-can-make-your-aws-bill-explode-934a383cb8b1

It appears AWS is looking into it: [image] Jeff Barr ☁️ @jeffbarr Thank you to everyone who brought this article to our attention. We agree that customers should not have to pay for unauthorized requests that they did not initiate. We’ll have more to share on exactly how we’ll help prevent these charges shortly. #AWS #S3 How an empty S3 7:11 PM - 30 Apr 2024 3.4K 540 I don’t think we’ve had a report of this happening with Discourse sites using S3 for uploads.

Indeed, I don’t think that’s the case, however it doesn’t hurt to take some precautions.

Indeed, I saw this as well and much cursing ensued. Discourse is not designed to obscure the underlying uploads bucket name and in the intervening days have been hoping nobody used one of ours. The worst thing is that even if you observe the attack, there is nothing you can do to stop it.

via Jeff Barr on Twitter: https://x.com/jeffbarr/status/1787844682216792163 Update: S3 engineers are working to make unauthorized requests that customers did not initiate free of charge. This change will cover a range of HTTP 3xx/4xx status codes, including all of those cited in the article. We’re moving quickly and we plan to share more details this week.

AWS S3 and the invoice of more than $1000 dollars on the second day after being created

Product Support Self-hosting

pfaffman (Jay Pfaffman) May 3, 2024, 7:00pm 4

I guess that’s another reason that using a CDN is recommended, as it makes it harder, at least, to see the bucket name.

Topic		Replies	Views
Incorrect S3 warning in admin menu Bug	5	1137	December 29, 2020
S3 upload bucket, cdn url and bucket name in CNAME Product Support	9	5532	July 17, 2020
What are the right settings to use S3 bucket (with non-Amazon URL)? Self-hosting	19	5493	August 25, 2020
Do I need a second aws S3 bucket for backup? Self-hosting backups , s3	9	1512	December 31, 2017
S3 media saves gazillions of "AccessDenied" xmls Self-hosting s3	5	720	March 16, 2022

AWS S3 and the invoice of more than $1000 dollars on the second day after being created

Related topics