4 ms·
I, for one, had one of those "oops" when I misused some cloud services, making a VPS instance accessible from the network. When I got charged an extremely larg
by rozularen 7y ago
I, for one, had one of those "oops" when I misused some cloud services, making a VPS instance accessible from the network.
When I got charged an extremely large amount I was contacted by the customer support. They explained to me what happened (I had leaked a SECRET in my repo) and then got refunded the total amount.
It was quite an anecdotical experience because I wasn't expecting any of it as it was my mistake.
- JackFr 7y agoI inadvertently committed SES creds to GitHub. The only way I found out by an email from AWS telling me that the creds were suspended 24 hours later for a high reported spam rate. Someone had sent 70,000 emails (which is the default daily limit at my tier). Luckily only cost ~$8.
- scarface74 7y agoHow do people keep doing this? It’s stated over and over again in all AWS documentation never to put access codes in code or your configuration. Locally, your keys should be stored as part of your user profile (configured with the AWS cli) and when your code is running in AWS, it should get permissions based on an IAM role attached to your EC2/ECS/Lambda.
- applecrazy 7y agoMy guess would be poorly configured .gitignore files. I recently had a project collaborator commit his .env file containing credentials to a MongoDB cluster because of this.
- scarface74 7y agoif you follow the guidelines that are repeatedly stressed, your code should never be reading or handling AWS credentials directly. That wouldn’t be an issue. The access keys would be in your usr directory and all of the SDKs would know how to find them. When running on AWS, the SDKs get the credentials from the instance metadata.