3 ms·

Blaming the victim for AWS having inadequate spending controls is kinda crummy. Absolute spending caps, or spending growth rate limits, would both be useful ev

by jffry 5y ago

Blaming the victim for AWS having inadequate spending controls is kinda crummy. Absolute spending caps, or spending growth rate limits, would both be useful even outside of situations where a user's credential is compromised. One example: When teaching colleagues how to use AWS tooling, I gave them full access to a sandbox account where they can learn without disrupting anybody else's infra. It would be nice to be able to place a spending cap on that account. Another example: With things like autoscaling, it's very easy to accidentally misconfigure it to where it will happily start launching tons and tons of VMs. You might do this and not notice. If I had the ability to voluntarily opt into limits on how fast I can increase the aggregate $/second spend rate, then AWS could alert me in general when I'm doing something that exceeds that soft limit.

tssva 5y ago
Trying to turn this into him somehow being victimized by AWS and the original comment as being victim blaming in this regard is kind of crummy. The OP was a victim of the hacker and not AWS.
- jffry 5y ago
  I did not say that this person was victimized by AWS, you are putting words in my mouth. We agree that this person has been victimized by a criminal. My point is that AWS failing to implement spending controls makes this type of attack significantly more damaging, and the slow turnaround on CloudWatch spending alarms means five or six-figure sums of money can be spent before customers are alerted. AWS can and should do more to give its customers additional control over spending as a defense-in-depth measure. This would be valuable both to limit unauthorized spending (this scenario, or a "rogue employee" scenario) and also unanticipated spending ("autoscaling gone wild" type scenarios). AWS is a big target, and the fact that credentials can be used to spend an unlimited quantity of money means they are a huge target for criminals. Defense in depth would be wise in this situation!

by jffry 5y ago

tssva 5y ago

Trying to turn this into him somehow being victimized by AWS and the original comment as being victim blaming in this regard is kind of crummy. The OP was a victim of the hacker and not AWS.

jffry 5y ago
I did not say that this person was victimized by AWS, you are putting words in my mouth. We agree that this person has been victimized by a criminal. My point is that AWS failing to implement spending controls makes this type of attack significantly more damaging, and the slow turnaround on CloudWatch spending alarms means five or six-figure sums of money can be spent before customers are alerted. AWS can and should do more to give its customers additional control over spending as a defense-in-depth measure. This would be valuable both to limit unauthorized spending (this scenario, or a "rogue employee" scenario) and also unanticipated spending ("autoscaling gone wild" type scenarios). AWS is a big target, and the fact that credentials can be used to spend an unlimited quantity of money means they are a huge target for criminals. Defense in depth would be wise in this situation!