3 ms·

This is exactly the scenario that people post in every thread about AWS failing to implement budgets and hard limits, and every time people always say "but AWS

This is exactly the scenario that people post in every thread about AWS failing to implement budgets and hard limits, and every time people always say "but AWS will just forgive the fee!" as an excuse for AWS being so user hostile. So far, this time, they haven't. I hope they do for this guy's sake, but to not have that as an official policy, or to implement a tech solution, is beyond terrible.

dan1234 5y ago
Yeah, happened to me with an account that: * Never used anything above the free tier * Never had a credit card attached * Was only ever logged in from the UK * Hadn't been used at all in 3 years Naively my root credentials were the same as my Linkedin details (which were all leaked), and one random Sunday, someone from Brazil logged in and spun up 50+ GPU instances across multiple zones. Amazon let that go for around 12 hours before they sent me an email asking me to check that my deployments were working as expected. £2,000 in just those few hours. I did get the fee waived (though they took two weeks to finally decide this), and I accepted that it was my fault for reusing passwords and not enabling MFA (which IIRC may not have been an option when the account was opened) but I was very critical of Amazon for not preventing expensive nodes from being spun up when there wasn't even a card attached to the account.
- chrisandchris 5y ago
  I really have issues understanding the "I did re-use my password for a service that might charge me an indefinit amount. But i still think, it's the services error". I mean, it could "never" happened if you just thought of a better password for your AWS account. Why blame AWS for that? All the preventive things AWS could implement wimm help the few users who didn't get that they should good passwords and hinder all the users who "know" what they are doing and just need some machines up-and-running. IMHO.
vasili111 5y ago
Maybe it is more profitable for them to not have hard limits for legit cloud uses and deal with hackings in a way to just forgive. I am pretty sure they have some calculations done showing what way is more profitable for them.
- simmerup 5y ago
  More profitable for them but user hostile
inoop 5y ago
> AWS failing to implement budgets and hard limits The problem isn't that AWS does not let you manage limits, because they do, to some extent: https://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html https://docs.aws.amazon.com/general/latest/gr/aws_service_li... The problem is that if someone has your root credentials, they can just change these limits and go to town.
foobarian 5y ago
Can't the guy contest the charges with the CC company? What recourse does Amazon have beyond locking the account?
- bdcravens 5y ago
  AWS bills monthly, so his CC hadn't been charged yet. It was just the number that showed up in his AWS console.
- GordonS 5y ago
  In previous threads, people have said that AWS send unpaid bills to debt collectors.

dan1234 5y ago

Yeah, happened to me with an account that: * Never used anything above the free tier * Never had a credit card attached * Was only ever logged in from the UK * Hadn't been used at all in 3 years Naively my root credentials were the same as my Linkedin details (which were all leaked), and one random Sunday, someone from Brazil logged in and spun up 50+ GPU instances across multiple zones. Amazon let that go for around 12 hours before they sent me an email asking me to check that my deployments were working as expected. £2,000 in just those few hours. I did get the fee waived (though they took two weeks to finally decide this), and I accepted that it was my fault for reusing passwords and not enabling MFA (which IIRC may not have been an option when the account was opened) but I was very critical of Amazon for not preventing expensive nodes from being spun up when there wasn't even a card attached to the account.

chrisandchris 5y ago
I really have issues understanding the "I did re-use my password for a service that might charge me an indefinit amount. But i still think, it's the services error". I mean, it could "never" happened if you just thought of a better password for your AWS account. Why blame AWS for that? All the preventive things AWS could implement wimm help the few users who didn't get that they should good passwords and hinder all the users who "know" what they are doing and just need some machines up-and-running. IMHO.

vasili111 5y ago

Maybe it is more profitable for them to not have hard limits for legit cloud uses and deal with hackings in a way to just forgive. I am pretty sure they have some calculations done showing what way is more profitable for them.

simmerup 5y ago
More profitable for them but user hostile

inoop 5y ago

> AWS failing to implement budgets and hard limits The problem isn't that AWS does not let you manage limits, because they do, to some extent: https://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html https://docs.aws.amazon.com/general/latest/gr/aws_service_li... The problem is that if someone has your root credentials, they can just change these limits and go to town.

foobarian 5y ago

Can't the guy contest the charges with the CC company? What recourse does Amazon have beyond locking the account?

bdcravens 5y ago
AWS bills monthly, so his CC hadn't been charged yet. It was just the number that showed up in his AWS console.
GordonS 5y ago
In previous threads, people have said that AWS send unpaid bills to debt collectors.