4 ms·
Trying to turn this into him somehow being victimized by AWS and the original comment as being victim blaming in this regard is kind of crummy. The OP was a vi
by tssva 5y ago
Trying to turn this into him somehow being victimized by AWS and the original comment as being victim blaming in this regard is kind of crummy.
The OP was a victim of the hacker and not AWS.
- jffry 5y agoI did not say that this person was victimized by AWS, you are putting words in my mouth. We agree that this person has been victimized by a criminal. My point is that AWS failing to implement spending controls makes this type of attack significantly more damaging, and the slow turnaround on CloudWatch spending alarms means five or six-figure sums of money can be spent before customers are alerted. AWS can and should do more to give its customers additional control over spending as a defense-in-depth measure. This would be valuable both to limit unauthorized spending (this scenario, or a "rogue employee" scenario) and also unanticipated spending ("autoscaling gone wild" type scenarios). AWS is a big target, and the fact that credentials can be used to spend an unlimited quantity of money means they are a huge target for criminals. Defense in depth would be wise in this situation!