4 ms·

I know that web security is a hard problem but I can't wrap my head around the fact that static content has the same issue as a Wordpress blog.

• Scoundreller 3y ago
  That’s correct. Only skip-a-heartbeat moment was when aws sent me an email saying that you I have “one or more S3 buckets that allow read or write access from any user on the Internet” But none of my containers had write access. All of them had public read, but yeah, it’s a website and they know this: their own route53 DNS points to the containers. They just sent the same generic mass email to everyone with any public container.
  • Someone 3y ago
    If you don’t have some form of automated throttling, couldn’t that still become costly if a popular webpage started pulling resources from that bucket? If so, their warning could have been phrased better, but isn’t incorrect.
    • gnz11 3y ago
      You can put the bucket behind Cloudfront and only give access to the bucket to Cloudfront.
      • Someone 3y ago
        But then, would the OP get an email saying they have “one or more S3 buckets that allow read or write access from any user on the Internet”?
• makeitdouble 3y ago
  The engineering team (that they fired) would have needed to explain that difference in so many details to stakeholders who just wanted to move on.