3 ms·

We use CloudFront and we deny public users the ability to access S3 directly. You can even use Signed URLs with CloudFront if you like. I'm not sure I'd evere

We use CloudFront and we deny public users the ability to access S3 directly. You can even use Signed URLs with CloudFront if you like. I'm not sure I'd evere feel comfortable letting the public at large hit my S3 endpoints.

INTPenis 3y ago
As it should be, but recently on HN it was posted that AWS will charge you for any unauthorized PUT request to your S3 buckets. Meaning even 4xx errors will rack up a charge. So your S3 bucket names must be hidden passphrases now that stand between an attacker and your budget.
- nijave 3y ago
  In all fairness, systems administrators have always had to pay for unauthorized requests and systems to mitigate the risk The new thing is hyperscalers have so much capacity you can get flooded by these long before the service degrades or goes offline
  - kazen44 3y ago
    Also, the cost of doing this per request is insane compared to either absorbing or rate-limiting the bandwith the requests take. Cloud computing charges you by the request/byte/cpu cycle. Servers do not have this issue. Also, is it simply not possible to rate limit this on a per IP basis? Make client only able to do X requests per second from each unique IP/network flow.
    - nijave 3y ago
      >Cloud computing charges you by the request/byte/cpu cycle. Servers do not have this issue. Sure they do. Processing requests takes bandwidth, CPU, memory, disk I/O >Also, is it simply not possible to rate limit this on a per IP basis It's largely useless. You'll block any legitimate bits/programs, people on CGNAT, people on corporate networks & bad actors will use botnets, residential IPs, VPNs to gain access to thousands or millions of unique IPs
      - yencabulator 3y ago
        The overhead of handling the 403 is very very small compared to what S3 charges for a PUT.
- akira2501 3y ago
  Wow. Okay. New horrors brought to us by the modern world we've created. Thankfully, it does look like AWS is appropriately embarrassed over this, and is going to maybe do something. https://twitter.com/jeffbarr/status/1785386554372042890 https://twitter.com/jeffbarr/status/1785386554372042890
  - yencabulator 3y ago
    Nah, they're just doing PR to manage their public image. AWS has known about that since 2006: https://twitter.com/cperciva/status/1785402732976992417 https://twitter.com/cperciva/status/1785402732976992417
nijave 3y ago
Direct S3 is pretty common for file distribution where latency is less of a concern. e.x. build an installer and distribute it, generate a report and generate a signed url

INTPenis 3y ago

As it should be, but recently on HN it was posted that AWS will charge you for any unauthorized PUT request to your S3 buckets. Meaning even 4xx errors will rack up a charge. So your S3 bucket names must be hidden passphrases now that stand between an attacker and your budget.

nijave 3y ago
In all fairness, systems administrators have always had to pay for unauthorized requests and systems to mitigate the risk The new thing is hyperscalers have so much capacity you can get flooded by these long before the service degrades or goes offline
- kazen44 3y ago
  Also, the cost of doing this per request is insane compared to either absorbing or rate-limiting the bandwith the requests take. Cloud computing charges you by the request/byte/cpu cycle. Servers do not have this issue. Also, is it simply not possible to rate limit this on a per IP basis? Make client only able to do X requests per second from each unique IP/network flow.
  - nijave 3y ago
    >Cloud computing charges you by the request/byte/cpu cycle. Servers do not have this issue. Sure they do. Processing requests takes bandwidth, CPU, memory, disk I/O >Also, is it simply not possible to rate limit this on a per IP basis It's largely useless. You'll block any legitimate bits/programs, people on CGNAT, people on corporate networks & bad actors will use botnets, residential IPs, VPNs to gain access to thousands or millions of unique IPs
    - yencabulator 3y ago
      The overhead of handling the 403 is very very small compared to what S3 charges for a PUT.
akira2501 3y ago
Wow. Okay. New horrors brought to us by the modern world we've created. Thankfully, it does look like AWS is appropriately embarrassed over this, and is going to maybe do something. https://twitter.com/jeffbarr/status/1785386554372042890 https://twitter.com/jeffbarr/status/1785386554372042890
- yencabulator 3y ago
  Nah, they're just doing PR to manage their public image. AWS has known about that since 2006: https://twitter.com/cperciva/status/1785402732976992417 https://twitter.com/cperciva/status/1785402732976992417

nijave 3y ago

Direct S3 is pretty common for file distribution where latency is less of a concern. e.x. build an installer and distribute it, generate a report and generate a signed url