4 ms·

As it should be, but recently on HN it was posted that AWS will charge you for any unauthorized PUT request to your S3 buckets. Meaning even 4xx errors will rac

As it should be, but recently on HN it was posted that AWS will charge you for any unauthorized PUT request to your S3 buckets. Meaning even 4xx errors will rack up a charge. So your S3 bucket names must be hidden passphrases now that stand between an attacker and your budget.

nijave 2y ago
In all fairness, systems administrators have always had to pay for unauthorized requests and systems to mitigate the risk The new thing is hyperscalers have so much capacity you can get flooded by these long before the service degrades or goes offline
- kazen44 2y ago
  Also, the cost of doing this per request is insane compared to either absorbing or rate-limiting the bandwith the requests take. Cloud computing charges you by the request/byte/cpu cycle. Servers do not have this issue. Also, is it simply not possible to rate limit this on a per IP basis? Make client only able to do X requests per second from each unique IP/network flow.
  - nijave 2y ago
    >Cloud computing charges you by the request/byte/cpu cycle. Servers do not have this issue. Sure they do. Processing requests takes bandwidth, CPU, memory, disk I/O >Also, is it simply not possible to rate limit this on a per IP basis It's largely useless. You'll block any legitimate bits/programs, people on CGNAT, people on corporate networks & bad actors will use botnets, residential IPs, VPNs to gain access to thousands or millions of unique IPs
    - yencabulator 2y ago
      The overhead of handling the 403 is very very small compared to what S3 charges for a PUT.
akira2501 2y ago
Wow. Okay. New horrors brought to us by the modern world we've created. Thankfully, it does look like AWS is appropriately embarrassed over this, and is going to maybe do something. https://twitter.com/jeffbarr/status/1785386554372042890 https://twitter.com/jeffbarr/status/1785386554372042890
- yencabulator 2y ago
  Nah, they're just doing PR to manage their public image. AWS has known about that since 2006: https://twitter.com/cperciva/status/1785402732976992417 https://twitter.com/cperciva/status/1785402732976992417

nijave 2y ago

In all fairness, systems administrators have always had to pay for unauthorized requests and systems to mitigate the risk The new thing is hyperscalers have so much capacity you can get flooded by these long before the service degrades or goes offline

kazen44 2y ago
Also, the cost of doing this per request is insane compared to either absorbing or rate-limiting the bandwith the requests take. Cloud computing charges you by the request/byte/cpu cycle. Servers do not have this issue. Also, is it simply not possible to rate limit this on a per IP basis? Make client only able to do X requests per second from each unique IP/network flow.
- nijave 2y ago
  >Cloud computing charges you by the request/byte/cpu cycle. Servers do not have this issue. Sure they do. Processing requests takes bandwidth, CPU, memory, disk I/O >Also, is it simply not possible to rate limit this on a per IP basis It's largely useless. You'll block any legitimate bits/programs, people on CGNAT, people on corporate networks & bad actors will use botnets, residential IPs, VPNs to gain access to thousands or millions of unique IPs
  - yencabulator 2y ago
    The overhead of handling the 403 is very very small compared to what S3 charges for a PUT.

akira2501 2y ago

Wow. Okay. New horrors brought to us by the modern world we've created. Thankfully, it does look like AWS is appropriately embarrassed over this, and is going to maybe do something. https://twitter.com/jeffbarr/status/1785386554372042890 https://twitter.com/jeffbarr/status/1785386554372042890

yencabulator 2y ago
Nah, they're just doing PR to manage their public image. AWS has known about that since 2006: https://twitter.com/cperciva/status/1785402732976992417 https://twitter.com/cperciva/status/1785402732976992417