4 ms·
Lesson 1: Don't publish your passwords. Lesson 2: When using AWS then use Billing Alarms[1]. It takes about 1 minute to setup and enables e-mail or SMS notifi
by moe 12y ago
Lesson 1: Don't publish your passwords.
Lesson 2: When using AWS then use Billing Alarms[1].
It takes about 1 minute to setup and enables e-mail or SMS notifications at dollar-thresholds of your choice.
[1] http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/create-billing-alarm.html http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/...
- FireBeyond 12y agoThe corollary to that is the first thing such people/scripts do when they have access to your account is disable Billing Alarms.
- rifung 12y agoAre you sure you can disable billing alarms with just your access/secret key? I thought you would need to know the user name + password for that
- TheDong 12y agoHaving root credentials is sufficient, and based on the fact that this guy said "apparently the s3 api lets you spin up ec2 instances" it looks like he didn't touch IAM. Root credentials are deprecated, but can still be used and if this guy used them then yes, his billing alarms could have been disabled. There's a difference between an admin iam user (can't do billing stuff) and the root credentials (just as powerful as username / password).
- mkale 12y agoMaybe they should send an email/SMS to notify you that email/SMS had been disabled. (And, an email/SMS to the old address when the email/SMS is changed too.)