There has probably been a half dozen of these threads on HN, and every single time, they have the fees waived. You see a much different strategy with public tel

There has probably been a half dozen of these threads on HN, and every single time, they have the fees waived. You see a much different strategy with public telco horror stories regarding roaming/data fees and things like that. There are a couple pro tips for anyone interested: - Configure billing alerts, so that if your bill goes over an expected threshold you will get an email/sms/etc [1]. If your bill is usually $20/month, then set the alert trigger for $30/month, and you will get an alert. In this case, it looks like they just racked up the bill, likely via crypto-currency mining, but what if they were deleting data, etc. You want to be pretty proactive about this stuff. This only takes a couple minutes. - Use dedicated role accounts, rather than the AWS root account, so that you can roll keys without a huge impact [2]. You can also give narrow rights to your role accounts, so that they do not have access to everything, this will greatly limit the scope of an attack. It seems that people mistakenly publish their root AWS keys to github, then this type of stuff happens, but luckily AWS is pretty good about it. Although, AWS cannot help if you had your database exfiltrated, or production instances deleted, so you really MUST create role accounts, and limit their abilities [3]. - Monitor the activity on your account [4]. Create some type of alerts so that you will get notified about suspicious activity on your account. For example, if you do no generally create new instances, have an alert fire on this event type, via cloudtrail [5]. Same goes for deleted instances, etc, then you will be in the loop at things are happening. [1] http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-what-is.html http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/... [2] http://docs.aws.amazon.com/IAM/latest/UserGuide/roles-creatingrole.html http://docs.aws.amazon.com/IAM/latest/UserGuide/roles-creati... [3] http://arstechnica.com/security/2014/06/aws-console-breach-leads-to-demise-of-service-with-proven-backup-plan/ http://arstechnica.com/security/2014/06/aws-console-breach-l... [4] http://docs.aws.amazon.com/general/latest/gr/aws-security-audit-guide.html http://docs.aws.amazon.com/general/latest/gr/aws-security-au... [5] http://aws.amazon.com/cloudtrail/ http://aws.amazon.com/cloudtrail/