A test bucket's name cost him $1,300 in a day

transcript

He made a storage bucket for a quick test. The bill? About 1,300 dollars. And he never sent a single one of those requests.

A developer in Warsaw makes one S3 bucket. A proof of concept. A few test files. He expects to stay in the free tier. Two days later, he checks his bill. About 1,300 dollars. From nearly 100 million write requests. In one day.

Nearly 100 million in a day. That's over 1,000 a second, all day. But here's the catch. They came from strangers' machines.

Anyone who knows a bucket's name can send it requests. A popular open-source tool stored its backups in S3 by default. Its placeholder bucket name? Exactly the name he picked. Every copy left unconfigured sent its backups to his bucket. S3 refused them. But back then, the owner paid anyway.

Then he briefly opened the bucket to public writes. In under 30 seconds, it collected over 10 gigabytes of strangers' data.

His write-up spread fast. AWS's Jeff Barr replied: We agree. Customers shouldn't pay for unauthorized requests they didn't initiate. 13 May 2024. Access Denied from outside your account or organization? The bucket owner is no longer charged.

Pay per request means someone else's traffic can become your bill. Think about who can reach you. Avoid guessable names. And set billing alerts. So surprises show up in hours, not days.

Full breakdown in the lecture.