Denial of wallet attacks or How an empty s3 bucket can make your bills explode

https://twitter.com/Lauramaywendel/status/1785064878643843085
21
Jump in the discussion.

No email address required.

Just put your shit behind a WAF, goddarn. :marseysigh: Unless this applies to straight-up any S3 bucket regardless of config?

Jump in the discussion.

No email address required.

Yes that's the whole point. If you have the bucket's name you can bankrupt them by sending unauthenticated requests. Even if you use Virtual Private Cloud (AWS analogue of a firewall) and only whitelist certain ip address access to your s3 bucket they can still do this.

Jump in the discussion.

No email address required.

I didn't read it, but I imagine traffic would get caught by the firewall without ever reaching the bucket service, no?

Jump in the discussion.

No email address required.

There's still a direct URL to the bucket. Fairly certain I've had those type of requests blocked by CloudFront w/ WAF in the past, but I have no idea if there's still a way to use the S3 API to ping it.

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.