Hacker News Reader

Comment by rwmj | Hacker News Reader

Doesn't AWS let you set a monthly limit? I only see a way to set spending alerts, not a hard "do not spend more than X" limit.

There's no way on earth I would use AWS on my personal card unless I could set a limit.

View on HN

To the author's point - if you have a strange charge on your credit card your credit card company will reach out to you and let you know. AWS should have similar controls - if your spend gets out of control within a X amount of time period they should reach out to you. Many of the CFM platforms have this as part of their suite of tools (usually called anomaly spend or something similar) and AWS should offer some native tooling.

AWS allows configuring cost alerts via AWS Budgets service.

https://aws.amazon.com/aws-cost-management/aws-budgets/

Yes - that's an opt-in service. IMO it should be on by default.

If a hacker can access your AWS account?

Does it matter -- what AWS limits were imposed?

Those 'real' limits would have to be set by the card issuer. Not AWS. Otherwise trivial for hacker to change the limits.

Amazon should notify you if the limit is changed. You should also be able to set non-editable limits. There's no way I, as a private individual, would spend 45000$ on AWS.

>Amazon should notify you if the limit is changed.

Again if a hacker was to access your AWS account with root this feature would be disabled and you would not be notified. Someone accessing your AWS is fundamentally the problem.

lol @ non-editable limits

Card limits come much later. Usage comes first, then the bill (end of the month).

Even if AWS had a hard spending limit, if an attacker has your root credentials, couldn't they still just increase the limits?

No, they explicitly refuse implementing hard limits for obvious reasons in spite of many users asking for it for years.

I wouldn't sleep.

Reply on news.ycombinator.com