Hacker News Reader

uf, aws should definitly not count the requests against a bucket that is not configured for public use.

Edit: if they do that, they should make it possible to firewall buckets via ips so that they are only accessible via certain ips

View on HN

Or at the very least the requester should b charged for the failed auth.

How is that possible? AWS can't bill anyone on the planet.

This is an unauthorized S3 API request. If there is a valid access id and secret attached, bill them for the request.

I doubt that anyone's agreed to pay that. Also that there's often a valid access ID and secret. Also that the cost of scanning through all the client IDs across all secrets is worth the money.

Reply on news.ycombinator.com