Hacker News Reader

Comment by cjk2 | Hacker News Reader

Ok I'm actually going to delete my web site and cloudfront distribution over this. It gets no traffic (at the moment).

The bucket is the same name as the domain so I can imagine this could be exploited quietly very easily as PUTs are so expensive.

Literally a $5 VPS could cost someone $1k.

View on HN

A $5 VPS should have a $10 spend limit or something, at which point it should shut down. In a reasonable world.

I think they meant the other way around, someone pays $5 for a VPS to spam unauthorized requests to your S3 bucket to get Amazon to bill you $1000.

Thanks. Damn, I've misunderstood some things recently so I'll take some rest and slow down I think.

i doubt it. i would imagine any single ip address would get rate-limited/throttle before doing much. the situation the article is describing is much more like a botnet — there were hundreds or thousands (or more?) of unique instances making requests.

I very run big buckets in production that have single addresses hammering them hard all day every day. I've never seen any restrictions or throttling.

> i would imagine any single ip address would get rate-limited/throttle before doing much

Yes, you would imagine, because without relevant WAF rules in place there would be no throttling.

> i would imagine any single ip address would get rate-limited/throttle before doing much.

Does AWS have default per-IP rate limits?

Reply on news.ycombinator.com