How an empty S3 bucket can make your AWS bill explode

Original Article ↗ Hacker News Discussion ↗

AWS customers are alarmed to learn that unauthorized requests to their S3 buckets — including empty or private ones — can generate significant charges, creating a “denial of wallet” attack vector where anyone who knows or guesses a bucket name can run up another party’s bill. Commenters question the fairness and incentives of billing for failed 4xx requests, note similar patterns on other major clouds, and highlight how hard it is to fully mitigate this without complex setups, random bucket names, or external cost controls. Many call for provider-side fixes such as not charging for authorization failures, adding hard spending caps, or offering better built‑in safeguards for public-facing storage.

Billing for Unauthorized S3 Requests

  • Many commenters are shocked that 403/Access Denied S3 requests are billable, calling it “bananas” and “customer‑hostile.”
  • Others argue unauthorized requests still consume resources, so someone must pay, and AWS is simply following its published pricing.
  • Several note that the marginal cost of an auth failure should be far lower than a real PUT/GET, yet pricing is similar or higher (e.g., failed PUTs priced like successful writes).

Denial‑of‑Wallet / Attack Potential

  • Strong concern that botnets or cheap VPSs could spam guessed bucket names and create large bills (“economic DDOS”).
  • Attack surface is increased by: predictable bucket names (domains, account IDs), pre‑signed URLs exposing bucket names, and old/abandoned buckets.
  • Some extend this to other AWS services (CloudFront, API Gateway, byte‑range GETs) as further denial‑of‑wallet vectors.

Mitigations and Workarounds

  • Suggestions:
    • Use long, random bucket names; delete unused buckets.
    • Put S3 behind CloudFront or reverse proxies, though S3’s direct endpoint remains exposed.
    • Use private / non‑internet‑routable storage where possible.
    • Set CloudWatch billing alarms, Cost Anomaly Detection, and DIY “budget ceilings” via Lambda (no native hard cap).
  • Some note you cannot truly “shut down” a bucket without deleting it, and requester‑pays does not shift costs for 403s.

Comparisons to Other Providers

  • Claims that GCP and Azure also bill for failed/unauthorized requests, but with nuances; a GCP pricing note says most 4xx/5xx aren’t charged, with specific exceptions.
  • Backblaze B2 reportedly does not bill for 4xx and supports spending limits.

Incentives, Responsibility, and Trust

  • Multiple commenters see misaligned incentives and “predatory” pricing; others frame it as the tradeoff for highly available, auto‑scaling infrastructure.
  • Worries that cloud complexity (S3 auth, access controls, billing) repeatedly creates new classes of user harm (“another Bucketgate”).
  • Several say they now prefer fixed‑price VPS / traditional hosting for personal projects to avoid surprise bills.