Re:How to burn the most money with a single click in Azure
by JackFr on Sunday March 29, 2020 @12:23PM
(#22720213)
I inadvertently committed SES creds to GitHub. The only way I found out by an email from AWS telling me that the creds were suspended 24 hours later for a high reported spam rate.
Someone had sent 70,000 emails (which is the default daily limit at my tier). Luckily only cost ~$8.
Re:How to burn the most money with a single click in Azure
by scarface74 on Sunday March 29, 2020 @01:46PM
(#22720934)
How do people keep doing this? It’s stated over and over again in all AWS documentation never to put access codes in code or your configuration. Locally, your keys should be stored as part of your user profile (configured with the AWS cli) and when your code is running in AWS, it should get permissions based on an IAM role attached to your EC2/ECS/Lambda.
Re:How to burn the most money with a single click in Azure
by applecrazy on Monday March 30, 2020 @02:01AM
(#22725621)
My guess would be poorly configured .gitignore files. I recently had a project collaborator commit his .env file containing credentials to a MongoDB cluster because of this.
Re:How to burn the most money with a single click in Azure
by scarface74 on Monday March 30, 2020 @04:28AM
(#22726195)
if you follow the guidelines that are repeatedly stressed, your code should never be reading or handling AWS credentials directly. That wouldn’t be an issue.
The access keys would be in your usr directory and all of the SDKs would know how to find them. When running on AWS, the SDKs get the credentials from the instance metadata.
When I got charged an extremely large amount I was contacted by the customer support. They explained to me what happened (I had leaked a SECRET in my repo) and then got refunded the total amount.
It was quite an anecdotical experience because I wasn't expecting any of it as it was my mistake.