Hacker Accessed AWS for $50k+ – AWS Ignoring Me

Re:Hacker Accessed AWS for $50k+ – AWS Ignoring Me by TrueGeek on Tuesday May 11, 2021 @09:44AM (#27118033)

It's still crap though. If they spin up an instance billing $1k a day you'll find out after they've already billed several hundred, if not at least $1k. There needs to be a way to set actually limits, not alerts. You should be able to say "I'm not using this service, the limit should be $0."

Of course, if OP didn't have MFA / let their keys leak this may not have helped anyway if the hacker was able to just remove the limits.

[ Parent | on HN ]

Re:Hacker Accessed AWS for $50k+ – AWS Ignoring Me by isbvhodnvemrwvn on Tuesday May 11, 2021 @06:49PM (#27124592)

> You should be able to say "I'm not using this service, the limit should be $0."

In your organization, add a service control policy which denies access to services you don't use. This will prevent all member accounts from executing actions you don't want, including root users. You can also deny any action on any resource in region other than whatever you expect to use (with some exceptions due to legacy stuff).

[ Parent | on HN ]

Re:Hacker Accessed AWS for $50k+ – AWS Ignoring Me by TrueGeek on Tuesday May 11, 2021 @09:07PM (#27125533)

this is great, thank you!

[ Parent | on HN ]

Re:Hacker Accessed AWS for $50k+ – AWS Ignoring Me by icedchai on Tuesday May 11, 2021 @12:19PM (#27119996)

If they had actual limits, you'd have people complaining about their sites getting shut down because someone broke into their account and spun up a bunch of instances. Or a developer did it accidentally. Alerts are much safer.

[ Parent | on HN ]