If you don’t have some form of automated throttling, couldn’t that still become costly if a popular webpage started pulling resources from that bucket?
If so, their warning could have been phrased better, but isn’t incorrect.
You can put the bucket behind Cloudfront and only give access to the bucket to Cloudfront.
Only skip-a-heartbeat moment was when aws sent me an email saying that you I have “one or more S3 buckets that allow read or write access from any user on the Internet”
But none of my containers had write access. All of them had public read, but yeah, it’s a website and they know this: their own route53 DNS points to the containers.
They just sent the same generic mass email to everyone with any public container.