Re:The AWS S3 Denial of Wallet Amplification Attack
by __roland__ on Wednesday May 01, 2024 @05:09PM
(#40229457)
You are right, this is about canceling range requests and still getting billed, not about requesting ranges and getting billed for the complete file egress. Sorry; we'll make the post clearer.
Re:The AWS S3 Denial of Wallet Amplification Attack
by nextaccountic on Wednesday May 01, 2024 @08:24PM
(#40231323)
This seems like something that customers can potentially sue for. AWS is overcharging them and not correcting the bug once they become aware of it.
Re:The AWS S3 Denial of Wallet Amplification Attack
by nielsole on Wednesday May 01, 2024 @05:08PM
(#40229446)
S3 egress costs are free if the traffic stays within AWS. Sounds like your clients were EC2 instances so this wouldn't apply to you, would it?
Re:The AWS S3 Denial of Wallet Amplification Attack
by mikepurvis on Wednesday May 01, 2024 @05:17PM
(#40229558)
If it was a web application as stated in the GP, then it would indeed be egress as the request would be coming from a browser.
Re:The AWS S3 Denial of Wallet Amplification Attack
by nicklecompte on Wednesday May 01, 2024 @05:24PM
(#40229666)
Yes, it was client-side JavaScript making the range requests, asking for a string of genomic data to render in the browser. It was only to give the scientists a pretty picture :) The EC2 costs were largely ElasticSearch for a different function, which never looked at the data in S3.
It also seemed like the root cause was an interrupted range request (although I wasn't fully clear on that). Even so that seems like a recent regression. It took me ages to get that stupid app working, I interrupted a lot of range requests :)