News for hackers. Stuff that matters.

A comment on The AWS S3 Denial of Wallet Amplification Attack. Parent comment

Re:The AWS S3 Denial of Wallet Amplification Attack by nielsole on Wednesday May 01, 2024 @05:08PM (#40229446)
S3 egress costs are free if the traffic stays within AWS. Sounds like your clients were EC2 instances so this wouldn't apply to you, would it?
[ Parent | on HN ]
Re:The AWS S3 Denial of Wallet Amplification Attack by mikepurvis on Wednesday May 01, 2024 @05:17PM (#40229558)
If it was a web application as stated in the GP, then it would indeed be egress as the request would be coming from a browser.
[ Parent | on HN ]
Re:The AWS S3 Denial of Wallet Amplification Attack by nicklecompte on Wednesday May 01, 2024 @05:24PM (#40229666)
Yes, it was client-side JavaScript making the range requests, asking for a string of genomic data to render in the browser. It was only to give the scientists a pretty picture :) The EC2 costs were largely ElasticSearch for a different function, which never looked at the data in S3.
[ Parent | on HN ]
Re:The AWS S3 Denial of Wallet Amplification Attack by belter on Thursday May 02, 2024 @04:14AM (#40233855)
> S3 egress costs are free if the traffic stays within AWS

Not if it's cross-region.

[ Parent | on HN ]