Hacker News Reader

Comment by markuman123 | Hacker News Reader

AWS_PROFILE=broken aws s3 ls s3://deltars/simple/

14kb in your bucket and you pay for outgoing traffic. means, while you're sleeping, I can ruin your aws bill.

In any case, committing credentials is always wrong and you cannot justify it.

Depending on your ci tool (e.g. gitlab-runner, drone-ci ... ) there are other and better ways to provide credentials for a git project in CI/CD pipeline.

View on HN

You can run up charges by requesting files in any number of public buckets without the AWS keys. The AWS keys don't change the threat model in this situation.

that's the reason why should always use aws:kms encryption on s3.

Wait what? This conflates two entirely unrelated things.

Nope, because you just get a 404, even on public buckets, because you have no access to the kms key.

I know from your absolute conviction on this (coupled with LOTS of experience with people who have absolute conviction about stuff) that your own conviction is preventing you from seeing valid uses for this, and is potentially keeping you from seeing the 100% of the landscape you're professing about.

Sorry, I cannot follow.

To be clear, I'm no aws advocate.

There are real uses for AWS Buckets that are public and cost you money. Distributing files, acting as a webhost, anything that you’d use dropbox with link sharing for.

Yes, it sucks if someone randomly decides to download files from you all day. You should probably set your budget to alert and attempt to blacklist them when it happens. That’s rare, though, and aside from a few cases of actual malice, the convenience is worth the cost.

Not the poster, I assume their comment is in response to your

“Always”

You know that AWS is frequently used as (and has an entire product for use as) a CDN, right?

using s3 as a cdn is a complete different thing than leaking intentionally credentials.

He "leaked" credentials which only allow reading, which makes it effectively the same thing as a CDN, except that instead of needing a URL, you need a tuple of URL and access token.

Always wrong? No justification? This seems like a good justification to me. Is there any difference between running up the outbound traffic bill using the key vs accessing web assets anonymously? OP has a budget alert set.

but the budget alert is delayed...I bet you're ruined when you've noticed the alert.

Reply on news.ycombinator.com