Skip to content

Recommendations & Tips

Beware 'denial of wallet' attacks on S3 buckets

ToolsWatch your object-storage bill for 'denial of wallet'

you still get charged for puts for AWS Object Object Storage put operations even if they fail. So basically some use somebody can just flood a bucket of yours with failed puts and rack up 1000s of dollars in charges

Episode 179: Swiss Army App (episode page, opens in a new tab) May 10, 2024, 2:53 p.m. CT 00:48:45 (play audio from this timestamp, opens in a new tab)

Speaker-labeled

Summary

A newer class of attack: AWS charges for object-storage PUT operations even when they fail, so anyone can flood your bucket with failed PUTs, even a private bucket, and rack up thousands of dollars. Dave advises keeping it in mind and watching your bill. If you're targeted, you may have to ask Amazon to waive the charges.

Not in the audio. This reflects AWS billing behaviour as Dave described it in 2024. AWS has since said it changed S3 billing for unauthorized requests; check current terms.