An empty S3 bucket can make your AWS bill explode

29 benterix 7 9/7/2025, 6:06:39 PM medium.com ↗

Comments (7)

Dylan16807 · 20h ago
cactacea · 20h ago
I always recommend using random strings for bucket names. If you want/need it to be human readable then use a random suffix instead.
leptons · 21h ago
The article is from April 2024, and AWS announced it would stop stopped charging the account owner for bad/unauthorized requests to S3 as of May 2024.

https://aws.amazon.com/about-aws/whats-new/2024/08/amazon-s3...

awirth · 8h ago
It's been a year. Has it been disclosed what tool had this misconfiguration?
jauntywundrkind · 17h ago
One of the items off the Serverless Horrors submission from today.

https://serverlesshorrors.com/all/aws-13k/ https://news.ycombinator.com/item?id=45157110

As noted in comments, AWS no longer charges for bad/unarhorized requests. https://aws.amazon.com/about-aws/whats-new/2024/08/amazon-s3...

The Serverless Horrors submission has some pretty amazing scenarios in it. Truly scary surprises!

cutler · 20h ago
It's simple - stop using AWS ... or Azure ... or ... Follow DHH and learn to manage your own boxes.
spwa4 · 19h ago
TLDR: any kind of usage based billing, where you don't control the usage, will have issues of cost explosions. It doesn't matter much what it is exactly.

Get your own machines. Get colo instead of cloud.