AWS patches S3 storage flaw that racked up huge bill for customer

The logo of AWS, developer of Amazon S3 storage range, pictured at Web Summit in Lisbon.
(Image credit: Getty Images)

AWS has fixed an Amazon S3 storage flaw that cost one customer thousands in compute bills after they were hit with unauthorized requests. 

The problem affected S3 buckets in particular, with third party access requests inadvertently sent to storage systems which the customers was then charged for.

This AWS customer, Maciej Pocwierz, blogged his experience of the bug, explaining how he created a single S3 bucket and then uploaded some files for test purposes.

“Two days later, I checked my AWS billing page, primarily to make sure that what I was doing was well within the free-tier limits. Apparently, it wasn’t. My bill was over $1,300, with the billing console showing nearly 100,000,000 S3 PUT requests executed within just one day!,” Pocwierz said. 

In his explanation, Pocwierz described how the unknown actor used a popular open source tool which, by default, was set to store backups in S3. The bucket name used for backups in this case was identical to the name of Pocwierz’s bucket. 

Even though these requests were denied, Pocwierz was still charged by AWS and he reportedly received a message from the firm at the time describing this as “expected behavior”. AWS did, however, proceed to cancel Pocwierz's S3 bill.

Other users took to social media to talk about the mishap, with one going as far as to exclaim “I can’t believe this is true”.

“Wow. That all sounds pretty painful, and I’m surprised AWS doesn’t have a process in place to tackle this scenario,” wrote another to Reddit. 

AWS has now fixed the issue, however, with the company confirming that it will no longer be charging for “Access Denied” error responses if they have been initiated from outside an AWS account.

“Amazon S3 will make a change so unauthorized requests that customers did not initiate are free of charge,” the firm stated.

RELATED WHITEPAPER

AWS’ chief evangelist Jeff Barr took to X to provide confirmation of the firm’s move, telling customers to be wary that the rollout would take a few weeks to complete across all regions.  

“We’ve started deploying changes to Amazon S3 to make unauthorized requests with certain error codes which were not initiated by you to be free of charge,” Barr said.

George Fitzmaurice
Staff Writer

George Fitzmaurice is a staff writer at ITPro, ChannelPro, and CloudPro, with a particular interest in AI regulation, data legislation, and market development. After graduating from the University of Oxford with a degree in English Language and Literature, he undertook an internship at the New Statesman before starting at ITPro. Outside of the office, George is both an aspiring musician and an avid reader.