S3 charges for unauthorized requests (4xx) as well[1].

AWS is aware of this and are working on a solution.

https://twitter.com/jeffbarr/status/1785386554372042890

https://www.linkedin.com/posts/jeffbarr_how-an-empty-s3-bucket-can-make-your-aws-activity-7191190505425113088-_mS0

You're highlighting a valid concern about the potential for unauthorized access to S3 buckets leading to unexpected charges, particularly if it results in a DDOS attack. While AWS does charge for unauthorized requests, While AWS does charge for unauthorized requests, there are several measures customers can take to mitigate this risk: DDOS Protection: Consider using AWS Shield, a managed Distributed Denial of Service (DDoS) protection service, to help protect against and mitigate DDOS attacks targeting your S3 buckets.

Amazon S3 Block Public Access: https://aws.amazon.com/s3/features/block-public-access/ Security best practices for Amazon S3: https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html Preventing unauthorized access and data exfiltration: https://docs.aws.amazon.com/whitepapers/latest/logical-separation/mitigating-unauthorized-access-to-data.html

Is this temporary workaround for private bucket?

https://docs.aws.amazon.com/AmazonS3/latest/userguide/RequesterPaysBuckets.html