Is there any charge for 403 requests over S3 bucket?

Please refer this S3: Error responses, which suggests that:

      - In general, S3 bucket owners are billed for all the requests with HTTP 200 OK successful responses, HTTP 3XX redirection responses, and HTTP 4XX client error responses, such as HTTP 403 Forbidden errors. You aren't billed for HTTP 5XX server error responses, such as HTTP 503 Slow Down errors. For more information on Requester Pays buckets, see [How Requester Pays charges work](https://docs.aws.amazon.com/AmazonS3/latest/userguide/RequesterPaysBuckets.html#ChargeDetails) in the Amazon S3 User Guide.

It might be possible that someone makes a large number of invalid requests against the bucket knowingly, in those cases, you can reach out to AWS Support explaining the situation and request for credit/refund, which would be subjected to AWS decision. Also, if you have Enterprise on Ramp or Enterpris support plan, you can also reach out to your account team for official response to that blog. See AWS support Plan Comparison for more details about various support plans.

Comment here if you have additional questions, happy to help.

Abhishek

I believe you are referring to this post? The short answer is Yes since 403 is a client side request. Jeff Barr has responded to this concern as below:

"Thank you to everyone who brought this article to our attention. We agree that customers should not have to pay for unauthorized requests that they did not initiate. We’ll have more to share on exactly how we’ll help prevent these charges shortly."

So please stay tuned for any follow-up announcement.

AWS is aware of the recent Medium blog post, titled "How an empty S3 bucket can make your AWS bill explode." We agree that customers should not have to pay for unauthorized requests that they did not initiate. We’ll have more to share on exactly how we’ll help prevent these charges shortly.

Today, you pay for requests made against your S3 buckets and objects. You are billed for requests with HTTP 200 Success responses, all HTTP 3xx redirects, and all HTTP 4xx errors, such as a HTTP 403 Access Denied Errors. You are not billed for 5xx server-side errors, such as HTTP 503 Slow Down responses [1].

While it is possible for an application to erroneously make a large number of requests against the bucket owner, you can request a service credit/refund by contacting AWS Support if you have incurred unexpected S3 request charges as a result of unauthenticated requests made against your S3 resources.

To monitor requests and request billing for your S3 responses, you can use detailed CloudWatch request metrics [2], CloudTrail Data Events [3], and/or S3 Server Access Logs [4].

[1] https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html [2] https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudwatch-monitoring.html [3] https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging.html [4] https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html