S3 - How do we protect ourselves from a malicious user refreshing a page a million times in order to rack up an AWS S3 Bill?

Certainly! Protecting your AWS resources from potential abuse is crucial. Here are some strategies you can employ to safeguard your S3 resources:

AWS Budgets:

• You can set up AWS Budgets to alert you when your estimated charges exceed your predefined thresholds. While it won't automatically disable requests, it will notify you so you can take action.
• Navigate to the AWS Budgets Dashboard and create a budget for your S3 service. Set up alerts to notify you when your usage or costs exceed the thresholds you've set.

CloudFront with WAF:

• Instead of serving your S3 objects directly, use Amazon CloudFront to distribute the content.
• With CloudFront, you can integrate AWS WAF (Web Application Firewall) which allows you to create rules to block or allow requests based on certain conditions like IP addresses, HTTP headers, or request rates.
• Using AWS WAF, you can set up rate-based rules to block IP addresses that exceed a certain number of requests in a 5-minute window.

S3 Bucket Policies:

• You can set up bucket policies to restrict access based on certain conditions. However, note that S3 bucket policies don't support rate-limiting based on IP. They can be used to restrict access based on other conditions like the referrer header.

Pre-Signed URLs:

• Instead of making your objects publicly accessible, use pre-signed URLs. These are temporary URLs that provide access to an S3 object for a limited time. This way, even if someone tries to refresh multiple times, the URL will expire after a certain period.

Monitoring with CloudWatch:

• Use Amazon CloudWatch to monitor your S3 request metrics. Set up alarms to notify you when there's an unusual spike in GET requests or other suspicious activities.

Educate and Inform Users:

• Sometimes, users might not be aware of the costs associated with excessive requests. Consider adding a note or tooltip in your application to inform users about the potential costs and ask them to avoid unnecessary refreshes.

Caching:

• Implement caching mechanisms, such as using the Cache-Control header, to reduce the number of requests to S3. This way, repeated requests can be served from the cache rather than hitting S3 directly.

Remember, while these strategies can help mitigate the risk, it's essential to monitor your AWS usage and costs regularly. AWS provides various tools and services to help you keep track of your spending and usage, so make sure to leverage them to avoid unexpected charges.

Hi,

AWS Web Application Firewall and AWS Shied are the solutions that you want to use for this purpose:

• https://aws.amazon.com/waf/
• https://aws.amazon.com/shield/

as the attack that you present is close in spirit to a DDoS attack.

See those blog posts about implementation for your use case:

1. https://aws.amazon.com/blogs/architecture/mitigating-ddos-with-data-science-using-aws-shield-advanced-and-aws-waf/
2. https://aws.amazon.com/blogs/security/using-aws-shield-advanced-protection-groups-to-improve-ddos-detection-and-mitigation/

Best,

Didier