5

I developed an open source library and hosted its assets on Amazon S3 (CSS, JS), these files were used in demo via URLs like: http://my_bucket_name.s3.amazonaws.com/some-file.js (my bad, I know). Without my permission, some websites started hot-linking these files.

It was fine for a while, but recently a few large NSFW sites hot-linked it and I get tens of millions GET requests in a month. So I deleted/moved these files, but I still get a lot of GET requests that return 403 errors, and Amazon bills them as a valid requests (see Charge Details section).

  • I tried contacting sites that hotlinked my library, but never got any reply.
  • I'm worried that if I delete the bucket "my_bucket_name", someone else might create it with the same name and hotlink malicious JS files.

What should I do to avoid getting billed for error requests that I don't make?

  • Why did you enable requester pay ? Maybe you could turn that bucket to private using bucket policy. / an advice always use proxy front s3 so you can manage your requesters and block bad ones. – pmoksuz Oct 9 '16 at 7:24
  • Are you sure that modifying bucket policy would make any difference? All files in a bucket are already private or deleted and no one can access them. Yea, I know that I should've used proxy in front of s3, but I didn't... Thank you for reply. – Marvin3 Oct 9 '16 at 7:43
  • 1
    Just nuke the whole bucket. That'll put a stop to it. – Michael Hampton Oct 9 '16 at 7:50
  • 1
    Once you delete the bucket it's not your problem any more. S3 will send 404 responses and people will stop using it, the problem will go away. – Tim Oct 9 '16 at 8:03
  • 2
    And you aren't responsible for maintaining other people's web sites. – Michael Hampton Oct 9 '16 at 8:40
1

You can either:

  • Delete the bucket
  • or disable static website access to the bucket and keep the bucket. Then use a new bucket.

You might want to add a policy to this bucket to restrict the access to the bucket, e.g. Restricting Access to a Specific HTTP Referrer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.