<story><title>Using a single AWS account is a serious risk</title><url>https://cloudonaut.io/your-single-aws-account-is-a-serious-risk/</url></story><parent_chain><item><author>impostervt</author><text>About three weeks ago I started working on a new open source project meant to interact with AWS. Coding fast and dumb, I cut and pasted my personal AWS credentials into my source code, committed it, and pushed it to Github.&lt;p&gt;The next day I got an email from Amazon, alerting me to the problem. Apparently, they scrape github looking for just that kind of stupidity. I instantly deleted the project, but it was too late.&lt;p&gt;Amazon ended up waving the nearly $3k in EC2 charges I incurred, thankfully. I&amp;#x27;m now a zealous advocate for making sure a person never even HAS AWS credentials. Instead, make a new user without a password for each use case, and manually select the privileges that account has.&lt;p&gt;If you have a password to AWS, you shouldn&amp;#x27;t have credentials.</text></item></parent_chain><comment><author>e40</author><text>I posted to the AWS forum and accidentally copy&amp;#x2F;pasted my secret key.  Within 24 hours $11k of charges.  I called them, they wiped them.  It&amp;#x27;s amazing how quickly people find and use these things.&lt;p&gt;What kills me is there is no easy way to stop &lt;i&gt;all&lt;/i&gt; the instances for an account, in a region.  It took me hours to kill all the instances.  They had maxed out the number of instances in every single region.  Very, very annoying.</text></comment>
<story><title>Using a single AWS account is a serious risk</title><url>https://cloudonaut.io/your-single-aws-account-is-a-serious-risk/</url></story><parent_chain><item><author>impostervt</author><text>About three weeks ago I started working on a new open source project meant to interact with AWS. Coding fast and dumb, I cut and pasted my personal AWS credentials into my source code, committed it, and pushed it to Github.&lt;p&gt;The next day I got an email from Amazon, alerting me to the problem. Apparently, they scrape github looking for just that kind of stupidity. I instantly deleted the project, but it was too late.&lt;p&gt;Amazon ended up waving the nearly $3k in EC2 charges I incurred, thankfully. I&amp;#x27;m now a zealous advocate for making sure a person never even HAS AWS credentials. Instead, make a new user without a password for each use case, and manually select the privileges that account has.&lt;p&gt;If you have a password to AWS, you shouldn&amp;#x27;t have credentials.</text></item></parent_chain><comment><author>scott_karana</author><text>&amp;gt; Amazon ended up waving the nearly $3k in EC2 charges I incurred, thankfully&lt;p&gt;For what it&amp;#x27;s worth, the word is &amp;quot;waived&amp;quot;. :-)&lt;p&gt;I&amp;#x27;m glad Amazon dealt with you well!</text></comment>