<story><title>Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill</title><text>I have been seeing a lot of posts on Reddit and other forums of mostly students setting up an AWS account only for them to be hacked and account owner being stuck with a significant bill.&lt;p&gt;Most likely scenario is hackers are trying leaked username&amp;#x2F;password pairs from other breaches against AWS and gaining access to those accounts.&lt;p&gt;They then spin up EC2 instances in all sorts of regions on the compromised accounts&lt;p&gt;PSA set up MFA on your account if you haven&amp;#x27;t already.&lt;p&gt;Some examples:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;rv3lm5&amp;#x2F;i_lost_55k_from_hackers&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;rv3lm5&amp;#x2F;i_lost_55k_from...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;rvbncu&amp;#x2F;account_hacked_unable_to_sign_in_4000_in&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;rvbncu&amp;#x2F;account_hacked_...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;qx8i02&amp;#x2F;got_hacked_and_found_a_30k_bill_please_turn_on&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;qx8i02&amp;#x2F;got_hacked_and_...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;rv4mnq&amp;#x2F;my_account_was_hacked_and_now_my_bill_is_over&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;rv4mnq&amp;#x2F;my_account_was_...&lt;/a&gt;</text></story><parent_chain><item><author>ujetin</author><text>I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn&amp;#x27;t really fit into my use case. I tried to just shut down the services that were using money but wasn&amp;#x27;t even sure I had found them all so I just closed the whole account.&lt;p&gt;I don&amp;#x27;t even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, it seems much more fun and startupish than aws, which appears to be all of the corporate stuff I left (AIMs etc). This is funny because I remember AWS being thought of as great for &amp;quot;just experimenting with stuff&amp;quot;.</text></item></parent_chain><comment><author>stackbutterflow</author><text>It says here that closing your account isn&amp;#x27;t enough:&lt;p&gt;&amp;gt; Closing your account might not automatically terminate all your active resources. You might continue to incur charges for some of your active resources even after you close your account.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;aws.amazon.com&amp;#x2F;premiumsupport&amp;#x2F;knowledge-center&amp;#x2F;terminate-resources-account-closure&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;aws.amazon.com&amp;#x2F;premiumsupport&amp;#x2F;knowledge-center&amp;#x2F;termi...&lt;/a&gt;</text></comment>
<story><title>Tell HN: Rise in AWS accounts getting hacked and owner being stuck with the bill</title><text>I have been seeing a lot of posts on Reddit and other forums of mostly students setting up an AWS account only for them to be hacked and account owner being stuck with a significant bill.&lt;p&gt;Most likely scenario is hackers are trying leaked username&amp;#x2F;password pairs from other breaches against AWS and gaining access to those accounts.&lt;p&gt;They then spin up EC2 instances in all sorts of regions on the compromised accounts&lt;p&gt;PSA set up MFA on your account if you haven&amp;#x27;t already.&lt;p&gt;Some examples:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;rv3lm5&amp;#x2F;i_lost_55k_from_hackers&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;rv3lm5&amp;#x2F;i_lost_55k_from...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;rvbncu&amp;#x2F;account_hacked_unable_to_sign_in_4000_in&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;rvbncu&amp;#x2F;account_hacked_...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;qx8i02&amp;#x2F;got_hacked_and_found_a_30k_bill_please_turn_on&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;qx8i02&amp;#x2F;got_hacked_and_...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;rv4mnq&amp;#x2F;my_account_was_hacked_and_now_my_bill_is_over&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;aws&amp;#x2F;comments&amp;#x2F;rv4mnq&amp;#x2F;my_account_was_...&lt;/a&gt;</text></story><parent_chain><item><author>ujetin</author><text>I deleted my AWS account yesterday. It is obviously catered towards large organisations - very complicated tools and pricing that I couldn&amp;#x27;t really fit into my use case. I tried to just shut down the services that were using money but wasn&amp;#x27;t even sure I had found them all so I just closed the whole account.&lt;p&gt;I don&amp;#x27;t even like the idea of any of this stuff. I want to run my own little raspberry pi server or whatever, it seems much more fun and startupish than aws, which appears to be all of the corporate stuff I left (AIMs etc). This is funny because I remember AWS being thought of as great for &amp;quot;just experimenting with stuff&amp;quot;.</text></item></parent_chain><comment><author>thejosh</author><text>Yep, the only way to do this is using aws-nuke [0], and the billing is such a mess for small use cases.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;rebuy-de&amp;#x2F;aws-nuke&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;rebuy-de&amp;#x2F;aws-nuke&lt;/a&gt;</text></comment>