Tobias Schmidt @tpschmidt.com ยท Jun 6 $97,000 AWS bill in 48 hours. Hacked account, Bedrock API, ~2 million tokens per minute. I guess long-lived access keys made it possible! ๐ Here's what actually protects you: 1. ๐๐ถ๐๐ฐ๐ต ๐น๐ผ๐ป๐ด-๐น๐ถ๐๐ฒ๐ฑ ๐ฎ๐ฐ๐ฐ๐ฒ๐๐ ๐ธ๐ฒ๐๐
0 likes 1 replies
?
Replies
Switch to IAM Identity Center. Short-lived credentials only. If a key leaks, it expires on its own. 2. ๐ฆ๐๐ฃ๐ ๐๐ผ ๐ฏ๐น๐ผ๐ฐ๐ธ ๐๐ฒ๐ฟ๐๐ถ๐ฐ๐ฒ๐ ๐๐ผ๐ ๐ฑ๐ผ๐ป'๐ ๐๐๐ฒ If your team doesn't use Bedrock, ban it at the org level. No leaked credential can touch what's blocked entirely.