THE AWS S3 DENIAL OF WALLET AMPLIFICATION ATTACK

Summary from the TLDR InfoSec newsletter

A novel attack method on AWS allows attackers to create a large amount of RANGE requests for parts of large (>1GB) files before quickly canceling the request. This bills owners for the full request, which can result in a 50x cost amplification. This post discusses defenses against this attack and why current remedies fail.