Thread by @QuinnyPig

Let's do an @awscloud experiment with our friends at @github.

I have pushed a set of API credentials to a public repository. Oh no! Specifically at Mon Jun 21 23:08:12 UTC 2021.

I immediately received an email from @github after the push--to tell me that the authentication token for Github that I was using is out of date and should be updated. (This was called via their old "hub" CLI).

And at 17 past the hour I get my first call from a remote IP in the UK. It's a ListBuckets call.

Three minutes later it's followed up by a "DescribeKeyPairs" call from the same IP. No word from GitHub yet.

Now a call to ListTables. All the same IP so far. Someone's sleeping on the job!

Now an attempt from an internal AWS IP attempting to `AttachUserPolicy`. It doesn't succeed.

(The keys aren't from an account I control at the moment; there may well be a shutoff switch AWS hit somewhere).

Another call from that same UK IP, and a new one from a new IP for ListBuckets. User agent string is Windows. Surprise surprise.

I have deleted the keys. Will retry this with an account I have better visibility into at some point. But it's an instructive example of CloudTrail report times improving!

All right, retrying it. Within a minute I have a pair of emails from @awscloud telling me that they've opened a support case.

...does AWS somehow think that this automatically attached IAM policy captures all of the billable calls, because it falls hilariously short.

"Mine bitcoin on Fargate," anyone?

I had to respond to an emergency @awscloud-opened support ticket. "Don't worry, I'm doing this on purpose" probably fails to reassure @awssupport.

@awscloud @AWSSupport I found my existing IAM policy reasonably comprehensive:

Curiously an assumed-by-support role just queried a bunch of things in rapid sequence; effectively trying to see if new instances, volumes, snapshots, or images had been created. They attempted a "list" of all of those.

This makes sense and is disclosed at docs.aws.amazon.com/awssupport/lat…

And thus ends the experiment. Unwound everything I spun up. Until next time!

Or not; @awssupport has forcibly reopened the ticket on the deleted user and credential set which never had permissions to do anything.

I'm making someone's day actively worse, aren't I...