I've recently been working to create a CentOS 6.4 Amazon machine image (AMI) from scratch to be used as a base image for running Postfix email services on EC2. In my quest to learn the process, I started by using the EC2 API's ec2-import-volume
command to import the disk images I've built.
After having several attempts fail at registering and running AMIs from my uploaded images, I had deleted several GB of files from these uploads that I no longer needed in order to reduce usage costs.
Throughout this process, I've been watching my AWS costs closely and noticed recently that I've been accumulating charges daily for S3 requests that I can't account for.
Today, I found my bill to be about $30 higher than I expected and downloaded a usage report to investigate. It shows hundreds of megabytes worth of requests for today alone to an empty bucket that I used more than a day ago with the import command.
Not understanding where these requests are coming from, I enabled S3 logging for that bucket and waited for logs to appear. And they did...megabytes worth, all showing HEAD requests for parts uploaded to S3 by the import command issued days ago and coming from ec2-54-244-xxx-xxx.us-west-2.compute.amazonaws.com
with a user agent like JetS3t/0.8.0 (Linux amsz-x.x.x.x; amd64; JVM 1.6.0_20)
.
Some context:
- I'm the only one with access to the problem bucket
- I had no running EC2 instances or anything else related to S3 when the requests occurred
- The user agent on the logged requests doesn't describe an instance I recognize
Where are all these requests being generated?