xeraa, 
turns out, you pay for every S3 request — even if it's returning an AccessDenied. just by knowing a bucket name (or picking one that's configured elsewhere) you can incur significant cost. "fun" story: https://medium.com/@maciej.pocwierz/how-an-empty-s3-bucket-can-make-your-aws-bill-explode-934a383cb8b1
guess security through obscurity still has value ;)