Comment by cosud

I was in the same situation as OP a few months back. My bill was $3000 after creating a "vanity bucket" which saw 500M accessed denied POST calls over a month. I took a while to get a one time refund.