“Amazon S3 will make a change so unauthorized requests that customers did not initiate are free of charge.”
Until now, a stranger hammering your private bucket with requests that came back 403 Access Denied ran up your bill. AWS charged the victim for traffic it refused to serve. The fix only covers requests from outside your own account or Organization, and the full list of exempt error codes sits in a separate billing doc. Billing people for attacks they never initiated was the policy for years, and nobody at AWS called it a bug until customers did.