What to do if your AWS account is misused? We explain initial response, verification methods, and measures to prevent recurrence.

If you find unfamiliar charges or resource activity in your Amazon Web Services (AWS) account, or receive notifications about suspicious activity, it could be a sign of unauthorized use by a third party.

To prevent further damage, we will promptly implement initial response measures, such as addressing potentially leaked credentials and shutting down or isolating suspicious resources. Subsequently, we will use tools such as CloudTrail and GuardDuty to investigate the scope and cause of the damage and take steps to prevent recurrence.

This article explains how to check for suspected fraudulent activity, initial response procedures, investigation of the extent and cause of damage, handling of fraudulent charges, measures to prevent recurrence, and monitoring and operational systems.

Things to check when you suspect your AWS account has been misused.

Unauthorized use can be discovered through unfamiliar charges, resource usage, or notifications from AWS. First, check your billing, resource usage, and security notifications for any unusual activity.

Check for any unfamiliar charges or usage details.

Use AWS Billing and Cost Management or AWS Cost Explorer to check for any sudden increases in charges or for expenses incurred for services or regions you don't recall using.

If there are any services or regions that are not normally used that have increased in usage compared to the previous month, we will also check the related resources. However, since charges can also increase due to configuration changes or unexpected resource usage, we will not judge fraudulent use based solely on the billing amount, but will look at it in conjunction with other signs.

Check for any resources you don't recognize.

Check the AWS Management Console for any resources or IAM users that you don't remember creating. This includes not only the regions you normally use, but also regions you don't currently use.

In particular, you should check if a large number of Amazon EC2 instance or spot instance requests have been made in regions you don't normally use. Attacks have also been observed where compromised AWS credentials are used to build cryptocurrency mining environments on Amazon EC2 and Amazon ECS. In a case published by AWS in 2025, an attacker accessed the system with compromised IAM credentials and started running a cryptocurrency miner within 10 minutes.

If you find any suspicious resources, do not delete them immediately. Instead, record the service, region, creation time, and other relevant information.

Check notifications and security alerts from AWS.

If you receive a notification from AWS regarding suspicious activity, check the access key and resources involved, as well as the date and time of the incident.

If you are using Amazon GuardDuty, check for any findings indicating unauthorized activity or misuse of credentials. At this stage, the priority is to identify signs of misuse, and then investigate the details of the activity history and the scope of the damage using tools such as CloudTrail.

Initial response to AWS misuse

If there is a high probability of misuse, priority will be given to preventing further damage, such as addressing leaked authentication information and shutting down or isolating suspicious resources.

However, changing or deleting authentication information or resources may affect live systems and root cause investigations. We will proceed while recording all necessary information.

Disable or modify potentially leaked authentication credentials.

A Palo Alto Networks Unit 42 investigation revealed an instance where AWS IAM credentials published on GitHub were detected and exploited by an attacker within 5 minutes. If a data breach is suspected, take action without waiting for confirmation of the damage.

The IAM user's access key will be updated to the new key, the original key will be invalidated, the application and other functions will be verified to work correctly, and then the old key will be deleted.

IAM users may have an AWS managed policy called "AWSCompromisedKeyQuarantineV3" assigned to them. This policy is enforced by AWS if the IAM user's credentials are compromised or exposed, and is designed to limit the damage caused by misuse. Do not delete it on your own; follow the instructions in the AWS support case created for this issue.

If temporary credentials such as IAM roles are being misused, simply changing the access key will not suffice. Depending on the authentication method, you may need to revoke existing sessions as necessary.

Related article:Should you use AWS access keys? Mechanisms, risks, and secure IAM design

Verify the security of authentication credentials, including those for the root user.

If you find any root user access keys that you don't recognize, delete them. If you suspect a breach due to suspicious sign-ins, change your password. Also, check the MFA settings and make sure the email address used for account recovery hasn't been changed by a third party.

The basic practice is to not use the root user for normal operations and not create access keys for them. For member accounts managed with AWS Organizations, there are methods to centrally manage and delete root user credentials.

Stop and isolate suspicious resources to prevent further damage.

Even if we find suspicious resources, we don't necessarily delete them all immediately. Deleting them could result in the loss of information needed to investigate the cause and scope of the impact.

After recording the target and circumstances, choose the appropriate method from options such as isolation from the network, restriction of access rights, suspension, or deletion. 

Contact AWS Support

If you receive a notification from AWS regarding suspicious activity, please take the necessary action and then reply to us from the AWS Support Center with details of what you have done. 

Investigating the scope and causes of the fraudulent use.

After the initial response, logs and security detection results are used to identify the unauthorized operations, affected resources, and misused credentials.

Check for suspicious activity history in CloudTrail.

AWS CloudTrail allows you to investigate the users and roles involved during the suspected period of misuse, the APIs executed, the date and time, the AWS region, and the source IP address.

Additionally, check if the CloudTrail trail settings have been changed. Attackers may disable logging to avoid leaving traces, and Amazon GuardDuty has a finding that detects when CloudTrail logging has been disabled. Also, check if GuardDuty itself has been stopped or disabled.

CloudTrail event history allows you to view administrative events for the past 90 days in each AWS region. However, it does not display data events such as access to Amazon S3 objects. To investigate such events, you must have previously recorded the relevant data events in a trail or CloudTrail Lake event data store.

If a suspicious access key has been identified, tracking the actions performed with that authentication information can help narrow down when the unauthorized use began and what changes were made.

Related article:AWS Security Log Design Guide | Focusing on AWS CloudTrail: Separating "Audit Trails" and "Detection"

Check the detection results from GuardDuty and other tools.

If you are using Amazon GuardDuty, check the Findings for the period when fraudulent activity is suspected.

In Findings for suspected credential breaches, you can check the target access key, API operation, execution count, date and time, and originating IP address. There are also AttackSequence Findings that link multiple suspicious operations and show the sequence of attacks that exploited the credential breaches.

By cross-referencing with CloudTrail events, it becomes easier to track which credentials were used to perform an operation on which resource.

Identify the resources that were misused and the scope of the impact.

In addition to resources created, modified, or deleted due to misuse, the system also identifies changes to IAM users, roles, and policies, changes to existing resource settings, and access to data.

If a third party creates new credentials or permissions, the access path will remain even if the initially leaked credentials are invalidated.

The investigation results will be used for subsequent recovery efforts and information sharing with AWS support. 

Investigate the leakage route of authentication information and any configuration errors.

We identify the misused access keys, IAM users, and IAM roles, and trace which systems and applications used those credentials.

If you were using long-term access keys, investigate where they might have been exposed, such as embedded in source code, published to external repositories, or stored on your device or development environment.

In addition, we will check whether excessively broad IAM permissions were granted and whether any unnecessary users or access keys remained, in order to isolate the cause of the misuse.

What to do if you incur AWS usage charges you don't recognize

If you notice any charges you don't recognize, please review your usage and then contact AWS support. 

Check the charges and affected resources due to misuse.

Use AWS Billing and Cost Management or AWS Cost Explorer to organize the services, regions, and periods in which charges were incurred. 

Even for resources that have already been deleted, you will still be charged for usage prior to deletion. We will cross-reference this with CloudTrail operation history and other data to determine when the misuse began and the scale of the charges. 

Share the details of the misuse with AWS Support

For billing-related inquiries, you can create a case titled "Account and billing support" in the AWS Support Center. 

When making an inquiry, please have the following information ready.

• Date and time when fraudulent use was discovered

• Period during which suspicious activity was observed

• Target services and regions

• Unauthorized creation or modification of resources

• Confirmed usage fees

• potentially leaked authentication information

• Initial response completed

We will address the cause of the fraudulent use in conjunction with responding to the billing.

Even if you contact AWS support regarding the billing, there is a possibility of further misuse if the access path used by a third party remains on file.

We will restore your system after addressing the root cause of the misuse, such as leaked credentials or unnecessary IAM users.

Measures to prevent recurrence of misuse of AWS

After addressing the fraudulent activity, we review the authentication information and permissions that caused the problem and establish a system that allows for early detection of anomalies.

Set up MFA

Using MFA (Multi-Factor Authentication) makes it easier to prevent unauthorized sign-ins even if your password is compromised.

In particular, it protects the authentication of users with strong privileges. The root user of an AWS account requires MFA, and it should not be used in normal operation, but only for tasks that can only be performed by the root user.

If you are using multiple AWS accounts, you should also consider centralizing authentication management through AWS IAM Identity Center or an external identity provider.

Properly manage access keys and IAM permissions.

Remove unnecessary access keys and IAM users to reduce long-term reliance on credentials.

For human access, we use temporary credentials via an identity provider, and for workloads, we use temporary credentials such as IAM roles. IAM permissions are based on the principle of least privilege, allowing only the necessary operations, and we regularly review them to ensure that no unnecessary users, roles, policies, or credentials remain.

Continuously monitor for anomalies using tools like CloudTrail or GuardDuty.

This allows you to save and analyze CloudTrail logs, enabling you to track suspicious activity.

GuardDuty ensures that when a critical finding occurs, the responsible person is notified and can begin taking action.

Early detection of abnormalities in usage charges

Unauthorized use can lead to a surge in usage fees due to the creation of a large number of resources. AWS Cost Anomaly Detection can detect unusual spending patterns and notify you via email, Amazon SNS, and other means.

AWS Budgets allows you to receive notifications when actual or predicted values ​​exceed set thresholds.

A robust monitoring and operational system is also crucial for responding quickly to misuse.

Even with AWS security services in place, delays in response can occur if there are no designated personnel to monitor alerts or established response procedures. It's crucial to define monitoring times, roles, and response procedures so that investigation, containment, and recovery can begin immediately after notification. 

Establish a monitoring system that can detect anomalies early.

If a critical alert occurs outside of business hours and is not addressed by the next business day, the damage may escalate during that time.

Based on the importance of the system, the data it handles, and the acceptable response time, we determine the time period during which monitoring will be conducted, including nights and holidays.

Determine the response procedures and roles when an alert occurs.

In addition to identifying the person in charge, escalation destination, and contact method, we will organize the response procedures for each anticipated event, such as invalidating authentication credentials or isolating resources. 

The AWS Well-Architected Framework recommends creating playbooks to prepare for security incidents, outlining procedures for detection, analysis, containment, threat elimination, and recovery. These procedures should be reviewed and regularly trained to reflect changes in personnel and the AWS environment. 

If it is difficult to handle the situation in-house, utilize external operational support services.

If it is difficult to continuously perform 24/365 monitoring and incident investigation and response in-house, you can utilize external operational support, such as managed security services compatible with AWS environments.

When choosing an external service, check the monitoring time period, target services, scope of response after an alert occurs, and whether it is compatible with your company's AWS environment and region.

Summary

If you suspect unauthorized use of your AWS account, prioritize addressing the compromised credentials and stopping or isolating any suspicious resources. After that, use tools like CloudTrail or GuardDuty to investigate the extent of the damage and its cause.

After recovery, we will review authentication, permissions, and monitoring to prevent recurrence via the same route. Additionally, by defining who will make decisions and take action when an anomaly is detected, we can facilitate early detection of misuse and prevent further damage.