If you’re dealing with a serious account compromise on your child account, here’s a clear way to handle the situation quickly and effectively.
First, recognize the signs of a compromise. In this case, the issue was caused by a stale domain takeover, which led to unauthorized charges exceeding $2,000 on Amazon Bedrock services. The moment you notice unusual activity or unexpected charges, take immediate steps to contain the damage.
To stop further unauthorized access, you should apply a broad service control policy. For example, setting a policy like ‘Deny all’ across your account can restrict any potential malicious activity. Confirm that the access has been successfully blocked and secure your root email account to prevent unauthorized login attempts.
Monitoring your account closely is essential. Tools like AWS Budget alerts can help detect unusual spending patterns quickly. In this case, an alert was triggered at the $100 threshold, allowing for rapid response.
If the damages are significant and the billing cycle is near, it’s crucial to escalate the issue. Contact AWS Support promptly and request that your support case be flagged for priority review. Reach out to AWS Trust & Safety or Billing teams to request a temporary hold on charges and a review for potential billing waivers. Providing all relevant details and evidence of the compromise can help expedite the process.
Taking these steps ensures you can contain the issue swiftly and work towards resolving any fraudulent charges. Remember, acting quickly and involving the right support teams is key to protecting your account and finances.