- 최신
- 최다 투표
- 가장 많은 댓글
<<First of all, I'd suggest you to remove your gmail id from here>>
-
This is important one: Contact AWS Support and explain your situation in precise way, they are well equipped and surely be able to help you out recovered from this situation.
-
Meanwhile follow I don't have access to the email for my AWS account and see if you can resolve it by your own.
Reference:
What to do after this issue gets resolved:
Once you can access the account, then here are the action items, that you need to take care of immediately:
IAM User Revoke Session Temporary Credentials
Deactivate IAM User access keys
There may be other users/roles might also exist, which would have been created under this account compromise incident. Make sure no IAM user or role exists which you haven't created.
To identify all those suspicious activities, follow this Knowledge Center Article for best practices so that it doesn't happen again. Also, check if you see any suspicious activity in cloudtrail.
Have MFA enabled on IAM users/roles for an additional layer of protection.
Hope this helps.
Comment here if you have additional questions, happy to help.
Abhishek
I disagree with contacting abuse@amazonaws.com. AWS Trust and Safety does not manage security breaches, nor conducts auditing for account access.
Thank you David for pointing that out, I should rather not mention that as that may not exactly apply. Reason for mentioning that was, I've seen a case where a hacked account was used in abusive activities, specially for sending explicit emails.