Skip to content

AWS Account Suspension Locked Hundreds of Client Private Keys in KMS — No Support, No Solution

0

I run a cryptocurrency trading platform that relies entirely on AWS infrastructure. Our clients' private keys are securely stored in AWS KMS, and our platform provides 24/7 access to these keys. Without any prior warning or adequate notice, AWS suspended our account over an unpaid invoice of approximately $275. As a result, our entire platform went offline, and hundreds of clients lost access to their wallets and private keys — keys that are locked inside AWS KMS with no way to retrieve them. We immediately attempted to resolve the payment. Multiple credit cards were declined by AWS's payment system despite being valid and functional elsewhere. We contacted AWS Support, but responses were slow, unhelpful, and did not match the urgency of the situation. We were given a deadline of February 26th, but no workable payment method was offered. Let me be clear about the severity: AWS is holding our clients' private keys hostage over a $275 invoice that we are actively trying to pay but cannot because of their own payment processing issues. These are not recoverable assets — if we permanently lose access to KMS, our clients lose their funds. This experience has exposed a critical flaw in relying on a single cloud provider for sensitive cryptographic operations. AWS showed zero consideration for the downstream impact on end users, zero urgency in resolving a payment processing failure on their end, and zero flexibility in providing alternative payment options. Has anyone experienced a similar situation? Any advice on escalating beyond standard support channels would be appreciated.

1 Answer
2

Below may be the reasons that the AWS Account is being suspended:

  • Account suspension: If an AWS account is suspended (for example, due to non-payment), access to all AWS services is blocked until the account is reinstated. This includes AWS Key Management Service (KMS).
  • KMS keys: Customer-managed keys in AWS KMS are stored in FIPS 140-3 validated hardware security modules (HSMs). These keys never leave AWS KMS unencrypted, and you cannot export them. If your account is suspended, you lose the ability to call KMS APIs, meaning you cannot decrypt or sign data with those keys.
  • No bypass: AWS documentation makes clear that there are no implicit or automatic permissions to use or manage a KMS key; all access requires valid AWS credentials and an active account. If the account is locked, the keys are effectively inaccessible until the suspension is lifted.

https://docs.aws.amazon.com/kms/latest/developearguide/overview.html

https://docs.aws.amazon.com/prescriptive-guidance/latest/aws-kms-best-practices/access.html

EXPERT

answered 8 months ago

AWS
EXPERT

reviewed 8 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.