By using AWS re:Post, you agree to the Terms of Use

"Action Required: Irregular activity in your AWS account." I'm unable to do anything.


Two days ago I got an email saying my AWS account may be compromised, so I have to take immediate action. Sounded quite urgent, so I changed my password, deleted a couple policies, but didn't find any unauthorized account access- I think the system just flagged me because I recently started a new project so I've been creating a lot of new resources.

Since my account was locked, I'm unable to access Lambda at all, the dashboard just reads "You do not have sufficient permission. Access denied." I can't do anything until this "urgent matter" is resolved.

I responded to the support ticket that I've done everything that was asked of me, been inquiring every day since then, but have received no help at all apart from being told that they're investigating. They have told me there's no time frame for resolving this, since the service team might not be available to me.

As far as I can tell, I'm just completely blocked from using AWS Lambda due to being incorrectly flagged, until someone gets around to fixing it. Is there anything I can do?

2 Answers

Try this here to see if it help

profile picture
answered 9 days ago

Hello there,

I understand you are facing issues with accessing resources on your account.

Usually when this warning is triggered, the specific IAM users or even the root users are denied access to the account to prevent any further damage or abrupt charges to the account prior to confirming the account is secure.

In your case, I understand that this might be a false alarm since you have investigated and found no compromise activity.

I would recommend you do the following:

  • Raise a chat contact on the same support case
  • Request the connected engineer to expedite the review of your account's security as it is impacting your project

Further, the engineer will reach out to the appropriate team and have this expedited.

The dedicated team experiences high case volumes and it is the reason why they are not able to provide you a confirmed SLA. However, you can reach out to the support engineers and ask it to expedited. Please note that there is no fixed SLA for expedited requests either. The engineers will try their best to have it updated within 24 to 48 hours.

Hope I have been helpful.

Take care.

profile picture
answered 9 days ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions