Urgent: Unauthorised Access to AWS Account – Security Breach & Unexpected Charges

Hello.

I think the contents of the following document will be helpful.
https://repost.aws/knowledge-center/potential-account-compromise

Identify the IAM user used for unauthorized access from CloudTrail, and check the API history from CloudTrail to see if that IAM user has created any other AWS resources.
If you can identify the AWS resources created during unauthorized access, you will delete them all.

Preventing further unauthorized access: What immediate steps should I take to secure my account? I have deleted all IAM users and keys and credentials, what else to do? Are there any recommended security best practices I should implement?

Please make sure to change the passwords of IAM users and root users, and set up MFA.

Handling the charges: Will AWS be able to waive the charges for unauthorized activity? What is the process for requesting a refund or credit due to security breaches? This is an urgent matter, and I would appreciate your guidance on next steps as soon as possible.

If you experience unauthorized access, please contact AWS Support by opening a case under "Account and billing".
Inquiries under "Account and billing" can be made free of charge.
Although the full amount is not guaranteed, a portion may be refunded.
You can contact AWS Support from the URL below.
https://console.aws.amazon.com/support

This is a critical security issue and re:Post is not the best place to get a rapid response to your questions. Please raise a support case about this issue. Our support team operates 24x7 and treat security issues with the highest priority.

Most of your questions can be answered by using CloudTrail and the team can help you do that and identify next steps.

Do you have a example script or any knowledge base on how to create this script and how to run it.

Created with Python.
I think running this for each region will solve the problem.
You can delete a security group by running the code below.
For "default_security_group_id", enter the default security group ID of the VPC.
Default security groups are excluded because they cannot be deleted.

import boto3

ec2 = boto3.client('ec2')

# default security group id
default_security_group_id = 'sg-yyyyyyyyy'

def delete_security_groups():
    next_token = None
    while True:
        if next_token:
            response = ec2.describe_security_groups(NextToken=next_token)
        else:
            response = ec2.describe_security_groups()

        security_group_ids = [sg['GroupId'] for sg in response['SecurityGroups']]

        security_group_ids_to_delete = [sg_id for sg_id in security_group_ids if sg_id != default_security_group_id]

        for sg_id in security_group_ids_to_delete:
            try:
                ec2.delete_security_group(GroupId=sg_id)
                print(f"Deleted Security Group with ID: {sg_id}")
            except Exception as e:
                print(f"Failed to delete Security Group with ID {sg_id}: {e}")

        if 'NextToken' in response:
            next_token = response['NextToken']
        else:
            break

delete_security_groups()

You can delete a key pair by running the code below.

import boto3

ec2 = boto3.client('ec2')

response = ec2.describe_key_pairs()

key_pair_names = [kp['KeyName'] for kp in response['KeyPairs']]

for key_pair_name in key_pair_names:
    try:
        ec2.delete_key_pair(KeyName=key_pair_name)
        print(f"Deleted Key Pair: {key_pair_name}")
    except Exception as e:
        print(f"Failed to delete Key Pair {key_pair_name}: {e}")

I have currently thousands of key pairs and security groups on each region. I also have two instances each on each region which i terminated. I don't know how will i be able to delete all the key pairs and security groups which is a tides process for me. Is there a automated way to get this resolved?

Additionally, i want to find who was involved in this security breach, which ip, region etc.