AWS Abuse Report - Never got one of these before

Some additional guidance if you need it:

• You don't mention if you replied back to the Abuse report email. If not, do make sure to reply and let them know the actions you have taken so far and any additional actions you plan to take. This is to ensure the Abuse team do not take further action against your account because they had not heard back from you.
• Some websites with forum/social features will do automatic link expansion when someone posts a URL in a chat. This requires the server to make outbound connections to download a preview of the page. This can cause unexpected patterns of outbound web traffic from your server. If you have such features on your site consider disabling them.
• You do not mention how you keep your WordPress application up to date or what plugins it has. In my experience the most critical part of keeping this application secure is rigorously keeping it updated and being very careful which plugins you install. You can get guidance on this from https://wordpress.com/support/security/ as well as many other third-party guides for running WordPress.
• To eliminate any malicious changes to the underlying host you can to backup the WordPress data, redeploy a new LS instance, disable IPv6 from the beginning, ensure all components are fully patched, apply the appropriate network security layers, then restore your backup, update DNS to point to the new server and see if the problem recurs. You can delete the original instance, although you can keep it offline and investigate further but this will add to your costs.
• If this still does not resolve the issue the next steps I'd recommend would be deploying additional tools to get low-level visibility into your network traffic, such as VPC FlowLogs, AWS Network Firewall and enabling both the Amazon GuardDuty service and the Amazon Detective service the enables you to see complex network flows from your instances. However these all have service charges so if your application is very cost sensitive you may want to use them only for a short period until the problem is resolved. (Several of these services do have free trials for a limited period of time) If it fits into your budget it is highly recommended to keep Amazon GuardDuty running all the time to monitor for network and AWS account level security issues.

Hello,

there are few potential things to do:

• Scan instance with Amazon Inspector, though it might be not free
• Scan instance with some antivirus software (like ClamAV). Here is example (refer to the first part only, I believe you don't need to automate it for regular actions)
• If your instance doesn't need to make outgoing connections to internet (like your app doesn't need to load anything from internet) - you can configure outbound rules in security group to prevent such connections

Regarding the WAF - note, that it protects the app itself from incoming threats, but it doesn't help if app is compromised and does some bad things by itself.