Loaded a Spring Boot Application to AWS Elastic Beanstalk, my Twilio Account was hacked

Did you change your credentials used in Twilio and your app after the hack?

Once that's done then you can start looking for what happened. If you can nail down a timeline of when you realized they stole your twilio account credentials (when was the first bogus message sent from twilio and when was the first time you uploaded/deployed your jar that gives you a window). If you were working on fixing issues you might be able to narrow that window down to a time where the software worked to when twilio hack showed up. That timeline will help you look through these logs to see if you can spot anything suspicious.

Check the S3 bucket where your Jar file lives. Make sure that bucket is NOT public. You may have removed it from the jar file, but old versions still have those credentials in them. If someone got access to your bucket they could steal the credentials. Also if you take any backups of your system and those aren't encrypted if someone gets access to those backups they could steal the information in them.

I'd look through access logs on your site to see if you can pinpoint someone finding the credentials that way. Cloud trail is a pain in the butt, but it's the only way to see all of the api calls made by your account. Those are the two sources you might be able to find someone doing something bad. You may talk to Twilio to see if they can provide any additional forensic information like IP addresses for where those fraudulent messages came from the you might see those same IPs talking to your server or AWS account.

Good luck.

Firstly follow @chubbsondubs advice and reset your Twilio credentials and ensure the S3 bucket is private.

Elastic Beanstalk creates an Amazon S3 bucket and doesn't turn on default encryption. This means that by default, objects are stored unencrypted in the bucket but should only be accessible by authorised users. Elastic Beanstalk also applies a bucket policy to the buckets it creates to allow environments to write to the bucket.

Be aware that Elastic Beanstalk creates an application version whenever you upload source code. This usually occurs when you create an environment or upload and deploy code using the environment management console or EB CLI. Elastic Beanstalk deletes these application versions according to the application's lifecycle policy and when you delete the application. So its possible you still have older application versions residing in the bucket.

You can track who's accessing your bucket and objects in the following ways. Below options are not enabled by default:

• S3 server access logging to see information about requests to your buckets and objects.
• CloudTrail to track API calls to your Amazon S3 resources.

The following link explains the key properties of AWS CloudTrail logs and Amazon S3 server access logs Logging options for Amazon S3

Instead of using environment variables for secure credentials consider using the SSM Parameter Store/Secrets Manager which you can then fetch programmatically in your Elastic Beanstalk instance or through Elastic Beanstalk’s custom environment configuration files (.ebextensions).

Additional references that may be useful

• Hardening the security of your AWS Elastic Beanstalk Application the Well-Architected way