Account still restricted from Lambda after completing all remediation steps (exposed access key)

Q2: It is best to narrow the category down to "Account Verification."

This is the most effective piece of advice for this situation.

The URL for opening a support case—which routes directly to the security team and is frequently recommended within the community—is as follows:

https://support.console.aws.amazon.com/support/home?issueType=customer-service&serviceCode=account-management&categoryCode=account-verification#/

Cases opened via this URL are classified as non-technical (and are free of charge) and are routed to the security team.

Multiple AWS staff members have consistently pointed out that opening multiple, redundant cases can actually delay the response. When opening a new case, it is safest to clearly list the case numbers of the three existing cases in the body text and state that the new case is intended to consolidate the previous ones.

Q1: Other actions you can take

1. Clearly state the "impact level" in the case body

The playbook recommends noting the internal escalation level (e.g., "this issue has visibility among executive management") when creating a case. Since phone and chat support are effectively unavailable under the Basic plan, the way you write the case body serves as the only signal regarding priority.

• Specific impact on business operations or services
• The fact that services other than Lambda are functioning normally (i.e., explicitly stating that this is a Lambda-specific flag, not a suspension of the entire account)
• Details of the five incidents confirmed via CloudTrail (four "AccessDenied" errors, one failure due to an unspecified VPC ID, and zero resource creations)

2. Temporarily upgrade your support plan

With the Basic plan, you cannot use chat or phone support, and there is no guaranteed response SLA. Upgrading to the Developer plan for just one month would at least provide a guaranteed response time. As this is a personal account, cost is likely a concern, but you should weigh that against the losses incurred by having Lambda unavailable across all regions.

Q3: Time required for resolution

There is no publicly stated standard timeframe for resolution. Looking at examples from the community, there is significant variation; while some cases were resolved in just a few days, others remained unresolved even after five days—with some even requiring a restart of the recovery process after the system determined that, although the member account had been cleared, the parent account was also subject to the same restrictions.

Thank you — this is very helpful.

Update: shortly after posting, the situation moved. AWS consolidated my three cases into one and the remaining case is now in progress. Support has asked me to confirm two things before submitting a reinstatement request to their internal security team: (1) that root MFA is enabled, and (2) location information (country/city, VPN use, whether anyone else has access).

So for anyone finding this later: the two confirmations above appear to be the actual gate to reaching the security team. I have not opened a new account-verification case, since AWS had already engaged on the existing one and additional cases risk re-fragmenting the thread.