I've got an email about abuse report

I understand your concern about the abuse report you've received. This is a serious situation that requires immediate attention. Here are the steps you should take:

1. Secure your AWS account immediately:

   • Change your AWS account password and enable multi-factor authentication (MFA) if you haven't already.
   • Review and revoke any suspicious IAM users, roles, or access keys.

2. Investigate the unauthorized EC2 instances:

   • Examine the EC2 instances mentioned in the report, focusing on the ap-northeast-1 region.
   • Look for any unfamiliar or unexpected instances, especially those created on 2025/01/14.

3. Stop and isolate suspicious resources:

   • If you've already stopped the unknown EC2 instances, that's a good first step.
   • Consider terminating these instances after preserving any necessary data for investigation.

4. Review your billing and set up alerts:

   • Check your AWS billing dashboard for unexpected charges.
   • Set up billing alerts to notify you of unusual spending patterns in the future.

5. Respond to the abuse notice:

   • Reply directly to the email from AWS Trust & Safety.
   • Explain that you did not create these instances and suspect your account was compromised.
   • Describe the actions you've taken to secure your account and stop the abusive activity.

6. Conduct a thorough security audit:

   • Review all regions in your AWS account for any other unauthorized resources.
   • Check your CloudTrail logs for suspicious API calls or activities.

7. Implement preventive measures:

   • Tighten your security groups and network ACLs.
   • Use AWS Config rules to monitor for unauthorized changes.
   • Consider using AWS GuardDuty for ongoing threat detection.

8. If needed, contact AWS Support:

   • If you have a Premium Support package, open a case for additional assistance.
   • Otherwise, you can use the AWS developer forums for general guidance.

Remember, you are responsible for the security of your AWS resources. Take this incident as an opportunity to strengthen your overall security posture and implement best practices to prevent future unauthorized access.
Sources
Abuse notice FAQs | AWS re:Post
Abuse reporting FAQs | AWS re:Post
AWS Abuse Email | AWS re:Post
AWS Abuse Report | AWS re:Post

1. Stop/Terminate the Unauthorized Instance

• Immediately stop or terminate the EC2 instance that was launched without your authorization to prevent further charges.

2. Investigate Using CloudTrail Logs

• Check the CloudTrail logs to identify the source of the unauthorized instance.
• Look for events such as RunInstances or any unusual activity.
• Note down the user, IP address, and time of the activity for your records.

3. Rotate IAM User Password and Access Keys

• Rotate the password and delete/recreate access keys for all IAM users in your account.
• Ensure no credentials are exposed in your code or repositories.

4. Enable Multi-Factor Authentication (MFA)

• Configure MFA for all IAM users and the root account to secure access.
• Use a hardware or virtual MFA device for better security.

5. Respond to the AWS Case

• Once you've performed the above steps, update the AWS Support Case with the following:
• A summary of the actions you've taken.
• Details from CloudTrail logs showing unauthorized activity.
• Request for billing relief due to unauthorized usage.