We recently migrated our infrastructure to AWS, and two days ago one of our important instances was taken offline after AWS sent automated notices claiming that an access key had been compromised. We reviewed the activity, resources, spending, CloudTrail records, and billing history, and everything appears to belong to us. The key has already been deactivated and deleted, and we confirmed it was not committed to a public repository. We answered AWS's questions and were told the case had been escalated to the security team, but follow-up requests have received no response. This instance is critical to our business, so we're looking for practical next steps. Would upgrading to a paid support plan help resolve the issue, or is there another way to get the security review moving?
3 Answers
Rotate or revoke the affected key immediately and create a replacement only after checking where the original could have been exposed. Public repositories are a common trigger because providers scan them for credentials. If you have a recent backup or machine image, launching a clean replacement may be faster than waiting for the original instance to be restored. Production systems should also use instance roles or another credential-management system instead of long-lived keys stored on the server.
Treat this as a possible compromise until you can prove otherwise. Preserve a copy of the instance or its disk for investigation, but redeploy the application onto fresh resources rather than trusting the flagged machine. Review CloudTrail and IAM activity across every region for unfamiliar users, keys, roles, policy changes, or newly created instances. Also determine whether the issue was a leaked credential or a vulnerability on the instance itself; those require different fixes.
From AWS's perspective, an alert does not necessarily mean the key was actively abused. They may have detected a leaked credential, unusual activity, or a pattern associated with previous abuse. Basic support generally does not promise a rapid security response, while a paid support plan may provide a clearer escalation path. It is frustrating, but production workloads are usually expected to have an appropriate support plan and a tested failover process.
We reviewed CloudTrail, billing, and the related account activity, and so far everything matches our own operations. The key was new, has been deleted, and was not found in any public repository. We are still checking for anything we may have missed, but this looks more like an automated false positive or an old account suddenly becoming active than an actual intrusion.