AWS Lambda Still Restricted Eight Days After I Secured a Compromised Account
Asked by
MellowCedar42
My AWS account was compromised on September 16. I detected it quickly, changed the root password, replaced credentials and MFA, reviewed CloudTrail, checked IAM for unauthorized users, roles, policies, and credentials, and looked for unexpected resources or activity. I also contacted AWS at the time.
AWS did not respond until September 24, when they opened a case saying the account may have been accessed improperly. They restricted access to some services, including Lambda, and instructed me to complete the same security steps I had already performed. I confirmed on September 25 that the account was secured and that all requested remediation was complete.
It is now October 1, and Lambda execution is still restricted. I have updated the support case daily, but I have not received a substantive response. Phone and chat options mentioned in the notice have not led to effective assistance either.
There does not appear to be another remediation step for me to take; the remaining action seems to be AWS reviewing the case and lifting its restriction. Fortunately, the account is only being used for a system still in development, but the lack of a stated review timeline is concerning.
Has anyone recently dealt with Lambda or other services being restricted after reporting an account compromise? How long did restoration take, and was there an effective escalation path for getting the security case reviewed?
Answers
The frustrating part is the delay between your report and AWS restricting the account. Reporting the compromise was supposed to help terminate suspicious activity quickly, but the response came eight days later and then repeated steps you had already completed. Since the restriction can only be removed internally, keep all updates in the existing case, clearly list the completed actions and dates, and ask for the case to be routed to the team that controls Lambda restoration.
Reply to this answer
You may want to repeat every requested remediation step and document the exact completion times in the case. It is possible that an automated review is looking for recent credential, password, or MFA changes and is not recognizing the earlier work. That should not be necessary, but it may help move the case past an automated check. Keep the account locked down and avoid making unrelated changes while waiting for the security team.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowCedar42: That delay is my main concern too. I reported the issue so suspicious sessions could be dealt with immediately, but the restriction and follow-up arrived much later. At this point I am documenting everything and waiting for AWS to review the case.