Our small startup's entire AWS account was locked without warning earlier today, taking our production environment offline. We opened a support case immediately, but after more than half a day it has moved between service and security teams with little communication or progress. We later learned the account may have been flagged because of an S3 access key, but disabling the specific key instead of the whole account would have avoided this outage. Has anyone dealt with a similar security lockout or know the fastest legitimate escalation path to get the account reviewed?
3 Answers
A public support-status update may indicate that the security review has been cleared, but it won’t replace the account-specific investigation. Ask support to confirm whether the security hold has actually been removed and what exact action is still blocking access. Once restored, rotate the affected credentials, review S3 access logs, and enable stronger monitoring and break-glass access.
There may not be a public shortcut around an account-security suspension. Continue updating the case through the official support console, clearly mark the production outage and customer impact, and ask for the case to be assigned to the account-security team or an incident manager. Avoid creating many duplicate cases, since that can split the investigation across queues.
If the lockout is related to a suspected compromised S3 key, make sure the support case clearly states that the key can be disabled or rotated immediately and that production is down. Include the case number, account ownership details, business impact, and confirmation that you’ll cooperate with any security checks. Keep all updates in the existing case so the security team has a complete record.
The main concern is that the entire paying account was disabled instead of only restricting the flagged key. Make the full-account impact and the requested remediation—key isolation or rotation—very explicit in every update.