Our company discovered on August 1 that a programmatic IAM access key had been compromised through a third-party supply-chain issue. We reported it to cloud support within four hours and revoked the affected access, but the support case remained unassigned for 14 days and is still unresolved after 20 days.
The account now shows a total Marketplace charge of $477,505.20: a $4,800 contract-creation fee plus $472,705.20 in usage charges for 47,270,520 units in us-east-1. The usage count has stopped increasing, but we never knowingly used or activated the product.
The Marketplace console still says "Set up product," no license ID was issued, and CloudTrail shows no Marketplace activity in our account after the initial compromise window. We also never received credentials for or logged into the seller's service.
My understanding is that SaaS Marketplace usage is generally reported by the seller through the Marketplace metering API using the entitlement's customer identifier. If so, the buyer's AWS account may not be involved in the actual usage reporting, meaning revoking IAM credentials or applying policies would not necessarily stop seller-side metering.
I'm trying to understand several things: whether seller-side metering can produce charges before buyer registration is completed, whether the persistent "Set up product" status proves that the ResolveCustomer process never happened or could simply be stale, and whether buyers can inspect entitlement or registration records through Marketplace APIs, billing data, or the Cost and Usage Report. I also want to know whether AWS's public-contract cancellation or refund window can still be honored when the customer reported the compromise promptly but support delayed handling the case, and whether large Marketplace usage charges have ever been reversed after an account compromise. We are a small company and cannot absorb hundreds of thousands of dollars in charges for a product we did not activate or use.
2 Answers
A Marketplace notification can be generated when a subscription is created, even if the customer never follows the setup link. However, subscription creation, fulfillment, registration, and actual product use are separate states. If there is no visible cancellation control, support should confirm whether the agreement was cancelled, suspended, or merely left unfulfilled, and whether metering remained enabled during that period.
The refund deadline may be based on the contract’s terms rather than the date support eventually opens the case, so do not assume the delay automatically extends the window. Still, the fact that the compromise was reported within four hours is important evidence. Request a formal review of the contract-cancellation eligibility, separate treatment of the fixed contract fee and usage charges, and a hold or dispute status on the invoice while the metering investigation is pending. Keep everything in writing and escalate through the payer account’s billing and Marketplace channels.
We received a notification and immediately revoked the exposed access, but the console never showed an activation or license ID. The usage total later stopped, so the important question is which system accepted the usage reports and why the agreement remained billable.