What should I do after my AWS credentials were compromised?

You’re actually pretty lucky that your bill is only $861. I've heard horror stories of people getting hit with $200k bills after their credentials were leaked! Still, it's crucial to not just delete access keys and walk away. You need to make sure there aren’t any services still running that could rack up more charges. Check your entire AWS account for active resources and monitor your billing closely to prevent surprises like this again.

You really need to do more than just delete your credentials. Ensure no services are still active and that the attackers haven’t left anything running in your account. Check the AWS Cost and Billing explorer to see where the charges are coming from. Familiarize yourself with AWS CloudTrail to review activities from the past few months. If it was your root credentials that were compromised, you may need to secure your account with new billing info and multifactor authentication to prevent further issues.

Right now, your best move is to wait for a response from AWS support regarding your case. They can guide you through any potential issues and might even help with those charges if they determine it’s a billing mistake due to unauthorized use.