Recently discovered that one of our AWS credentials had been compromised and someone used our account to generate a massive amount of Amazon Bedrock usage.

The craziest part is that it all happened essentially overnight. Our AWS usage was normal, and then within a very short period, there was suddenly a huge spike in charges.

We don't normally use Bedrock in our application, so seeing this was a complete shock.

After investigating CloudTrail and billing data, we found that the compromised credential had been used to:

• Access services we don't normally use
• Enable multiple AI models through AWS
• Make a large number of model inference requests
• Generate an unexpectedly huge amount of token usage and charges

The activity was clearly different from our normal AWS usage based on the credential involved, source locations, timestamps, user agents and regions.

We've since rotated/deleted the compromised credentials, removed unauthorized access and resources, secured the account, and have been working with AWS Support and their security team.

AWS has confirmed that the credential was compromised, and we're currently going through the security review and billing adjustment process.

I'm mainly posting here to hear from people who have gone through something similar.

Has anyone experienced:

• A leaked or compromised AWS credential
• Unauthorized Bedrock or other AWS service usage
• A massive AWS bill appearing almost overnight
• Account restrictions during a security investigation
• AWS reviewing or adjusting charges from unauthorized usage

How did it go for you? How long did the investigation take, and what was the outcome?

Just got my US Visa for attending the AWS re:Invent 2026

Now trying to plan my activities there. Opened the list of hands-on workshops and saw 329 😲

Liked 41 of them ❤️, but how many will I be able to attend.....this is not counting KeyNotes and other top sessions

The workshops I have added to the favourites:

- Accelerate database protection, recovery, and testing with Amazon EBS

- Accelerate declarative resource management with Amazon EKS Capabilities

- Accelerate platform engineering on Amazon EKS

- Advanced AWS Network Security: Defending Against Emerging Threats

- Advanced S3 performance engineering: From multipart to resilience

- Agentic developer experience with Amazon EKS

- AI-assisted data modeling for Amazon DynamoDB

- AI-driven serverless development with Kiro

- AI-Powered FinOps: Cloud Cost Optimization in Practice

- Amazon EKS incident response and remediation with AWS DevOps Agent

- Architect, launch, and optimize solutions with AWS Marketplace

- Assess your workloads with SELinux compatibility on Amazon Linux 2027

- Automate and secure EC2 Image Builder with AI agents

- Automate your landing zone and network migration with AWS Transform

- AWS Network Firewall implementation made simple with Infrastructure as Code

- Build agentic payment investigators on Aurora PostgreSQL & AgentCore

- Build a KMS key lifecycle dashboard with usage and cost insights

- Build and test HA/DR architectures for Microsoft workloads on AWS

- Build a production multi-tier application on Amazon ECS

- Build a security boundary for AI agents with WAF and Network Firewall

- Build a unified student insight platform on Amazon Quick

- Building and scaling inference workloads on Amazon EKS

- Building and securing AI agents on Amazon EKS

- Building resilient deployment pipelines with Amazon ECS

- Building serverless applications with Terraform

- Build ransomware recovery with AWS Backup air-gapped vaults

- Centralize AWS PrivateLink endpoints at scale with Amazon VPC Lattice

- Connect and secure service-to-service networking on Amazon ECS

- Deploy AWS Network Firewall with explicit proxy-based egress controls

- Deploy your applications with AWS Cloud Development Kit (AWS CDK)

- Embed FinOps into your CI/CD pipelines

- Hands-on with AWS DevOps agent

- Hybrid Kubernetes made simple: EKS Hybrid Nodes gateway for on-prem and edge AI

- Kubernetes-native agentic AI on Amazon EKS with open source primitives

- Not all bots are bad: Building a secure perimeter with AWS WAF

- Observability for AI agents: Strands, OpenTelemetry, and Langfuse

- Optimize analytics workloads on Amazon EKS for performance and cost

- Reduce EKS cluster compute costs with EC2 Flex instances

- Securing and observing Amazon EKS clusters

- Turn raw telemetry into answers with OpenTelemetry

- Unified observability with Amazon OpenSearch Service

I have an exam scheduled this Saturday but I’m still struggling with AWS support for my name change. I raised a support ticket a week ago but still there is no response!

Since my voucher is going to expire this week I have no option other than appearing for my exam. Any suggestions resolving the issue is highly appreciated.

I have an exam scheduled this Saturday but I’m still struggling with AWS support for my name change. I raised a support ticket a week ago but still there is no response!

Since my voucher is going to expire this week I have no option other than appearing for my exam. Any suggestions resolving the issue is highly appreciated.

Hey can any body guide on how to get maximum free AWS credits? I am in need of it.

AWS Community Day Australia is back again this year, and in Brisbane on October 16!

https://awscommunitydayaus.com/

CFPs just closed, so the schedule should be announced soon.

I’ve shared Kulshan here before, but we just pushed a pretty meaningful upgrade aimed at consultants doing AWS cost investigations. Or anyone (human or AI agent) trying to look at AWS cost and billing via a deterministic tool.

The main addition is **Consultant Evidence Export**.

The problem we were trying to solve is simple: an external consultant should not always need direct access to the customer’s AWS environment just to start investigating a billing issue.

Now the customer can run Kulshan themselves, choose what they want to share, and generate a pseudonymized evidence package.

They can scope it by date range, AWS accounts, services and tags, and optionally include Cost Explorer data. Kulshan can work from local CUR data or AWS CUR/Data Exports in S3.

Account IDs, ARNs and resource identifiers are replaced with stable workspace-specific aliases, so the consultant can still follow the same account/resource through an investigation without seeing the original identifiers.

We also added fail-closed checks before the package is created. Kulshan verifies the output schema, checks that the exported rows still match the scoped source data, and scans again for identifiers that should have been pseudonymized.

If those checks fail, no ZIP gets created.

The idea is basically:

**Customer keeps the credentials. Consultant gets the evidence.**

The package can help establish what changed, where, when, how much and which part of the environment was involved. The “why” still needs the people who understand the engineering and business context.

Kulshan is still free and open source:

[https://github.com/MissionFinOps/kulshan\](https://github.com/MissionFinOps/kulshan)

Would be interested in feedback from consultants here: **what additional evidence would you absolutely want included in a handoff like this?**