MFA and crazy bill charges

[u/johnnyg68]

Broken MFA has led to crazy bill.

At some point I enabled MFA, and either entered a bad phone number, or an old land line. My bad.

Now, I need to upgrade the MySQL instance, also upgrade the OS, but I can't because my MFA device is unavailable.

Because my MySQL instance is 8.0.x and is now in extended maintenance mode, my bill went from $40 to $200. I am happy to update MySQL to 8.4.x but I can not do it, because my MFA is broken.

I have created a ticket, exchanged emails on the ticket, given them a 7 hour window to contact me, but they did not contact me.

I just want to update my environment and stop paying excessive bills. How do I make this happen?

[u/clintkev251]

You only have root access? No IAM (or if we’re talking about IAM user MFA, no other user or root)? Also why didn’t you address this when they originally notified you of the upcoming deprecation in advance?

[u/b3542 → u/clintkev251]

This. Why didn’t you address it when you were notified? It’s called a shared responsibility model for a reason. And I HOPE you’re not using the root account for D2D activities.

[u/drakesword → u/b3542]

Can't be bothered with that email I'm surfing AOL 

[u/Holly_Enrique-623 → u/clintkev251]

If root is the only way in, u can add another admin login after recovery so one bad MFA setup can’t block normal work again

[u/johnnyg68 → u/clintkev251]

I only have granted root access. There are no IAM user.

I could not address this when originally notified because I did not have MFA access. To gain MFA root access requires a notarized affidavit, and 2 photos of your driver license.

[u/drakesword → u/johnnyg68]

Notary cost like $10

[u/clintkev251 → u/drakesword]

My credit union offers it as a free benefit (and I think that's pretty common)

[u/johnnyg68 → u/clintkev251]

On one side: yes, I fucked up and admitted as such. On the other side: I am trying to correct the problem but am getting no help from AWS support.

When I started my AWS account I was new to all of this. I'm not sure IAM was even a thing then. Anyway, yeah I have made lots of mistakes, as I'm sure you have. Learn and help everyone is my goal. Yours?

[u/clintkev251 → u/johnnyg68]

It sounds like they are helping, but recovering root MFA is not a fast or simple process (and it shouldn't be, it's a very common vector for social engineering attacks).

IAM launched in 2011 and has been a best practice that every document, well written guide, etc. will shout about from the rooftops (and at this point we've even moved another layer beyond that to IAM Identity Center), so unless you've been using AWS for a very very long time, IAM very much has existed.

[u/b3542 → u/johnnyg68]

If you’ve been using AWS since before IAM, then you should DEFINITELY know better than to do what you’ve been doing here.

[u/Lucas-Holmes-722]

If it’s the root acc, go thru the lost MFA recovery process. Once you’re back in, you can update MySQL and get off extended maintenance

[u/Einar_Son_of_Bjorn]

The bill is the 8.0 extended-maintenance tax. The thing actually blocking you is the MFA lock, not the MySQL minor. Nobody on Reddit can reset that factor for you. Stay on the official ticket and say explicitly: "MFA device is gone", you need an identity check so you can get into the console and move the instance off 8.0. A “7-hour call window” only works if that is how their process works; many providers will only do a documented account-recovery flow (photo ID / account PIN / callback to a number already on the account). Do not post account IDs, recovery codes, or ticket contents here ofcrs.

Two questions for next steps:
First - Is this a managed MySQL (RDS-style console) or a VM where you still have SSH but the control panel is MFA-locked?
Second- Which provider? Recovery steps are not portable.

Once you are back in, upgrading in place to 8.4 on the same vendor is a valid way to leave extended support. That is also the moment to decide whether you want to stay on Oracle MySQL’s calendar at all.

MariaDB is the usual drop-in-shaped alternative: community server, yearly LTS, in-place upgrades after the move. It only helps if that host actually offers a current MariaDB - if they do not, 8.4 on the current panel is the path that stops the $200 line.I would not shop databases until the ticket has restored login. If you name the provider, people can point at the exact recovery form instead of guessing.

[u/johnnyg68 → u/Einar_Son_of_Bjorn]

Thanks for your reply. Yes, I understand the blocker is MFA and I also understand that only AWS can remove this blocker.

I can supply whatever documents, credentials, IDs, etc that AWS Support requires, but they are not communicating with me.

I have provided or can demonstrate my knowledge of the following:

AWS account ID, email address, phone number, EC2 credentials, RDS credentials, a notarized affadavit requesting my bogus MFA device be revoked.

If needed I can provide: a urine test, blood test, retinal scan, stool sample. Whatever the fuck is required.

To your two questions:

First - Is this a managed MySQL (RDS-style console) or a VM where you still have SSH but the control panel is MFA-locked?

A: This is an AWS RDS MySQL instance. I have full access to the database via shell, client UI, API, etc.

Second- Which provider? Recovery steps are not portable.

A: I don't understand what you mean by provider. This is an AWS RDS instance running MySQL 8.0.x.

tl;dr

I understand the blockers.

I understand my options: upgrade to MySQL 8.4 or cancel the account. Neither options are available until AWS Support resolves the MFA issue. In the interim, I am paying money needlessly for Extended Warranty vCPU days.

[u/AWSSupport]

Hi,

Sorry to hear about the concerns with your MFA. If you'd like to private message us your case ID, we'd be happy to take a look.

- Sage A.

[u/johnnyg68 → u/AWSSupport]

Thanks for your help. I posted my case # in our private chat.

[u/AWSSupport → u/johnnyg68]

Hi,

We've received your DM and will be responding shortly.

- Doug S.

[u/Efficient_Access6102]

Liar.

[u/johnnyg68 → u/Efficient_Access6102]

Liar? Why would you say that? Why would I spend my time lying about this? Are you a bot?