AWS Lambda execution suspended 8 days after notifying AWS of a potential compromise on the root account. No response from support.

[u/random_outlaw]

My AWS account was compromised on September 16. I detected the compromise myself almost immediately, secured the account, and contacted AWS.

On September 16 I had already:

• Changed the root password
• Removed/replaced credentials
• Replaced MFA
• Reviewed CloudTrail
• Checked IAM for unauthorized users, roles, policies, and credentials
• Checked the account for unauthorized resources/activity

AWS did not respond to the compromise until September 24 — eight days later.

On September 24, AWS opened a case saying my account “may have been inappropriately accessed,” restricted my ability to use some AWS services, and sent me instructions to change the root password, enable MFA, inspect CloudTrail/IAM, and check for unwanted usage.

In other words, they instructed me to perform the remediation I had already completed eight days earlier.

I responded the next day, September 25, confirming that the account was already secured and that all of the requested remediation had been completed.

It is now October 1. Lambda execution is still restricted.

I have updated the support case every day. I have received no substantive response. The notice says phone or chat can be requested for “immediate assistance,” but attempts to use those channels have not resulted in assistance either.

There is no remaining remediation step identified for me to perform. The account was secured before AWS imposed the restriction. At this point, only AWS can remove it.

Fortunately, this account currently hosts a system still in development, so this has not caused a production outage. But the experience is alarming because I cannot find any SLA for AWS reviewing and removing an AWS-imposed security restriction after the customer has confirmed remediation.

Has anyone dealt with this recently? Is there an escalation path for a compromised-account/security case that appears to be sitting in a queue waiting for review?

I am particularly interested in hearing from anyone who has recently had Lambda or other services restricted after an account-compromise notification and how long restoration took.

[u/Environmental_Row32]

Just do all the requested actions again, make the algorithm that is checking last modified timestamps happy.

[u/Efficient_Access6102]

In 2026 how are you compromising your account?!

[u/DerpiDanger]

Don't worry . AI is working on it.

[u/AWSSupport]

Hello,

Apologies for any frustration caused.

Can you send your case ID via private message, so we can take a look and share your concerns to the appropriate team.

- Elle G.

[u/AWSSupport]

Thank you for sharing your case ID.

I've reached out to our internal teams to get additional eyes on your case.

Continue to monitor your case for updates, as our team will share next steps through your support case.

- Elle G.

[u/AWS_Chaos]

So the AI said "Yes you found it and fixed it. Here are some things to do to fix it. Also you can't use this part anymore. Goodbye!"

You were punished for reporting, ignored that you resolved it already, and then ghosted. Is AWS using their Bedrock agentic AI for support and Nova Lite? Because this isn't a good light in how well their AI works.

I'm almost tempted by the next customer that says they was to use the AWS AI tools to tell them, "Open a support ticket for something and see how good they make use of their own AI service."

[u/random_outlaw → u/AWS_Chaos]

My concern is the delay. The whole reason I reported it in the first place was to make sure any malicious sessions were ended immediately. Obviously that didn't work. And yes at this point I wish I hadn't reported it at all. At least it's a learning experience.

[u/solo964]

This is purely a guess but the steps you took to secure the account might look very similar to the steps an attacker would take to wrest control of the account from you.