Neutralising an AWS Threat - and Recovering 100% of Costs

Overview

When an external threat actor gained temporary access to a UK digital services company's AWS environment, Cloud Bridge's managed support layer detected and contained the attack, coordinated the investigation with AWS, and recovered 100% of the unauthorised charges. We then used the incident as a springboard to strengthen the customer's long-term security posture and establish ongoing Partner-Led Support.

Customer overview

The customer is a UK-based technology and digital services company whose solutions depend on secure, reliable cloud infrastructure. They rely on AWS to power client-facing applications and internal systems in a competitive market.

Like any organisation in the cloud, they face an evolving threat landscape. When an external threat actor targeted their AWS environment, our managed support layer provided the rapid detection and response that made the difference.

The situation: unauthorised access, mounting charges, restricted operations

Security incidents don't wait for office hours. An external threat actor gained temporary unauthorised access to the customer's AWS environment - caught quickly through AWS's fraud prevention systems and our own monitoring, but not before that brief window created three urgent problems:

• Costs started climbing - the attacker spun up unauthorised resources, racking up significant spend
• Operations got restricted - AWS applied precautionary account restrictions that temporarily disrupted normal service
• The scope was unknown - a thorough investigation was needed to confirm the extent of access and guarantee full containment

The customer needed a partner who could move immediately - not just to shut the threat down, but to run the investigation, coordinate with AWS, and win back the money.

How Cloud Bridge responded

Rapid detection & containment

• Engaged the moment the threat was detected, working alongside the customer to assess the situation
• Identified and terminated every unauthorised resource the attacker had created
• Raised a formal AWS Support case at the highest priority to coordinate the investigation
• Worked with AWS to lift the precautionary restrictions and restore normal operations
• Secured a formal Root Cause Analysis (RCA) from AWS — confirming the attack vector and giving a clear basis for remediation

Financial recovery

• Quantified the full extent of charges incurred during the unauthorised access window
• Coordinated with AWS, presenting the evidence and investigation findings
• Recovered 100% of the unauthorised charges — turning what could have been a serious financial hit into zero net impact

Proactive security hardening

We didn't stop at putting the fire out. We used the moment to make the customer harder to hit next time:

• Ran a security assessment of the AWS environment using CloudHealth
• Enhanced logging and audit-trail coverage to sharpen detection and forensics
• Strengthened identity and access controls based on the findings
• Delivered a prioritised remediation roadmap to close the gaps that mattered most

The result: a stronger, more resilient security baseline than before the attack.

Ongoing managed support

• Activated Partner-Led Support with 24/7 coverage and direct AWS escalation
• Established quarterly service reviews covering cost, security, operational health and architecture
• Provided CloudHealth access for continuous cost and security visibility
• Gave the customer a dedicated support team for whatever comes next

The results

• External threat neutralised — all unauthorised activity terminated and access secured
• 100% of unauthorised charges recovered — no financial impact
• Formal Root Cause Analysis obtained — a clear understanding of the incident to inform prevention
• Security posture strengthened — enhanced logging, access controls and monitoring coverage
• 100% service availability maintained post-incident across all core workloads
• Ongoing managed support in place — 24/7 coverage, quarterly reviews, real-time visibility

Quote from the customer's CEO: 

When an external threat targeted our AWS environment, Cloud Bridge's response was exactly what we needed. They contained the threat, coordinated with AWS to recover the costs, and then went further — providing guidance on our security posture so we're in a much better position going forward. Having a partner like Cloud Bridge means we can focus on our business knowing the infrastructure is in safe hands.

Why Cloud Bridge?

Cloud security isn't a matter of if, but when. What matters is how fast you detect, respond and recover — and whether you come out of it stronger. This engagement shows exactly that:

• Speed of response — we engaged immediately and contained the threat before it could escalate
• AWS partnership — established escalation paths and partner credibility accelerated the investigation and the financial recovery
• Beyond the incident — a proactive hardening programme turned a reactive moment into a stronger long-term posture
• Ongoing protection — moving from incident response to managed support means continuous coverage, not a one-off rescue

Frequently asked questions

What should you do if your AWS account is compromised? Act immediately: terminate unauthorised resources, raise a high-priority AWS Support case, and investigate the scope of access. A specialist partner can contain the threat, coordinate the AWS investigation, obtain a Root Cause Analysis, and pursue recovery of unauthorised charges — while strengthening your security posture to prevent recurrence.

Can unauthorised AWS charges be recovered? Yes. Where charges result from a security incident, they can often be recovered by quantifying the unauthorised spend, presenting evidence and investigation findings to AWS, and coordinating through established partner escalation paths. In this case, 100% of the unauthorised charges were recovered.

What is Partner-Led Support? Partner-Led Support combines the expertise of an AWS Partner with the backing of AWS. You work with specialists who understand your environment, operational priorities and business goals, with 24/7 coverage and direct AWS escalation when specialist expertise is required.

Take the next step

Security threats are a matter of when, not if — and how well-governed your environment is decides how fast you can respond. Book your complimentary Cloud Snapshot → — a personalised report within 48 hours covering your security posture, cost drivers and governance gaps.

Related reading:

• Why Good AWS Support Starts Long Before You Raise a Ticket
• How to Take Control of Your AWS Environment and Reduce Costs
• AWS Cloud Governance Services

Frequently asked questions

What should you do if your AWS account is compromised? Act immediately: terminate unauthorised resources, raise a high-priority AWS Support case, and investigate the scope of access. A specialist partner can contain the threat, coordinate the AWS investigation, obtain a Root Cause Analysis, and pursue recovery of unauthorised charges — while strengthening your security posture to prevent recurrence.

Can unauthorised AWS charges be recovered? Yes. Where charges result from a security incident, they can often be recovered by quantifying the unauthorised spend, presenting evidence and investigation findings to AWS, and coordinating through established partner escalation paths. In this case, 100% of the unauthorised charges were recovered.

What is Partner-Led Support? Partner-Led Support combines the expertise of an AWS Partner with the backing of AWS. You work with specialists who understand your environment, operational priorities and business goals, with 24/7 coverage and direct AWS escalation when specialist expertise is required.

Cloud Bridge is an AWS Premier Tier Services Partner, Managed Service Provider and AI Competency Partner. We help organisations take control of their AWS environments through continuous governance, optimisation and support — built into what you're already paying.