Stolen EC2 keys burn $14,000 in a single day on Amazon Bedrock

A three-person agency with a typical AWS bill of $10-$15/month received a $14,000 charge in a single day after attackers extracted static access keys from an EC2 instance and burned through Claude model invocations on Amazon Bedrock. The keys carried Bedrock Full Access, AWS had removed the model-access toggle in 2025 leaving all models enabled by default, and the application was designed to use Haiku with an expected bill under $100. Detection came from the credit card, not from AWS -- Cost Explorer lags up to 24 hours.

What this means for youA small business using cloud AI services could be billed heavily if its access keys are stolen, so it should check that its AWS keys are not stored on servers in plain form, use only the minimum permissions needed, and set billing alerts that trigger within hours rather than days.