AWS Cost Explorer - Cost Anomaly Detection Report identified an unauthorized Amazon Sagemaker Canvas user
Tags: aws, beginners, security, cost
Published: 2022-07-18 16:41:00


## A Very Expensive Lesson 

I received a huge surprise this month, a forecast for a July month end bill of $586 linked to my AWS root account. As best practice I never use my AWS root account and always build projects with the AWS IAM account login.

The AWS Management Console provides a summary of the AWS services usage, forecasted costs, in particular indicating that Amazon Sagemaker had an end of month $578.57 forecast with cost increasing by over 300% in the current month. I have not used Amazon Sagemaker recently 🙄 and this raised concerns for my unexpected charges. 

![mybill](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/19tjg0kxcjcz6ru9xqxp.jpg)

![services](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o6p8d6lsp7zheaztmdq2.jpg)

### Amazon Cost Explorer

By navigating to Amazon Cost Explorer, AWS Cost Management provides a summary view of  costs, commentary on the right hand side and also a graph outlining daily usage had increased by 270% in the region US-East-1 (N.Virginia).

![root linked](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g2j6xtsfz72lq38s48n6.jpg)

I navigated each of the panes to investigate further information regarding the costs incurred such as *Region*, *Instance Type* and *Linked Account*.

**Instance Type**

I checked under Instance Type to see if there were any active EC2 instances. There were no active instances after 11 July 2022.


![Instance](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fg1s4unnf250e5x1aeji.jpg)

**Usage Type**

In this pane, I could identify that after 11 July 2022, someone had created an Amazon Sagemaker Canvas session from 11-17 July (indicated in purple)

![Icanvas usage](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/da61ljxljcrii36vcb4k.jpg)

**Linked Account**

I used the AWS root account login details to check any active sessions of Amazon Sagemaker Canvas.

![root](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4mmj6mgwyxdfgcnqzou6.jpg)

###  Reduce Costs - Clean up Active AWS resources

The previous week on the 11 July, I cleaned up my AWS account for active resources such as:

a) Deleting **EC2** instances in the regions  Sydney, Ohio and N.Virginia

![none](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pexqwawkkhzblr28me1d.jpg)

![delete any EC2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/imcjpngi8i986b6pakjl.jpg)

b) Shutting down any active **Cloud9** sessions

c) Deleting any active **Cloud Formation stacks** 

d) Deleting any AWS Sagemaker **processing jobs**

e) **Emptying S3 buckets** for completed AWS Glue jobs

### Reduce Costs - Create an AWS Cost Anomaly Detection Report

As an extra measure I created a **Cost Anomaly Report** that could be emailed to me to identify any suspicious activity to my AWS account over a threshold of $15. You may create a Cost Anomaly Detection Report from this [link](https://aws.amazon.com/aws-cost-management/aws-cost-anomaly-detection/)

AWS Cost Anomaly Detection Report uses machine learning to detect anomalies and the root causes for cloud spend.


![create anamoly](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9f4ju7yjin0ja9yz4bt4.jpg)

You may also download as a csv file the Cost Anomaly Detection Report to view the details of the surprise charges:

![Idownload](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p4mwgizfnnda278p0nww.jpg)

### Reduce Costs - Delete if not in use - Amazon Sagemaker Canvas

Navigate to Amazon Sagemaker Canvas and click on **Canvas** and then click **Getting Started**. I located active sessions of an unauthorized user 'michael-c' who has been generating workloads $40 per day from 13-18 July on my account. I followed the instructions to remediate and prevent unauthorized user from this [link](https://aws.amazon.com/premiumsupport/knowledge-center/potential-account-compromise/)


![canvas](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o3nxpod2ijnzvsnqmuvd.jpg)

I deleted the app from Amazon Sagemaker Canvas and then deleted the user. 


![deletion process](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4vquy0vxuwxljunqekfh.jpg)

From the diagram you may see an unauthorized user 'michael-c'.

![michaek](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wqv4i8dzocbicu3sty0y.jpg)

### AWS CloudWatch

I further explored AWS CloudWatch to confirm the usage levels of Amazon Sagemaker Canvas used by user 'michael-c' in US East - region (N.Virginia) to understand how many days I was being charged from the Canvas instance.

AWS CloudWatch was able to monitor the metrics of an AWS Service and provide further evidence for my investigation of the surprise charges.

![cloud watch](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rq0a6jru5s3o29qmzpfg.jpg)

### Block Public Access to all Amazon S3 buckets

I wanted to review my Amazon S3 buckets to see if I could further reduce my monthly bill. This is what I discovered:

a) User 'michael-c' had created an S3 bucket with my AWS account number and included a prefix with region US- East-1 (N.Virginia)

I emptied the files within the bucket.

![delete s3](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ovrq9g5ylvss0y3a5pbu.jpg)

b) This S3 bucket was Public and not private. I updated the settings to **Block Public S3 buckets**.

### Create MFA on Root Account and Admin IAM User Account

To further secure my linked AWS Root account I also implemented Multi-Factor Authentication (MFA) as recommended on the AWS IAM dashboard. Please this [blog](https://dev.to/aws-builders/create-multi-factor-authentication-mfa-for-your-aws-accounts-2ohm) and follow all the steps to enable MFA on all AWS accounts.


![Add MFA](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4nympnr2n60cid3mx2ah.jpg)

![MFA](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kb1vbfqm6mt7vums7vnc.jpg)

Best practice guidelines to enable MFA include downloading Twilio Authy for an iPhone or Android phone and link it to your mobile device. You may find the steps [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html).

![Twilio](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l87iejskr1noy89ltcp2.jpg)

MFA provides an additional layer of security to identify the user during the login process of your AWS account.

### Final Steps - Change passwords

As an extra measure to prevent unauthorized access to my AWS account, I also reset the passwords to the AWS IAM and Root user accounts.

I recommend that you also change your email passwords regularly and enable 2-factor authentication if possible.

I hope you won't have to learn the hard way like me. Until next time, happy learning! 😁

![bill](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zz2zq58ue7capoju618h.jpg)

### Join us for AWS re:Inforce conference 2022

Next week is AWS re:Inforce conference, 26-27 July 📆 

A learning conference on compliance, privacy and identity 🔐🛠️

• Register to watch the keynote & sessions streamed live online 📺

• Link: https://reinforce.awsevents.com


![Reinforce](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sjrctympdeoqdzdir9zu.jpg)