AWS Acceptable Use Policy Violations: Common Violations and How to Avoid Them

AWS's Acceptable Use Policy prohibits using AWS services to harm others or violate laws. The policy is stated broadly, but enforcement is specifically triggered by specific behaviors detected through AWS's monitoring infrastructure. Understanding which behaviors trigger enforcement — and how to prevent them from occurring in your account, intentionally or through compromise — is foundational account management.

The practical concern for most legitimate businesses isn't intentional violation. It's the scenario where your credentials are stolen and your account is used to violate the AUP by a third party, or where a misconfiguration creates an inadvertent violation. Both scenarios trigger the same enforcement process.

AUP Categories That Affect Production Accounts

Malicious network activity: Using EC2 instances to launch DDoS attacks, conduct unauthorized port scanning against external IPs, or distribute malware. This category is almost entirely credential-compromise-driven for legitimate businesses — nobody's production application should be port scanning the internet. Prevent by limiting outbound access from EC2 instances using security groups, monitoring for unusual outbound connection patterns via VPC Flow Logs, and detecting compromised instances with GuardDuty.

Email spam and phishing: Using SES or EC2-based mail servers to send unsolicited commercial email, phishing messages, or malware. See SES reputation monitoring and SES account suspension prevention for the full picture of email compliance. Key prevention: monitor SES complaint rates continuously, implement double opt-in for marketing lists, process complaint and bounce notifications immediately.

Unauthorized resource use for cryptocurrency mining: Using EC2 or other compute resources for crypto mining without authorization. This is the most common AUP violation in compromised accounts. See crypto mining detection for prevention and detection guidance.

Hosting prohibited content: S3 or EC2 serving malware, CSAM, or other content explicitly prohibited by the AUP. For legitimate businesses, this is almost always inadvertent: an S3 bucket that's accidentally public and is found by attackers who upload malicious content, or a web application with an upload vulnerability that allows attackers to host content through your application. Prevent with S3 Block Public Access, upload validation, and regular content auditing of public resources.

Inadvertent Violations from Misconfiguration

Some AUP violations don't require account compromise — they come from configuration mistakes:

Open DNS resolvers: EC2 instances configured as DNS resolvers that accept queries from any source IP can be used for DNS amplification attacks. Any EC2 instance running DNS services should accept queries only from specific source IPs (your VPC CIDR, your office IP), not from 0.0.0.0/0. AWS sometimes receives abuse reports about DNS amplification attacks before the account owner is aware of the issue.

Open SMTP relays: EC2 instances running mail servers that relay email from any source can be exploited for spam. Configure outbound email servers to relay only for authenticated senders. Alternatively, use SES for all outbound email rather than running your own mail server on EC2 — SES handles abuse monitoring and has built-in protections against relay exploitation.

Open proxy servers: EC2 instances running proxy software that accepts connections from any source can be used to anonymize malicious traffic. Restrict proxy software to authenticated users with specific source IP restrictions.

AUP Violation Response Process

When AWS detects AUP violations, the enforcement process depends on severity:

Notification: For most first-time or lower-severity violations, AWS sends an email notification describing the detected activity and requesting a response within a defined timeframe. Respond within 24 hours with an explanation of the root cause and remediation steps taken. The email goes to your account's root email address — ensure this inbox is monitored.

Service restriction: AWS may restrict specific services pending resolution of the abuse issue. SES may have sending suspended; EC2 may have launching disabled in specific regions. Service restrictions typically lift quickly after confirming the issue is resolved and providing a satisfactory response.

Account suspension: For severe violations or unresponsive accounts, AWS may suspend the entire account. Account suspension requires more extensive remediation and AWS review before restoration. The suspension affects all services and resources in the account. See why AWS accounts get suspended for the full suspension risk picture.

Prevention Framework

The preventive controls that address most AUP violation risk:

• Eliminate long-lived IAM access keys that can be stolen and used to provision abusive resources
• Enable GuardDuty in all regions to detect compromise-related AUP violations early
• Monitor SES complaint and bounce rates continuously with alerting below enforcement thresholds
• Use S3 Block Public Access at the account level to prevent inadvertent public bucket content hosting
• Restrict outbound security group rules on EC2 instances to prevent abuse after compromise
• Monitor CloudTrail for unusual resource provisioning patterns that indicate compromise

Related Reading

• AWS abuse prevention — comprehensive abuse risk management
• Account reputation management — maintaining good standing after AUP interactions
• Why AWS accounts get suspended — AUP violations as a suspension trigger
• SES account suspension — email-specific AUP violations

FAQ

If I'm not at fault for an AUP violation (my account was compromised), does that matter?

Yes, it matters significantly for the response process. AWS distinguishes between intentional AUP violations and violations caused by compromise. For compromise-caused violations, demonstrating that you're a victim (not a perpetrator) and showing what you've done to secure the account typically leads to faster restoration and more accommodating treatment. Provide clear documentation: when the compromise occurred, what actions were taken, what preventive controls are now in place. AWS's abuse team deals with this scenario regularly and generally extends good faith to cooperative account owners who were genuinely compromised.

Can a single SES spam complaint cause an AUP violation?

A single complaint won't trigger enforcement. AUP violations for email spam require patterns of abusive behavior — sustained high complaint rates, confirmed spam campaigns, or malware/phishing content in emails. A single complaint from a recipient who marked a legitimate marketing email as spam is handled through SES's reputation metrics (which affect sending limits), not through AUP enforcement.

How long does an AUP violation stay on my account's record?

AWS doesn't publish a specific statute of limitations for AUP violations. In practice, fully resolved violations with clear root cause documentation and demonstrated remediation have diminishing effect on account standing over time. An incident fully resolved 2 years ago matters less than one from 2 months ago. AWS's account teams have the context of your full account history when evaluating current issues.