This happened to me, the bill was so ridiculous that I wasnt even bothered by it. It got voided by aws support as predicted.
MFA does not prevent this. Its IAM keys.
MFA does not prevent this. Its IAM keys.
The credentials I'm using with Terraform require MFA in order to call 'AssumeAdmin'. Everyone I've ever shown this configuration has complained about it being overkill and tried to argue Terraform should just have IAM keys sitting on disk, one desktop compromise away from taking everything. And since it's used to provision basically everything it's a highly privileged account.
It was pretty obviously uncharacteristic