Did you report it to Google/AWS? I feel like they would be proactive about removing malicious users, but whether expectations match reality is another question.