Bitcoin mining? - Had to close my AWS account

When I read about a similar incident in hacker news sometime back,  I felt sorry for that person and also happy that I had not exposed my secret key. I woke up this morning to see the same thing happen to my account.  I got an email this morning from AWS that my account was compromised and the secret key was available in github.

When I looked at that Github project, I was cursing myself. It was created a year back when I was taking part in a startup weekend event. I don't even remember checking in my secret key in the rush for delivering something over the weekend. Now it has come to haunt me. Someone had launched almost 20 "c3.8xlarge" instances in each region and too many spot instances. Estimated bill is already $300 in a day. It was exhausting for me to find every resource launched in every region and terminate it. I had to close my AWS account to stop further charges and sent an email to the support team and hoping that they would consider that my account was compromised. I am guessing it is bitcoin mining incident again.

I was using this account just for learning AWS and was launching EC2 micro/medium instances to try few things.  I assume most of the devs working in cloud projects would have their personal account to learn AWS and would never ever need to launch such Large instances. I hope that Amazon AWS would provide an option to create a developer account which gives access only to create micro/medium instances for learning AWS and not to worry about huge bill even if the key is exposed by mistake.

Hope that AWS support team helps me this time.

I wish I had the skills like Liam Neeson in "Taken" movie to go after them :)

EDIT:

Estimated bill is now $1534. I called up Amazon immediately and the customer care was very helpful. They informed me that they would arrange for one time credit and asked me to be careful with the Access keys. They also fixed my account and asked me to continue using it.

As suggested by Garp in the comments, the first thing I did is to delete my AWS access keys and created a IAM user with permission to create only t1.micro instances in us-east-1 region.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "ec2:*",
      "Effect": "Allow",
      "Resource": "arn:aws:ec2:us-east-1:*",
      "Condition": {
         "StringEquals": {
            "ec2:InstanceType": "t1.micro"
         }
      }
    },
    {
      "Effect": "Allow",
      "Action": "elasticloadbalancing:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "cloudwatch:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "autoscaling:*",
      "Resource": "*"
    }
  ]
}

Amazon customer care is the best.