Took a while to come back to this project. We have rebuilt from scratch with much more hardened configs. The amount of malicious traffic instantly targeting instances is pretty staggering. But between our hardened deployment and detailed logging, we are confident that everything is now alright!