[Animats]

Yes. Computer Fraud and Abuse Act to start.

The first demand letter from a lawyer will usually stop this. The great thing about suing big companies is that they have to show up. You have no contractual agreement which prevents suing; this is entirely from the outside.

[SoftTalker]

Threatening to sue is one thing. Actually doing it will cost you time and money. And even if you get a judgement how are you going to collect from some rando in Singapore?

[tracker1]

AWS isn't some rando in Singapore.

[SoftTalker]

AWS isn't doing this. The rando renting the AWS instance in Singapore is.

[Animats]

There are ways. You sue AWS and "Does 1-50". Then AWS's lawyers become eager to tell you who misused their service so you can sue the other party. Talk to a lawyer.

[impossiblefork]

It's AWS's system and they have been informed that the spam/DDOS is ongoing.

They have control of what goes on on their computers and they are responsible.