That's not how lawyers or bills work, unfortunately in this case, but fortunately in general.

Yes. Computer Fraud and Abuse Act to start.

The first demand letter from a lawyer will usually stop this. The great thing about suing big companies is that they have to show up. You have no contractual agreement which prevents suing; this is entirely from the outside.

Threatening to sue is one thing. Actually doing it will cost you time and money. And even if you get a judgement how are you going to collect from some rando in Singapore?

AWS isn't some rando in Singapore.

AWS isn't doing this. The rando renting the AWS instance in Singapore is.

There are ways. You sue AWS and "Does 1-50". Then AWS's lawyers become eager to tell you who misused their service so you can sue the other party. Talk to a lawyer.

It's AWS's system and they have been informed that the spam/DDOS is ongoing.

They have control of what goes on on their computers and they are responsible.