I found out which provider was sending the SMS and contact their abuse line (I would reply STOP but they would just send from a different phone number) and got the name of the customer who was sending the messages. I then contacted that company and got them to blacklist my number (they were a company for sending political sms only, I have no worries about needing to get an sms they would send).
I now get 1-2 political spam messages a month, if that, and I’ve been too lazy to hunt down the source of the few remaining spammers. It went from 2-3 a day to 1-2 a month, huge relief.
We're now investigating moving to Kubernetes where we will have more control over our destiny. Thankfully a couple people on the team have experience with this.
Something like this never happened with Fargate in the years my previous team had used that.