Something is off here.
They shut down?
OR
Was it that they got turned off?
Most attacks are like flooding a service with too many calls. You cause the server software to stress the hardware so hard that it can't think anymore.
Why aren't they on CloudFlare or CloudFront? These services would help mitigate a mass bot calling.
They would still be up and running.
Is it an old framework issue? Most likely not. All of the places where you can type in information has most likely (hopefully) has been hardened at the UI level and at the back end code level. This means you can't run database commands to dump data or enter some weird characters that will cause issues in your software and then get information directly or a hint to what you can attack next.
IAM Authentication is normally associated with Amazon AWS services.
If this was a developer issue, code can be rolled back if the team is paying attention.
eleadcrm .com doesn't load for me so the domain is turned off. It's like taking your phone number out of telecom system rather than being sent to voicemail.
Or was this a social engineered AWS access issue which would mean, shut the damn thing down now issue.
