Use at your own risk. Provided "as is", no warranty. Security changes can block access or break workloads; test in a non-production account first and keep a break-glass admin path. CloudGuard Templates is independent and not affiliated with, endorsed by, or sponsored by AWS or the Center for Internet Security (CIS). CIS numbers follow the AWS Security Hub CSPM mapping for CIS AWS Foundations Benchmark v5.0.0; verify against the current CIS document.

Minutes 0-15: triage

• Write down the key ID (AKIA...), the owning user, how you found out and the time.
• Open an incident ticket and name one lead. One person running commands avoids chaos.

Minutes 5-20: contain

Deactivate first (it's reversible), then confirm:

aws iam update-access-key --user-name USER --access-key-id AKIAEXAMPLE --status Inactive
aws iam list-access-keys --user-name USER

If the key may have been used to assume roles, temporary sessions keep working after the key is disabled. Use Revoke active sessions on the affected roles (it attaches a deny policy using aws:TokenIssueTime). If needed, attach an explicit deny-all policy to the user.

Minutes 20-45: investigate

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=AKIAEXAMPLE --max-results 50

Then check every region, not just your usual one, for:

• new EC2 instances or Lambda functions (crypto-mining is common)
• new IAM users, keys, roles or policy changes (persistence)
• S3 reads of sensitive buckets
• GuardDuty findings and billing spikes

Minutes 45-60: eradicate

aws iam delete-access-key --user-name USER --access-key-id AKIAEXAMPLE

Delete anything the attacker created. Remove the secret from git history too; rotating it isn't enough if the old value is still public.

After the first hour: recover and learn

• Issue a new key only if truly needed. Prefer roles, and OIDC for CI/CD (e.g. GitHub Actions) so no long-lived key exists.
• Reply to any AWS support or abuse case.
• Write up a timeline, root cause, cost impact and fixes: secret scanning, key-age limits, SCPs, budget alarms.

CloudGuard Templates packages this runbook with a baseline checklist and policy templates in an AWS Security Starter Kit.