Question

A security engineer receives a GuardDuty finding of type UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS. The finding indicates that credentials from an EC2 instance's IAM role were used from an IP address outside AWS. The instance itself is still running normally and serving production traffic, and the team cannot immediately terminate or isolate it without causing an outage. What is the MOST effective immediate containment action to stop the attacker from continuing to use the stolen credentials?

Accepted Answer

Attach an IAM policy to the instance role that denies all actions when the request does not originate from the instance's VPC using the aws:SourceVpc or aws:VpcSourceIp condition keys, effectively revoking the exfiltrated session's access

Answer

Rotate the EC2 instance's SSH key pair and reboot the instance to force new temporary credentials to be issued by the metadata service

Answer

Enable IMDSv2 in required mode on the running instance so the exfiltrated credentials are immediately invalidated

Answer

Create a GuardDuty suppression rule for the finding so the SOC can continue monitoring the instance without alert noise while planning a maintenance window