Question

During an incident, a security analyst discovers that temporary credentials issued by an IAM role (used by a fleet of EC2 instances) were exfiltrated and are being used from an external IP to make API calls. The analyst has already identified the role. To immediately contain the threat and invalidate all currently active temporary sessions issued by this role — including those already handed out — while allowing legitimate instances to obtain new credentials after remediation, which action is MOST effective?

Accepted Answer

Attach an inline policy to the role that denies all actions when the token issue time (aws:TokenIssueTime) is earlier than the current time (via an AWSRevokeOlderSessions-style DateLessThan condition).

Answer

Delete the IAM role entirely and recreate it with the same name and trust policy after the incident is resolved.

Answer

Rotate the IAM access keys associated with the role so the exfiltrated credentials stop working.

Answer

Add a Deny statement to the role's trust policy blocking the sts:AssumeRole action from the external IP address.