CloudTrail shows an IAM user's access key making API calls from an unknown IP — the key is compromised. What's the correct FIRST response?
A.Delete the IAM user entirely
Deleting the user is heavier-handed, loses forensic context, and may break workloads.
B.Deactivate the access key (and rotate), then investigate the blast radius
Correct. Contain first (deactivate), then investigate, then rotate.
C.Send the user an email asking if it was them
Email delays containment while the attacker keeps access.
D.Change the user's console password
Console password doesn't stop programmatic API abuse of the access key.
Why this answer
Deactivate the exposed key immediately to stop bleeding — then scope the incident via CloudTrail (what was called, from where) and rotate credentials. Deleting the user first destroys evidence and can break applications using other credentials on that user.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Incident Response practice session.
Practice Incident Response