Leaked AWS key unauthorized access
At 02:14 UTC GitHub's secret-scanning partner alert fires: a long-lived AWS access key (AKIA...) for the prod 'data-pipeline' IAM user was pushed to a public repo 40 minutes ago in a commit by a contractor. CloudTrail now shows that same key making GetCallerIdentity, then ListBuckets, then GetObject calls from an IP in a hosting ASN you've never seen, ~9 minutes ago. GuardDuty has a 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' finding pending. The key has AdministratorAccess via an attached policy. How do you triage, contain, and remediate?
What a strong answer looks like
Stop the bleeding first (mitigate), then form hypotheses from real signals. Separate root cause from symptom, communicate status as you go, and close with what prevents a repeat.
0:00 of about 35 min
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.