Privilege escalation detected

Your cloud audit-log anomaly detector pages at 02:50: an IAM principal belonging to a low-privilege CI build role performed a sequence in 90 seconds, iam:CreateAccessKey for an admin user, iam:AttachUserPolicy attaching AdministratorAccess to a newly created user, then sts:AssumeRole into the prod admin role and ec2:DescribeInstances across all regions. The build role should only be able to push to one ECR repo. No human was on shift. You're the on-call security engineer. Triage and respond.