The Scenario An EC2 instance with an attached IAM role has s3:GetObject on a bucket containing sensitive data. An attacker compromises the instance, extracts temporary credentials from the metadata service, and begins bulk-downloading objects. GuardDuty fires Exfiltration:S3/AnomalousBehavior . The development team needs 4 hours to patch. You need to cut off access now. This post walks through exactly how to do that — commands, policies, validation steps, and the reasoning behind each ...