A compromised AWS key launched GPU instances across 3 regions over a weekend. Cost Explorer flagged the spend but not the cause. Three signals were present and ignored. Here's the workflow that cuts the 48-hour window down to under 2 hours.