# Stopping S3 Data Exfiltration in Real Time: A Step-by-Step Incident Response

The Scenario

An EC2 instance with an attached IAM role has s3:GetObject on a bucket containing sensitive data. An attacker compromises the instance, extracts temporary credentials from the metadata service, and begins bulk-downloading objects. GuardDuty fires Exfiltration:S3/AnomalousBehavior. The development team needs 4 hours to patch. You need to cut off access now.

This post walks through exactly how to do that — commands, policies, validation steps, and the reasoning behind each decision.

Step 1: Confirm the Compromised Role

First, identify which IAM role is attached to the EC2 instance. You need the instance ID from the GuardDuty finding.