Responding to Unexpected Activity in a Cloud Account

An instance you did not launch. A region you never use showing charges. A key used from an unfamiliar address. The instinct is to delete everything immediately, and that instinct destroys the information you need.

Work in this order.

1. Preserve before you change

Export or copy the audit trail for the relevant period first. If an attacker still has access, logs can be deleted. Snapshot any affected machine before stopping or destroying it, so the disk can be examined later.

This step costs a few minutes and is the difference between understanding what happened and guessing.

2. Cut access

Then close the doors, in this order:

• Revoke all API keys and access tokens.
• Change the account password.
• Remove and re-enrol second factors.
• Check and reset recovery email addresses and phone numbers.
• Remove unrecognised users, roles and service accounts.
• Invalidate active sessions where the provider allows it.

Recovery paths are the step most often missed, and they undo the rest. See recovery options.

3. Contain the resources

Stop unrecognised compute rather than deleting it. Stopping halts the cost and the activity while preserving the disk. Check every region, since unfamiliar regions are exactly where unwanted resources tend to appear.

Tighten firewall rules to cut off any command-and-control traffic.

4. Work out the entry point

The audit trail usually shows which credential was used. Common answers are a leaked access key committed to a repository, a password reused from a breached service, or a server compromised through an unpatched application.

Rotating credentials without finding the entry point means it happens again.

5. Tell the provider

Contact provider support. They can advise, and where unauthorised usage generated charges they have a process for reviewing it. Report promptly: a request made quickly with a clear account of events is treated very differently from one raised months later.

6. Write it down

Record what happened, what you changed and when. This matters for any billing discussion, for your own understanding, and for anyone who inherits the environment later.

Reducing the odds beforehand

The measures that prevent most of this are unglamorous: multi-factor authentication, short-lived credentials rather than static keys, least privilege, and audit logging enabled before anything goes wrong. They are covered in a practical security baseline and least privilege without slowing your team down.