An EC2 instance with compromised credentials is exfiltrating data from an S3 bucket, triggering a GuardDuty alert. To immediately stop this, identify the compromised IAM role using the instance ID. Then, revoke all active sessions for that role by attaching a deny policy that invalidates credentials issued before the current timestamp. This policy uses a condition based on aws:TokenIssueTime to deny all actions for older credentials. This process is effective because the deny is checked with every API request, immediately stopping exfiltration. You can validate the revocation by checking CloudTrail for AccessDenied events and confirming legitimate workloads remain unaffected by testing access to the S3 bucket. It is crucial to isolate the compromised instance after revoking credentials to prevent the attacker from obtaining new ones. While temporary credentials eventually expire, this wait is unacceptable during an active exfiltration. The inline policy should be removed after the development team deploys a permanent fix to avoid unintended access denials later. This targeted approach using an IAM policy is superior to broader measures like security group isolation or bucket-wide deny policies, which can cause wider outages or fail to address the root cause. The recommended incident response sequence involves identifying the role, revoking sessions, isolating the instance, and then validating the actions.