Cloud account compromise response

Overview

Cloud account takeover often starts with phishing an admin, leaked API keys, or a hijacked federated session. Speed and preservation matter; blitz-deleting resources can destroy forensics.

First hour

• Rotate privileged credentials and revoke active sessions (Entra ID / IAM).
• Enable MFA everywhere not already enforced; block legacy auth.
• Isolate: disable compromised keys, set deny all emergency SCP or policy until scope known—communicate blast radius.

Investigation

Export activity logs / CloudTrail to immutable storage; snapshot IAM policies; check new users, roles, access keys, budget changes, and forwarding rules.

Recovery

Remove persistence (scheduled tasks in automation accounts, Lambda backdoors, new subscriptions). Forensics partner if regulated or ransomware adjacent.

Post-incident

Root-cause note: PIM adoption, break-glass usage, CI/CD secrets scanning. Add anomaly detection on owner actions.