A security engineer received an Amazon GuardDuty alert indicating a finding involving the Amazon EC2...

The GuardDuty finding “IAMUser/InstanceCredentialExfiltration” indicates that temporary credentials from the instance metadata service have been stolen and used from an unusual location. The immediate priority is to revoke all existing IAM sessions for that instance profile to block the compromised credentials.

This is considered a critical containment action. IAM allows active session revocation, which invalidates credentials associated with a compromised instance profile.

This is explicitly covered under the Incident Response domain in the AWS Security Specialty study material, which emphasizes session revocation and credential rotation in response to exfiltration events.