What problem does it solve? Responding to a cloud compromise without a defined order of operations risks destroying forensic evidence, missing attacker persistence, or revoking access before scoping the blast radius. This playbook provides a sequenced, provider-specific methodology for containing and eradicating cloud intrusions. ## Core Features & Use Cases - Blast-radius scoping: Pivot from an initial indicator across principals, regions, and resources using CloudTrail, Azure Activity Log, and GCP Audit Logs queries. - Forensics-first containment: Capture logs, disk snapshots, and IAM policy JSON before revoking sessions or keys, preserving attribution evidence. - Ordered eradication and recovery: Remove rogue IAM principals, shadow access keys, and malicious functions, then re-scan to confirm attacker TTPs no longer fire. - Use Case: An AWS access key shows anomalous API calls from an unknown IP. Follow the playbook to scope affected resources, snapshot the compromised instance, deactivate the key, quarantine the instance, and document the control gap. ## Quick Start Walk me through responding to a compromised IAM user in my AWS account using the cloud incident response playbook.
