An organization notices unusual API activity in its AWS account, suggesting unauthorized access and potential...

This scenario indicates identity compromise in a cloud environment, reflected by unusual API activity. The ECIH Cloud Security Incident Handling module emphasizes that in cloud platforms, identity and access management (IAM) is the primary security boundary. When API misuse is detected, the most urgent action is to invalidate potentially compromised credentials.

Option D is correct because rotating all IAM access keys immediately cuts off the attacker’s ability to continue abusing API access. Reviewing IAM policies for excessive permissions further reduces the attack surface and prevents privilege misuse. ECIH explicitly states that compromised credentials must be revoked before implementing additional detective or preventive controls.

Option A may help limit access but does not address stolen credentials that could still be abused elsewhere. Option B improves future visibility but does not mitigate the active incident. Option C is unrelated, as there is no indication of a DDoS attack.

ECIH guidance prioritizes containment through credential revocation in cloud incidents involving unauthorized API usage. Therefore, rotating IAM keys and reviewing permissions is the most critical immediate mitigation step.