1. CONTAIN: revoke/rotate the key NOW; disable the identity

2. SCOPE: audit logs — what did the attacker access/create?

3. HUNT: new IAM users/keys, resources, persistence, lateral move

4. ERADICATE & RECOVER: remove attacker artifacts, restore clean

5. PREVENT: secret scanning, OIDC, history purge, postmortem

This integrates the whole guide. Contain first — revoke the key and disable the identity immediately; every minute it’s live is more damage. Scope via audit logs (CloudTrail): what did the credential do, from where? Hunt for persistence — attackers create backdoor IAM users, access keys, and resources; assume they tried to entrench and move laterally. Eradicate those artifacts and recover to a known-good state. Then prevent recurrence: secret scanning in CI and pre-commit, replace static keys with OIDC/workload identity, purge history (knowing the key must still be rotated), and run a blameless postmortem on how it leaked and why it wasn’t caught.

What earns the offer: Leading with containment over investigation, knowing a leaked key means hunting for attacker-created persistence (not just rotating), and closing with systemic prevention — it shows you think in incidents and root causes, not just one-off fixes.