Cloud incident response and forensics

A cloud incident is still an incident, but the evidence and containment tools are different. You cannot unplug a region; you revoke identities, change policies and snapshot resources.

Contain first

For a compromised identity:

1. Disable or revoke credentials.
2. Revoke active sessions and tokens.
3. Remove persistence: new roles, keys, trust policies, mailbox rules.
4. Check for other identities created or modified.

For a compromised workload:

1. Isolate the network path.
2. Snapshot the instance or volume.
3. Preserve logs before they rotate.
4. Rebuild from a trusted image rather than cleaning in place.

Evidence sources

• control-plane audit logs;
• identity sign-in logs;
• VPC flow logs and DNS logs;
• object access logs;
• function and container logs;
• snapshots and configuration history.

Note the time zone and clock source. Cloud events often use UTC; your timeline should too.