Revoking and Rotating Exposed Secrets

Once a credential is confirmed leaked, speed matters — but so does order. Disabling a key abruptly can break production if you do not first understand what depends on it.

The goal is to cut off the attacker while keeping legitimate workloads running, ideally in a single rehearsed sequence.

The first move on a leaked access key is to deactivate it, not delete it. Setting the key status to Inactive immediately stops it from working.

Keeping it (inactive) for now preserves it for forensic correlation in CloudTrail. You delete it only after the investigation is complete.