# Stopping S3 Data Exfiltration in Real Time: A Step-by-Step Incident Response

The Scenario An EC2 instance with an attached IAM role has s3:GetObject on a bucket...