Unexplained compute in a cloud account

The cheapest incident to detect and the one most often misread as a finance problem. The compute is the symptom; the credential that created it is the incident, and it usually still works.

Trigger. A billing alert, instances nobody created, or a provider notification about mining.

The first 90 minutes1 of 5 expire

01 02 03 04 05

045 min90

01
Find the identity that created the resources
by 20 min
The audit trail names the caller for every creation event. That identity, not the instance, is the scope of the incident.
02
Revoke and rotate that identity, including its sessions
by 35 minexpires
Keys, and any role it can assume. Temporary session credentials issued from it stay valid for their lifetime unless explicitly revoked, so a key deletion alone leaves a working session behind.

Tell somebody

Finance, on the spend, and the provider, who will often waive fraudulent usage if asked promptly
The platform team, on whether the same credential pattern exists elsewhere
Executive, if data access is found alongside the mining

Drawn from

The documents these steps come from, so you can check one rather than take it on trust.

The evidence

What each source proves, and what it does not.

logon events

Collect it in one go

A read-only script that gathers most of the above in volatility order, with a hash manifest.

Triage collection

Make it yours

Replace the escalation list with real names, and the timings with what your change process actually allows. A playbook that assumes an authority you do not have will stall at the step that needed it.

Find the identity that created the resources

Revoke and rotate that identity, including its sessions