GuardDuty at high severity: the web server's credentials are being used from an address outside AWS

The public MasterLinux site (www.masterlinux.lab) runs on the instance ml-web-01 (i-0e7a3c91b5d24f680) behind an ALB: nginx in front of a Node.js application. The instance carries the IAM role ml-web-role, which gives it access to S3. Since last week, the forum shows a preview of the links pasted by students (title and image of the target page).

At 02:31, GuardDuty raised a high severity alert on this role. The night team checked: no unusual SSH login, the site answers. The head of security asks you to understand how the credentials got out, what was read, and to cut off the attacker's access without stopping the site, before registrations open at 09:00.

You are the on-call cloud security engineer, on ml-poste-01 (AWS CLI v2, region eu-west-3), with SSH access to ml-web-01 through the bastion.