What Would You Cut If Your AWS CI Role Was Compromised?

Scanners show you the attack path. Almost nobody shows you which single deny stops a compromised CI role without taking down prod. That missing piece is containment.