What you should do when EC2 is hacked?

1. Stop the instance immediately.
2. Take a snapshot of the EBS Volume.
3. Deploy the instance in to an isolated environment.
4. Isolate VPC, ensure no internet access.
5. Access the instance using a Forensic Instance.
6. Review the logs for the next steps.
7. Perform the forensic analysis.