A cloud key showed up in the open
An access key is in a log line, a ticket, or a repository. Treat it as already copied. Revoke it, then read what it was used for. Do not paste it into another note to preserve it.
Stop passing the secret around
The key is a credential, not a sample to quote in full. Record where you found it, the account it belongs to, and the time. Redact the secret itself in the ticket you file.
Replying to the thread with the key still visible, or copying it into a personal note "just in case," is how it spreads. Delete is not the same as revoke. The cloud account has to refuse that key.
Revoke the key you found
Disable or delete that access key on the account that owns it. Say which account and which key identifier, not the secret. If people still need the access, they get a new key through the normal path, after this one is dead.
A policy that allowed the key to do too much is a second finding. The IAM lab walks one request through the policies that decide allow or deny. Read that before you widen a replacement key to "make the outage stop."
Then read the log
After the key is revoked, ask what it already called. The useful log names the key, the time, the action, and the source. One question of a log is enough to start. The log-query lab is that habit on a sample, not a live account.
The cloud-security workbench is the identity and the policy. The detection workbench is the log you should have been keeping. If the log is missing, write that down. A missing log is part of the finding.