An application runs on an Amazon EC2 instance with an attached IAM role that permits use of an AWS Key Management Service (AWS KMS) customer managed key and access to an Amazon S3 bucket containing 2 TB of sensitive data. A security engineer discovers a potential vulnerability on the instance that could expose the data but cannot immediately stop the instance. What is the fastest way to prevent exposure of the sensitive data?

The fastest way to prevent data exposure is to revoke the IAM role's permissions. Revoking active session credentials immediately invalidates any temporary credentials the EC2 instance is currently using. Updating the S3 bucket policy to explicitly deny the role ensures that even if new credentials are somehow obtained, access to the S3 bucket is blocked at the resource level. Removing the role from the EC2 instance profile prevents the instance from assuming that role in the future. Copying data to a new instance and re-encrypting is too slow and complex for an immediate threat. Blocking public S3 endpoint IP ranges with a host-based firewall is ineffective if the instance can still access S3 via private endpoints or if the vulnerability allows bypassing the firewall. Disabling the KMS key and re-encrypting data is also a time-consuming process and doesn't immediately prevent access to the existing data.