How can you not know what credentials were used. A simple cloud trail search on the affected infrastructure will tell you.