A long-lived IAM access key is exposed in a public repository. Which sequence best limits risk while supporting investigation?

1. Rename the IAM user while retaining the same active key.
2. Disable the exposed credential, assess its activity and permissions, and replace dependent access safely.
3. Delete CloudTrail logs to avoid retaining the exposed key identifier.
4. Rotate only the repository password while leaving the AWS key active.