Isolating instances for forensic investigation

When you encounter a security threat within your AWS environment and have identified that an EC2 instance may have been compromised, what actions should you take to help prevent the threat from extending further into your network and affecting and compromising even more resources?