APIs and web services require extensive hardening and must assume attacks from authenticated and unauthenticated adversaries.
If the management plane has been breached, you should confirm the templates/configurations for your infrastructure or applications have not also been compromised.
How can virtual machine communications bypass network security controls?
What should every cloud customer set up with its cloud service provider (CSP) that can be utilized in the event of an incident?