Create a new key-pair in the AWS console and boot up a new instance (assuming the attacker is removed from IAM users). This requires configuring the instance, which can be time-consuming ...

No go. I made an image (AMI) and used it to create a new instance, with the same key pair and security group. It won't even connect to port 22. Or port 80, for that matter.

AWS will make an AMI from your snapshot with some behind-the-scenes tinkering. If you are used to VMware snapshots, you will find EC2 snapshots are not the same. Examine the original EC2 machine.

Nick Hardiman shows you how to set up a secure connection to an Amazon EC2 machine using PuTTY and Pageant to handle your private key.