Automated Remediation and Configuration Changes

What it is

Automated remediation means a system detects a problem or a trigger and changes configuration by itself: closing an open port, replacing a compromised instance, scaling a service or updating a record. It shortens the time between detection and fix from hours to seconds.

The pattern is always detect, decide, act and record. Detection comes from an alarm, a Config rule or a finding. The action is a Systems Manager Automation runbook, a Lambda function or an Auto Scaling operation.

How it works

Remediation with AWS Config

A Config rule evaluates resources and marks them noncompliant. A remediation action attaches a Systems Manager Automation document to the rule, and it can run automatically or by manual approval.

aws configservice put-remediation-configurations --remediation-configurations '[{
  "ConfigRuleName": "restricted-ssh",
  "TargetType": "SSM_DOCUMENT",
  "TargetId": "AWS-DisablePublicAccessForSecurityGroup",
  "Automatic": true,
  "MaximumAutomaticAttempts": 3,
  "RetryAttemptSeconds": 60,
  "Parameters": {
    "GroupId": {"ResourceValue": {"Value": "RESOURCE_ID"}},
    "AutomationAssumeRole": {"StaticValue": {"Values": ["arn:aws:iam::111122223333:role/ConfigRemediationRole"]}}
  }
}]'

The remediation runs with the assume role named in the parameters, so that role needs only the permissions the fix requires. Use this approach for compliance drift, such as public buckets, open security groups and unencrypted volumes, because the rule continues to check after the fix.

Remediation with EventBridge

For events that Config does not cover, match an event and call a target. Here, a rule reacts to a high severity GuardDuty finding.

{
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": {"severity": [{"numeric": [">=", 7]}]}
}

A Lambda or Automation target can then isolate the instance: replace its security groups with an isolation group that allows no inbound or outbound traffic, snapshot its volumes for forensics, tag it, and notify the security team. Isolating, not terminating, keeps the evidence.

Systems Manager Automation as the action engine

Automation runbooks give audited, repeatable actions with approval steps, branching and rate control. AWS provides many documents for common fixes, and your own can call any AWS API through aws:executeAwsApi. Runbooks can be triggered by EventBridge, Config, alarms, maintenance windows or by hand.

Responding to lifecycle events

Auto Scaling lifecycle hooks pause an instance during launch or termination and publish an event. A rule can run a function or a runbook while the instance waits, for example to register it with a service, pull configuration, or drain connections and upload logs before termination. The hook ends when the action completes, or when the timeout expires.

aws autoscaling complete-lifecycle-action --lifecycle-hook-name launch-hook \
  --auto-scaling-group-name web-asg --lifecycle-action-result CONTINUE \
  --instance-id i-0123456789abcdef0

Other common event to change patterns

Safe automation

• Give each remediator a least privilege role and restrict what it can touch with tags or conditions.
• Make actions idempotent, so a repeat does no harm.
• Guard against loops: a fix that creates a new event should not retrigger itself endlessly.
• Start with notify only, then enable automatic fixes when you trust the rule.
• Add rate limits, approval steps for destructive actions and a clear audit trail through CloudTrail and notifications.

Fixing at the source

Remediation treats symptoms. Pair it with a preventive control, such as an SCP or a CloudFormation Hook, and fix the template that created the bad resource, or the drift will return.