Automated Response and Remediation

What it is

Automated response means that a detection triggers a containment or fix without waiting for a person. It shortens the time an attacker has, and it removes inconsistent manual steps.

Not every action should be automatic. The skill the exam tests is choosing which actions are safe to automate, and which service runs them.

How it works

The building blocks

!GuardDuty findings, API events and Security Hub custom actions reach an EventBridge rule (the trigger layer), which starts Systems Manager Automation, Lambda or Step Functions (the action layer) to isolate or fix a resource; an AWS Config rule can run Automation directly through a remediation action.

Choose Automation documents for standard AWS operations, because AWS provides many ready runbooks. Choose Lambda when you need code, and Step Functions when you need a workflow that spans minutes or waits for a person.

Event driven response

An EventBridge rule on a high severity GuardDuty finding can start an Automation runbook that isolates the instance.

{
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": {
    "type": [{ "prefix": "UnauthorizedAccess:EC2/" }],
    "severity": [{ "numeric": [">=", 7] }]
  }
}

The target is an SSM Automation document, and the rule needs an IAM role that is allowed to start the automation. The automation itself uses a separate execution role with only the permissions it needs, such as changing a security group and creating a snapshot.

Config remediation

AWS Config evaluates resources against rules, and a remediation action can run an Automation document on each non compliant resource.

# AWS CLI: remediate public S3 buckets automatically
aws configservice put-remediation-configurations --remediation-configurations '[{
  "ConfigRuleName": "s3-bucket-public-read-prohibited",
  "TargetType": "SSM_DOCUMENT",
  "TargetId": "AWS-DisableS3BucketPublicReadWrite",
  "Automatic": true,
  "MaximumAutomaticAttempts": 3,
  "RetryAttemptSeconds": 60,
  "Parameters": {
    "AutomationAssumeRole": { "StaticValue": { "Values": ["arn:aws:iam::111122223333:role/ConfigRemediationRole"] } },
    "S3BucketName": { "ResourceValue": { "Value": "RESOURCE_ID" } }
  }
}]'

Remediation can be manual, where a person approves it, or automatic. Config also limits retries with MaximumAutomaticAttempts, which prevents endless loops on a fault.

Multi account response

In an organization, run the detection and the rule centrally and act in member accounts by assuming a response role. A common pattern forwards events to a central bus, then a Lambda function or Automation assumes a pre created role in the affected account. The role trusts only the central automation role.

Safe automation design

• Least privilege. Give each runbook its own role limited to its actions.
• Reversible first. Prefer isolating, tagging and snapshotting over terminating or deleting.
• Preserve evidence. Take a snapshot before any destructive step.
• Loop control. Make sure the fix does not trigger the rule again, for example by filtering on a tag that the runbook sets.
• Human approval for high impact actions, using an Automation approval step or Step Functions.
• Notify and log. Every automated action should notify the team, and runs are recorded in CloudTrail.
• Test in a non production account using sample findings.

Typical scenarios