AWS Incident Response Architecture – Forensics, Containment & Remediation

AWS Incident Response Architecture — Overview

Incident Response accounts for 14% of the SCS-C03 exam (Domain 2). Questions focus on forensic isolation of compromised instances, automated remediation pipelines, and the specific AWS services used at each phase. This post covers the complete IR lifecycle: Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned.

IR Phases — AWS Services Mapping

EC2 Forensic Isolation — The Key Exam Pattern

When an EC2 instance is compromised, the standard forensic procedure is:

1. Tag the instance: Status=Compromised, Incident=IR-2026-001 (for tracking)
2. Isolate the network: Replace the security group with a “forensic isolation” SG that allows NO inbound/outbound traffic (or only outbound to forensic tools)
3. Preserve evidence:
   • Create EBS snapshots (disk forensics)
   • Capture memory dump (if instance is running — use SSM to run memory capture tool)
   • Capture instance metadata (instance type, security groups, IAM role, network interfaces)
4. Disable auto-termination: Set DisableApiTermination=true (prevent ASG from terminating)
5. Detach from ASG/ELB: Remove from load balancer target group (stops new traffic)
6. Analyze in forensic account: Share EBS snapshots to dedicated forensic account → mount and analyze offline

Critical exam point: Do NOT terminate the instance immediately. You need evidence for root cause analysis. Isolate first, preserve, THEN terminate after analysis.

IAM Credential Compromise Response

1. Identify compromised credentials: CloudTrail shows unauthorized API calls from unexpected IPs/regions
2. Disable the credential:
   • Access key: Deactivate (don’t delete yet — need for audit trail)
   • IAM role: Add inline Deny policy with condition aws:TokenIssueTime < [current time] (revokes all existing sessions)
   • Console password: Delete login profile
3. Review CloudTrail: What did the attacker do? What resources were accessed/modified?
4. Rotate all related credentials: Any secrets the compromised role could access (Secrets Manager, Parameter Store)
5. Review resource policies: Check if attacker created backdoor access (new IAM users, role trust policies, S3 bucket policies)

Automated Remediation Patterns

Amazon Detective — Investigation

• What: Automatically builds a security behavior graph from CloudTrail, VPC Flow Logs, GuardDuty, Security Lake
• How: Visualizes relationships — which IAM entity accessed which resource, from which IP, at what time
• Use case: Determine blast radius of a compromise. “What else did this attacker do? What other resources were accessed?”
• Exam note: Detective is for investigation (post-detection). GuardDuty is for detection. Don’t confuse them.

Exam Tips

AWS Certification Exam Practice Questions

Question 1:

GuardDuty detects that an EC2 instance is communicating with a known command-and-control server. The security team needs to immediately contain the threat while preserving forensic evidence. Which sequence of actions is correct?

1. Terminate the instance immediately to stop the C2 communication
2. Replace the instance’s security group with an isolation SG (no inbound/outbound), create EBS snapshots, then investigate
3. Add a NACL rule blocking the C2 IP, leave the instance running normally
4. Detach the instance’s IAM role and wait for the connection to timeout

Question 2:

An IAM access key has been exposed on GitHub. CloudTrail shows the key was used to create new IAM users and launch EC2 instances in multiple regions. What is the FIRST action to take?

1. Delete the IAM user who owned the exposed key
2. Deactivate the exposed access key and attach a Deny-all inline policy to the user
3. Rotate the access key (create new, delete old)
4. Change the console password for the user

Question 3:

A security engineer needs to revoke all active sessions for an IAM role that has been compromised. The role is assumed by multiple Lambda functions and EC2 instances. How can ALL existing role sessions be invalidated immediately?

1. Delete the IAM role and recreate it
2. Attach an inline policy to the role with Deny on all actions, conditioned on aws:TokenIssueTime being before the current timestamp
3. Change the role’s trust policy to deny all principals
4. Remove all managed policies from the role

Question 4:

A company wants to automatically isolate any EC2 instance when GuardDuty detects cryptocurrency mining activity. The solution must also capture a memory dump before isolation and notify the security team. Which architecture achieves this?

1. GuardDuty → SNS → Security team email (manual response)
2. GuardDuty → EventBridge → Step Functions (parallel: SSM RunCommand for memory dump + Lambda for SG swap + SNS notification)
3. GuardDuty → Lambda (sequential: memory dump, then isolate, then notify)
4. GuardDuty → Config rule → auto-remediation

Question 5:

After a security incident, the investigation team needs to analyze the compromised EC2 instance’s disk contents. The instance is in Account A (production). Forensic analysis must happen in Account B (forensic account) to avoid contaminating the production environment. How should the EBS data be transferred?

1. Create AMI of the instance and share with Account B
2. Create EBS snapshots, modify snapshot permissions to share with Account B, Account B creates volumes from shared snapshots in the forensic account
3. Use DataSync to copy the EBS volume to Account B
4. Attach the EBS volume to an instance in Account B

Related Posts

• Security Services Architecture – GuardDuty & Security Hub
• Centralized Logging Architecture
• IAM Security Architecture
• Data Encryption Architecture

References

• AWS Security Incident Response Guide
• Automate EC2 Incident Response — AWS Security Blog
• Amazon Detective User Guide
• Step Functions for Security IR — AWS Blog

Frequently Asked Questions

Why not just terminate a compromised instance immediately?

Terminating destroys volatile evidence (memory, running processes, network connections). You lose the ability to determine: what the attacker did, what data was exfiltrated, how they got in, and whether they established persistence elsewhere. Always isolate first (SG swap), preserve evidence (snapshots + memory), investigate, THEN terminate. The isolation stops the threat while preserving evidence.

How do I revoke temporary credentials from an assumed IAM role?

Attach an inline Deny policy to the role with condition: aws:TokenIssueTime less than current time. This immediately invalidates ALL sessions issued before that timestamp. New sessions (assumed after the timestamp) still work normally. This is the official AWS-recommended approach — you cannot individually revoke STS tokens.

What is the difference between GuardDuty and Detective?

GuardDuty is for detection — it identifies threats (finding: “EC2 is talking to a C2 server”). Detective is for investigation — after you know something happened, Detective helps you understand the full scope (“what else did the attacker do, what was the timeline, which other resources were affected”). GuardDuty triggers the alert; Detective helps you investigate it.