AWS Certified Security – SpecialtyDomain 1: Incident ResponseMedium
A security engineer is tasked with automating the containment of compromised EC2 instances. Upon detection of a severe threat by Amazon GuardDuty, the automated response system should immediately detach all IAM roles from the affected EC2 instance to revoke its permissions, preventing further unauthorized actions or privilege escalation. Which AWS service should be used to orchestrate this automated response?
- AAWS Step Functions.
- BAWS Lambda.
- CAWS Systems Manager Run Command.
- DAmazon EventBridge (CloudWatch Events).
Show answer & explanationAnswer & explanation
Correct answer: D. Amazon EventBridge (CloudWatch Events).
Amazon EventBridge (formerly CloudWatch Events) is a serverless event bus service that makes it easy to connect applications together using data from your own applications, integrated SaaS applications, and AWS services. It can trigger AWS Lambda functions in response to GuardDuty findings, which can then call the necessary AWS API to detach IAM roles.
Why the other options are wrong
- A. AWS Step Functions can orchestrate complex workflows, but for a direct, single-action response to an event like a GuardDuty finding, EventBridge triggering Lambda is simpler and more appropriate.
- B. AWS Lambda would perform the actual action (detaching the IAM role), but it needs to be triggered by an event. EventBridge is the service that orchestrates the trigger based on GuardDuty findings.
- C. Systems Manager Run Command executes commands on EC2 instances, but detaching an IAM role is an API operation, not a command run on the instance itself. It's also not the ideal orchestrator for event-driven responses.
Automated IR with EventBridge & Lambda
Amazon EventBridge acts as the central event bus to receive security findings (e.g., from GuardDuty) and trigger AWS Lambda functions to execute automated incident response actions, such as revoking IAM roles.
- EventBridge reacts to events from AWS services.
- Lambda executes custom code in response to triggers.
- Together, they form a powerful serverless automation pattern.
Memory trick: EventBridge is the traffic cop directing security alerts to the right Lambda responders.