Incident response and containment on AWS

Incident response questions test order: contain, preserve evidence, investigate, then recover. The best answer stops damage without destroying proof.

Compromised IAM credentials

For an IAM user, deactivate the access keys, attach a deny-all policy and remove the console password. For a role you cannot delete issued sessions, so use Revoke active sessions in the IAM console. It attaches an inline policy that denies everything when aws:TokenIssueTime is before the current time. Sessions created afterwards are not blocked.

{
  "Effect": "Deny",
  "Action": "*",
  "Resource": "*",
  "Condition": {"DateLessThan": {"aws:TokenIssueTime": "2026-11-03T10:00:00Z"}}
}

In IAM Identity Center, disable the user and revoke their active sessions. Then use the organization trail with Athena, or CloudTrail Lake, to review recent activity across accounts.

Compromised EC2 instance

Follow this sequence:

1. Tag the instance (for example Status=Quarantine) and enable termination protection so nobody removes it.
2. Capture instance metadata and, if possible, memory.
3. Snapshot all EBS volumes.
4. Replace the security groups with an isolation group that has no inbound or outbound rules. Deny the instance role sessions.
5. Investigate on a separate forensic instance in an isolated VPC, using volumes created from the snapshots.

Do not stop or terminate first, because memory and volatile data are lost. Security groups are stateful, so an already tracked connection can survive a rule removal; moving the instance to a group with no rules, or adding a NACL deny (NACLs are stateless), cuts it.

Automating response

Findings from GuardDuty, Security Hub and Macie go to Amazon EventBridge. A rule matches on source, detail-type and finding type. Targets include Lambda, Step Functions, SNS and Systems Manager Automation runbooks.

Need	Use
Run custom code on a finding	EventBridge rule and Lambda
Fix a noncompliant resource	AWS Config rule with remediation (Systems Manager Automation document)
Notify people	SNS topic or AWS Chatbot
Understand the scope	Amazon Detective

Data being read from S3

To stop downloads quickly, revoke the role sessions or apply a temporary bucket policy that denies everyone except trusted principals. Enabling Macie does not stop an attack in progress.

Exam traps

• Revoking sessions blocks old tokens; editing the role’s permissions alone is slower and breaks legitimate use.
• Stopping the instance destroys memory evidence.
• GuardDuty never calls Lambda directly; EventBridge is the bridge.
• Deactivating an IAM user’s keys does not end an assumed-role session already issued.
• Terminate only after evidence is captured.

Practice questions

Choose an answer, then review the explanation to check your understanding.

1. An attacker is using temporary credentials from an EC2 instance role to read an S3 bucket. What is the fastest way to cut off that access without deleting the role?

1. A.Delete the instance
2. B.Use Revoke active sessions on the role
3. C.Rotate the EC2 key pair
4. D.Remove the S3 bucket policy

Show answer

Answer: B.Revoke active sessions adds a deny policy based on aws:TokenIssueTime, so existing temporary credentials stop working while new sessions still can.

2. A suspected compromised EC2 instance must be isolated, but its memory and disk must stay available for investigation. What should the engineer do first?

1. A.Terminate the instance and keep the AMI
2. B.Replace its security groups with an isolation group that has no rules, and snapshot the EBS volumes
3. C.Stop the instance
4. D.Delete its IAM role

Show answer

Answer: B.Swapping to an isolation security group blocks traffic and keeps the instance running for forensics. Snapshots preserve disk evidence. Stopping loses memory.

3. A GuardDuty finding must automatically trigger a Lambda function that moves the instance to a quarantine security group. Which design is correct?

1. A.GuardDuty invokes the Lambda function directly
2. B.An EventBridge rule matches GuardDuty findings and targets the Lambda function
3. C.A VPC Flow Logs subscription filter calls the function
4. D.An AWS Config rule triggers the function on each finding

Show answer

Answer: B.GuardDuty publishes findings to EventBridge. A rule with a pattern on the finding type invokes the target.

4. An IAM user's access keys were leaked. The engineer must stop use of the user in all accounts and review the past 7 days of activity. Which approach works?

1. A.Deactivate the keys, deny the user, and query the organization CloudTrail trail or CloudTrail Lake
2. B.Delete the CloudTrail trail to stop further logging
3. C.Enable Macie on all accounts
4. D.Rotate the root password

Show answer

Answer: A.Deactivate the credentials and attach a deny policy, then use the organization trail (Athena) or CloudTrail Lake to see the actions of that principal across accounts.