AWS for DevOps — Security Automation

13.5 — Security Automation

The best security response is an automated one. By the time a human reviews an alert, the damage may already be done. This section covers patterns for automatically detecting and remediating security issues.

Real-World Analogy

Security automation is like a smart home security system. When a sensor detects an intruder (GuardDuty finding), it doesn’t just ring an alarm — it automatically locks all doors (block network access), turns on lights (enable detailed logging), calls the police (pages on-call), and saves camera footage (preserve evidence).

Automation Architecture

  ┌──────────┐    ┌──────────────┐    ┌──────────────┐
  │GuardDuty │───→│ EventBridge  │───→│   Lambda     │
  │Config    │    │              │    │              │
  │CloudTrail│    │ Rule:        │    │ Actions:     │
  └──────────┘    │ severity >= 7│    │ • Block IP   │
                  └──────────────┘    │ • Isolate EC2│
                                      │ • Revoke key │
                                      │ • Notify SNS │
                                      └──────────────┘

Pattern 1: Auto-Isolate Compromised EC2

When GuardDuty detects a compromised EC2 instance, automatically isolate it:

# EventBridge rule for EC2 compromise findings
$ aws events put-rule \
    --name auto-isolate-ec2 \
    --event-pattern '{
      "source": ["aws.guardduty"],
      "detail-type": ["GuardDuty Finding"],
      "detail": {
        "type": [{"prefix": "UnauthorizedAccess:EC2"}],
        "severity": [{"numeric": [">=", 7]}]
      }
    }'

Lambda function logic (pseudocode):

1. Get the instance ID from the GuardDuty finding
2. Create a "quarantine" security group (no inbound, no outbound)
3. Replace all security groups on the instance with quarantine SG
4. Tag the instance: Status=Quarantined, QuarantineDate=now
5. Create a snapshot of all attached EBS volumes (preserve evidence)
6. Send notification to SNS topic with finding details

Pattern 2: Auto-Block Malicious IPs

# EventBridge rule for any high-severity finding with a remote IP
$ aws events put-rule \
    --name auto-block-ip \
    --event-pattern '{
      "source": ["aws.guardduty"],
      "detail-type": ["GuardDuty Finding"],
      "detail": {
        "severity": [{"numeric": [">=", 7]}]
      }
    }'

Lambda function logic:

1. Extract the remote IP from the GuardDuty finding
2. Add the IP to a WAF IP set (blocklist)
3. Add the IP to a NACL deny rule
4. Log the action to CloudWatch
5. Notify the security team via SNS

Pattern 3: Auto-Remediate Public S3 Buckets

# EventBridge rule for AWS Config non-compliance
$ aws events put-rule \
    --name auto-fix-public-s3 \
    --event-pattern '{
      "source": ["aws.config"],
      "detail-type": ["Config Rules Compliance Change"],
      "detail": {
        "configRuleName": ["s3-bucket-public-read-prohibited"],
        "newEvaluationResult": {
          "complianceType": ["NON_COMPLIANT"]
        }
      }
    }'

Lambda function logic:

1. Get the bucket name from the Config event
2. Put S3 Public Access Block on the bucket
3. Remove any public bucket policy statements
4. Log the remediation action
5. Notify the bucket owner via SNS

Pattern 4: Auto-Revoke Exposed Credentials

When CloudTrail detects credentials used from an unusual location:

1. Disable the IAM access key
2. Attach a deny-all policy to the IAM user
3. Notify the security team
4. Create an incident ticket (via SNS → Lambda → Jira)

Building the Notification Pipeline

# Create SNS topic for security alerts
$ aws sns create-topic --name security-alerts

# Subscribe PagerDuty
$ aws sns subscribe \
    --topic-arn arn:aws:sns:ap-south-1:123456789012:security-alerts \
    --protocol https \
    --notification-endpoint https://events.pagerduty.com/integration/abc123/enqueue

# Subscribe Slack (via Lambda or AWS Chatbot)
$ aws sns subscribe \
    --topic-arn arn:aws:sns:ap-south-1:123456789012:security-alerts \
    --protocol lambda \
    --notification-endpoint arn:aws:lambda:ap-south-1:123456789012:function:slack-notifier

Security Automation Checklist

Automation	Priority	Implementation
Isolate compromised EC2	P1	GuardDuty → EventBridge → Lambda
Block malicious IPs	P1	GuardDuty → EventBridge → Lambda → WAF
Fix public S3 buckets	P1	Config → EventBridge → Lambda
Revoke exposed credentials	P1	GuardDuty → EventBridge → Lambda
Enable encryption on unencrypted EBS	P2	Config → Remediation
Notify on root account usage	P1	CloudTrail → CloudWatch → SNS
Tag untagged resources	P3	Config → Lambda

Common Mistakes

Mistake	Why It Hurts	Fix
No automated response	Threats persist for hours	Implement EventBridge + Lambda pipelines
Lambda has too many permissions	Automation Lambda becomes a target	Give Lambda minimum required permissions
No testing of automations	May not work when needed	Test with create-sample-findings
No audit trail of auto-remediation	Can’t prove what was done	Log all actions to CloudWatch Logs

---

Next → Security Exercises