Question

A company operates a central Security account and many workload accounts under AWS Organizations. When GuardDuty in any workload account produces a high-severity finding, an EventBridge rule in the central account (which receives findings via a cross-account event bus) must trigger an AWS Systems Manager Automation runbook that isolates the affected EC2 instance in the workload account where it resides. During testing, the runbook fails with an access-denied error when it attempts to modify the instance's security group. The Automation document is executed via an EventBridge target using a role in the central account. What is the MOST appropriate way to allow the runbook to remediate resources in the workload accounts?

Accepted Answer

Configure the Systems Manager Automation to run in multi-account/multi-Region mode, deploy an execution IAM role with the required permissions in each workload account, and grant the central automation-assume role permission to assume those roles via cross-account trust.

Answer

Attach an IAM policy with ec2:* permissions directly to the EventBridge invocation role in the central account so it can modify security groups in every workload account.

Answer

Add a resource-based policy to each workload account's default EC2 security group that trusts the central Security account, so the runbook can edit it directly.

Answer

Replicate the Automation document into every workload account and have the central EventBridge rule invoke each copy synchronously through the shared event bus.