Question

A security team requires that any security group that is modified to allow unrestricted inbound access (0.0.0.0/0) on port 22 be automatically remediated within seconds. All API activity is recorded by an organization CloudTrail trail delivered to a central logging account, and each member account also has AWS Config enabled with the restricted-ssh managed rule. The DevOps engineer must implement near-real-time auto-remediation within each member account with the least custom code and the fastest response. Which approach meets these requirements?

Accepted Answer

Create an EventBridge rule in each member account that matches the AuthorizeSecurityGroupIngress CloudTrail management event and targets a Systems Manager Automation runbook (AWS-RemoveSecurityGroupRule or a custom runbook) that revokes the offending rule.

Answer

Rely solely on the AWS Config restricted-ssh rule with an attached SSM Automation remediation action, accepting the periodic evaluation interval as sufficiently fast.

Answer

Configure the central logging account's CloudTrail to invoke a cross-account Lambda function that scans CloudTrail logs in S3 every 5 minutes and revokes offending rules in member accounts via assumed roles.

Answer

Enable GuardDuty in each member account and create an EventBridge rule on GuardDuty findings that triggers a Lambda function to revoke the security group rule.