Question

A financial services company runs a fleet of EC2 instances with attached IAM roles. The security team wants fully automated remediation whenever GuardDuty detects a finding of type 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS', which indicates that instance role credentials are being used from an external IP address. The remediation must immediately isolate the compromised instance and revoke the leaked temporary credentials so the attacker cannot continue using them, all without human intervention. Which approach meets these requirements?

Accepted Answer

Create an EventBridge rule matching the GuardDuty finding type that triggers a Systems Manager Automation runbook, which attaches an isolation security group to the instance and attaches an inline deny-all IAM policy with a condition on aws:TokenIssueTime to revoke the previously issued session credentials.

Answer

Configure GuardDuty to publish findings to an SNS topic and have an email subscriber manually run a Systems Manager Automation runbook to stop the instance during business hours.

Answer

Create an EventBridge rule that triggers a Lambda function to terminate the instance immediately, which invalidates all outstanding IAM role credentials associated with it.

Answer

Enable GuardDuty auto-remediation in the console, which automatically detaches the IAM role and quarantines the instance without any additional configuration.