Question

A company runs a fleet of EC2 instances hosting a customer-facing application across multiple accounts in AWS Organizations. The security team wants to improve its security posture by automatically detecting compromised instances (e.g., cryptomining, malware, credential exfiltration) and quarantining them without manual intervention. They already have GuardDuty enabled organization-wide with a delegated administrator account. Which approach BEST meets these requirements while minimizing operational overhead?

Accepted Answer

Configure GuardDuty findings to publish to a central EventBridge event bus in the delegated administrator account, then trigger a Lambda function or Step Functions workflow that isolates the affected instance by attaching a restrictive quarantine security group, detaches it from load balancers, and captures a snapshot for forensics.

Answer

Enable AWS Config with a managed rule that checks for instances flagged by GuardDuty and use Config auto-remediation to terminate the instances immediately upon detection.

Answer

Install the CloudWatch agent on each instance to stream OS logs to a central account, create metric filters for malware signatures, and trigger an SNS notification for the on-call engineer to manually quarantine instances.

Answer

Enable Amazon Inspector across the organization to continuously scan instances for vulnerabilities and configure Inspector to automatically stop any instance with a critical CVE score.