Question

A financial services company aggregates findings in AWS Security Hub across a multi-account organization. Their security team wants a fully automated response when GuardDuty raises an 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS' finding: the exposed IAM user's access keys must be deactivated within seconds, and an incident record must be created, all without requiring an engineer to log in. Which approach best meets these requirements while keeping the automation centralized in the security account?

Accepted Answer

Create an EventBridge rule in the security account that matches the Security Hub finding event, targeting a Lambda function that assumes a cross-account IAM role in the affected member account to call UpdateAccessKey (setting Status to Inactive) and creates a ticket via API.

Answer

Enable AWS Config in each member account with a managed rule that detects exposed IAM keys and configure automatic remediation using an SSM Automation document scoped to each account individually.

Answer

Configure GuardDuty to automatically suspend the compromised IAM user and rely on Security Hub's built-in auto-remediation feature to disable the access keys.

Answer

Create an SNS topic subscribed by the security team that receives the Security Hub finding and instructs an on-call engineer to manually run an SSM Automation runbook to deactivate the keys.