Question

After a security incident, a company confirmed that several EC2 instances in an Auto Scaling group were compromised through an unpatched vulnerability. The instances have already been isolated and forensic snapshots captured. The security team now needs to safely bring the workload back into service. They want an automated, repeatable recovery process that terminates the compromised instances, launches fresh instances from a hardened AMI, and applies the latest approved patch baseline before the instances rejoin the load balancer. Which approach best meets these recovery requirements?

Accepted Answer

Use an AWS Systems Manager Automation runbook that updates the Auto Scaling group's launch template to reference the hardened AMI, triggers an instance refresh, and runs the AWS-RunPatchBaseline document as part of the launch lifecycle.

Answer

Restore the forensic EBS snapshots directly to the running instances and use AWS Config to confirm the patch level before adding them back to the load balancer.

Answer

Manually terminate each compromised instance, launch replacements from the original AMI, and rely on GuardDuty to detect whether the vulnerability is exploited again.

Answer

Create an EventBridge rule that invokes a Lambda function to reboot the isolated instances so the operating system reloads with the latest patches automatically.