Question

A security team operates workloads in three AWS Regions within a single account. GuardDuty is enabled in all three Regions. The team wants a centralized incident-response automation that, whenever a high-severity GuardDuty finding is generated in ANY of the three Regions, invokes a single Lambda function (deployed in the primary Region) to isolate the affected resource and open a ticket. What is the correct way to route these findings to the centralized Lambda function with the least operational overhead?

Accepted Answer

In each of the three Regions, create an EventBridge rule matching GuardDuty high-severity findings whose target is a custom event bus in the primary Region, then add a rule on that bus targeting the Lambda function.

Answer

Enable GuardDuty cross-Region finding replication so all findings appear in the primary Region, then create a single EventBridge rule in the primary Region targeting the Lambda function.

Answer

Create a single EventBridge rule in the primary Region that matches GuardDuty findings; EventBridge automatically ingests events from all Regions in the same account.

Answer

Configure a Security Hub aggregation Region and rely on Security Hub to invoke the Lambda function directly whenever a cross-Region GuardDuty finding is aggregated.