Question

A security team wants automated containment when GuardDuty reports an UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration finding indicating that EC2 instance role credentials are being used from an external IP. The finding must trigger an automated action within seconds, but the team is concerned that a single Lambda invocation might fail silently and leave credentials active. They also want the response to be auditable and to avoid deleting the IAM role, since it is shared by an Auto Scaling group of healthy instances. Which approach BEST meets these requirements?

Accepted Answer

Create an EventBridge rule matching the GuardDuty finding that invokes a Lambda function to attach an inline deny-all policy scoped to the exfiltrated session by using an aws:TokenIssueTime condition, and configure a dead-letter queue and Lambda destinations for failed invocations.

Answer

Create an EventBridge rule that invokes a Lambda function to delete the IAM role attached to the instance profile, then recreate it with reduced permissions after investigation completes.

Answer

Create an EventBridge rule that publishes the finding to an SNS topic so an on-call engineer can manually revoke the credentials using the AWS CLI.

Answer

Create an EventBridge rule that invokes Systems Manager Automation to stop all instances in the Auto Scaling group, preventing any further use of the leaked credentials.