Question

A financial services company runs a fleet of EC2 instances behind an Application Load Balancer. The security team wants a fully automated containment workflow: when GuardDuty reports a high-severity finding indicating an instance is communicating with a known command-and-control server, the instance must be immediately isolated from the network while preserving all volatile and disk state for later forensic analysis, and the security team must be notified. The team wants to minimize manual steps and human error during initial containment. Which approach BEST meets these requirements?

Accepted Answer

Create an EventBridge rule matching the GuardDuty finding that triggers a Lambda function to replace the instance's security groups with an isolation security group that denies all traffic, tag the instance, disable termination, and publish to an SNS topic for notification.

Answer

Create an EventBridge rule that triggers a Lambda function to call TerminateInstances on the affected EC2 instance and send an SNS notification so the threat is removed before it spreads.

Answer

Configure GuardDuty to automatically stop the EC2 instance when a high-severity finding is generated, then have an analyst manually create an EBS snapshot the next business day.

Answer

Create an EventBridge rule that triggers a Lambda function to detach all EBS volumes from the affected instance and reattach them to a forensic instance, then notify the security team via SNS.