Question

A security team runs a production workload across two AWS Regions. During a suspected compromise, responders discovered that their automated containment Lambda (triggered by EventBridge) failed to execute because the finding originated in the secondary Region, where no EventBridge rule or Lambda existed. The team wants to ensure that any GuardDuty finding in ANY Region reliably invokes a single centralized containment workflow, while minimizing ongoing operational overhead and duplicated code. Which approach best meets these requirements?

Accepted Answer

Deploy identical EventBridge rules in every Region that forward matched GuardDuty events to a central event bus in the primary Region, where a single rule targets the containment Lambda.

Answer

Enable GuardDuty in only the primary Region and disable it elsewhere so all findings are generated centrally and the existing Lambda can process them.

Answer

Create a separate copy of the containment Lambda and EventBridge rule in each Region and maintain them independently through manual updates.

Answer

Configure an S3 bucket in each Region to receive GuardDuty findings and use a scheduled Lambda in the primary Region to poll the buckets every 15 minutes for new findings.