Question

A security team runs a multi-account AWS Organization. When GuardDuty produces a HIGH or CRITICAL finding for an EC2 instance, the team wants automation to determine the incident-response path: production instances (tagged Environment=prod) must trigger a human approval step before any containment action, while non-production instances should be automatically isolated. All findings flow to a central security account via an EventBridge rule. Which design best meets these requirements while minimizing custom code and operational overhead?

Accepted Answer

Route the EventBridge finding to a Step Functions state machine that reads the instance's Environment tag, and for prod branches to an approval task (via SNS/callback token) before invoking an SSM Automation containment runbook, while non-prod branches invoke the runbook directly.

Answer

Configure a single Lambda function triggered by EventBridge that isolates every instance immediately, then emails the security team afterward so they can restore production instances if the isolation was inappropriate.

Answer

Create two separate EventBridge rules with event-pattern filters on the resource tag so prod and non-prod findings each invoke a dedicated Lambda, since GuardDuty findings always include full resource tag data in the event.

Answer

Send all findings to Security Hub and rely on an automation rule to isolate prod instances after a manual severity review, using Security Hub's built-in approval workflow.