Question

A security team must preserve forensic evidence when an EC2 instance is quarantined during an incident. Their incident-response plan requires that EBS volume snapshots be captured and copied into a dedicated, isolated forensics account where only the IR team has access. The team wants this to happen automatically the moment an instance is tagged 'Quarantine=true', with minimal custom code and a durable, tamper-resistant chain of custody. Which approach best meets these requirements?

Accepted Answer

Create an EventBridge rule matching the tag-change event that triggers a Systems Manager Automation runbook to snapshot the volumes, then share and copy the snapshots to the forensics account whose S3 and EBS resources are locked down by SCPs and resource policies.

Answer

Enable Amazon Data Lifecycle Manager with a schedule-based policy that snapshots all EBS volumes hourly and retains them in the source account for 90 days.

Answer

Configure AWS Backup in the production account to run continuous backups of every EC2 instance and grant the forensics team a cross-account IAM role to read the backups on demand.

Answer

Write a Lambda function invoked by a CloudWatch alarm on instance CPU utilization that snapshots the volumes and stores the snapshot IDs in a DynamoDB table in the production account.