Question

A financial services company has documented incident-response runbooks for handling compromised EC2 credentials, but during a recent real incident the on-call team discovered that the isolation Lambda function lacked the IAM permissions to modify security groups, delaying containment by several hours. The security lead wants to prevent this class of failure and ensure the response team is confident executing the plan. Which approach BEST addresses this gap as part of a mature incident-response program?

Accepted Answer

Conduct regular game-day simulations that exercise the runbooks end-to-end in a non-production account, validating both automation permissions and team readiness, then feed lessons learned back into the runbooks

Answer

Grant the isolation Lambda function the AdministratorAccess managed policy so it can perform any containment action without permission failures during future incidents

Answer

Move all runbook logic from Lambda into Systems Manager Automation documents because Automation runbooks do not require IAM permissions to execute containment steps

Answer

Enable AWS Config rules to continuously verify that the Lambda execution role has the correct permissions and alert when they drift