Question

A security team has built an automated incident-response pipeline. When GuardDuty detects a compromised EC2 instance, EventBridge triggers a Systems Manager Automation runbook that isolates the instance by replacing its security group and creating a forensic snapshot. During testing, the team discovered that the runbook occasionally isolated production instances that were later found to be benign, causing outages. The team wants automated containment to proceed immediately for instances tagged Environment=dev, but require a human approval before containment executes on instances tagged Environment=prod. Which approach best meets this requirement with the least custom code?

Accepted Answer

Use a branch condition (aws:branch) in the Automation runbook to evaluate the Environment tag, and insert an aws:approve step in the production path that pauses execution until an approver responds.

Answer

Add an aws:executeStateMachine step that always pauses for 30 minutes so an engineer can cancel the automation before it proceeds.

Answer

Configure two separate EventBridge rules with input transformers so production findings are only sent to email and never invoke the runbook.

Answer

Attach an SCP that denies the ModifyInstanceAttribute action on production instances so the runbook cannot change their security groups.