Question

During an active incident, the security team must run a set of read-only diagnostic commands (process list, open network connections, loaded kernel modules) across 40 potentially compromised EC2 instances simultaneously. They need the exact command output captured centrally and preserved as evidence, with each execution attributable to a specific responder, and without opening any inbound SSH ports. Which approach best meets these requirements?

Accepted Answer

Use Systems Manager Run Command to send a documented command to all 40 instances at once, and configure the command to write output to an S3 bucket and CloudWatch Logs for centralized, attributable evidence capture.

Answer

Start an SSM Session Manager interactive session to each instance one at a time and manually copy the terminal output into a shared document.

Answer

Distribute a temporary SSH key pair to responders and add an inbound rule for their IP addresses so they can SSH in and run the diagnostics.

Answer

Create an EventBridge rule that triggers a Lambda function to call the EC2 SendCommand API and store results only in the Lambda execution logs.