Question

A financial services company wants to automate its incident-response workflow for compromised EC2 instances. When a high-severity finding fires, the workflow must run several ordered steps: capture a memory image, isolate the instance, notify the SOC, and then WAIT for a human security analyst to approve before terminating the instance. The steps must have clear visibility into which stage failed if an error occurs, and the pause for human approval may last several hours. Which approach BEST meets these orchestration and human-approval requirements?

Accepted Answer

Use an AWS Step Functions state machine triggered by EventBridge, chaining the automation tasks and using a task with the waitForTaskToken integration pattern to pause for the analyst's approval.

Answer

Use a single Lambda function triggered by EventBridge that executes all steps sequentially and calls time.sleep() while waiting for the analyst to reply to an SNS notification.

Answer

Use a Systems Manager Automation runbook with aws:approve action, but trigger a separate Lambda for each step and correlate their results manually in CloudWatch Logs.

Answer

Configure EventBridge to invoke multiple Lambda functions in parallel, each performing one step, and use DynamoDB to track completion order and approval state.