A company runs a web application on a fleet of Amazon EC2 instances in an Auto Scaling group. Amazon GuardDuty and AWS Security Hub are enabled. The…

This solution provides a fully automated and targeted incident response. Amazon EventBridge is used to capture the GuardDuty finding and trigger a Lambda function. The function performs two critical actions: it detaches the compromised instance from the Auto Scaling group, allowing a healthy replacement to be launched, which minimizes service disruption. It then applies a restrictive security group to the instance, isolating it from the network for forensic analysis. This approach is an AWS best practice for containing threats while maintaining application availability.

A. Disabling instance profile keys only stops AWS API access from the instance; it does not stop the anomalous network traffic or remove the instance from service.

C. Modifying a network ACL affects the entire subnet, which would disrupt traffic to healthy instances and cause a wider service impact than necessary.

D. Sending an email notification via Amazon SNS is a manual process, not the automated response required by the question.

1. AWS Security Blog, "How to automate forensic data preservation for Amazon EC2," Nov 12, 2021. The blog post details the exact pattern described in the correct answer: "This solution uses Amazon GuardDuty to detect suspicious activity... Amazon EventBridge to trigger an AWS Lambda function... The Lambda function isolates the EC2 instance by moving it to a 'forensic' security group."

2. AWS Documentation: Amazon GuardDuty User Guide, "Remediating GuardDuty findings." This guide states, "You can configure Amazon EventBridge to automatically respond to GuardDuty findings... For example, you can create a rule to trigger an AWS Lambda function to perform a remediation action, such as modifying a security group." This supports the use of EventBridge and Lambda for automated response.

3. AWS Documentation: AWS Security Hub User Guide, "Taking action on findings." The documentation explains, "Security Hub is integrated with Amazon EventBridge. You can define custom actions that are sent as findings to EventBridge. You can then configure an EventBridge rule to trigger an automated response when it receives a finding for a custom action." This confirms the integration pattern for automated remediation.

4. AWS Well-Architected Framework, Security Pillar, "SEC 11 - How do you configure your incident response plan?", Design principles, "Automate response to events." The framework recommends using automation to "reduce errors from manual processes and to ensure a consistent and faster response." The solution in option B is a direct implementation of this principle.