digitaldencloud / automating-incident-remediation-with-aws-config-and-lambda

Configure a solution to automatically remediate an incident where a security group's inbound rules no longer conforms with the desired configuration

Automating Incident Remediation with AWS Config and Lambda

Configure a solution to automatically remediate an incident where a security group's inbound rules no longer conforms with the desired configuration

More Information

---

• Blog
• Lab

Project date

---

16.05-2023

Tech Stack

---

• AWS Identity and Access Management (IAM)
• AWS Config
• AWS Lambda
• AWS CloudWatch

Project Description

---

Used AWS Config and AWS Lambda to monitor and automatically remediate security incidents related to EC2 security groups. By using the AWS Config service, I am able to track changes to the security group settings and identify potential security concerns.

Utilized AWS Config: I configured AWS Config to monitor changes to specific resources in my AWS account, specifically the EC2 security group settings. AWS Config tracks changes and maintains a configuration history for the resources.

Defined Desired Configuration: I defined the desired configuration for the EC2 security groups, specifying which inbound ports should be open and which should not. This configuration represented the desired state of the security groups.

Security Concern Identification: AWS Config continuously monitors the EC2 security group settings and detects any changes that deviate from the desired configuration. It flags these changes as potential security concerns.

AWS Lambda Integration: To automate the remediation process, I integrated AWS Config with AWS Lambda. AWS Lambda allows you to execute custom code in response to specific events. In this case, I created Lambda functions to handle security incidents triggered by AWS Config.

Remediation Actions: When AWS Config detects a security incident, such as someone modifying a security group's inbound rules, it triggers the associated Lambda function. The Lambda function then takes remediation actions to bring the security group back into compliance with the desired configuration. For example, it could revoke unauthorized access or revert to the previously approved configuration.

Objectives

---

• Create IAM roles to grant AWS services access to other AWS services.
• Enable AWS Config to monitor resources in my AWS account.
• Create a Lambda function and import function code.
• Create and enable a custom AWS Config rule that uses my Lambda function.
• Test the behaviour of an AWS Config rule to ensure it works as intended.
• Analyse Amazon CloudWatch logs to audit when AWS Config rules are invoked.