Incident and Event Response
What to know
Event response tests EventBridge, SNS/SQS, Lambda, and automated remediation. Know EventBridge rules (event patterns, schedules), targets, and how AWS service events (e.g., EC2 state change, GuardDuty findings, Config compliance changes) route to Lambda, SNS, or SSM Automation. Understand SSM Automation runbooks for remediation (e.g., stop/isolate an instance, snapshot a volume, revoke access keys). Know SNS fan-out to SQS for durable processing, and dead-letter queues for failed deliveries. For security incidents, know GuardDuty (threat detection), Security Hub (aggregated findings), and how findings flow to EventBridge for automated response. Understand Systems Manager Incident Manager for on-call and runbooks.
Traps
- EventBridge rules match on event structure; a wrong detail-type or source means no match.
- SNS is push and not durable for consumers that are down - use SQS for buffering.
- Automated remediation must be idempotent; retries can re-run Lambda.
- GuardDuty detects but does not remediate; you build the response.
Rule of thumb
For "automatically respond to a security finding," chain: GuardDuty → EventBridge rule → Lambda or SSM Automation runbook (isolate/revoke). Add SNS for human notification.
Worked example
A compromised EC2 instance should be isolated automatically: an EventBridge rule matches the GuardDuty finding, targets an SSM Automation runbook that removes the instance from target groups and applies a restrictive security group, and notifies via SNS.