EventBridge Security Automation
Monitoring & DetectionEventBridge Security Automation uses Amazon EventBridge as the backbone for event-driven security response. Security services emit events that trigger automated remediation.
Security Event Sources
- GuardDuty: threat findings (compromised instance, malicious IP, crypto mining)
- Security Hub: compliance findings and imported findings from all security services
- IAM Access Analyzer: external access findings
- Config: non-compliant resource events
- Inspector: vulnerability findings
- Macie: sensitive data discovery findings
Automation Patterns
- Auto-remediate: Lambda function disables compromised access key when GuardDuty detects credential abuse
- Notify: SNS → Slack/PagerDuty when high-severity finding detected
- Quarantine: Lambda applies restrictive security group to compromised EC2 instance
- Enrich & Ticket: Step Functions workflow that enriches findings and creates Jira tickets
Related AWS Services
Related Content
Related Terms
AWS managed threat detection service that continuously monitors your accounts for malicious activity using CloudTrail, VPC Flow Logs, and DNS logs.
AWS service that aggregates security findings from GuardDuty, Inspector, Macie, and third-party tools into a single dashboard with compliance scoring.
The structured process of detecting, containing, eradicating, and recovering from a security incident, following frameworks like NIST SP 800-61.
The incident response phase where you isolate affected resources to prevent the threat from spreading - deactivating keys, quarantining instances, blocking network access.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.