Build your AWS incident response playbook with open source tools

This article provides a comprehensive playbook for incident response in AWS, mapping each phase of IR to native services (CloudTrail, Athena, CloudWatch, GuardDuty, Config, Security Hub, IAM), and showing how to prepare, detect, analyze, contain, eradicate, and recover from cloud incidents. It highlights open-source tooling and a new AWS-IReveal-MCP server to streamline investigations, details practical log queries and workflows (including SES, Bedrock, VPC Flow Logs), outlines EC2 forensic procedures, and documents common attacker persistence techniques (federation tokens, role backdoors, IMDS abuse, resource policy backdoors) with concrete detection and remediation steps.