Build your AWS incident response playbook with open source tools

### Executive summary This article provides comprehensive AWS incident response guidance, detailing preparation, detection, analysis, containment, eradication, and recovery phases; it covers key AWS services (CloudTrail, Athena, CloudWatch, GuardDuty, Config, Security Hub, IAM), demonstrates forensic procedures for compromised EC2 instances, shows how to analyze CloudTrail/CloudWatch/Athena data, describes persistence techniques (federation tokens, backdoor roles, IMDS abuse, resource-based backdoors), and recommends open-source tools and automated mitigations (including the AWS-IReveal-MCP server) to accelerate investigations and remediation.