Your AWS has been breached – now what? by Alex Groyz

This report outlines Vectra CDR for AWS’s automated incident response containment approach aligned with NIST/SANS IR phases, detailing how an SNS-triggered Lambda function determines the AWS entity type (EC2, IAM User/Role, Lambda) and applies targeted lockdown actions (DenyAll policies, Lambda concurrency set to 0, and a two-step EC2 security group strategy converting tracked to untracked connections before full isolation). It emphasizes least-privilege operation via SNS publish rights, automated audit trails, cross-account/region support, and integration with services like Amazon Security Hub/SOAR. Deployment is delivered through CloudFormation (single or multi-account), providing SecOps with a repeatable, auditable method to rapidly contain suspicious AWS entities without broad administrative access.