🚨 Incident Response in AWS: A Step-by-Step Guide for Beginners

Cloud environments are dynamic and powerful, but they also open the door to security incidents if not monitored effectively. Imagine this: a suspicious login attempt is detected in your AWS infrastructure—what would you do?

In this blog, we’ll walk through how to detect, respond to, and isolate a potentially compromised EC2 instance using AWS native tools like CloudWatch, SNS, Lambda, and Systems Manager.

By the end, you’ll not only learn how to set up an automated incident response pipeline but also understand the “why” behind each step—even if you're new to AWS.

🎯 Objectives of this Lab

Here’s what we’ll accomplish:

✅ Understand what infrastructure incidents are and why they matter.

✅ Configure your application to log events into Amazon CloudWatch.

✅ Create alarms and notifications when malicious activity is detected.

✅ Automate EC2 isolation using Lambda and Security Groups.

✅ Notify stakeholders using Amazon SNS.

🛠 AWS Services You’ll Use

Amazon CloudWatch – For monitoring logs and creating alarms.

AWS Lambda – To automate response actions (like isolating EC2).

Amazon SNS (Simple Notification Service) – To notify stakeholders.

AWS Systems Manager (Fleet Manager & Run Command) – For managing EC2 without SSH.

Pro tip for beginners: Each of these services is serverless, meaning you don’t need to manage servers or infrastructure to run them!

🔍Step 1: Understand Infrastructure Incidents

An incident in cloud security typically means unexpected or unauthorized activity within your environment—think failed login attempts, privilege escalations, or abnormal traffic spikes.

In AWS, such incidents are often detected through logs (CloudTrail, application logs) and metrics (unusual CPU/network usage). That’s why centralized logging and monitoring are essential.

📝 Step 2: Configure CloudWatch Logging

Before you can detect anything, you need visibility! Let’s enable CloudWatch Agent to collect logs:

Commands to Install and Configure:

sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard

This wizard will:

• Ask for OS type (choose Linux if using EC2 Linux AMI).


• Configure user permissions (root or cwagent).


• Enable log collection (provide your application log path, e.g., /home/ssm-user/record.log).


• Save and push configuration to AWS Systems Manager Parameter Store for consistency.

After running, your logs are shipped to CloudWatch → Log Groups where they can be monitored.

🚨 Step 3: Detect Suspicious Activity with CloudWatch Alarms

Now that logs are centralized:

• Go to CloudWatch → Logs → Log Groups → record.log.


• Create a metric filter for suspicious patterns (e.g., HTTP 401 Unauthorized errors).


• Name it something meaningful like "LabApplications".

Why?

This filter will scan logs in real-time for your defined pattern. If a match is found, CloudWatch triggers an alarm.

📢 Step 4: Set Up Notifications (Amazon SNS)

Create an SNS topic named IncidentResponse-Alerts:

• Go to Amazon SNS → Topics → Create Topic.


• Choose "Standard".


• Add email subscriptions for stakeholders (e.g., [email protected]).

Now, link your CloudWatch Alarm (from Step 3) to this SNS topic. This ensures real-time alerts when an incident occurs.

🖥 Step 5: Automate Instance Isolation with AWS Lambda

Here’s where automation shines. Instead of manually logging in and isolating the instance (which wastes precious time during an incident), let Lambda do it for you.

Lambda Function 1– Traffic Generator (for testing):

This function simulates failed login attempts to trigger alarms:

import boto3, requests, logging



logger = logging.getLogger()

logger.setLevel(logging.INFO)

ec2_client = boto3.client('ec2')



def lambda_handler(event, context):

    pub_ip = get_public_ip("App-Server")

    url = f"http://{pub_ip}:8443/"

    for _ in range(40):

        requests.post(url, data="username=admin&password=test123")



def get_public_ip(tag):

    response = ec2_client.describe_instances(Filters=[{'Name':'tag:Name','Values':[tag]}])

    return response['Reservations'][0]['Instances'][0]['PublicIpAddress']

Lambda Function 2 – Instance Isolation:

Triggered by the alarm SNS notification, it:

• Removes IAM role (to cut off API access).


• Attaches an Isolated Security Group (no ingress/egress).

Code snippet:

def lambda_handler(event, context):

    message = json.loads(event['Records'][0]["Sns"]['Message'])

    instance_id = message['Trigger']['MetricName']

    isolate_instance(instance_id)



def isolate_instance(instance_id):

    ec2_client.modify_instance_attribute(

        InstanceId=instance_id,

        Groups=[create_isolated_sg()]

    )



def create_isolated_sg():

    sg = ec2_resource.create_security_group(GroupName="Isolated_SG", VpcId=vpc_id)

    sg.revoke_egress(IpPermissions=[{'IpProtocol':'-1','IpRanges':[{'CidrIp':'0.0.0.0/0'}]}])

    return sg.id

🔒Step 6: Validate the Response

Once triggered:

• Check EC2 IAM Role – it should now be removed.


• Check Security Groups – EC2 should be assigned Isolated_SG (no ingress/egress rules).

At this stage, the instance is quarantined, preventing lateral movement by attackers while you perform forensic analysis.

🛠 Step 7: Manage Instances Securely (Systems Manager Fleet Manager)

Instead of SSH/RDP:

• Use AWS Systems Manager Fleet Manager to run commands securely (ideal for restricted or isolated instances).


• Run automated scripts or view logs directly without opening risky network ports.

✅What Did We Achieve?

• Centralized logging using CloudWatch.


• Real-time threat detection with alarms & metric filters.


• Automated incident response via SNS + Lambda.


• Instance isolation to stop threats instantly.

This workflow is scalable and serverless, making it perfect for enterprises and even AWS learners experimenting in a sandbox.

🔥 Final Thoughts

Security incidents are inevitable, but preparedness makes the difference. By combining AWS-native services, you can build an automated, proactive incident response pipeline without external tools.