AWS solutions documentation change
Summary
Removed image line break and condensed numbered list into a continuous paragraph with step descriptions. Updated workflow formatting but maintained same technical content.
Security assessment
The changes are formatting/structural (removing line breaks, consolidating steps) without introducing new security-related content. The existing security aspects (KMS key usage, snapshot protection) were already documented prior to this change.
Diff
diff --git a/solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/disk-forensics-acquisition-workflow.md b/solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/disk-forensics-acquisition-workflow.md index bf3938d02..606500ae0 100644 --- a//solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/disk-forensics-acquisition-workflow.md +++ b//solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/disk-forensics-acquisition-workflow.md @@ -7,2 +6,0 @@ - - @@ -11,19 +9 @@ - 1. The _Forensic triage_ Step Function initiates _disk acquisition flow_. - - 2. The _Perform Instance Snapshot_ Lambda function performs an instance snapshot. - - 3. The _Perform Instance Snapshot_ Lambda function assumes a role in the application account and initiates an instance snapshot API call. - - 4. _Check for Instance Snapshot_ Lambda function assumes a role in the application account and checks for snapshot completion. - - 5. If the response is `Pending` or `In Progress` it waits for 120 seconds. - - 6. The disk acquisition flow [copies](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-copy-snapshot.html) the compromised instance snapshot using AWS KMS keys shared with the forensic account. - - 7. After the copy snapshot operation of the compromised instance, the disk acquisition flow [shares](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html) the copied EBS snapshot with the forensic account. - - 8. To keep the copy of snapshot in the forensic account, copy the shared copy of compromised instance snapshot using Forensic KMS keys. This step allows protection of the shared snapshot with a local copy to perform forensics in case of the AWS account being compromised, or the shared snapshot being deleted by the security team. - - 9. Post copy flow the step functions initiates the investigation flow with forensic type as `DISK`. - - + @@ -30,0 +11 @@ +The _Forensic triage_ Step Function initiates _disk acquisition flow_. . The _Perform Instance Snapshot_ Lambda function performs an instance snapshot. . The _Perform Instance Snapshot_ Lambda function assumes a role in the application account and initiates an instance snapshot API call. . _Check for Instance Snapshot_ Lambda function assumes a role in the application account and checks for snapshot completion. . If the response is `Pending` or `In Progress` it waits for 120 seconds. . The disk acquisition flow [copies](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-copy-snapshot.html) the compromised instance snapshot using AWS KMS keys shared with the forensic account. . After the copy snapshot operation of the compromised instance, the disk acquisition flow [shares](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html) the copied EBS snapshot with the forensic account. . To keep the copy of snapshot in the forensic account, copy the shared copy of compromised instance snapshot using Forensic KMS keys. This step allows protection of the shared snapshot with a local copy to perform forensics in case of the AWS account being compromised, or the shared snapshot being deleted by the security team. . Post copy flow the step functions initiates the investigation flow with forensic type as `DISK`.