AWS solutions documentation change
Summary
Expanded isolation scope to include EKS clusters alongside EC2 instances, updated Volatility profile reference to symbol table, and added EKS cluster details in SNS notifications
Security assessment
The changes document extended security controls (isolation) for EKS clusters, but there's no evidence of addressing a specific vulnerability. The updates enhance documentation of existing security features like resource isolation and forensic analysis workflows.
Diff
diff --git a/solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/forensic-investigation-and-reporting-service.md b/solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/forensic-investigation-and-reporting-service.md index 887bbebaf..ada56f409 100644 --- a//solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/forensic-investigation-and-reporting-service.md +++ b//solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/forensic-investigation-and-reporting-service.md @@ -9 +9 @@ Interaction viewImplementation viewForensic investigation and reporting workflow -The diagram below represents the logical interaction view of forensic memory and disk investigation service. Once forensic acquisition is completed, forensic investigation flow is initiated, isolation of EC2 instance is done based on the AWS Security Hub event type. +The diagram below represents the logical interaction view of forensic memory and disk investigation service. Once forensic acquisition is completed, forensic investigation flow is initiated, isolation of EC2 instance or EKS cluster is done based on the AWS Security Hub event type. @@ -45 +45 @@ The diagram below represents the logical interaction view of forensic memory and - * The _Memory forensics flow_ retrieves the appropriate meta data tag associated with the memory dump and loads the matching kernel Volatility profile from a configurable S3 location. + * The _Memory forensics flow_ retrieves the appropriate meta data tag associated with the memory dump and loads the matching kernel Volatility symbol table from a configurable S3 location. @@ -55 +55 @@ The diagram below represents the logical interaction view of forensic memory and - 14. Details about forensic ID, compromised Amazon EC2 instance, Amazon S3 bucket location of the results, and Amazon DynamoDB table details about disk and memory analysis are sent as SNS. + 14. Details about forensic ID, compromised Amazon EC2 instance or EKS cluster, Amazon S3 bucket location of the results, and Amazon DynamoDB table details about disk and memory analysis are sent as SNS.