AWS solutions documentation change
Summary
Added EKS cluster support in isolation procedures and termination protection documentation
Security assessment
Changes expand documentation of security features (network isolation via security groups, termination protection) to cover EKS clusters, but do not indicate remediation of a specific security vulnerability. These represent enhanced documentation of existing security controls rather than patching issues.
Diff
diff --git a/solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/forensic-memory-and-disk-acquisition-service.md b/solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/forensic-memory-and-disk-acquisition-service.md index 124fefff9..b45ffbaee 100644 --- a//solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/forensic-memory-and-disk-acquisition-service.md +++ b//solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/forensic-memory-and-disk-acquisition-service.md @@ -11 +11 @@ The diagram below represents the logical interaction view of the forensic memory -Isolation of EC2 instance is done based on the Security Hub action event types - Forensic triage and Forensic isolation. +Isolation of EC2 instance or EKS cluster is done based on the Security Hub action event types - Forensic triage and Forensic isolation. @@ -27 +27 @@ The _Forensic triage_ Step Function initiates the _memory acquisition_ flow. . T -\+ **The memory dump is stored in an S3 bucket of the forensic account.** The memory dump has associated meta data tags to indicate the underlying OS and kernel the dump is associated with, assisting the _memory analysis flow_ further downstream. . The _Check memory acquisition_ Lambda function checks for SSM Run Command to be completed. . If the response from SSM Run Command status is `Pending` or `Delayed` or `In Progress`, it waits for 120 seconds. . If the response from SSM Run Command status is `Success`, it checks if isolation is needed. . If **isolation** is set to `true`, then the Lambda function assumes role into the application account and attaches a security group with no egress and ingress security group, and detaches the existing security group. Isolation is set to `true` during the triaging phase based on security event type. . This initiates investigation flow with forensic type as `MEMORY`. . If any error occurs during the memory acquisition process, the EC2 instance isolation will be performed based on the `isolation` flag. +\+ **The memory dump is stored in an S3 bucket of the forensic account.** The memory dump has associated meta data tags to indicate the underlying OS and kernel the dump is associated with, assisting the _memory analysis flow_ further downstream. . The _Check memory acquisition_ Lambda function checks for SSM Run Command to be completed. . If the response from SSM Run Command status is `Pending` or `Delayed` or `In Progress`, it waits for 120 seconds. . If the response from SSM Run Command status is `Success`, it checks if isolation is needed. . If **isolation** is set to `true`, then the Lambda function assumes role into the application account and attaches a security group with no egress and ingress security group, and detaches the existing security group. Isolation is set to `true` during the triaging phase based on security event type. . This initiates investigation flow with forensic type as `MEMORY`. . If any error occurs during the memory acquisition process, the EC2 instance or EKS cluster isolation will be performed based on the `isolation` flag. @@ -37 +37 @@ Instances after isolation will have: - * Termination protection for the compromised EC2 instance set to `true` + * Termination protection for the compromised EC2 instance or EKS cluster is set to `true`