AWS solutions documentation change
Summary
Updated documentation to reference Volatility 3 instead of Volatility 2, added EKS cluster support alongside EC2 instances in forensic module building process
Security assessment
The changes update forensic analysis tooling documentation (Volatility 3) and expand coverage to EKS clusters. While forensic analysis is security-related, there's no evidence this addresses a specific vulnerability. The updates enhance existing security documentation rather than fix a disclosed issue.
Diff
diff --git a/solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/steps-to-build-volatility-profile-using-ssm-document.md b/solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/steps-to-build-volatility-profile-using-ssm-document.md index 1cd6e0b47..e8c017335 100644 --- a//solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/steps-to-build-volatility-profile-using-ssm-document.md +++ b//solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/steps-to-build-volatility-profile-using-ssm-document.md @@ -5 +5 @@ -Automate the creation of LiME and Volatility 2 profiles +Automate the creation of LiME and Volatility 3 symbol tables @@ -19 +19 @@ The diagram below details the usage of a Volatility profile in the memory invest -image::images/volatility-profile-using-ssm-flow.png[scaledwidth=100%]. Launch an [Amazon EC2](https://aws.amazon.com/ec2/) instance (Amazon Linux 2) to build a LiME module volatility profile. Ensure the SSM is appropriately configured on the EC2 instance. Record the instance ID. . Navigate to the AWS Systems Manager documents and select the previously created SSM document example **Documents** tab. Record the name of the SSM document to build the profile. +image::images/volatility-profile-using-ssm-flow.png[scaledwidth=100%]. Launch an [Amazon EC2](https://aws.amazon.com/ec2/) instance (Amazon Linux 2) to build a LiME module volatility profile. Ensure the SSM is appropriately configured on the EC2 instance or EKS cluster. Record the instance ID. . Navigate to the AWS Systems Manager documents and select the previously created SSM document example **Documents** tab. Record the name of the SSM document to build the profile. @@ -21 +21 @@ image::images/volatility-profile-using-ssm-flow.png[scaledwidth=100%]. Launch an -\+ .SSM document image::images/ssm-document.png[scaledwidth=100%] Run AWS SSM document to build LiME module Volatility2 profile for a launched Amazon EC2 instance that matches the OS and kernel version. +\+ .SSM document image::images/ssm-document.png[scaledwidth=100%] Run AWS SSM document to build LiME module and Volatility 3 symbol tables for a launched Amazon EC2 instance or EKS cluster that matches the OS and kernel version. @@ -25 +25 @@ image::images/volatility-profile-using-ssm-flow.png[scaledwidth=100%]. Launch an -## Automate the creation of LiME and Volatility 2 profiles +## Automate the creation of LiME and Volatility 3 symbol tables @@ -27 +27 @@ image::images/volatility-profile-using-ssm-flow.png[scaledwidth=100%]. Launch an -You can incorporate the module build process for LiME and Volatility (or your preferred forensic tools) into a hardened AMI pipeline prior to allowing AMI use by developers and application teams. These modules are prerequisites for running the Automated Forensics Orchestrator for Amazon EC2 Guidance to allow the capture and analysis of volatile memory. You also need to incorporate a mechanism to build these modules for the specific kernel versions in the event they do not exist. This can occur if an EC2 instance is updated after being launched or if an EC2 instance was launched from a non-hardened AMI that is not managed by a central team. +You can incorporate the module build process for LiME and Volatility (or your preferred forensic tools) into a hardened AMI pipeline prior to allowing AMI use by developers and application teams. These modules are prerequisites for running the Automated Forensics Orchestrator for Amazon EC2 and EKS Guidance to allow the capture and analysis of volatile memory. You also need to incorporate a mechanism to build these modules for the specific kernel versions in the event they do not exist. This can occur if an EC2 instance or EKS cluster is updated after being launched or if an EC2 instance or EKS cluster was launched from a non-hardened AMI that is not managed by a central team. @@ -29 +29 @@ You can incorporate the module build process for LiME and Volatility (or your pr -For more information, refer to the [How to automatically build forensic kernel modules for Amazon Linux EC2 instances](https://aws.amazon.com/blogs/security/how-to-automatically-build-forensic-kernel-modules-for-amazon-linux-ec2-instances/) blog, which will walk you through deploying a Guidance to automatically build modules for specific EC2 instance OS kernel versions based on input parameters of AMI ID and kernel version. You can use the blog Guidance with the Automated Forensics Orchestrator for Amazon EC2 Guidance in the event that specific kernel module versions are missing and need to be created. +For more information, refer to the [How to automatically build forensic kernel modules for Amazon Linux EC2 instances](https://aws.amazon.com/blogs/security/how-to-automatically-build-forensic-kernel-modules-for-amazon-linux-ec2-instances/) blog, which will walk you through deploying a Guidance to automatically build modules for specific EC2 instance or EKS cluster OS kernel versions based on input parameters of AMI ID and kernel version. You can use the blog Guidance with the Automated Forensics Orchestrator for Amazon EC2 and EKS Guidance in the event that specific kernel module versions are missing and need to be created.