AWS managedservices high security documentation change
Summary
Added documentation for 'Amazon EC2 Broken Secure Channel' remediation automation including pre-checks, validation steps, and remediation process for Windows instances losing AD Domain Controller connectivity
Security assessment
The change addresses remediation of broken secure channel connections to Active Directory Domain Controllers, which is a security-critical authentication component. The documentation explicitly describes automated checks for system integrity (SSM status, hostname uniqueness, CloudFormation alignment) and remediation of domain trust relationships - all critical for maintaining secure access controls. Failure to maintain secure channel connections could lead to authentication failures and unauthorized access risks.
Diff
diff --git a/managedservices/latest/userguide/auto-remediation.md b/managedservices/latest/userguide/auto-remediation.md index 484014fb4..24a2354c4 100644 --- a//managedservices/latest/userguide/auto-remediation.md +++ b//managedservices/latest/userguide/auto-remediation.md @@ -5 +5 @@ -EC2 status check failure: Remediation automation notesEC2 volume usage remediation automationAmazon RDS low storage event remediation automation +Amazon EC2 Broken Secure Channel: Remediation automation noteEC2 status check failure: Remediation automation notesEC2 volume usage remediation automationAmazon RDS low storage event remediation automation @@ -12,0 +13 @@ Alert name | Description | Thresholds | Action +Broken secure channel | The Broken Secure Channel Alarm is triggered on Windows EC2 Instances when the instance loses connection with the AD Domain Controller. | The threshold is above the defined value 10 times in the last 15 minutes. | AMS automatic remediation validates that the instance is online in SSM, the hostname is not duplicated, and that the AD Computer Object is aligned with the CloudFormation stack . The remediation repairs the secure channel connection to restore access to the instance. @@ -20,0 +22,24 @@ RDS-Storage-Capacity | Less than 1GB is left at the allocated storage for the DB +## Amazon EC2 Broken Secure Channel: Remediation automation note + +Before AWS Managed Services (AMS) auto-remediation performs remediation on Amazon EC2 Windows Broken Secure Channel issues, the automation carries out the following pre-checks and creates an incident report for further investigation: + + * Validates that the Amazon EC2 instance SSM status is "Online." + + * Validates whether the Amazon EC2 instance is part of an Auto Scaling group and whether all instances in the Auto Scaling group have the same hostname. + + * Checks if the Amazon EC2 instance is part of the CloudFormation stack that was used to provision it. If the instance has been removed from the CloudFormation stack, the automation verifies whether the associated Active Directory Organizational Unit (OU) is still referencing the stack. + + + + +After the above validations have passed, automation proceeds to remediate the Broken Secure channel. + +Remediation Steps: + + * Auto-remediation attempts to repair the secure channel between the EC2 instance and the AD Domain, restoring access to the instance. + + * Post remediation the automation checks that the secure channel is established. If unsuccessful, AMS creates an incident and engages AMS operations to investigate. + + + +