AWS solutions documentation change
Summary
Completely revised procedures for disabling automated remediation, shifting from EventBridge to DynamoDB-based configuration management
Security assessment
The changes update operational procedures for managing remediation controls but don't address security vulnerabilities. The documentation now reflects improved configuration management through DynamoDB, enhancing operational safety but not fixing security flaws.
Diff
diff --git a/solutions/latest/automated-security-response-on-aws/troubleshooting.md b/solutions/latest/automated-security-response-on-aws/troubleshooting.md index 1fe171564..5bd455bb1 100644 --- a//solutions/latest/automated-security-response-on-aws/troubleshooting.md +++ b//solutions/latest/automated-security-response-on-aws/troubleshooting.md @@ -27 +27 @@ In the event of an incident, you may find that you need to disable the solution -**Scenario 1** : Disable automatic remediation for a single control. +**Scenario 1** : Disable automatic remediation for a single control @@ -29 +29 @@ In the event of an incident, you may find that you need to disable the solution - 1. Navigate to EventBridge in the [AWS CloudFormation console](https://console.aws.amazon.com/cloudformation/home?). + 1. In the Admin account, navigate to the [AWS CloudFormation console](https://console.aws.amazon.com/cloudformation/home?). @@ -31 +31 @@ In the event of an incident, you may find that you need to disable the solution - 2. Select Rules in the sidebar. + 2. Locate the Admin stack and view its **Outputs** tab. @@ -33 +33 @@ In the event of an incident, you may find that you need to disable the solution - 3. Select the default event bus and search for the control that you would like to disable. + 3. Copy the value of the `RemediationConfigurationDynamoDBTable` output. @@ -35 +35 @@ In the event of an incident, you may find that you need to disable the solution - 4. Select on the rule and select the Disable button. + 4. Navigate to the [DynamoDB console](https://console.aws.amazon.com/dynamodbv2/home?) and open the Remediation Configuration table. @@ -36,0 +37 @@ In the event of an incident, you may find that you need to disable the solution + 5. Select **Explore Table Items**. @@ -37,0 +39 @@ In the event of an incident, you may find that you need to disable the solution + 6. Under **Scan or query items** , select **Query**. @@ -38,0 +41 @@ In the event of an incident, you may find that you need to disable the solution + 7. Enter the control ID (for example, `Lambda.1`) in the **Partition key: controlId** field and click **Run**. @@ -40 +43 @@ In the event of an incident, you may find that you need to disable the solution -**Scenario 2** : Disable automatic remediation for all controls. + 8. Select the returned item, then click **Actions > Edit item**. @@ -42 +45 @@ In the event of an incident, you may find that you need to disable the solution - 1. Navigate to EventBridge in the console. + 9. Change the `automatedRemediationEnabled` attribute value to **False**. @@ -44 +47 @@ In the event of an incident, you may find that you need to disable the solution - 2. Select Rules in the sidebar. + 10. Click **Save and Close**. @@ -46 +48,0 @@ In the event of an incident, you may find that you need to disable the solution - 3. Select the "default" event bus and select all rules below. @@ -48 +50,13 @@ In the event of an incident, you may find that you need to disable the solution - 4. Select on the "Disable" button. Note that you may have to do this for multiple pages of rules. + + +**Scenario 2** : Disable automatic remediation for all controls + + 1. Follow steps 1-5 from Scenario 1 to access the Remediation Configuration table items. + + 2. Under **Scan or query items** , select **Scan** to view all controls. + + 3. For each control with `automatedRemediationEnabled` set to **True** , select the item and click **Actions > Edit item**. + + 4. Change the `automatedRemediationEnabled` attribute value to **False** and click **Save and Close**. + + 5. Repeat for all controls you wish to disable. @@ -55 +69 @@ In the event of an incident, you may find that you need to disable the solution - 1. Navigate to EventBridge in the console. + 1. Navigate to the [EventBridge console](https://console.aws.amazon.com/events/home?). @@ -57 +71 @@ In the event of an incident, you may find that you need to disable the solution - 2. Select Rules in the sidebar. + 2. Select **Rules** in the sidebar. @@ -59 +73 @@ In the event of an incident, you may find that you need to disable the solution - 3. Select the "default" event bus and search for "Remediate_with_ASR_CustomAction" + 3. Select the **default** event bus and search for `Remediate_with_ASR_CustomAction`. @@ -61 +75 @@ In the event of an incident, you may find that you need to disable the solution - 4. Select on the rule and select the "Disable" button. + 4. Select the rule and click the **Disable** button.