AWS security-ir high security documentation change
Summary
Enhanced documentation about proactive containment capabilities, including explicit steps to enable containment, IAM role requirements, and containment preference options (Approval Required, Contain Confirmed, Contain Suspected). Removed redundant note about permissions.
Security assessment
The change explicitly documents security containment capabilities and authorization requirements. It introduces security-critical preferences for resource containment based on compromise confidence levels (confirmed/suspected), which directly impacts incident response security posture. The clarification of default 'Approval Required' setting prevents unintended automatic containment actions.
Diff
diff --git a/security-ir/latest/userguide/contain.md b/security-ir/latest/userguide/contain.md index f6ce37bfd..23d9474a6 100644 --- a//security-ir/latest/userguide/contain.md +++ b//security-ir/latest/userguide/contain.md @@ -7 +7,20 @@ -AWS Security Incident Response partners with you to contain events. You can configure a service role for AWS Security Incident Response to take automated and manual actions in your account as a response to alerts. You can also perform containment yourself or in partnership with your third party relationships by using SSM documents. +AWS Security Incident Response partners with you to contain events. You can configure the service to take proactive containment actions in your account in response to security findings. You can also perform containment yourself or in partnership with your third party relationships by using SSM documents. + +###### Important + +AWS Security Incident Response does not enable containment capabilities by default. + +Two steps are required to enable proactive containment capabilities: + + * Grant the necessary permissions to the service using IAM roles. You can create these roles individually per account or across your entire organization by Working with AWS CloudFormation stacksets, which create the required roles. + + * Define your containment preferences per account or across your organization to authorize proactive containment actions. Account-level preferences supersede organization-level preferences. This may be done by creating an AWS Support Case (Technical: Security Incident Response Service/Other). The available containment preferences are: + + * **Approval Required (default):** Do not perform proactive containment of any resource without explicit authorization on a case-by-case basis. + + * **Contain Confirmed:** Perform proactive containment of a resource confirmed to be compromised. + + * **Contain Suspected:** Perform proactive containment of a resource with a high likelihood of having been compromised, based on analysis performed by AWS Security Incident Response Engineering. + + + @@ -26,4 +44,0 @@ It is important to note that existing tracked connections won’t be shut down a -###### Important - -AWS Security Incident Response does not enable containment capabilities by default, to execute these containment actions, you must first grant the necessary permissions to the service using roles. You can create these roles individually per account or across your entire organization by [Working with AWS CloudFormation stacksets](https://docs.aws.amazon.com/security-ir/latest/userguide/working-with-stacksets.html), which create the required roles. -