AWS security-ir medium security documentation change
Summary
Added API/CLI enablement instructions, updated delegated administrator guidance, and clarified automatic service-linked role deployment.
Security assessment
Resolves potential misconfiguration risks by documenting automatic service-linked role creation ('AWSServiceRoleForSecurityIncidentResponse_Triage'), ensuring GuardDuty integration works by default. Previously manual setup could leave accounts unprotected against threats.
Diff
diff --git a/security-ir/latest/userguide/deploy-configure.md b/security-ir/latest/userguide/deploy-configure.md index ffe1fec4b..144365ada 100644 --- a//security-ir/latest/userguide/deploy-configure.md +++ b//security-ir/latest/userguide/deploy-configure.md @@ -11 +11,5 @@ The onboarding process takes approximately 10 to 15 minutes per AWS organization -###### To enable AWS Security Incident Response +###### Note + +The instructions in this section outline how to enable Security Incident Response and set up your team using the AWS Security Incident Response console (Step 1 and Step 2). You can also perform these steps using the API/CLI. For instructions on using the API/CLI, see [Enable Security Incident Response and configure your incident response team using the API/CLI](./enable-sir-using-cli.html). + +###### Enable AWS Security Incident Response using the AWS Security Incident Response console @@ -19,3 +23 @@ The onboarding process takes approximately 10 to 15 minutes per AWS organization - 3. Designate a security tooling account as the delegated administrator. - - * For guidance, see [Security Reference Architecture](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html) in _AWS Prescriptive Guidance_ and [Delegated administrator](https://docs.aws.amazon.com/security-ir/latest/userguide/delegated-admin.html). + 3. Setup your central membership account. For guidance, see [Security Reference Architecture](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html) in _AWS Prescriptive Guidance_ and [Considerations and recommendations](./considerations_important.html) on how a delegated Security Incident Response administrator account operates. @@ -31,3 +33 @@ The onboarding process takes approximately 10 to 15 minutes per AWS organization - 7. For **Proactive Response** , confirm that the setting is enabled. Proactive response is on by default and creates a service-linked role that allows AWS SIRT to ingest GuardDuty findings and open proactive investigation cases when threats are detected. For more information, see [Proactive response](https://docs.aws.amazon.com/security-ir/latest/userguide/proactive-response.html). - -###### Important + 7. **Proactive response** is on by default and creates a service-linked role that allows AWS SIRT to ingest GuardDuty findings and open proactive investigation cases when threats are detected. For more information, see [Proactive response](https://docs.aws.amazon.com/security-ir/latest/userguide/proactive-response.html). @@ -35 +35 @@ The onboarding process takes approximately 10 to 15 minutes per AWS organization -The service-linked role is not automatically deployed to the management account. You must configure it manually for complete coverage. For instructions, see [Setup proactive response and alert triaging workflows](./setup-monitoring-and-investigation-workflows.html). +AWS Security Incident Response automatically creates the `AWSServiceRoleForSecurityIncidentResponse_Triage` service-linked role in your AWS Organizations management account and in all accounts that are in scope.