Responding to Security Events
The live response, in the order that preserves your options: validate the finding and scope it, capture evidence before you change anything, climb the containment ladder (including revoking sessions that a detached policy would not touch), eradicate persistence, recover without reinfection, and prove root cause with Amazon Detective.
Content current as of 2026-10.
Lessons
- Triage: validating what you were told
- Evidence first: capture before you change
- Containment and eradication
- Recovery without reinfection
- Root cause analysis