Home › AWS Security › cloudcomputing › scsthreatresponse › Which AWS service automates incident-response ru…
Which AWS service automates incident-response runbooks — e.g. 'on compromised credential finding, rotate the key + revoke active sessions + notify on-call'?
AAmazon Route 53
BAWS Systems Manager Automation runbooks (often triggered by EventBridge rules on Security Hub / GuardDuty findings)
CAmazon CloudFront
DManual rotation by a junior on-call
Answer & Solution
Correct answer: B. AWS Systems Manager Automation runbooks (often triggered by EventBridge rules on Security Hub / GuardDuty findings)
SSM Automation + EventBridge is the canonical IR-runbook automation (per SCS-C02 §1.1, §1.3). Manual rotation doesn't scale; CloudFront/Route 53 aren't automation.
Related questions
Which AWS feature provides an audit-trail of every IAM principal action across the AWS accWhich AWS service enables 'continuous compliance' by recording resource config changes andAfter detecting that a long-lived IAM access key has been leaked publicly, which response Which AWS service continuously scans EC2 instances and container images for software vulneWhich AWS service lets a responder query large volumes of CloudTrail / VPC Flow / WAF logsWhich AWS service is the canonical event-routing bus that receives Security Hub / GuardDutWhich AWS feature lets a responder capture an immutable EBS volume snapshot for forensic aAn incident-response team must IMMEDIATELY isolate a suspected-compromised Amazon EC2 inst