SEC04-BP04: Initiate remediation for non-compliant resources
Implement automated remediation for non-compliant resources to reduce the time to resolution and improve your security posture. For example, automatically remediate an S3 bucket that has been configured with public read access by removing the public access configuration.
Implementation guidance
Automated remediation of non-compliant resources is essential for maintaining a strong security posture at scale. By implementing automated responses to security violations and misconfigurations, you can reduce the window of exposure, minimize manual intervention, and ensure consistent application of security policies across your environment.
Key steps for implementing this best practice:
- Identify remediable security violations:
- Define security policies and compliance requirements
- Identify common misconfigurations that can be automatically remediated
- Categorize violations by risk level and remediation complexity
- Document approved remediation actions for each violation type
- Establish criteria for automatic vs. manual remediation
- Implement detection mechanisms:
- Use AWS Config Rules to detect configuration violations
- Configure AWS Security Hub for centralized finding management
- Set up Amazon GuardDuty for threat detection
- Implement custom detection logic for organization-specific requirements
- Enable real-time monitoring for critical security configurations
- Design remediation workflows:
- Create automated remediation scripts and functions
- Implement approval workflows for high-risk remediations
- Design rollback mechanisms for failed remediations
- Establish notification and logging for all remediation actions
- Implement rate limiting to prevent cascading effects
- Implement automated remediation:
- Use AWS Config Remediation Configurations for standard violations
- Deploy AWS Lambda functions for custom remediation logic
- Implement AWS Systems Manager Automation documents
- Use AWS Security Hub Custom Actions for manual remediation triggers
- Configure Amazon EventBridge for event-driven remediation
- Establish governance and oversight:
- Implement approval processes for sensitive remediations
- Create audit trails for all remediation activities
- Set up monitoring and alerting for remediation failures
- Establish escalation procedures for complex violations
- Implement regular review of remediation effectiveness
- Test and validate remediation:
- Test remediation scripts in non-production environments
- Validate that remediation actions don’t break functionality
- Implement monitoring to verify successful remediation
- Create rollback procedures for problematic remediations
- Regularly review and update remediation logic
Implementation examples
Example 1: AWS Config automatic remediation for S3 public access
Example 2: Custom Lambda function for security group remediation
Example 3: Systems Manager Automation for EC2 instance remediation
Example 4: EventBridge-driven remediation orchestration
AWS services to consider
Benefits of initiating remediation for non-compliant resources
- Reduced exposure time: Automated remediation minimizes the window of vulnerability
- Consistent security posture: Ensures uniform application of security policies across all resources
- Operational efficiency: Reduces manual intervention and speeds up incident response
- Scalable security management: Handles large-scale environments without proportional increase in staff
- Improved compliance: Maintains continuous compliance with security standards and regulations
- Cost reduction: Reduces the cost of manual security operations and potential breach impacts
- Enhanced audit readiness: Provides detailed logs of all remediation actions for compliance reporting