SEC05

SEC05-BP04 - Automate network protection

One-Click Remediation

Deploy CloudFormation stacks to implement this best practice with a single click.

Network Protection Automation

Automate baseline network protection responses with managed rules, alerting, and remediation workflows

Stacks deploy to your AWS account. Review parameters before creating. Standard AWS charges apply.

Implementation guidance

Automating network protection enables your security infrastructure to respond to threats in real-time without human intervention. By implementing automated protective controls, you can significantly reduce response times and ensure consistent application of security policies across your network infrastructure.

Key steps for implementing this best practice:

Implement automated threat response:
- Configure automatic blocking of malicious IP addresses
- Set up automated quarantine of compromised resources
- Implement dynamic security group rule updates
- Configure automatic traffic redirection during attacks
- Enable automated incident escalation procedures
Deploy adaptive security controls:
- Implement machine learning-based anomaly detection
- Configure behavioral analysis for network traffic
- Set up adaptive rate limiting based on traffic patterns
- Deploy dynamic firewall rules based on threat intelligence
- Implement context-aware access controls
Configure automated policy enforcement:
- Implement Infrastructure as Code for consistent security policies
- Set up automated compliance checking and remediation
- Configure automatic security configuration drift detection
- Deploy policy-based network segmentation
- Implement automated security baseline enforcement
Enable intelligent traffic management:
- Configure automatic load balancing during DDoS attacks
- Implement geo-blocking based on threat intelligence
- Set up automated content delivery network (CDN) protection
- Deploy intelligent traffic routing for threat mitigation
- Configure automatic capacity scaling for attack resilience
Integrate threat intelligence feeds:
- Configure automatic updates from threat intelligence sources
- Implement real-time indicator of compromise (IoC) blocking
- Set up automated reputation-based filtering
- Deploy dynamic blacklist and whitelist management
- Configure threat hunting automation
Implement automated monitoring and alerting:
- Set up real-time security event correlation
- Configure automated anomaly detection and alerting
- Implement predictive threat analysis
- Deploy automated security metrics collection
- Set up intelligent alert prioritization and routing

Implementation examples

Example 1: Automated threat response with Lambda and EventBridge

View code

import boto3
import json
from datetime import datetime, timedelta

def lambda_handler(event, context):
    """
    Automated network protection response function
    Responds to GuardDuty findings and WAF events
    """
    
    # Initialize AWS clients
    ec2 = boto3.client('ec2')
    wafv2 = boto3.client('wafv2')
    sns = boto3.client('sns')
    
    try:
        # Parse the incoming event
        event_source = event.get('source')
        detail = event.get('detail', {})
        
        if event_source == 'aws.guardduty':
            return handle_guardduty_finding(ec2, wafv2, sns, detail)
        elif event_source == 'aws.wafv2':
            return handle_waf_event(ec2, wafv2, sns, detail)
        else:
            print(f"Unsupported event source: {event_source}")
            return {'statusCode': 400, 'body': 'Unsupported event source'}
            
    except Exception as e:
        print(f"Error processing event: {str(e)}")
        return {'statusCode': 500, 'body': f'Error: {str(e)}'}

def handle_guardduty_finding(ec2, wafv2, sns, detail):
    """Handle GuardDuty findings with automated response"""
    
    finding_type = detail.get('type', '')
    severity = detail.get('severity', 0)
    
    # Extract threat information
    remote_ip = None
    instance_id = None
    
    if 'service' in detail and 'remoteIpDetails' in detail['service']:
        remote_ip = detail['service']['remoteIpDetails'].get('ipAddressV4')
    
    if 'resource' in detail and 'instanceDetails' in detail['resource']:
        instance_id = detail['resource']['instanceDetails'].get('instanceId')
    
    response_actions = []
    
    # High severity findings require immediate action
    if severity >= 7.0:
        if remote_ip:
            # Block malicious IP in WAF
            block_result = block_ip_in_waf(wafv2, remote_ip)
            response_actions.append(f"Blocked IP {remote_ip} in WAF: {block_result}")
            
            # Add IP to security group deny rule
            sg_result = add_ip_to_deny_rule(ec2, remote_ip)
            response_actions.append(f"Added IP {remote_ip} to deny rule: {sg_result}")
        
        if instance_id and 'Backdoor' in finding_type:
            # Isolate compromised instance
            isolation_result = isolate_instance(ec2, instance_id)
            response_actions.append(f"Isolated instance {instance_id}: {isolation_result}")
    
    # Medium severity findings get monitoring enhancement
    elif severity >= 4.0:
        if remote_ip:
            # Add IP to monitoring watchlist
            watchlist_result = add_ip_to_watchlist(remote_ip)
            response_actions.append(f"Added IP {remote_ip} to watchlist: {watchlist_result}")
    
    # Send notification
    send_notification(sns, finding_type, severity, response_actions)
    
    return {
        'statusCode': 200,
        'body': json.dumps({
            'finding_type': finding_type,
            'severity': severity,
            'actions_taken': response_actions
        })
    }

def block_ip_in_waf(wafv2, ip_address):
    """Add IP address to WAF IP set for blocking"""
    
    try:
        # Get existing IP set
        ip_set_response = wafv2.get_ip_set(
            Name='AutoBlockedIPs',
            Scope='REGIONAL',
            Id='12345678-1234-1234-1234-123456789012'
        )
        
        current_addresses = ip_set_response['IPSet']['Addresses']
        
        # Add new IP if not already present
        if f"{ip_address}/32" not in current_addresses:
            current_addresses.append(f"{ip_address}/32")
            
            # Update IP set
            wafv2.update_ip_set(
                Name='AutoBlockedIPs',
                Scope='REGIONAL',
                Id='12345678-1234-1234-1234-123456789012',
                Addresses=current_addresses,
                LockToken=ip_set_response['LockToken']
            )
            
            return "Success"
        else:
            return "Already blocked"
            
    except Exception as e:
        print(f"Error blocking IP in WAF: {str(e)}")
        return f"Error: {str(e)}"

def add_ip_to_deny_rule(ec2, ip_address):
    """Add IP address to security group deny rule"""
    
    try:
        # Create or update security group rule
        ec2.authorize_security_group_ingress(
            GroupId='sg-blocklist123456',
            IpPermissions=[
                {
                    'IpProtocol': '-1',
                    'IpRanges': [
                        {
                            'CidrIp': f'{ip_address}/32',
                            'Description': f'Auto-blocked malicious IP - {datetime.utcnow().isoformat()}'
                        }
                    ]
                }
            ]
        )
        return "Success"
        
    except ec2.exceptions.ClientError as e:
        if 'InvalidPermission.Duplicate' in str(e):
            return "Already blocked"
        else:
            print(f"Error adding IP to deny rule: {str(e)}")
            return f"Error: {str(e)}"

def isolate_instance(ec2, instance_id):
    """Isolate compromised instance by changing security group"""
    
    try:
        # Get current instance details
        response = ec2.describe_instances(InstanceIds=[instance_id])
        
        if response['Reservations']:
            instance = response['Reservations'][0]['Instances'][0]
            
            # Change security group to isolation group
            ec2.modify_instance_attribute(
                InstanceId=instance_id,
                Groups=['sg-isolation123456']
            )
            
            # Add tag to indicate isolation
            ec2.create_tags(
                Resources=[instance_id],
                Tags=[
                    {
                        'Key': 'SecurityStatus',
                        'Value': 'Isolated'
                    },
                    {
                        'Key': 'IsolationTime',
                        'Value': datetime.utcnow().isoformat()
                    }
                ]
            )
            
            return "Success"
        else:
            return "Instance not found"
            
    except Exception as e:
        print(f"Error isolating instance: {str(e)}")
        return f"Error: {str(e)}"

def add_ip_to_watchlist(ip_address):
    """Add IP to monitoring watchlist for enhanced tracking"""
    
    # This would integrate with your monitoring system
    # For example, adding to CloudWatch custom metrics or external SIEM
    
    try:
        cloudwatch = boto3.client('cloudwatch')
        
        # Send custom metric for watchlist IP
        cloudwatch.put_metric_data(
            Namespace='Security/Watchlist',
            MetricData=[
                {
                    'MetricName': 'SuspiciousIP',
                    'Dimensions': [
                        {
                            'Name': 'IPAddress',
                            'Value': ip_address
                        }
                    ],
                    'Value': 1,
                    'Unit': 'Count',
                    'Timestamp': datetime.utcnow()
                }
            ]
        )
        
        return "Success"
        
    except Exception as e:
        print(f"Error adding IP to watchlist: {str(e)}")
        return f"Error: {str(e)}"

def send_notification(sns, finding_type, severity, actions):
    """Send notification about automated response actions"""
    
    message = f"""
Automated Network Protection Response

Finding Type: {finding_type}
Severity: {severity}
Timestamp: {datetime.utcnow().isoformat()}

Actions Taken:
"""
    
    for action in actions:
        message += f"- {action}\n"
    
    try:
        sns.publish(
            TopicArn='arn:aws:sns:us-west-2:123456789012:NetworkProtectionAlerts',
            Subject=f'Automated Response: {finding_type}',
            Message=message
        )
    except Exception as e:
        print(f"Error sending notification: {str(e)}")

def handle_waf_event(ec2, wafv2, sns, detail):
    """Handle WAF events for automated response"""
    
    # Extract WAF event details
    blocked_requests = detail.get('blockedRequests', 0)
    source_ip = detail.get('sourceIP')
    
    # If high volume of blocked requests, enhance protection
    if blocked_requests > 1000:
        if source_ip:
            # Add to more restrictive blocking
            enhanced_block_result = enhance_ip_blocking(wafv2, source_ip)
            
            # Send alert
            send_notification(sns, 'High Volume Attack', 8.0, [enhanced_block_result])
    
    return {
        'statusCode': 200,
        'body': json.dumps({
            'blocked_requests': blocked_requests,
            'source_ip': source_ip
        })
    }

def enhance_ip_blocking(wafv2, ip_address):
    """Enhance blocking for high-volume attackers"""
    
    try:
        # Add to high-priority block list with longer duration
        # Implementation would depend on your specific WAF configuration
        return f"Enhanced blocking for {ip_address}"
        
    except Exception as e:
        return f"Error enhancing block: {str(e)}"

Example 2: Automated security group management

View code

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Automated security group management with Lambda'

Resources:
  # Lambda function for automated security group updates
  SecurityGroupAutomationFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: SecurityGroupAutomation
      Runtime: python3.9
      Handler: index.lambda_handler
      Role: !GetAtt SecurityGroupAutomationRole.Arn
      Timeout: 300
      Code:
        ZipFile: |
          import boto3
          import json
          from datetime import datetime, timedelta
          
          def lambda_handler(event, context):
              ec2 = boto3.client('ec2')
              
              # Automated security group rule cleanup
              cleanup_expired_rules(ec2)
              
              # Update security groups based on threat intelligence
              update_threat_intelligence_rules(ec2)
              
              return {'statusCode': 200, 'body': 'Security groups updated'}
          
          def cleanup_expired_rules(ec2):
              # Remove temporary rules that have expired
              try:
                  # Get security groups with temporary rules
                  response = ec2.describe_security_groups(
                      Filters=[
                          {
                              'Name': 'tag:AutoManaged',
                              'Values': ['true']
                          }
                      ]
                  )
                  
                  for sg in response['SecurityGroups']:
                      for rule in sg.get('IpPermissions', []):
                          for ip_range in rule.get('IpRanges', []):
                              description = ip_range.get('Description', '')
                              if 'Expires:' in description:
                                  # Parse expiration date and remove if expired
                                  # Implementation details would go here
                                  pass
                                  
              except Exception as e:
                  print(f"Error cleaning up rules: {str(e)}")
          
          def update_threat_intelligence_rules(ec2):
              # Update rules based on latest threat intelligence
              try:
                  # This would integrate with threat intelligence feeds
                  # Implementation details would go here
                  pass
              except Exception as e:
                  print(f"Error updating threat intelligence: {str(e)}")

  # IAM role for Lambda function
  SecurityGroupAutomationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: SecurityGroupManagement
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ec2:DescribeSecurityGroups
                  - ec2:AuthorizeSecurityGroupIngress
                  - ec2:RevokeSecurityGroupIngress
                  - ec2:AuthorizeSecurityGroupEgress
                  - ec2:RevokeSecurityGroupEgress
                  - ec2:CreateTags
                  - ec2:DescribeTags
                Resource: '*'

  # EventBridge rule for scheduled execution
  SecurityGroupAutomationSchedule:
    Type: AWS::Events::Rule
    Properties:
      Name: SecurityGroupAutomationSchedule
      Description: 'Trigger security group automation every hour'
      ScheduleExpression: 'rate(1 hour)'
      State: ENABLED
      Targets:
        - Arn: !GetAtt SecurityGroupAutomationFunction.Arn
          Id: SecurityGroupAutomationTarget

  # Permission for EventBridge to invoke Lambda
  SecurityGroupAutomationPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref SecurityGroupAutomationFunction
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt SecurityGroupAutomationSchedule.Arn

  # Auto-managed security group for dynamic rules
  AutoManagedSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 'Auto-managed security group for dynamic threat response'
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: Auto-Managed-SG
        - Key: AutoManaged
          Value: 'true'
        - Key: Purpose
          Value: 'Dynamic-Threat-Response'

  # Security group for isolated instances
  IsolationSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 'Security group for isolated instances'
      VpcId: !Ref VPC
      SecurityGroupEgress: []  # No outbound rules - complete isolation
      Tags:
        - Key: Name
          Value: Isolation-SG
        - Key: Purpose
          Value: 'Instance-Isolation'

### Example 3: Automated DDoS protection with CloudFront and Shield

python import boto3 import json from datetime import datetime

def setup_automated_ddos_protection(): """Configure automated DDoS protection with CloudFront and Shield Advanced"""

View code

cloudfront = boto3.client('cloudfront')
shield = boto3.client('shield')
route53 = boto3.client('route53')

# Enable Shield Advanced for enhanced DDoS protection
try:
    shield.create_subscription()
    print("Shield Advanced subscription created")
except shield.exceptions.ResourceAlreadyExistsException:
    print("Shield Advanced already enabled")

# Create CloudFront distribution with DDoS protection
distribution_config = {
    'CallerReference': f'ddos-protection-{datetime.utcnow().strftime("%Y%m%d%H%M%S")}',
    'Comment': 'Automated DDoS protection distribution',
    'DefaultCacheBehavior': {
        'TargetOriginId': 'primary-origin',
        'ViewerProtocolPolicy': 'redirect-to-https',
        'TrustedSigners': {
            'Enabled': False,
            'Quantity': 0
        },
        'ForwardedValues': {
            'QueryString': False,
            'Cookies': {'Forward': 'none'}
        },
        'MinTTL': 0,
        'Compress': True
    },
    'Origins': {
        'Quantity': 1,
        'Items': [
            {
                'Id': 'primary-origin',
                'DomainName': 'example.com',
                'CustomOriginConfig': {
                    'HTTPPort': 80,
                    'HTTPSPort': 443,
                    'OriginProtocolPolicy': 'https-only',
                    'OriginSslProtocols': {
                        'Quantity': 1,
                        'Items': ['TLSv1.2']
                    }
                }
            }
        ]
    },
    'Enabled': True,
    'WebACLId': 'arn:aws:wafv2:us-east-1:123456789012:global/webacl/DDoSProtection/12345678-1234-1234-1234-123456789012'
}

try:
    distribution_response = cloudfront.create_distribution(
        DistributionConfig=distribution_config
    )
    
    distribution_id = distribution_response['Distribution']['Id']
    distribution_domain = distribution_response['Distribution']['DomainName']
    
    print(f"Created CloudFront distribution: {distribution_id}")
    
    # Configure Route 53 health checks for failover
    setup_health_checks_and_failover(route53, distribution_domain)
    
    return distribution_id
    
except Exception as e:
    print(f"Error creating CloudFront distribution: {str(e)}")
    return None

def setup_health_checks_and_failover(route53, distribution_domain): """Set up Route 53 health checks and automated failover"""

View code

try:
    # Create health check for primary endpoint
    health_check_response = route53.create_health_check(
        Type='HTTPS',
        ResourcePath='/health',
        FullyQualifiedDomainName=distribution_domain,
        Port=443,
        RequestInterval=30,
        FailureThreshold=3,
        Tags=[
            {
                'Key': 'Name',
                'Value': 'Primary-Endpoint-Health-Check'
            }
        ]
    )
    
    health_check_id = health_check_response['HealthCheck']['Id']
    
    # Create CloudWatch alarm for health check
    cloudwatch = boto3.client('cloudwatch')
    
    cloudwatch.put_metric_alarm(
        AlarmName='PrimaryEndpointHealthCheck',
        ComparisonOperator='LessThanThreshold',
        EvaluationPeriods=2,
        MetricName='HealthCheckStatus',
        Namespace='AWS/Route53',
        Period=60,
        Statistic='Minimum',
        Threshold=1.0,
        ActionsEnabled=True,
        AlarmActions=[
            'arn:aws:sns:us-west-2:123456789012:DDoSProtectionAlerts'
        ],
        AlarmDescription='Primary endpoint health check failure',
        Dimensions=[
            {
                'Name': 'HealthCheckId',
                'Value': health_check_id
            }
        ]
    )
    
    print(f"Created health check and alarm: {health_check_id}")
    
except Exception as e:
    print(f"Error setting up health checks: {str(e)}")

def create_automated_waf_rules(): """Create WAF rules with automated DDoS protection"""

View code

wafv2 = boto3.client('wafv2')

# Create rate-based rule with automatic scaling
rate_based_rule = {
    'Name': 'AutomatedRateLimiting',
    'Priority': 1,
    'Action': {'Block': {}},
    'Statement': {
        'RateBasedStatement': {
            'Limit': 2000,
            'AggregateKeyType': 'IP',
            'ScopeDownStatement': {
                'NotStatement': {
                    'Statement': {
                        'GeoMatchStatement': {
                            'CountryCodes': ['US', 'CA', 'GB']  # Allow from trusted countries
                        }
                    }
                }
            }
        }
    },
    'VisibilityConfig': {
        'SampledRequestsEnabled': True,
        'CloudWatchMetricsEnabled': True,
        'MetricName': 'AutomatedRateLimiting'
    }
}

# Create adaptive rule based on request patterns
adaptive_rule = {
    'Name': 'AdaptiveProtection',
    'Priority': 2,
    'Action': {'Block': {}},
    'Statement': {
        'AndStatement': {
            'Statements': [
                {
                    'ByteMatchStatement': {
                        'SearchString': 'bot',
                        'FieldToMatch': {'SingleHeader': {'Name': 'user-agent'}},
                        'TextTransformations': [
                            {'Priority': 1, 'Type': 'LOWERCASE'}
                        ],
                        'PositionalConstraint': 'CONTAINS'
                    }
                },
                {
                    'RateBasedStatement': {
                        'Limit': 100,
                        'AggregateKeyType': 'IP'
                    }
                }
            ]
        }
    },
    'VisibilityConfig': {
        'SampledRequestsEnabled': True,
        'CloudWatchMetricsEnabled': True,
        'MetricName': 'AdaptiveProtection'
    }
}

try:
    web_acl_response = wafv2.create_web_acl(
        Name='AutomatedDDoSProtection',
        Scope='CLOUDFRONT',
        DefaultAction={'Allow': {}},
        Rules=[rate_based_rule, adaptive_rule],
        Description='Automated DDoS protection with adaptive rules',
        Tags=[
            {
                'Key': 'Name',
                'Value': 'Automated-DDoS-Protection'
            }
        ],
        VisibilityConfig={
            'SampledRequestsEnabled': True,
            'CloudWatchMetricsEnabled': True,
            'MetricName': 'AutomatedDDoSProtection'
        }
    )
    
    return web_acl_response['Summary']['ARN']
    
except Exception as e:
    print(f"Error creating automated WAF rules: {str(e)}")
    return None

Example 4: Infrastructure as Code for automated network security

View code

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Automated network security infrastructure'

Parameters:
  VpcCidr:
    Type: String
    Default: '10.0.0.0/16'
  ThreatIntelligenceBucket:
    Type: String
    Description: 'S3 bucket containing threat intelligence feeds'

Resources:
  # Custom resource for automated threat intelligence updates
  ThreatIntelligenceUpdater:
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt ThreatIntelligenceFunction.Arn
      ThreatIntelligenceBucket: !Ref ThreatIntelligenceBucket

  # Lambda function for threat intelligence processing
  ThreatIntelligenceFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: ThreatIntelligenceProcessor
      Runtime: python3.9
      Handler: index.lambda_handler
      Role: !GetAtt ThreatIntelligenceRole.Arn
      Timeout: 300
      Code:
        ZipFile: |
          import boto3
          import json
          import cfnresponse
          
          def lambda_handler(event, context):
              try:
                  if event['RequestType'] == 'Create' or event['RequestType'] == 'Update':
                      # Process threat intelligence feeds
                      process_threat_intelligence(event['ResourceProperties'])
                      cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
                  else:
                      cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
              except Exception as e:
                  print(f"Error: {str(e)}")
                  cfnresponse.send(event, context, cfnresponse.FAILED, {})
          
          def process_threat_intelligence(properties):
              # Download and process threat intelligence feeds
              # Update WAF IP sets and security groups
              pass

  # IAM role for threat intelligence function
  ThreatIntelligenceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: ThreatIntelligencePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:ListBucket
                  - wafv2:UpdateIPSet
                  - wafv2:GetIPSet
                  - ec2:AuthorizeSecurityGroupIngress
                  - ec2:RevokeSecurityGroupIngress
                Resource: '*'

  # EventBridge rule for automated threat intelligence updates
  ThreatIntelligenceSchedule:
    Type: AWS::Events::Rule
    Properties:
      Name: ThreatIntelligenceUpdate
      Description: 'Update threat intelligence feeds every 4 hours'
      ScheduleExpression: 'rate(4 hours)'
      State: ENABLED
      Targets:
        - Arn: !GetAtt ThreatIntelligenceFunction.Arn
          Id: ThreatIntelligenceTarget

  # Permission for EventBridge to invoke Lambda
  ThreatIntelligencePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref ThreatIntelligenceFunction
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt ThreatIntelligenceSchedule.Arn

  # Auto-scaling group for network security appliances
  NetworkSecurityASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      AutoScalingGroupName: NetworkSecurityAppliances
      VPCZoneIdentifier:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      LaunchTemplate:
        LaunchTemplateId: !Ref SecurityApplianceLaunchTemplate
        Version: !GetAtt SecurityApplianceLaunchTemplate.LatestVersionNumber
      MinSize: 2
      MaxSize: 10
      DesiredCapacity: 2
      TargetGroupARNs:
        - !Ref SecurityApplianceTargetGroup
      Tags:
        - Key: Name
          Value: Network-Security-Appliance
          PropagateAtLaunch: true

  # Launch template for security appliances
  SecurityApplianceLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateName: SecurityApplianceLaunchTemplate
      LaunchTemplateData:
        ImageId: ami-12345678  # Security appliance AMI
        InstanceType: c5.large
        SecurityGroupIds:
          - !Ref SecurityApplianceSecurityGroup
        IamInstanceProfile:
          Arn: !GetAtt SecurityApplianceInstanceProfile.Arn
        UserData:
          Fn::Base64: !Sub |
            #!/bin/bash
            # Configure security appliance with automated threat feeds
            /opt/security-appliance/configure-automation.sh

Outputs:
  ThreatIntelligenceFunctionArn:
    Description: 'ARN of the threat intelligence processing function'
    Value: !GetAtt ThreatIntelligenceFunction.Arn
    Export:
      Name: !Sub '${AWS::StackName}-ThreatIntelligence-Function'

AWS services to consider

AWS Lambda

Lets you run code without provisioning or managing servers. Essential for implementing automated response functions and security orchestration workflows.

Amazon EventBridge

A serverless event bus that makes it easy to connect applications together. Enables automated response to security events from multiple AWS services.

AWS Systems Manager

Gives you visibility and control of your infrastructure on AWS. Provides automation capabilities for security configuration management and incident response.

Amazon CloudWatch

Monitors your AWS resources and applications in real time. Provides metrics, alarms, and automated actions for network security monitoring.

AWS CloudFormation

Gives you an easy way to model a collection of related AWS and third-party resources. Enables Infrastructure as Code for consistent security deployments.

Amazon GuardDuty

Provides intelligent threat detection for your AWS accounts and workloads. Integrates with automated response systems for immediate threat mitigation.

Benefits of automating network protection

Rapid threat response: Automated systems can respond to threats in seconds rather than minutes or hours
Consistent policy enforcement: Automation ensures security policies are applied uniformly across all network resources
Reduced human error: Automated processes eliminate mistakes that can occur during manual security operations
24/7 protection: Automated systems provide continuous protection without requiring human oversight
Scalable security: Automation scales with your infrastructure growth without proportional increases in security staff
Improved threat intelligence: Automated systems can process and act on threat intelligence feeds in real-time
Cost efficiency: Reduces operational costs by minimizing manual security operations and faster incident resolution

```

Back to SEC05

SEC05-BP04 - Automate network protection

One-Click Remediation

Implementation guidance

Key steps for implementing this best practice:

Implementation examples

Example 1: Automated threat response with Lambda and EventBridge

Example 2: Automated security group management

Example 4: Infrastructure as Code for automated network security

AWS services to consider

AWS Lambda

Amazon EventBridge

AWS Systems Manager

Amazon CloudWatch

AWS CloudFormation

Amazon GuardDuty

Benefits of automating network protection

Related resources

Related Resources