When a Security Hub finding fires at 2am, the last thing you want is to be piecing together a response process from scratch — figuring out who to notify, what to isolate, and where to look for evidence.
I built this toolkit after going through that exact situation too many times. It’s the set of templates, automation, and reference material I wish I’d had from day one.
What’s in the Toolkit
IR Playbook Template (PDF)
A printable, checklist-style playbook covering the five standard IR phases, aligned to ISO 27001 and AWS-native workflows:
- Preparation — roles (Incident Commander, Comms Lead, IR Engineer), CloudTrail/GuardDuty/Config prerequisites, forensic IAM roles, asset documentation
- Detection & Analysis — trigger sources (Security Hub, GuardDuty), CloudTrail correlation, resource identification, volatile data capture via SSM
- Containment — security group isolation, credential revocation, IAM suspension
- Eradication & Recovery — patching, secret rotation, re-imaging, backup restoration
- Lessons Learned — post-mortem, root cause documentation, playbook updates, stakeholder debrief
Each phase has checkboxes you can print and use during an active incident.
Notification Pipeline (Terraform + Lambda)
Deployable automation that routes Security Hub findings to your team:
The Terraform code creates everything in one terraform apply:
- EventBridge rule — matches findings with severity >= MEDIUM, compliance status FAILED, workflow status NEW
- Lambda function — extracts finding metadata and sends a formatted email via SES, then marks the finding as NOTIFIED to prevent duplicate alerts
- IAM role — least-privilege permissions for SES and Security Hub only
- CloudWatch log group — 14-day retention for Lambda logs
The EventBridge rule pattern filters on severity and compliance status so you don’t get paged for every informational finding:
event_pattern = jsonencode({
source = ["aws.securityhub"]
detail-type = ["Security Hub Findings - Imported"]
detail = {
findings = {
Workflow = { Status = ["NEW"] }
Compliance = { Status = ["FAILED"] }
Severity = { Label = ["MEDIUM", "HIGH", "CRITICAL"] }
}
}
})
Slack Notification Lambda
A second Lambda function that posts formatted alerts to Slack via incoming webhook. Uses Slack Block Kit for structured messages with:
- Severity color-coding (red for CRITICAL, orange for HIGH, yellow for MEDIUM)
- Finding title, source service, account, region, and resource
- Direct “View in Security Hub” button
Uses only Python’s built-in urllib — no external dependencies, no Lambda layers required.
Notification Flow Architectures
Three reference patterns documented with triggers, logic, and what to configure:
- Security Hub → SES email (fully implemented with Terraform)
- GuardDuty/Security Hub → Slack (Lambda included, Terraform target left as exercise)
- IAM policy changes → CloudTrail → EventBridge → SQS (reference architecture with EventBridge pattern)
Cloud Forensics Tool Matrix (Excel)
A categorized reference of tools for AWS incident investigation — native AWS services and open-source alternatives, mapped by use case (memory acquisition, log analysis, network forensics, disk forensics).
How to Deploy
- Download the toolkit and extract it
- Create
terraform/terraform.tfvarswith your email addresses:
aws_region = "eu-west-1"
ses_from_email = "[email protected]"
ses_to_email = "[email protected]"
- Deploy:
cd terraform
terraform init
terraform plan
terraform apply
- Generate sample findings to test:
aws securityhub create-sample-findings --region eu-west-1
Prerequisites: SES sender email must be verified (or SES out of sandbox mode). AWS credentials configured locally.
Download the Toolkit (Free)
Download AWS IR Toolkit v1.1 (.zip, ~100KB)
Includes the playbook PDF, all Terraform and Python code above, the notification flow architectures, and the forensic tool matrix.
Related guides:
- AWS Incident Response Scenarios: 5 Real-World Attack Patterns — practice these scenarios with the playbook
- AWS CloudTrail Log Analysis for Security — the primary data source for IR investigation
- AWS GuardDuty Setup: Route Findings to Slack & Your SIEM — the detection layer that feeds the notification pipeline
- Real-World Phishing Incident Response — a full IR walkthrough using this methodology