Fo-triage lambda is failing on not able to accuire instance detail info

aws-solutions / automated-forensic-orchestrator-for-amazon-ec2

Automated Forensics Orchestrator for Amazon EC2 is a self-service AWS Solution implementation that enterprise customers can deploy to quickly set up and configure an automated orchestration workflow that enables their Security Operations Centre (SOC) to capture and examine data from EC2 instances and attached volumes as evidence for forensic analysis, in the event of a potential security breach. It will orchestrate the forensics process from the point at which a threat is first detected, enable isolation of the affected EC2 instances and data volumes, capture memory and disk images to secure storage, and trigger automated actions or tools for investigation and analysis of such artefacts. All the while, the solution will notify and report on its progress, status, and findings. It will enable SOC to continuously discover and analyze patterns of fraudulent activities across multi-account and multi-region environments. The solution will leverage native AWS services and be underpinned by a highly available, resilient, and serverless architecture, security, and operational monitoring features. Digital forensics is a 4 step process of triaging, acquisition, analysis and reporting. Automated Forensics framework provides capability to enterprise to act on security event by imaging or acquisition of breached resource for examination and generate forensic report about the security breach. In the event of a security breach, it will enable customers to easily to capture and examine required targeted data for forsensic’s storage and analysis. This solution framework enables security operations centre to discover and analyse patterns of fraudulent activities. The automated forensics solution will provide a multi-account and a multi-region [“solution”] built using native AWS services.

Apache License 2.0

57 stars 8 forks source link

Describe the bug Get Instance Lambda function assumes role into compromised application account and is unable to retrieves instance information.

To Reproduce

AWS Security Hub operating in AWS application account is reported with details of the compromised instance and the findings get aggregated to AWS Security Hub administrator AWS master Account.

The security administrator initiates one of the following forensic actions in Security Hub.

Forensic triage

Forensic isolation

Amazon EventBridge initiates the triage Step Functions flow.

Expected behavior A clear and concise description of what you expected to happen.

Please complete the following information about the solution:

[ ] Version: [e.g. v1.0.0]

To get the version of the solution, you can look at the description of the created CloudFormation stack. For example, "(SO0191) - Automated Forensics for Amazon EC2. Version v5.0.0". If the description does not contain the version information, you can look at the mappings section of the template:

Mappings:
    SourceCode:
        General:
            S3Bucket: 'solutions'
            KeyPrefix: 'automated-forensics-for-amazon-ec2/v1.0.0'

[ ] Region: [e.g. us-east-1]
[ ] Was the solution modified from the version published on this repository?
[ ] If the answer to the previous question was yes, are the changes available on GitHub?
[ ] Have you checked your service quotas for the sevices this solution uses?
[ ] Were there any errors in the CloudWatch Logs?

Screenshots

Additional context Add any other context about the problem here.

aws-solutions / automated-forensic-orchestrator-for-amazon-ec2

Fo-triage lambda is failing on not able to accuire instance detail info #20