Detect sensitive file modifications with Amazon GuardDuty, classify severity, and auto-isolate compromised instances via AWS Step Functions and AWS Lambda
Amazon GuardDuty detects sensitive file modifications or unauthorized access on Amazon EC2 instances and publishes findings to Amazon EventBridge.
Amazon EventBridge triggers an AWS Step Functions workflow that classifies finding severity: HIGH (≥7) isolates the instance, MEDIUM (4-6) notifies only, LOW (<4) logs only.
For HIGH severity findings, AWS Lambda replaces the instance security group (network isolation), creates forensic EBS snapshots, and tags the instance. Amazon SNS delivers alerts to the security team.
< Back to all patterns
Clone repo
git clone https://github.com/aws-samples/serverless-patterns/cd serverless-patterns/guardduty-file-modification-sfn-response-cdkDeploy
<code>cd guardduty-file-modification-sfn-response-cdk/cdk</code><code>npm install</code><code>npx cdk deploy</code>Testing
Generate sample Amazon GuardDuty findings using the create-sample-findings API.
Verify AWS Step Functions execution was triggered via the list-executions API.
For HIGH severity, confirm the instance security group was replaced and forensic snapshots were created.
Subscribe to the Amazon SNS topic to receive incident alerts.
Cleanup
npx cdk destroyCreated by:
