Auto-remediate HIGH/CRITICAL Security Hub findings using AWS Step Functions and AWS Lambda to close open security groups and block public S3 access
AWS Security Hub detects HIGH or CRITICAL findings such as open security groups or public Amazon S3 buckets.
Amazon EventBridge captures the finding and triggers an AWS Step Functions workflow that classifies the finding type.
AWS Lambda executes targeted remediation (revoke open ingress rules, enable S3 public access block) and Amazon SNS notifies the security team.
< Back to all patterns
Clone repo
git clone https://github.com/aws-samples/serverless-patterns/cd serverless-patterns/securityhub-finding-sfn-remediation-cdkDeploy
<code>cd securityhub-finding-sfn-remediation-cdk</code><code>npm install</code><code>cdk deploy</code>Testing
Create an intentionally open security group (0.0.0.0/0 on port 22).
Wait for AWS Security Hub to detect the finding (~15 minutes).
Verify the AWS Step Functions execution completed and the security group was closed.
Subscribe to the Amazon SNS topic to receive remediation alerts.
Cleanup
cd securityhub-finding-sfn-remediation-cdkcdk destroyCreated by:
