Record · corpus.blog/posts/01a08783-2996-72ba-a876-ac53f09f33b7

AWS Security Incident Response Playbooks - First-Response Runbooks for Common Scenarios | hidekazu-konishi.com

hidekazu-konishi.com · published 26 July 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at hidekazu-konishi.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
External links: 28
Words captured: 8,319

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://aws.amazon.com/blogs/security/announcing-the-aws-blueprint-for-ransomware-defense/

aws.amazon.com

https://docs.aws.amazon.com/whitepapers/latest/ransomware-risk-management-on-aws-using-nist-csf/ransomware-risk-management-on-aws-using-nist-csf.html

docs.aws.amazon.com

https://aws.amazon.com/blogs/security/anatomy-of-a-ransomware-event-targeting-data-in-amazon-s3/

aws.amazon.com

https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html

docs.aws.amazon.com

https://csrc.nist.gov/pubs/sp/800/61/r3/final

csrc.nist.gov

https://www.nist.gov/cyberframework

nist.gov

https://docs.aws.amazon.com/pdfs/whitepapers/latest/aws-security-incident-response-guide/aws-security-incident-response-guide.pdf

docs.aws.amazon.com

https://docs.aws.amazon.com/security-ir/latest/userguide/what-is.html

docs.aws.amazon.com

https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact-alternate.html

docs.aws.amazon.com

https://aws.amazon.com/security-incident-response/

aws.amazon.com

https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html

docs.aws.amazon.com

https://docs.aws.amazon.com/guardduty/latest/ug/compromised-creds.html

docs.aws.amazon.com

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_revoke-sessions.html

docs.aws.amazon.com

https://aws.amazon.com/blogs/security/how-to-revoke-federated-users-active-aws-sessions/

aws.amazon.com

https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html

docs.aws.amazon.com

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html

docs.aws.amazon.com

https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

docs.aws.amazon.com

https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html

docs.aws.amazon.com

https://docs.aws.amazon.com/guardduty/latest/ug/compromised-ec2.html

docs.aws.amazon.com

https://github.com/awslabs/git-secrets

github.com

https://github.com/aws-samples/aws-customer-playbook-framework

github.com

https://github.com/aws-samples/aws-incident-response-playbooks

github.com

https://aws.amazon.com/security-incident-response/faqs/

aws.amazon.com

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_disable-perms.html

docs.aws.amazon.com

https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCompromisedKeyQuarantineV3.html

docs.aws.amazon.com

https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-analyzer.html

docs.aws.amazon.com

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html

docs.aws.amazon.com

https://docs.aws.amazon.com/detective/latest/userguide/what-is-detective.html

docs.aws.amazon.com

Elsewhere on hidekazu-konishi.com (10)

Incident Triage Flowcharts - Network, DB, and Application Layer | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

IAM Policy Evaluation Logic Step-by-Step - Explicit Deny, RCP, SCP, Resource Policy, Identity Policy, Permission Boundary, and Session Policy | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

AWS Organization Guardrails - Service Control Policies, Resource Control Policies, and Data Perimeter Design | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

CloudWatch Logs Insights Query Cookbook: Practical Recipes for Incident Investigation, Cost Analysis, and Security Audits | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

Centralized Logging and Audit Architecture on AWS - Multi-Account Log Aggregation, Detection, and Query with CloudTrail, Config, Security Hub, and OpenSearch | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

AWS Secrets Manager and Parameter Store Decision Guide - Storing, Rotating, and Accessing Secrets and Configuration | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

AWS Config Rules and Conformance Packs - Compliance Detection, Automated Remediation, and Organizations Deployment | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

What Can Be Made Public on AWS - Storage and Data, the Block Public Access Family, and What Each Switch Does Not Promise | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

AI-Assisted Security Testing on AWS - What You Approve, What You Can Only Stop, and What the Findings List Hides by Default | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com

Detection Engineering on AWS - What a Custom Source Must Satisfy Before a Detection Can Be Written, and What the Detection Still Does Not See | hidekazu-konishi.com Read at the source ↗

hidekazu-konishi.com