Ravi Sir's Cards › AWS
What do you do on a CRITICAL finding?
This interview card answers: What do you do on a CRITICAL finding? Contain (keys/instances), open an incident, preserve evidence, then eradicate and review IAM. Do not only silence the alert. Rotate exposed keys quickly. Compromised access key , then disable key, GuardDuty detail, CloudTrail review.
Read card text
What this card says
What it is
Contain (keys/instances), open an incident, preserve evidence, then eradicate and review IAM.
contain first
Why it matters
Do not only silence the alert. Rotate exposed keys quickly.
How / example
Compromised access key → disable key, GuardDuty detail, CloudTrail review.