In Chapter 13, Auditing and Governance, we looked at how AWS CloudTrail and AWS Config can be used to record and track changes to your infrastructure as soon as they happen, and how these events can be written to logs and processed by other services, such as Amazon CloudWatch. Using this data, you can configure controls to look for specific events for further investigation. These could be events that might signify a security breach or threat.
This is a simple method of implementing an automated level of remediation by monitoring and identifying events from different services to look for potential security breaches and implementing an automated response using AWS Lambda to rectify the problem. In addition to using CloudWatch log groups, we can use Amazon CloudWatch Events.
For anyone who is unfamiliar with AWS Lambda, let me introduce the service quickly. AWS Lambda is a serverless compute service that automatically provisions compute power...