Scaling incident response with AWS developer tools
summary
Shows concrete, working recipes: a shell script that uses aws cli to enable Organizations service access idempotently, list active account IDs, exclude the current account via sts get-caller-identity, and call get-contact-information across hundreds of accounts; and a Python example using boto3 that generate_and_fetchs the IAM credential report, decodes the CSV, flags users created within six hours and accounts with two active access keys. Scripts run in CloudShell or pipelines, print planned remediation actions, and log for postmortems.
AI-written summary · about
chapters (4)
- 0:00Introduction to incident response
- 1:29Preparing with AWS CLI
- 9:53Automating with Python SDK
- 14:52Next steps and resources
related talks
28mYour journey to temporary credentials in the cloud
34mScaling access with AWS IAM Identity Center, feat.
43mThink like a HACKER
20mFantastic AWS Attacks and Where to Find Them
23mGetting started with identity on AWS
26mAWS (mis)configuration from an attacker’s-eye view
46mHardening AWS Environments and Automating Incident Response for AWS Compromises
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!