Automated Security Remediation Design — AWS Solutions Architect Pro (SAP-C02)

GuardDuty Routes to Lambda or Step Functions Based on Confidence

A GuardDuty finding that identifies a known malicious IP communicating with an EC2 instance carries high confidence and a narrow, reversible remediation: Lambda modifies the security group to isolate the instance automatically. A finding that a principal is accessing an unusual number of S3 buckets carries lower confidence with broader implications; automated isolation could disrupt a legitimate batch job. Lower-confidence findings should route to a Step Functions workflow with a manual approval task before any destructive action executes. The design principle is to match automation depth to finding confidence and action reversibility. High-confidence, narrow-blast-radius findings justify full automation; broader or ambiguous findings require a human review step.