Execute cloud-native incident containment across AWS, Azure, and GCP by isolating compromised resources, revoking credentials, preserving forensic evidence, and applying security group restrictions to prevent lateral movement.
Execute cloud-native incident containment across AWS, Azure, and GCP by isolating compromised resources, revoking credentials, preserving forensic evidence, and applying security group restrictions to prevent lateral movement.
["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"]
nist_csf
["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]
Performing Cloud Incident Containment Procedures
Overview
Cloud incident containment requires cloud-native approaches that differ significantly from traditional on-premises response. Containment procedures must leverage platform-specific controls including security groups, IAM policies, network ACLs, and service-level isolation to restrict compromised resources while preserving forensic evidence. According to the 2025 Unit 42 Global Incident Response Report, responding to cloud incidents requires understanding shared responsibility models, ephemeral infrastructure, and API-driven operations. Effective containment involves credential revocation, resource isolation, evidence snapshot creation, and automated response playbook execution.
When to Use
When conducting security assessments that involve performing cloud incident containment procedures
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Common Misconfigurations & Verification
Containment that destroys evidence: terminating/stopping an instance before snapshotting wipes the instance-store volume and RAM. Always create-snapshot/New-AzSnapshot/gcloud compute disks snapshot and capture memory before isolation, and prefer quarantine SG/NSG over stop. Tag and Object-Lock the snapshot so cleanup automation can't delete it.
Token revocation that isn't: disabling an IAM user's access key or AccountEnabled=$false does not kill already-issued STS/refresh tokens — they remain valid until expiry. For AWS attach the aws:TokenIssueTime deny condition (and update the role trust policy) ; for Azure run Revoke-AzureADUserAllRefreshToken; for GCP the SA key delete leaves active OAuth tokens until TTL. Verify with CloudTrail/Activity/Audit logs showing the principal's calls now AccessDenied.
Isolation gaps: an EC2/VM SG/NSG change leaves existing established connections alive in some stacks, and removing one of several attached SGs/NICs leaves another path open. Confirm all NICs/SGs, NACLs, and public IPs are covered; for serverless, set Lambda reserved concurrency to 0 and delete event-source mappings.
Cross-account / persistence missed: attackers leave behind backdoor IAM roles, added trust relationships, new access keys, and Lambda/EventBridge triggers. Containing the obvious identity but not auditing iam:CreateRole// since the compromise window lets them walk back in.
CreateAccessKey
AttachRolePolicy
Concrete verification the action worked: replay a known-bad API call and confirm it now fails; check the instance is unreachable on its prior listeners; confirm the snapshot exists with COMPLIANCE-mode lock; and verify CloudTrail/Activity logs are still flowing to write-protected storage (containment must not break logging).
Prerequisites
Familiarity with incident response concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
AWS Containment Procedures
1. Credential Compromise Containment
# Disable compromised IAM user access keys
aws iam update-access-key --user-name compromised-user \
--access-key-id AKIA... --status Inactive
# List and disable all access keys for user
aws iam list-access-keys --user-name compromised-user
aws iam delete-access-key --user-name compromised-user --access-key-id AKIA...
# Attach deny-all policy to compromised user
aws iam put-user-policy --user-name compromised-user \
--policy-name DenyAll \
--policy-document '{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "*",
"Resource": "*"
}]
}'# Revoke all active sessions for IAM role
aws iam put-role-policy --role-name compromised-role \
--policy-name RevokeOldSessions \
--policy-document '{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"DateLessThan": {"aws:TokenIssueTime": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}
}
}]
}'# Invalidate temporary credentials by updating role trust policy
aws iam update-assume-role-policy --role-name compromised-role \
--policy-document '{"Version":"2012-10-17","Statement":[]}'
2. EC2 Instance Isolation
# Create quarantine security group (no inbound, no outbound)
aws ec2 create-security-group --group-name quarantine-sg \
--description "Quarantine - No traffic allowed" --vpc-id vpc-xxxxx
# Remove all rules from quarantine SG (default allows outbound)
aws ec2 revoke-security-group-egress --group-id sg-quarantine \
--ip-permissions '[{"IpProtocol":"-1","FromPort":-1,"ToPort":-1,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]}]'# Take forensic snapshot BEFORE containment
aws ec2 create-snapshot --volume-id vol-xxxxx \
--description "Forensic snapshot - IR Case 2025-001" \
--tag-specifications 'ResourceType=snapshot,Tags=[{Key=IR-Case,Value=2025-001}]'# Apply quarantine security group to compromised instance
aws ec2 modify-instance-attribute --instance-id i-xxxxx \
--groups sg-quarantine
# Tag instance as compromised
aws ec2 create-tags --resources i-xxxxx \
--tags Key=IR-Status,Value=Contained Key=IR-Case,Value=2025-001
# Capture memory (if SSM agent available)
aws ssm send-command --instance-ids i-xxxxx \
--document-name "AWS-RunShellScript" \
--parameters 'commands=["dd if=/dev/mem of=/tmp/memory.dump bs=1M"]'
