Skip to main content Home Creators oyi77 1ai-skills performing-cloud-incident-containment-procedures
performing-cloud-incident-containment-procedures Execute cloud-native incident containment across AWS, Azure, and GCP by isolating compromised resources, revoking credentials, preserving forensic evidence, and applying security group restrictions to prevent lateral movement. Use when working with performing cloud incident containment procedures.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/oyi77/1ai-skills --skill performing-cloud-incident-containment-proceduresThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository
Related occupations SOC
Based on SOC occupation classification
name performing-cloud-incident-containment-procedures description Execute cloud-native incident containment across AWS, Azure, and GCP by isolating compromised resources, revoking credentials, preserving forensic evidence, and applying security group restrictions to prevent lateral movement. Use when working with performing cloud incident containment procedures. domain cybersecurity subdomain incident-response tags ["cloud-security","incident-containment","aws","azure","gcp","cloud-forensics","credential-revocation","network-isolation"] mitre_attack ["T1078","T1537","T1580","T1525","T1098"] version 1.0 author oyi77 license Apache-2.0 d3fend_techniques ["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"] nist_csf ["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]
Performing Cloud Incident Containment Procedures
Overview
Cloud incident containment requires cloud-native approaches that differ significantly from traditional on-premises response. Containment procedures must leverage platform-specific controls including security groups, IAM policies, network ACLs, and service-level isolation to restrict compromised resources while preserving forensic evidence. According to the 2025 Unit 42 Global Incident Response Report, responding to cloud incidents requires understanding shared responsibility models, ephemeral infrastructure, and API-driven operations. Effective containment involves credential revocation, resource isolation, evidence snapshot creation, and automated response playbook execution.
When to Use
Trigger phrases:
"performing cloud incident containment procedures"
"Execute cloud-native incident containment across AWS, Azure, and GCP by isolatin"
When conducting security assessments that involve performing cloud incident containment procedures
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Familiarity with incident response concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
AWS Containment Procedures
This section covers aws containment procedures for performing cloud incident containment procedures.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
1. Credential Compromise Containment
aws iam update-access-key --user-name compromised-user \
--access-key-id AKIA... --status Inactive
aws iam list-access-keys --user-name compromised-user
aws iam delete-access-key --user-name compromised-user --access-key-id AKIA...
aws iam put-user-policy --user-name compromised-user \
--policy-name DenyAll \
--policy-document '{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "*",
"Resource": "*"
}]
}'
'{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"DateLessThan": {"aws:TokenIssueTime": "'
date
'"}
}
}]
}'
'{"Version":"2012-10-17","Statement":[]}'
2. EC2 Instance Isolation
aws ec2 create-security-group --group-name quarantine-sg \
--description "Quarantine - No traffic allowed" --vpc-id vpc-xxxxx
aws ec2 revoke-security-group-egress --group-id sg-quarantine \
--ip-permissions '[{"IpProtocol":"-1","FromPort":-1,"ToPort":-1,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]}]'
aws ec2 create-snapshot --volume-id vol-xxxxx \
--description "Forensic snapshot - IR Case 2025-001" \
--tag-specifications 'ResourceType=snapshot,Tags=[{Key=IR-Case,Value=2025-001}]'
aws ec2 modify-instance-attribute --instance-id i-xxxxx \
--groups sg-quarantine
aws ec2 create-tags --resources i-xxxxx \
--tags Key=IR-Status,Value=Contained Key=IR-Case,Value=2025-001
aws ssm send-command --instance-ids i-xxxxx \
--document-name "AWS-RunShellScript" \
--parameters 'commands=["dd if=/dev/mem of=/tmp/memory.dump bs=1M"]'
3. S3 Bucket Containment
aws s3api put-public-access-block --bucket compromised-bucket \
--public-access-block-configuration \
BlockPublicAcls=true ,IgnorePublicAcls=true ,BlockPublicPolicy=true ,RestrictPublicBuckets=true
aws s3api put-bucket-policy --bucket compromised-bucket \
--policy '{
"Version": "2012-10-17",
"Statement": [{
"Sid": "DenyAllExceptForensics",
"Effect": "Deny",
"NotPrincipal": {"AWS": "arn:aws:iam::ACCOUNT:role/IR-Forensics"},
"Action": "s3:*",
"Resource": ["arn:aws:s3:::compromised-bucket","arn:aws:s3:::compromised-bucket/*"]
}]
}'
aws s3api put-bucket-versioning --bucket compromised-bucket \
--versioning-configuration Status=Enabled
aws s3api put-object-lock-configuration --bucket evidence-bucket \
--object-lock-configuration '{
"ObjectLockEnabled": "Enabled",
"Rule": {"DefaultRetention": {"Mode": "COMPLIANCE", "Days": 365}}
}'
4. Lambda Function Containment
aws lambda put-function-concurrency --function-name compromised-function \
--reserved-concurrent-executions 0
aws lambda list-event-source-mappings --function-name compromised-function
aws lambda delete-event-source-mapping --uuid mapping-uuid
Azure Containment Procedures This section covers azure containment procedures for performing cloud incident containment procedures.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
1. Identity Containment # Revoke all user sessions
Revoke-AzureADUserAllRefreshToken -ObjectId "user-object-id"
# Disable user account
Set-AzureADUser -ObjectId "user-object-id" -AccountEnabled $false
# Reset user password
Set-AzureADUserPassword -ObjectId "user-object-id" -Password (
ConvertTo-SecureString "TempP@ss!" -AsPlainText -Force
) -ForceChangePasswordNextLogin $true
# Block sign-in via Conditional Access (emergency policy)
# Create policy blocking user from all cloud apps
# Revoke Azure AD application consent
Remove-AzureADServiceAppRoleAssignment -ObjectId "sp-object-id" \
-AppRoleAssignmentId "assignment-id"
2. VM Isolation # Create Network Security Group with deny-all rules
$nsg = New-AzNetworkSecurityGroup -ResourceGroupName "rg" -Location "eastus" `
-Name "quarantine-nsg" `
-SecurityRules @(
New-AzNetworkSecurityRuleConfig -Name "DenyAllInbound" -Protocol * `
-Direction Inbound -Priority 100 -SourceAddressPrefix * `
-SourcePortRange * -DestinationAddressPrefix * `
-DestinationPortRange * -Access Deny,
New-AzNetworkSecurityRuleConfig -Name "DenyAllOutbound" -Protocol * `
-Direction Outbound -Priority 100 -SourceAddressPrefix * `
-SourcePortRange * -DestinationAddressPrefix * `
-DestinationPortRange * -Access Deny
)
# Take disk snapshot for forensics
$vm = Get-AzVM -ResourceGroupName "rg" -Name "compromised-vm"
$snapshotConfig = New-AzSnapshotConfig -SourceUri $vm.StorageProfile.OsDisk.ManagedDisk.Id `
-Location "eastus" -CreateOption Copy
New-AzSnapshot -ResourceGroupName "rg" -SnapshotName "forensic-snap" -Snapshot $snapshotConfig
# Apply quarantine NSG to VM NIC
$nic = Get-AzNetworkInterface -ResourceGroupName "rg" -Name "compromised-nic"
$nic.NetworkSecurityGroup = $nsg
Set-AzNetworkInterface -NetworkInterface $nic
3. Storage Account Containment # Remove network access
Update-AzStorageAccountNetworkRuleSet -ResourceGroupName "rg" `
-Name "storageaccount" -DefaultAction Deny
# Regenerate access keys
New-AzStorageAccountKey -ResourceGroupName "rg" -Name "storageaccount" -KeyName key1
New-AzStorageAccountKey -ResourceGroupName "rg" -Name "storageaccount" -KeyName key2
# Revoke all SAS tokens (by rotating keys)
# Enable immutability for evidence preservation
GCP Containment Procedures This section covers gcp containment procedures for performing cloud incident containment procedures.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
1. IAM Containment
gcloud projects get-iam-policy PROJECT_ID --format=json > policy.json
gcloud projects set-iam-policy PROJECT_ID policy.json
gcloud iam service-accounts disable SA_EMAIL
gcloud iam service-accounts keys list --iam-account SA_EMAIL
gcloud iam service-accounts keys delete KEY_ID --iam-account SA_EMAIL
2. Compute Instance Isolation
gcloud compute disks snapshot compromised-disk \
--snapshot-names forensic-snap-$(date +%Y%m%d) \
--zone us-central1-a
gcloud compute firewall-rules create quarantine-deny-all \
--network default --action DENY --rules all \
--target-tags quarantine --priority 0
gcloud compute instances add-tags compromised-instance \
--tags quarantine --zone us-central1-a
gcloud compute instances delete-access-config compromised-instance \
--access-config-name "External NAT" --zone us-central1-a
Evidence Preservation Best Practices
Always snapshot before containment - Create disk/volume snapshots before network isolationPreserve CloudTrail/Activity Logs - Copy logs to write-protected storageDocument all actions - Timestamp every containment step takenUse break-glass procedures - Pre-establish emergency access for IR teamMaintain forensic chain of custody - Hash all evidence artifacts
MITRE ATT&CK Cloud Techniques Technique Containment Action T1078 - Valid Accounts Disable accounts, revoke tokens T1530 - Data from Cloud Storage Lock down bucket/storage policies T1537 - Transfer to Cloud Account Block cross-account access T1578 - Modify Cloud Compute Isolate instances, snapshot disks T1552 - Unsecured Credentials Rotate all access keys and secrets
When NOT to Use
You don't have explicit written authorization to test
Task is about defense/detection, not offense (use detection skills)
You need to implement security controls (use implementing-* skills)
Task requires compliance auditing (use auditing-* skills)
You're investigating an incident (use incident response skills)
Target is out of scope for your engagement
Task is about vulnerability scanning only (use scanning tools)
Red Flags
Performing actions without explicit written authorization from the asset owner
Testing against production systems without a defined scope and rules of engagement
Modifying cloud IAM policies or security groups without approval
Exposing cloud credentials or secrets in logs or reports
Running scans that generate excessive API calls and trigger billing alerts
Verification
All steps executed successfully against a test environment before production use
Output documented with screenshots or logs demonstrating expected behavior
Cloud resource changes reverted or documented as intentional
IAM policies reviewed for least-privilege compliance after testing
No residual test resources left running (cost and security check)
References
Process
Analyze the task requirements
Apply domain expertise
Verify output quality
Anti-Rationalization Table Rationalization Reality "We are too small to be targeted" Automated attacks target everyone. Size does not matter. "Security slows us down" A breach slows you down 100x more. Build security in from the start. "We will fix it after launch" Vulnerabilities in production are exploited within hours. Fix before deploy.
