performing-cloud-incident-containment-procedures

name	performing-cloud-incident-containment-procedures
description	Execute cloud-native incident containment across AWS, Azure, and GCP by isolating compromised resources, revoking credentials, preserving forensic evidence, and applying security group restrictions to prevent lateral movement. Use when working with performing cloud incident containment procedures.
domain	cybersecurity
subdomain	incident-response
tags	["cloud-security","incident-containment","aws","azure","gcp","cloud-forensics","credential-revocation","network-isolation"]
mitre_attack	["T1078","T1537","T1580","T1525","T1098"]
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"]
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Performing Cloud Incident Containment Procedures

Overview

Cloud incident containment requires cloud-native approaches that differ significantly from traditional on-premises response. Containment procedures must leverage platform-specific controls including security groups, IAM policies, network ACLs, and service-level isolation to restrict compromised resources while preserving forensic evidence. According to the 2025 Unit 42 Global Incident Response Report, responding to cloud incidents requires understanding shared responsibility models, ephemeral infrastructure, and API-driven operations. Effective containment involves credential revocation, resource isolation, evidence snapshot creation, and automated response playbook execution.

When to Use

Trigger phrases:

• "performing cloud incident containment procedures"

• "Execute cloud-native incident containment across AWS, Azure, and GCP by isolatin"

• When conducting security assessments that involve performing cloud incident containment procedures

• When following incident response procedures for related security events

• When performing scheduled security testing or auditing activities

• When validating security controls through hands-on testing

Prerequisites

• Familiarity with incident response concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

AWS Containment Procedures

This section covers aws containment procedures for performing cloud incident containment procedures.

• Ensure all prerequisites are met before proceeding
• Follow the documented workflow steps in sequence
• Record results and any anomalies encountered during this phase

1. Credential Compromise Containment

# Disable compromised IAM user access keys
aws iam update-access-key --user-name compromised-user \
  --access-key-id AKIA... --status Inactive

# List and disable all access keys for user
aws iam list-access-keys --user-name compromised-user
aws iam delete-access-key --user-name compromised-user --access-key-id AKIA...

# Attach deny-all policy to compromised user
aws iam put-user-policy --user-name compromised-user \
  --policy-name DenyAll \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*"
    }]
  }'


aws iam put-role-policy --role-name compromised-role \
  --policy-name RevokeOldSessions \
  --policy-document $( -u +%Y-%m-%dT%H:%M:%SZ)


aws iam update-assume-role-policy --role-name compromised-role \
  --policy-document