GuardDuty raises a finding that temporary credentials issued to an EC2 instance are being used from an address outside AWS. The security team wants the source address blocked and the stolen sessions invalidated without human delay. What is the recommended approach?
Show answer and explanation
Answer: B
GuardDuty publishes every finding to the default EventBridge bus, so a rule can match the finding type and severity and invoke a Lambda function. That function inserts a deny entry for the offending address in the subnet NACL and attaches a policy that denies requests made with tokens issued before the current time, which neutralizes credentials already in the attacker's hands.
The whole path is event driven, repeatable and logged, so containment happens in seconds rather than waiting for an analyst.
Why the other options are wrong
- A. Manual deletion is slow, destroys an identity the investigation needs, and leaves already-issued temporary credentials usable until they expire.
- C. Disabling long-term keys does nothing for STS session tokens, which is what the finding reports, and still depends on a person noticing the alert.
- D. AWS does not block arbitrary addresses inside your VPC on request. Address filtering is your responsibility through security groups, NACLs, or a firewall.
Exam tip. Findings reach automation through EventBridge, not through direct Lambda invocation.