3.1.2. Preparing Services for Incidents

First Principle: Incident response capabilities must be pre-provisioned before an incident occurs — you can't deploy forensic tools, grant emergency access, or configure isolation mechanisms while an attack is actively underway.

Pre-Provisioning Checklist:

Access: Create a dedicated incident response IAM role with cross-account access in advance. Don't wait until an incident to figure out permissions.

• Create an "IR-Role" in every account with pre-approved forensic permissions
• Use IAM session policies to limit scope during incidents
• Implement break-glass procedures for emergency access when normal channels fail

Tools: Deploy security tools to all accounts BEFORE they're needed.

• Enable GuardDuty, Security Hub, and Config in all Regions across all accounts
• Pre-configure EventBridge rules for automated response patterns
• Deploy Lambda functions for common automated responses (isolate instance, disable key)

Blast Radius Minimization:

• Network segmentation limits lateral movement (VPC isolation, security group tiers)
• Least-privilege IAM prevents compromised roles from accessing unrelated resources
• Multi-account architecture contains blast radius to individual accounts
• Shield Advanced pre-configured for DDoS response with dedicated AWS support

Shield Advanced Incident Preparation:

• Provides 24/7 access to the AWS Shield Response Team (SRT)
• Requires pre-authorization for SRT to make changes during active DDoS attacks
• Offers cost protection for scaling events caused by DDoS attacks
• Must be configured BEFORE the attack — the SRT needs pre-provisioned access

⚠️ Exam Trap: Shield Advanced's DDoS Response Team (SRT) cannot help during an attack unless you've pre-authorized them. If a question describes an active DDoS and asks "what should have been configured," the answer involves Shield Advanced with SRT pre-authorization.

Scenario: Your company experiences a DDoS attack on a Saturday night. Shield Advanced is enabled but the SRT hasn't been pre-authorized to modify WAF rules. The on-call engineer can't reach the security team for approval. With pre-authorization, the SRT could have mitigated the attack within minutes.

Reflection Question: Why does pre-provisioning IR capabilities during "peacetime" fundamentally change the speed and effectiveness of incident response?