Step 1: Enable AWS Security Incident Response
The onboarding process takes approximately 10 to 15 minutes per AWS organization. For a walkthrough, see the Getting Started video in the service documentation.
To enable AWS Security Incident Response
-
Sign in to the AWS Management Console using your management account.
-
Open the AWS Security Incident Response console and choose Sign up.
-
Designate a security tooling account as the delegated administrator.
-
For guidance, see Security Reference Architecture in AWS Prescriptive Guidance and Delegated administrator.
-
-
Sign in to the delegated administrator account.
-
Enter your membership details and associate the relevant accounts.
-
For Account scope, choose to enable AWS Security Incident Response for your entire AWS organization or for specific OUs. You can select coverage at the OU level, but not at the individual account level.
-
For Proactive Response, confirm that the setting is enabled. Proactive response is on by default and creates a service-linked role that allows AWS SIRT to ingest GuardDuty findings and open proactive investigation cases when threats are detected. For more information, see Proactive response.
Important
The service-linked role is not automatically deployed to the management account. You must configure it manually for complete coverage. For instructions, see Setup proactive response and alert triaging workflows.
-
(Optional) Choose to pre-authorize AWS SIRT to perform containment actions on your behalf during active incidents. Supported containment actions include runbooks for compromised S3 buckets, EC2 instances, and IAM principals. If you skip this step, SIRT will provide manual guidance during investigations. For more information, see Containment actions.
-
Review the service permissions and onboarding configuration, then choose Sign up.
