View a markdown version of this page

Your role during the investigation - AWS Security Incident Response User Guide

Your role during the investigation

While AWS Security Incident Response engineers lead the investigation, your participation is essential. You're responsible for the following actions:

  • Providing timely responses to information requests

  • Implementing recommended containment and remediation actions in your AWS environment

  • Authorizing Security Incident Response engineers to take actions on your behalf (if you enabled proactive response)

  • Coordinating with your internal teams (security, legal, compliance) as needed

  • Making business decisions about incident response priorities and trade-offs

AWS Security Incident Response engineers provide expertise and recommendations, but you maintain control over your AWS resources and make final decisions about response actions.