View a markdown version of this page

Forensic image and SSM Document builder service - Automated Forensics Orchestrator for Amazon EC2 and EKS

Forensic image and SSM Document builder service

The forensic image builder pipeline creates the forensic AMI with necessary forensic tools needed to perform forensic investigation. The diagram below represents the overall implementation.

Note

Customers can use your own forensic AMI or leverage the Amazon EC2 Image Builder samples to build a forensic Image.

Forensic image and SSM document builder service

forensic image ssm document builder

Amazon EC2 Image Builder initiates the EC2 Image Builder pipeline to build the EC2 Image based on the forensic tools configured in the document. . After successful creation of the AMI, it drops the message as an Amazon SNS topic. . The AWS Lambda function listens to the Amazon SNS topic and gets initiated for each message. . The AWS Lambda function stores the AMI ID in Parameter Store and is used to launch the forensic instance.