Automated AWS Security Hub finding remediation
Build a workflow triggered by AWS Security Hub findings. Enrich with related GuardDuty data, then branch by finding type: revoke compromised IAM sessions, block public access on offending S3 buckets, and tighten over-permissive security groups. Create a Jira issue capturing the finding and remediation. Gate destructive actions behind severity thresholds or approval, deduplicate findings, and retry API errors. Output the actions taken and the Jira reference per finding.
What this prompt builds
Process Security Hub findings and auto-remediate: revoke IAM sessions, lock S3, fix security groups.
The problem
AWS Security Hub aggregates findings but doesn't act on them, so critical issues like exposed S3 buckets and compromised credentials linger until a human gets to them. Response time is the difference between a finding and a breach.
Solution and impact
This workflow processes Security Hub findings, enriches with GuardDuty, and takes targeted action, revoking compromised IAM sessions, blocking public S3 buckets, adjusting security groups, and tracking it all in Jira. High-severity cloud risks are contained in minutes, automatically and auditable.