Reimage a compromised AWS EC2 instance from a snapshot
Build a workflow triggered with an EC2 instance's identifier or public/private IP. Identify the instance and the target snapshot, stop the instance, detach the existing root volume, create and attach a new volume from the snapshot, and start the instance. Validate the snapshot, require approval before destructive steps, handle each AWS API error, and confirm the instance returns healthy. Output the reimaged instance ID and the snapshot used.
What this prompt builds
Restore an EC2 instance's root volume from a snapshot to reimage a compromised or broken host.
The problem
When an EC2 instance is compromised or corrupted, reimaging it by hand under pressure is slow and error-prone, prolonging downtime or attacker dwell time. Consistent recovery steps are hard to follow during an incident.
Solution and impact
This workflow takes an instance's details and restores its root volume from a snapshot, reimaging it reliably. Recovery becomes a repeatable one-click action that shortens incident response.