Lab: Building Automated Compliance Remediation for Large-Scale Environments

In this lab, you will design and implement an event-driven automation solution to maintain security compliance at scale. You will use AWS Config to monitor resource states and AWS Lambda to automatically remediate non-compliant security groups that have overly permissive SSH access (Port 22).

[!WARNING] Remember to run the teardown commands at the end of the lab to avoid ongoing charges in your AWS account.

Prerequisites

An active AWS account with Administrator access.
AWS CLI installed and configured with your credentials.
Basic familiarity with Python (used for the Lambda function).
Environment variables: Replace <YOUR_REGION> and <YOUR_ACCOUNT_ID> with your specific values.

Learning Objectives

Configure AWS Config to track resource compliance.
Develop a Lambda function using the AWS SDK (Boto3) to remediate configuration drift.
Create an EventBridge rule to trigger automation based on compliance change events.
Implement logic to handle automated security enforcement in a multi-account/multi-region style context.

Architecture Overview

The following diagram illustrates the flow of the automated remediation system:

Loading Diagram...

Figure 1 — Mermaid diagram

Step-by-Step Instructions

Step 1: Create the Remediation IAM Role

The Lambda function requires permissions to describe security groups and revoke ingress rules.

bash

# Create the Trust Policy file
echo '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Service": "lambda.amazonaws.com" },
      "Action": "sts:AssumeRole"
    }
  ]
}' > trust-policy.json

# Create the role
aws iam create-role --role-name brainybee-remediation-role --assume-role-policy-document file://trust-policy.json

# Attach Managed Policy for Logging and EC2
aws iam attach-role-policy --role-name brainybee-remediation-role --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
aws iam attach-role-policy --role-name brainybee-remediation-role --policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess

▶Console alternative

Navigate to IAM > Roles > Create role. Select Lambda as the service, search for and attach AWSLambdaBasicExecutionRole and AmazonEC2FullAccess. Name it brainybee-remediation-role.

Step 2: Create the Remediation Lambda Function

This function will parse the Config event and remove Port 22 access if found.

python

# lambda_function.py
import boto3
import json

ec2 = boto3.client('ec2')

def lambda_handler(event, context):
    # Extract resource ID (Security Group ID)
    detail = event['detail']
    sg_id = detail['resourceId']
    
    print(f"Remediating Security Group: {sg_id}")
    
    try:
        ec2.revoke_security_group_ingress(
            GroupId=sg_id,
            IpProtocol='tcp',
            FromPort=22,
            ToPort=22,
            CidrIp='0.0.0.0/0'
        )
        return { "status": "remediated", "sg": sg_id }
    except Exception as e:
        print(f"Error: {str(e)}")
        return { "status": "failed", "error": str(e) }

bash

# Package and deploy via CLI
zip function.zip lambda_function.py
aws lambda create-function --function-name RemediationHandler \
    --zip-file fileb://function.zip --handler lambda_function.lambda_handler --runtime python3.9 \
    --role arn:aws:iam::<YOUR_ACCOUNT_ID>:role/brainybee-remediation-role

Step 3: Enable AWS Config and Rule

We need to tell AWS Config to monitor for open SSH.

bash

# Put a managed rule for restricted SSH
aws configservice put-config-rule --config-rule '{
    "ConfigRuleName": "restricted-ssh",
    "Source": {
        "Owner": "AWS",
        "SourceIdentifier": "INCOMING_SSH_DISABLED"
    }
}'

Step 4: Create EventBridge Automation Rule

Connect the Config compliance change to the Lambda function.

bash

# Create Rule
aws events put-rule --name RemediateConfigRule --event-pattern '{
  "source": ["aws.config"],
  "detail-type": ["Config Rules Compliance Change"],
  "detail": {
    "messageType": ["ComplianceChangeNotification"],
    "configRuleName": ["restricted-ssh"],
    "newEvaluationResult": {
      "complianceType": ["NON_COMPLIANT"]
    }
  }
}'

# Add Target
aws events put-targets --rule RemediateConfigRule --targets "Id"="1","Arn"="arn:aws:lambda:<YOUR_REGION>:<YOUR_ACCOUNT_ID>:function:RemediationHandler"

# Grant Lambda Permission
aws lambda add-permission --function-name RemediationHandler --statement-id EventBridgeInvoke \
    --action 'lambda:InvokeFunction' --principal events.amazonaws.com --source-arn arn:aws:events:<YOUR_REGION>:<YOUR_ACCOUNT_ID>:rule/RemediateConfigRule

Checkpoints

Verify Config Rule: Run aws configservice describe-config-rule-evaluation-status --config-rule-names restricted-ssh. It should show the rule is active.
Simulate Non-Compliance: Create a security group and add an ingress rule for 0.0.0.0/0 on Port 22.
Verify Remediation: Wait 2-3 minutes. Check the Security Group again. The SSH rule should have been automatically removed.

Troubleshooting

Problem	Possible Cause	Fix
Lambda not firing	EventBridge pattern mismatch	Verify the `configRuleName` in the JSON pattern matches the actual rule name exactly.
Permission Denied	Lambda Role missing EC2 permissions	Ensure `AmazonEC2FullAccess` or a specific policy for `RevokeSecurityGroupIngress` is attached.
Config not recording	Recorder not started	Ensure AWS Config recorder is in the `STARTED` state via `aws configservice start-configuration-recorder`.

Clean-Up / Teardown

Execute these commands to remove all resources created in this lab:

bash

# 1. Delete EventBridge Rule and Target
aws events remove-targets --rule RemediateConfigRule --ids "1"
aws events delete-rule --name RemediateConfigRule

# 2. Delete Lambda Function
aws lambda delete-function --function-name RemediationHandler

# 3. Delete Config Rule
aws configservice delete-config-rule --config-rule-name restricted-ssh

# 4. Delete IAM Role
aws iam detach-role-policy --role-name brainybee-remediation-role --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
aws iam detach-role-policy --role-name brainybee-remediation-role --policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess
aws iam delete-role --role-name brainybee-remediation-role

Stretch Challenge

Modify the Lambda function to handle "Multi-Account" notifications. Use AWS Step Functions to add a manual approval step via SNS email before the remediation occurs, creating a "Human-in-the-loop" automation pattern.

Cost Estimate

AWS Config: $0.003 per configuration item recorded. One rule evaluation is $0.001.
AWS Lambda: Free Tier covers 1M requests/month. Negligible cost for this lab.
EventBridge: Free tier includes all AWS-service-generated events.
Estimated Total: < $0.10 for the duration of this lab.

Concept Review

Automation in large-scale environments is critical for Security Governance. By using Infrastructure as Code (via CLI/SDK) and Event-Driven Architectures, we move from manual ticketing to real-time enforcement.

$\text{Compliance Rate} = \frac{\text{Resources Checked} - \text{Non-Compliant Findings}}{\text{Resources Checked}} \times 100$

Service	Role in Lab	Scale Benefit
AWS Config	Detection	Continuous monitoring across thousands of resources.
EventBridge	Routing	Decouples detection from remediation logic.
Lambda	Remediation	Serverless, scaling automatically to handle bursts of events.

Lab: Building Automated Compliance Remediation for Large-Scale Environments

[!WARNING] Remember to run the teardown commands at the end of the lab to avoid ongoing charges in your AWS account.

Prerequisites

An active AWS account with Administrator access.
AWS CLI installed and configured with your credentials.
Basic familiarity with Python (used for the Lambda function).
Environment variables: Replace <YOUR_REGION> and <YOUR_ACCOUNT_ID> with your specific values.

Learning Objectives

Configure AWS Config to track resource compliance.
Develop a Lambda function using the AWS SDK (Boto3) to remediate configuration drift.
Create an EventBridge rule to trigger automation based on compliance change events.
Implement logic to handle automated security enforcement in a multi-account/multi-region style context.

Architecture Overview

The following diagram illustrates the flow of the automated remediation system:

Loading Diagram...

Figure 1 — Mermaid diagram

Step-by-Step Instructions

Step 1: Create the Remediation IAM Role

The Lambda function requires permissions to describe security groups and revoke ingress rules.

bash

# Create the Trust Policy file
echo '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Service": "lambda.amazonaws.com" },
      "Action": "sts:AssumeRole"
    }
  ]
}' > trust-policy.json

# Create the role
aws iam create-role --role-name brainybee-remediation-role --assume-role-policy-document file://trust-policy.json

# Attach Managed Policy for Logging and EC2
aws iam attach-role-policy --role-name brainybee-remediation-role --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
aws iam attach-role-policy --role-name brainybee-remediation-role --policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess

▶Console alternative

Step 2: Create the Remediation Lambda Function

This function will parse the Config event and remove Port 22 access if found.

python

# lambda_function.py
import boto3
import json

ec2 = boto3.client('ec2')

def lambda_handler(event, context):
    # Extract resource ID (Security Group ID)
    detail = event['detail']
    sg_id = detail['resourceId']
    
    print(f"Remediating Security Group: {sg_id}")
    
    try:
        ec2.revoke_security_group_ingress(
            GroupId=sg_id,
            IpProtocol='tcp',
            FromPort=22,
            ToPort=22,
            CidrIp='0.0.0.0/0'
        )
        return { "status": "remediated", "sg": sg_id }
    except Exception as e:
        print(f"Error: {str(e)}")
        return { "status": "failed", "error": str(e) }

bash

# Package and deploy via CLI
zip function.zip lambda_function.py
aws lambda create-function --function-name RemediationHandler \
    --zip-file fileb://function.zip --handler lambda_function.lambda_handler --runtime python3.9 \
    --role arn:aws:iam::<YOUR_ACCOUNT_ID>:role/brainybee-remediation-role

Step 3: Enable AWS Config and Rule

We need to tell AWS Config to monitor for open SSH.

bash

# Put a managed rule for restricted SSH
aws configservice put-config-rule --config-rule '{
    "ConfigRuleName": "restricted-ssh",
    "Source": {
        "Owner": "AWS",
        "SourceIdentifier": "INCOMING_SSH_DISABLED"
    }
}'

Step 4: Create EventBridge Automation Rule

Connect the Config compliance change to the Lambda function.

bash

# Create Rule
aws events put-rule --name RemediateConfigRule --event-pattern '{
  "source": ["aws.config"],
  "detail-type": ["Config Rules Compliance Change"],
  "detail": {
    "messageType": ["ComplianceChangeNotification"],
    "configRuleName": ["restricted-ssh"],
    "newEvaluationResult": {
      "complianceType": ["NON_COMPLIANT"]
    }
  }
}'

# Add Target
aws events put-targets --rule RemediateConfigRule --targets "Id"="1","Arn"="arn:aws:lambda:<YOUR_REGION>:<YOUR_ACCOUNT_ID>:function:RemediationHandler"

# Grant Lambda Permission
aws lambda add-permission --function-name RemediationHandler --statement-id EventBridgeInvoke \
    --action 'lambda:InvokeFunction' --principal events.amazonaws.com --source-arn arn:aws:events:<YOUR_REGION>:<YOUR_ACCOUNT_ID>:rule/RemediateConfigRule

Checkpoints

Verify Config Rule: Run aws configservice describe-config-rule-evaluation-status --config-rule-names restricted-ssh. It should show the rule is active.
Simulate Non-Compliance: Create a security group and add an ingress rule for 0.0.0.0/0 on Port 22.
Verify Remediation: Wait 2-3 minutes. Check the Security Group again. The SSH rule should have been automatically removed.

Troubleshooting

Problem	Possible Cause	Fix
Lambda not firing	EventBridge pattern mismatch	Verify the `configRuleName` in the JSON pattern matches the actual rule name exactly.
Permission Denied	Lambda Role missing EC2 permissions	Ensure `AmazonEC2FullAccess` or a specific policy for `RevokeSecurityGroupIngress` is attached.
Config not recording	Recorder not started	Ensure AWS Config recorder is in the `STARTED` state via `aws configservice start-configuration-recorder`.

Clean-Up / Teardown

Execute these commands to remove all resources created in this lab:

bash

# 1. Delete EventBridge Rule and Target
aws events remove-targets --rule RemediateConfigRule --ids "1"
aws events delete-rule --name RemediateConfigRule

# 2. Delete Lambda Function
aws lambda delete-function --function-name RemediationHandler

# 3. Delete Config Rule
aws configservice delete-config-rule --config-rule-name restricted-ssh

# 4. Delete IAM Role
aws iam detach-role-policy --role-name brainybee-remediation-role --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
aws iam detach-role-policy --role-name brainybee-remediation-role --policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess
aws iam delete-role --role-name brainybee-remediation-role

Stretch Challenge

Cost Estimate

AWS Config: $0.003 per configuration item recorded. One rule evaluation is $0.001.
AWS Lambda: Free Tier covers 1M requests/month. Negligible cost for this lab.
EventBridge: Free tier includes all AWS-service-generated events.
Estimated Total: < $0.10 for the duration of this lab.

Concept Review

$\text{Compliance Rate} = \frac{\text{Resources Checked} - \text{Non-Compliant Findings}}{\text{Resources Checked}} \times 100$

Service	Role in Lab	Scale Benefit
AWS Config	Detection	Continuous monitoring across thousands of resources.
EventBridge	Routing	Decouples detection from remediation logic.
Lambda	Remediation	Serverless, scaling automatically to handle bursts of events.