Isolating EC2 Instances for Forensic Inspection

If you are going to perform forensic inspection or forensic analysis, you need to have created the required infrastructure beforehand. The optimal way to do this is with AWS Organizations and the creation of a specialized forensic account. Some companies skip creating the forensic account and instead use their security account inside the AWS organization structure. This practice can be dangerous. For example, if you have moved an instance or function over to the quarantine in the forensic account because it had malicious software that could spread to other parts of the account and perform destructive actions such as deleting files, you don’t want the same happening in your specialized security account. Figure 11.21 presents a graphical representation of the isolated placement of forensic accounts in an AWS Organizations structure.

Figure 11.21: Forensic account placement in AWS organizational structure...