Auto Remediation Action with AWS Config and AWS System Manager to Make Your Life Easier
Published: 2024-01-09 03:55:55

      It can be challenging to monitor the EC2 instances that developers or admin teams launch. Sometimes, these launches may exceed the budget allocated to an organization. To address this, I will demonstrate how to set up automatic remediation actions using AWS Config, AWS Systems Manager and AWS Lambda. This setup ensures that only EC2 instances of type 't3.medium' are considered compliant. Any instance launched with a type other than 't3.medium' will be identified as non-compliant by AWS Config and will be immediately stopped by an automatic remediation action. This approach helps in maintaining budget control and ensuring compliance with organizational standards for resource usage.
In this case we will make custom rules with help from AWS Lambda in AWS config. Before start, this is my network topology diagram for real life testing.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f4f0wk58jj1ths8s2uuo.png)

Add new rule:
I will choose custom lambda rule to make custom AWS config rule.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k52zs1c56v5jt649qq4x.png)

For lambda code,this is lambda code I configured:



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qeozcf4jqvrsh9mnayba.png)
AWS Config detects a change in an EC2 instance's configuration, it will triggers this Lambda function. This function evaluates the instance and reports back to AWS Config whether the instance is compliant or not.
Configure the rule, and fill lambda ARN with ARN lambda we just created. 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t0q8tdw1iwj6tiubxjgg.png)

I configured trigger type with “when configuration changes” and resource= “AWS ëc2 instance”



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/32fye09n2k59fzw34f04.png)

Check review for one last time:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hakmzs6mmfcmp54a7cb9.png)

After creating rules, we will make remediation action IF our rule is not compliant.

We go to AWS System Manager to use Automation Document to help us with remediation automatic action.



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c9ogubpq8zuloo1wmefy.png)



We will use automation document named : AWS-StopEC2Instance. This is the content of automation document in SSM.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jk7zfwdta9kerucoa57a.png)


After this, we can continue setting automatic remediation action in AWS config.

AWS Config also offers manual remediation, or manual remediation with a human approval process. We can choose based on our requirements.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0zf6k5d4wlpltbwrir6n.png)

We can setup retries for this script to take action, I setup just 1 time. Resource id parameter I fill with InstanceID. 
For remediation action, choose the document we choose at AWS System Manager.
Our rules and automatic remediation action have now been completed. It's time to test if our script and design are functioning correctly.
I am attempting to launch a noncompliant EC2 instance with the type “t3.micro”. After the EC2 instance starts and passes the status check, it won't be long before our SSM automation initiates action to stop this instance.

The EC2 instance will be stopped automatically.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lmftqq9qyadvhlg2ja43.png)

Summary of aws config detail page: 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u6mpce4rg49vdkj5bz8o.png)

Our remediation action status is “Äction executed successfully “.
Lets try it again to launch another ec2.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2u6l3bj70ur0cluaz6sx.png)

Only ec2 type t3.medium running well. Not comply ec2 already stopping by SSM automation action .
(Unused ec2 already terminated by me after stop)
And one of important to run these lab is IAM role and policy.
This is IAM role to make SSM run automation process to stopping ec2 that not compliant. We can change  policies ”EC2fullaccess” to have more least privilege level in our production /development level.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8tcqp9qd7xuqmi517ph0.png)

With trust relationship to SSM.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fki645bee2t3203e5yzd.png)


Source to read:

1.	https://docs.aws.amazon.com/config/latest/developerguide/remediation.html