DRX integration for Amazon Web Services

Supports investigations and response across AWS identities, workloads, networks and storage. Nova DRX applies your response policies and approval requirements before sending an action to Amazon Web Services.

The provider connection supplies a supported destination for DRX. It does not decide that an action is appropriate, expand the customer scope, or bypass the approval policy selected for the environment.

Nova DRX supports 7 actions for Amazon Web Services.

Block an address with an AWS network control

Adds an approved deny rule for the selected network address.

Remove broad AWS administrative policies

Removes selected high-privilege policies from an approved identity target.

Disable an AWS identity

Restricts the selected AWS user account as an approved containment action.

Add GuardDuty context

Retrieves relevant GuardDuty finding context for the selected entity.

Quarantine an S3 bucket

Applies approved public-access protection and marks the selected bucket for review.

Stop an EC2 instance

Stops the selected running workload after the required decision and approval.

Capture an EC2 snapshot

Creates approved image or volume snapshots to preserve investigation evidence.

• The exact target and customer scope are confirmed before action.
• The action must be present in the supported DRX catalog and available in the connected provider environment.
• Configured approval and separation-of-duties requirements remain in force.
• A simulation or proposal is not treated as an executed provider outcome.
• The reported result and review history remain available after the action.

• Which listed outcomes are required and which should remain disabled?
• Which provider plan, region, target types, and customer-owned access are available?
• Which outcomes require one approver, two-person review, or a manual-only decision?
• How will success, partial completion, failure, reversal, and follow-up be reviewed?