Security World 6 · Incident Command · Stage 6

Recover the Bucket

Objects deleted and overwritten overnight: scope it, close the bucket, remove what was added, restore, and set the protection that makes the next one a non-event.

S3 incident scoping
Bucket policy containment
RCP containment
Recovery from versions
Backups and vault locks

Domain: Security
World: Security World 6: Incident Command (Specialty)
Game type: Runbook: Order the response steps, run the runbook and read the timeline.
Time: About 40 minutes on a first attempt (estimated)
Exam guides: SAA-C03Task 1.3: Determine appropriate data security controls
SOA-C03Skill 2.3.1: Automate snapshots and backups for AWS resources (for example, EC2 instances, RDS DB instances, EBS volumes, S3 buckets, DynamoDB tables) by using AWS services (for example, AWS Backup)
SCS-C03Skill 2.2.4: Respond to affected resources by containing and eradicating threats, and recover resources (for example, by implementing network containment controls, restoring backups); Skill 2.2.1: Capture and store relevant system and application logs as forensic artifacts; Skill 5.2.4: Design and configure secure data replication and backup solutions (for example, Amazon Data Lifecycle Manager, AWS Backup, ransomware protection, AWS DataSync)