aws-lambda-security-automations

Python Lambda functions that auto-remediate AWS security misconfigurations detected by Security Hub or EventBridge. Supports dry-run mode for safe testing before enabling enforcement.

Automations

Lambda	Trigger	What it fixes
s3_remediation	Security Hub finding / EventBridge	Re-enables S3 block public access (all 4 settings)
sg_remediation	Security Hub finding / EventBridge	Revokes 0.0.0.0/0 ingress on SSH, RDP, and DB ports
iam_key_rotation	EventBridge daily	Deactivates IAM keys unused/older than 90 days; warns at 80

Blocked ports (sg_remediation)

SSH (22), RDP (3389), MySQL (3306), PostgreSQL (5432), MSSQL (1433), Redis (6379), MongoDB (27017), Elasticsearch (9200)

Usage

Dry run (safe — no changes made)

DRY_RUN=true python lambdas/s3_remediation/handler.py

Test locally

from lambdas.s3_remediation.handler import lambda_handler
result = lambda_handler({"bucket_name": "my-bucket"}, None)

Deploy via Terraform

cd terraform
terraform init && terraform apply

Environment variables

Variable	Default	Description
DRY_RUN	false	Set to true to simulate without changes
SNS_TOPIC_ARN	""	SNS topic for remediation notifications
WARNING_DAYS	80	Days before key rotation warning
DEACTIVATE_DAYS	90	Days before key deactivation

Tech stack

Python 3.12, boto3, Terraform >= 1.5, AWS Lambda, EventBridge, Security Hub