사고 예방 및 대응체계가 구축되어 있는가?

# 1. GuardDuty 활성화
resource "aws_guardduty_detector" "main" {
  enable                       = true
  finding_publishing_frequency = "FIFTEEN_MINUTES"

  datasources {
    s3_logs    { enable = true }
    kubernetes { audit_logs { enable = true } }
  }
  tags = { ISMS-P = "2.11.1" }
}

# 2. EventBridge - Critical/High Finding 탐지
resource "aws_cloudwatch_event_rule" "security_finding" {
  name = "security-finding-critical"
  event_pattern = jsonencode({
    source      = ["aws.guardduty"]
    detail-type = ["GuardDuty Finding"]
    detail      = { severity = [{ numeric = [">=", 7] }] }
  })
}

# 3. SNS 다채널 알림
resource "aws_sns_topic" "security_alerts" {
  name = "security-incident-alerts"
}

resource "aws_cloudwatch_event_target" "sns" {
  rule      = aws_cloudwatch_event_rule.security_finding.name
  target_id = "send-to-sns"
  arn       = aws_sns_topic.security_alerts.arn
}

# 4. 격리용 Security Group
resource "aws_security_group" "quarantine" {
  name        = "quarantine-sg"
  description = "No inbound/outbound - incident isolation"
  vpc_id      = var.vpc_id
  # 인바운드/아웃바운드 규칙 없음 = 모든 트래픽 차단
}

# 5. Lambda 자동 대응 함수
resource "aws_lambda_function" "incident_response" {
  function_name = "security-incident-response"
  handler       = "index.handler"
  runtime       = "python3.11"
  role          = aws_iam_role.incident_response.arn

  environment {
    variables = {
      QUARANTINE_SG_ID = aws_security_group.quarantine.id
      SNS_TOPIC_ARN    = aws_sns_topic.security_alerts.arn
    }
  }
}

💡 핵심: 대응 체계는 탐지 → 알림 → 분석 → 대응 → 복구 전체 파이프라인이 자동화되어야 합니다. GuardDuty가 탐지하면 EventBridge가 즉시 처리하고, SNS로 알림을 보내고, Lambda가 자동 격리합니다.

📚 참고 자료