This final article covers the advanced scenarios in AWS incident response — acquiring memory from cloud instances, forensicating containers, understanding the metadata service attack, and making the decision between in-cloud and on-premises analysis. By the end of this series, you have a complete picture of how to investigate any AWS incident from first alert to evidence report. In-Cloud vs. On-Premises Analysis ▸ Recommendation: Always analyse in-cloud first. Download to on-

One of the most powerful capabilities AWS gives you for incident response is the ability to automate it. Unlike on-premise environments where IR automation requires complex SOAR platforms, AWS has native services that can trigger forensic actions the moment a threat is detected — no human in the loop required for the initial containment and evidence preservation steps. Lambda — Serverless Functions for DFIR Automation AWS Lambda lets you run code without managing any servers.

So far we've covered the raw evidence sources — CloudTrail, VPC flow logs, S3 logs. Now we look at the tools AWS provides that sit on top of all that telemetry and do the detection work for you. These three services form AWS's native automated detection and investigation stack. Choosing the Right Tool for the Job ▸ CloudTrail Insights (statistical anomaly) → GuardDuty (ML threat detection) → AWS Detective (investigation platform) None of these replace manual CloudTrail analys

S3 (Simple Storage Service) is the backbone of AWS storage. It's where CloudTrail logs land, where flow logs are stored, where application data lives, and where attackers look for sensitive information. Understanding S3 from an IR perspective means understanding both how attacks happen against S3, and how S3 itself becomes your central evidence repository. S3 Access Controls — The Basics S3 access is controlled at multiple layers. Every S3 bucket is private by default — no pu

Network forensics in AWS is not like network forensics on-premise. There's no physical switch to mirror traffic from. But AWS gives you powerful tools — VPC flow logs, load balancer logs, DNS resolver logs — that tell you a huge amount about what was happening on the network. VPC — Virtual Private Cloud A VPC is a logical network boundary inside AWS — like a network switch. Everything inside can communicate at Layer 3, nothing gets in or out without explicit routing and firew