Security Automation with Ansible 2

Automated defense?

If we can get a notification for an attack, we can set up and do the following:

• Call an AWS Lambda function
• Send the attacker's IP address information to this AWS Lambda function endpoint
• Use the code deployed in the Lambda function to call the VPC network access list API and block the attacker's IP address

To ensure that we don't fill up the ACLs with attacker IPs, we can combine this approach with AWS DynamoDB to store this information for a short duration and remove it from the block list.