Can you trigger audit mitigation actions automatically?

Question

I've set up mitigation actions (publish to SNS) for my Device Defender audits and know how to manually run them.  But I want to know if there's a way to automatically trigger a mitigation action when an audit finds a violation.  As an example, if an audit finds a certificate that's about to expire, I'd love it if we could _automatically_ update the certificate and notify someone that the violation was found.  I don't want someone to have to go into the console to start that task manually.  Looking at the documentation, I don't see that this is an option, though.  Is that correct?  Or am I overlooking something?

AWS-User-3427449 · Answer

Device Defender provides mitigation actions that customers can configure and execute at scale. However, Device Defender does not take these mitigation actions automatically on our customer’s behalf, because that affects their production fleets. If customers so choose, they have the option to automate these mitigation actions by configuring a SNS notification for Audit completion and running a lambda to take that action.  
   
To enable this, they need to -  
   
1. Use the UpdateAccountAuditConfiguration \[1]. API to enable SNS notifications on Audit completion.  
2. Configure AWS lambda for that SNS notification. This lambda will be triggered when a SNS notification is received and can be used to analyze Audit findings if needed.  
3. Use the StartAuditMitigationActionsTask \[2] API to executes the mitigation actions against AuditFindings in the lambda code.  
   
\[1] - https://docs.aws.amazon.com/cli/latest/reference/iot/update-account-audit-configuration.html  
\[2] - https://docs.aws.amazon.com/cli/latest/reference/iot/start-audit-mitigation-actions-task.html

Can you trigger audit mitigation actions automatically?

Add your answer

Relevant content