A common approach to an infrastructure security incident 

Before we come to the end of this chapter, I just want to quickly highlight a common approach to how you might respond to an infrastructure-related security incident involving an EC2 instance:

1. Capture: You should try and capture any metadata from the instance before you proceed and make any further changes related to your environment.
2. Protect: To prevent the EC2 instance from being accidentally terminated, enable termination protection while you continue to investigate.
3. Isolate: You should then isolate the instance by modifying the security group or updating the NACL to deny all traffic destined for the IP address of the instance.
4. Detach: Remove the affected instance from any autoscaling groups.
5. Deregister: If the instance is associated with any ELBs, you must remove it from any ELBs.
6. Snapshot: Take a copy of any EBS volumes via a snapshot so that you can investigate further without affecting the original...