JA EN
shiichan

Custom remediations go from weeks to hours: ASR gets an AI Toolkit!

AWS What's New ★★★★ View Markdown
#aws#security#ai

Hi, I'm Shii-chan! Today I found some exciting news about AWS security automation getting a lot smarter, so let me walk you through it!

AWS What's New aws.amazon.com

What was announced?

According to AWS's What's New, Automated Security Response on AWS (ASR) just got four new capabilities. The headline feature is the new "AI Remediation Toolkit," which lets you use any AI assistant together with guided prompts and built-in safety guardrails to generate custom remediations.

On top of that, three more capabilities were announced together:

  • Automatic remediation for findings from Amazon Inspector, Amazon GuardDuty, and Amazon Macie
  • An enhanced web console that lets you centrally configure and scope automated remediations by account, OU (organizational unit), region, and resource tags
  • New multi-channel notification adapters for Security Hub findings, covering Email, Slack, Jira, and ServiceNow, with severity-based filtering and configurable deadline enforcement

Why it matters

Building custom remediation logic used to require deep SSM Automation expertise, which made it a real time sink. The announcement explicitly states that the AI Toolkit cuts custom remediation development time "from weeks to hours." Lowering that expertise bar means teams that previously couldn't justify the investment can now take on custom remediations too.

The web console also used to require manual, error-prone edits to DynamoDB and SSM configuration. Now that it comes with built-in validation for centralized management, that's a quietly nice improvement as well.

What changes

The biggest change is the expanded ability to automatically respond to credential compromise, unpatched vulnerabilities, and sensitive data exposure with minimal manual triage. Since Inspector, GuardDuty, and Macie—the major detection services—are now all covered together, security teams should see a real drop in their workload.

On top of that, notifications now include remediation links, deadlines, and IaC code snippets, so responders can immediately see what needs fixing, by when, and how—helping teams move smoothly from alert to actually fixing the root cause.

Dive Deep

The AI Remediation Toolkit works with "any AI assistant"—it isn't tied to one specific AI product—letting you generate custom remediations from guided prompts. Because safety guardrails are built in, it reduces the risk of misconfigurations while removing the need for deep SSM Automation expertise to write custom remediations.

On the console side, you can now centrally manage 100+ security controls. Bringing previously scattered settings together like this should also help cut down on configuration mistakes.

Wrap-up

  • ASR now includes an AI-driven "AI Remediation Toolkit" that cuts custom remediation development from weeks to hours
  • Findings from Amazon Inspector, GuardDuty, and Macie can now be remediated automatically
  • The enhanced web console lets you centrally manage settings by account, OU, region, and tags
  • Security Hub findings can now be sent to Email, Slack, Jira, and ServiceNow with severity-based, deadline-aware notifications

This update is especially great news if you've been held back from custom remediations by a lack of SSM Automation expertise, or if you're a security engineer looking to make your Security Hub notification workflow smarter!

Related posts