AWS GENAI for Security Remediation - IAM
A Bedrock-hosted Claude 3.7 pipeline that classifies IAM findings from Security Hub and GuardDuty, and drafts the least-privilege CloudFormation fix for a human to review before it applies.
IAM findings from Security Hub read like a queue that never shortens. Most are boilerplate misconfigurations that a person could fix in a minute, if they weren't already fixing a hundred others.
I wired Security Hub and GuardDuty findings into a Bedrock-hosted Claude 3.7 pipeline that classifies each IAM finding, drafts the least-privilege remediation as CloudFormation, and routes it for review before it's applied. The model proposes; a human still approves anything that changes an identity boundary.
The model's job is to draft the fix. Deciding it's the right fix is still mine.
The routine IAM findings clear themselves with human review; the interesting ones get the attention they deserved all along.
- Claude 3.7 via Bedrock drafts CloudFormation fixes for IAM findings
- Human approval remains in the loop for any identity-boundary change
- Security Hub and GuardDuty feed the pipeline as findings publish