Accelerate security investigations with Kiro CLI

The AWS Security Incident Response Guide emphasizes that preparation is the foundation of effective incident response. With the immediate threat contained, we used Kiro CLI to strengthen our preparation phase by establishing automated alerting for future incidents. As shown in Figure 11, we used natural language to request Set up a notification system that sends an email to [email] for any high severity or higher severity findings. Kiro CLI understood the requirement and proposed a multi-step solution involving Amazon SNS and EventBridge: Create an SNS topic for GuardDuty alerts Subscribe an email address to the topic Create an EventBridge rule to trigger on high-severity findings (severity greater than or equal to 7. 0) Configure the SNS topic as the EventBridge target Grant EventBridge permissions to publish to the SNS topic Building automated alerting requires understanding multiple AWS services, their interactions, and correct configuration syntax.

Kiro CLI translates a straightforward natural language request into a complete, production-ready solution. Auto-correction and testing: When setting up complex integrations, commands can fail because of permission issues, incorrect Amazon Resource Name (ARN) references, or malformed JSON policies. Kiro CLI automatically detects these failures and proposes corrected commands. Figure 11: Notification system setup completion showing SNS topic created, EventBridge rule configured, and confirmation that notifications will trigger on HIGH and CRITICAL severity findings You can also prompt Kiro CLI to test the setup: Test this notification system to verify it’s working correctly. Kiro CLI will verify that the SNS subscription is confirmed, check that the EventBridge rule is properly configured, validate IAM permissions, identify any misconfigurations, and publish a test event to verify end-to-end functionality.