Eradication For AWS Assets



Created: 09.09.2020

This is about … .

EC2 Instance

Secure-wipe files (can be automated). After that delete any KMS data keys, if used.

  • Copy DoD approved sanitisation tools to affected EC2 hosts scp -i "<host priv key>" bcwipe.[exe] <user>@<targetec2>:[root_drive/bcwipe.[exe]]
  • Log into the machine via ssh or RDP ssh -i "<host priv key>" <user>@<targetec2>
  • Once on the target host, delete files and wipe slack and free space bcwipe <file(s)>

References

[1] Incident Response in the Cloud (119678)