# AWS244 Incident Response Workbook

## Declaration

- Incident ID and UTC window:
- User journey/impact:
- Severity and reason:
- Account/Region/resources (redacted):
- Incident commander / operations / communications / owner:
- Last known good:
- Change freeze declared:
- Production changed: No

## Timeline

| UTC | Detection/event/action | Source/query | Fact or inference | Owner |
|---|---|---|---|---|
| | | | | |

## Expected transaction

Draw client -> DNS -> TLS/LB -> network -> target/process -> identity/KMS/secret -> dependency -> response.

| Boundary | Expected input/output | Evidence | State | Owner |
|---|---|---|---|---|
| | | | | |

## Hypotheses

| Hypothesis | Prediction if true | Read-only falsifying test | Result | Keep/reject |
|---|---|---|---|---|
| | | | | |

## Layer triage

| Layer | Evidence | Primary / contributing / healthy / unknown |
|---|---|---|
| User/DNS/TLS | | |
| Load balancer/target | | |
| Route/SG/NACL/firewall/return | | |
| EC2 system/instance/EBS | | |
| SSM access | | |
| Linux process/resources/storage | | |
| IAM/KMS/config/secret | | |
| Dependency/quota | | |
| Telemetry/change history | | |

## Controlled changes

Copy once per change:

- Proven fault:
- Desired owner source:
- Exact bounded change:
- Approval/observer:
- Blast radius:
- Backup/version:
- Stop condition:
- Rollback trigger/action:
- Change/request ID and UTC:
- Immediate result:

## Recovery acceptance

| Test | Expected | Evidence/result |
|---|---|---|
| New positive user transaction | | |
| Unauthorized negative test | | |
| Component/dependency health | | |
| Restart/replacement durability | | |
| SLO observation window | | |
| Telemetry and alarm recovery | | |
| Temporary-control cleanup | | |

## Root-cause review

- Primary cause/mechanism:
- Contributing factors:
- Why prevention failed:
- Why detection/diagnosis/recovery took this long:
- What went well:

| Corrective action | Prevention layer | Owner | Due | Verification |
|---|---|---|---|---|
| | | | | |

## Cost and cleanup

- Runtime/IPv4/storage:
- LB/network/DNS:
- Logs/metrics/queries:
- KMS/secrets/transfer:
- Pricing date:
- Tagged inventory before/after:
- Temporary IAM/network/DNS/config:
- Retained evidence location/expiry:
- Lab resources remaining: Zero