Quarantining a Compromised EC2 Instance

If GuardDuty or your monitoring shows an EC2 instance making malicious outbound connections, mining crypto, or scanning your network, it needs to be quarantined.

Quarantine isolates the instance from everything else so it can do no further harm, while keeping it alive for investigation rather than wiping the evidence.

The cleanest quarantine is to replace the instance's security groups with a single forensic group that has no inbound rules and, ideally, no outbound rules.

Because security groups are stateful and instance-attached, this immediately severs essentially all new connections without touching anything else in the subnet.