HOW TO AUTOMATICALLY DISABLE USERS IN AWS MANAGED MICROSOFT AD BASED ON GUARDDUTY FINDINGS

Summary from the TLDR InfoSec newsletter

Automatically disabling compromised user accounts helps organizations reduce attack fallout. This tutorial demonstrates how to utilize GuardDuty for detecting suspicious activity, triggering an AWS Step Function to retrieve user information, and subsequently disabling the account in AWS Directory Service for Microsoft AD. The last step can also be done on a domain-joined EC2 instance if an organization doesn't use AWS Managed AD.