Microsoft Sentinel
Cloud and workloadsEnable attack disruption actions on AWS with Microsoft Sentinel (preview)
In brief
The documentation now requires installing the Amazon Web Services solution from Content Hub so the Amazon Web Services S3 connector appears. It also clarifies connector setup references and updates attack-disruption terminology.
What Defender admins need to know
Install the Amazon Web Services solution before configuring AWS disruption actions; otherwise the required S3 connector will not appear.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Enable attack disruption actions on AWS with Microsoft Sentinel (preview)
This article describes how to configure your AWS environment so that Microsoft Sentinel can take automated actions on a user that assumes a SAML role, or on an AWS IAM account when an alert is triggered. Automatic attack disruption in Microsoft Defender XDR uses high-confidence signals to contain compromised assets and limit the damage from attacks, including actions on identities in AWS. Before you begin, make sure the required AWS and Microsoft Sentinel prerequisites are in place.
Prerequisites
- You have an active AWS account with administrative privileges.
- Your Microsoft Sentinel analytic workspace is connected to the unified security operations portal.
- The AWS Connector for Microsoft Sentinel is deployed and
enabledenabled. - AWS CloudTrail logs are being ingested into Microsoft
Sentinel See:Sentinel; see Connect Microsoft Sentinel to Amazon Web Services to ingest AWS service log data. - Appropriate IAM roles and permissions are configured in AWS to allow Microsoft Sentinel to perform actions on IAM accounts.
- The Amazon Web Services solution is installed from Content Hub in Microsoft Sentinel so that the Amazon Web Services S3 connector appears in the data connectors gallery.
Step 1: Prepare AWS for integration
1.1 Create a dedicated IAM role for Microsoft Sentinel
Create a new IAM role in the AWS Management Console.
Select AWS service as the trusted entity and choose EC2 as a temporary placeholder. You replace this trust relationship with the correct Microsoft Sentinel principal in Configure trust relationship.
Attach the following IAM policy to the role. This policy grants Microsoft Sentinel the permissions needed to manage IAM user and role policies for attack disruption actions. Replace <YOUR_ACCOUNT_ID> as needed:
{
Follow the instructions in Connect Microsoft Sentinel to Amazon Web Services to ingest AWS service log data to set up your AWS environment and connect it to Microsoft Sentinel.
Provide the IAM role ARN and the Amazon SQS queue URL that receives S3 log notifications from your AWS environment. These values are created
duringwhen you set up the connectorsetup described in the previous step.by following Connect Microsoft Sentinel to Amazon Web Services to ingest AWS service log data.
Step 4: Validate integration
@@ -4,15 +4,15 @@ description: Configure your AWS environment so Microsoft Sentinel can take autom ms.author: monaberdugo author: mberdugo ms.reviewer: eyalhaik-ms.date: 06/15/2026+ms.date: 07/01/2026 ms.topic: how-to ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 --- # Enable attack disruption actions on AWS with Microsoft Sentinel (preview) -This article describes how to configure your AWS environment so that Microsoft Sentinel can take automated actions on a user that assumes a SAML role, or on an AWS IAM account when an alert is triggered. [Attack disruption](/defender-xdr/automatic-attack-disruption) uses high-confidence signals to contain compromised assets and limit the damage from attacks, including actions on identities in AWS. Before you begin, make sure the required [AWS and Microsoft Sentinel prerequisites](#prerequisites) are in place.+This article describes how to configure your AWS environment so that Microsoft Sentinel can take automated actions on a user that assumes a SAML role, or on an AWS IAM account when an alert is triggered. [Automatic attack disruption in Microsoft Defender XDR](/defender-xdr/automatic-attack-disruption) uses high-confidence signals to contain compromised assets and limit the damage from attacks, including actions on identities in AWS. Before you begin, make sure the required [AWS and Microsoft Sentinel prerequisites](#prerequisites) are in place. ## Prerequisites @@ -20,10 +20,10 @@ Before you begin, you need the following prerequisites in place: - You have an active AWS account with administrative privileges. - Your Microsoft Sentinel analytic workspace is connected to the unified security operations portal.-- The AWS Connector for Microsoft Sentinel is deployed and enabled-- AWS CloudTrail logs are being ingested into Microsoft Sentinel- See: [Connect Microsoft Sentinel to Amazon Web Services to ingest AWS service log data](./connect-aws.md)+- The AWS Connector for Microsoft Sentinel is deployed and enabled.+- AWS CloudTrail logs are being ingested into Microsoft Sentinel; see [Connect Microsoft Sentinel to Amazon Web Services to ingest AWS service log data](./connect-aws.md). - Appropriate IAM roles and permissions are configured in AWS to allow Microsoft Sentinel to perform actions on IAM accounts.+- The Amazon Web Services solution is installed from Content Hub in Microsoft Sentinel so that the **Amazon Web Services S3** connector appears in the data connectors gallery. ## Step 1: Prepare AWS for integration @@ -31,11 +31,11 @@ Complete the following tasks to prepare your AWS environment for Microsoft Senti ### 1.1 Create a dedicated IAM role for Microsoft Sentinel -1. [Create a new IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) in the AWS Management Console.+[Create a new IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) in the AWS Management Console. -- Select **AWS service** as the trusted entity and choose **EC2** as a temporary placeholder. You replace this trust relationship with the correct Microsoft Sentinel principal in [Configure trust relationship](#12-configure-trust-relationship).+1. Select **AWS service** as the trusted entity and choose **EC2** as a temporary placeholder. You replace this trust relationship with the correct Microsoft Sentinel principal in [Configure trust relationship](#12-configure-trust-relationship). -- Attach the following IAM policy to the role. This policy grants Microsoft Sentinel the permissions needed to manage IAM user and role policies for attack disruption actions. Replace \<YOUR_ACCOUNT_ID\> as needed:+1. Attach the following IAM policy to the role. This policy grants Microsoft Sentinel the permissions needed to manage IAM user and role policies for attack disruption actions. Replace \<YOUR_ACCOUNT_ID\> as needed: ```json {@@ -101,7 +101,7 @@ Deploy and enable the AWS S3 data connector in Microsoft Sentinel so that it can 1. Follow the instructions in [Connect Microsoft Sentinel to Amazon Web Services to ingest AWS service log data](./connect-aws.md) to set up your AWS environment and connect it to Microsoft Sentinel. -1. Provide the IAM role ARN and the Amazon SQS queue URL that receives S3 log notifications from your AWS environment. These values are created during the connector setup described in the previous step.+1. Provide the IAM role ARN and the Amazon SQS queue URL that receives S3 log notifications from your AWS environment. These values are created when you set up the connector by following [Connect Microsoft Sentinel to Amazon Web Services to ingest AWS service log data](./connect-aws.md). ## Step 4: Validate integration