BlueSky Bank’s SOC analysts want a one-click “Quarantine EC2” option inside AWS Security Hub to isolate instances referenced by specific findings. Clicking the action should invoke an existing Lambda function with the full finding context, including the selected resource ARN. What is the most appropriate design to meet this requirement with minimal friction for analysts?

Creating a Security Hub custom action provides the desired "one-click" option directly within the Security Hub console. When this custom action is invoked, Security Hub emits an event to Amazon EventBridge. An EventBridge rule can then be configured to specifically listen for events with source: "aws.securityhub" and detail-type: "Security Hub Findings - Custom Action", filtering by the actionId of the custom action. This rule can then directly target and invoke the existing Lambda function, passing the full finding context. Incorrect options: Security Hub insights and CloudWatch alarms are for monitoring and alerting based on aggregated findings, not for triggering actions on specific findings via a user click. Security Hub Automation Rules can trigger actions, but they are for automated responses based on finding criteria, not for user-initiated "one-click" actions. Publishing all findings to SNS and manually sending to SNS does not provide a "one-click" experience within Security Hub for a specific finding.