Project: Cloud Incident Response Runbooks

This project is about operational maturity.

Tools matter, but during an incident the team needs clear ownership, containment steps, communication, evidence capture, and a recovery path.

What the repo will include

1. Leaked secret response runbook.
2. Public storage exposure runbook.
3. Suspicious IAM change runbook.
4. Vulnerable container image rollout runbook.
5. Helper scripts with dry-run defaults.
6. Post-incident review template.

Runbook structure

Each runbook will follow the same pattern:

severity
owner
detection signal
first 15 minutes
containment
eradication
recovery
customer or stakeholder comms
post-incident actions

Why this matters

This structure connects preventive controls with the operational steps required when a control fails, from initial containment through platform improvements after the incident.