Enable AWS Security Incident Response (SIR) via AWS CLI

Overview

This guide provides step-by-step instructions to enable AWS Security Incident Response (SIR) using the AWS Command Line Interface (CLI). AWS Security Incident Response helps you prepare for, respond to, and recover from security events across your AWS environment.

Prerequisites

Before enabling SIR, ensure the following:

• AWS CLI v2 is installed and configured with appropriate credentials
• You have access to the AWS Organizations management account (or a delegated administrator account for later steps)
• Amazon GuardDuty is enabled (recommended for full functionality)
• AWS Security Hub is enabled (recommended for full functionality)

Enable Amazon GuardDuty (if not already enabled)

aws guardduty create-detector --enable

Enable AWS Security Hub (if not already enabled)

aws securityhub enable-security-hub

Step 1: Enable AWS Security Incident Response as a Trusted Service

Run from: AWS Organizations management account

Enable SIR as a trusted service within AWS Organizations:

aws organizations enable-aws-service-access \
    --service-principal security-ir.amazonaws.com

This grants the Security Incident Response service permission to operate across your organization.

Step 2: Register a Delegated Administrator Account

Run from: AWS Organizations management account

Designate a member account as the delegated administrator for Security Incident Response:

aws organizations register-delegated-administrator \
    --account-id <MEMBER_ACCOUNT_ID> \
    --service-principal security-ir.amazonaws.com

Replace <MEMBER_ACCOUNT_ID> with the 12-digit AWS account ID of the member account you want to designate as the delegated administrator.

Note: This step is optional if you plan to manage SIR directly from the management account. However, AWS recommends using a delegated administrator account as a best practice.

Step 3: Create the Service-Linked Role for SIR

Run from: Management account or delegated administrator account

Create the service-linked role required for the SIR triage functionality:

aws iam create-service-linked-role \
    --aws-service-name "triage.security-ir.amazonaws.com"

This role allows the Security Incident Response service to perform triage operations on your behalf.

Note: If the service-linked role already exists, the command will return an error — this is safe to ignore.

Step 4: Create a SIR Membership

Run from: Management account or delegated administrator account

Create a membership to onboard your account(s) to Security Incident Response.

Important: The --incident-response-team parameter requires a minimum of 2 team members. Providing fewer than 2 will result in a ParamValidation error.

Option A: Create Membership for Specific Accounts

aws security-ir create-membership \
    --membership-name "MyOrg-SIR-Membership" \
    --incident-response-team '[
        {
            "name": "John Doe",
            "jobTitle": "Security Engineer",
            "email": "johndoe@example.com"
        },
        {
            "name": "Jane Smith",
            "jobTitle": "Security Lead",
            "email": "janesmith@example.com"
        }
    ]' \
    --opt-in-features '[
        {
            "featureName": "Triage",
            "isEnabled": true
        }
    ]'

Option B: Create Membership for Entire Organization

To apply the membership across all accounts in your AWS Organization, add the --cover-entire-organization flag:

aws security-ir create-membership \
    --membership-name "MyOrg-SIR-Membership" \
    --incident-response-team '[
        {
            "name": "John Doe",
            "jobTitle": "Security Engineer",
            "email": "johndoe@example.com"
        },
        {
            "name": "Jane Smith",
            "jobTitle": "Security Lead",
            "email": "janesmith@example.com"
        }
    ]' \
    --opt-in-features '[
        {
            "featureName": "Triage",
            "isEnabled": true
        }
    ]' \
    --cover-entire-organization

Key Parameters

Parameter	Required	Description
--membership-name	Yes	A descriptive name for your SIR membership
--incident-response-team	Yes	JSON array of team members (name, jobTitle, email); minimum 2 members required
--opt-in-features	No	Enable optional features such as Triage
--cover-entire-organization	No	Boolean flag; when included, membership applies to all accounts in the organization
--client-token	No	Idempotency token to prevent duplicate membership creation
--tags	No	Key-value pairs for tagging the membership resource

Step 5: Verify the Membership

Confirm that the membership was created successfully:

aws security-ir get-membership \
    --membership-id <MEMBERSHIP_ID>

Replace <MEMBERSHIP_ID> with the membership ID returned from the create-membership command in Step 4.

Summary of Commands

Step	Command	Run From
Prerequisites	aws guardduty create-detector --enable	Any account
Prerequisites	aws securityhub enable-security-hub	Any account
Step 1	aws organizations enable-aws-service-access --service-principal security-ir.amazonaws.com	Management account
Step 2	aws organizations register-delegated-administrator	Management account
Step 3	aws iam create-service-linked-role --aws-service-name "triage.security-ir.amazonaws.com"	Management or delegated admin
Step 4	aws security-ir create-membership	Management or delegated admin
Step 5	aws security-ir get-membership	Management or delegated admin

Troubleshooting

Error	Cause	Solution
ParamValidation: Invalid length for parameter incidentResponseTeam, value: 1, valid min length: 2	Only 1 team member provided	Add at least 2 team members to the --incident-response-team array
Service role already exists	SLR was previously created	Safe to ignore; proceed to the next step
AccessDeniedException	Insufficient IAM permissions	Ensure your IAM principal has permissions for Organizations, IAM, and Security IR actions
AWSOrganizationsNotInUseException	AWS Organizations not enabled	Enable AWS Organizations before proceeding

Important Notes

• Account Requirements: Steps 1 and 2 must be executed from the AWS Organizations management account. Steps 3–5 can be run from either the management account or the delegated administrator account.
• Team Size: The incident response team must include a minimum of 2 members. This ensures adequate coverage for security incident handling.
• GuardDuty & Security Hub: For the full Security Incident Response experience, AWS recommends activating both Amazon GuardDuty and AWS Security Hub.
• IAM Permissions: Ensure the IAM principal executing these commands has the necessary permissions for Organizations, IAM, and Security Incident Response actions.

References

• AWS Security Incident Response User Guide
• AWS CLI Reference — security-ir create-membership
• AWS Security Incident Response FAQs