> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opsbeacon.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Automated Remediation & Approvals

> Allow Beacon to apply fixes automatically with your approval.

> [!NOTE]
>
> Automated remediation is available for select finding types. OpsBeacon never makes changes to your AWS account without explicit approval.

## How it works

For supported finding types, Beacon can generate and apply the remediation — with your approval. The flow:

1. Beacon detects a finding and proposes a fix
2. You review the proposed change in Slack
3. You approve or reject
4. If approved, Beacon applies the change via your AWS account

## Supported finding types

* Enabling GuardDuty in uncovered regions
* Enabling Security Hub
* Blocking public access on misconfigured S3 buckets (with confirmation)
* Enabling EBS default encryption

## Approval flow

```
Beacon: finding-01 can be auto-remediated.
        Proposed change: Enable GuardDuty in us-east-1
        This will cost approximately $3/month.
        Reply `approve finding-01` to apply, or `reject finding-01` to skip.

@Beacon approve finding-01
```

## What automated remediation requires

Automated remediation requires an additional IAM role with write permissions for the specific services it can modify. This is separate from the read-only role used for analysis. See [AWS IAM Permissions](https://docs.opsbeacon.co/security-privacy/iam-permissions.md) for the required policy.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.