Use AWS Lambda to create a function that terminates the compromised EC2 instance and creates a new instance with the same configuration.

Use AWS Step Functions to create a state machine that triggers an AWS Lambda function to isolate the compromised EC2 instance, captures forensic data, and initiates a root cause analysis using AWS Detective.

Use EventBridge to create a rule that triggers an AWS Lambda function to take a snapshot of the compromised EC2 instance's Amazon EBS volume and store it in an isolated Amazon S3 bucket.

Use AWS Systems Manager Runbooks to create a runbook that automates the process of isolating the compromised EC2 instance, capturing forensic data, and initiating a root cause analysis using AWS Detective.