Capstone: Incident Response Drill

This advanced capstone presents a deliberately broken system: an S3 bucket that should trigger a Lambda via SQS, but nothing works. IAM policies are wrong, the event source mapping is missing, the S3 notification has the wrong prefix filter, and a CloudWatch alarm is red.

You will:

• Investigate the broken system using CloudWatch Logs, IAM policy inspection, SQS queue attributes, and S3 event notification configuration
• Map every failure point to create an incident response baseline
• Fix IAM permission boundaries: grant the Lambda role SQS consumption permissions and fix the SQS queue policy to allow S3 delivery
• Create the missing Lambda event source mapping and adjust the Lambda timeout from 1 second to 10 seconds
• Correct the S3 event notification prefix filter and replay events through the pipeline
• Validate full end-to-end recovery with multiple test files and produce an incident postmortem document

This lab integrates Domain 1 (SDLC Automation), Domain 2 (Configuration Management/IaC), Domain 3 (Resilient Cloud Solutions), Domain 4 (Monitoring and Logging), and Domain 5 (Incident and Event Response). Every resource is tagged for identification. Region: us-east-1.