Capstone: Secure Serverless DevOps Workflow

This is the DOP-C02 capstone lab that ties together SDLC automation, Infrastructure as Code, monitoring and observability, incident response, security and compliance, and resilient architectures into a single end-to-end workflow.

You will act as a senior DevOps engineer tasked with delivering a secure, observable serverless application. Every decision you make here mirrors a real exam scenario and production pattern.

You will:

• Design least-privilege IAM roles for Lambda execution and CodePipeline service, with scoped permissions and resource tagging
• Create a KMS-encrypted S3 artifact bucket and a versioned source bucket
• Build a four-stage CodePipeline (Source, Build, Manual Approval, Deploy) with a CodeBuild buildspec that packages a Python Lambda
• Deploy a Lambda function with immutable versions and a weighted PROD alias, then alarm on Lambda errors via CloudWatch + SNS
• Wire an EventBridge rule to trigger on CloudWatch Alarm state changes and invoke an auto-remediation Lambda that logs the incident and can roll back the alias
• Run `aws iam simulate-principal-policy` to validate least-privilege posture and generate a capstone audit report documenting all resources and security decisions

Region: `us-east-1`. Instance type: `t2.small` workstation. All resources are tagged `lab=true,Course=dop-c02` so the cleanup script can sweep them on lab stop. This lab intentionally combines CLI-based operations, IAM policy authoring, pipeline orchestration, alarm engineering, and EventBridge event-driven remediation in a single 90-minute session.