Config-Style S3 Compliance Remediation

Build a complete compliance monitoring and auto-remediation pipeline for S3 buckets. Create an AWS Config managed rule to detect publicly readable S3 buckets. Deploy a Python Lambda function that automatically remediates non-compliant buckets by reverting their ACL to private. Wire up EventBridge to capture Config compliance change events and trigger the remediation Lambda. Validate the end-to-end pipeline and build a CloudWatch dashboard with compliance metrics and alarms. Covers detective controls (Config), corrective controls (Lambda auto-remediation), and event-driven architectures tested in SAP-C02 Domain 4 (Security Architecture).