Domain 5: Incident and Event Response on Album69

Amazon EventBridge

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is EventBridge?

Serverless event bus service for application integration
Routes events between AWS services, SaaS applications, and custom applications
Formerly known as CloudWatch Events
Event-driven architecture foundation

Key Components

Event Buses - Receive and route events
Rules - Match events and route to targets
Targets - Destinations for matched events
Events - JSON messages describing state changes

Use Cases

Application decoupling
Real-time data processing
Automated incident response
Cross-account event routing
SaaS integration

2. Event Buses

Default Event Bus

Automatically created in each account
Receives events from AWS services
Cannot be deleted
Regional service

Custom Event Buses

User-created event buses
Isolate events by application or team
Cross-account sharing capabilities
Resource-based policies

# Create custom event bus
aws events create-event-bus --name "MyApplicationBus"

# Put resource policy on event bus
aws events put-permission \
 --principal "123456789012" \
 --action "events:PutEvents" \
 --statement-id "CrossAccountAccess"

Partner Event Buses

Created by SaaS providers
Receive events from partner applications
Automatic provisioning when configured

3. Events and Event Patterns

Event Structure

{
 "version": "0",
 "id": "6a7e8feb-b491-4cf7-a9f1-bf3703467718",
 "detail-type": "EC2 Instance State-change Notification",
 "source": "aws.ec2",
 "account": "123456789012",
 "time": "2024-01-15T10:30:00Z",
 "region": "us-east-1",
 "detail": {
 "instance-id": "i-1234567890abcdef0",
 "state": "running"
 }
}

Event Patterns

{
 "source": ["aws.ec2"],
 "detail-type": ["EC2 Instance State-change Notification"],
 "detail": {
 "state": ["running", "stopped"]
 }
}

Custom Events

# Send custom event
aws events put-events \
 --entries '[
 {
 "Source": "myapp.orders",
 "DetailType": "Order Placed",
 "Detail": "{\"orderId\":\"12345\",\"customerId\":\"67890\",\"amount\":99.99}"
 }
 ]'

4. Rules and Targets

Create Rule

# Create rule for EC2 state changes
aws events put-rule \
 --name "EC2StateChange" \
 --event-pattern '{
 "source": ["aws.ec2"],
 "detail-type": ["EC2 Instance State-change Notification"],
 "detail": {
 "state": ["running", "stopped"]
 }
 }' \
 --state ENABLED

Rule Targets

# Add Lambda target
aws events put-targets \
 --rule "EC2StateChange" \
 --targets '[
 {
 "Id": "1",
 "Arn": "arn:aws:lambda:us-east-1:123456789012:function:ProcessEC2StateChange"
 }
 ]'

# Add SNS target
aws events put-targets \
 --rule "EC2StateChange" \
 --targets '[
 {
 "Id": "2",
 "Arn": "arn:aws:sns:us-east-1:123456789012:ec2-notifications"
 }
 ]'

Supported Targets

Lambda functions
SNS topics
SQS queues
Kinesis streams
Step Functions
ECS tasks
Systems Manager Run Command
API Gateway
HTTP endpoints

5. Incident Response Automation

Automated EC2 Response

import boto3
import json

def lambda_handler(event, context):
 """Automated response to EC2 incidents"""
 
 detail = event['detail']
 instance_id = detail['instance-id']
 state = detail['state']
 
 if state == 'stopped' and 'unexpected' in detail.get('reason', ''):
 # Investigate unexpected stop
 investigate_instance_stop(instance_id)
 
 # Restart if healthy
 if is_instance_healthy(instance_id):
 restart_instance(instance_id)
 else:
 create_incident_ticket(instance_id, 'Instance health check failed')

def investigate_instance_stop(instance_id):
 """Investigate why instance stopped"""
 ec2 = boto3.client('ec2')
 
 # Get instance details
 response = ec2.describe_instances(InstanceIds=[instance_id])
 
 # Check CloudTrail for stop events
 cloudtrail = boto3.client('cloudtrail')
 events = cloudtrail.lookup_events(
 LookupAttributes=[
 {
 'AttributeKey': 'ResourceName',
 'AttributeValue': instance_id
 }
 ]
 )
 
 return events

Security Incident Response

def handle_security_incident(event, context):
 """Handle GuardDuty security findings"""
 
 finding = event['detail']
 severity = finding['severity']
 
 if severity >= 7.0: # High severity
 # Isolate affected resources
 isolate_compromised_resources(finding)
 
 # Create incident
 create_security_incident(finding)
 
 # Notify security team
 notify_security_team(finding)
 
 elif severity >= 4.0: # Medium severity
 # Log for investigation
 log_security_event(finding)
 
 # Apply automated remediation
 apply_security_remediation(finding)

def isolate_compromised_resources(finding):
 """Isolate compromised EC2 instances"""
 ec2 = boto3.client('ec2')
 
 for resource in finding.get('service', {}).get('resources', []): # was: iterated a boolean (== comparison), which raises TypeError
 if resource['resourceType'] == 'Instance':
 instance_id = resource['instanceDetails']['instanceId']
 
 # Create isolation security group
 isolation_sg = create_isolation_security_group()
 
 # Apply to instance
 ec2.modify_instance_attribute(
 InstanceId=instance_id,
 Groups=[isolation_sg]
 )

6. Application Integration Patterns

Microservices Communication

{
 "Rules": [
 {
 "Name": "OrderProcessing",
 "EventPattern": {
 "source": ["ecommerce.orders"],
 "detail-type": ["Order Placed"]
 },
 "Targets": [
 {
 "Id": "inventory-service",
 "Arn": "arn:aws:lambda:us-east-1:123456789012:function:UpdateInventory"
 },
 {
 "Id": "payment-service", 
 "Arn": "arn:aws:lambda:us-east-1:123456789012:function:ProcessPayment"
 },
 {
 "Id": "notification-service",
 "Arn": "arn:aws:sns:us-east-1:123456789012:order-notifications"
 }
 ]
 }
 ]
}

Cross-Account Event Routing

# Grant cross-account permissions
aws events put-permission \
 --principal "111122223333" \
 --action "events:PutEvents" \
 --statement-id "CrossAccountOrderEvents"

# Create cross-account rule
aws events put-rule \
 --name "CrossAccountOrders" \
 --event-pattern '{
 "source": ["partner.orders"],
 "account": ["111122223333"]
 }'

7. Monitoring and Observability

EventBridge Metrics

import boto3

def monitor_eventbridge_metrics():
 """Monitor EventBridge performance"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Get rule invocation metrics
 response = cloudwatch.get_metric_statistics(
 Namespace='AWS/Events',
 MetricName='InvocationsCount',
 Dimensions=[
 {
 'Name': 'RuleName',
 'Value': 'EC2StateChange'
 }
 ],
 StartTime=datetime.utcnow() - timedelta(hours=1),
 EndTime=datetime.utcnow(),
 Period=300,
 Statistics=['Sum']
 )
 
 return response['Datapoints']

Dead Letter Queues

# Create DLQ for failed events
aws sqs create-queue --queue-name "eventbridge-dlq"

# Configure rule with DLQ
aws events put-targets \
 --rule "MyRule" \
 --targets '[
 {
 "Id": "1",
 "Arn": "arn:aws:lambda:us-east-1:123456789012:function:MyFunction",
 "DeadLetterConfig": {
 "Arn": "arn:aws:sqs:us-east-1:123456789012:eventbridge-dlq"
 }
 }
 ]'

8. Schema Registry

Event Schema Management

# Create schema registry
aws schemas create-registry --registry-name "MyAppRegistry"

# Create schema
aws schemas create-schema \
 --registry-name "MyAppRegistry" \
 --schema-name "OrderPlaced" \
 --type "JSONSchemaDraft4" \
 --content '{
 "type": "object",
 "properties": {
 "orderId": {"type": "string"},
 "customerId": {"type": "string"},
 "amount": {"type": "number"}
 },
 "required": ["orderId", "customerId", "amount"]
 }'

Schema Discovery

import boto3

def discover_event_schemas():
 """Automatically discover event schemas"""
 
 schemas = boto3.client('schemas')
 
 # Start schema discovery
 response = schemas.start_discoverer(
 DiscovererId='MyAppDiscoverer',
 SourceArn='arn:aws:events:us-east-1:123456789012:event-bus/MyAppBus'
 )
 
 return response

9. Error Handling and Retry

Retry Configuration

{
 "RetryPolicy": {
 "MaximumRetryAttempts": 3,
 "MaximumEventAge": 3600
 },
 "DeadLetterConfig": {
 "Arn": "arn:aws:sqs:us-east-1:123456789012:failed-events"
 }
}

Error Handling Patterns

def robust_event_handler(event, context):
 """Event handler with error handling"""
 
 try:
 # Process event
 result = process_event(event)
 
 # Log success
 logger.info(f"Successfully processed event: {event['id']}")
 
 return result
 
 except RetryableError as e:
 # Log for retry
 logger.warning(f"Retryable error processing event: {e}")
 raise e
 
 except FatalError as e:
 # Log and send to DLQ
 logger.error(f"Fatal error processing event: {e}")
 send_to_dlq(event, str(e))
 
 except Exception as e:
 # Unknown error - log and investigate
 logger.error(f"Unknown error processing event: {e}")
 create_investigation_ticket(event, str(e))
 raise e

10. Performance Optimization

Batch Processing

def batch_event_processor(event, context):
 """Process multiple events in batch"""
 
 # EventBridge can send up to 10 events per invocation
 records = event.get('Records', [])
 
 batch_size = 10
 for i in range(0, len(records), batch_size):
 batch = records[i:i + batch_size]
 process_event_batch(batch)

def process_event_batch(events):
 """Process batch of events efficiently"""
 
 # Group events by type
 events_by_type = {}
 for event in events:
 event_type = event['detail-type']
 if event_type not in events_by_type:
 events_by_type[event_type] = []
 events_by_type[event_type].append(event)
 
 # Process each type efficiently
 for event_type, type_events in events_by_type.items():
 processor = get_processor_for_type(event_type)
 processor.process_batch(type_events)

Connection Pooling

import boto3
from botocore.config import Config

# Configure connection pooling
config = Config(
 max_pool_connections=50,
 retries={'max_attempts': 3}
)

# Reuse clients
eventbridge = boto3.client('events', config=config)
lambda_client = boto3.client('lambda', config=config)

11. Common Exam Scenarios

Scenario 1: Automate incident response for failed deployments

Solution:

Amazon EventBridge Pipes

Sun, 04 Oct 2026 00:00:00 +0000

Launched: November 2022. Pipes are a distinct EventBridge feature from rules/buses — know the difference.

1. Overview

What it is: A point-to-point integration that connects a single source to a single target with optional filtering and enrichment in between — all without writing glue code.

What problem it solves: Before Pipes, connecting an SQS queue to a Lambda enricher to a Step Functions workflow required custom Lambda code just to pass messages along. Pipes does that wiring declaratively, with built-in batching, filtering, and enrichment.

AWS CloudWatch Alarms

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What are CloudWatch Alarms?

Monitoring service that watches CloudWatch metrics
Triggers actions when metric thresholds are breached
Essential component of incident detection and response
Integrates with SNS, Auto Scaling, EC2, and other services

Key Components

Metrics - Data points that alarms monitor
Thresholds - Values that trigger alarm state changes
Actions - What happens when alarm state changes
States - OK, ALARM, INSUFFICIENT_DATA

Use Cases for Incident Response

Infrastructure monitoring and alerting
Application performance monitoring
Security incident detection
Automated scaling and remediation
Cost monitoring and optimization

2. Alarm States and Transitions

Alarm States

OK - Metric is within threshold
ALARM - Metric has breached threshold
INSUFFICIENT_DATA - Not enough data to determine state

State Transitions

def monitor_alarm_state_changes(event, context):
 """Handle CloudWatch alarm state changes"""
 
 detail = event['detail']
 alarm_name = detail['alarmName']
 old_state = detail['previousState']['value']
 new_state = detail['newState']['value']
 reason = detail['newState']['reason']
 
 logger.info(f"Alarm {alarm_name} changed from {old_state} to {new_state}")
 
 if new_state == 'ALARM':
 handle_alarm_triggered(alarm_name, reason, detail)
 elif new_state == 'OK' and old_state == 'ALARM':
 handle_alarm_resolved(alarm_name, detail)
 elif new_state == 'INSUFFICIENT_DATA':
 handle_insufficient_data(alarm_name, detail)

def handle_alarm_triggered(alarm_name, reason, detail):
 """Handle alarm entering ALARM state"""
 
 # Create incident
 incident = create_incident(
 title=f"CloudWatch Alarm: {alarm_name}",
 description=reason,
 severity=determine_severity_from_alarm(alarm_name),
 alarm_details=detail
 )
 
 # Send notifications
 send_alarm_notification(incident)
 
 # Trigger automated response
 trigger_automated_response(alarm_name, incident)

3. Metric-Based Alarms

EC2 Instance Monitoring

# CPU utilization alarm
aws cloudwatch put-metric-alarm \
 --alarm-name "HighCPUUtilization" \
 --alarm-description "Triggers when CPU exceeds 80%" \
 --metric-name CPUUtilization \
 --namespace AWS/EC2 \
 --statistic Average \
 --period 300 \
 --threshold 80 \
 --comparison-operator GreaterThanThreshold \
 --evaluation-periods 2 \
 --alarm-actions "arn:aws:sns:us-east-1:123456789012:cpu-alerts" \
 --dimensions Name=InstanceId,Value=i-1234567890abcdef0

# Memory utilization alarm (custom metric)
aws cloudwatch put-metric-alarm \
 --alarm-name "HighMemoryUtilization" \
 --alarm-description "Triggers when memory exceeds 85%" \
 --metric-name MemoryUtilization \
 --namespace CWAgent \
 --statistic Average \
 --period 300 \
 --threshold 85 \
 --comparison-operator GreaterThanThreshold \
 --evaluation-periods 2 \
 --alarm-actions "arn:aws:sns:us-east-1:123456789012:memory-alerts" \
 --dimensions Name=InstanceId,Value=i-1234567890abcdef0

Application Load Balancer Monitoring

# High error rate alarm
aws cloudwatch put-metric-alarm \
 --alarm-name "ALBHighErrorRate" \
 --alarm-description "Triggers when 5XX error rate exceeds 5%" \
 --metric-name HTTPCode_ELB_5XX_Count \
 --namespace AWS/ApplicationELB \
 --statistic Sum \
 --period 300 \
 --threshold 10 \
 --comparison-operator GreaterThanThreshold \
 --evaluation-periods 2 \
 --alarm-actions "arn:aws:sns:us-east-1:123456789012:alb-alerts" \
 --dimensions Name=LoadBalancer,Value=app/my-alb/50dc6c495c0c9188

# High response time alarm
aws cloudwatch put-metric-alarm \
 --alarm-name "ALBHighResponseTime" \
 --alarm-description "Triggers when response time exceeds 2 seconds" \
 --metric-name TargetResponseTime \
 --namespace AWS/ApplicationELB \
 --statistic Average \
 --period 300 \
 --threshold 2 \
 --comparison-operator GreaterThanThreshold \
 --evaluation-periods 3 \
 --alarm-actions "arn:aws:sns:us-east-1:123456789012:performance-alerts"

RDS Database Monitoring

# Database connection alarm
aws cloudwatch put-metric-alarm \
 --alarm-name "RDSHighConnections" \
 --alarm-description "Triggers when connection count exceeds 80% of max" \
 --metric-name DatabaseConnections \
 --namespace AWS/RDS \
 --statistic Average \
 --period 300 \
 --threshold 80 \
 --comparison-operator GreaterThanThreshold \
 --evaluation-periods 2 \
 --alarm-actions "arn:aws:sns:us-east-1:123456789012:rds-alerts" \
 --dimensions Name=DBInstanceIdentifier,Value=mydb-instance

4. Composite Alarms

Multi-Metric Monitoring

def create_composite_alarm():
 """Create composite alarm for application health"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Create composite alarm that triggers when multiple conditions are met
 response = cloudwatch.put_composite_alarm(
 AlarmName='ApplicationHealthComposite',
 AlarmDescription='Composite alarm for overall application health',
 AlarmRule=(
 "ALARM('HighCPUUtilization') OR "
 "ALARM('ALBHighErrorRate') OR "
 "ALARM('RDSHighConnections')"
 ),
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:critical-alerts'
 ],
 OKActions=[
 'arn:aws:sns:us-east-1:123456789012:recovery-notifications'
 ]
 )
 
 return response

Complex Logic Alarms

# Composite alarm with AND/OR logic
aws cloudwatch put-composite-alarm \
 --alarm-name "CriticalSystemFailure" \
 --alarm-description "Critical system failure detected" \
 --alarm-rule "(ALARM('HighCPUUtilization') AND ALARM('ALBHighErrorRate')) OR ALARM('DatabaseDown')" \
 --actions-enabled \
 --alarm-actions "arn:aws:sns:us-east-1:123456789012:emergency-alerts"

5. Custom Metrics and Alarms

Application Metrics

import boto3
import time

def publish_custom_metrics():
 """Publish custom application metrics"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Business metrics
 cloudwatch.put_metric_data(
 Namespace='MyApp/Business',
 MetricData=[
 {
 'MetricName': 'OrdersPerMinute',
 'Value': get_orders_per_minute(),
 'Unit': 'Count/Second',
 'Dimensions': [
 {
 'Name': 'Environment',
 'Value': 'Production'
 }
 ]
 },
 {
 'MetricName': 'PaymentFailureRate',
 'Value': get_payment_failure_rate(),
 'Unit': 'Percent',
 'Dimensions': [
 {
 'Name': 'PaymentProvider',
 'Value': 'Stripe'
 }
 ]
 }
 ]
 )

def create_business_metric_alarms():
 """Create alarms for business metrics"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Low order rate alarm
 cloudwatch.put_metric_alarm(
 AlarmName='LowOrderRate',
 AlarmDescription='Order rate has dropped significantly',
 MetricName='OrdersPerMinute',
 Namespace='MyApp/Business',
 Statistic='Average',
 Period=300,
 Threshold=10,
 ComparisonOperator='LessThanThreshold',
 EvaluationPeriods=3,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:business-alerts'
 ],
 Dimensions=[
 {
 'Name': 'Environment',
 'Value': 'Production'
 }
 ]
 )
 
 # High payment failure rate alarm
 cloudwatch.put_metric_alarm(
 AlarmName='HighPaymentFailureRate',
 AlarmDescription='Payment failure rate is too high',
 MetricName='PaymentFailureRate',
 Namespace='MyApp/Business',
 Statistic='Average',
 Period=300,
 Threshold=5,
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=2,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:payment-alerts'
 ]
 )

6. Alarm Actions and Automation

def setup_alarm_notifications():
 """Set up SNS topics for alarm notifications"""
 
 sns = boto3.client('sns')
 
 # Create topics for different severity levels
 topics = {
 'critical': 'critical-alerts',
 'warning': 'warning-alerts',
 'info': 'info-alerts'
 }
 
 topic_arns = {}
 
 for severity, topic_name in topics.items():
 response = sns.create_topic(Name=topic_name)
 topic_arn = response['TopicArn']
 topic_arns[severity] = topic_arn
 
 # Subscribe appropriate endpoints
 if severity == 'critical':
 # SMS for critical alerts
 sns.subscribe(
 TopicArn=topic_arn,
 Protocol='sms',
 Endpoint='+1234567890'
 )
 # Email for critical alerts
 sns.subscribe(
 TopicArn=topic_arn,
 Protocol='email',
 Endpoint='oncall@example.com'
 )
 
 # Email for all alerts
 sns.subscribe(
 TopicArn=topic_arn,
 Protocol='email',
 Endpoint='alerts@example.com'
 )
 
 return topic_arns

Auto Scaling Integration

# Create scaling policy
aws autoscaling put-scaling-policy \
 --auto-scaling-group-name "my-asg" \
 --policy-name "scale-up-policy" \
 --policy-type "StepScaling" \
 --adjustment-type "ChangeInCapacity" \
 --step-adjustments MetricIntervalLowerBound=0,MetricIntervalUpperBound=50,ScalingAdjustment=1 \
 MetricIntervalLowerBound=50,ScalingAdjustment=2

# Create alarm that triggers scaling
aws cloudwatch put-metric-alarm \
 --alarm-name "ScaleUpAlarm" \
 --alarm-description "Scale up when CPU is high" \
 --metric-name CPUUtilization \
 --namespace AWS/EC2 \
 --statistic Average \
 --period 300 \
 --threshold 70 \
 --comparison-operator GreaterThanThreshold \
 --evaluation-periods 2 \
 --alarm-actions "arn:aws:autoscaling:us-east-1:123456789012:scalingPolicy:policy-id"

Lambda Integration

def create_lambda_alarm_handler():
 """Create Lambda function to handle alarm events"""
 
 lambda_code = '''
import json
import boto3

def lambda_handler(event, context):
 """Handle CloudWatch alarm events"""
 
 # Parse SNS message
 message = json.loads(event['Records'][0]['Sns']['Message'])
 
 alarm_name = message['AlarmName']
 new_state = message['NewStateValue']
 reason = message['NewStateReason']
 
 if new_state == 'ALARM':
 # Trigger incident response
 trigger_incident_response(alarm_name, reason)
 
 return {'statusCode': 200}

def trigger_incident_response(alarm_name, reason):
 """Trigger automated incident response"""
 
 if 'HighCPU' in alarm_name:
 # Scale up resources
 trigger_auto_scaling()
 elif 'HighErrorRate' in alarm_name:
 # Restart application
 restart_application()
 elif 'DatabaseDown' in alarm_name:
 # Failover to backup
 trigger_database_failover()
'''
 
 # Create Lambda function
 lambda_client = boto3.client('lambda')
 
 response = lambda_client.create_function(
 FunctionName='AlarmResponseHandler',
 Runtime='python3.9',
 Role='arn:aws:iam::123456789012:role/LambdaExecutionRole',
 Handler='lambda_function.lambda_handler',
 Code={'ZipFile': lambda_code.encode()},
 Description='Handles CloudWatch alarm events'
 )
 
 return response

7. Anomaly Detection

Anomaly Detector Alarms

def create_anomaly_detection_alarm():
 """Create alarm based on anomaly detection"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Create anomaly detector
 cloudwatch.put_anomaly_detector(
 Namespace='AWS/EC2',
 MetricName='CPUUtilization',
 Dimensions=[
 {
 'Name': 'InstanceId',
 'Value': 'i-1234567890abcdef0'
 }
 ],
 Stat='Average'
 )
 
 # Create alarm based on anomaly detection
 cloudwatch.put_metric_alarm(
 AlarmName='CPUAnomalyDetection',
 AlarmDescription='Detects CPU usage anomalies',
 ComparisonOperator='LessThanLowerOrGreaterThanUpperThreshold',
 EvaluationPeriods=2,
 Metrics=[
 {
 'Id': 'm1',
 'MetricStat': {
 'Metric': {
 'Namespace': 'AWS/EC2',
 'MetricName': 'CPUUtilization',
 'Dimensions': [
 {
 'Name': 'InstanceId',
 'Value': 'i-1234567890abcdef0'
 }
 ]
 },
 'Period': 300,
 'Stat': 'Average'
 }
 },
 {
 'Id': 'ad1',
 'Expression': 'ANOMALY_DETECTION_FUNCTION(m1, 2)'
 }
 ],
 ThresholdMetricId='ad1',
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:anomaly-alerts'
 ]
 )

8. Monitoring and Troubleshooting

Alarm History

def analyze_alarm_history(alarm_name, days=7):
 """Analyze alarm history for patterns"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 end_time = datetime.utcnow()
 start_time = end_time - timedelta(days=days)
 
 # Get alarm history
 response = cloudwatch.describe_alarm_history(
 AlarmName=alarm_name,
 StartDate=start_time,
 EndDate=end_time,
 MaxRecords=100
 )
 
 # Analyze patterns
 state_changes = []
 for item in response['AlarmHistoryItems']:
 if item['HistoryItemType'] == 'StateUpdate':
 state_changes.append({
 'timestamp': item['Timestamp'],
 'summary': item['HistorySummary'],
 'data': json.loads(item['HistoryData'])
 })
 
 # Calculate alarm frequency
 alarm_count = len([sc for sc in state_changes 
 if 'to ALARM' in sc['summary']])
 
 return {
 'alarm_name': alarm_name,
 'period_days': days,
 'total_state_changes': len(state_changes),
 'alarm_count': alarm_count,
 'alarm_frequency': alarm_count / days,
 'state_changes': state_changes
 }

Alarm Effectiveness Metrics

def calculate_alarm_effectiveness():
 """Calculate metrics for alarm effectiveness"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Get all alarms
 alarms = cloudwatch.describe_alarms()
 
 effectiveness_metrics = {}
 
 for alarm in alarms['MetricAlarms']:
 alarm_name = alarm['AlarmName']
 
 # Get alarm history
 history = analyze_alarm_history(alarm_name, days=30)
 
 # Calculate effectiveness metrics
 effectiveness_metrics[alarm_name] = {
 'total_alarms': history['alarm_count'],
 'false_positive_rate': calculate_false_positive_rate(alarm_name),
 'mean_time_to_resolution': calculate_mttr(alarm_name),
 'alarm_frequency': history['alarm_frequency']
 }
 
 return effectiveness_metrics

def calculate_false_positive_rate(alarm_name):
 """Calculate false positive rate for alarm"""
 # Implementation would analyze incident outcomes
 # vs alarm triggers to determine false positives
 return 0.15 # Example: 15% false positive rate

def calculate_mttr(alarm_name):
 """Calculate mean time to resolution"""
 # Implementation would analyze time between
 # alarm trigger and resolution
 return 45 # Example: 45 minutes average

9. Cost Optimization

Alarm Cost Management

def optimize_alarm_costs():
 """Optimize CloudWatch alarm costs"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Get all alarms
 alarms = cloudwatch.describe_alarms()
 
 optimization_recommendations = []
 
 for alarm in alarms['MetricAlarms']:
 alarm_name = alarm['AlarmName']
 
 # Check if alarm has triggered recently
 history = analyze_alarm_history(alarm_name, days=90)
 
 if history['alarm_count'] == 0:
 # Alarm hasn't triggered in 90 days
 optimization_recommendations.append({
 'alarm_name': alarm_name,
 'recommendation': 'Consider disabling - no triggers in 90 days',
 'potential_savings': 0.10 # $0.10 per alarm per month
 })
 
 elif history['false_positive_rate'] > 0.8:
 # High false positive rate
 optimization_recommendations.append({
 'alarm_name': alarm_name,
 'recommendation': 'Tune threshold - high false positive rate',
 'false_positive_rate': history['false_positive_rate']
 })
 
 return optimization_recommendations

10. Common Exam Scenarios

Scenario 1: High CPU utilization incident response

Solution:

AWS Lambda

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is Lambda?

Serverless compute service for running code without managing servers
Event-driven execution model
Automatic scaling and high availability
Pay-per-request pricing model

Key Benefits

No Server Management - Focus on code, not infrastructure
Automatic Scaling - Scales from zero to thousands of concurrent executions
Built-in Fault Tolerance - Automatic failure handling and retry
Cost Effective - Pay only for compute time used
Event Integration - Native integration with AWS services

Use Cases for Incident Response

Automated incident response workflows
Real-time log processing and analysis
Alert processing and notification routing
Infrastructure remediation actions
Security incident automation

2. Lambda Function Basics

Function Configuration

import json
import boto3
import logging

# Configure logging
logger = logging.getLogger()
logger.setLevel(logging.INFO)

def lambda_handler(event, context):
 """Main Lambda function handler"""
 
 try:
 # Log incoming event
 logger.info(f"Received event: {json.dumps(event)}")
 
 # Process event
 result = process_incident_event(event)
 
 # Return response
 return {
 'statusCode': 200,
 'body': json.dumps(result)
 }
 
 except Exception as e:
 logger.error(f"Error processing event: {str(e)}")
 raise e

def process_incident_event(event):
 """Process incident-related event"""
 
 event_source = event.get('source', '')
 
 if event_source == 'aws.cloudwatch':
 return handle_cloudwatch_alarm(event)
 elif event_source == 'aws.guardduty':
 return handle_security_finding(event)
 elif event_source == 'aws.ec2':
 return handle_ec2_event(event)
 else:
 return handle_generic_event(event)

Environment Variables

# Set environment variables
aws lambda update-function-configuration \
 --function-name IncidentResponseFunction \
 --environment Variables='{
 "SNS_TOPIC_ARN":"arn:aws:sns:us-east-1:123456789012:incident-alerts",
 "SLACK_WEBHOOK_URL":"https://hooks.slack.com/services/...",
 "LOG_LEVEL":"INFO"
 }'

3. Event Sources and Triggers

CloudWatch Events/EventBridge

def handle_cloudwatch_alarm(event):
 """Handle CloudWatch alarm events"""
 
 detail = event['detail']
 alarm_name = detail['alarmName']
 new_state = detail['newState']['value']
 reason = detail['newState']['reason']
 
 if new_state == 'ALARM':
 # Create incident
 incident = create_incident(
 title=f"CloudWatch Alarm: {alarm_name}",
 description=reason,
 severity=determine_severity(alarm_name),
 source='cloudwatch'
 )
 
 # Send notifications
 send_incident_notification(incident)
 
 # Trigger automated response
 trigger_automated_response(incident)
 
 return incident
 
 elif new_state == 'OK':
 # Resolve incident if exists
 resolve_incident_by_alarm(alarm_name)
 
 return {'status': 'processed'}

S3 Events

def handle_s3_event(event, context):
 """Process S3 events for log analysis"""
 
 for record in event['Records']:
 bucket = record['s3']['bucket']['name']
 key = record['s3']['object']['key']
 
 if key.endswith('.log'):
 # Process log file for incidents
 analyze_log_file(bucket, key)

def analyze_log_file(bucket, key):
 """Analyze log file for incident patterns"""
 
 s3 = boto3.client('s3')
 
 # Download log file
 response = s3.get_object(Bucket=bucket, Key=key)
 log_content = response['Body'].read().decode('utf-8')
 
 # Analyze for error patterns
 error_patterns = [
 r'ERROR.*database connection failed',
 r'CRITICAL.*out of memory',
 r'FATAL.*service unavailable'
 ]
 
 incidents = []
 for pattern in error_patterns:
 matches = re.findall(pattern, log_content, re.IGNORECASE)
 if matches:
 incident = create_incident_from_log_pattern(pattern, matches, bucket, key)
 incidents.append(incident)
 
 return incidents

def handle_sns_message(event, context):
 """Process SNS messages for incident escalation"""
 
 for record in event['Records']:
 message = json.loads(record['Sns']['Message'])
 
 # Check if this is an incident escalation
 if message.get('type') == 'incident_escalation':
 escalate_incident(message['incident_id'])
 
 # Check if this is a security alert
 elif message.get('type') == 'security_alert':
 handle_security_alert(message)

def escalate_incident(incident_id):
 """Escalate incident to higher tier support"""
 
 # Get incident details
 incident = get_incident_details(incident_id)
 
 # Update incident severity
 incident['severity'] = 'HIGH'
 incident['escalated'] = True
 incident['escalation_time'] = datetime.utcnow().isoformat()
 
 # Notify escalation team
 send_escalation_notification(incident)
 
 # Update incident in database
 update_incident(incident)

4. Automated Incident Response

EC2 Instance Recovery

def handle_ec2_incident(event):
 """Automated EC2 instance incident response"""
 
 instance_id = event['detail']['instance-id']
 state = event['detail']['state']
 
 if state == 'stopped' and is_unexpected_stop(event):
 # Investigate the stop
 investigation_result = investigate_instance_stop(instance_id)
 
 if investigation_result['can_restart']:
 # Attempt automatic restart
 restart_instance(instance_id)
 
 # Monitor restart success
 monitor_instance_restart(instance_id)
 else:
 # Create incident for manual intervention
 create_manual_intervention_incident(instance_id, investigation_result)

def investigate_instance_stop(instance_id):
 """Investigate why instance stopped"""
 
 ec2 = boto3.client('ec2')
 cloudtrail = boto3.client('cloudtrail')
 
 # Get instance details
 response = ec2.describe_instances(InstanceIds=[instance_id])
 instance = response['Reservations'][0]['Instances'][0]
 
 # Check CloudTrail for stop events
 events = cloudtrail.lookup_events(
 LookupAttributes=[
 {
 'AttributeKey': 'ResourceName',
 'AttributeValue': instance_id
 }
 ],
 StartTime=datetime.utcnow() - timedelta(hours=1)
 )
 
 # Analyze stop reason
 stop_reason = instance.get('StateReason', {}).get('Message', '')
 
 # Determine if safe to restart
 can_restart = (
 'user initiated' not in stop_reason.lower() and
 'spot interruption' not in stop_reason.lower() and
 len([e for e in events['Events'] if e['EventName'] == 'StopInstances']) == 0
 )
 
 return {
 'can_restart': can_restart,
 'stop_reason': stop_reason,
 'recent_events': events['Events']
 }

def restart_instance(instance_id):
 """Restart EC2 instance"""
 
 ec2 = boto3.client('ec2')
 
 try:
 response = ec2.start_instances(InstanceIds=[instance_id])
 logger.info(f"Started instance {instance_id}")
 return response
 except Exception as e:
 logger.error(f"Failed to start instance {instance_id}: {str(e)}")
 raise e

Security Incident Automation

def handle_security_incident(event):
 """Automated security incident response"""
 
 finding = event['detail']
 severity = finding['severity']
 
 if severity >= 7.0: # High/Critical
 # Immediate isolation
 isolate_compromised_resources(finding)
 
 # Create high-priority incident
 incident = create_security_incident(finding, 'HIGH')
 
 # Notify security team immediately
 notify_security_team(incident, urgent=True)
 
 # Start forensic data collection
 start_forensic_collection(finding)
 
 elif severity >= 4.0: # Medium
 # Log and investigate
 incident = create_security_incident(finding, 'MEDIUM')
 
 # Apply automated remediation if available
 apply_security_remediation(finding)
 
 # Notify security team
 notify_security_team(incident)

def isolate_compromised_resources(finding):
 """Isolate compromised resources"""
 
 ec2 = boto3.client('ec2')
 
 # Get affected resources
 for resource in finding['service']['resourceRole'] == 'TARGET':
 if resource['resourceType'] == 'Instance':
 instance_id = resource['instanceDetails']['instanceId']
 
 # Create isolation security group
 isolation_sg = create_isolation_security_group()
 
 # Apply isolation
 ec2.modify_instance_attribute(
 InstanceId=instance_id,
 Groups=[isolation_sg]
 )
 
 logger.info(f"Isolated instance {instance_id}")

def create_isolation_security_group():
 """Create security group for isolation"""
 
 ec2 = boto3.client('ec2')
 
 # Create security group with no inbound rules
 response = ec2.create_security_group(
 GroupName=f'isolation-{int(time.time())}',
 Description='Isolation security group for compromised resources'
 )
 
 return response['GroupId']

5. Error Handling and Resilience

Retry Logic and Dead Letter Queues

def lambda_handler_with_retry(event, context):
 """Lambda handler with built-in retry logic"""
 
 max_retries = 3
 retry_count = 0
 
 while retry_count < max_retries:
 try:
 return process_event(event)
 
 except RetryableError as e:
 retry_count += 1
 logger.warning(f"Retryable error (attempt {retry_count}): {str(e)}")
 
 if retry_count >= max_retries:
 # Send to DLQ
 send_to_dlq(event, str(e))
 raise e
 
 # Exponential backoff
 time.sleep(2 ** retry_count)
 
 except FatalError as e:
 logger.error(f"Fatal error: {str(e)}")
 send_to_dlq(event, str(e))
 raise e

def send_to_dlq(event, error_message):
 """Send failed event to dead letter queue"""
 
 sqs = boto3.client('sqs')
 
 dlq_message = {
 'original_event': event,
 'error_message': error_message,
 'timestamp': datetime.utcnow().isoformat(),
 'function_name': context.function_name
 }
 
 sqs.send_message(
 QueueUrl=os.environ['DLQ_URL'],
 MessageBody=json.dumps(dlq_message)
 )

Circuit Breaker Pattern

class CircuitBreaker:
 def __init__(self, failure_threshold=5, timeout=60):
 self.failure_threshold = failure_threshold
 self.timeout = timeout
 self.failure_count = 0
 self.last_failure_time = None
 self.state = 'CLOSED'
 
 def call(self, func, *args, **kwargs):
 if self.state == 'OPEN':
 if time.time() - self.last_failure_time > self.timeout:
 self.state = 'HALF_OPEN'
 else:
 raise Exception("Circuit breaker is OPEN")
 
 try:
 result = func(*args, **kwargs)
 self.on_success()
 return result
 except Exception as e:
 self.on_failure()
 raise e
 
 def on_success(self):
 self.failure_count = 0
 self.state = 'CLOSED'
 
 def on_failure(self):
 self.failure_count += 1
 self.last_failure_time = time.time()
 
 if self.failure_count >= self.failure_threshold:
 self.state = 'OPEN'

# Global circuit breaker instance
external_api_breaker = CircuitBreaker()

def call_external_api_safely(data):
 """Call external API with circuit breaker protection"""
 return external_api_breaker.call(call_external_api, data)

6. Monitoring and Observability

CloudWatch Metrics and Alarms

def publish_custom_metrics(function_name, incident_count, response_time):
 """Publish custom metrics for incident response"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 cloudwatch.put_metric_data(
 Namespace='IncidentResponse/Lambda',
 MetricData=[
 {
 'MetricName': 'IncidentsProcessed',
 'Dimensions': [
 {
 'Name': 'FunctionName',
 'Value': function_name
 }
 ],
 'Value': incident_count,
 'Unit': 'Count'
 },
 {
 'MetricName': 'ResponseTime',
 'Dimensions': [
 {
 'Name': 'FunctionName',
 'Value': function_name
 }
 ],
 'Value': response_time,
 'Unit': 'Milliseconds'
 }
 ]
 )

X-Ray Tracing

from aws_xray_sdk.core import xray_recorder
from aws_xray_sdk.core import patch_all

# Patch AWS SDK calls
patch_all()

@xray_recorder.capture('incident_response')
def lambda_handler(event, context):
 """Lambda handler with X-Ray tracing"""
 
 # Add metadata to trace
 xray_recorder.put_metadata('event_source', event.get('source'))
 xray_recorder.put_annotation('incident_type', event.get('detail-type'))
 
 with xray_recorder.in_subsegment('process_incident'):
 result = process_incident(event)
 
 return result

@xray_recorder.capture('external_api_call')
def call_external_service(data):
 """External service call with tracing"""
 
 # This will be traced automatically
 response = requests.post('https://api.example.com/incidents', json=data)
 
 # Add response metadata
 xray_recorder.put_metadata('response_status', response.status_code)
 
 return response.json()

7. Performance Optimization

Provisioned Concurrency

# Configure provisioned concurrency
aws lambda put-provisioned-concurrency-config \
 --function-name IncidentResponseFunction \
 --qualifier '$LATEST' \
 --provisioned-concurrency-units 10

Connection Pooling

import boto3
from botocore.config import Config

# Configure connection pooling
config = Config(
 max_pool_connections=50,
 retries={'max_attempts': 3}
)

# Reuse clients outside handler
dynamodb = boto3.resource('dynamodb', config=config)
sns = boto3.client('sns', config=config)
ec2 = boto3.client('ec2', config=config)

def lambda_handler(event, context):
 """Optimized handler with connection reuse"""
 
 # Use pre-initialized clients
 table = dynamodb.Table('incidents')
 
 # Process event efficiently
 return process_incident_optimized(event, table, sns, ec2)

Memory and Timeout Optimization

# Optimize function configuration
aws lambda update-function-configuration \
 --function-name IncidentResponseFunction \
 --memory-size 1024 \
 --timeout 300 \
 --reserved-concurrent-executions 100

8. Security Best Practices

IAM Roles and Policies

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "logs:CreateLogGroup",
 "logs:CreateLogStream",
 "logs:PutLogEvents"
 ],
 "Resource": "arn:aws:logs:*:*:*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "ec2:DescribeInstances",
 "ec2:StartInstances",
 "ec2:StopInstances",
 "ec2:ModifyInstanceAttribute"
 ],
 "Resource": "*",
 "Condition": {
 "StringEquals": {
 "ec2:ResourceTag/Environment": ["Production", "Staging"]
 }
 }
 },
 {
 "Effect": "Allow",
 "Action": [
 "sns:Publish"
 ],
 "Resource": "arn:aws:sns:*:*:incident-*"
 }
 ]
}

Environment Variable Encryption

# Encrypt environment variables with KMS
aws lambda update-function-configuration \
 --function-name IncidentResponseFunction \
 --kms-key-arn "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012" \
 --environment Variables='{
 "ENCRYPTED_API_KEY":"AQICAHi...",
 "DATABASE_PASSWORD":"AQICAHi..."
 }'

9. Common Exam Scenarios

Scenario 1: Automated CloudWatch alarm response

Solution:

AWS SNS & SQS

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

Fully managed pub/sub messaging service
Push-based message delivery
Fan-out messaging to multiple subscribers
Integration with AWS services and external endpoints

Amazon SQS (Simple Queue Service)

Fully managed message queuing service
Pull-based message consumption
Decouples application components
Reliable message delivery with visibility timeout

Use Cases

SNS: Notifications, alerts, fan-out messaging
SQS: Task queues, batch processing, decoupling
Together: Reliable message processing with fan-out

Topics

Communication channels for messages
Publishers send messages to topics
Subscribers receive messages from topics
Support for standard and FIFO topics

Subscriptions

Endpoints that receive messages from topics
Multiple subscription types supported
Message filtering capabilities
Delivery retry policies

Supported Protocols

HTTP/HTTPS - Web endpoints
Email/Email-JSON - Email notifications
SMS - Text messages
SQS - Queue integration
Lambda - Function invocation
Mobile Push - iOS, Android, Windows

3. SQS Core Concepts

Queue Types

Standard Queues - At-least-once delivery, best-effort ordering
FIFO Queues - Exactly-once delivery, strict ordering
Dead Letter Queues - Failed message handling

Message Attributes

Message Body - Up to 256KB of data
Message Attributes - Metadata key-value pairs
Visibility Timeout - Message processing time
Retention Period - How long messages are kept

Polling Types

Short Polling - Immediate response (may be empty)
Long Polling - Wait for messages (up to 20 seconds)

4. Incident Response with SNS

Alert Distribution

import boto3
import json

def send_incident_alert(incident_details):
 """Send incident alert to multiple channels"""
 
 sns = boto3.client('sns')
 
 # Create alert message
 message = {
 "incident_id": incident_details['id'],
 "severity": incident_details['severity'],
 "description": incident_details['description'],
 "timestamp": incident_details['timestamp'],
 "affected_services": incident_details['services']
 }
 
 # Send to incident response topic
 response = sns.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:incident-alerts',
 Message=json.dumps(message),
 Subject=f"INCIDENT: {incident_details['severity']} - {incident_details['description']}",
 MessageAttributes={
 'severity': {
 'DataType': 'String',
 'StringValue': incident_details['severity']
 },
 'service': {
 'DataType': 'String',
 'StringValue': incident_details['primary_service']
 }
 }
 )
 
 return response

Multi-Channel Notifications

# Create incident response topic
aws sns create-topic --name "incident-alerts"

# Subscribe email for notifications
aws sns subscribe \
 --topic-arn "arn:aws:sns:us-east-1:123456789012:incident-alerts" \
 --protocol email \
 --notification-endpoint "oncall@example.com"

# Subscribe SMS for critical alerts
aws sns subscribe \
 --topic-arn "arn:aws:sns:us-east-1:123456789012:incident-alerts" \
 --protocol sms \
 --notification-endpoint "+1234567890"

# Subscribe Lambda for automated response
aws sns subscribe \
 --topic-arn "arn:aws:sns:us-east-1:123456789012:incident-alerts" \
 --protocol lambda \
 --notification-endpoint "arn:aws:lambda:us-east-1:123456789012:function:IncidentResponse"

Message Filtering

{
 "severity": ["HIGH", "CRITICAL"],
 "service": ["web-app", "database"],
 "region": ["us-east-1", "us-west-2"]
}

5. Event Processing with SQS

Reliable Event Processing

import boto3
import json

def process_incident_events():
 """Process incident events from SQS queue"""
 
 sqs = boto3.client('sqs')
 queue_url = 'https://sqs.us-east-1.amazonaws.com/123456789012/incident-events'
 
 while True:
 # Receive messages
 response = sqs.receive_message(
 QueueUrl=queue_url,
 MaxNumberOfMessages=10,
 WaitTimeSeconds=20, # Long polling
 MessageAttributeNames=['All']
 )
 
 messages = response.get('Messages', [])
 
 for message in messages:
 try:
 # Process event
 event_data = json.loads(message['Body'])
 process_incident_event(event_data)
 
 # Delete message after successful processing
 sqs.delete_message(
 QueueUrl=queue_url,
 ReceiptHandle=message['ReceiptHandle']
 )
 
 except Exception as e:
 print(f"Error processing message: {e}")
 # Message will become visible again after visibility timeout

def process_incident_event(event_data):
 """Process individual incident event"""
 
 event_type = event_data.get('event_type')
 
 if event_type == 'service_down':
 handle_service_down(event_data)
 elif event_type == 'high_error_rate':
 handle_high_error_rate(event_data)
 elif event_type == 'resource_exhaustion':
 handle_resource_exhaustion(event_data)

Dead Letter Queue Configuration

# Create main queue
aws sqs create-queue \
 --queue-name "incident-events" \
 --attributes '{
 "VisibilityTimeoutSeconds": "300",
 "MessageRetentionPeriod": "1209600",
 "ReceiveMessageWaitTimeSeconds": "20"
 }'

# Create dead letter queue
aws sqs create-queue --queue-name "incident-events-dlq"

# Configure redrive policy
aws sqs set-queue-attributes \
 --queue-url "https://sqs.us-east-1.amazonaws.com/123456789012/incident-events" \
 --attributes '{
 "RedrivePolicy": "{\"deadLetterTargetArn\":\"arn:aws:sqs:us-east-1:123456789012:incident-events-dlq\",\"maxReceiveCount\":3}"
 }'

6. SNS + SQS Integration Pattern

Fan-Out Architecture

def setup_fanout_architecture():
 """Set up SNS topic with multiple SQS subscribers"""
 
 sns = boto3.client('sns')
 sqs = boto3.client('sqs')
 
 # Create SNS topic
 topic_response = sns.create_topic(Name='incident-fanout')
 topic_arn = topic_response['TopicArn']
 
 # Create SQS queues for different processors
 queues = [
 'incident-logging',
 'incident-metrics',
 'incident-notifications',
 'incident-automation'
 ]
 
 for queue_name in queues:
 # Create queue
 queue_response = sqs.create_queue(QueueName=queue_name)
 queue_url = queue_response['QueueUrl']
 
 # Get queue ARN
 attrs = sqs.get_queue_attributes(
 QueueUrl=queue_url,
 AttributeNames=['QueueArn']
 )
 queue_arn = attrs['Attributes']['QueueArn']
 
 # Subscribe queue to topic
 sns.subscribe(
 TopicArn=topic_arn,
 Protocol='sqs',
 Endpoint=queue_arn
 )
 
 # Set queue policy to allow SNS
 set_queue_policy_for_sns(queue_url, queue_arn, topic_arn)

def set_queue_policy_for_sns(queue_url, queue_arn, topic_arn):
 """Set SQS queue policy to allow SNS to send messages"""
 
 policy = {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {"Service": "sns.amazonaws.com"},
 "Action": "sqs:SendMessage",
 "Resource": queue_arn,
 "Condition": {
 "ArnEquals": {
 "aws:SourceArn": topic_arn
 }
 }
 }
 ]
 }
 
 sqs = boto3.client('sqs')
 sqs.set_queue_attributes(
 QueueUrl=queue_url,
 Attributes={'Policy': json.dumps(policy)}
 )

7. FIFO Queues for Ordered Processing

FIFO Queue Configuration

# Create FIFO queue
aws sqs create-queue \
 --queue-name "incident-events.fifo" \
 --attributes '{
 "FifoQueue": "true",
 "ContentBasedDeduplication": "true",
 "VisibilityTimeoutSeconds": "300"
 }'

Ordered Event Processing

def send_ordered_incident_events(incident_id, events):
 """Send incident events in order using FIFO queue"""
 
 sqs = boto3.client('sqs')
 queue_url = 'https://sqs.us-east-1.amazonaws.com/123456789012/incident-events.fifo'
 
 for i, event in enumerate(events):
 response = sqs.send_message(
 QueueUrl=queue_url,
 MessageBody=json.dumps(event),
 MessageGroupId=incident_id, # Ensures ordering per incident
 MessageDeduplicationId=f"{incident_id}-{i}", # Prevents duplicates
 MessageAttributes={
 'event_type': {
 'DataType': 'String',
 'StringValue': event['type']
 },
 'sequence': {
 'DataType': 'Number',
 'StringValue': str(i)
 }
 }
 )

8. Monitoring and Alerting

CloudWatch Metrics

def monitor_queue_metrics():
 """Monitor SQS queue metrics for incident response"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Create alarm for queue depth
 cloudwatch.put_metric_alarm(
 AlarmName='IncidentQueueDepthHigh',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=2,
 MetricName='ApproximateNumberOfVisibleMessages',
 Namespace='AWS/SQS',
 Period=300,
 Statistic='Average',
 Threshold=100,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:queue-alerts'
 ],
 AlarmDescription='Incident queue depth is high',
 Dimensions=[
 {
 'Name': 'QueueName',
 'Value': 'incident-events'
 }
 ]
 )
 
 # Create alarm for message age
 cloudwatch.put_metric_alarm(
 AlarmName='IncidentMessageAgeHigh',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=1,
 MetricName='ApproximateAgeOfOldestMessage',
 Namespace='AWS/SQS',
 Period=300,
 Statistic='Maximum',
 Threshold=600, # 10 minutes
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:queue-alerts'
 ],
 Dimensions=[
 {
 'Name': 'QueueName',
 'Value': 'incident-events'
 }
 ]
 )

Custom Metrics

def publish_custom_metrics(queue_name, processed_count, error_count):
 """Publish custom metrics for incident processing"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Publish processing metrics
 cloudwatch.put_metric_data(
 Namespace='IncidentResponse',
 MetricData=[
 {
 'MetricName': 'ProcessedEvents',
 'Dimensions': [
 {
 'Name': 'QueueName',
 'Value': queue_name
 }
 ],
 'Value': processed_count,
 'Unit': 'Count'
 },
 {
 'MetricName': 'ProcessingErrors',
 'Dimensions': [
 {
 'Name': 'QueueName',
 'Value': queue_name
 }
 ],
 'Value': error_count,
 'Unit': 'Count'
 }
 ]
 )

9. Security and Access Control

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "AllowIncidentServices",
 "Effect": "Allow",
 "Principal": {
 "AWS": [
 "arn:aws:iam::123456789012:role/IncidentDetectionRole",
 "arn:aws:iam::123456789012:role/MonitoringRole"
 ]
 },
 "Action": "sns:Publish",
 "Resource": "arn:aws:sns:us-east-1:123456789012:incident-alerts"
 },
 {
 "Sid": "AllowCrossAccountSubscription",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111122223333:root"
 },
 "Action": "sns:Subscribe",
 "Resource": "arn:aws:sns:us-east-1:123456789012:incident-alerts"
 }
 ]
}

SQS Queue Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "AllowIncidentProcessors",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::123456789012:role/IncidentProcessorRole"
 },
 "Action": [
 "sqs:ReceiveMessage",
 "sqs:DeleteMessage",
 "sqs:GetQueueAttributes"
 ],
 "Resource": "arn:aws:sqs:us-east-1:123456789012:incident-events"
 }
 ]
}

Encryption Configuration

# Create encrypted SNS topic
aws sns create-topic \
 --name "secure-incident-alerts" \
 --attributes '{
 "KmsMasterKeyId": "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
 }'

# Create encrypted SQS queue
aws sqs create-queue \
 --queue-name "secure-incident-events" \
 --attributes '{
 "KmsMasterKeyId": "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012",
 "KmsDataKeyReusePeriodSeconds": "300"
 }'

10. Error Handling and Resilience

Retry Logic

import time
import random
from botocore.exceptions import ClientError

def send_message_with_retry(queue_url, message, max_retries=3):
 """Send SQS message with exponential backoff retry"""
 
 sqs = boto3.client('sqs')
 
 for attempt in range(max_retries + 1):
 try:
 response = sqs.send_message(
 QueueUrl=queue_url,
 MessageBody=json.dumps(message)
 )
 return response
 
 except ClientError as e:
 if attempt == max_retries:
 raise e
 
 # Exponential backoff with jitter
 wait_time = (2 ** attempt) + random.uniform(0, 1)
 time.sleep(wait_time)

Circuit Breaker Pattern

class CircuitBreaker:
 def __init__(self, failure_threshold=5, timeout=60):
 self.failure_threshold = failure_threshold
 self.timeout = timeout
 self.failure_count = 0
 self.last_failure_time = None
 self.state = 'CLOSED' # CLOSED, OPEN, HALF_OPEN
 
 def call(self, func, *args, **kwargs):
 if self.state == 'OPEN':
 if time.time() - self.last_failure_time > self.timeout:
 self.state = 'HALF_OPEN'
 else:
 raise Exception("Circuit breaker is OPEN")
 
 try:
 result = func(*args, **kwargs)
 self.on_success()
 return result
 except Exception as e:
 self.on_failure()
 raise e
 
 def on_success(self):
 self.failure_count = 0
 self.state = 'CLOSED'
 
 def on_failure(self):
 self.failure_count += 1
 self.last_failure_time = time.time()
 
 if self.failure_count >= self.failure_threshold:
 self.state = 'OPEN'

11. Performance Optimization

Batch Operations

def send_messages_batch(queue_url, messages):
 """Send multiple messages in batch for better performance"""
 
 sqs = boto3.client('sqs')
 
 # SQS supports up to 10 messages per batch
 batch_size = 10
 
 for i in range(0, len(messages), batch_size):
 batch = messages[i:i + batch_size]
 
 entries = []
 for j, message in enumerate(batch):
 entries.append({
 'Id': str(j),
 'MessageBody': json.dumps(message)
 })
 
 response = sqs.send_message_batch(
 QueueUrl=queue_url,
 Entries=entries
 )
 
 # Handle failed messages
 if 'Failed' in response:
 for failed in response['Failed']:
 print(f"Failed to send message {failed['Id']}: {failed['Message']}")

def receive_messages_batch(queue_url):
 """Receive multiple messages for efficient processing"""
 
 sqs = boto3.client('sqs')
 
 response = sqs.receive_message(
 QueueUrl=queue_url,
 MaxNumberOfMessages=10, # Maximum batch size
 WaitTimeSeconds=20, # Long polling
 MessageAttributeNames=['All']
 )
 
 return response.get('Messages', [])

12. Common Exam Scenarios

Scenario 1: Implement incident notification system

Solution:

AWS Step Functions

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is Step Functions?

Serverless orchestration service for coordinating AWS services
Visual workflow designer for complex business logic
State machine-based execution model
Built-in error handling and retry mechanisms

Key Benefits

Visual Workflows - Easy to understand and maintain
Serverless - No infrastructure to manage
Fault Tolerant - Built-in error handling and retries
Scalable - Handles thousands of concurrent executions
Cost Effective - Pay per state transition

Use Cases for Incident Response

Orchestrating complex incident response workflows
Coordinating multiple remediation actions
Managing escalation procedures
Automating disaster recovery processes
Coordinating cross-service incident handling

2. State Machine Types

Standard Workflows

Long-running workflows (up to 1 year)
Exactly-once execution model
Full execution history and visual debugging
Higher cost per state transition

Express Workflows

Short-duration, high-volume workflows (up to 5 minutes)
At-least-once execution model
Optimized for high event rates
Lower cost per execution

{
 "Comment": "Incident Response Workflow",
 "StartAt": "DetectIncident",
 "States": {
 "DetectIncident": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:DetectIncident",
 "Next": "ClassifyIncident"
 },
 "ClassifyIncident": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:ClassifyIncident",
 "Next": "RouteByPriority"
 },
 "RouteByPriority": {
 "Type": "Choice",
 "Choices": [
 {
 "Variable": "$.priority",
 "StringEquals": "HIGH",
 "Next": "HighPriorityResponse"
 },
 {
 "Variable": "$.priority",
 "StringEquals": "MEDIUM",
 "Next": "MediumPriorityResponse"
 }
 ],
 "Default": "LowPriorityResponse"
 }
 }
}

3. State Types

Task States

{
 "InvestigateIncident": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:InvestigateIncident",
 "Parameters": {
 "incidentId.$": "$.incidentId",
 "severity.$": "$.severity"
 },
 "ResultPath": "$.investigation",
 "Retry": [
 {
 "ErrorEquals": ["States.TaskFailed"],
 "IntervalSeconds": 2,
 "MaxAttempts": 3,
 "BackoffRate": 2.0
 }
 ],
 "Catch": [
 {
 "ErrorEquals": ["States.ALL"],
 "Next": "HandleInvestigationFailure",
 "ResultPath": "$.error"
 }
 ],
 "Next": "DetermineResponse"
 }
}

Choice States

{
 "DetermineResponse": {
 "Type": "Choice",
 "Choices": [
 {
 "And": [
 {
 "Variable": "$.severity",
 "StringEquals": "CRITICAL"
 },
 {
 "Variable": "$.investigation.autoRemediationAvailable",
 "BooleanEquals": true
 }
 ],
 "Next": "AutomatedRemediation"
 },
 {
 "Variable": "$.severity",
 "StringEquals": "CRITICAL",
 "Next": "ManualEscalation"
 },
 {
 "Variable": "$.investigation.knownIssue",
 "BooleanEquals": true,
 "Next": "ApplyKnownFix"
 }
 ],
 "Default": "CreateTicket"
 }
}

Parallel States

{
 "ParallelRemediation": {
 "Type": "Parallel",
 "Branches": [
 {
 "StartAt": "RestartServices",
 "States": {
 "RestartServices": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:RestartServices",
 "End": true
 }
 }
 },
 {
 "StartAt": "ScaleResources",
 "States": {
 "ScaleResources": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:ScaleResources",
 "End": true
 }
 }
 },
 {
 "StartAt": "NotifyTeams",
 "States": {
 "NotifyTeams": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:NotifyTeams",
 "End": true
 }
 }
 }
 ],
 "Next": "VerifyRemediation"
 }
}

Wait States

{
 "WaitForCooldown": {
 "Type": "Wait",
 "Seconds": 300,
 "Next": "CheckSystemHealth"
 },
 "WaitUntilScheduledMaintenance": {
 "Type": "Wait",
 "TimestampPath": "$.scheduledMaintenanceTime",
 "Next": "PerformMaintenance"
 }
}

4. Incident Response Workflows

Complete Incident Response State Machine

{
 "Comment": "Comprehensive Incident Response Workflow",
 "StartAt": "ReceiveAlert",
 "States": {
 "ReceiveAlert": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:ProcessAlert",
 "Next": "CheckDuplicates"
 },
 "CheckDuplicates": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:CheckDuplicateIncidents",
 "Next": "IsDuplicate"
 },
 "IsDuplicate": {
 "Type": "Choice",
 "Choices": [
 {
 "Variable": "$.isDuplicate",
 "BooleanEquals": true,
 "Next": "MergeWithExisting"
 }
 ],
 "Default": "CreateNewIncident"
 },
 "MergeWithExisting": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:MergeIncidents",
 "End": true
 },
 "CreateNewIncident": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:CreateIncident",
 "Next": "AssignSeverity"
 },
 "AssignSeverity": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:AssignSeverity",
 "Next": "InitialResponse"
 },
 "InitialResponse": {
 "Type": "Parallel",
 "Branches": [
 {
 "StartAt": "SendNotifications",
 "States": {
 "SendNotifications": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:SendNotifications",
 "End": true
 }
 }
 },
 {
 "StartAt": "GatherDiagnostics",
 "States": {
 "GatherDiagnostics": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:GatherDiagnostics",
 "End": true
 }
 }
 }
 ],
 "Next": "DetermineResponseStrategy"
 },
 "DetermineResponseStrategy": {
 "Type": "Choice",
 "Choices": [
 {
 "Variable": "$.severity",
 "StringEquals": "P1",
 "Next": "CriticalIncidentResponse"
 },
 {
 "Variable": "$.severity",
 "StringEquals": "P2",
 "Next": "HighIncidentResponse"
 }
 ],
 "Default": "StandardIncidentResponse"
 },
 "CriticalIncidentResponse": {
 "Type": "Parallel",
 "Branches": [
 {
 "StartAt": "ActivateWarRoom",
 "States": {
 "ActivateWarRoom": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:ActivateWarRoom",
 "End": true
 }
 }
 },
 {
 "StartAt": "NotifyExecutives",
 "States": {
 "NotifyExecutives": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:NotifyExecutives",
 "End": true
 }
 }
 },
 {
 "StartAt": "AttemptAutoRemediation",
 "States": {
 "AttemptAutoRemediation": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:AttemptAutoRemediation",
 "End": true
 }
 }
 }
 ],
 "Next": "MonitorResolution"
 },
 "MonitorResolution": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:MonitorResolution",
 "Next": "IsResolved"
 },
 "IsResolved": {
 "Type": "Choice",
 "Choices": [
 {
 "Variable": "$.isResolved",
 "BooleanEquals": true,
 "Next": "CloseIncident"
 }
 ],
 "Default": "EscalateOrWait"
 },
 "EscalateOrWait": {
 "Type": "Choice",
 "Choices": [
 {
 "Variable": "$.escalationNeeded",
 "BooleanEquals": true,
 "Next": "EscalateIncident"
 }
 ],
 "Default": "WaitAndRecheck"
 },
 "WaitAndRecheck": {
 "Type": "Wait",
 "Seconds": 300,
 "Next": "MonitorResolution"
 },
 "EscalateIncident": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:EscalateIncident",
 "Next": "MonitorResolution"
 },
 "CloseIncident": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:CloseIncident",
 "Next": "PostIncidentTasks"
 },
 "PostIncidentTasks": {
 "Type": "Parallel",
 "Branches": [
 {
 "StartAt": "GenerateReport",
 "States": {
 "GenerateReport": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:GenerateIncidentReport",
 "End": true
 }
 }
 },
 {
 "StartAt": "SchedulePostmortem",
 "States": {
 "SchedulePostmortem": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:SchedulePostmortem",
 "End": true
 }
 }
 }
 ],
 "End": true
 }
 }
}

5. Error Handling and Retries

Retry Configuration

{
 "CallExternalAPI": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:CallExternalAPI",
 "Retry": [
 {
 "ErrorEquals": ["Lambda.ServiceException", "Lambda.AWSLambdaException"],
 "IntervalSeconds": 2,
 "MaxAttempts": 6,
 "BackoffRate": 2.0
 },
 {
 "ErrorEquals": ["States.TaskFailed"],
 "IntervalSeconds": 1,
 "MaxAttempts": 3,
 "BackoffRate": 1.5
 }
 ],
 "Catch": [
 {
 "ErrorEquals": ["States.ALL"],
 "Next": "HandleAPIFailure",
 "ResultPath": "$.error"
 }
 ],
 "Next": "ProcessAPIResponse"
 }
}

Error Handling Patterns

def lambda_handler(event, context):
 """Lambda function with Step Functions error handling"""
 
 try:
 # Process the incident
 result = process_incident(event)
 
 return {
 'statusCode': 200,
 'success': True,
 'result': result
 }
 
 except RetryableError as e:
 # This will trigger Step Functions retry
 raise Exception(f"Retryable error: {str(e)}")
 
 except FatalError as e:
 # This will be caught by Step Functions catch block
 return {
 'statusCode': 500,
 'success': False,
 'error': str(e),
 'errorType': 'FatalError'
 }

6. Integration Patterns

Service Integration Patterns

{
 "SendSNSNotification": {
 "Type": "Task",
 "Resource": "arn:aws:states:::sns:publish",
 "Parameters": {
 "TopicArn": "arn:aws:sns:us-east-1:123456789012:incident-alerts",
 "Message.$": "$.notificationMessage",
 "Subject": "Incident Alert"
 },
 "Next": "WaitForAcknowledgment"
 },
 "StartECSTask": {
 "Type": "Task",
 "Resource": "arn:aws:states:::ecs:runTask.sync",
 "Parameters": {
 "TaskDefinition": "incident-response-task",
 "Cluster": "incident-response-cluster",
 "LaunchType": "FARGATE"
 },
 "Next": "CheckTaskResult"
 },
 "InvokeStepFunction": {
 "Type": "Task",
 "Resource": "arn:aws:states:::states:startExecution.sync",
 "Parameters": {
 "StateMachineArn": "arn:aws:states:us-east-1:123456789012:stateMachine:SubWorkflow",
 "Input.$": "$"
 },
 "Next": "ProcessSubWorkflowResult"
 }
}

Map State for Parallel Processing

{
 "ProcessMultipleIncidents": {
 "Type": "Map",
 "ItemsPath": "$.incidents",
 "MaxConcurrency": 5,
 "Iterator": {
 "StartAt": "ProcessSingleIncident",
 "States": {
 "ProcessSingleIncident": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:ProcessIncident",
 "End": true
 }
 }
 },
 "Next": "AggregateResults"
 }
}

7. Monitoring and Observability

CloudWatch Integration

def monitor_step_function_executions():
 """Monitor Step Functions executions"""
 
 stepfunctions = boto3.client('stepfunctions')
 cloudwatch = boto3.client('cloudwatch')
 
 # Get execution history
 executions = stepfunctions.list_executions(
 stateMachineArn='arn:aws:states:us-east-1:123456789012:stateMachine:IncidentResponse',
 statusFilter='FAILED'
 )
 
 # Analyze failed executions
 for execution in executions['executions']:
 execution_arn = execution['executionArn']
 
 # Get execution details
 details = stepfunctions.describe_execution(executionArn=execution_arn)
 
 # Get execution history for error analysis
 history = stepfunctions.get_execution_history(executionArn=execution_arn)
 
 # Find failure events
 failure_events = [
 event for event in history['events']
 if event['type'] in ['TaskFailed', 'ExecutionFailed']
 ]
 
 # Publish custom metrics
 cloudwatch.put_metric_data(
 Namespace='StepFunctions/IncidentResponse',
 MetricData=[
 {
 'MetricName': 'ExecutionFailures',
 'Value': 1,
 'Unit': 'Count',
 'Dimensions': [
 {
 'Name': 'StateMachine',
 'Value': 'IncidentResponse'
 }
 ]
 }
 ]
 )

X-Ray Tracing

{
 "Comment": "State machine with X-Ray tracing",
 "StartAt": "ProcessIncident",
 "States": {
 "ProcessIncident": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:ProcessIncident",
 "Parameters": {
 "input.$": "$",
 "_X_AMZN_TRACE_ID.$": "$$.Execution.Input._X_AMZN_TRACE_ID"
 },
 "End": true
 }
 }
}

8. Security and Access Control

IAM Roles for Step Functions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "lambda:InvokeFunction"
 ],
 "Resource": [
 "arn:aws:lambda:us-east-1:123456789012:function:ProcessIncident*",
 "arn:aws:lambda:us-east-1:123456789012:function:SendNotification*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "sns:Publish"
 ],
 "Resource": [
 "arn:aws:sns:us-east-1:123456789012:incident-*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "ecs:RunTask",
 "ecs:DescribeTasks"
 ],
 "Resource": "*",
 "Condition": {
 "StringEquals": {
 "ecs:cluster": "incident-response-cluster"
 }
 }
 }
 ]
}

Resource-Based Policies

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "AllowCrossAccountExecution",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111122223333:role/IncidentResponseRole"
 },
 "Action": "states:StartExecution",
 "Resource": "arn:aws:states:us-east-1:123456789012:stateMachine:IncidentResponse"
 }
 ]
}

9. Performance Optimization

Optimizing State Machine Design

def optimize_state_machine_performance():
 """Best practices for Step Functions performance"""
 
 # 1. Minimize state transitions
 # Combine simple operations into single Lambda functions
 
 # 2. Use Express Workflows for high-volume, short-duration workflows
 # 3. Implement proper error handling to avoid unnecessary retries
 # 4. Use Map state for parallel processing
 # 5. Optimize Lambda function cold starts
 
 optimized_design = {
 "Comment": "Optimized incident response workflow",
 "StartAt": "BatchProcessIncidents",
 "States": {
 "BatchProcessIncidents": {
 "Type": "Map",
 "ItemsPath": "$.incidents",
 "MaxConcurrency": 10,
 "Iterator": {
 "StartAt": "ProcessIncidentBatch",
 "States": {
 "ProcessIncidentBatch": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:ProcessIncidentBatch",
 "Retry": [
 {
 "ErrorEquals": ["States.TaskFailed"],
 "IntervalSeconds": 1,
 "MaxAttempts": 2,
 "BackoffRate": 2.0
 }
 ],
 "End": True
 }
 }
 },
 "End": True
 }
 }
 }
 
 return optimized_design

10. Common Exam Scenarios

Scenario 1: Orchestrate multi-step incident response

Solution:

ChatOps (Amazon Q Developer in Chat Applications)

Sun, 04 Oct 2026 00:00:00 +0000

What it is: Operate AWS from Slack or Microsoft Teams. Important rename: AWS Chatbot became “Amazon Q Developer in chat applications” on Feb 19, 2025 — same service, same functionality, new name. The repo’s single mention still uses the old name.

Exam-testable facts:

Notifications in chat: CloudWatch alarms, CodePipeline manual approvals, GuardDuty findings (via EventBridge → SNS → chat client) land in the channel where responders already are.
Run commands from chat: @Amazon Q followed by AWS CLI commands (invoke Lambda, pull diagnostics), natural-language questions about resources, and interactive message buttons (approve/deny).
Incident response: integrates with Incident Manager — responders collaborate in the channel and their actions are visible in real time.
Support cases: create and manage AWS Support cases from chat.
Permissions: IAM controls who can do what from chat (read-only vs command execution via guardrail policies on the SNS-to-chat mapping).
Regional footprint: the console works only in us-east-2 (Ohio); APIs in us-east-2, us-west-2, ap-southeast-1, eu-west-1.

Common traps:

EventBridge Scheduler

Sun, 04 Oct 2026 00:00:00 +0000

What it is: The purpose-built serverless scheduler — cron, rate, or one-time invocation of 200+ AWS API targets. For “run X on a schedule,” this has replaced CloudWatch Events scheduled rules as the recommended answer.

Exam-testable facts:

Occurrence types: one-time (at(...) timestamp) or recurring (cron or rate expression).
Flexible time windows: OFF, or FLEXIBLE with a 1–1440 minute window — the invocation lands somewhere inside the window, which smooths out thundering-herd load and cost.
Schedule groups: tag and organize schedules as a set.
Timeframes: timezone-aware evaluation plus optional start/end dates (start date is ignored for one-time schedules).
Reliability: per-target retry policy and an SQS dead-letter queue for failed invocations.
Permissions: the scheduler assumes an execution role to invoke the target — the role, not the schedule creator, needs target permissions.

Common traps:

Incident Manager Concepts

Sun, 04 Oct 2026 00:00:00 +0000

⚠️ Status caveat (verified): AWS Systems Manager Incident Manager is closed to new customers — existing customers continue normally. Learn the concepts and workflow (the exam tests the response model, not new provisioning); do not present it as a service a new team would adopt today.

What it is: Incident-response orchestration: who gets paged, what runs automatically, where responders collaborate, and how you learn afterward.

Exam-testable facts:

Contacts: individuals with engagement channels (email, SMS, voice). On-call schedules rotate contacts (up to 30 per rotation) so there’s always an owner.
Escalation plans: staged paging — notify stage 1, wait N minutes, escalate to stage 2. Nobody waits on one silent phone.
Response plans: the master playbook launched at incident start — engagements + runbooks + chat channel + an incident template (title, impact rating, dedupe string, tags).
Runbooks: SSM Automation documents mixing automated steps with manual ones.
Chat channels: responders collaborate in Slack/Teams/Chime; every responder action is visible in the channel in real time.
Post-incident analysis: timeline, metrics, and action items (tracked as OpsItems) to harden runbooks and response plans.
Trigger path: CloudWatch alarm or EventBridge rule → start incident from a response plan. The dedupe string stops a flapping alarm from spawning duplicate incidents.
Multi-Region replication set recommended so incident data survives a Regional outage.

Common traps:

Domain 5: Incident and Event Response on Album69

Amazon EventBridge

1. Overview

What is EventBridge?

Key Components

Use Cases

2. Event Buses

Default Event Bus

Custom Event Buses

Partner Event Buses

3. Events and Event Patterns

Event Structure

Event Patterns

Custom Events

4. Rules and Targets

Create Rule

Rule Targets

Supported Targets

5. Incident Response Automation

Automated EC2 Response

Security Incident Response

6. Application Integration Patterns

Microservices Communication

Cross-Account Event Routing

7. Monitoring and Observability

EventBridge Metrics

Dead Letter Queues

8. Schema Registry

Event Schema Management

Schema Discovery

9. Error Handling and Retry

Retry Configuration

Error Handling Patterns

10. Performance Optimization

Batch Processing

Connection Pooling

11. Common Exam Scenarios

Scenario 1: Automate incident response for failed deployments

Amazon EventBridge Pipes

1. Overview

AWS CloudWatch Alarms

1. Overview

What are CloudWatch Alarms?

Key Components

Use Cases for Incident Response

2. Alarm States and Transitions

Alarm States

State Transitions

3. Metric-Based Alarms

EC2 Instance Monitoring

Application Load Balancer Monitoring

RDS Database Monitoring

4. Composite Alarms

Multi-Metric Monitoring

Complex Logic Alarms

5. Custom Metrics and Alarms

Application Metrics

6. Alarm Actions and Automation

SNS Integration

Auto Scaling Integration

Lambda Integration

7. Anomaly Detection

Anomaly Detector Alarms

8. Monitoring and Troubleshooting

Alarm History

Alarm Effectiveness Metrics

9. Cost Optimization

Alarm Cost Management

10. Common Exam Scenarios

Scenario 1: High CPU utilization incident response

AWS Lambda

1. Overview

What is Lambda?

Key Benefits

Use Cases for Incident Response

2. Lambda Function Basics

Function Configuration

Environment Variables

3. Event Sources and Triggers

CloudWatch Events/EventBridge