AWS DevOps Professional Guide

examples/lambda-handler.py""" AWS Lambda — Auto-Remediation Handler ====================================== This Lambda function demonstrates automated incident response, a key topic on the DOP-C02 exam. It handles three common scenarios: 1. Security Group opened to 0.0.0.0/0 → Automatically revokes the rule 2. S3 bucket made public → Automatically re-enables block public access 3. IAM access key older than 90 days → Automatically deactivates the key The function is triggered by EventBridge rules that match specific AWS API calls captured by CloudTrail. Exam Tips: - EventBridge + Lambda is THE pattern for automated remediation - CloudTrail logs API calls → EventBridge matches patterns → Lambda remediates - Config Rules can also trigger Lambda remediation (SSM Automation preferred) - Always log actions to CloudWatch for audit trail - Consider dry-run mode for safety in initial deployments - SNS notification after remediation is best practice Architecture: CloudTrail → EventBridge Rule → Lambda Function → AWS API (remediation) → SNS (notification) → CloudWatch Logs (audit) Environment Variables (set in Lambda configuration): - SNS_TOPIC_ARN: ARN of the SNS topic for notifications - DRY_RUN: Set to "true" to log actions without executing them - ALLOWED_CIDRS: Comma-separated list of allowed CIDR blocks Usage: Deploy this function and create EventBridge rules to trigger it. See the inline comments for the exact EventBridge event patterns. License: MIT """ from __future__ import annotations