Event-Driven Auto-Remediation and Observability System on AWS A complete event-driven DevOps solution on AWS that automatically detects
and remediates non-compliant security groups using a fully serverless, fan-out architecture.
Service
Role
AWS Config Detects non-compliant security groups (unrestricted SSH)
Amazon EventBridge Routes compliance events via fan-out to 3 targets
Amazon SQS Stores audit trail of all compliance events
Amazon Kinesis Streams events for real-time analytics
AWS Step Functions Orchestrates the remediation workflow
AWS Lambda Evaluates events and sends notifications
AWS Systems Manager Automatically removes the non-compliant SSH rule
Amazon CloudWatch Logs, metrics, and alarms
AWS X-Ray End-to-end distributed tracing
Amazon SNS Alert notifications
EC2 Security Group (port 22 open to 0.0.0.0/0)
│
▼
AWS Config Rule (restricted-ssh) → NON_COMPLIANT
│
▼
Amazon EventBridge (ConfigNonCompliantRule)
│
Fan-Out (3 targets simultaneously)
┌──────┼──────────────┐
▼ ▼ ▼
Amazon Amazon AWS Step Functions
SQS Kinesis CapstoneAutoRemediation
(audit) (stream) │
┌────┴─────┐
▼ ▼
Lambda SSM Automation
(Evaluator) (Removes SSH rule)
│
▼
Lambda (Notifier) → SNS → Email
│
CloudWatch + X-Ray
(Logs, Metrics, Traces)
Resource
Name
Region
Config Rule
restricted-sshus-east-1
S3 Bucket
config-bucket-508471420037us-east-1
SQS Queue
capstone-audit-queueus-east-1
SQS DLQ
capstone-audit-dlqus-east-1
Kinesis Stream
capstone-event-streamus-east-1
Lambda
CapstoneEvaluatorus-east-1
Lambda
CapstoneNotifierus-east-1
Step Functions
CapstoneAutoRemediationus-east-1
EventBridge Rule
ConfigNonCompliantRuleus-east-1
SNS Topic
capstone-alertsus-east-1
CloudWatch Alarm
CapstoneLambdaErrorAlarmus-east-1
CloudWatch Alarm
CapstoneHighCPUAlarmus-east-1
CloudWatch Alarm
CapstoneSQSDepthAlarmus-east-1
capstone-aws-remediation/
├── README.md
├── lambda/
│ ├── evaluator/lambda.py # Evaluator Lambda
│ └── notifier/lambda.py # Notifier Lambda
├── step-functions/
│ └── state-machine.json # Full workflow with real ARNs
├── eventbridge/
│ └── event-pattern.json # EventBridge rule pattern
├── config/
│ └── config-rule.json # AWS Config rule
├── monitoring/
│ └── cloudwatch-alarm.json # CloudWatch alarms
├── iac/
│ └── iam-roles.json # All IAM roles with real ARNs
├── scripts/
│ ├── 00-prerequisites.sh
│ ├── 01-setup-config.sh
│ ├── 02-setup-sqs.sh
│ ├── 03-setup-kinesis.sh
│ ├── 04-deploy-lambda.sh
│ ├── 05-setup-stepfunctions.sh
│ ├── 06-setup-eventbridge.sh
│ ├── 07-setup-monitoring.sh
│ ├── 08-test-scenario.sh
│ └── 09-cleanup.sh
└── docs/
├── architecture.md
└── screenshots/ # 17 evidence screenshots
[Evaluate] → [IsRemediationRequired?]
│
┌──────┴──────┐
YES│ │NO
▼ ▼
[Remediate] [AlreadyCompliant ✓]
│
▼
[Notify]
│
▼
[RemediationComplete ✓]
On any error → [HandleError] → SNS alert → [WorkflowFailed ✗]
AWS Config - Detecting NON_COMPLIANT Security Group
EventBridge - Fan-Out Rule with 3 Targets
Step Functions - Full Green Execution
Security Group BEFORE Remediation (Port 22 Open)
Security Group AFTER Remediation (SSH Rule Removed)
SQS - Real Config Event Received
CloudWatch - Lambda Logs with X-Ray TraceId
X-Ray - Full End-to-End Trace Map
CloudWatch Alarms - All OK
See docs/screenshots/README.md for all 17 screenshots with full descriptions.
Test
Result
Config detected NON_COMPLIANT SG
sg-0a2b05376ee94d9de
EventBridge fired real aws.config event
SQS received real Config event
Message body verified
Kinesis received 1 record
RecordCount=1
Step Functions executed successfully
All states green
Lambda CloudWatch logs generated
4 invocations logged
X-Ray traces captured
Full trace map visible
SSM removed SSH rule automatically
Empty inbound rules
CloudWatch alarms active
3 alarms in OK state
X-Ray SDK - use Lambda's built-in Active tracing mode instead of importing aws_xray_sdk to avoid ImportModuleError on Python 3.13SSM PassRole - Step Functions role needs iam:PassRole permission on the SSM automation roleEventBridge source - aws.config is a reserved source; only real Config events can use itSSM trust policy - must allow both ssm.amazonaws.com AND the Step Functions role ARN to assume itConfig evaluation - use start-config-rules-evaluation to force immediate evaluation
bash scripts/09-cleanup.sh