> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Summary of Domain 5 Incident and Event Response

> Summary of AWS DevOps Engineer Professional Domain 5 covering event and incident response including detection, routing, automated remediation, observability, recovery, and resilience validation

Welcome back, students.

This article summarizes Domain 5 of the AWS Certified DevOps Engineer — Professional exam. Domain 5 covers event and incident response: detecting events, routing them, automating remediation, and performing reliable recovery. Domain 5 is about 14% of the exam (roughly nine questions). Key themes include event sources, event routing, automated and manual remediation patterns, observability for troubleshooting, and resilience validation.

If any topic below is unfamiliar, review your notes or check [notes.kodekloud.com](https://notes.kodekloud.com/index.md) for deeper explanations and examples.

![A presentation slide titled "Domain 5 at a Glance" with three labeled boxes. The boxes summarize Exam Weight (14% ≈ 9 questions), Key Themes (event sources, routing, automated response, troubleshooting), and Core Focus (incident response, remediation, recovery).](https://mintcdn.com/kodekloud-c4ac6d9a/T-jO1evnEtyHSiTN/images/AWS-Certified-DevOps-Engineer-Professional/Summary/Summary-of-Domain-5-Incident-and-Event-Response/domain5-glance-incident-response-remediation.jpg?fit=max\&auto=format\&n=T-jO1evnEtyHSiTN\&q=85\&s=e86d99127d7fc42527c4a084a3d9e578)

Core services and their primary roles

* Amazon EventBridge — centralized event router: event bus, pattern matching, routing, cross-account event flows.
* AWS Systems Manager (SSM) — execution and operational orchestration: Automation documents, Run Command, Session Manager, OpsCenter, Incident Manager.
* AWS Health — account-specific health events and public service status (Personal Health Dashboard, Service Health Dashboard, Health API).
* AWS Config — continuous configuration tracking, drift detection, managed/custom rules, conformance packs, and auto-remediation triggers.
* AWS Fault Injection Simulator (FIS) — controlled chaos experiments for validating resilience.

Use-case mapping (quick reference)

| Service | Primary use case | Typical integration |
| - | - | - |
| Amazon EventBridge | Central event router, pattern-based routing, cross-account events | Routes to Lambda, Step Functions, SSM, SNS, SQS, API Destinations |
| AWS Systems Manager | Automated remediation and operations | Runs SSM Automation, Run Command, Session Manager, OpsCenter |
| AWS Health | Detect service outages and account-impacting events | Publishes to EventBridge, integrates with Health API |
| AWS Config | Detect configuration drift and compliance violations | Triggers rules and SSM Automation for remediation |
| AWS Fault Injection Simulator (FIS) | Chaos/chaotic-failure testing for resilience | Integrates with CloudWatch and EventBridge for stop conditions and events |

Remember:

* Which service detects AWS infrastructure/service issues? AWS Health.
* Which service routes events and triggers responses? EventBridge.
* Which service tracks configuration and compliance? AWS Config.
* Which service performs controlled chaos testing? AWS Fault Injection Simulator.

![A slide titled "Core Services Quick Reference" showing five AWS service icons and names: Amazon EventBridge, AWS Systems Manager, AWS Health, AWS Config, and AWS Fault Injection Simulator. A small note at the bottom briefly explains a "Memory Trigger" mapping for those services.](https://mintcdn.com/kodekloud-c4ac6d9a/T-jO1evnEtyHSiTN/images/AWS-Certified-DevOps-Engineer-Professional/Summary/Summary-of-Domain-5-Incident-and-Event-Response/aws-core-services-quick-reference.jpg?fit=max\&auto=format\&n=T-jO1evnEtyHSiTN\&q=85\&s=725bdccc648d7a6f3b93dbf592491644)

Event sources, patterns, and common targets
EventBridge accepts events from many AWS services and custom applications. Common event sources:

* CloudTrail — management plane API calls (who did what, when).
* AWS Config — configuration change notifications and rule evaluations.
* AWS Health — service or account-impacting events.
* CloudWatch Alarms & Logs — metric alarms and log-based events.
* GuardDuty — security findings.
* Custom applications via PutEvents or API Destinations.

EventBridge evaluates incoming events against event patterns (supports exact matches, prefixes, numeric ranges, existence checks). When a rule matches, EventBridge routes the event to one or more targets:

Typical EventBridge targets:

* Lambda — lightweight remediation or enrichment.
* Step Functions — orchestrated, multi-step workflows with approval gates.
* Systems Manager (SSM) Automation or Run Command — execute remediation across instances.
* SNS/SQS — fan-out or durable queuing for teams and systems.
* Cross-account event buses — centralized or multi-account pipelines.

EventBridge supports cross-account routing using event buses plus resource-based policies, enabling centralized monitoring and cross-account incident workflows.

EventBridge often routes to Systems Manager to execute automated remediations (Automation documents or Run Command), or to Step Functions and Lambda for more complex orchestration.

Systems Manager: operational tooling for incident response
Key Systems Manager features used in incident response:

* Automation — reusable, versioned runbooks (Automation documents) for remediation and standard work.
* Run Command — execute commands across EC2 and on-prem instances securely and at scale.
* Session Manager — interactive, auditable shell access without opening inbound ports.
* OpsCenter — aggregate and track operational items (OpsItems) for investigation.
* Incident Manager — create response plans, contact schedules, and escalation workflows.

Typical automated flow: EventBridge triggers an SSM Automation document → SSM executes remediation steps → OpsCenter/Incident Manager aggregates the incident and tracks ownership and next steps.

AWS Config: compliance, drift detection, and remediation
AWS Config continuously records resource configurations and evaluates them against rules to detect drift and compliance issues.

Highlights:

* 300+ managed rules available from AWS and additional custom rules you can author.
* Broad resource coverage (100% where supported).
* Conformance packs: bundled rules and remediation for compliance standards (CIS, PCI-DSS, HIPAA).
* Auto-remediation: Config can trigger remediation actions that invoke SSM Automation documents.

![A presentation slide about "AWS Config – Compliance and Drift Detection" showing that AWS Config offers "300+ Managed Rules" and "100% Coverage" for pre-built compliance checks and resource monitoring, with an AWS Config icon and feature boxes for managed/custom rules, auto-remediation, and conformance packs.](https://mintcdn.com/kodekloud-c4ac6d9a/T-jO1evnEtyHSiTN/images/AWS-Certified-DevOps-Engineer-Professional/Summary/Summary-of-Domain-5-Incident-and-Event-Response/aws-config-compliance-drift-300-rules.jpg?fit=max\&auto=format\&n=T-jO1evnEtyHSiTN\&q=85\&s=726451cd8beff6190aa64d2565beff79)

AWS Health: account and service health events
AWS Health exposes:

* Personal Health Dashboard — account-specific events and remediation guidance.
* Service Health Dashboard — general public status of AWS services.
  AWS Health also provides an API and can publish events to EventBridge, enabling automated escalation or notifications when AWS reports service disruptions affecting your account.

![An AWS Health infographic slide showing the AWS Health icon and four feature boxes: Personal Health Dashboard, Service Health Dashboard, Health API, and EventBridge Integration. It briefly describes each feature’s purpose (account-specific health events, global service status, programmatic access, and event publishing for automation).](https://mintcdn.com/kodekloud-c4ac6d9a/T-jO1evnEtyHSiTN/images/AWS-Certified-DevOps-Engineer-Professional/Summary/Summary-of-Domain-5-Incident-and-Event-Response/aws-health-personal-service-api-eventbridge.jpg?fit=max\&auto=format\&n=T-jO1evnEtyHSiTN\&q=85\&s=dd7e0ae15ed2d0fb47874f5befd39c08)

Automated remediation patterns (practical examples)
Below are common, exam-relevant remediation patterns with typical steps:

1. Config-driven remediation

* AWS Config detects a non-compliant resource.
* Config emits an event to EventBridge.
* EventBridge routes the event to SSM Automation to remediate.
* AWS Config re-evaluates the resource and updates compliance status.

2. Metric-based response (operational scaling or recovery)

* CloudWatch alarm triggers when a metric breaches its threshold.
* EventBridge receives the alarm event and invokes Lambda, SSM, or Step Functions for remediation or autoscaling.
* CloudWatch tracks outcome; alarms clear when metrics return to normal.

3. Security incident workflow

* GuardDuty emits a finding.
* EventBridge routes the finding to Step Functions to orchestrate detection-enrichment-remediation steps.
* Use SNS to notify security teams; automated quarantine or credential revocation can run with manual approval gates.

Tip: Use Step Functions approval gates or human-in-the-loop SNS workflows for sensitive production changes.

![A presentation slide titled "Automated Remediation Patterns" listing three numbered patterns—01 Config-Driven Remediation, 02 Metric-Based Response, and 03 Security Incident Workflow—each with a colored icon and brief explanatory text. A footer includes a production safety note and a KodeKloud copyright.](https://mintcdn.com/kodekloud-c4ac6d9a/T-jO1evnEtyHSiTN/images/AWS-Certified-DevOps-Engineer-Professional/Summary/Summary-of-Domain-5-Incident-and-Event-Response/automated-remediation-patterns-slide.jpg?fit=max\&auto=format\&n=T-jO1evnEtyHSiTN\&q=85\&s=1670a167671176d468efd098d5a4971c)

Troubleshooting and observability: tools and roles
Use these observability services together to detect, investigate, and verify remediation:

| Tool | Purpose | When to use |
| - | - | - |
| CloudWatch Metrics & Alarms | Numeric monitoring and automated alerts | Detect breaches and performance degradation |
| CloudWatch Logs | Aggregation and search of logs | Investigate application/system errors |
| AWS X-Ray | Distributed tracing for latency and performance | Diagnose request flow and hotspots |
| CloudTrail | API audit trail (who changed what & when) | Post-incident forensics and auditing |
| Session Manager | Secure interactive troubleshooting | When you need shell access without open ports |

Workflow example: CloudWatch metrics/alarms detect an anomaly → CloudWatch Logs/X-Ray are used to diagnose → CloudTrail provides audit context → Session Manager or SSM Run Command executes fixes.

![A presentation slide titled "Troubleshooting Failures" listing core AWS tools: CloudWatch Logs, AWS X‑Ray, AWS CloudTrail, and Session Manager. Each tool has a short note about its use (application errors, latency/performance, who changed what, need shell access).](https://mintcdn.com/kodekloud-c4ac6d9a/T-jO1evnEtyHSiTN/images/AWS-Certified-DevOps-Engineer-Professional/Summary/Summary-of-Domain-5-Incident-and-Event-Response/troubleshooting-failures-aws-cloudwatch-xray-cloudtrail.jpg?fit=max\&auto=format\&n=T-jO1evnEtyHSiTN\&q=85\&s=92140a18d1bf305badb0643a80aee300)

Fault Injection Simulator (FIS): validating resilience with controlled experiments
AWS FIS is the managed service for chaos engineering on AWS:

* Define experiments that target resources, instances, or API behavior.
* Set stop conditions using CloudWatch alarms for safety.
* Execute experiments under IAM policies and safeguard constraints.
* Analyze results and iterate improvements.

FIS integrates with CloudWatch and EventBridge, so you can run experiments that automatically stop on safety thresholds and publish experiment events for automated analysis or remediation.

![A slide titled "Chaos Engineering With FIS" explaining AWS Fault Injection Simulator, which injects controlled failures to validate system resilience. Below it is a four-step timeline: Define experiment, Set stop conditions, Execute safely, and Analyze results.](https://mintcdn.com/kodekloud-c4ac6d9a/T-jO1evnEtyHSiTN/images/AWS-Certified-DevOps-Engineer-Professional/Summary/Summary-of-Domain-5-Incident-and-Event-Response/chaos-engineering-fis-timeline.jpg?fit=max\&auto=format\&n=T-jO1evnEtyHSiTN\&q=85\&s=53abe5a45aa02b0e5a87d653f20ef355)

Incident aggregation and coordinated response at scale
For multi-account or large environments, centralize incident handling:

* OpsCenter (Systems Manager) — aggregate OpsItems across accounts into centralized work items for triage and assignment.
* Incident Manager — define response plans, contact and escalation schedules, runbooks, and on-call rotations.
  Both integrate with EventBridge and Systems Manager to automate incident lifecycle, notification, and remediation while maintaining auditability.

Key takeaways

* EventBridge is the central event router: pattern-based matching, routing to multiple targets, and cross-account routing.
* Systems Manager (Automation, Run Command, Session Manager, OpsCenter, Incident Manager) is the main execution and operational toolset for remediation and incident coordination.
* AWS Config provides continuous configuration tracking, drift detection, rules, conformance packs, and SSM-based auto-remediation.
* AWS Fault Injection Simulator validates resilience through controlled experiments and integrates with CloudWatch/EventBridge to ensure safety.
* OpsCenter and Incident Manager enable incident aggregation and coordinated responses at scale.
* Observability stack (CloudWatch metrics/logs/alarms, X-Ray) and CloudTrail are essential for detection, diagnosis, and forensics.

This summary is concise and assumes familiarity with each service. If you need deeper examples or step-by-step runbook templates, consult the official AWS documentation or your study notes at [notes.kodekloud.com](https://notes.kodekloud.com/index.md).

> **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/bbd35ea9-a64e-40d2-a60b-01cd8ccb85dd/lesson/d78cfb88-9e91-4743-a45e-62a1fcf3eca8)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.