# AWS Cloud Rescue v4.1.0 — Student Rescue Challenge Briefs > Independent, browser-only troubleshooting simulations. **No answer key or step-by-step repairs appear in this student document.** Assessments use new versioned v4 mission environments. Original v3 scenarios and historical scores remain in older backups, but do not count as completed v4 challenges. Select [Rescue Challenges](index.html#challenge), then choose a numbered mission. Read the brief, investigate the preloaded faulty resources using the service console, and select **Run challenge validation**. After a test, use the evidence report to guide further investigation. Optional hints reduce earned XP. Each mission is isolated by Region and challenge number. Reset only a single mission using **Reload starter / restart**, after exporting a backup. ## Index - [Challenge 1: The Vanishing Customer Portal](#challenge-01) - [Challenge 2: The Confidential Export Incident](#challenge-02) - [Challenge 3: The Checkout Zone Evacuation](#challenge-03) - [Challenge 4: The Unexpected Compute Bill](#challenge-04) - [Challenge 5: The Silent Notification Queue](#challenge-05) - [Challenge 6: The Missing Operations Signal](#challenge-06) - [Challenge 7: The Overwritten Launch Artwork](#challenge-07) - [Challenge 8: Eightfold Traffic Spike](#challenge-08) - [Challenge 9: The Broken Edge Distribution](#challenge-09) - [Challenge 10: The Final Go-Live Review](#challenge-10) ## Challenge 01 — The Vanishing Customer Portal **Incident:** After a routine network change, the Acme Arcade player portal stopped responding. The compute instance is running, but browser access fails and an old administrative rule may be overexposed. **Assignment:** Restore a secure public web path to the existing workload without exposing remote administration to everyone. **Business objectives:** - A running application instance is reachable through an appropriate public subnet - Its attached security group permits web traffic from customers - The instance has a simulated public address - No security group permits internet-wide SSH access **Constraint:** Preserve the existing instance and its network; do not treat globally open SSH as a workaround. **Submit:** A passing console validation and your exported student results JSON, with an explanation of evidence and tradeoffs. --- ## Challenge 02 — The Confidential Export Incident **Incident:** An internal customer export was reported as anonymously readable. Operations also suspects privileged identity and audit controls were weakened during a migration. **Assignment:** Contain the exposure and restore the minimum identity and audit protections needed to investigate it. **Business objectives:** - Private, encrypted object storage for the export - No S3 bucket in this incident can be read publicly - Privileged IAM identities require a second authentication factor - At least one activity trail is recording events **Constraint:** Keep the customer export bucket and an active administrator; do not pass by deleting evidence. **Submit:** A passing console validation and your exported student results JSON, with an explanation of evidence and tradeoffs. --- ## Challenge 03 — The Checkout Zone Evacuation **Incident:** A zonal facility alert threatens the checkout application. Both running web hosts are currently dependent on one zone, and the customer database has a single-zone recovery posture. **Assignment:** Make the frontend continue serving through one zone outage while keeping the relational database private and highly available. **Business objectives:** - A healthy load balancer serves compute targets in two distinct Availability Zones - The frontend load balancer is internet-facing with two public zonal subnets - An encrypted, private Multi-AZ database has private subnet coverage in two zones - The protected database belongs to the same VPC as the resilient application **Constraint:** Stay in one AWS Region and never make the database publicly accessible. **Submit:** A passing console validation and your exported student results JSON, with an explanation of evidence and tradeoffs. --- ## Challenge 04 — The Unexpected Compute Bill **Incident:** A test environment is still running on an oversized instance. The financial warning policy triggers only when almost the entire budget is spent. **Assignment:** Reduce simulated monthly spend without taking the application offline and make financial warnings arrive earlier. **Business objectives:** - At least one application instance remains running - All running instances are economical pilot-sized compute - A positive monthly budget exists - The same budget warns at or before 70 percent **Constraint:** Budget figures are fictional; do not stop every workload to claim savings. **Submit:** A passing console validation and your exported student results JSON, with an explanation of evidence and tradeoffs. --- ## Challenge 05 — The Silent Notification Queue **Incident:** Customer purchases complete, but receipts and notifications disappear when a downstream email provider returns errors. The background queue lacks a failure recovery policy. **Assignment:** Establish resilient asynchronous processing for customer notifications. **Business objectives:** - A queue exists for independent background work - The processing queue has dead-letter handling enabled - An active Lambda worker is connected to that queue - The worker has a reasonable execution timeout **Constraint:** Keep application compute running. The simulated queue must remain the worker trigger. **Submit:** A passing console validation and your exported student results JSON, with an explanation of evidence and tradeoffs. --- ## Challenge 06 — The Missing Operations Signal **Incident:** The on-call team cannot reconstruct recent control-plane changes and does not receive capacity or error alerts. Privileged access also lacks second-factor protection. **Assignment:** Restore audit visibility, operational alarms, and administrator login protection. **Business objectives:** - CloudTrail records audit events - An enabled CPU-utilization CloudWatch alarm exists - An enabled application-error CloudWatch alarm exists - All administrator identities use MFA **Constraint:** Keep audit evidence and the operating workload in place; do not remove the administrator. **Submit:** A passing console validation and your exported student results JSON, with an explanation of evidence and tradeoffs. --- ## Challenge 07 — The Overwritten Launch Artwork **Incident:** A designer replaced the launch banner with an incorrect image. The original object may be unrecoverable, and the asset bucket has weak data-protection settings. **Assignment:** Protect the original asset and future versions without discarding the existing object. **Business objectives:** - At least one bucket retains stored application objects - The object-containing bucket blocks anonymous public access - The object-containing bucket uses default encryption - Versioning is enabled to preserve revisions **Constraint:** Do not remove the asset or replace its identity; this incident is about recoverability. **Submit:** A passing console validation and your exported student results JSON, with an explanation of evidence and tradeoffs. --- ## Challenge 08 — Eightfold Traffic Spike **Incident:** Marketing predicts an 8× increase in visitors. Current frontend capacity is healthy but the scale-out policy cannot grow and no CPU alert is active. **Assignment:** Prepare the application to increase capacity while preserving healthy multi-zone routing and utilization monitoring. **Business objectives:** - A healthy public application entry point spans two zones - A connected Auto Scaling group supports at least eight instances - Dynamic target-tracking scaling is enabled - A functioning CPU alarm warns operations **Constraint:** Keep at least one baseline instance; right-sizing is not the same as deleting availability. **Submit:** A passing console validation and your exported student results JSON, with an explanation of evidence and tradeoffs. --- ## Challenge 09 — The Broken Edge Distribution **Incident:** A new static-content deployment is offline at the edge, and the origin bucket was mistakenly left open to anonymous traffic. **Assignment:** Restore secure worldwide distribution of the retained object assets. **Business objectives:** - At least one S3 origin has an uploaded object - Origin storage is private and encrypted - A distribution is enabled and uses HTTPS - The enabled distribution points to the protected origin bucket **Constraint:** Do not make private origin assets public to solve the edge delivery incident. **Submit:** A passing console validation and your exported student results JSON, with an explanation of evidence and tradeoffs. --- ## Challenge 10 — The Final Go-Live Review **Incident:** A prelaunch readiness audit finds weak application health routing, incomplete database recovery, missing identity/audit controls and late cost warnings. **Assignment:** Resolve the findings and demonstrate a protected, resilient release environment. **Business objectives:** - A public two-zone load balancer has healthy application targets - The database is private, encrypted, Multi-AZ and has a recoverable backup policy - All asset buckets are protected against public access - Privileged IAM access uses MFA and audit logging is enabled - A monthly budget has an early warning threshold **Constraint:** Do not delete production-style application, database or asset resources just to silence diagnostics. **Submit:** A passing console validation and your exported student results JSON, with an explanation of evidence and tradeoffs. --- **Simulation and grading note:** This is a conceptual local-browser exercise. Grading evidence is self-reported and is not tamper-proof. No private instructor answer key is included in the public files.