1 of 8

AWS JAM • SJSU

Claudathon- 2026 - Team 03

14/14

CHALLENGES SOLVED — PERFECT SCORE

1,310

POINTS

2 of 8

01

LOAD BALANCING • HIGH AVAILABILITY

Prepare to Fail(over)

THE PROBLEM

Website returning 503 errors on a single risky instance.��• ALB had no targets registered�• Stickiness blocked true load balancing across servers

ARCHITECTURE

USERS

APPLICATION LOAD BALANCER�(stickiness OFF)

EC2 #1�✓ Healthy

EC2 #2�✓ Healthy

KEY LEARNINGS

503 = ALB live, no healthy targets behind it��Target Group health checks must pass before traffic flows��Disable stickiness for true round-robin distribution

Resilience starts with redundancy — single points of failure are not optional in production.

3 of 8

02

NETWORKING SECURITY • EDGE PROTECTION

Protect my CloudFront Origin

THE PROBLEM

S3 origin was directly accessible from the public internet, bypassing CloudFront's caching, WAF, and HTTPS enforcement.��Attackers could hit the bucket directly.

THE FIX: ORIGIN ACCESS CONTROL

USERS

CLOUDFRONT�+ Origin Access Control (OAC)

S3 ORIGIN BUCKET�🔒 Bucket Policy: only OAC

✗ Direct internet access → DENIED

KEY LEARNINGS

OAC replaces legacy OAI as the modern standard��Bucket policy must trust the CloudFront distribution ARN, not a wildcard��Defense-in-depth: edge + origin = layered security

Lock the back door. Edge protection is meaningless if the origin is open to the world.

4 of 8

03

GRAVITON

ARM64 your Databases

THE PROBLEM

Migrate an x86 RDS instance to ARM64 (Graviton) without downtime or data loss & prove the cost savings and performance

x86 → GRAVITON(ARM) MIGRATION

BEFORE�db.t3.micro�(x86 / Intel)

AFTER�db.t4g.micro�(ARM / Graviton)

Snapshot → Restore on Graviton → Cutover

Up to 20% better price/performance (aws official)�Same MySQL — zero app code changes

KEY LEARNINGS

Graviton = AWS-built ARM64 chips at lower cost��MySQL & Postgres run unchanged on ARM��Snapshot/restore is the safe migration path��Always match instance class on restore

Same workload. Lower bill. Greener footprint. The cloud bill IS the lowered.

5 of 8

04

DEVSECOPS • MEDIUM • OUR HARDEST WIN

CloudFormation Sherlock !!

THE 3 BUGS WE CRACKED

SYNTAX

!GetAttr → !GetAtt

RUNTIME

python3.9 deprecated

SECURITY

Missing Egress rule

SHIFT-LEFT PIPELINE

CodeCommit�Source of truth

cfn-lint�Syntax check

cfn-nag�Security audit

Deploy ✓�CloudFormation

KEY LEARNINGS

!GetAtt is the only valid intrinsic — case matters��Shift-Left: catch errors before deploy with cfn-lint + cfn-nag��Declare explicit Egress — defaults won't pass audits

Security isn't a stage — it's the pipeline. Catch bugs in CI, not in production.

6 of 8

05

S3 LOGGING • OBSERVABILITY

Data with the Stars!

THE PROBLEM

Audit who accessed an S3 bucket and when — but server-access logs were never enabled.��No audit trail = no compliance, no forensics, no answers.

LOGGING PIPELINE

SOURCE S3 BUCKET�Server Access Logging: ON

LOG DESTINATION BUCKET�+ ACL grants log-delivery write

ATHENA QUERY�SELECT requester, time FROM logs

KEY LEARNINGS

Logging is not retroactive — turn it on before you need it��Log destination needs the right ACL or it silently drops events��Athena turns S3 logs into queryable forensics in minutes

If it's not logged, it didn't happen. Observability is the price of trust in the cloud.

7 of 8

THE BIG PICTURE

Five domains. One stack.�Production-ready thinking.

RESILIENT

ALB + multi-AZ�No single points of failure

SECURE

OAC + Egress + Audit logs�Defense in depth

EFFICIENT

Graviton + Shift-left�Lower cost, fewer prod bugs

8 of 8