Milestone 1: Automated incident-response capstone

Design a multi-account workflow that:

• receives AWS Health, CloudTrail, application, and compliance events,
• classifies severity and ownership,
• enriches resource and deployment context,
• creates an operational work item or incident record,
• notifies and escalates responders,
• performs one safe Systems Manager or Step Functions remediation,
• stores failed events,
• verifies recovery,
• records a complete timeline,
• creates post-incident actions.

Include manual approval for destructive or high-risk actions.