Trigger automation from an event and guard the destructive case

applied · 70 min · Objective 5.1

Task

Build event-triggered automation that reacts to a resource appearing without required tags, then add the guard that stops a cleanup job from deleting far more than it should. That guard is the difference between useful automation and an incident.

Steps

  1. Write a watcher that observes container creation events and checks each new container for the three required tags from domain 1.
  2. Make it react: for an untagged container, write a finding to lab/auto/findings.log with a timestamp and the container id. Create three containers, two tagged and one not, and confirm only one finding appears.
  3. Add a cleanup action that removes untagged containers older than a threshold, running with LEAST PRIVILEGE -- it may remove containers and nothing else. Record the permissions it holds.
  4. Add the guard: the cleanup refuses to proceed if it would remove more than an expected number in one run, logging what it would have done instead. Prove it by creating ten untagged containers at once and capturing the refusal in lab/auto/guard.txt.
  5. Add a scheduled reconciliation sweep alongside the event trigger, and write in lab/auto/design.md why both exist when the event path already works.

Verify

awk 'END{print NR" finding(s)"}' lab/auto/findings.log
test -s lab/auto/guard.txt && grep -Eci 'refus|abort|exceed|would have' lab/auto/guard.txt
grep -Eci 'sweep|reconcil|schedule' lab/auto/design.md
grep -Eci 'least privilege|only' lab/auto/design.md

The guard capture is the essential artefact: a cleanup job that normally removes a few things and suddenly proposes to remove many should stop and ask rather than proceed confidently.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.