3.3.1.4. Building Event Processing Workflows (SQS, Kinesis, SNS, Lambda, Step Functions)

3.3.1.4. Building Event Processing Workflows (SQS, Kinesis, SNS, Lambda)

Complex incidents require multi-step responses that can't be handled by a single Lambda function. Step Functions orchestrates these workflows with retry logic, parallel execution, and human approval gates.

Incident response workflow example:

{
  "StartAt": "ClassifyIncident",
  "States": {
    "ClassifyIncident": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:...:ClassifyFunction",
      "Next": "SeverityRouter"
    },
    "SeverityRouter": {
      "Type": "Choice",
      "Choices": [
        {"Variable": "$.severity", "StringEquals": "CRITICAL", "Next": "CriticalPath"},
        {"Variable": "$.severity", "StringEquals": "HIGH", "Next": "HighPath"}
      ],
      "Default": "LogAndNotify"
    },
    "CriticalPath": {
      "Type": "Parallel",
      "Branches": [
        {"StartAt": "PageOnCall", "States": {"PageOnCall": {"Type": "Task", "Resource": "arn:aws:lambda:...:PagerDuty", "End": true}}},
        {"StartAt": "IsolateResource", "States": {"IsolateResource": {"Type": "Task", "Resource": "arn:aws:lambda:...:Isolate", "End": true}}},
        {"StartAt": "CreateIncidentTicket", "States": {"CreateIncidentTicket": {"Type": "Task", "Resource": "arn:aws:lambda:...:Jira", "End": true}}}
      ],
      "End": true
    }
  }
}

SQS + Lambda processing patterns:

• Batch processing: Lambda receives up to 10 SQS messages per invocation. ReportBatchItemFailures lets you return only failed message IDs — successful messages are deleted, failures return to the queue.
• Partial batch response prevents reprocessing all messages when only one fails.

Exam Trap: Step Functions Standard Workflows have a maximum duration of 1 year and charge per state transition. Express Workflows last up to 5 minutes and charge per execution + duration. For high-volume event processing (thousands per second), Express Workflows are 10-100x cheaper. If the exam describes a short-lived, high-frequency workflow, the answer is Express, not Standard.