14.12 Lab — generate, query, write the note

Lab

Practise the CloudWatch Logs primary path (or stdout + documented ship step if your account setup blocks agents today — still write the incident note).

1. Run badge API hello API (or any tiny app) that writes an ERROR line on a deliberate bad request.
2. Capture logs with docker logs and (when available) ship/query via CloudWatch Logs in your lab account.
3. Create or use a clearly named lab log group; confirm events appear.
4. Query/filter the last ERROR; copy one line.
5. Write a five-line incident note (When, Symptom, Evidence, Action, Follow-up) in your notebook or private README — no real secrets, no customer PII.
6. Add one sentence on how a correlation id would make the search easier.
7. Optional interview prep: three bullets comparing CloudWatch Logs vs ELK at idea level (store, search, ops ownership) — no invented product limits.

Practice task

Redact this bad log line into a safe version: ERROR user=priya token=AKIAexample secret=hunter2 order=55 failed (Use obviously fake placeholders only — never paste real credentials into notes you might commit.)