Capstone Submission — Complete the Cricket Analytics Platform

Your Capstone Submission

You have designed, implemented, secured and documented a production-ready Cricket Analytics Platform. This final lesson is your capstone submission — a self-assessment against the evaluation criteria from M6 Lesson 1 and a reflection on the skills you have developed across Course 1. The submission checklist is the same rubric that engineering managers use when evaluating whether a system is ready for production deployment. Work through each item honestly: any incomplete item is an opportunity for additional practice before moving to Course 2.

Analogy🏏Cricket

🏏 Think of it like cricket: This capstone submission is your debut Test match scorecard — the permanent record of your performance that defines your standing at the start of your career. A century on debut (completing all checklist items) demonstrates readiness for the senior team. Gaps in the scorecard are not failures — they are specific areas for practice before the next match. Every elite cricketer had weaknesses that they addressed through deliberate practice; every senior cloud engineer had gaps in their foundation that they filled by doing exactly what you are doing now.

Submission Checklist — Infrastructure

VPC: Three-tier subnets (public, private, data) across 3 AZs with non-overlapping CIDRs documented and validated.
Security Groups: Three-tier chain (ALB → App → DB) using security group ID references, not CIDRs. DenyAll-equivalent achieved through the absence of inbound rules.
NAT Gateways: One per AZ with per-AZ private route tables. S3 and DynamoDB VPC gateway endpoints provisioned.
RDS: PostgreSQL Multi-AZ with encryption at rest, 7-day backup retention, deletion protection, and password in Secrets Manager.
DynamoDB: Table with match_id partition key, ball_ref sort key, PAY_PER_REQUEST billing, encryption, and PITR enabled.
Lambda: Ingestion processor with least-privilege IAM role. DynamoDB and RDS writes. Unit tests passing. Error handling for malformed input.
ALB + ASG: ALB with HTTPS listener (or HTTP for lab). ASG with target tracking at 60% CPU. Health checks on /health endpoint.
Route 53: A records with latency routing to both regions and health check failover configured.

Submission Checklist — Security

Zero hardcoded credentials: grep -r 'aws_access_key\|password\|secret' in all Terraform and Lambda code returns no matches.
IAM policy simulator: All Lambda, EC2 and RDS roles pass the least-privilege check — only required actions allowed, no wildcards on sensitive resources.
S3 Block Public Access: Enabled at account level.
VPC Flow Logs: Enabled on the production VPC with 7-day CloudWatch Logs retention.
CloudTrail: Multi-region trail enabled.
IAM Access Analyzer: No active findings for public or cross-account resource access.
Security audit script: All checks PASS in the automated security audit from M6 Lesson 4.

Submission Checklist — Observability

CloudWatch Dashboard: Shows API p99 latency, 5xx error rate, request count and RDS CPU in a single view.
Alarms: p99 latency > 500ms and 5xx error rate > 1% alarms trigger SNS → email. RDS CPU > 80% alarm configured.
Lambda monitoring: Duration, error count and throttles metrics visible in CloudWatch.
Application logs: Structured JSON logs from the API include request_id, latency_ms, status_code and user_id fields.
Runbook: RUNBOOK.md covers high latency, RDS failover, deployment and point-in-time recovery procedures.

Submission Checklist — Infrastructure as Code

Terraform code: All resources provisioned via Terraform with no manual console changes. terraform plan shows zero drift.
Remote state: S3 backend with DynamoDB locking. State file not committed to Git.
Modules: VPC, database and compute separated into reusable modules with variable inputs and outputs.
ADRs: Five Architecture Decision Records covering database strategy, compute platform, ingestion architecture, multi-region and observability tool choice.
README: Includes architecture diagram, prerequisites, deployment instructions and cost estimate.

Self-Assessment — Course 1 Skills

Rate your confidence in each skill area from 1 (need more practice) to 5 (confident enough to teach). Honest self-assessment prevents moving to Course 2 with unaddressed gaps that compound as concepts build on each other.

Linux fundamentals: Filesystem hierarchy, file permissions, process management, systemd, storage tools. Rate 1-5: ___
Bash scripting: Variables, control flow, functions, error handling, jq/yq, cron automation. Rate 1-5: ___
Networking: OSI model, TCP handshake, CIDR subnetting, DNS resolution, TLS certificate chains, load balancing algorithms. Rate 1-5: ___
AWS IAM: Users vs roles, policy evaluation logic, least privilege, service accounts, cross-account roles. Rate 1-5: ___
AWS compute: EC2 instance families, AMI baking, ASG with target tracking, Spot Instances, Launch Templates. Rate 1-5: ___
AWS storage: S3 storage classes, lifecycle rules, VPC endpoints, presigned URLs, encryption. Rate 1-5: ___
AWS networking: VPC design, security group chains, NAT gateways, Route 53 routing policies and health checks. Rate 1-5: ___
AWS databases: RDS Multi-AZ failover, DynamoDB partition key design, avoiding Scan, Cloud SQL Proxy pattern. Rate 1-5: ___
Azure fundamentals: Tenant/subscription/resource group hierarchy, NSG rules, Managed Identities, Container Apps. Rate 1-5: ___
GCP fundamentals: Project hierarchy, IAM additive model, Workload Identity, BigQuery partitioning, Cloud Run. Rate 1-5: ___
Terraform: Multi-cloud providers, remote state, modules, plan/apply workflow, lifecycle meta-arguments. Rate 1-5: ___
Observability: Four golden signals, CloudWatch alarms, runbook writing, security audit automation. Rate 1-5: ___

What Is Next — Course 2 Preview

Course 2 — Infrastructure as Code, Terraform and Ansible — builds directly on the Terraform foundations from this course. You will go deeper: Terraform modules, workspaces, remote backends, Terragrunt for DRY multi-environment deployments, Terraform Cloud for team workflows, Sentinel for policy as code, and Ansible for configuration management and idempotent server automation. The cricket analytics platform you built in this capstone will be the recurring reference architecture throughout Course 2 — each new concept will be applied to extend and improve the platform you built here. Everything learned in Course 1 will be used in Course 2; nothing is wasted.

Any self-assessment score of 3 or below indicates a topic to revisit before Course 2 — return to the specific module lessons and lab exercises until you reach confidence level 4.
The capstone submission is evidence of your work — commit the Terraform code, ADRs, runbook and architecture diagram to a GitHub repository and add it to your portfolio.
The architecture patterns in this capstone (three-tier VPC, security group chains, IAM least privilege, multi-AZ databases, CloudWatch golden signals) are the same patterns used by production systems at every company that runs on AWS.
Course 2 will extend this platform with Terragrunt multi-environment management, Ansible server configuration, Sentinel policy enforcement and Terraform Cloud for team workflows.
You have completed 35 lessons covering 172+ hours of cloud engineering content — this represents the equivalent of approximately 3-4 months of on-the-job experience compressed into a structured learning path.