Exercise 2: Why a Budget Alert Doesn't Stop a Compromised-Key Incident — Possible Solution
====================================================================

AWS Budgets is fundamentally a NOTIFICATION tool, not an enforcement
tool. When real or forecasted spend crosses the $5,000/month
threshold, AWS Budgets sends an alert -- it does not, on its own, take
any action against the resources actually causing the charges. It
never shuts anything down, revokes any credentials, or halts billing
automatically.

In the scenario described, a compromised access key is being used to
launch a large amount of unauthorized compute. Even once the budget
alert fires (assuming it fires promptly, which depends on how
forecasting and alert timing are configured), the unauthorized
compute keeps running and keeps accumulating real charges until a
PERSON sees the alert and manually intervenes -- revoking the
compromised credentials, terminating the unauthorized resources, or
both.

ANSWER: A Budget alert alone would not prevent the unexpected charges
from accumulating because it only notifies -- it never stops spending
by itself. The real gap between "alert fires" and "problem is
actually fixed" is filled entirely by a human noticing the alert and
manually responding; without separate, automated controls (like
service quotas or an automated Lambda response tied to a billing
alarm), the unauthorized compute keeps running and racking up charges
in the meantime.

WHY THIS WORKS AS AN ANSWER
------------------------------
This correctly applies the chapter's own explicit, critical
distinction -- Budgets alerts, it does not act -- to a concrete real
incident scenario, and connects it back to Chapter 2's own warning
about compromised credentials rather than treating this as an
unrelated new risk.