Another alternative approach

Like I said, welcome to the real world.

Turns out corporate IT didn't approve Elasticsearch, and they weren't too happy with you using Kinesis Data Analytics either.

So now, you have to accomplish the goal of sending an alert when there is more than 3 negative tweets in 5 minutes using only Firehose, Lambda and SNS.

Here is the original architecture.

Are you up to the challenge?