Advanced AI Prompt for AWS VPC Flow Logs Security Analytics

Act as a Principal Cloud Forensics Investigator. Architect an advanced security analysis pipeline utilizing AWS VPC Flow Logs originating from [VPC_ID]. Configure the flow logs to push custom, high-fidelity formats directly to an S3 Data Lake. Write highly complex Amazon Athena SQL queries strictly focusing on the [ATHENA_QUERY_FOCUS] (e.g., isolating 'REJECT' traffic targeting SSH/RDP ports). You must programmatically JOIN this query against an external, dynamically updated [THREAT_IP_LIST] stored in a secondary S3 bucket. Provide the CloudWatch Event logic required to trigger an automated Lambda function that instantly blocks offending IP addresses via a Network ACL the millisecond an Athena query flags a positive hit.