AWS Certified DevOps Engineer Professional DOP-C02 (DOP-C02) — Questions 1–75

AWS::AccountId is a true pseudo parameter that is resolved during template evaluation, providing a unique, numeric identifier for the current AWS account. When combined with a fixed prefix like 'mybucket-', the resulting bucket name is globally unique across all accounts and regions because each account has a distinct ID, satisfying S3's global namespace requirement. This approach is deterministic, readable, and avoids the circular dependency issues of resource attributes, making it a widely adopted best practice for naming resources.

The Amazon ECS deploy action provider is the native integration in CodePipeline for pushing a new container image or task definition to an existing ECS service. When this action runs, it registers the revised task definition and calls UpdateService so the service starts a deployment with the new image. This makes it the correct, minimal-action choice for an ECS-based application pipeline, as it avoids abstracting the deployment behind another compute platform.

The error occurs because CloudFormation did not explicitly specify an Availability Zone, so AWS placed the instance in an AZ that does not offer the selected instance type. By adding an Availability Zone parameter that is constrained to zones where the instance type is supported—or by setting the AvailabilityZone property directly on the AWS::EC2::Instance resource—you force EC2 to launch in a compatible AZ. This addresses the root cause without changing the instance type, region, or underlying architecture.

This approach leverages the SQS visibility timeout as a built-in retry buffer: setting it to 6 hours prevents messages from being redelivered to consumers while the downstream service is unhealthy, effectively holding them in the queue. Combined with a high maxReceiveCount (e.g., 100) in the redrive policy, messages are not prematurely moved to the DLQ, allowing the Lambda consumer to keep retrying for hours until the service recovers. This ensures no data loss and avoids manual intervention, making it the correct pattern for intermittent downstream outages.

Amazon CloudWatch Dashboards is the correct choice because it natively integrates with CloudWatch, which collects and stores EC2 standard metrics (CPU, network, disk) and, when the CloudWatch agent is installed on the instance, also collects custom operating-system-level metrics such as memory utilization and disk space. These dashboards can be customized to display multiple metrics in a single graph, aggregated across instances, and automatically refreshed for near-real-time monitoring. Additionally, CloudWatch Dashboards support alarm overlays and anomaly detection, making it purpose-built for visualizing application performance as a monitoring and observability tool.

For Fargate, Container Insights must be enabled to collect infrastructure telemetry such as CPU and memory utilization at the cluster, service, task, and container levels; AWS then ships these metrics to CloudWatch automatically. ServiceLens builds on that by combining CloudWatch metrics, logs, and X-Ray traces into a single service map and console, allowing you to select a trace and see the corresponding CPU/memory metric trends for that underlying container. This native integration is exactly what is required to prove whether a CPU saturation event is causing an observed latency increase in a traced request.

Defining the service to spread tasks across multiple Availability Zones ensures that the microservice remains available even if a single AZ fails. In Amazon ECS, you can use a placement strategy with 'spread' across 'attribute:ecs.availability-zone' for EC2, or for Fargate you can use the `AvailabilityZoneSpread` placement strategy (or specify AZs in the service definition) to distribute tasks evenly across AZs. This directly mitigates the risk of an AZ outage by maintaining running tasks in other zones.

Patch Manager is the purpose-built Systems Manager capability that automates the process of patching managed nodes. It uses patch baselines to determine which patches are approved or rejected, and it can either scan for missing patches or install them directly on EC2 instances and on-premises servers. Patch Manager supports both Linux and Windows, integrates with maintenance windows and compliance reporting, and is the correct answer because it directly handles patch configuration and deployment.

The AWS Systems Manager Parameter Store is purpose-built for configuration management, providing a secure, hierarchical namespace for keys and values. A SecureString parameter uses AWS KMS encryption at rest and in transit, and integrates natively with EC2 via the SSM agent or SDK without exposing plaintext. It supports versioning, tagging, and IAM policies for fine-grained access, making it the right choice for dynamic runtime retrieval.

Blue/green shifts traffic to a new fleet only after it passes health checks, so no traffic reaches unhealthy instances, and CodeDeploy automatic rollback reverts on failure. This satisfies the zero-traffic-to-unhealthy-instances and automatic rollback constraints while avoiding full in-place replacement cost.

When the S3 bucket is in a different account, the CodeBuild service role needs explicit permission from the bucket owner. The AmazonS3FullAccess policy grants permissions within the same account, but cross-account access requires a bucket policy that allows the role to perform actions. Adding a bucket policy that grants PutObject to the CodeBuild service role resolves the access issue.

The only way to recover from a deleted bucket is to recreate it and restore objects from a backup. (Note: bucket name uniqueness may require waiting or using a different name.)

AWS CloudTrail is the authoritative source for who, when, and how an EC2 instance was terminated: every StopInstances/TerminateInstances API call is recorded as an event with the IAM user or role, source IP, user agent, and request parameters. Console clicks, CLI commands, SDK calls, and automated actions by services such as Auto Scaling or AWS Lambda all generate a TerminateInstances event. Reviewing CloudTrail event history or querying the CloudTrail S3 bucket with Athena reveals the entity that issued the termination and any accompanying error or access-denied information.

An Elastic Beanstalk platform hook, such as a script in the .platform/hooks/postdeploy directory, runs on the instance during deployment and can call the AWS CLI or SDK to retrieve secrets from Secrets Manager using the instance role's IAM permissions. The script can then export the secret values as environment variables into the application runtime context (e.g., by writing to /etc/profile.d or a systemd environment file) before the app starts. This keeps secrets out of the environment configuration and source code, and it supports rotation by re-running the hook on subsequent deployments.

A custom cookbook can contain a recipe with Chef resources like 'template' or 'file' that renders the configuration file content to the exact path expected by PHP on each instance. Assigning that recipe to the Deploy lifecycle event of the PHP layer ensures it runs only during a deployment operation on that layer, and only on instances that belong to the PHP layer. This approach is fully automated, idempotent, and version-controlled, and it aligns with OpsWorks best practices by using the layer-specific lifecycle hook to scope execution precisely.

The absence of MFA in a CloudTrail session is a direct security-control failure because AWS relies on multi-factor authentication as a second factor to verify the caller's identity beyond long-term credentials. For sensitive actions like terminating an EC2 instance, missing MFA increases the risk that the request came from compromised keys or a stolen session. This makes the MFA status the key anomaly that warrants investigation, as it violates the security best practice of enforcing MFA for destructive operations.

CloudFormation Guard is a policy-as-code engine from AWS that uses a Guard-specific DSL to define rules for template properties like encryption, tags, and allowed resource types. It reads CloudFormation JSON/YAML directly and can be invoked in CodeBuild via the `cfn-guard` CLI to fail the build when a violation is found. This enables automated, pre-deployment compliance checks, which is exactly what the scenario requires.

To securely share an encrypted snapshot, the source account must share the snapshot and modify the KMS key policy to include a statement that grants the target account's root principal the kms:Decrypt and kms:CreateGrant permissions needed to use the customer managed key. After adding this cross-account authorization, the target account can create an encrypted EBS volume from the shared snapshot. The target account's IAM user or role must also have corresponding EBS and KMS permissions, but the key policy is the critical mechanism that enables cross-account decryption.

The CodeDeploy agent on the failed instance writes execution logs that include the full stdout and stderr for every lifecycle event hook, such as BeforeInstall and ApplicationStop. These logs are available at /var/log/aws/codedeploy-agent/codedeploy-agent.log and under /opt/codedeploy-agent/deployment-root/deployment-logs, and they reveal the exact script command that failed and the error message. Reviewing these logs is the only way to directly observe the script's runtime behavior, making it the correct first step in troubleshooting.

MFA Delete requires an authenticated AWS user to provide both a valid AWS credential and a one-time code from an MFA device before permanently deleting an object version or toggling the versioning state. This effectively blocks accidental or malicious permanent deletion because an attacker who compromises credentials would still need physical access to the MFA token. It is a strong, targeted defense for critical S3 data, especially when combined with versioning.

Enabling storage auto scaling on the DB instance automatically increases the allocated storage when free space falls below the configured threshold, up to your specified maximum. Amazon RDS detects low storage conditions and modifies the storage volume dynamically, requiring no manual intervention or downtime. This is the most direct and proactive solution to prevent the instance from reaching a storage-full state.

When CloudFront fronts an S3 static website, edge locations serve cached objects until they expire or are invalidated. CodePipeline's S3 sync updates the origin, but CloudFront does not automatically know about those changes; it continues returning the old objects as long as they remain in the cache. To serve the new content, you must create a CloudFront invalidation for the changed paths (e.g., /*) or use versioned filenames to bypass the cache. This directly matches the symptom of a successful deployment that still shows stale content in the browser.

Aurora Auto Scaling automatically adjusts the number of Aurora Replicas based on metrics like CPU utilization. Placing replicas in multiple Availability Zones ensures that if one AZ fails, replicas in other AZs continue to serve read traffic. This solution provides automatic scaling and AZ resilience with minimal manual intervention, meeting both requirements.

Fargate tasks must download their container images from Amazon ECR before they enter the RUNNING state. If the service is configured to use private subnets that lack a route to a NAT Gateway (or a subnet with an Internet Gateway for public IPs), the task cannot establish outbound connectivity to the image registry, causing the deployment to hang in PROVISIONING and eventually fail. Verifying the subnet route tables for a 0.0.0.0/0 route to a NAT Gateway or IGW directly addresses the most likely cause of image pull failures.

Parameters are the designated CloudFormation feature for passing environment-specific values, such as instance types, AMI IDs, or environment names, into a template during stack creation or update. They are declared in the template and can be referenced via Ref or Fn::Sub, allowing users to supply input without editing the template, with optional constraints like AllowedValues, type validation, and NoEcho for sensitive data. This makes Parameters exactly what the DevOps team needs for dynamic per-environment configuration.

An excessively long deregistration delay prolongs the draining period in which a target is excluded from new request routing but still waits for in-flight requests to complete. For example, if the delay is set to 3,600 seconds (the maximum) and a rolling deployment drains instances, replacement targets may not become healthy quickly enough, leaving zero targets in rotation. With no healthy targets, the ALB returns HTTP 503 to new requests even though the underlying instances might function correctly—the bottleneck is the delayed deregistration.

Enabling automatic rollback in the deployment group settings is the correct native mechanism for requiring CodeDeploy to redeploy the last successful revision when a deployment fails. This feature can also be configured to roll back when a deployment hits a limit or when a CloudWatch alarm triggers, making it flexible for various failure scenarios. It is precisely what the team needs to achieve automatic recovery without manual intervention.

Fn::Sub is the correct choice because it performs variable and pseudo-parameter substitution on a string literal, allowing you to embed ${AWS::StackName} and other pseudo parameters like ${AWS::AccountId} directly into a bucket name. This creates a predictable, globally unique S3 bucket name that is automatically tied to the stack, eliminating the need to hardcode a name and reducing the risk of collisions when the stack is deployed in multiple environments.

A CloudWatch alarm on CPUUtilization monitors the metric in near real-time and, when breached, triggers an Auto Scaling policy that terminates the affected instance, after which the Auto Scaling group automatically launches a fresh replacement. This directly addresses the intermittent high latency by reacting to the actual symptom (high CPU) as it occurs, rather than relying on predetermined schedules, and the managed replacement ensures capacity is maintained without manual intervention.

If the Maven local repository is overridden (e.g., via a custom settings.xml, the -Dmaven.repo.local flag, or a different user's home directory), the path declared in CodeBuild's cache section will not contain the downloaded dependencies. The build will then re-download artifacts every time because the restore phase puts files into a location Maven never reads. The fix is to ensure the cache path exactly matches the effective local repository path used by the Maven build.

Deregistering instances from the load balancer before deployment engages connection draining, allowing in-flight requests to finish before the instance is stopped. Combined with health check grace periods, users never reach a terminating instance, preventing 5xx errors and dropped connections during rolling or batch replacements. This is the core of a zero-downtime rolling update.

A cross-Region read replica uses asynchronous replication to continuously copy changes from the source DB instance to a replica in the secondary Region, keeping data loss typically within 5 minutes. In a disaster, you can promote this replica to a standalone primary instance, which is a fast, reversible operation that meets the 1-hour RTO. This is the only option that both maintains an up-to-date copy in another Region and provides a ready-to-activate target for write traffic.

The recommended approach is to first publish the custom application metric to Amazon CloudWatch using the PutMetricData API, ensuring it has the appropriate ECS service dimensions. Then, in Application Auto Scaling, create a target tracking scaling policy that references that custom metric; the policy automatically calculates the required desired count to maintain the target value, and adjusts the ECS service accordingly. This provides native, automated scaling with built-in cooldowns and no additional compute, making it the most operationally efficient solution.

Running ECS tasks in multiple Availability Zones ensures that an AZ failure does not cause total loss of capacity. The ALB performs health checks and routes traffic only to healthy targets, so if tasks in one AZ become unhealthy, traffic automatically shifts to tasks in the other AZ. Additionally, ECS service scheduler maintains desired task count across AZs, and with service auto scaling you can scale based on request count or CPU. This architecture provides both resiliency and elasticity.

The CloudWatch Synthetics canary's logs contain detailed request/response records, error stack traces, and screenshots captured during the run, making them essential for pinpointing whether a failure is caused by network errors, timeouts, or the application itself. By reviewing these logs, you can check for DNS resolution failures, TCP handshake timeouts, TLS certificate errors, or 4xx/5xx responses that indicate the problem is not with the client-side script. This is the first diagnostic step because it separates infrastructure-level issues from application-level defects.

The PAT is the credential CodePipeline uses to authenticate to GitHub for API calls, including the initial webhook registration and every source-revision lookup (e.g., GetCommit, ListCommits). When the token expires, CodePipeline receives 401/403 responses, so webhook events cannot be processed successfully and the Source stage fails or is skipped, which matches the observed post-push behavior.

Configuring three Availability Zones with a desired capacity of three places one instance in each AZ, so if any single AZ fails, the remaining two instances continue serving traffic, preserving 66% of capacity. The Auto Scaling group will automatically detect the unhealthy instances and launch replacements in other healthy AZs, gradually restoring capacity to the desired level. Because the application is stateless, a load balancer can distribute traffic across the surviving instances, providing high availability with minimal disruption.

The appspec.yml file is the deployment specification that maps each lifecycle hook (e.g., BeforeInstall, AfterInstall, ApplicationStart) to a script path. The 'ScriptMissing' error occurs precisely when the CodeDeploy agent attempts to execute the script declared in a hook and finds no file at that path, either because the path is mistyped, uses an incorrect relative reference, or the script file was omitted from the deployment revision. Since the agent only knows script locations from appspec.yml, an incorrect path there is the direct and immediate cause of this error, making this option correct.

Adding a script to the ValidateService lifecycle hook is the correct solution because this hook executes after ApplicationStart and is designed to verify application readiness. When the script detects that the application did not start successfully—for example, it curls a local endpoint or checks the listening port—it returns a nonzero exit code, causing CodeDeploy to fail the deployment immediately. This check ensures unhealthy instances are identified before any production traffic is shifted, preventing user-facing outages and allowing you to fix the root cause.

CloudTrail records every API call across the account, including the identity, source IP and timestamp, and delivers these events to an S3 bucket. This satisfies the requirement to log all API calls, with S3 lifecycle policies retaining the logs for the mandated seven years.

AWS Config is the correct service because it offers managed rules specifically for detecting S3 public access, such as s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited. These rules can be evaluated continuously, and when a violation is found, AWS Config can automatically invoke remediation actions through SSM automation documents, such as removing the public policy. This provides a continuous, automated enforcement mechanism that goes beyond simple detection, making it the only listed service capable of enforcing the requirement.

The AWS SDK and AWS Secrets Manager client-side caching libraries cache secret values in memory with a default TTL (e.g., 1 hour in Java) to reduce API calls. After rotation, the cached entry still holds the old AWSCURRENT value, and the application will keep using it until the cache expires or an explicit cache refresh is triggered. To fix this, the application must implement rotation-aware behavior, such as forcing a cache reload on authentication failure, shortening the TTL, or using the cached secret's version ID and comparing it to the newly fetched AWSCURRENT version. Without refreshing, the application is pinned to the pre-rotation secret indefinitely within the cache window.

Route 53 failover routing enables traffic redirection.

System status checks specifically monitor the health of the EC2 physical host and the surrounding AWS infrastructure, including power, network connectivity, and host maintenance events. When the underlying physical host experiences a hardware failure, loss of power, or network degradation, the system status check will fail because the host can no longer provide the required virtualization and I/O capabilities. This type of issue is considered host-level and is not fixable by rebooting the instance or making guest OS changes; instead, AWS recommends stopping and starting the instance to move it to a new, healthy host. The symptom described—an instance that is running in the console but failing system status checks—is the classic indicator of a physical host impairment.

An SCP (Service Control Policy) is a preventive guardrail applied at the AWS Organizations level, and it can deny the s3:PutBucketPolicy action for all IAM principals within an account or OU. This ensures that even if a user has an IAM policy granting s3:PutBucketPolicy, they cannot attach a bucket policy that would grant public access, because the SCP takes precedence. It is an effective way to enforce a 'no public buckets' rule across the entire organization.

The failing command `./gradlew build` invokes Gradle's primary lifecycle task, which compiles all production and test sources and then executes the test suite. Any compilation error or failed test causes Gradle to abort with a non-zero exit code (typically 1), producing a 'BUILD FAILED' status. Since this failure occurs in the `build` phase and the exit code originates from the Gradle process itself, this is the direct and correct explanation.

AWS Systems Manager Run Command lets you securely execute commands on managed EC2 instances via the SSM Agent, without requiring SSH, RDP, or open inbound ports. To diagnose a high-CPU alarm, you can run an OS-level command such as `top -b -n1` or `ps aux --sort=-%cpu` to get a snapshot of per-process CPU and memory usage, and retrieve the output from the console, CLI, or an S3 bucket. This gives you process-level detail directly from the guest OS, making it the correct tool to determine the root cause of the CPU spike.

The upload fails because the S3 bucket policy contains an explicit Deny statement whose condition key `aws:SecureTransport` evaluates to `false` for any HTTP request. Since the request was made over HTTP rather than HTTPS, the condition is satisfied and S3 returns 403 Forbidden, regardless of any IAM permissions that would otherwise permit the PutObject action. An explicit deny always takes precedence over any allow.

ALB invokes Lambda functions via a target group that references a specific function version or alias. When you publish a new version and update the target group, ALB's connection draining process allows existing in-flight connections to complete on the old version before deregistering it. As a result, the old Lambda version can continue serving requests for a short period, causing a temporary gradual rollout until draining finishes.

The correct approach is to run the test command (for example, mvn test or gradle test) inside the build phase of the buildspec. CodeBuild executes each command in a shell where a non-zero exit code causes that phase to be marked failed and the overall build to be FAILED. Because Maven/Gradle test goals already return non-zero when tests fail, this single change ensures the build pipeline stops immediately. Any subsequent build phases, such as post_build artifact packaging, still run, but the final build status will reflect the failure.

The Setup lifecycle event is specifically designed to run on an instance after it has been booted and registered with the stack, but before it is available. This event is intended for initial configuration tasks that need to happen only once, such as installing packages, creating directories, or setting up system users. In AWS OpsWorks, the Setup event is part of the standard lifecycle (Setup -> Configure -> Deploy -> Undeploy -> Shutdown) and is the correct lifecycle event for boot-time provisioning tasks, making it the answer to this question.

This approach uses an IAM role attached to the instance profile, providing temporary credentials to the pipeline. The policy scopes permissions to only the specific secret's ARN, adhering to least privilege. The secret is retrieved at runtime and never stored on the instance or in code.

When an update operation fails, CloudFormation automatically initiates a rollback to the stack's previous template and resources, and ROLLBACK_COMPLETE is the final state after that restoration finishes. The stack is still present and functional from its prior state, but the attempted changes were discarded. This is the only status in the output that matches both the 'update' command and the terminal rollback outcome, so it directly confirms a failed update followed by a rollback.

If the Lambda execution role were missing ec2:CreateNetworkInterface or related ENI permissions, the Lambda service would fail to create an elastic network interface during function initialization, producing a different error such as 'InvalidParameterValueException' or a resource creation failure. This would prevent the function from running at all, rather than causing a timeout on the deployment's wait condition. Since the observed failure is a timeout, the role likely has the required ENI permissions, but the network route is missing.

Rolling deployment with a small batch size updates only a handful of instances at a time while the rest of the fleet continues serving live traffic, so the application remains available throughout the pipeline. AWS CodeDeploy moves the entire ASG to the new revision in incremental batches, and it uses health checks to verify each batch before proceeding; if a batch fails, the deployment is halted and can be rolled back. This is the correct choice when you need a zero-downtime update on an Auto Scaling group.

Increasing the Test stage timeout in the CodeBuild project is a pragmatic mitigation when network congestion intermittently causes dependencies or database connections to be slower than the default limit. CodeBuild has a default timeout of 60 minutes for a build, but the pipeline's stage timeout may be shorter, and network retries during peak usage can push a stage over its configured limit without an underlying configuration error. This accommodates transient network delays rather than masking a permanent misconfiguration, making it a valid, if not root-cause, fix.

Circuit breakers are a client-side resilience pattern that monitor outgoing requests to a dependency and, after exceeding a failure threshold, automatically fail fast without attempting the network call. In an ECS microservices environment with service discovery, this stops unhealthy services from being flooded with retries, preventing latency spikes and thread exhaustion in healthy services. By quarantining the failing service from call traffic, circuit breakers effectively stop cascading failures and allow the unhealthy service time to recover.

CodeBuild should be used to build the Docker image because it can execute a buildspec that runs 'docker build' and then uses 'aws ecr put-image' or 'docker push' to store the image in ECR. This step is the pipeline's build stage, converting source code into an immutable container artifact tagged with a version or commit hash. Without this action, the pipeline would have no image to deploy, making it the essential first of the two required actions.

AWS Secrets Manager natively supports automatic rotation of secrets with a configurable rotation schedule, using a Lambda function that updates the secret in both Secrets Manager and the target database. The ECS task assumes an IAM role whose permissions include secretsmanager:GetSecretValue, allowing the container to fetch the current password at runtime without embedding it in the task definition. This approach centralizes secret storage, enables rotation without redeploying the ECS service, and follows AWS best practices for managing database credentials.

CloudWatch Events (now EventBridge) can capture Simple Notification Service messages or CloudWatch alarm state changes triggered by a Route 53 health check or EC2 status check, and then invoke an AWS Lambda function. That function can programmatically call ec2-associate-address to detach the Elastic IP from the failed instance and attach it to a healthy one, fully automating active/passive failover. This approach is the standard serverless pattern for EIP failover because it reacts to health signals and directly manages the association.

An ALB's health check marks an instance unhealthy when it repeatedly fails the configured protocol and path check, and the ALB then stops sending traffic to that instance. When the Auto Scaling group is configured to use ELB health checks, the 'ReplaceUnhealthy' process automatically terminates the unhealthy instance and launches a new one to maintain desired capacity. Thus, the health check is the trigger that enables the self-healing replacement of failed instances, ensuring application availability.

AWS CodePipeline is a fully managed continuous delivery service that can be configured with CodeCommit as a source action, automatically detecting new commits and triggering the pipeline execution. It supports path filters in the source action (e.g., requiring changes only in a specific folder) to avoid unnecessary runs. This makes it the native, event-driven orchestration service to start automated tests (via a CodeBuild build stage) exactly when developers push code.

KMS offers optional automatic rotation of customer-managed keys on an annual basis. When enabled, KMS generates new backing key material each year while preserving the old material so that previously encrypted data can still be decrypted. This feature helps meet compliance requirements for cryptographic key lifecycle management.

With an AllAtOnce deployment strategy, CodeDeploy stops every current instance at the same time, deploys the new application revision to each, and then restarts them; this creates a zero-capacity window where no instance is serving traffic. If the new revision contains incompatible changes—such as expecting a new database schema, missing environment variables, or a different API version—the restarted instances may fail to connect to the database, leaving the entire application unavailable until the issues are resolved. This is the classic failure mode of AllAtOnce deployments: every instance fails together, so a single backward-incompatibility causes a full, fleet-wide outage rather than a partial degradation.

Metric math lets a single alarm combine several API Gateway metrics. Summing 4XXError and 5XXError and dividing by Count at a 300-second period yields the stage-level error rate, so one alarm covers the whole API rather than one alarm per method or resource. This directly satisfies the 5% threshold requirement.

X-Ray propagates a trace ID through API Gateway and the downstream Lambda invocation, producing segment-level timings for each component. This granular breakdown isolates API Gateway overhead from Lambda init and execution duration, satisfying the requirement to measure end-to-end latency across both services.

AWS IAM Identity Center (formerly AWS SSO) integrates natively with AWS Organizations, providing a single place to manage users and groups and then assign them access across multiple AWS accounts. It uses permission sets to define IAM policies that are applied consistently to accounts, and it issues short-term AWS credentials, eliminating the need to create and rotate IAM users. This is the only option that genuinely centralizes user management while preserving fine-grained, auditable access control.

This is the correct approach because AWS Config rules continually evaluate resources against a desired policy, and when they detect non-compliance they can trigger an automatic remediation action—a Systems Manager Automation document—to fix the resource. In this case the rule (such as the managed RESTRICTED_SSH rule) would flag any security group with port 22 open to 0.0.0.0/0, and the associated SSM Automation document (for example, AWS-RevokeSecurityGroupIngress) would revoke the offending rule automatically. AWS Config tracks the remediation status and retries until the resource becomes compliant, providing a closed-loop, auditable remediation process without manual involvement.

AWS Secrets Manager is the correct choice because it natively stores secrets as encrypted objects with fine-grained IAM policies, automatic rotation for both AWS and custom secrets, and direct integration with services like CodeBuild, RDS, and Lambda. The pipeline retrieves a reference to the secret at build time, so the material value never appears in source control, buildspec files, or logs. Secrets Manager also logs every retrieval via CloudTrail, enabling security auditing and immediate revocation if a secret is compromised.

AWS Systems Manager Parameter Store is the correct choice because it securely stores configuration data and secrets as parameters, supports typed values including SecureString using KMS encryption, and CodeBuild has native integration by allowing environment variables to reference parameter names and fetch values at build time. It is ideal for static parameters because it imposes no rotation overhead, and you only need to grant the build project's IAM role ssm:GetParameter(s) permission.

Deploying the Elastic Beanstalk environment as a load-balanced, auto-scaling configuration with a minimum of two instances in separate Availability Zones eliminates the web tier as a single point of failure. The load balancer distributes traffic across instances and health-checks them, while Auto Scaling replaces unhealthy instances and can scale out during load spikes. This is the foundational action for high availability of stateless applications because it provides both redundancy and elasticity.

AWS CodeDeploy natively supports blue/green deployments for ECS services when integrated with an Application Load Balancer. During deployment, CodeDeploy registers the new task set with a 'green' target group while the existing 'blue' task set remains registered with the original target group; the ALB listener's traffic is then shifted from blue to green using either a canary, linear, or all-at-once traffic-shifting configuration. CodeDeploy also runs lifecycle hooks (BeforeInstall, AfterInstall, etc.) and preserves the original task set for instant rollback if the deployment fails. This is the only option that provides immutable infrastructure and controlled traffic shifting, making it the correct answer.

Elastic Beanstalk with enhanced health reporting publishes the 'EnvironmentHealth' metric to CloudWatch, and creating an alarm on this metric allows you to react automatically when the environment transitions to states such as severe or degraded. The alarm can publish to an SNS topic to email or page the team, enabling real-time incident response without any custom code. This approach is the native, supported integration between Elastic Beanstalk health and CloudWatch observability.