AWS Certified DevOps Engineer Professional DOP-C02 (DOP-C02) — Questions 976–1050

The correct approach is to authenticate the local Docker daemon to the private ECR registry using 'aws ecr get-login-password' piped to 'docker login', then build your image with 'docker build', tag it with the ECR repository URI, and run 'docker push'. This satisfies ECR's token-based authentication and uploads Docker layers directly to the registry's S3-backed storage. It is the only way among the choices that actually moves image data into ECR.

Circuit breaker pattern monitors calls to a remote service and maintains three states—closed, open, and half-open—progressing to open when failure thresholds are exceeded, at which point subsequent calls fail fast without attempting the network operation. This prevents a failing service from being overwhelmed and stops the same repeated errors from saturating caller resources, thereby breaking the chain of cascading failures and giving the dependency time to recover.

Amazon S3 server access logs are the native, purpose-built mechanism for auditing who accessed a specific S3 bucket or object. When you enable server access logging on a bucket, S3 writes a log record for every request, including the requester's AWS account ID (or 'Anonymous' for unauthenticated requests), the bucket name, object key, request type (GET, PUT, etc.), response status, and timestamp. These logs are delivered to a target bucket you specify, and they provide the granular object-level history needed to answer 'who accessed this specific object?'. Although delivery is best-effort and logs may arrive asynchronously, they are the canonical source for S3 access-level audits.

This is the correct approach. Developers should sign commits locally, and a pre-commit hook can enforce that unsigned commits are rejected before they are made. This provides client-side enforcement, which is the only option available within CodeCommit's constraints.

Amazon EFS is the correct choice because it provides a fully managed NFS file system that is regional by default, with mount targets in every AZ to deliver continuous shared access. Cache data written to EFS persists independently of any individual EC2 instance, so when an instance fails and is replaced, the new instance simply mounts the same file system and immediately has the full cache. It also scales automatically and supports concurrent access from many instances, making it the only viable shared, cross-AZ cache service among these options.

This is the correct pattern: API Gateway exposes a public HTTPS endpoint that the Jira webhook POSTs to, and API Gateway invokes a Lambda function to process the payload. The Lambda function can then validate the webhook signature, extract branch metadata, and use the AWS CodeCommit SDK (e.g., CreateBranch with the target commit ID) to perform the branch creation in real time. This serverless design gives you a low-latency, exactly-once-ish webhook receiver without needing to run persistent infrastructure.

The build phase executes `python setup.py build`, which requires a `setup.py` file to be present in the current working directory (the root of the source checkout). If the repository lacks this file—for instance, if it uses `pyproject.toml` or is a plain script—the Python interpreter exits with `python: can't open file 'setup.py': [Errno 2] No such file or directory`, causing the build to fail. This error occurs during the build phase, so no later phases are reached.

Drift detection compares the live S3 bucket policy against the CloudFormation template and reports resource drift. An EventBridge rule listens for CloudFormation drift-detection status-change events and invokes Lambda, which re-applies the original bucket policy or triggers a stack update to restore the resource. This closes the loop between detecting drift and automatically remediating it.

Amazon SNS is a fully managed pub/sub messaging service that supports multiple subscription protocols, including email (as well as HTTP, Lambda, SQS, etc.). To receive CloudFormation stack event notifications, you create an SNS topic, subscribe an email address to it, and specify the topic ARN in the CloudFormation stack's `NotificationARNs` property. When the stack state changes, CloudFormation publishes the event to the topic, and SNS delivers an email to every confirmed subscriber.

If the timeout is too low, increasing it may resolve false positives.

Creating a source stage with AWS CodeCommit as the source provider is required because the pipeline needs a trigger and a location for the application source code, including the Dockerfile and any build specifications. CodeCommit is the native Git repository service on AWS, and integrating it with CodePipeline allows automatic pipeline execution on every push to the configured branch. This provides version-controlled source securely within AWS, avoiding the need for external credentials or additional network access.

SCPs can deny actions across all accounts.

Performance Insights delivers a comprehensive, real-time view of database load, breaking down utilization by waits, SQL statement, and host. By drilling into the 'Top SQL' section, you can pinpoint the exact queries consuming the most CPU, along with statistics such as rows examined and temp tables. This evidence-based approach allows you to optimize indexes or rewrite expensive statements, directly addressing the observed CPU spike.

AWS WAF is the correct choice because it is a fully managed web application firewall that attaches directly to an Application Load Balancer to inspect each incoming HTTP/HTTPS request at the application layer. It can block, allow, or count requests matching conditions such as SQL injection signatures, XSS patterns, IP reputation lists, geo restrictions, and header or body size limits. AWS-managed rule groups, including the OWASP Top 10 rule sets, provide ready-made protection, and WAF integrates natively with ALB to stop malicious traffic before it reaches the EC2 instances.

This is correct because an SQS-triggered Lambda invocation has a maximum execution window set by the function timeout, and the SQS visibility timeout controls when unacknowledged messages become visible again for redelivery. If the function timeout is too short, valid work gets aborted, and if the visibility timeout is shorter than the processing time, the message is re-delivered before the first attempt finishes, causing duplicate work and retries that inflate the backlog. Setting the visibility timeout to 90 seconds (longer than the 60-second function timeout) ensures the message stays hidden until the Lambda function either succeeds or itself times out, giving the function the full time it needs.

CodePipeline natively orchestrates cross-account deployments through its CloudFormation action, which can be configured with a role ARN to assume in each target account. A dedicated CodeBuild project running cfn-lint performs static validation in an isolated build stage, while subsequent CloudFormation deployment actions use that assumed role to create or update stacks per account. This separation allows you to add manual approvals, run parallel deployments, and reuse the same artifact across accounts without embedding cloud logic in a single script.

AWS CodeBuild is a fully managed continuous integration service that compiles code, runs test suites, and produces build artifacts in a scalable, ephemeral environment. Its buildspec configuration can install dependencies, execute unit and integration tests against a serverless app (using frameworks like Jest or Mocha), and publish test reports to AWS services. CodeBuild integrates naturally with AWS CodePipeline, making it the correct choice for automating testing of a serverless application.

S3 Event Notifications on the CloudTrail bucket fire for each new log file object, invoking a Lambda function within seconds of delivery, which is near real time because CloudTrail delivers log files roughly every 5 minutes. The Lambda function can decompress the gzipped JSON, parse all API records, and use a DynamoDB table to record when a user creates an access key, then check subsequent calls in the same or later log files against that table to identify a match within 24 hours. This event-driven architecture minimizes latency compared to polling and supports the stateful correlation needed to detect the suspicious pattern accurately.

Amazon S3 Block Public Access provides a bucket-level setting that, when enabled, overrides all other public-access grants by ignoring bucket policies and object ACLs that allow public access, including those that grant access to `*`. This control is evaluated at the edge before any policy or ACL decision and is not overridable by explicit allow statements, making it a highly effective preventative measure. Because it is a native access control, enabling it immediately blocks both existing and future public exposure without requiring you to rewrite the bucket policy.

Attaching AWS WAF to the Application Load Balancer adds a managed Layer 7 firewall that filters incoming HTTP(S) requests before they reach the target group. WAF can block common web exploits such as SQL injection, cross-site scripting (XSS), and excessive request patterns via rate-based rules, and it integrates with AWS Managed Rules for OWASP Top 10 protection. This is a required security action for a publicly exposed web workload because security groups alone only control transport-level access and cannot inspect payloads, and it can be used alongside AWS Shield for DDoS mitigation.

ecr:DescribeRepositories is the exact IAM action required to call the ECR DescribeRepositories API, which CodeBuild uses to list repositories and retrieve their metadata (repository name, ARN, URI, creation timestamp, and image scanning configuration). If this permission is missing from the CodeBuild service role, any attempt to enumerate or describe repositories will fail with AccessDenied. This is the root cause of the failure in the scenario.

RunInstances requires permissions on resources like images, security groups, etc., which are not allowed.

AWS Security Hub is the correct answer because it is designed as a multi-account, multi-region aggregation service that centralizes security findings from AWS services and partner products. It enables a delegated administrator to view a consolidated security posture across the entire AWS Organizations hierarchy, evaluate compliance against standards like CIS and NIST, and automate responses via custom actions and AWS Config rules.

HealthyHostCount directly reflects the number of targets that are passing the configured health checks. For a target group with EC2 instances, it is the authoritative CloudWatch metric for monitoring target health; when all instances fail, this value drops to zero, leaving the ALB with no registered and healthy targets to serve traffic, which causes it to return HTTP 503 Service Unavailable. Therefore, it is the correct metric to identify the described incident.

Lambda enforces hard quotas on deployment package size: 50 MB for a direct .zip upload, 250 MB for a .zip uploaded from an S3 bucket, and 250 MB for the uncompressed size including layers. In a CodePipeline/CloudFormation deployment, the Lambda code is staged in S3 and then referenced by CloudFormation; if that package exceeds Lambda's 250 MB uncompressed limit, the underlying API call returns a RequestEntityTooLargeException, which exactly matches the size-related failure observed.

Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS. This is the correct pattern because ALB listeners combine a protocol/port with rule actions: the HTTP (port 80) listener can have a rule that returns a 301/302 redirect to the same path on the HTTPS listener (port 443). This enforces HTTPS at the access point, automatically upgrades clients, and leaves web servers free to handle only HTTP/HTTPS as needed, typically with TLS terminated at the ALB.

The target group tied to the Auto Scaling group acts as the traffic-routing endpoint for the load balancer. If its health check path, port, or timeout settings are misconfigured—or if it is not attached to the appropriate listener rule—the newly deployed instances will be registered but immediately marked unhealthy and deregistered, so no user traffic reaches them. CodeDeploy itself successfully completes its scripts, but the deployment outcome appears as a routing failure, not an instance-level failure.

AWS CloudTrail is the authoritative service for auditing API calls, and it natively records Systems Manager management events such as SendCommand, RunCommand, and StartSession. When a trail is enabled (or via the default event history), each event includes the IAM principal, source IP address, event time, request parameters, and response elements, yielding a complete 'who did what' record. This is precisely what is needed to audit and govern SSM usage across an EC2 fleet.

AWS Config can be enabled to record configuration changes to Elastic Beanstalk environments and their underlying AWS resources (such as EC2 instances, security groups, and load balancers). By authoring or using managed Config rules, you can compare the actual environment settings to the desired baseline and receive SNS notifications or trigger SSM remediation when drift is detected. This provides a continuous, auditable change history and alerts you to unauthorised or accidental configuration modifications, allowing you to restore the correct settings quickly.

The policy shown contains an explicit Allow for ec2:DescribeInstances on Resource '*' and an explicit Deny only for ec2:TerminateInstances; there is no Deny for DescribeInstances and no region condition on the Allow. Under IAM evaluation, an Allow for an action with no matching explicit Deny results in the action being permitted, so DescribeInstances is allowed in any region. Therefore, if a user cannot describe instances outside us-east-1, the policy fragment is not the cause; the problem must stem from another factor such as a service control policy (SCP), a permission boundary, a session policy, or a VPC endpoint policy that restricts the API call.

Files placed in the .ebextensions directory of your application source bundle are processed automatically by Elastic Beanstalk during each deployment lifecycle. A .config file in this directory can use the 'files' key to write configuration content directly to absolute paths on the instance, and it can also run commands or container_commands in sequence with deployment events. Because these configuration files are part of the versioned source bundle, they are associated with a specific application version and are re-applied consistently whenever that version is deployed, making this the correct way to inject a configuration file into each instance during deployment.

The CodePipeline service role must be explicitly listed as a principal in the artifact bucket's bucket policy with permissions like s3:GetObject, s3:PutObject, and s3:ListBucket. If the bucket policy is missing or uses the wrong role ARN, the pipeline gets an AccessDenied error when trying to read or write artifacts. This is the correct root cause because CodePipeline validates bucket access via the bucket policy and the attached IAM role policies.

API Gateway imposes a hard 10 MB payload size limit for REST API responses (and 4 MB for HTTP APIs). When a Lambda function returns a response exceeding this threshold, API Gateway cannot process it and returns a 502 Bad Gateway error to the client, with no error logged from the Lambda side because the function already completed successfully. This is the classic 'silent' 502 cause and matches the symptoms in the question.

Amazon VPC Flow Logs is the native service that captures IP traffic metadata for network interfaces in a VPC, including source and destination IPs, ports, protocol, and packet/byte counts for both accepted and rejected traffic. These logs can be published to Amazon S3 or CloudWatch Logs for long-term retention and analysis with services like Athena. As a result, VPC Flow Logs provides the flow-level visibility needed to monitor network traffic to and from a VPC.

Reviewing the stack events in the CloudFormation console is the recommended first step because each event logs the status of every resource operation, and a failed resource includes a StatusReason field with the specific error message returned by the underlying AWS service. These event details reveal the root cause, such as an invalid property value, insufficient IAM permissions, or a resource limit exceeded, enabling you to make a targeted fix. This is the most direct and authoritative source of troubleshooting information for a failed stack operation.

Run Command is a Systems Manager capability that lets you execute shell scripts or PowerShell commands on one or more EC2 instances via the SSM Agent, without the need for SSH/RDP or opening inbound ports. By invoking documents like AWS-RunShellScript or AWS-RunPowerShellScript, you can directly enforce configuration settings, install software, or remediate configuration drift on demand. It supports rate control, error thresholds, and IAM-based permission scoping, making it a direct and flexible mechanism for enforcing instance configuration.

AWS EventBridge (CloudWatch Events) can be configured with a cron or rate expression to invoke the StartPipelineExecution API action on CodePipeline as a rule target. This provides a fully managed, scheduled trigger for pipelines, commonly used for nightly builds, recurring data syncs, or regular compliance scans. It is a legitimate automated trigger that does not require any external activity, making it ideal for time-based initiation.

This is the correct solution because it combines three complementary layers. The VPC endpoint for S3 (a gateway endpoint) ensures that all traffic to the bucket originates from within the company's VPC, and the bucket policy denies any request unless the aws:SourceVpce condition matches that endpoint, effectively blocking public internet access. The aws:SecureTransport condition forces all requests to use HTTPS, protecting data in transit from eavesdropping and man-in-the-middle attacks. Finally, enabling S3 default encryption (SSE-S3) ensures that artifact objects are encrypted at rest, so even if an object is somehow copied outside the bucket, its contents remain unintelligible without the encryption key. Together these controls satisfy both transit and at-rest encryption while restricting the attack surface to the VPC.

AWS Config rules continuously evaluate resource configurations, including tags, against your desired policy and can trigger automatic remediation when a resource is non-compliant. Remediation actions are implemented through AWS Systems Manager Automation runbooks, such as AWS-TagEC2Instance to add the required tag or AWS-StopEC2Instance to stop the resource, or through a custom Lambda function. This provides a fully automated, auditable corrective control that detects and fixes tag non-compliance at scale without manual intervention.

AWS X-Ray provides end-to-end tracing with segment details, allowing you to see latency per API endpoint and downstream dependencies.

AWS CloudTrail is the native auditing service that records every API call made in the account, including calls from the console, SDKs, CLI, and other AWS services. Each event captures the identity of the caller, source IP, time, request and response elements, and the specific action invoked. This makes CloudTrail the correct and only service in this list that directly provides a complete API call history for auditing.

Correctly enforces HTTPS by denying non-secure transport.

Defining a parameter of type AWS::EC2::Subnet::Id lets the caller supply the actual subnet at stack creation or update, and CloudFormation validates that the value is a real subnet ID. Referencing it via Ref keeps the template portable across environments, and the parameter appears in the console or CLI for clear input.

For a true cross-region disaster recovery, an Amazon RDS read replica in a second region can be promoted to a standalone primary instance during failover. The replica is typically created with asynchronous replication, so some data loss may occur, but it provides a writable database endpoint in the secondary region. This is a standard DR pattern for maintaining business continuity.

Parameters with AllowedValues is the correct mechanism because it defines an input variable whose acceptable values are explicitly enumerated at template authoring time. When the stack is created or updated, CloudFormation validates any supplied value against that list and rejects the operation if the value is not present. This provides a controlled menu of environment-specific options (e.g., Dev, Staging, Prod) or instance types, ensuring the multi-tier app is deployed with a valid, pre-approved configuration.

The EC2 system log (console output) is a hypervisor-accessible snapshot of the instance's serial port, capturing kernel panics, OOM killer events, and boot-time failures that may be invisible from inside the OS. Pairing that with CloudWatch Logs—where the CloudWatch agent streams Apache, Nginx, or custom application errors—gives you a non-disruptive, evidence-based starting point to pinpoint whether the web service stopped due to memory exhaustion, a crashed process, or an external dependency. These sources are available via the EC2 console or the get-console-output CLI call and require no downtime, making them the correct first step for diagnosis.

Elastic Beanstalk saved configurations are YAML files that capture the environment's option settings, environment variables, and platform configuration. You can store these files in source control, which gives you versioned, auditable, and reproducible configuration snapshots. When you need to roll back a problematic change, you can apply an older saved configuration via the EB CLI or console, restoring the exact previous runtime settings without re-provisioning infrastructure.

Credentials are not replicated across Multi-AZ; they must be the same.

Instrumenting the application with the X-Ray SDK adds tracing headers to each incoming HTTP request and tracks the request as it flows through the EC2-hosted application and any downstream calls to databases or other services. X-Ray segments and subsegments capture the exact service, operation, and any exceptions or faults that occur, enabling a trace map that pinpoints the failing component or code path. This gives per-request context and error stack traces needed to resolve application-level errors definitively.

When a user clicks the 'Cancel' button in the CloudFormation console, or an automation script invokes DeleteStack during a creation operation, CloudFormation aborts pending resource creation and emits a 'Resource creation cancelled' event for each in-progress resource. The stack then transitions to ROLLBACK_IN_PROGRESS, destroying any resources that were successfully created before the cancellation. This event reason directly matches the manual or scripted interruption described in the correct answer.

The CloudFormation console Events tab lists every operation performed on a stack in chronological order, one per resource action, including statuses like CREATE_FAILED and UPDATE_FAILED. For each failed event, the Status Reason field contains the exact error message returned by the underlying service, such as an IAM permission issue or a missing S3 bucket. This is the authoritative source for diagnosing stack deployment problems.

The policy's only explicit Allow is ec2:DescribeInstances; because ec2:StopInstances is a separate action in the IAM action namespace, no permission is granted to perform a stop. When the user calls StopInstances, IAM finds no allow and defaults to an implicit deny, so the API request fails. The Deny statement on RunInstances does not counteract this, so the missing start/stop Allow is precisely the cause.

Correct. The policy grants actions only on log streams, missing permissions on the log group itself.

CodeDeploy supports blue/green deployments on ECS with automatic rollback based on alarms.

Enabling the RDS slow query log captures every SQL statement whose execution exceeds the configured long_query_time threshold, recording details like query text, execution duration, rows examined, and timestamps. By publishing these log events to CloudWatch Logs, you gain a searchable, historical record that can be queried with CloudWatch Logs Insights to filter for the slowest statements, identify patterns, and correlate with other metrics. This directly exposes the exact SQL causing performance issues, making it a definitive diagnostic method for slow query analysis.

The correct diagnosis is that the function's timeout setting is too low. The 3000 ms Duration exactly matches the default Lambda timeout of 3 seconds, and the 'Task timed out' error means Lambda terminated the handler at its configured limit. Raising the timeout, after reviewing the code for inefficiencies, would allow the function to complete successfully.

AWS Secrets Manager is a purpose-built service for storing and managing database credentials and other sensitive secrets. It provides native automatic rotation, including native integration with Amazon RDS, Redshift, and DocumentDB, which enforces credential lifecycle management and reduces the operational burden of periodic rotation. Its resource-based policies and tight integration with AWS Lambda and IAM make it the correct, secure choice for handling sensitive data.

MemoryUtilization, published as a custom metric by the CloudWatch Agent, is calculated from /proc/meminfo or OS-level memory counters and represents the percentage of actual RAM in use. A memory leak causes this value to climb continuously over time as allocations are never freed, even when the workload is stable. Monitoring this metric reveals the leak as a monotonic upward trend, making it one of the most direct and essential signals for detection.

Enabling versioning on the bucket creates a new version for every object put, overwrite, or delete, so a delete operation only inserts a delete marker that hides old versions rather than purging them; with versioning enabled, you can permanently recover any object version. MFA Delete fortifies this by requiring an MFA code (using root credentials) to permanently delete an object version, suspend versioning, or change the versioning state—thus preventing attackers or accidental admin actions from irreversibly destroying data.

With session stickiness enabled on the ALB target group, the load balancer consistently routes a given client's requests to the same EC2 instance for the stickiness duration. When a few power users or long-lived connections generate heavy traffic, those specific instances absorb a disproportionate share of load, causing CPU utilization to spike even if the aggregate fleet average remains moderate. This creates a hot-spot pattern where some targets are saturated while others idle, and the Auto Scaling group, if scaling on average CPU, may not react in time.

The DynamoDB lock table uses conditional writes to ensure that only one Terraform run can hold the state lock at a time, preventing two `apply` executions from simultaneously updating the same S3 object and causing corruption. Enabling consistency checks (for example, verifying the lock acquisition and using DynamoDB's strongly consistent reads) ensures that the state pulled before a plan or apply is the latest known-good version, so stale or partially written state is never used as the basis for changes.

buildspec.yml is the correct file because AWS CodeBuild automatically looks for a file named buildspec.yml in the root of the source code directory, unless an alternate buildspec file is specified in the build project. This YAML file defines the build phases—install, pre_build, build, and post_build—along with environment variables, artifact output, and cache settings. For a Java application, the `build` phase would contain commands such as `mvn compile` or `gradle build` to compile the source code. Without a valid buildspec, CodeBuild will fail unless an inline buildspec is provided in the project configuration.

AWS Config conformance packs provide a way to deploy a collection of AWS Config rules and remediation actions across all accounts and Regions in an organization. A managed rule such as `cloudtrail-enabled` can be included in a conformance pack to verify that CloudTrail trails are configured and enabled, and the results are aggregated centrally in the AWS Config console for the entire organization. This approach gives a single, policy-as-code mechanism to enforce and audit CloudTrail enablement consistently across every account.

The AWS CLI's high-level command aws s3 cp does not directly invoke GetObject on a known key; it first performs a ListObjectsV2 operation to discover the objects in the bucket. Even if the IAM policy allows s3:GetObject, without the s3:ListBucket permission the CLI receives AccessDenied when attempting to list the source bucket. This is a common gotcha because users assume GetObject is sufficient for downloads, but the CLI's behavior requires both actions for object transfer commands.

Commit the variables in a .ebextensions/*.config file (e.g., option_settings for namespace aws:elasticbeanstalk:application:environment). CodePipeline packages the entire source into the application version, and the Elastic Beanstalk deployment agent processes this file automatically, injecting the values into the Node.js process's environment. This makes environment configuration declarative, versioned, and reproducible for every pipeline run, eliminating manual or post-deployment steps.

CodePipeline's S3 source action resolves the artifact by object key at the moment the pipeline execution starts. If an external system overwrites or deletes that object during the run, the pipeline may fetch a different revision or fail entirely because the original content no longer exists. Enforcing immutability through a write-once policy or access controls prevents this race condition and guarantees the pipeline operates on a stable artifact.

Switching to count mode allows monitoring and tuning of WAF rules to eliminate false positives while still detecting SQL injection. Implementing an IAM policy with the aws:SourceArn condition key restricts database access to only approved AWS services, enhancing security beyond network controls.

VPC Flow Logs capture IP traffic metadata for every network interface in a VPC, subnet, or at the interface level, recording source and destination IP addresses, ports, protocol, packet/byte counts, and whether the action was accepted or rejected by security groups and network ACLs. Enabling flow logs on the affected VPC or subnets would immediately provide the raw data needed to identify the top talkers, unusual port usage, or malicious sources behind the spike. This makes it the correct service for diagnosing an unexpected increase in network traffic.

The correct approach in OpsWorks Stacks is to run the original 'Setup' recipe manually on the layer by using the 'Execute Recipes' action, which re-applies the Chef code that installs and configures the previous PHP version on all instances. Because lifecycle recipes should be idempotent, re-running the Setup recipe restores the desired PHP version without needing to recreate instances or manually edit files. This leverages OpsWorks's intended pattern for configuration changes and updates all instances in the layer in a controlled, automated manner.

A promoted read replica is a new database instance with a distinct DNS endpoint; the original master endpoint does not automatically reroute to the replica. Applications that connect using the old endpoint will continue hitting the original instance (or fail if it is down), so you must update your connection strings or configuration to use the promoted replica's endpoint. In complex environments, this is often managed via a CNAME that can be repointed to the replica, but the core requirement is that clients resolve to the new master.

The root cause is a TLS protocol version mismatch: the MySQL client library in the Docker image is too old to negotiate TLS 1.2, which is the minimum version required by Amazon RDS for MySQL. Rebuilding the Docker image with the latest MySQL client libraries ensures the client supports TLS 1.2 (and later), allowing the SSL handshake to succeed. This is the correct fix because it directly addresses the version negotiation failure at the transport layer without forcing insecure protocol fallbacks.

A PodDisruptionBudget with maxUnavailable:1 guarantees that at most one Pod is unavailable during voluntary evictions such as node drains, and pod anti-affinity rules (preferably with topologyKey kubernetes.io/hostname) force the scheduler to place replicas on distinct nodes. This means an involuntary node failure can kill only one replica, and the remaining replicas continue to serve traffic. Combined, these mechanisms directly address both failure classes—involuntary hardware failures and voluntary maintenance—by ensuring the application always has at least N-1 replicas available across different failure domains.

This creates a custom metric for error count.

DeletionPolicy: Retain on a resource instructs AWS CloudFormation to preserve that physical resource when the stack is deleted. Without it, DeleteStack removes every resource in the template; with Retain, the resource is simply left in place and becomes orphaned, allowing you to keep critical data such as databases or S3 buckets. This is the standard way to prevent accidental data loss during stack deletion.

Rotating the access keys means generating a new access key pair for the IAM user, updating dependent applications with the new credentials, and then deactivating and deleting the compromised keys. This immediately denies requests signed with the stolen keys because IAM checks key validity for every call, making it the fastest, least-disruptive way to stop the attacker.