AWS Certified DevOps Engineer Professional DOP-C02 (DOP-C02) — Questions 1201–1275

A TLS-enabled ELB (ALB or NLB) terminates the TLS/SSL handshake with clients, decrypting traffic at the AWS edge and thereby providing the cryptographic controls required for cardholder data in transit under PCI DSS Requirement 4. It also allows you to attach an AWS Certificate Manager certificate and optionally re-encrypt traffic to backend targets, so the load balancer is a correct service for securing communications.

Amazon ECR image scanning automatically checks container images for known vulnerabilities (CVEs) by integrating with Amazon Inspector. In a CI/CD pipeline, you can invoke a scan after pushing an image to ECR, then retrieve findings via an API and block the deployment if critical vulnerabilities exist. This directly satisfies the requirement to identify known security vulnerabilities in images before they are deployed.

Adding a manual approval action is the native CodePipeline mechanism for inserting a human gate before a deploy action. When the pipeline reaches this action, the execution status changes to OnHold, and the pipeline pauses until an authorized user approves or rejects the action via the console, AWS CLI, or API. You can also configure an SNS notification or a custom URL (e.g., a change request ticket) to guide the approver; if approved, the deploy action automatically proceeds, which directly satisfies the requirement for a manual sign-off before deployment.

Amazon ElastiCache for Redis is a fully managed in-memory data store that provides sub-millisecond read/write latencies and is ideal for storing transient session state. It supports replication across Availability Zones and automatic failover, so the session store remains available even if a container task is rescheduled or an Availability Zone fails. Because it is external to the ECS task, the session data persists independently of the container lifecycle, enabling stateless containers and horizontal scaling of the web tier.

The 'phases' section is the correct place to implement failure logic because CodeBuild evaluates the exit status of each shell command run in its sub-sections (install, pre_build, build, post_build). If any command exits with a non-zero status, the build is stopped immediately and marked as FAILED. For a security scan, you would invoke your scanning tool in the 'build' phase and rely on that exit status to signal failure. This is the only mechanism that directly controls the build outcome.

The max_connections parameter in the RDS parameter group defines the hard ceiling of allowed simultaneous client connections; if this limit is being hit, legitimate application requests are rejected with 'too many connections'. Reviewing this value against your connection pool settings and raising it if it's legitimately too low can provide immediate relief, but doing so without understanding why the number of connections jumped can exhaust memory or threads because each connection consumes resources. Also, changing the parameter group may require a reboot depending on whether it's a static or dynamic parameter, so monitor after applying.

The Amazon CloudWatch agent is installed as a DaemonSet to run on every node in the EKS cluster, enabling it to gather node, pod, and container metrics from the Kubernetes API, kubelet, and container runtime. It publishes these metrics to the CloudWatch Container Insights namespace and can also collect Prometheus metrics. This is the standard, fully integrated method for enabling Container Insights on EKS.

The RunningTaskCount metric is an ECS control-plane metric automatically emitted by AWS for each service and cluster, including services running on Fargate. An alarm on this metric can directly compare the current running task count against a threshold or the DesiredTaskCount, and notify via SNS when it falls below expected levels. This is the simplest, most direct way to detect service degradation without any additional agents or instrumentation.

Origin Shield is an optional intermediate cache layer that sits between CloudFront edge locations and the origin, aggregating requests from all edges. When multiple edges miss their local cache for the same object, Origin Shield consolidates those requests into a single origin fetch and caches the result globally, raising the effective hit ratio for the entire distribution and reducing origin traffic. It also adds resilience by absorbing request spikes and lowering latency for revalidation.

Multi-AZ deployment creates a primary DB instance and a standby replica in a different Availability Zone, using synchronous physical replication to keep the standby transactionally consistent. When an AZ failure, network outage, or instance health check failure occurs, Amazon RDS automatically flips the DNS CNAME to the standby within about 60–120 seconds, providing automatic failover without manual intervention. This is the only option that gives the DB instance true high availability with a single endpoint, which is why it is correct.

EC2 instance recovery replaces the instance and ALB health checks will automatically re-register it once healthy.

Performance Insights identifies the top queries by CPU usage.

An Auto Scaling group with a minimum of two instances across two Availability Zones is the most complete solution because it combines horizontal scaling with automated self-healing. The ASG continuously monitors instance health and automatically replaces failed instances, while distributing the workload across two AZs ensures that a single Availability Zone outage does not eliminate all capacity. This is the gold standard for highly available EC2 architectures.

A deployment configuration with a 25% failure margin means that the minimum healthy instances threshold is set to 75% (or the equivalent fleet percentage). CodeDeploy continuously monitors the health of each instance across lifecycle events; if more than one quarter of the instances fail or abort, the remaining healthy percentage drops below 75%, and CodeDeploy terminates the deployment to protect the service. The state becomes 'Failed' with a message about the minimum healthy instances threshold being breached.

The health check associated with the primary ALB endpoint continued to receive a valid HTTP 200 response, so Route 53 considered the resource healthy and did not trigger failover to the secondary region. Even though an AZ was experiencing an outage, the ALB is a regional service that can remain available if it is deployed in other AZs, or the outage may have been in a different part of the region. Since the health check threshold was never breached, Route 53 had no reason to update DNS records.

This is the correct multi-tier security group design because it enforces least privilege with instance-level granularity. The web tier security group allows only HTTP/S from the internet, the app security group allows traffic only from the web security group (not from any IP or CIDR), and the database security group allows only from the app security group. Using security group references instead of CIDR blocks means that any instance bearing the web SG is automatically allowed to reach the app tier, which makes scaling and instance replacement seamless without updating rules. This approach is stateful, so responses are automatically allowed, and it is far more secure than subnet-level NACL rules, which are stateless and cannot distinguish between instances within the same subnet.

When the BucketName property is omitted from an S3 bucket resource, CloudFormation automatically generates a globally unique name by combining the stack name with a random suffix (e.g., my-stack-s3bucket-1a2b3c4d5e6f). This generated name guarantees uniqueness across all AWS accounts and regions, because the random component virtually eliminates collision risk. CloudFormation then exposes this generated name through the Ref function and the resource's physical ID, allowing other resources to reference it without ever needing to know the exact value beforehand. This is the simplest and most reliable way to avoid bucket-name conflicts without manual input.

This is the correct answer because S3 bucket names are globally unique and are not released immediately after deletion. When a bucket is deleted, S3 enters a 'pending deletion' state where the name is still reserved for a variable period (usually minutes, sometimes up to an hour). Attempting to create a new bucket with that same name, whether through CloudFormation or the CLI, results in a BucketAlreadyExists (or BucketAlreadyOwnedByYou for the same account) error until the name is fully released. Since the stack previously managed a bucket with the same name and deleted it, the name is likely still in this cleanup window.

Global Accelerator provides cross-region failover.

This is correct because interface endpoints (AWS PrivateLink) for Amazon ECR provide private connectivity from your VPC without requiring internet access. You need to create both the ECR API endpoint and the ECR Docker Registry (DKR) endpoint, and then configure the CodeBuild project to use the VPC, subnet, and security group associated with those endpoints. This allows the build to pull images and push to ECR securely over the AWS network.

Enabling encryption when creating the DB instance with a customer-managed KMS key is a valid method for encrypting data at rest.

A graceful reboot via the AWS Management Console or CLI sends an ACPI reboot signal to the guest OS, which restarts the operating system and all application processes while preserving the instance ID, private IP, EBS volumes, and attached Elastic IP. This is the fastest and least disruptive recovery action for transient conditions like memory leaks or a stuck process, and it typically resolves the issue within minutes without requiring reconfiguration.

AWS CloudTrail is the correct service because it records all KMS API requests as events, including both management-plane actions like CreateKey and EnableKeyRotation and data-plane operations like Encrypt, Decrypt, and GenerateDataKey. Each event includes details such as the caller identity, source IP address, key ID, and timestamp, which allows you to audit key usage and detect unauthorized access after the fact.

Without a NAT gateway, the build container cannot access the public internet to pull the image.

This is the correct answer because an SCP attached at the root or OU can deny cloudformation:UpdateStack, UpdateStackSet, DeleteStack, and related actions for all IAM principals in those accounts. SCPs are permission boundaries that take effect even for highly privileged IAM roles, and the denial is evaluated before any IAM policy grants, making it a preventive control. CloudFormation StackSets allows you to deploy a consistent SCP to every account in the organization in one operation, ensuring a uniform 'freeze' across the entire environment. This enables incident responders to immediately halt all stack modifications, which squarely meets the requirement to prevent changes.

Timeout indicates no response from the web server.

CloudWatch Logs Insights enables you to run SQL-like queries across log groups that receive application and system logs from EC2 instances via the unified CloudWatch agent. By filtering for messages between 1:55 PM and 2:05 PM and searching for terms such as 'cron,' 'schedule,' or the job name, you can identify a recurring batch process that coincides with the spike. This is a non-invasive, first-step diagnostic that directly associates application behavior with the CPU metric.

In CloudFormation's AWS::RDS::DBInstance resource, DBInstanceClass and Engine are mandatory properties for every instance. DBInstanceClass defines the instance's compute and memory capacity, while Engine specifies the database engine (e.g., mysql, postgres). Without these, the resource automatically fails validation because CloudFormation can't provision a database without a compute class and an engine type. This makes this pair the correct answer for the property required universally.

For a CloudWatch alarm to transition from ALARM to OK, it must evaluate a specified number of consecutive periods where the metric is below the threshold (e.g., 3 of 3 datapoints below 90%). After the CPU spike dropped back down, the alarm has only recently started seeing low datapoints; until enough consecutive okay datapoints are evaluated, the alarm state remains ALARM. This is CloudWatch's default state-transition behavior to avoid flapping, not a misconfiguration.

An SCP attached at the AWS Organizations root or an OU can deny the specific IAM actions that grant public access, such as s3:PutBucketAcl with a condition like s3:x-amz-acl=public-read or s3:PutBucketPolicy. Because SCPs act as a governance boundary across all accounts in the organization, they proactively prevent a bucket from ever becoming public, but they do not remediate existing buckets that are already public, so this is a preventive, not detective, control.

A central S3 bucket in the logging account must accept writes from all other accounts' logging services. The bucket policy must grant the specific service principals (e.g., cloudtrail.amazonaws.com and logs.amazonaws.com) from each account permission to perform s3:PutObject, while restricting access to the prefix paths so logs remain separated. This bucket policy is the foundational enabler for cross-account log delivery and is therefore a mandatory prerequisite for the entire solution.

Launching additional EC2 instances in a second Availability Zone and registering them with the NLB target group creates a multi-AZ target fleet, allowing the load balancer to route new connections to healthy instances in the surviving zone when the original zone has an outage. To make this work you must also configure the NLB itself with subnets in at least two AZs so its nodes are geographically distributed; then the target group's health checks automatically remove failed instances and keep the service available. This is the correct architecture for fault tolerance because it eliminates the single AZ as a point of failure and aligns with AWS's region-based resiliency patterns.

Amazon EventBridge (formerly CloudWatch Events) is the correct service because it provides a default event bus that captures AWS service events, including CodeCommit repository events like 'Reference Created', 'Reference Updated', and 'Reference Deleted'. By defining a rule with an event pattern filtered by repository and branch, EventBridge can directly trigger a CodeBuild project through a built-in integration, passing commit details like the commit ID and branch name to the build, enabling fully event-driven CI/CD without custom glue code.

Adding a test stage immediately after the build stage with a script using the AWS CLI or SDK to call ecr:DescribeImages for the specific repository and image tag validates that the expected artifact exists before deployment. This automated gate runs in every pipeline execution, catches missing or mis-tagged images at the earliest practical point, and fails the pipeline with a clear error rather than letting the deploy stage fail late. It is the correct, lightweight fix that does not alter build behavior.

SCPs can restrict API calls across accounts, enforcing encryption at creation time.

RDS Proxy pools and shares database connections between the application and the RDS instance, so when a Multi-AZ failover occurs, the proxy keeps existing client connections alive and transparently re-routes them to the new primary. This eliminates the connection storms and reconnection lag that normally slow application recovery after failover. The proxy also shortens the failover window by avoiding the need for each application thread to re-establish its own session, making HA failover faster and more reliable for stateful applications.

The IAM policy includes an explicit Allow for ec2:StopInstances, and no explicit Deny statement covers StopInstances. Under IAM evaluation logic, an explicit Allow overrides the default implicit Deny, and since no explicit Deny applies, the request is permitted. Therefore, the user can stop the instance regardless of its running state.

Amazon DynamoDB global tables provide a fully managed multi-Region, multi-master replication solution that maintains two or more identical tables across AWS Regions. When a write is issued to any replica, DynamoDB automatically propagates that write to every other region using DynamoDB Streams, with last-writer-wins conflict resolution to reconcile concurrent updates. This makes global tables the appropriate choice for an active-active architecture because each region can accept both reads and writes while providing low-latency access for geographically distributed users. The service handles the replication plumbing, versioning, and conflict resolution internally, eliminating the need for custom code.

Lambda concurrency is the number of in-flight invocations across all resources. When a function's execution time is long, each invocation holds a concurrency slot for the entire duration, so the configured reserved concurrency of 100 can be reached with relatively few requests. Once all slots are occupied, Lambda throttles additional invocations with a 429 error, and the SQS event source mapping receives a failure, causing messages to remain in the queue. This is the classic cause of throttling with long-running workers, not the other options.

Cross-Region read replicas replicate with low lag, achieving RPO under 5 minutes.

Adding a manual approval action between the build and deploy stages creates a required gate that pauses pipeline execution, satisfying the constraint that only authorised personnel can approve production deployments. Configuring the SNS topic enables the pipeline to send email or SMS notifications to the designated approvers, ensuring they are alerted to review and approve the change before CodeDeploy proceeds.

AWS Secrets Manager is designed for managing database credentials and provides native automatic rotation. Its RDS rotation Lambda blueprint creates a Lambda function that updates the secret and the database user password on a defined schedule, without application changes. The service also tracks secret versions and supports KMS encryption, making it the secure, fully managed choice for this requirement.

Create an IAM role that defines the exact AWS API permissions the container needs, then specify that role in the task definition using the taskRoleArn parameter. The ECS agent—on Fargate or EC2—assumes this role on behalf of the task and exposes temporary credentials to the container via the ECS credential endpoint, so the SDK automatically rotates them. This is the recommended pattern because it scopes credentials to a single task, follows least privilege, and eliminates the need to manage any static access keys.

The instance profile must allow actions like ec2:StartInstances or ssm:StartAutomationExecution if the recipe uses those, or the application may need permissions to access resources.

AWS Secrets Manager is purpose-built for securely storing, rotating, and auditing access to secrets, with encryption via KMS at rest and in transit. By assigning the CodeBuild service role an IAM policy that allows secretsmanager:GetSecretValue for the specific secret, you can inject the secret directly into the build environment using the 'secrets-manager' environment variable type in the buildspec, ensuring the actual secret material never appears in logs, the console, or CloudFormation templates. Secrets Manager also provides automatic rotation (e.g., for RDS credentials), CloudTrail API logging for every retrieval, and fine-grained control through resource-based policies, making it the most secure and operationally efficient option for CodeBuild credential management.

The Average statistic computes the mean DatabaseConnections over the 5-minute interval, which inherently dampens short-lived fluctuations and reveals the central tendency of connection concurrency. If the average exceeds the 80% threshold, it means the typical number of connections during the entire window was too high, matching the criterion of sustained usage for more than 5 minutes. This is the most appropriate aggregation for a threshold alarm aimed at detecting prolonged saturation of the connection pool.

This pattern gives the application explicit control over failover by first attempting to read from the primary bucket and, on failure (e.g., throttling, regional outage, or S3 service disruption), switching to a pre-created bucket in another Region. It is a common active-passive architecture that avoids reliance on any AWS feature providing automatic DNS-level or data-plane failover. Because the application itself detects the failure, it can also manage consistency, replication lag, and write buffering appropriately. This satisfies the recovery requirement because data availability is maintained as long as at least one Region is operational.

For the rotation function to update credentials on RDS, it must be deployed inside the same VPC or have a route to it; if the Lambda function lacks VPC configuration, its ENI never gets a private IP in the RDS subnet. Each invocation then tries to open a socket to the database but has no network path, so it consumes the entire configured timeout and Secrets Manager reports rotation as failed. Merely granting IAM permissions for secretsmanager and RDS does not create network connectivity, so this is the root cause when the error is consistently a timeout rather than an access-denied.

AWS Config can detect non-compliant instances (e.g., missing required tags) and trigger SSM Automation to perform remediation actions.

Enabling CloudWatch Logs is the correct approach because every Lambda invocation automatically emits a REPORT log entry containing a Duration field, for example 123.45 ms, along with billed duration and memory usage. This is generated by the Lambda managed runtime, so there is no need to instrument the application code. You can use CloudWatch Logs Insights with a filter such as filter @type = 'REPORT' to query and parse these entries across all invocations, making it an efficient and fully managed solution for extracting execution duration.

StackSets enable multi-Region deployment for resilience.

An SCP attached to the affected account or its OU in AWS Organizations acts as a guardrail across every principal in the account, including the account root user and all IAM users and roles. By explicitly denying * , the SCP reduces each principal's effective permissions to an empty set, and because SCPs can only be changed by an administrator in the management account, neither the compromised root user nor any IAM user can detach or bypass the lockdown. This provides full account quarantine, which is exactly what the scenario requires.

Terminating the instance is the correct action because it triggers the Auto Scaling group to detect the lost capacity through its health checks and immediately launch a fresh instance from the launch template, restoring the desired instance count automatically. This approach ensures the replacement is clean, conforms to the group's configuration, and avoids the downtime and statefulness of manual repair, making it the most efficient and reliable recovery mechanism.

AWS Systems Manager Run Command is part of AWS Systems Manager and lets you remotely and securely execute shell commands or PowerShell scripts on EC2 instances (and on-premises machines) via the SSM Agent. You can run a command like `ps aux` or `Get-Process` to enumerate running processes, capture output, and store it in S3 or CloudWatch Logs. Because the SSM Agent runs inside the instance as a guest process, it has direct access to OS-level state, making it the appropriate service for collecting process-level data. It also supports rate control and error handling for fleet-wide execution.

Raising the Lambda function's reserved concurrency to 500 is correct because it directly increases the maximum number of simultaneous executions, allowing the SQS event source mapping to scale out beyond the previous limit and process more messages in parallel. With a higher concurrency ceiling, incoming SQS messages are consumed faster, preventing the burst of throttling attempts that occur when the function is already running at its current cap. This aligns with Lambda's SQS scaling model, where the number of active pollers grows with the message volume until the reserved concurrency is exhausted.

Git LFS in CodeCommit replaces large binary files with small pointer files in the repository and stores the actual binary content in an S3 bucket managed by the service. When developers clone the repo, they only fetch pointers, keeping the repository small and clones fast; the actual binary is downloaded on demand when checking out a specific revision. This maintains Git's full versioning, branching, and commit atomicity while ensuring that the repository itself never bloats.

The `SecurityGroupIds` property of an EC2 instance is typed as a list of security group IDs. When you use `!Ref` on a security group resource, CloudFormation resolves it to the security group's physical ID as a single string, not an array. Because the property requires a `List<AWS::EC2::SecurityGroup::Id>`, passing a bare `!Ref` causes a type-validation failure. To fix it, you must wrap the reference in a list literal, e.g., `SecurityGroupIds: [!Ref MySecurityGroup]`, or use `Fn::Split` if composing from a string.

The ECS service's Application Auto Scaling target tracking policy is capped by a maximum capacity of 10 tasks. Since the service is already running at that desired count of 10, the policy cannot scale out any further even though the CloudWatch metric is above the target value. To resolve the issue, increase the maximum tasks (for example, from 10 to 15) in the scaling configuration, which allows the policy to add more task instances.

.ebextensions files are processed by Elastic Beanstalk during environment creation and every instance deployment, allowing you to use a container command to copy the configuration from a private S3 bucket. Using an IAM instance role with a least-privilege policy scoped to that bucket keeps credentials out of code, and the configuration can be updated independently of the application.

The bucket policy contains an explicit deny statement for the principal or action being attempted, and AWS IAM policy evaluation gives explicit deny statements absolute precedence over any allow statements from identity-based policies, resource-based policies, or permission boundaries. Even though the IAM role allows the s3:GetObject call, the explicit deny in the bucket policy forces the final decision to AccessDenied. This precedence is a deterministic, non-configurable part of AWS's authorization engine.

Remediation actions in AWS Config require the Lambda function to have an IAM role that is assumable in every member account where the rule runs. When using the AWS-provided remediation action 'AWS-ConfigureSecurityGroupChanges' or a custom Lambda function, that role must include permissions such as ec2:AuthorizeSecurityGroupIngress, ec2:RevokeSecurityGroupIngress, and similar actions scoped to the target security groups. Without those permissions, the Lambda execution fails with an AccessDenied error even though the event was delivered and the function started. This is the most direct cause of the failure because the rule is detecting and triggering correctly, but the remediation cannot modify the resources.

To encrypt a CloudWatch Logs log group with a customer-managed KMS key, you must create or select a KMS key, update its key policy to grant the CloudWatch Logs service principal permissions such as kms:Encrypt, kms:Decrypt, kms:GenerateDataKey*, and kms:DescribeKey, and then associate that key with the log group using the console or the associate-kms-key API. This server-side encryption protects log data at rest and allows CloudWatch Logs to decrypt the data internally for features like log queries.

If the ZIP file is exceptionally large (approaching Lambda's 50 MB compressed limit), the time CloudFormation takes to download it from S3 and create the Lambda resource can exceed the stack resource creation timeout. This manifests as a 'Resource creation timed out' error in the stack event, even though the function is valid. In contrast, a small package deploys quickly regardless of the Lambda function's configured timeout or role permissions.

A service control policy that denies `cloudformation:DeleteStack` is correct because SCPs act as an account/OU-level permissions boundary that applies to every principal in the organization, regardless of their IAM policies, and cannot be overridden by account administrators. The management account is exempt from SCPs, so you must protect it separately, and you can add a condition key—such as `aws:PrincipalArn`—to whitelist a break-glass role while denying everyone else. This gives centralized, preventive control that IAM policies and termination protection cannot match.

Allows recovery from backups in another Region.

AWS CodeBuild webhooks natively support filter groups that include FILEPATH patterns, allowing you to trigger a build only when a committed file under a specified path (e.g., 'services/payment/**') changes. Each microservice can have its own CodeBuild project and webhook, so commits to unrelated services do not waste compute time. Additionally, the buildspec can further refine the build with conditional phases, giving precise, automated control without custom infrastructure.

The approver needs permissions to submit the approval result.

The CodeBuild service role is the IAM role that the build service assumes at runtime to perform actions on your behalf, including fetching source code from Amazon S3. If the role's attached policy lacks an s3:GetObject action on the source bucket, the build start fails with an AccessDenied error that names the role. This is the correct diagnosis because CodeBuild's access to source objects is governed entirely by the service role, not by the caller's user-level S3 permissions.

DynamoDB on-demand capacity protects against table-level throttling but still enforces a per-partition limit of about 1,000 write capacity units. When access patterns are uneven, such as a single partition key receiving a disproportionate share of writes from the Kinesis stream, that partition hits its limit and throttles requests even though the overall table has plenty of capacity. Adaptive capacity can redistribute some of this load, but it is not instantaneous and does not fully prevent throttling during sharp spikes.

The SSM Agent downloads patch binaries directly from the configured patch repositories, such as Windows Update or Linux package mirrors, using HTTPS on TCP port 443. If the instance's security group or subnet NACL blocks outbound HTTPS, the agent cannot reach these repositories, leading to a patch download failure. This is the most common network-level cause, especially when the instance can otherwise communicate with the Systems Manager API but fails specifically during patch retrieval.

This is the correct solution because CloudWatch natively supports creating dashboards that display multiple operational metrics, and alarms on DynamoDB consumed capacity can be configured to trigger SNS notifications (e.g., email) when thresholds are exceeded. The dashboard can be shared as a public read-only dashboard using the CloudWatch console's 'Share' feature, which generates a URL that grants view-only access without requiring IAM credentials or Cognito. This directly addresses both the need for at-a-glance monitoring and threshold-based alerting on DynamoDB capacity, making it the most operationally sound and low-overhead option.

This statement uses 'Deny' with the condition 'aws:SecureTransport': 'false', meaning that any time S3 sees a request to this bucket that did not use TLS/SSL, the condition is satisfied and the explicit deny applies, causing the request to be rejected. HTTPS requests have SecureTransport set to true, so they are not affected by this particular statement and may be allowed or denied based on other applicable policies. This is a standard pattern to enforce HTTPS-only access to S3 buckets.

AWS CodeDeploy's ECS blue/green deployment creates a new 'green' task set with the new application version while preserving the original 'blue' task set and its target group. During the deployment, CodeDeploy shifts load balancer traffic from blue to green using a canary or linear strategy, and you can define post-deployment hooks and wait times. CloudWatch alarms, such as a failing health check on the green service or increased error rate, trigger a CodeDeploy rollback that automatically reroutes traffic to the blue task set and kills the green tasks. This gives microservices teams zero-downtime release with fully automated rollback—directly meeting the requirement.

The correct issue is that this Lambda execution role lacks any inline or managed policy granting the required CloudWatch Logs permissions. Without a policy allowing logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents, Lambda cannot write execution logs to CloudWatch, even though the trust policy is valid. This will cause runtime failures or missing log output, and is a common misconfiguration.