AWS Certified DevOps Engineer Professional DOP-C02 (DOP-C02) — Questions 1351–1425

A trail can be configured to log only data events, which capture S3 object-level activity, Lambda invocations, and similar resource operations, while excluding management events that record account-level actions like ConsoleLogin. Because the lookup query for ConsoleLogin returns nothing, the trail is evidently not capturing management events. This is the most plausible reason for the missing event, as CloudTrail trails default to logging management events unless explicitly set to data events only.

AWS CloudTrail is the correct answer because it is the native AWS service designed to record all API activity across your account. Every management event, including calls made by users, roles, or AWS services, is captured with details like the identity of the caller, source IP address, event time, request parameters, and response elements. By creating a trail, you can deliver these audit logs to an S3 bucket for long-term storage and enable CloudTrail Insights to detect anomalous API activity, which directly satisfies the requirement to ensure all API calls are audited.

Customer managed keys are the only KMS key type that supports manual rotation, allowing you to create a new key and update aliases as needed at any time. By manually rotating every 90 days, the company can enforce its required rotation policy while keeping the same alias or key ID for applications. This gives full control over rotation frequency, unlike automatic rotation which is fixed at yearly.

Distributing instances across AZs provides high availability for the web tier.

The default EC2 monitoring only exposes hypervisor-level metrics like CPU, network, and disk I/O; memory utilization is a guest-OS metric that AWS cannot see without an in-guest component. Installing the unified CloudWatch agent (with the `mem_used_percent` and similar metrics in the agent's JSON config) and starting the `amazon-cloudwatch-agent` service enables the agent to publish memory metrics to CloudWatch, making them available for alarms and dashboards. This is required because no amount of instance-level monitoring settings can surface guest-OS memory.

AWS Systems Manager Patch Manager is a purpose-built capability that automates the process of patching managed instances, whether they are EC2 instances or on-premises servers. It works in tandem with patch baselines, maintenance windows, and rate control to approve, schedule, and install patches, and it also reports patch compliance for the fleet. With the SSM Agent installed, Patch Manager uses a standard SSM document such as AWS-RunPatchBaseline to execute the patch operation, making it the correct choice for automated OS patching.

The correct approach is to authenticate the local Docker daemon to the private ECR registry using 'aws ecr get-login-password' piped to 'docker login', then build your image with 'docker build', tag it with the ECR repository URI, and run 'docker push'. This satisfies ECR's token-based authentication and uploads Docker layers directly to the registry's S3-backed storage. It is the only way among the choices that actually moves image data into ECR.

Circuit breaker pattern monitors calls to a remote service and maintains three states—closed, open, and half-open—progressing to open when failure thresholds are exceeded, at which point subsequent calls fail fast without attempting the network operation. This prevents a failing service from being overwhelmed and stops the same repeated errors from saturating caller resources, thereby breaking the chain of cascading failures and giving the dependency time to recover.

Amazon S3 server access logs are the native, purpose-built mechanism for auditing who accessed a specific S3 bucket or object. When you enable server access logging on a bucket, S3 writes a log record for every request, including the requester's AWS account ID (or 'Anonymous' for unauthenticated requests), the bucket name, object key, request type (GET, PUT, etc.), response status, and timestamp. These logs are delivered to a target bucket you specify, and they provide the granular object-level history needed to answer 'who accessed this specific object?'. Although delivery is best-effort and logs may arrive asynchronously, they are the canonical source for S3 access-level audits.

CodeBuild executes in a managed build environment that uses a specified image (e.g., Amazon Linux with a particular JDK, Node.js, or Python version) and its own set of environment variables and pre-installed tool versions, which may differ from the developer's local machine. Dependency resolution without strict lockfiles can pull different minor or patch versions of libraries in CodeBuild than those present locally, leading to behavioral changes that break tests intermittently. Similarly, environment variables such as API endpoints, feature flags, or locale settings can alter application logic at runtime. This environmental divergence is the classic 'works on my machine' problem and directly explains why tests pass locally but intermittently fail in CodeBuild.

AWS Config rules continuously evaluate EC2 instances against compliance criteria such as mandatory tags or VPC membership. When an instance violates a rule, Config marks it non-compliant and can trigger remediation actions like Lambda functions, but it does not block the initial launch. This makes it a detective control that identifies drift after the fact rather than preventing non-compliant resources from being created.

This is the correct approach. Developers should sign commits locally, and a pre-commit hook can enforce that unsigned commits are rejected before they are made. This provides client-side enforcement, which is the only option available within CodeCommit's constraints.

Amazon EFS is the correct choice because it provides a fully managed NFS file system that is regional by default, with mount targets in every AZ to deliver continuous shared access. Cache data written to EFS persists independently of any individual EC2 instance, so when an instance fails and is replaced, the new instance simply mounts the same file system and immediately has the full cache. It also scales automatically and supports concurrent access from many instances, making it the only viable shared, cross-AZ cache service among these options.

This is the correct pattern: API Gateway exposes a public HTTPS endpoint that the Jira webhook POSTs to, and API Gateway invokes a Lambda function to process the payload. The Lambda function can then validate the webhook signature, extract branch metadata, and use the AWS CodeCommit SDK (e.g., CreateBranch with the target commit ID) to perform the branch creation in real time. This serverless design gives you a low-latency, exactly-once-ish webhook receiver without needing to run persistent infrastructure.

The build phase executes `python setup.py build`, which requires a `setup.py` file to be present in the current working directory (the root of the source checkout). If the repository lacks this file—for instance, if it uses `pyproject.toml` or is a plain script—the Python interpreter exits with `python: can't open file 'setup.py': [Errno 2] No such file or directory`, causing the build to fail. This error occurs during the build phase, so no later phases are reached.

Drift detection compares the live S3 bucket policy against the CloudFormation template and reports resource drift. An EventBridge rule listens for CloudFormation drift-detection status-change events and invokes Lambda, which re-applies the original bucket policy or triggers a stack update to restore the resource. This closes the loop between detecting drift and automatically remediating it.

Amazon SNS is a fully managed pub/sub messaging service that supports multiple subscription protocols, including email (as well as HTTP, Lambda, SQS, etc.). To receive CloudFormation stack event notifications, you create an SNS topic, subscribe an email address to it, and specify the topic ARN in the CloudFormation stack's `NotificationARNs` property. When the stack state changes, CloudFormation publishes the event to the topic, and SNS delivers an email to every confirmed subscriber.

If the timeout is too low, increasing it may resolve false positives.

Creating a source stage with AWS CodeCommit as the source provider is required because the pipeline needs a trigger and a location for the application source code, including the Dockerfile and any build specifications. CodeCommit is the native Git repository service on AWS, and integrating it with CodePipeline allows automatic pipeline execution on every push to the configured branch. This provides version-controlled source securely within AWS, avoiding the need for external credentials or additional network access.

SCPs can deny actions across all accounts.

Performance Insights delivers a comprehensive, real-time view of database load, breaking down utilization by waits, SQL statement, and host. By drilling into the 'Top SQL' section, you can pinpoint the exact queries consuming the most CPU, along with statistics such as rows examined and temp tables. This evidence-based approach allows you to optimize indexes or rewrite expensive statements, directly addressing the observed CPU spike.

This is correct. When Elastic Beanstalk performs a deployment that replaces instances (such as an immutable or rolling update with a new Auto Scaling group), the new instances are launched with the environment's current security group. If that security group is not explicitly added as an allowed source in the RDS database's security group inbound rules, the new instances will be denied TCP (or PostgreSQL/MySQL) connections, even though the application code and database settings are unchanged. You must authorize the Elastic Beanstalk environment's security group ID (or its attached load balancer's security group) in the RDS security group to allow traffic from the latest instance replacements.

AWS WAF is the correct choice because it is a fully managed web application firewall that attaches directly to an Application Load Balancer to inspect each incoming HTTP/HTTPS request at the application layer. It can block, allow, or count requests matching conditions such as SQL injection signatures, XSS patterns, IP reputation lists, geo restrictions, and header or body size limits. AWS-managed rule groups, including the OWASP Top 10 rule sets, provide ready-made protection, and WAF integrates natively with ALB to stop malicious traffic before it reaches the EC2 instances.

This is correct because an SQS-triggered Lambda invocation has a maximum execution window set by the function timeout, and the SQS visibility timeout controls when unacknowledged messages become visible again for redelivery. If the function timeout is too short, valid work gets aborted, and if the visibility timeout is shorter than the processing time, the message is re-delivered before the first attempt finishes, causing duplicate work and retries that inflate the backlog. Setting the visibility timeout to 90 seconds (longer than the 60-second function timeout) ensures the message stays hidden until the Lambda function either succeeds or itself times out, giving the function the full time it needs.

Lambda has a concurrency limit (account, region, or reserved concurrency). When the event source mapping polls SQS and receives messages but the service can't obtain a concurrency slot to invoke the function, those messages stay 'in flight' with the SQS visibility timer running. If the visibility timeout is shorter than the time spent throttled, SQS makes the messages visible again and the poller can receive them a second time — so the same message is processed after the function eventually runs, creating apparent duplicates. This matches the symptom of repeated processing rather than a poison-pill failure or configuration error.

CodePipeline natively orchestrates cross-account deployments through its CloudFormation action, which can be configured with a role ARN to assume in each target account. A dedicated CodeBuild project running cfn-lint performs static validation in an isolated build stage, while subsequent CloudFormation deployment actions use that assumed role to create or update stacks per account. This separation allows you to add manual approvals, run parallel deployments, and reuse the same artifact across accounts without embedding cloud logic in a single script.

AWS CodeBuild is a fully managed continuous integration service that compiles code, runs test suites, and produces build artifacts in a scalable, ephemeral environment. Its buildspec configuration can install dependencies, execute unit and integration tests against a serverless app (using frameworks like Jest or Mocha), and publish test reports to AWS services. CodeBuild integrates naturally with AWS CodePipeline, making it the correct choice for automating testing of a serverless application.

S3 Event Notifications on the CloudTrail bucket fire for each new log file object, invoking a Lambda function within seconds of delivery, which is near real time because CloudTrail delivers log files roughly every 5 minutes. The Lambda function can decompress the gzipped JSON, parse all API records, and use a DynamoDB table to record when a user creates an access key, then check subsequent calls in the same or later log files against that table to identify a match within 24 hours. This event-driven architecture minimizes latency compared to polling and supports the stateful correlation needed to detect the suspicious pattern accurately.

Amazon S3 Block Public Access provides a bucket-level setting that, when enabled, overrides all other public-access grants by ignoring bucket policies and object ACLs that allow public access, including those that grant access to `*`. This control is evaluated at the edge before any policy or ACL decision and is not overridable by explicit allow statements, making it a highly effective preventative measure. Because it is a native access control, enabling it immediately blocks both existing and future public exposure without requiring you to rewrite the bucket policy.

Attaching AWS WAF to the Application Load Balancer adds a managed Layer 7 firewall that filters incoming HTTP(S) requests before they reach the target group. WAF can block common web exploits such as SQL injection, cross-site scripting (XSS), and excessive request patterns via rate-based rules, and it integrates with AWS Managed Rules for OWASP Top 10 protection. This is a required security action for a publicly exposed web workload because security groups alone only control transport-level access and cannot inspect payloads, and it can be used alongside AWS Shield for DDoS mitigation.

ecr:DescribeRepositories is the exact IAM action required to call the ECR DescribeRepositories API, which CodeBuild uses to list repositories and retrieve their metadata (repository name, ARN, URI, creation timestamp, and image scanning configuration). If this permission is missing from the CodeBuild service role, any attempt to enumerate or describe repositories will fail with AccessDenied. This is the root cause of the failure in the scenario.

RunInstances requires permissions on resources like images, security groups, etc., which are not allowed.

This is correct because it embeds the approval workflow into IAM itself, making it impossible to bypass via the AWS Management Console or CLI. The IAM policy denies cloudformation:UpdateStack for all principals except when the request is made by a service role with the path /ci-cp/, which can be enforced using the aws:PrincipalPath condition key. The CI/CD pipeline assumes that dedicated service role, so only code changes that pass through the pipeline can trigger stack updates. This combines an explicit Deny with a positive condition, eliminating any dependence on manual discipline and ensuring that junior users without that role cannot update stacks even if they have broad IAM permissions.

AWS Security Hub is the correct answer because it is designed as a multi-account, multi-region aggregation service that centralizes security findings from AWS services and partner products. It enables a delegated administrator to view a consolidated security posture across the entire AWS Organizations hierarchy, evaluate compliance against standards like CIS and NIST, and automate responses via custom actions and AWS Config rules.

HealthyHostCount directly reflects the number of targets that are passing the configured health checks. For a target group with EC2 instances, it is the authoritative CloudWatch metric for monitoring target health; when all instances fail, this value drops to zero, leaving the ALB with no registered and healthy targets to serve traffic, which causes it to return HTTP 503 Service Unavailable. Therefore, it is the correct metric to identify the described incident.

Lambda enforces hard quotas on deployment package size: 50 MB for a direct .zip upload, 250 MB for a .zip uploaded from an S3 bucket, and 250 MB for the uncompressed size including layers. In a CodePipeline/CloudFormation deployment, the Lambda code is staged in S3 and then referenced by CloudFormation; if that package exceeds Lambda's 250 MB uncompressed limit, the underlying API call returns a RequestEntityTooLargeException, which exactly matches the size-related failure observed.

By enabling default encryption on the S3 bucket used as CodePipeline's artifact store—or specifying an AWS KMS customer-managed key in the pipeline settings—all build outputs and source artifacts are encrypted at rest with either SSE-S3 or SSE-KMS. This protects sensitive data from unauthorized direct access to the bucket, even if the bucket policy or ACL is misconfigured. Using KMS adds an additional layer of control by letting you restrict which roles can decrypt artifacts and enabling CloudTrail auditing of all decrypt operations.

Creating an ECR lifecycle policy is the correct action because it automatically applies expiration rules to images in the chosen repository. Lifecycle policies evaluate images based on criteria like tag status and age, then expire matching images for you. They are managed through the ECR service (console, CLI, or SDK), not through the CI/CD build steps, and are the standard mechanism for controlling image retention and storage costs.

Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS. This is the correct pattern because ALB listeners combine a protocol/port with rule actions: the HTTP (port 80) listener can have a rule that returns a 301/302 redirect to the same path on the HTTPS listener (port 443). This enforces HTTPS at the access point, automatically upgrades clients, and leaves web servers free to handle only HTTP/HTTPS as needed, typically with TLS terminated at the ALB.

During an RDS Multi-AZ failover, the existing TCP connections to the primary instance are forcibly closed, and the database endpoint's DNS CNAME is updated to point to the new primary. If the application does not implement connection retry with exponential backoff, it will never re-establish those dropped connections, causing an outage even after the failover completes. Retry logic with backoff and jitter is the standard, required practice for any production application using RDS, especially when combined with a connection pool or RDS Proxy.

The target group tied to the Auto Scaling group acts as the traffic-routing endpoint for the load balancer. If its health check path, port, or timeout settings are misconfigured—or if it is not attached to the appropriate listener rule—the newly deployed instances will be registered but immediately marked unhealthy and deregistered, so no user traffic reaches them. CodeDeploy itself successfully completes its scripts, but the deployment outcome appears as a routing failure, not an instance-level failure.

AWS CloudTrail is the authoritative service for auditing API calls, and it natively records Systems Manager management events such as SendCommand, RunCommand, and StartSession. When a trail is enabled (or via the default event history), each event includes the IAM principal, source IP address, event time, request parameters, and response elements, yielding a complete 'who did what' record. This is precisely what is needed to audit and govern SSM usage across an EC2 fleet.

AWS Config can be enabled to record configuration changes to Elastic Beanstalk environments and their underlying AWS resources (such as EC2 instances, security groups, and load balancers). By authoring or using managed Config rules, you can compare the actual environment settings to the desired baseline and receive SNS notifications or trigger SSM remediation when drift is detected. This provides a continuous, auditable change history and alerts you to unauthorised or accidental configuration modifications, allowing you to restore the correct settings quickly.

The policy shown contains an explicit Allow for ec2:DescribeInstances on Resource '*' and an explicit Deny only for ec2:TerminateInstances; there is no Deny for DescribeInstances and no region condition on the Allow. Under IAM evaluation, an Allow for an action with no matching explicit Deny results in the action being permitted, so DescribeInstances is allowed in any region. Therefore, if a user cannot describe instances outside us-east-1, the policy fragment is not the cause; the problem must stem from another factor such as a service control policy (SCP), a permission boundary, a session policy, or a VPC endpoint policy that restricts the API call.

Files placed in the .ebextensions directory of your application source bundle are processed automatically by Elastic Beanstalk during each deployment lifecycle. A .config file in this directory can use the 'files' key to write configuration content directly to absolute paths on the instance, and it can also run commands or container_commands in sequence with deployment events. Because these configuration files are part of the versioned source bundle, they are associated with a specific application version and are re-applied consistently whenever that version is deployed, making this the correct way to inject a configuration file into each instance during deployment.

The CodePipeline service role must be explicitly listed as a principal in the artifact bucket's bucket policy with permissions like s3:GetObject, s3:PutObject, and s3:ListBucket. If the bucket policy is missing or uses the wrong role ARN, the pipeline gets an AccessDenied error when trying to read or write artifacts. This is the correct root cause because CodePipeline validates bucket access via the bucket policy and the attached IAM role policies.

A central S3 bucket with a bucket policy that enforces HTTPS (aws:SecureTransport) and SSE-KMS via conditions like s3:x-amz-server-side-encryption, while restricting writes to specific CloudTrail principals/accounts and reads to a security team IAM role, provides a defense-in-depth approach. This pattern forces all log deliveries to be encrypted at rest with KMS keys you control and creates an auditable, centralized logging endpoint, which is the AWS-recommended way to aggregate CloudTrail logs.

API Gateway imposes a hard 10 MB payload size limit for REST API responses (and 4 MB for HTTP APIs). When a Lambda function returns a response exceeding this threshold, API Gateway cannot process it and returns a 502 Bad Gateway error to the client, with no error logged from the Lambda side because the function already completed successfully. This is the classic 'silent' 502 cause and matches the symptoms in the question.

Amazon VPC Flow Logs is the native service that captures IP traffic metadata for network interfaces in a VPC, including source and destination IPs, ports, protocol, and packet/byte counts for both accepted and rejected traffic. These logs can be published to Amazon S3 or CloudWatch Logs for long-term retention and analysis with services like Athena. As a result, VPC Flow Logs provides the flow-level visibility needed to monitor network traffic to and from a VPC.

Reviewing the stack events in the CloudFormation console is the recommended first step because each event logs the status of every resource operation, and a failed resource includes a StatusReason field with the specific error message returned by the underlying AWS service. These event details reveal the root cause, such as an invalid property value, insufficient IAM permissions, or a resource limit exceeded, enabling you to make a targeted fix. This is the most direct and authoritative source of troubleshooting information for a failed stack operation.

Run Command is a Systems Manager capability that lets you execute shell scripts or PowerShell commands on one or more EC2 instances via the SSM Agent, without the need for SSH/RDP or opening inbound ports. By invoking documents like AWS-RunShellScript or AWS-RunPowerShellScript, you can directly enforce configuration settings, install software, or remediate configuration drift on demand. It supports rate control, error thresholds, and IAM-based permission scoping, making it a direct and flexible mechanism for enforcing instance configuration.

AWS EventBridge (CloudWatch Events) can be configured with a cron or rate expression to invoke the StartPipelineExecution API action on CodePipeline as a rule target. This provides a fully managed, scheduled trigger for pipelines, commonly used for nightly builds, recurring data syncs, or regular compliance scans. It is a legitimate automated trigger that does not require any external activity, making it ideal for time-based initiation.

This is the correct solution because it combines three complementary layers. The VPC endpoint for S3 (a gateway endpoint) ensures that all traffic to the bucket originates from within the company's VPC, and the bucket policy denies any request unless the aws:SourceVpce condition matches that endpoint, effectively blocking public internet access. The aws:SecureTransport condition forces all requests to use HTTPS, protecting data in transit from eavesdropping and man-in-the-middle attacks. Finally, enabling S3 default encryption (SSE-S3) ensures that artifact objects are encrypted at rest, so even if an object is somehow copied outside the bucket, its contents remain unintelligible without the encryption key. Together these controls satisfy both transit and at-rest encryption while restricting the attack surface to the VPC.

AWS Config rules continuously evaluate resource configurations, including tags, against your desired policy and can trigger automatic remediation when a resource is non-compliant. Remediation actions are implemented through AWS Systems Manager Automation runbooks, such as AWS-TagEC2Instance to add the required tag or AWS-StopEC2Instance to stop the resource, or through a custom Lambda function. This provides a fully automated, auditable corrective control that detects and fixes tag non-compliance at scale without manual intervention.

AWS X-Ray provides end-to-end tracing with segment details, allowing you to see latency per API endpoint and downstream dependencies.

AWS CloudTrail is the native auditing service that records every API call made in the account, including calls from the console, SDKs, CLI, and other AWS services. Each event captures the identity of the caller, source IP, time, request and response elements, and the specific action invoked. This makes CloudTrail the correct and only service in this list that directly provides a complete API call history for auditing.

Correctly enforces HTTPS by denying non-secure transport.

Defining a parameter of type AWS::EC2::Subnet::Id lets the caller supply the actual subnet at stack creation or update, and CloudFormation validates that the value is a real subnet ID. Referencing it via Ref keeps the template portable across environments, and the parameter appears in the console or CLI for clear input.

For a true cross-region disaster recovery, an Amazon RDS read replica in a second region can be promoted to a standalone primary instance during failover. The replica is typically created with asynchronous replication, so some data loss may occur, but it provides a writable database endpoint in the secondary region. This is a standard DR pattern for maintaining business continuity.

Parameters with AllowedValues is the correct mechanism because it defines an input variable whose acceptable values are explicitly enumerated at template authoring time. When the stack is created or updated, CloudFormation validates any supplied value against that list and rejects the operation if the value is not present. This provides a controlled menu of environment-specific options (e.g., Dev, Staging, Prod) or instance types, ensuring the multi-tier app is deployed with a valid, pre-approved configuration.

The EC2 system log (console output) is a hypervisor-accessible snapshot of the instance's serial port, capturing kernel panics, OOM killer events, and boot-time failures that may be invisible from inside the OS. Pairing that with CloudWatch Logs—where the CloudWatch agent streams Apache, Nginx, or custom application errors—gives you a non-disruptive, evidence-based starting point to pinpoint whether the web service stopped due to memory exhaustion, a crashed process, or an external dependency. These sources are available via the EC2 console or the get-console-output CLI call and require no downtime, making them the correct first step for diagnosis.

Elastic Beanstalk saved configurations are YAML files that capture the environment's option settings, environment variables, and platform configuration. You can store these files in source control, which gives you versioned, auditable, and reproducible configuration snapshots. When you need to roll back a problematic change, you can apply an older saved configuration via the EB CLI or console, restoring the exact previous runtime settings without re-provisioning infrastructure.

Credentials are not replicated across Multi-AZ; they must be the same.

Instrumenting the application with the X-Ray SDK adds tracing headers to each incoming HTTP request and tracks the request as it flows through the EC2-hosted application and any downstream calls to databases or other services. X-Ray segments and subsegments capture the exact service, operation, and any exceptions or faults that occur, enabling a trace map that pinpoints the failing component or code path. This gives per-request context and error stack traces needed to resolve application-level errors definitively.

The Lambda rotation function must perform multiple sequential operations—connect to the RDS database, run an ALTER USER statement, and call UpdateSecret to store the new password—all of which can exceed the default 3-second timeout, especially during cold starts or slow network conditions. Increasing the function timeout directly prevents the execution from being terminated mid-rotation, allowing the full workflow to complete before Secrets Manager marks the step as failed. This is the correct fix because timeout errors indicate the function is being killed before finishing, not that it lacks compute resources or network access.

When a user clicks the 'Cancel' button in the CloudFormation console, or an automation script invokes DeleteStack during a creation operation, CloudFormation aborts pending resource creation and emits a 'Resource creation cancelled' event for each in-progress resource. The stack then transitions to ROLLBACK_IN_PROGRESS, destroying any resources that were successfully created before the cancellation. This event reason directly matches the manual or scripted interruption described in the correct answer.

An Application Load Balancer is a regional, layer-7 service that can route traffic to healthy targets across multiple Availability Zones. By placing EC2 instances in different AZs and registering them in the ALB's target group, the ALB automatically performs health checks and reroutes traffic away from unhealthy instances or entirely failed AZs. This design ensures that if one AZ becomes unavailable, the ALB continues to serve requests using instances in the other AZ. The combination of cross-zone load balancing and health-based target removal makes this the industry-standard resilient architecture.

The CloudFormation console Events tab lists every operation performed on a stack in chronological order, one per resource action, including statuses like CREATE_FAILED and UPDATE_FAILED. For each failed event, the Status Reason field contains the exact error message returned by the underlying service, such as an IAM permission issue or a missing S3 bucket. This is the authoritative source for diagnosing stack deployment problems.

The policy's only explicit Allow is ec2:DescribeInstances; because ec2:StopInstances is a separate action in the IAM action namespace, no permission is granted to perform a stop. When the user calls StopInstances, IAM finds no allow and defaults to an implicit deny, so the API request fails. The Deny statement on RunInstances does not counteract this, so the missing start/stop Allow is precisely the cause.

Correct. The policy grants actions only on log streams, missing permissions on the log group itself.

CodeDeploy supports blue/green deployments on ECS with automatic rollback based on alarms.

Enabling the RDS slow query log captures every SQL statement whose execution exceeds the configured long_query_time threshold, recording details like query text, execution duration, rows examined, and timestamps. By publishing these log events to CloudWatch Logs, you gain a searchable, historical record that can be queried with CloudWatch Logs Insights to filter for the slowest statements, identify patterns, and correlate with other metrics. This directly exposes the exact SQL causing performance issues, making it a definitive diagnostic method for slow query analysis.

The correct diagnosis is that the function's timeout setting is too low. The 3000 ms Duration exactly matches the default Lambda timeout of 3 seconds, and the 'Task timed out' error means Lambda terminated the handler at its configured limit. Raising the timeout, after reviewing the code for inefficiencies, would allow the function to complete successfully.

AWS Secrets Manager is a purpose-built service for storing and managing database credentials and other sensitive secrets. It provides native automatic rotation, including native integration with Amazon RDS, Redshift, and DocumentDB, which enforces credential lifecycle management and reduces the operational burden of periodic rotation. Its resource-based policies and tight integration with AWS Lambda and IAM make it the correct, secure choice for handling sensitive data.

State Manager judges an association as successful based on the exit code returned by the script; if the script's last command always returns 0, or it explicitly ends with `exit 0`, then even a failed installation will be recorded as compliant. To correctly reflect failures, the script must inspect `$?` (or `$LASTEXITCODE` in PowerShell) after the installer and propagate a non-zero exit. Because this script ignores the installer's failure and exits 0, compliance shows Success despite the software not being installed.