AWS Certified DevOps Engineer Professional DOP-C02 (DOP-C02) — Questions 451–525

The CloudWatch agent runs on each instance to collect system metrics and application logs, then ships them to CloudWatch. This delivers the managed monitoring service the company requires, replacing Nagios without self-managed infrastructure, and satisfies the instance health, metrics and logs monitoring requirement.

CodeBuild is the required compute stage in a static website pipeline: it pulls the source from CodeCommit, executes build commands such as minification, Sass compilation, or image optimization, and outputs the production-ready artifacts to a staging location. Without a build project, the pipeline would simply copy raw source files, missing any transformation needed for the final site. CodeBuild integrates directly with CodePipeline and writes artifacts to S3, making it the only component explicitly running build commands.

The pipeline role's policy scopes `iam:PassRole` to a single resource ARN, so CodePipeline cannot hand CodeBuildServiceRole2 to CodeBuild. Starting a build requires passing the project's service role; the mismatched ARN triggers AccessDenied. Broadening the resource to the intended role ARN resolves it.

AWS CloudFormation StackSets let you define a stack containing the AWS Config rule once and deploy it to specified accounts across the organization. With service-managed StackSets, you can enable automatic deployment so that any new account added to the organization is automatically provisioned with the stack, ensuring the Config rule exists in every account. This centrally manages the rule's lifecycle and avoids needing per-account manual setup, making it the appropriate solution.

Checking the backend service's application logs in CloudWatch Logs is the correct initial action because it provides direct visibility into application errors, database query execution times, and slow transactional paths. These logs, combined with ECS task metrics and ALB access logs, help isolate whether the high latency is due to application code, database contention, or an upstream dependency. Logs are the least intrusive and most informative diagnostic step, enabling an evidence-based decision before changing infrastructure.

The central S3 bucket needs a resource-based policy that explicitly grants the source accounts' log-delivery services (e.g., CloudTrail, VPC Flow Logs) permission to write objects and read the bucket ACL. Without this bucket policy, cross-account writes from other accounts will be denied by default. The policy must reference the source account IDs or the organization ID and include conditions like aws:SourceAccount or aws:SourceArn to prevent confused deputy attacks. This is a mandatory step to enable centralized log collection.

EventBridge matches the PutBucketPolicy API call from CloudTrail and routes it to an SNS topic, giving near-real-time notification without polling. This is more efficient than scheduled log analysis or S3 event notifications, which do not cover bucket policy changes.

This Deny statement uses a condition key such as aws:SourceAccount with an operator like StringNotEquals, which evaluates as true when the key is missing from the request context. Because an explicit Deny overrides all Allow statements, the request is denied whenever the expected source account is not present in the request. This is the precise cause of the AccessDenied error.

A CloudWatch Logs metric filter is applied to a log group in near-real time as log events are ingested, and it uses pattern syntax to count occurrences of the string 'ERROR' and emit a custom metric (e.g., ErrorCount) for that log group. The CloudWatch alarm is then configured on that custom metric with an evaluation period of 5 minutes, so if the number of ERROR log lines within a 5-minute interval exceeds the configured threshold, the alarm state changes to ALARM and can trigger an SNS notification. This is the standard, fully managed mechanism for log-pattern-based alerting because it does not require any custom code or additional infrastructure, and it integrates directly with CloudWatch alarm actions.

Upgrading the compute type in the buildspec—from the default BUILD_GENERAL1_SMALL (3 GB memory) to BUILD_GENERAL1_MEDIUM (7 GB) or BUILD_GENERAL1_LARGE (15 GB)—is the correct fix because CodeBuild's compute-type property directly controls the memory and vCPU allocated to the build container. Java compilation through Maven or Gradle is memory-intensive, and a small instance can easily cause the JVM or compiler daemon to run out of heap space. Selecting a larger general-purpose tier gives the build process a proportionally larger heap and OS memory, resolving the OOM without changing application code.

CloudFormation uses the IAM service role's permissions when performing stack updates. If the role lacks ec2:DescribeSubnets, the update fails with an access denied error, exactly as shown in the exhibit. This permission is required for CloudFormation to validate the subnet and retrieve its attributes during the update. Adding ec2:DescribeSubnets to the role's policy resolves the issue.

AWS CodePipeline is a fully managed continuous delivery service that orchestrates the entire release workflow, from source through build to deployment. As an orchestration engine, it can directly invoke AWS CloudFormation actions to provision or update infrastructure stacks at any stage. It supports custom actions, manual approval gates, and seamless integration with other AWS services, making it the correct choice for automating infrastructure provisioning as part of a CI/CD pipeline.

Migrating to cluster mode enabled with multiple shards horizontally partitions the Redis keyspace across nodes, which directly lowers per-shard CPU utilization and enables linear scaling as traffic grows. Enabling Multi-AZ with automatic failover and placing read replicas in different AZs provides high availability and lets reads be served by replicas, reducing primary node load and cutting failover time from minutes to seconds—this tackles both the immediate CPU bottleneck and the resilience requirement for a production e-commerce platform.

Placing a single S3 bucket in a centralized logging account with a bucket policy that grants s3:PutObject to principals in all source accounts is the most efficient pattern because CloudTrail, VPC Flow Logs, and similar services can deliver logs cross-account natively without additional moving parts. The bucket policy can restrict writes using aws:SourceArn or aws:SourceAccount conditions to prevent the confused-deputy problem, and the central account owns objects for unified lifecycle and access control. This direct-write model achieves lower latency and zero maintenance compared to middleware or copying mechanisms.

Adding a bucket policy that explicitly grants the CodeBuild project's IAM role ARN the s3:GetObject action is a resource-based policy approach. It complements the identity-based policy attached to the role and ensures S3 evaluates the permission grant directly, which is required when the bucket account enforces resource policies or when the bucket resides in a different account. This explicit allow on the bucket side removes any dependency on implicit same-account authorization and is a secure, scoped way to permit object retrieval.

ALB access logs capture full request-level detail for every HTTP request the load balancer receives, including the exact HTTP response code returned to the client (e.g., 503) and the target processing time, which is the time the EC2 instance took to respond. By filtering for 503 responses and correlating them with target IPs and timestamps, you can confirm whether errors originate from unhealthy targets, overloaded instances, or misconfigured routing. This is the most direct diagnostic because access logs are designed to expose the request/response path, rather than merely indicating that a threshold was crossed.

Instance status checks detect OS-level problems such as failed system boot, kernel panic, or filesystem corruption. The instance's system log (console output) shows the boot sequence and kernel messages, while application logs streamed to CloudWatch Logs reveal software-level errors that may have caused the failure. Reviewing both gives the evidence needed to identify the root cause before taking any corrective action.

An Application Load Balancer operates at Layer 7 and can distribute HTTP/HTTPS traffic across instances in multiple Availability Zones, providing health checks and automatic registration of instances in the Auto Scaling group. This integration allows the ALB to route traffic only to healthy instances and to scale with the ASG's changes, enhancing availability and fault tolerance. It is the recommended pattern for web applications requiring high availability and advanced routing.

Immutable update deploys the new application version to a completely new set of instances (or a fully separate environment) that runs alongside the old fleet. It waits for all new instances to pass health checks before shifting traffic to them, and if any fail, the old environment remains untouched, enabling an immediate, zero-impact rollback. This provides the strongest availability and isolation, making it the safest deployment policy.

CloudTrail's built-in log file validation creates hash-chained digest files that are digitally signed with a private key, and you can verify them with the public key published by AWS. The CloudTrail service emits the DigestDeliveryFailed metric to CloudWatch when it cannot deliver a digest file, which is often the first sign of tampering or a delivery problem. Creating a CloudWatch alarm on this metric gives you immediate, proactive notification without building custom code.

AWS IAM Identity Center centralizes workforce identity and builds on AWS Organizations to give users SSO access to all accounts via permission sets, which define granular IAM role permissions. It enforces MFA with policy settings such as requiring MFA for all users or context-dependent MFA, and supports both its built-in directory and external identity providers. Users sign in once at the portal or via the CLI, and IAM Identity Center automatically creates temporary credentials for each account.

AWS CloudTrail records all management API calls in the account, including failed attempts, with metadata such as the IAM principal, source IP, event name, and error codes. Amazon EventBridge can be configured with a rule whose event pattern matches CloudTrail's api_call events and a filter condition on errorCode, routing the matched events to an SNS topic for real-time alerting. This combination is purpose-built for monitoring failed API calls.

The account has reached the EC2 instance limit for the selected instance type in the region, which is the only option that matches the error 'You have requested more instances than your current EC2 instance limit allows'. Auto Scaling attempts to call RunInstances, but EC2 rejects it with an InstanceLimitExceeded error, causing the scaling activity to fail. This is a service quota that applies per instance type per region, and the fix is to request a quota increase via the Service Quotas console.

Changing the deployment policy to immutable launches a fully new Auto Scaling group with the new application version while the old group continues serving traffic. Once the new instances pass health checks, Elastic Beanstalk swaps the environment's capacity to the new group, providing both safety and minimal downtime. This is the correct choice because it verifies the deployment before cutting over, unlike rolling or all-at-once strategies that update existing instances in place.

AWS Systems Manager State Manager is the correct choice because it lets you define a desired configuration state (such as specific software packages, user accounts, or agent settings) and automatically apply and maintain that state on your EC2 fleet. It uses associations that run on a schedule, detect drift from the defined state, and reapply the configuration whenever needed. Unlike ad-hoc tools, State Manager continuously enforces the desired state across instances with built-in rate controls and error handling, making it ideal for managing large fleets.

fields @timestamp, @message | filter @message like /ERROR/ applies a regular expression filter to the raw message text, returning only the individual log events that contain the substring 'ERROR'. This directly mirrors the behavior of the CloudWatch Logs metric filter pattern "ERROR", allowing you to see the exact events that would increment the metric. It is the appropriate query for testing whether the pattern matches the intended production logs before creating or updating the metric filter.

CloudFront reports in the AWS Management Console include a Geo Distribution report and viewer reports that break down requests, bytes served, and other metrics by country and by edge location. These built-in reports are pre-aggregated by AWS and displayed directly in the console, giving a quick geographic view of traffic patterns and performance without needing additional infrastructure or custom queries. They are the intended way to answer global distribution questions out of the box.

Amazon RDS Proxy presents a single endpoint to the application while pooling and reusing database connections on the backend, dramatically cutting the CPU and memory load caused by connection handling. It is fully managed and transparent, and during Multi-AZ failovers it can keep connections warm for faster recovery. For a high-traffic web fleet, this directly mitigates CPU exhaustion due to connection volume, making it the most efficient and cost-effective option.

Separate stages in CodePipeline provide a sequential execution model where each stage contains a set of actions that deploy or test an environment. By defining dev, test, and prod as distinct stages, you enforce an ordered promotion flow, allow artifacts to progress only after each stage succeeds, and can insert approval actions between them. This is the fundamental way to model environment promotion in CodePipeline.

CodeDeploy with the ECS compute platform natively orchestrates blue/green deployments by shifting traffic between the original and replacement ECS task sets using a load balancer target group. You can associate CloudWatch alarms with the deployment and enable automatic rollback so that if health checks or custom metrics fail, CodeDeploy reverts traffic to the original task set without manual intervention. This is the only option that combines native ECS support, health monitoring, and automated rollback.

ACM issues and automatically renews public or private TLS certificates that integrate natively with an ALB's HTTPS listener, allowing the ALB to terminate TLS and encrypt traffic between the client and load balancer. For multi-tier architectures, the ALB can front each layer (e.g., web and application), providing encrypted inter-tier communication without manual certificate deployment or key management. This approach leverages AWS-managed distribution, per-listener policies, and SNI support, directly addressing the requirement for in-transit encryption.

CloudWatch Logs metric filters are the correct mechanism for real-time alerting on CloudTrail API activity. A metric filter defines a pattern that matches specific CloudTrail log events, such as `errorCode = "UnauthorizedOperation"`, and continuously increments a custom CloudWatch metric. A CloudWatch alarm can then evaluate that metric over a fixed period (e.g., 5 minutes) and trigger an SNS notification when the threshold is breached, enabling fast, automated responses to suspicious API calls.

To achieve a 90-day automatic rotation, you must create a new symmetric customer managed key with `--rotation-period-in-days 90` in the `create-key` CLI call and then associate it with the trail using `update-trail --kms-key-id <new-key-arn>`. After updating, CloudTrail will use the new key to encrypt future log files, and the new key's key policy must include CloudTrail's account and the required `kms:GenerateDataKey` and `kms:Decrypt` permissions. Existing log files remain encrypted under the old key, so that key should still be available for decryption.

Replacing the NLB with an ALB and enabling sticky sessions via the ALB's load balancer-generated cookie is the correct minimal-change solution. The ALB inserts a stickiness cookie on the first response, and all subsequent requests from that client are routed to the same EC2 instance, preserving the locally stored session state without any application modifications. This leverages the ALB's Layer 7 capabilities to achieve session affinity while keeping the existing web application code unchanged.

DynamoDB Accelerator (DAX) is an in-memory cache that sits in front of a DynamoDB table, serving read-heavy workloads with microsecond latency while absorbing a large fraction of read requests. By caching frequently accessed items (including strongly consistent reads when DAX is enabled), DAX reduces the number of read requests that actually reach DynamoDB, thereby reducing the table's consumed read capacity and preventing read throttling. It is a native, fully managed solution specifically designed for this scenario, preserving the DynamoDB API and requiring no application rewrite beyond adding a DAX client endpoint.

Switching the table to on-demand capacity mode removes the provisioned throughput ceiling and instantly accommodates unpredictable spikes, which is exactly the flash-sale pattern here. It is the fastest mitigation because the table continues serving reads and writes during the switch, so the ProvisionedThroughputExceededException errors stop without capacity math or client changes.

OpsWorks Stacks downloads custom cookbooks from the source repository during the setup phase and then runs the recipes defined for each lifecycle event. If the repository URL is malformed, points to a private repo with invalid credentials, or the endpoint is unreachable, the agent cannot retrieve the cookbook and therefore cannot execute any recipes. The failure may appear as 'non-execution' because the instance comes online but nothing from the cookbook is applied, and the error is only visible if you inspect the OpsWorks agent logs or stack activity.

AWS Secrets Manager is purpose-built for storing secrets like database credentials and natively supports automatic rotation through an integrated Lambda rotation function. It manages secret versions with AWSCURRENT and AWSPREVIOUS labels, allowing applications to reliably fetch rotated credentials without downtime. It also provides fine-grained access via IAM and resource policies, making it the correct service when the requirement is both secure storage and automatic rotation of database credentials.

Aurora Global Database replicates data from the primary Region to a secondary cluster using a dedicated storage-based replication channel with typical latency under one second, ensuring an RPO of under one minute. Failover can be initiated either manually or automatically, and a promoted secondary cluster becomes available in minutes without the need to restore from a backup or apply transaction logs. This is the only option that inherently satisfies both the 1-minute RPO and a recovery time objective measured in minutes.

Amazon DynamoDB is a fully managed NoSQL key-value database that delivers single-digit millisecond read/write performance at any scale, making it an excellent external session store. Its fine-grained access control, encryption, backup, and TTL support for automatic item expiration align well with session lifecycle needs. Because DynamoDB is serverless and horizontally scalable, EC2 instances can share session state without statefulness, enabling the application tier to scale freely behind a load balancer.

S3 event notifications triggering Step Functions decouple processing from the API request, letting large files be handled asynchronously with retries and state tracking. This removes the Lambda timeout constraint imposed by synchronous invocation behind API Gateway.

Docker requires privileged mode to run inside a container. AWS CodeBuild projects must have privileged mode enabled to build Docker images. Enabling it allows the Docker daemon to run, resolving the error. This is a common configuration for building container images in CodeBuild and is the minimal change needed to fix the issue.

Increasing the number of evaluation periods to 3 with a 1-minute period means the alarm must observe the replication lag exceeding the threshold for three consecutive datapoints (three consecutive minutes) before entering ALARM state. This creates a temporal smoothing effect that filters out brief, self-correcting spikes in AuroraReplicaLag, which are often caused by momentary write bursts or replica catch-up delays. CloudWatch evaluates all three most recent datapoints when determining alarm state, so sustained high lag triggers the alarm, while isolated outliers do not, directly reducing false positives without changing the sensitivity to genuine long-duration lag.

Flapping occurs when targets are marked unhealthy during normal startup or heavy I/O. Lengthening the interval and unhealthy threshold tolerates transient failures, while a health check grace period or slow start keeps new or busy targets in service until they are ready, which directly stops the repeated removal and re-addition causing 502s.

Enabling automatic rollback in the deployment group, combined with a CloudWatch alarm on the ALB health check, lets CodeDeploy detect the failed health check and revert to the last known-good revision automatically, satisfying the requirement for rollback without manual intervention.

CodePipeline's CloudFormation deploy action uses a service role to issue `sts:AssumeRole` for the CloudFormation execution role specified in the pipeline configuration. If the service role's policy lacks `sts:AssumeRole` permission on that execution role (or the execution role's trust policy does not allow the service role), the STS call fails with 'AccessDenied' or an invalid-token indication because the temporary credentials cannot resolve the requested role. This precisely matches the reported error, making it the root cause.

CloudWatch Logs Insights queries multiple log groups at once with a time range and supports saving or exporting results, directly matching the search and preservation requirements. It requires no infrastructure, so it is the lowest-effort option for finding the request ID and retaining the findings for review.

Blue/green deployment in AWS CodeDeploy is the only deployment type that provisions a new, separate environment (green) alongside the existing one (blue), then shifts production traffic to the green environment. This architecture enables instant rollback by simply switching traffic back to the blue environment if the deployment fails or exhibits issues, with no need to reinstall or reconfigure instances. CodeDeploy manages this through lifecycle hooks like AllowTraffic and redirecting traffic via the load balancer, providing the fastest and most reliable rollback path.

An invalidation request for the '/*' path removes all objects from CloudFront's edge caches across every region, which forces the distribution to return to the S3 origin on the next request and fetch the updated content. This is the standard, immediate method for clearing cached content when you need to publish new website changes, and it does not require changing URLs or reconfiguring any origin settings.

Blue/Green deployment creates a completely separate green environment and reroutes traffic only after the new instances pass health checks. The load balancer is the key component: it keeps traffic anchored to the blue environment until the green is verified healthy, and if health checks fail, you simply do not cut over or you can switch back to blue instantly. This gives an automatic, low-risk rollback path because the original environment remains intact and available. Thus, it satisfies the need to revert to the original version when issues are detected.

A running process with an HTTP 503 health endpoint indicates the application started but cannot serve requests, typically because required configuration files are absent. The CodeDeploy agent logs no errors, confirming the failure is application-level, not deployment-mechanism-level.

A CloudWatch Logs subscription filter can be configured with a Lambda function as its destination, enabling real-time processing of log events as they arrive. When a log event matches the filter pattern, CloudWatch Logs invokes the Lambda function asynchronously, passing the event payload (base64-encoded and gzipped) for your custom logic to parse and forward. This is a native, low-latency pattern that satisfies the requirement to filter and stream logs in real time, and it is a widely recommended approach for building log-processing pipelines.

CodePipeline can trigger on commits to the main branch through the CodeCommit source action, and the CloudFormation deploy action performs create or update semantics on the stack. CloudFormation automatically rolls back to the previous stack state if the update fails, satisfying both the automation and rollback requirements natively.

Circuit breakers in service clients detect repeated downstream failures and trip open, failing fast instead of holding threads until timeout. This halts the cascade at the caller, satisfying the resilience requirement by preventing upstream exhaustion when a downstream service partially fails.

Amazon Kinesis Data Firehose is a fully managed streaming ingestion service that can receive log events directly from a CloudWatch Logs subscription and deliver them near-real-time to centralized destinations such as Amazon S3, Amazon Redshift, or Amazon OpenSearch Service. It automatically handles buffering, compression, and encryption, which reduces cost and operational overhead. This makes it the ideal component for aggregating logs from multiple AWS accounts into a single, queryable data lake for centralized analysis.

The HTTP 500 on /api/orders is generated by the application after the ALB successfully forwards the request, meaning the instance is reachable and the web server process is handling traffic. However, the /api/orders endpoint depends on a downstream service (e.g., database, internal microservice, cache) whose failure causes the application to throw an unhandled exception and return a 500. Health checks succeed because the configured health check path (typically /health or /) exercises simple connectivity and doesn't call the failing dependency, so the instance remains in service. This is a classic partial-failure scenario where the dependency, not the instance, is unhealthy.

CloudWatch automatically emits the CPUUtilization metric for each EC2 instance, expressed as a percentage, so an alarm can directly evaluate it. Configuring the alarm with a threshold of 90% for five consecutive evaluation periods (5-minute periods, or 1-minute if detailed monitoring is enabled) ensures the alert only fires on sustained load, not transient spikes. The action sends an SNS notification to a topic with an email subscription, which is the canonical AWS approach for metric-based alerting.

The DatabaseConnections CloudWatch metric directly tracks the number of client connections currently established to the RDS instance, and when this value approaches the max_connections parameter, the server begins rejecting or timing out new connection attempts. This pattern perfectly matches the symptom of intermittent connection timeouts while CPU and memory remain normal, because the connection ceiling is a hard limit unaffected by resource utilization. Comparing this metric against the configured max_connections (from the parameter group) confirms whether connection exhaustion is the cause.

CodePipeline uses Amazon EventBridge rules that match S3 object-created events recorded by AWS CloudTrail as data events. For these events to reach EventBridge, CloudTrail must be enabled to log S3 data events for the source bucket and deliver them to a CloudWatch Logs log group; the EventBridge rule then forwards matching events to the pipeline. If CloudTrail is not configured to deliver S3 data events to CloudWatch Logs, the pipeline's trigger remains silent even though the source code changes, causing the pipeline to appear stalled or never start. This is the root cause, as the IAM role, bucket policy, and S3 event notifications are all in order.

Deploying RDS in a Multi-AZ configuration creates a synchronous standby replica in a different Availability Zone, and Amazon RDS automatically fails over to the standby if the primary instance becomes unhealthy or the AZ fails. The DNS name stays the same, so the ECS order service can reconnect without code changes, and the standby is continuously updated with synchronous replication to prevent data loss. This directly addresses the database as a single point of failure, which is necessary because the order service depends on durable transactions to record orders.

The native CodePipeline manual approval action is the correct pattern: it creates a gate that pauses the pipeline after the build stage and does not proceed to deploy until an approved or rejected decision is recorded. When you add the action, you configure an SNS topic for notifications, and approvers with the proper IAM policy respond through the console or CLI with `put-approval-result`. This integrated workflow provides explicit audit trails and automatically resumes only on approval, which is far more reliable than any external workaround. It is purpose-built to block stage transitions and supports both email SNS notifications and custom SNS topics for team alerting.

The `requiresCompatibilities` array must explicitly contain the value `"FARGATE"` so that ECS can verify the task definition is eligible to launch on Fargate. When this field is missing, any attempt to run the task with `launchType: FARGATE` produces an `InvalidParameterException` stating that the task definition is not compatible with the requested launch type. This field is an explicit declaration independent of networkMode, CPU, or memory, and is the exact missing piece that triggers the complaint about compatibility.

AWS Secrets Manager is purpose-built for storing, retrieving, and automatically rotating database credentials and other sensitive secrets, including integration with Amazon RDS, Redshift, and DocumentDB. The rotation feature uses an AWS Lambda function to update credentials on a schedule, ensuring that database passwords are cycled without manual intervention. Lambda can also retrieve secrets at runtime via the AWS SDK using IAM permissions, making it the correct and most appropriate pairing for the company's requirement.

Artifact storage is the durable, versioned repository that holds the output of the build stage, such as Docker images in Amazon ECR or packages in S3, until the deployment stage consumes them. Without this component, builds are ephemeral and you cannot reliably reproduce a release, roll back to a known-good version, or audit exactly what was deployed. In a container context, the image registry is a distinct stateful service that integrates with IAM and image scanning, making it a non-negotiable pipeline component.

Distributing EC2 instances across multiple Availability Zones ensures the application can tolerate a complete failure of one physical data center, because the remaining instances continue to serve traffic. Each AZ has independent power, cooling, and network connectivity, so an outage in one AZ does not affect the others. This redundancy is the fundamental building block of high availability on AWS and is a necessary condition for achieving a higher service-level agreement.

This is correct. When any action in the Test stage fails, CodePipeline immediately transitions the entire pipeline execution to the Failed status, and no later stages run. The execution history preserves the failure details for inspection, but you must resolve the root cause and retry the failed action or start a new execution manually; the pipeline does not recover on its own.

DAX is a fully managed, in-memory caching service placed in front of DynamoDB, returning cached items with microsecond latency. By writing through and caching the frequently read flash-sale items, it absorbs the burst of read traffic before it reaches the table, which directly reduces consumed read capacity units and throttling events. This requires no costly rearchitecture or constantly adjusting provisioned throughput, making it the most appropriate solution for unpredictable read spikes.

This is the correct approach. An Application Load Balancer is a regional service; by enabling subnets in at least two Availability Zones, you create redundant ALB nodes. The ALB performs health checks and automatically routes traffic to healthy EC2 instances across both AZs. Cross-zone load balancing ensures each instance receives an equal share of requests, so the architecture tolerates an AZ failure and even an instance failure without manual intervention.

The service role is the IAM role that CodePipeline assumes to perform actions on your behalf. To pull source artifacts from S3, the role must have an IAM policy allowing s3:GetObject (and typically s3:ListBucket) on the specified bucket and prefix. The error indicates the pipeline cannot download the object, which is a direct consequence of the role lacking this permission. Adding a policy statement with s3:GetObject on the source bucket ARN will resolve the stage failure.

AWS Systems Manager State Manager is the correct choice because it enforces desired configuration on managed instances through associations. An association defines a set of actions, such as running a custom SSM document or a Chef recipe, and State Manager executes it according to a schedule to ensure the instance remains compliant. If an instance drifts from the desired state, the next scheduled execution brings it back, providing continuous configuration management for both EC2 and hybrid instances.

A stack policy is a JSON document attached to a CloudFormation stack that controls which update, replacement, or deletion actions are allowed on the stack's resources. By writing a statement that denies the Delete action on the logical resource ID of the database (e.g., the AWS::RDS::DBInstance resource), CloudFormation will refuse to remove or replace that resource during any stack update. This protects the database from being deleted as a side effect of an update, while still permitting other modifications to proceed.

ALB access logs are the authoritative source for diagnosing 504 timeouts because they record the HTTP status code and three timing dimensions: request_processing_time, target_processing_time, and response_processing_time. The target_processing_time field directly measures how long the ALB waited for the target to begin sending a response; values at or near the idle timeout threshold precisely identify the request and target instance responsible for the 504. This option provides concrete, per-request evidence of backend latency, unlike health checks or security group rules, which only indicate availability and reachability.

The Lambda function is failing because its actual execution time is longer than the configured timeout. Raising the timeout to 10 seconds directly expands the allowed execution window, giving the code enough time to complete its work — as long as it stays below the 15-minute maximum. This is the only option that addresses the root cause of a timeout error rather than changing resources or failure handling.

This is correct because the Deny statement is scoped to any branch reference that is not `main`. When the user pushes to a branch like `develop`, the condition `StringNotEquals` on `codecommit:References` evaluates to true, causing an explicit Deny that blocks the `GitPush` action. Under IAM's evaluation logic, an explicit Deny overrides the earlier Allow, so the push is denied. A push to `main` would not trigger the Deny and would be allowed, confirming the condition is the decisive factor.

Route 53 health checks associated with the latency records let DNS stop returning the failed Region's endpoints, redirecting users to a healthy Region. Without this, latency records would continue resolving to the unavailable Region, defeating the active-active resilience requirement.