AWS Certified DevOps Engineer Professional DOP-C02 (DOP-C02) — Questions 601–675

Amazon ECS (Blue/Green) with CodeDeploy is the correct native deployment provider for ECS in CodePipeline. CodeDeploy's ECS compute platform orchestrates the creation of a green task set, shifts traffic from the blue target group to the green target group in either linear or canary increments, and performs post-traffic-shift validation hooks defined in an AppSpec file. It also supports automatic rollback if the deployment fails health checks, making it the ideal, fully integrated choice for ECS blue/green deployments in a pipeline.

Adding a bucket policy that denies requests when aws:SecureTransport is false enforces HTTPS for all access to the bucket. Combined with the gateway endpoint, traffic stays within the AWS network and is encrypted in transit. This directly meets both the encryption and private connectivity requirements.

AWS Config records configuration items for AWS::IAM::Policy and related resources, building a configuration history that shows exactly how IAM policy documents changed over time. It evaluates those configurations against custom or managed rules to detect noncompliant policies. This provides a persistent, queryable state timeline, which is the definitive way to audit all IAM policy changes after the fact.

AWS Secrets Manager offers native automatic rotation through a configured Lambda function, allowing the password to be rotated on a schedule independent of CloudFormation. Referencing the secret with a dynamic reference such as {{resolve:secretsmanager:MySecret:SecretString:password}} retrieves the current value at deployment time without embedding plaintext or ciphertext in the template. This combines secure storage, versioning, managed rotation, and clean CloudFormation integration, which makes it the correct choice.

Enabling local caching in the CodeBuild project configuration is the officially supported way to reuse dependencies across builds. You set a cache type that includes LOCAL_CUSTOM (or use the combined LOCAL option in newer versions) and define a cache directory—for example, /root/.m2 for Maven or /root/.npm for npm—so CodeBuild saves that directory after one build and restores it at the start of the next. This avoids re-downloading or recompiling unchanged dependencies, significantly reducing build time while requiring no custom scripting or external services.

The most direct cause of a 'LaunchTemplate version not found' error during stack update or creation is that the exact version number specified in the CloudFormation template has been deleted. Launch template versions are immutable but can be manually deleted (except the default version) when no longer needed, and CloudFormation validates that the referenced version exists before provisioning resources. Once deleted, any stack operation referencing that version fails because the template is effectively trying to instantiate a non-existent configuration.

The Throttles metric is the definitive CloudWatch counter for how many invocation requests Lambda rejected because the function had no available concurrency capacity. Each time Lambda receives a request while the function or account is over its concurrency limit, it increments Throttles and returns a 429 TooManyRequestsException, prompting SDK retries or event-source retry logic. For a slow-running function, elevated Throttles explains intermittent delays caused by client-side retries, making this the correct metric to inspect when troubleshooting such issues.

HTTPCode_Target_5XX_Count is the correct choice because it represents the number of HTTP responses with a 5xx status code that were returned by registered targets (e.g., EC2 instances) to the Application Load Balancer. This metric excludes 5xx errors generated by the ALB itself, such as 502 Bad Gateway or 503 Service Unavailable from the load balancer when no healthy targets exist. By checking this metric with a Sum statistic, the engineer can directly quantify application-level server errors and distinguish them from load-balancer-level failures.

The AWS CLI command that updates the Lambda function must be defined in the buildspec file or in a script committed to the source repository. CodeBuild executes the buildspec during the build phase, so placing the command there ensures it is run as part of the pipeline after the artifact is produced. Keeping it in source control also makes the deployment step reproducible, auditable, and versioned alongside the application code.

The `ROLLBACK_COMPLETE` state is terminal: the stack still exists in CloudFormation, but the failed create or update operation has rolled back, leaving no functional infrastructure from that attempt. CloudFormation will not accept `update-stack` or change-set execution from this state, so the only supported recovery path is to delete the stack and create a new one using the updated template. Recreating the stack provides a clean, deterministic provisioning pass and avoids inconsistent resource states.

AWS WAF is an application-layer firewall that can be associated with an Application Load Balancer and inspects each HTTP/HTTPS request for suspicious patterns. You can create custom rules and use AWS-managed rule groups such as AWSManagedRulesSQLiRuleSet and AWSManagedRulesCommonRuleSet to automatically block SQL injection, cross-site scripting, and other common web exploits. These rules evaluate request components like headers, query strings, body, and cookies, which is exactly what is needed to stop these attacks before they reach the EC2 instances.

An Internet Gateway (IGW) is a horizontally scaled, redundant VPC component that provides bidirectional communication between the VPC and the internet. It is attached to the VPC and serves as the target for the 0.0.0.0/0 route in public subnet route tables, enabling resources with public IPs to send and receive internet traffic. Additionally, the IGW is a prerequisite for a NAT Gateway, because the NAT Gateway itself resides in the public subnet and relies on the IGW for outbound internet forwarding. Without an IGW, neither public nor private instances could reach the internet.

Amazon CloudWatch Logs cross-account subscriptions let you forward log events from multiple source accounts to a central destination (via a Kinesis Data Stream or Data Firehose) using subscription filters, enabling near-real-time aggregation of application logs. This is the correct pattern because it directly receives application log streams from existing CloudWatch Logs agents and routes them to a central account for storage and analysis.

The build's `aws ecr get-login-password` command makes an ECR Authorization API call that requires the `ecr:GetAuthorizationToken` permission on the build project's service role. If that IAM policy is missing or doesn't allow the action, the CLI exits with an `AccessDeniedException` and no password is returned, causing the subsequent `docker login` to fail with invalid or empty credentials. This is the classic cause of ECR login failures in CodeBuild.

Default encryption is a bucket-level setting that automatically applies server-side encryption (SSE-S3 or SSE-KMS) to all new objects, even when the upload request does not include encryption headers. When enabled, every PUT that does not explicitly specify an encryption method is wrapped with the bucket's configured encryption, thereby ensuring new objects are encrypted at rest. Note that default encryption only affects objects uploaded after the setting is enabled; existing objects require rewriting or a copy operation to be encrypted. It is the only option that actively encrypts data without relying on client behavior.

Failure tolerance specifies how many stack instance failures (as an absolute number or a percentage of total stack instances) are acceptable before the entire StackSet operation is considered failed. When this threshold is exceeded, StackSets automatically rolls back all successfully deployed stack instances, allowing you to absorb a limited number of transient errors without halting the whole deployment. This is the primary safety control for managing partial deployment success.

Dynamic references resolve the AMI at deploy time from Parameter Store, so the template no longer depends on a static region mapping. This satisfies the region-agnostic constraint, letting the stack create successfully in any region without maintaining per-region map entries.

A blue/green deployment creates a fresh set of green instances beside the original blue instances, and traffic is shifted to the green fleet only after it successfully passes the configured health checks. If the green instances fail, CodeDeploy can keep the blue fleet available and immediately route traffic back to it, giving you a deterministic rollback path that does not require re-deploying the old revision. This directly solves the problem in the question, because the old instances remain running and intact until the new ones are proven healthy, making rollback both possible and rapid.

An SCP attached at the root or OU can deny s3:PutBucketVersioning unless the request's VersioningState header is exactly 'Enabled', using a condition such as s3:x-amz-versioning. Because SCPs are evaluated before any IAM policies, a user in a member account cannot bypass this restriction even if their IAM policy allows the action, and the API call fails before any state change occurs. This preventive control enforces the organization-wide requirement that every bucket remain versioned, making it the correct answer.

Secrets Manager's pre-built Lambda rotation function (e.g., for Amazon RDS MySQL, PostgreSQL, Oracle, or SQL Server) is the correct choice because it provides a fully managed, automated rotation pattern that requires minimal configuration. When you enable rotation, Secrets Manager executes the Lambda on a configurable schedule (e.g., every 30 days), and the function updates the database password and the stored secret atomically using the Secrets Manager rotation sequence (createSecret, setSecret, testSecret, finishSecret). This ensures the secret and the database remain in sync with no temporary breakage and no custom code to write or maintain.

During a rolling update, CloudFormation temporarily sets the ECS service's desired count to zero to force a clean replacement of all tasks. If the service's minimumHealthyPercent is set to 100%, ECS cannot scale the current running tasks below 100% of the desired count, so the service scheduler rejects the desired count reduction and the CloudFormation update is cancelled. This is a common misconfiguration when engineers expect zero-downtime but inadvertently block the scale-in step.

When the Auto Scaling group is configured with EC2 health checks or an attached Elastic Load Balancer's health checks, it automatically detects instances that become unhealthy. The default health check replacement behavior marks the failing instance as unhealthy, terminates it, and launches a replacement instance to restore desired capacity, all without manual intervention. This is the underlying mechanism that keeps the web tier healthy, making it the correct choice for replacing faulty instances.

CodeStar Connections automatically create webhooks for GitHub repositories. When a push event occurs on the configured branch (e.g., main), the webhook triggers the pipeline. Merging a pull request results in a push to the main branch, so the pipeline starts. This is the intended and supported integration for GitHub sources in CodePipeline.

AWS Config's managed rule s3-bucket-server-side-encryption-enabled detects buckets where default encryption is disabled and continuously evaluates the account's infrastructure. When a noncompliant bucket is found, Config can trigger a remediation action, such as an AutoRemediate SSM document that enables default encryption, turning detection into corrective enforcement. This is a control-plane enforcement of encryption at the bucket level, rather than preventing unencrypted object writes.

AWS Config is purpose-built for recording and evaluating configuration changes to AWS resources, including IAM policies. It continuously records the configuration state of IAM users, roles, groups, and their attached or inline policies, and maintains a configuration history with a timeline for each resource. You can query the configuration timeline to see what the policy document looked like before and after each change, making it the ideal service for auditing all changes to IAM policies.

AWS Config evaluates launched instances against a managed rule such as approved-ami-by-id, which checks whether the instance’s AMI ID is in an allowed list. When an instance is non-compliant, Config can automatically invoke an AWS Systems Manager Automation document (for example, to stop or terminate the instance), providing a self-healing enforcement loop. This is the recommended pattern for reactive enforcement where the desired AMI cannot be blocked at the API level by IAM or SCP policies.

Amazon S3 server access logs provide detailed records for every request, including source IP address, user agent, requester, operation, and HTTP status. This is the correct service to identify the source IP and user agent of the unauthorized request.

During a CloudFormation stack update that forces replacement, the Auto Scaling group is recreated with a new physical resource ID. CloudFormation first creates the replacement group and only after it is successfully provisioned does it delete the original group, which terminates the old group's instances. This create-before-delete behavior preserves capacity during the update window.

A CodeCommit trigger can be configured for pull-request events such as pullRequestCreated or pullRequestSourceBranchUpdated, invoking a Lambda function asynchronously. The Lambda parses the pull request description with a regex for a JIRA key such as [A-Z]+-[0-9]+, and if the key is missing it calls the CodeCommit API UpdatePullRequestStatus with status CLOSED to reject the PR and posts a comment explaining the failure. Because the logic runs in AWS managed services on every qualifying pull request event, enforcement is centralized and cannot be bypassed by individual developers.

An IAM policy is evaluated for every AWS API request, and the global condition key `aws:SecureTransport` returns `false` when the request was not sent over TLS/HTTPS. By attaching a policy that explicitly denies access when `aws:SecureTransport` is `false`, you enforce that all API calls must use HTTPS at the authorization layer. This is the correct, service-agnostic mechanism because IAM conditions apply uniformly to any supported AWS service, making it impossible to bypass via a non-HTTPS client.

This is the correct pattern because SQS itself owns the retry and dead-letter behavior when Lambda consumes from a queue. A redrive policy with maxReceiveCount: 3 instructs SQS to allow a message to be received up to three times; if the Lambda function fails to process it each time, SQS automatically moves the message to the configured dead-letter queue. This is a native, serverless-friendly mechanism that avoids unnecessary compute and precisely matches the requirement for '3 retries before a DLQ'.

Correct. The Lambda runtime (for both the AWS-provided runtimes and custom runtimes that use the Runtime API) intercepts all output written to stdout and stderr and automatically streams it to CloudWatch Logs under the log group /aws/lambda/<function-name>. This happens regardless of whether the function completes successfully or crashes, so logging to stdout/stderr is the standard, documented way to generate logs. Each invocation gets a unique log stream, and the exact log line format can include request IDs if you also log the Lambda context object, but the capture itself requires no extra configuration beyond the Lambda service execution role's CloudWatch Logs permissions.

Create an IAM policy that uses the 'aws:MultiFactorAuthPresent' condition key to deny actions when MFA is not present, for example: 'Condition': {'Bool': {'aws:MultiFactorAuthPresent': 'false'}}. Attach this policy to all IAM users or groups so that any API call made without MFA is rejected, while requests made with MFA succeed. This enforces MFA globally across all AWS services for the attached identities. Be sure to grant users permission to manage their own MFA devices beforehand to avoid lockout.

Security group names in EC2 are case-sensitive, and CloudFormation's lookup by name uses an exact, literal string match against the security groups within the specified VPC. If you reference a group by name and the template contains a typo, wrong case, or an unintended trailing space, the API returns no matching group, which CloudFormation reports as a 'security group not found' error. This is the most frequent root cause in practice because names like 'web-SG' and 'web-sg' are considered distinct, and the error message often appears immediately after a small edit or a manual copy-paste from a different source.

Enabling AWS CloudTrail records the PutApprovalResult API calls made through CodePipeline when an approver clicks Approve or Reject. CloudTrail logs the IAM principal or federated user identity, the timestamp, the source IP address, and the decision, providing an immutable audit trail that satisfies compliance and forensic needs. This is the correct answer because the company's explicit requirement is to know who approved the deployment and when.

AutoScalingReplacingUpdate is only supported for AWS::AutoScaling::AutoScalingGroup and cannot be applied to an AWS::RDS::DBInstance resource.

An AWS Lambda function can programmatically call the CreateStack API and include 'CAPABILITY_IAM' in the Capabilities list, satisfying CloudFormation's acknowledgement requirement. This is a valid automation method because the Lambda handler can pass the parameter directly in the SDK request, and the function can be triggered by various events. The Lambda execution role must have permission to create stacks and the necessary IAM resources.

Configuring the source stage to use Webhook change detection with a branch pattern, such as refs/heads/feature/*, makes the pipeline automatically respond to pushes on matching feature branches. This allows a single pipeline to serve multiple branches by filtering events based on the branch reference, without manual per-branch pipelines. The webhook sends an event to CodePipeline only when the push matches the pattern, enabling efficient and dynamic multi-branch execution.

Synchronous dependencies like database queries and external API calls are the classic cause of elevated application latency; the end-user response time becomes the sum of all blocking calls in the request path, and a single slow query (e.g., missing index, lock contention, or throttled API) holds up the entire page. This pattern usually shows as high response times with low CPU and network utilization on the application instances, because threads are parked waiting for the downstream I/O to complete. In an Auto Scaling environment, simply adding instances won't help while the database or API service remains the bottleneck.

Separating the build stage from the deploy stage ensures that a single immutable artifact—such as a Docker image or packaged JAR—is produced once and then promoted through environments (dev, staging, prod) without rebuilding. This eliminates configuration drift and makes the pipeline auditable, because the exact artifact tested can be deployed to production. It also enables independent validation and safe rollback: if a deployment fails, you can redeploy the previous artifact rather than re-running a build that may produce different output.

The Deploy stage is mandatory because it uses AWS CodeDeploy's ECS deployment type to shift traffic from the old to the new task definition. CodeDeploy references an AppSpec file and the task definition produced during the Build stage, then updates the ECS service with either rolling updates or blue/green traffic shifting. Without this stage, the built and pushed container image would never be run as an active service in ECS.

AWS CodeBuild supports test reporting through the 'reports' section in buildspec.yml. By specifying a report group and the path to the test results file (e.g., JUnit XML), CodeBuild can parse and display test results in the console. Additionally, if 'pytest' exits with a non-zero status on failure, the build fails automatically. This change provides visibility into test results and ensures failures are caught.

Reviewing the build logs in AWS CodeBuild directly surfaces the compile-time or test-time error that caused the pipeline action to fail. CodeBuild logs are stored in CloudWatch Logs (and optionally S3), showing the full output of each build phase, including command execution, environment setup, and the exact error message and exit code. This is the fastest, most authoritative way to identify the root cause of a build-phase failure.

The deployment group configuration holds the load balancer or target group settings for the deployment. During an in-place or blue/green deployment, CodeDeploy automatically registers healthy instances with the target group defined in this configuration, and deregisters them before traffic shifts. It is this centrally defined setting, not anything in the application files or on the instance, that governs elastic load balancing integration.

For a deployment to four instances, a minimum healthy hosts percentage of 75% requires that at least three instances remain available throughout the deployment. When two instances failed, the healthy count dropped to two (50%), which is below the required threshold, so CodeDeploy was forced to abort the deployment and mark it as failed. This is a classic example of the minimum healthy hosts guardrail catching a partial-failure scenario that other, fleet-wide issues would not produce.

A CloudWatch Logs metric filter continuously scans new log events as they arrive in the log group and increments a custom metric whenever a pattern such as 'ERROR' or a specific error code appears. This metric can then drive a CloudWatch alarm with an associated SNS topic, providing a near-real-time notification without building any separate ingestion pipeline. Metric filters are the native, low-latency mechanism for monitoring textual patterns in logs.

CodeBuild allows you to define environment variables that are encrypted at rest with a customer-managed or AWS-managed KMS key and are never stored in buildspec or source control. These values are decrypted automatically in the build container at runtime, so the build commands can use them without exposing plaintext in the pipeline artifacts. Because CodeBuild also supports referencing Systems Manager Parameter Store or Secrets Manager values as environment variables, this approach centralizes secret access while retaining per-environment changes.

This is the correct approach for a review-before-execution pipeline. The CHANGE_SET_REPLACEMENT action creates a new change set (or replaces an existing one) that captures the exact resource-level differences between the current stack and the proposed template, but it does not apply any changes. A subsequent manual approval step then gates the pipeline, allowing a human reviewer to inspect the change set in the CloudFormation console or via CLI. Only after approval does the CHANGE_SET_EXECUTE action run, which applies the previously created change set, ensuring that no stack modification occurs without explicit review and approval.

A pilot light strategy keeps a minimal core, such as the RDS instance, running in the DR Region via a cross-Region read replica while other services remain off. The read replica provides continuous asynchronous replication, so a promotion on failover can complete in roughly 15 minutes, and automated backups in the DR Region give point-in-time restore support. Since the database is already warm and data is being copied, the worst-case data loss stays within the 1-hour RPO.

In CodePipeline, the CloudFormation deployment action requires an explicit ActionMode such as CREATE_UPDATE to create a new stack or update an existing one. When 'Rollback on failure' is selected, CloudFormation automatically rolls back the stack to its last known good state if the deployment fails, restoring both resources and stack outputs. This is the correct mechanism because it leverages CloudFormation's native rollback capability within the pipeline execution, preserving the integrity of the deployed infrastructure.

This is correct because the password is stored and rotated in AWS Secrets Manager, and the CloudFormation template only references the secret's ARN (e.g., via a dynamic reference) in the IAM role policy, enabling the EC2 instance to read it. No secret value ever enters the template, user data, or instance filesystem; the application retrieves the plaintext only when it calls Secrets Manager at runtime. Since the IAM role restricts access to only that secret and Secrets Manager supports automatic rotation, the approach satisfies security best practices.

A single pipeline execution carries its own artifacts from source through deploy. If the approval is part of that execution, the deploy stage consumes the exact artifact built and tested earlier, so commits pushed after the test stage start a new execution that must itself pass testing and approval, leaving the original execution's artifact intact.

CodePipeline naturally executes independent actions within a stage in parallel unless you set explicit runOrder values or action dependencies. By configuring multiple build actions, each running a partitioned portion of the test suite (by module, service, or shard), the total test work is spread across concurrent CodeBuild projects. The stage completes when all parallel actions finish, so overall duration approaches the slowest shard's critical path rather than the sum of all tests, directly reducing feedback time.

AWS Lambda automatically writes all execution logs—including output from print() statements, exception stack traces, and custom log messages—to a dedicated CloudWatch Logs log group named /aws/lambda/<function-name>. When the stack update fails, the Lambda function's runtime error is recorded as a log event, which you can view in the CloudWatch Logs console to pinpoint the root cause. Be sure to check the log stream that matches the exact timestamp of the failed update, and remember that logs are retained based on the log group's retention policy.

Running a scanner such as Trivy or Anchore inside a CodeBuild stage before the Docker push enforces a shift-left security gate; if the scanner exits with a non-zero code on critical/high vulnerabilities, the build fails and the image never reaches ECR. This keeps the registry free of vulnerable images and ensures only approved artifacts are available for subsequent pipeline stages.

CodeDeploy deployment groups support a built-in automatic rollback option triggered by CloudWatch alarms. When you configure one or more alarms in the deployment group, CodeDeploy monitors them during the deployment (and during traffic shifting for blue/green) and, if any alarm enters the ALARM state, it automatically rolls back the deployment to the last known good revision. This is a native, first-class feature that tightly integrates with Amazon CloudWatch and requires no custom code or external services, making it the recommended and correct way to achieve automated rollback on detected failures.

The `{{resolve:ssm:/org/vpn/cidr}}` dynamic reference resolves the Parameter Store value at deployment time, satisfying the requirement that the CIDR is fetched when the StackSet instantiates stacks. Unlike hard-coded values or parameters passed manually, it retrieves the current stored value per account deployment, keeping the security group rule consistent with the central VPN range.

Amazon EventBridge natively ingests ECR lifecycle events such as an image push or scan, publishing them as event objects. You can define a rule with an event pattern matching the aws.ecr source and ECR Image Action detail-type, then route that event to a Lambda function that calls the ECS CreateService or UpdateService API. This is the correct mechanism because it is event-driven and requires no polling or manual invocation.

The SSM Agent running on each EC2 instance requires an IAM instance profile that grants Systems Manager API permissions, such as the AmazonSSMManagedInstanceCore managed policy. Without this role, the agent cannot register with the Systems Manager service or receive association requests, so any subsequent automation—including State Manager—will fail. This IAM prerequisite is non-negotiable and must be verified before creating associations or running documents.

CodeBuild evaluates each buildspec command's exit code; if the security scanner returns a non-zero exit status when vulnerabilities are found, the build phase will immediately fail. To guarantee this, invoke the scanner as the final command in the build phase or wrap its output so that any findings are translated into a non-zero exit code. Without this explicit exit-code enforcement, a scanner that always exits 0 would allow the pipeline to pass despite critical security findings.

A database connection timeout to the database IP address strongly indicates the new task definition is passing an invalid connection string or is associated with a security group that blocks the database port. The application container is starting and attempting to open a TCP connection, but the destination either rejects or silently drops it — exactly what a bad host, port, or restrictive inbound rule produces. This is an application-level configuration defect in the task definition that does not prevent the task from launching, which is why the deployment can still be marked successful.

Customer managed keys can be configured for automatic rotation. Enabling this setting causes AWS KMS to automatically generate new key material for the CMK every 365 days, while retaining the previous material for decryption of existing ciphertext. You must explicitly opt in to this feature; it is not the default behavior.

When you reference a launch template by name in an Auto Scaling group's LaunchTemplateSpecification, CloudFormation and the Auto Scaling API require that the launch template already exists in the same account and Region. If the name is misspelled, or the launch template was created under a different account/Region or never created, the API returns an error indicating the launch template parameter is invalid or not found. The error message in the output is consistent with this cause, as it specifically flags the launch template name reference, not the AMI, key pair, or IAM permissions.

Deploying an RDS DB instance in a Multi-AZ configuration creates a synchronous standby in a different Availability Zone and enables automatic failover. RDS monitors the primary instance and, if a failure is detected, automatically switches the endpoint to the standby, typically in 60–120 seconds. This is the standard RDS pattern for high availability within a single region.

Pod Disruption Budgets (PDBs) constrain voluntary disruptions such as node drains during cluster upgrades, node-group updates, or Cluster Autoscaler scale-in by specifying minAvailable or maxUnavailable for a pod selector. During a voluntary disruption, the Kubernetes eviction API rejects requests that would cause the number of available pods to fall below the budget. PDBs do not protect against involuntary failures like an EC2 instance crash, so they are a complement, not a substitute, for multi-AZ node deployment.

Network ACLs are a stateless firewall layer operating at the subnet boundary, inspecting traffic entering and leaving each subnet. Rules are evaluated in numeric order, and because they are stateless, you must explicitly allow both inbound and outbound traffic, including return traffic. By default, a custom Network ACL denies all traffic until you add allow rules, while the default NACL permits all traffic. This makes NACLs ideal for subnet-level deny lists and for enforcing broad boundaries, but they lack the stateful awareness of security groups.

The cooldown period is a deliberate delay after a scaling activity before the group can launch or terminate additional instances. If set too high, it suppresses subsequent scaling actions for an extended time, so the group cannot keep pace with rapidly increasing demand. For a dynamic scaling policy, this directly prevents the Auto Scaling group from adding instances promptly, making scaling appear slow. Thus, an excessively high cooldown is a valid cause of the described problem.

Raising the task memory to 2048 MiB while keeping CPU at 512 units is the minimal change that removes the hard memory limit causing the container's OOM kill. ECS enforces task memory as a cgroup limit, so the kernel terminates the process once the container's resident memory reaches that configured cap. This directly provides the application runtime sufficient headroom, uses the valid Fargate 0.5 vCPU / 2 GiB combination, and avoids wasting spend on CPU that was never the bottleneck.

CloudWatch dashboards are not region-bound artifacts: each widget can explicitly specify a different source region, and metric math can combine those cross-region metrics within a single expression, for example summing SuccessPercent or averaging Duration across all canary regions. This natively aggregates the existing Synthetics metrics without duplicating canaries, running Lambda functions, or parsing logs. It is the intended, low-operational-overhead mechanism for a consolidated cross-region view and requires no custom infrastructure.

Configuring an SNS topic as a stack notification option delivers every CloudFormation stack event, including ResourceStatusReason for the specific resource that failed, satisfying the requirement to identify the failing resource. Subscribing an email or Lambda endpoint to that topic then surfaces the failure notification automatically.

In CodeDeploy's ECS blue/green deployment, the green target group's health checks are the gating mechanism for traffic shifting. If the health check path, port, or interval is misconfigured, the green tasks are marked unhealthy even though the containerized application is running normally, so CodeDeploy never receives the signal that the green fleet is ready. As a result, the listener remains pointed at the blue target group, and the deployment times out waiting for a healthy green target.

AutoScalingRollingUpdate replaces instances in batches, maintaining a minimum number of healthy instances throughout the update. This satisfies the no-downtime constraint by keeping the Auto Scaling group serving traffic while new AMI-based instances launch and old ones terminate, rather than replacing all instances simultaneously.

Deploying across multiple Availability Zones (AZs) is the primary AWS design pattern for high availability because each AZ is an independent failure domain with separate power, cooling, and networking. By placing resources (e.g., application servers behind an Application Load Balancer, and a Multi-AZ database) in at least two AZs, the workload can continue serving traffic if one AZ suffers an outage, as the load balancer automatically routes requests only to healthy instances in the remaining AZs. This approach directly satisfies the requirement for fault tolerance, and when combined with Auto Scaling, it also provides capacity to absorb increased load in the surviving AZs.

When a parameter is stored as a SecureString, its value is encrypted at rest using an AWS KMS key, either the default aws/ssm key or a customer-managed key. To retrieve the plaintext value via ssm:GetParameter, the caller must have kms:Decrypt permission on that specific KMS key, in addition to the ssm:GetParameter action on the parameter resource. The policy shown grants the SSM read action but omits kms:Decrypt, so even though the resource-level SSM permission is correct, the call fails with an AccessDeniedException.

Redeploying the previous application version through the Elastic Beanstalk console triggers a fresh environment update that restores the last known-good build, directly reversing the faulty deployment. This is faster than rebuilding the environment or manually patching instances, satisfying the requirement to quickly revert to the previous working version.