CCNA Incident and Event Response Questions

The only way to recover from a deleted bucket is to recreate it and restore objects from a backup. (Note: bucket name uniqueness may require waiting or using a different name.)

AWS CloudTrail is the authoritative source for who, when, and how an EC2 instance was terminated: every StopInstances/TerminateInstances API call is recorded as an event with the IAM user or role, source IP, user agent, and request parameters. Console clicks, CLI commands, SDK calls, and automated actions by services such as Auto Scaling or AWS Lambda all generate a TerminateInstances event. Reviewing CloudTrail event history or querying the CloudTrail S3 bucket with Athena reveals the entity that issued the termination and any accompanying error or access-denied information.

Enabling storage auto scaling on the DB instance automatically increases the allocated storage when free space falls below the configured threshold, up to your specified maximum. Amazon RDS detects low storage conditions and modifies the storage volume dynamically, requiring no manual intervention or downtime. This is the most direct and proactive solution to prevent the instance from reaching a storage-full state.

Fargate tasks must download their container images from Amazon ECR before they enter the RUNNING state. If the service is configured to use private subnets that lack a route to a NAT Gateway (or a subnet with an Internet Gateway for public IPs), the task cannot establish outbound connectivity to the image registry, causing the deployment to hang in PROVISIONING and eventually fail. Verifying the subnet route tables for a 0.0.0.0/0 route to a NAT Gateway or IGW directly addresses the most likely cause of image pull failures.

An excessively long deregistration delay prolongs the draining period in which a target is excluded from new request routing but still waits for in-flight requests to complete. For example, if the delay is set to 3,600 seconds (the maximum) and a rolling deployment drains instances, replacement targets may not become healthy quickly enough, leaving zero targets in rotation. With no healthy targets, the ALB returns HTTP 503 to new requests even though the underlying instances might function correctly—the bottleneck is the delayed deregistration.

The appspec.yml file is the deployment specification that maps each lifecycle hook (e.g., BeforeInstall, AfterInstall, ApplicationStart) to a script path. The 'ScriptMissing' error occurs precisely when the CodeDeploy agent attempts to execute the script declared in a hook and finds no file at that path, either because the path is mistyped, uses an incorrect relative reference, or the script file was omitted from the deployment revision. Since the agent only knows script locations from appspec.yml, an incorrect path there is the direct and immediate cause of this error, making this option correct.

System status checks specifically monitor the health of the EC2 physical host and the surrounding AWS infrastructure, including power, network connectivity, and host maintenance events. When the underlying physical host experiences a hardware failure, loss of power, or network degradation, the system status check will fail because the host can no longer provide the required virtualization and I/O capabilities. This type of issue is considered host-level and is not fixable by rebooting the instance or making guest OS changes; instead, AWS recommends stopping and starting the instance to move it to a new, healthy host. The symptom described—an instance that is running in the console but failing system status checks—is the classic indicator of a physical host impairment.

AWS Systems Manager Run Command lets you securely execute commands on managed EC2 instances via the SSM Agent, without requiring SSH, RDP, or open inbound ports. To diagnose a high-CPU alarm, you can run an OS-level command such as `top -b -n1` or `ps aux --sort=-%cpu` to get a snapshot of per-process CPU and memory usage, and retrieve the output from the console, CLI, or an S3 bucket. This gives you process-level detail directly from the guest OS, making it the correct tool to determine the root cause of the CPU spike.

This is the correct approach because AWS Config rules continually evaluate resources against a desired policy, and when they detect non-compliance they can trigger an automatic remediation action—a Systems Manager Automation document—to fix the resource. In this case the rule (such as the managed RESTRICTED_SSH rule) would flag any security group with port 22 open to 0.0.0.0/0, and the associated SSM Automation document (for example, AWS-RevokeSecurityGroupIngress) would revoke the offending rule automatically. AWS Config tracks the remediation status and retries until the resource becomes compliant, providing a closed-loop, auditable remediation process without manual involvement.

An EC2 instance in a private subnet has no route to the public internet unless a NAT device or VPC endpoint is provisioned. Since no VPC endpoint for S3 is listed as existing, traffic from the instance to S3 cannot traverse the AWS backbone via the private subnet. A gateway endpoint or interface endpoint for S3 is required to establish private connectivity without leaving the AWS network, making the absent endpoint the root cause of the failure.

The correct interpretation is that the system status check has failed, which indicates an AWS infrastructure-level problem with the physical host running the instance. This includes issues such as a failing disk, network connectivity loss, or hardware component degradation. Even though the instance is running and its instance status check may pass, the impaired system status means the underlying hardware is compromised and AWS may need to repair or replace the host, often requiring a stop/start or recovery action.

Amazon ECR uses both identity-based policies (attached to the principal, typically the task execution role) and resource-based policies (attached to the repository) to control access. If the repository policy does not explicitly grant the task execution role permission to perform actions like ecr:BatchGetImage and ecr:GetDownloadUrlForLayer, the pull will be denied even if the role's IAM policy allows those actions. The default repository policy is restrictive, and an overly narrow or misconfigured repository policy will cause a 'CannotPullContainerError' during task startup. Therefore, verifying that the ECR repository policy includes an Allow statement for the task execution role is a critical step.

This is the correct explanation. AWS IAM policy evaluation is based on a strict rule: an explicit deny from any applicable policy always overrides any allow, regardless of statement order or the number of allows. Even though the policy contains an Allow that includes `s3:DeleteObject` on the specified bucket and objects, the explicit Deny for the same action takes precedence, resulting in the user being denied. This is fundamental to AWS's default-deny model and is non-negotiable.

This is correct. After an RDS Multi-AZ failover, the RDS-managed DNS CNAME is updated to point to the new primary instance's underlying IP address. However, if the application's DNS resolver (or the application itself) has cached the old IP address from before the failover, it will continue to try to connect to the old primary instance until the cache expires (based on the DNS TTL, which is typically 30–60 seconds for RDS). A long TTL or a resolver that ignores TTL can keep the stale IP in effect, causing errors (e.g., 'Communications link failure') even though the new primary is healthy.

The CodePipeline console provides Approve and Reject buttons for any pending manual approval action to any IAM user or role with the codepipeline:ApproveStage permission. The approval is bound to the action and its configured IAM permissions, not to the specific person who originally triggered it, so another authorized user can approve the action and immediately unblock the current pipeline execution without any code or pipeline definition changes.

This is the correct near-real-time solution. By delivering CloudTrail events to CloudWatch Logs, events are streamed continuously rather than waiting for S3 log file delivery. A CloudWatch Events (EventBridge) rule can match the specific API call from CloudTrail—filtering on the IAM user, event name, or region—and invoke a Lambda function, which publishes an SNS notification. This end-to-end path operates in seconds, giving you immediate alerting on unauthorized API calls.

AWS X-Ray traces requests through Lambda and downstream services, exposing latency, errors and their causal path. This gives the engineer the distributed tracing needed to pinpoint the root cause of increased error rates, which CloudWatch logs alone would require manual correlation to achieve.

AWS CloudTrail is the correct answer because it provides a complete audit history of API activity across AWS, including actions performed on S3 buckets such as CreateBucket, PutBucketPolicy, and DeleteBucket. For every management event, CloudTrail captures the IAM user or role, the source IP address, the request parameters, and the response returned, enabling you to answer exactly who did what and when. CloudTrail can also be configured to log data events for object-level S3 operations (GetObject, PutObject) for deeper forensic analysis.

The `ContinueUpdateRollback` API is the designed recovery action when a CloudFormation stack is stuck in the `UPDATE_ROLLBACK_FAILED` state. By invoking it with the `ResourcesToSkip` parameter, you explicitly instruct CloudFormation to skip the specific resource that caused the rollback failure, allowing the stack to return to a stable `UPDATE_COMPLETE` state. This bypasses the problematic resource without requiring manual intervention. It is the recommended and least disruptive method to recover from a failed stack update.

The CloudWatch agent is required to emit in-guest memory metrics. The default EC2 monitoring collects only hypervisor-level metrics such as CPU utilization, disk I/O, and network throughput; memory utilization is not visible from the hypervisor and must be reported by the agent inside the OS. If the agent is not installed or its configuration does not define memory as a collected metric, the MemoryUtilization metric will be absent, causing any alarm relying on it to remain in INSUFFICIENT_DATA and never trigger.

Configuring target tracking scaling policies for the ECS service lets AWS automatically scale the number of tasks in response to actual load, using CloudWatch metrics such as CPUUtilization or MemoryUtilization. The policy works by maintaining a specified target value (for example, 70% CPU) and triggers scale-out or scale-in based on aggregated utilization across the service. This is the recommended pattern for handling spikes in containerized workloads on ECS, as it provides reactive, horizontal scaling without manual intervention.

Managed node groups perform health checks and can automatically replace nodes that fail them, which addresses unhealthy nodes without manual action. Pairing that with CloudWatch alarms on node condition metrics provides the alerting path, satisfying both automatic replacement and notification requirements for future incidents.

This is the correct explanation because the ALB health check probes the configured endpoint and expects a successful status code, and a 503 returned by that endpoint indicates the application's dependency (for example, a database or downstream API) is unavailable. When the health check receives 503 for all tasks, the ALB marks the targets unhealthy and stops routing traffic, ultimately returning HTTP 503 to clients. The symptom therefore matches the health check failure, not an application exception or scaling issue.

An escalation plan is a first-class component of an AWS Systems Manager Incident Manager response plan. You define a total duration (e.g., 10 minutes) and add engagement targets such as individual contacts, chat channels, or a full on-call schedule; if the primary responder does not acknowledge the incident within that window, Incident Manager automatically pages the secondary/next-level contact using the configured contact channels (SMS, voice, mobile push). This is the intended solution because it is fully managed, idempotent, and does not require any custom code or additional AWS services. Escalation plans also support multiple levels, and you can set the engagement duration per target to progressively move up the chain until someone acknowledges.

Creating a snapshot of the attached EBS volumes is a core forensic preservation technique because it captures the full disk state—including deleted file remnants, user-space artifacts, logs, and malware binaries—without stopping the instance. Unlike a live filesystem copy, an EBS snapshot is crash-consistent (or application-consistent with pre-freeze), providing a point-in-time image that can be analyzed on a separate forensic instance without risking further alteration of the original evidence. This must be done before any stop/termination, since those actions can change or destroy disk data.

The aws:ViaAWSService global condition key is true when an AWS service, such as Systems Manager, makes the API call on the principal's behalf rather than the principal making a direct call. The policy's condition requires this key to be false, so when the tool is invoked via Systems Manager the actual value is true and the Allow statement does not match. With no other matching Allow, the request is implicitly denied, which is exactly the error observed.

CodeDeploy deployment logs capture lifecycle event hook failures, invalid scripts, and resource timing issues during deployment (e.g., BeforeInstall/AfterInstall failures) that can leave instances in a degraded state causing performance hits. Any failed or aborted deployment step may cause new instances to be registered with incomplete configuration, leading to CPU/memory pressure or misrouted traffic. Scrutinizing these logs pinpoints whether the performance spike correlates with deployment execution timeouts, file overwrite errors, or instance registration failures.

Implementing DynamoDB Accelerator (DAX) is correct because it puts a write-through, in-memory cache directly in front of your DynamoDB table. DAX intercepts repeated read requests—such as product details, pricing, or inventory views during a sale—and serves them in microseconds, dramatically reducing the read capacity units consumed by the table. This offloading lowers the chance of throttling your primary table while keeping latency low for read-heavy traffic.

An Auto Scaling group with a desired capacity continuously monitors instance health via EC2 status checks and optionally Elastic Load Balancing health checks, automatically terminating and relaunching failed instances. By spreading the ASG across multiple Availability Zones and setting the desired count, you ensure that if an instance or an entire AZ fails, replacement capacity is launched to maintain the required number of instances, making this a core high-availability mechanism.

If the visibility timeout is shorter than the time it takes for the Lambda function to process the message, the message becomes visible again in the queue before the function completes. Another Lambda invocation can then receive and process the same message, leading to duplicate processing. This is a common misconfiguration. The visibility timeout should be set to at least the function's timeout plus a buffer to prevent this. Even if the function eventually succeeds, the duplicate processing has already occurred.

AWS Config's managed rules continuously evaluate security group configurations against policies such as 'restricted-ssh' or 'vpc-sg-open-only-to-a-specific-port'. When a rule detects a non-compliant inbound rule, a configured AWS Systems Manager Automation document, such as AWS-DisablePublicAccessForSecurityGroup, automatically removes or tightens the offending rule, providing the required detect-and-remediate control loop without manual intervention.

A CloudWatch alarm is the correct monitoring construct to watch a metric such as StatusCheckFailed or CPUUtilization. It evaluates the metric against a threshold over a specified number of evaluation periods and transitions to ALARM, OK, or INSUFFICIENT_DATA, then triggers a configured SNS action. The alarm is the central component that converts raw metric data into an operational notification, making it the appropriate mechanism for alerting on the instance's status check result.

The correct root cause is a timeout mismatch: CloudFront waits for an origin response within its configured origin timeout (default 30 seconds), while the ALB has an idle timeout (default 60 seconds) that can close the connection to the backend if no bytes flow. If the ALB idle timeout is shorter than CloudFront’s timeout, the ALB can terminate a long-running request before the backend finishes, causing CloudFront to receive no response and return 504. Since the ALB logs show 200 for completed requests, the occasional slow requests are being cut off by this idle setting; aligning the ALB idle timeout to be greater than CloudFront’s origin timeout (or tuning backend latency) is the fix.

DynamoDB throttling occurs when write requests exceed the provisioned write capacity (WCUs) of the table. If the Lambda function writes processed items back to the same table, insufficient WCUs will cause ProvisionedThroughputExceededException, leading to retries and stream processing failures. Increasing the write capacity reduces throttling, allowing the stream-triggered writes to succeed and the function to make progress.

CloudFront caches objects at edge locations until their TTL expires, so after you update files in Amazon S3 the edge locations continue serving the old copies. An invalidation request explicitly removes the specified file paths from every CloudFront edge cache, forcing subsequent requests to fetch the latest version from the S3 origin. You can target an individual file with /path/file.js or use a wildcard like /images/* to clear a whole directory. This is the intended, immediate mechanism for propagating content updates without waiting for natural cache expiry.

A health check timeout set too low can cause the ALB to mark otherwise functional instances as unhealthy when the application's response time occasionally exceeds the timeout. The ALB health check settings include an interval, timeout, and unhealthy threshold; if a slow application misses the timeout a few consecutive times, the target is deregistered and the ALB returns 503 Service Unavailable when no healthy targets remain. This matches the symptom of intermittent errors under load, as the application may respond normally at times but exceed the timeout during traffic spikes.

CloudTrail event history retains management events for the last 90 days, and each event record includes the sourceIPAddress field, which identifies the IP address from which the API call was made. Searching event history for the DeleteBucket event, or a similar deletion event, and expanding the event details will show the sourceIPAddress in the raw event record. This is the direct and correct way to retrieve the requester's IP for a specific CloudTrail event.

The ContinueUpdateRollback operation is the correct recovery mechanism specifically designed for stacks that fail during an update and subsequently fail to roll back automatically, landing in UPDATE_ROLLBACK_FAILED. It instructs CloudFormation to resume the rollback to the last known good state, optionally skipping resources that are causing repeated failures via the ResourcesToSkip parameter after manually fixing them. This restores the stack to a stable, updatable condition without destroying the underlying infrastructure.

Fargate tasks provisioned in a private subnet have no route to the internet unless a NAT gateway is configured in a public subnet. Because ECR's API and Docker Hub need outbound HTTPS access, and image layers are fetched from Amazon S3, the task's image pull fails without a NAT gateway or VPC endpoints for ECR (both API and DKR) and S3. This manifests as a 'CannotPullContainerError' or 'ResourceInitializationError' in the task's stopped reason. Adding a NAT gateway or the appropriate VPC endpoints resolves the issue.

This action creates a new launch template version that retrieves the password from AWS Secrets Manager, then performs an instance refresh with a minimum healthy percentage of 100%. This replaces instances one by one without downtime, remediating the security issue on all instances.

A sidecar container, such as aws-for-fluent-bit, runs alongside the application in the same pod and streams log events to Amazon CloudWatch Logs in near real time. Even if the main application container crashes and immediately restarts, the sidecar remains operational, and the log events already shipped are safely retained in CloudWatch, enabling immediate debugging and automated alarms. This decouples log shipping from the application's lifetime and provides durable, searchable history that survives pod restarts and rescheduling.

AWS CloudTrail is correct for this investigation because it records S3 data-plane API calls such as GetObject, PutObject, and ListObjects, along with the requesting IAM identity, source IP, and timestamp. Object-level logging must be enabled on the trail or bucket, but once active, it provides a comprehensive audit trail of exactly which objects were retrieved. This makes CloudTrail a primary evidence source for S3 data exfiltration.

Amazon Macie is a fully managed data security service that uses machine learning and pattern matching to automatically discover sensitive data, such as personally identifiable information (PII), stored in Amazon S3. It continuously monitors bucket policies and access control lists (ACLs) to detect publicly accessible buckets and generates security findings that can be sent in real time via Amazon EventBridge. This makes it a detective control perfectly suited for alerting auditors on public exposure.

The ALB health check is performing HTTP requests against the configured health check path on each target. When the application returns any 5xx status code (or the request times out because the app hangs under load), the ALB marks that target as unhealthy. With an intermittent application bug (e.g., a memory leak or a connection pool exhaustion), the health check will fail sporadically, causing the ALB to periodically stop routing traffic to that instance. If all targets become unhealthy at the same time, the ALB returns HTTP 503 Service Unavailable to clients, which exactly matches the intermittent nature of the reported errors.

When the application instances cannot process requests fast enough, their internal request queue gradually fills up. The ALB forwards new connections to these instances, but if the backend fails to accept or complete the connection within the configured timeout, the load balancer returns HTTP 503 Service Unavailable. This is a performance/capacity bottleneck, not a network or configuration fault.

Point-in-Time Restore is the fastest AWS-native recovery method because RDS never leaves you without a timeline: it automatically captures daily snapshots and continuously records MySQL binary logs, so you can pick a timestamp just before the offending DDL/DML statement. RDS then creates a new DB instance by restoring the last automated snapshot before that moment and replaying transaction logs up to the exact second you specify, avoiding any manual log analysis. The restored instance reflects the database before the change, making this both the quickest and most reliable choice.

When you increase reserved concurrency for a function, you allocate a specific slice of the account's total concurrency limit (e.g., 1000). The remaining functions share the leftover pool, and if the total request rate exceeds that remaining capacity, new invocations for those functions are throttled with a 429 RateExceeded error. This is especially common when a burst of SQS messages triggers many concurrent invocations across multiple functions, saturating the account-wide limit and causing messages to remain in queue.

Viewing the CloudTrail event history for the delete-bucket event provides the source IP address and user agent because CloudTrail records management API calls, including DeleteBucket. This is the direct and correct method to obtain the required information.

The CloudWatch agent runs as a separate user-space daemon that periodically reads log files and sends them to the CloudWatch Logs API. When the host's CPU is saturated — especially on T-series instances with exhausted CPU credits — the agent's log collection and flush loop can be delayed or preempted for long enough that it begins dropping buffered events to avoid creating an ever-growing backlog. Increasing instance size or CPU credits gives the agent the scheduling time it needs to reliably process and upload log batches, directly resolving the observed missing periods.

The RDS error log is the first place to look because it records 'Aborted connection' entries with explicit reasons such as 'Got timeout reading communication packets' or 'Client has exceeded the max_user_connections' when a reset occurs. These entries include the source host, user, and exact error code, which lets you determine whether the reset originates from the database server (e.g., idle timeout) or from the client side. This evidence directly confirms or rules out connection-level failures before you change any configuration or architecture.

Amazon RDS Proxy sits between the application and the database, pooling and reusing connections to reduce connection overhead, and when read/write splitting is enabled it can automatically route read queries to one or more Read Replicas while sending write transactions to the primary. This transparently offloads read traffic from the primary without requiring application code changes or manual endpoint management. The proxy also maintains session state and preserves transaction semantics, making it the correct solution for reducing load on a Multi-AZ RDS MySQL instance.

When an ElastiCache cluster reaches its maxmemory limit, the eviction policy (e.g., allkeys-lru or volatile-lru) kicks in to free space by deleting keys. Evicted keys disappear before they can serve valid reads, so subsequent lookups for those keys become cache misses, directly reducing the CacheHitRate metric. This is the most consistent explanation for a sustained drop in hit ratio: the cache is actively discarding data to accommodate new writes, and the eviction is a continuous symptom of memory pressure, not a one-time event.

AWS CloudFormation StackSets extends CloudFormation to deploy stacks across multiple accounts and regions within AWS Organizations, automatically and in a single operation. You can define a template containing a CloudWatch Logs subscription filter and a Lambda function, and StackSets will create those resources in every member account. The subscription filter streams selected log events from each account's log groups to the Lambda function, which then processes and forwards them to a centralized destination such as an S3 bucket, Kinesis, or a central CloudWatch account. This approach is fully automated, consistent, and the recommended pattern for centralized log forwarding.

Security groups act as a stateful firewall at the instance level, while network ACLs are stateless at the subnet level, so both must allow the relevant inbound traffic and the NACL must also allow the corresponding outbound return traffic. An incorrect deny rule, an overly restrictive CIDR, or a missing allow for the source IP/port pairs will cause exactly this kind of unreachability even when the instance is running and healthy, making this the correct first troubleshooting step.

The unified CloudWatch Agent is the correct solution because it runs as a service on your EC2 instance and reads guest-OS metrics directly from /proc and the operating system, allowing it to report memory utilization as a custom metric to CloudWatch. You can install and configure it via the command line, SSM Run Command, or an AWS-supplied recipe, and attach an IAM role with `cloudwatch:PutMetricData` permissions. It also supports collecting disk usage, CPU per-core statistics, and logs, all of which are invisible to hypervisor-level default EC2 metrics.

A 403 Forbidden response from an API means the server understood the request but refused to authorize it; public APIs commonly require an API key, an Authorization header, or a signed payload, and the canary's HTTP request may be missing those credentials. Verify the canary script attaches the API key (e.g., x-api-key header) or uses the same authentication mechanism as your test client; also ensure the key is valid and not expired.

Enabling automated backups with point-in-time recovery (PITR) is the correct immediate response because it lets you restore the database to any second within the retention window, such as a timestamp just before the compromise occurred. Automated backups take daily snapshots, and RDS continuously records transaction logs to enable PITR, minimizing data loss if tables were dropped or data was tampered with. This is the foundational recovery mechanism to return the system to a known-good state.

An Application Load Balancer operates at Layer 7 and can distribute HTTP/HTTPS traffic across instances in multiple Availability Zones, providing health checks and automatic registration of instances in the Auto Scaling group. This integration allows the ALB to route traffic only to healthy instances and to scale with the ASG's changes, enhancing availability and fault tolerance. It is the recommended pattern for web applications requiring high availability and advanced routing.

The account has reached the EC2 instance limit for the selected instance type in the region, which is the only option that matches the error 'You have requested more instances than your current EC2 instance limit allows'. Auto Scaling attempts to call RunInstances, but EC2 rejects it with an InstanceLimitExceeded error, causing the scaling activity to fail. This is a service quota that applies per instance type per region, and the fix is to request a quota increase via the Service Quotas console.

CloudFront reports in the AWS Management Console include a Geo Distribution report and viewer reports that break down requests, bytes served, and other metrics by country and by edge location. These built-in reports are pre-aggregated by AWS and displayed directly in the console, giving a quick geographic view of traffic patterns and performance without needing additional infrastructure or custom queries. They are the intended way to answer global distribution questions out of the box.

CloudWatch Logs metric filters are the correct mechanism for real-time alerting on CloudTrail API activity. A metric filter defines a pattern that matches specific CloudTrail log events, such as `errorCode = "UnauthorizedOperation"`, and continuously increments a custom CloudWatch metric. A CloudWatch alarm can then evaluate that metric over a fixed period (e.g., 5 minutes) and trigger an SNS notification when the threshold is breached, enabling fast, automated responses to suspicious API calls.

Switching the table to on-demand capacity mode removes the provisioned throughput ceiling and instantly accommodates unpredictable spikes, which is exactly the flash-sale pattern here. It is the fastest mitigation because the table continues serving reads and writes during the switch, so the ProvisionedThroughputExceededException errors stop without capacity math or client changes.

Flapping occurs when targets are marked unhealthy during normal startup or heavy I/O. Lengthening the interval and unhealthy threshold tolerates transient failures, while a health check grace period or slow start keeps new or busy targets in service until they are ready, which directly stops the repeated removal and re-addition causing 502s.

CloudWatch Logs Insights queries multiple log groups at once with a time range and supports saving or exporting results, directly matching the search and preservation requirements. It requires no infrastructure, so it is the lowest-effort option for finding the request ID and retaining the findings for review.

An invalidation request for the '/*' path removes all objects from CloudFront's edge caches across every region, which forces the distribution to return to the S3 origin on the next request and fetch the updated content. This is the standard, immediate method for clearing cached content when you need to publish new website changes, and it does not require changing URLs or reconfiguring any origin settings.

The HTTP 500 on /api/orders is generated by the application after the ALB successfully forwards the request, meaning the instance is reachable and the web server process is handling traffic. However, the /api/orders endpoint depends on a downstream service (e.g., database, internal microservice, cache) whose failure causes the application to throw an unhandled exception and return a 500. Health checks succeed because the configured health check path (typically /health or /) exercises simple connectivity and doesn't call the failing dependency, so the instance remains in service. This is a classic partial-failure scenario where the dependency, not the instance, is unhealthy.

The DatabaseConnections CloudWatch metric directly tracks the number of client connections currently established to the RDS instance, and when this value approaches the max_connections parameter, the server begins rejecting or timing out new connection attempts. This pattern perfectly matches the symptom of intermittent connection timeouts while CPU and memory remain normal, because the connection ceiling is a hard limit unaffected by resource utilization. Comparing this metric against the configured max_connections (from the parameter group) confirms whether connection exhaustion is the cause.

ALB access logs are the authoritative source for diagnosing 504 timeouts because they record the HTTP status code and three timing dimensions: request_processing_time, target_processing_time, and response_processing_time. The target_processing_time field directly measures how long the ALB waited for the target to begin sending a response; values at or near the idle timeout threshold precisely identify the request and target instance responsible for the 504. This option provides concrete, per-request evidence of backend latency, unlike health checks or security group rules, which only indicate availability and reachability.

The Lambda function is failing because its actual execution time is longer than the configured timeout. Raising the timeout to 10 seconds directly expands the allowed execution window, giving the code enough time to complete its work — as long as it stays below the 15-minute maximum. This is the only option that addresses the root cause of a timeout error rather than changing resources or failure handling.

A target tracking scaling policy with a target value of 70% average CPU utilization proactively adds instances before utilization reaches 80% and continuously adjusts to maintain the target, providing fast response to spikes without over-provisioning.

The AWS CloudTrail LookupEvents API is the correct method because it directly queries CloudTrail's event history, which records all control plane API calls such as DeleteBucket. You can use the LookupAttributes parameter with AttributeKey=EventName and AttributeValue=DeleteBucket, filtering by time range if needed. This returns the full event record, including the IAM user or role, source IP, and timestamp, for any deletion within the last 90 days. It is the native, low-latency mechanism for exactly this forensic search.

Auto Scaling is configured to use EC2 status checks for health, so it will detect the instance's failed status check and automatically terminate it, launching a new instance with the same launch configuration to maintain desired capacity. Waiting is the correct action because the replacement process is fully automated and requires no manual intervention. The new instance will be created once the unhealthy instance is marked as unhealthy, typically within a few minutes.