CCNA Incident and Event Response Questions

CodePipeline executes deploy actions by assuming a dedicated IAM service role, and that role must contain an identity-based policy granting the required API permissions (e.g., codedeploy:CreateDeployment, ecs:UpdateService, or cloudformation:CreateStack) on the target resource. If a required permission is missing or explicitly denied, the deploy stage fails with an AccessDenied error even though every other pipeline configuration is correct. You should review the pipeline execution details to identify the specific denied action, then attach an appropriate managed or inline policy to the service role.

Amazon CloudWatch Alarms are the native mechanism for EC2 AutoRecovery. By configuring an alarm on the System Status Check metric (StatusCheckFailed_System) with the 'recover' action, you let EC2 automatically restart the instance on new hardware while preserving its instance ID, private IP, Elastic IP, and instance store data. This is the direct, built-in solution that requires no custom code or additional orchestration.

Deleting the pod with `kubectl delete pod <name>` immediately sends a termination signal (SIGTERM) to the container, and after the grace period, a SIGKILL, removing the pod from the cluster and stopping the malicious process. This is the primary containment step to halt active compromise; however, if the pod is managed by a ReplicaSet or Deployment, the controller will replace it, so you must also update the workload definition or scale down to prevent recreation. It is a precise operation that affects only the compromised instance.

Auto Scaling can be configured with an appropriate health check type (EC2 status checks or ELB/ALB health checks) and a termination policy to automatically detect and replace unhealthy instances. This ensures that the ASG maintains the desired instance count by terminating the unhealthy instance and launching a new one, providing a self-healing architecture for the critical application.

The default inactivity timeout for many HTTP clients is exactly 3 seconds, so when the external API takes longer than that to respond, the client aborts with a timeout error before the Lambda function's own timeout limit is reached. Raising the client timeout (or configuring connection/read timeouts) to exceed the expected API response time directly resolves the issue. This matches the symptom precisely because every call that exceeds the threshold fails at the same 3-second mark.

S3 server access logs record every request made to a bucket, capturing the authenticated identity, timestamp, source IP and operation performed. This directly satisfies the requirement to determine which actions the unauthorised user took, since the logs detail the specific REST operations against the bucket.

Shield Advanced provides always-on detection and inline mitigation at the AWS edge, absorbing large volumetric DDoS attacks before they reach the ALB. It also includes DDoS cost protection and 24/7 access to the DDoS Response Team (DRT), who can analyze attack patterns and apply mitigations directly. Enabling it on the ALB is a fundamental step for comprehensive DDoS protection.

A cooldown period is a duration after a scaling activity during which the scaling policy cannot trigger another action, even if the CloudWatch alarm remains in breach. In Application Auto Scaling, this prevents rapid oscillation and lets the newly added tasks take effect. If a previous scale-out or scale-in occurred recently, the outstanding cooldown will block the new scaling request, which exactly matches the symptom of the alarm being breached but no scaling activity occurring.

Configuring a health check against a specific application endpoint, such as /healthz or /api/v1/status, makes the ELB perform a deep health check that exercises your application's critical request path, including framework routing, connections to dependent services, and session or cache state. This directly addresses the scenario where an instance accepts TCP or HTTP requests but is not truly ready to serve application traffic. By returning a non-200 status only when application dependencies or internal state are degraded, the ELB can accurately detect the unhealthy instance and stop sending it traffic.

During a rolling update, CloudFormation temporarily sets the ECS service's desired count to zero to force a clean replacement of all tasks. If the service's minimumHealthyPercent is set to 100%, ECS cannot scale the current running tasks below 100% of the desired count, so the service scheduler rejects the desired count reduction and the CloudFormation update is cancelled. This is a common misconfiguration when engineers expect zero-downtime but inadvertently block the scale-in step.

When the Auto Scaling group is configured with EC2 health checks or an attached Elastic Load Balancer's health checks, it automatically detects instances that become unhealthy. The default health check replacement behavior marks the failing instance as unhealthy, terminates it, and launches a replacement instance to restore desired capacity, all without manual intervention. This is the underlying mechanism that keeps the web tier healthy, making it the correct choice for replacing faulty instances.

Amazon S3 server access logs provide detailed records for every request, including source IP address, user agent, requester, operation, and HTTP status. This is the correct service to identify the source IP and user agent of the unauthorized request.

The cooldown period is a deliberate delay after a scaling activity before the group can launch or terminate additional instances. If set too high, it suppresses subsequent scaling actions for an extended time, so the group cannot keep pace with rapidly increasing demand. For a dynamic scaling policy, this directly prevents the Auto Scaling group from adding instances promptly, making scaling appear slow. Thus, an excessively high cooldown is a valid cause of the described problem.

Raising the task memory to 2048 MiB while keeping CPU at 512 units is the minimal change that removes the hard memory limit causing the container's OOM kill. ECS enforces task memory as a cgroup limit, so the kernel terminates the process once the container's resident memory reaches that configured cap. This directly provides the application runtime sufficient headroom, uses the valid Fargate 0.5 vCPU / 2 GiB combination, and avoids wasting spend on CPU that was never the bottleneck.

Redeploying the previous application version through the Elastic Beanstalk console triggers a fresh environment update that restores the last known-good build, directly reversing the faulty deployment. This is faster than rebuilding the environment or manually patching instances, satisfying the requirement to quickly revert to the previous working version.

Target tracking is a dynamic scaling policy that uses a control loop to continuously compute the required capacity needed to keep the CloudWatch metric at the specified target value. Rather than reacting with binary on/off alarms, it applies proportional adjustments based on the current deviation from 50% CPU utilization, smoothing out capacity changes and preventing the overshoot/undershoot cycle that causes oscillation. This gives the Auto Scaling group a clear, single objective that balances responsiveness with stability.

The deregistration delay (connection draining) is the time ALB gives in-flight requests to finish after a target is deregistered. On ECS Fargate, when a task is stopped, the ALB stops routing new requests and, if the delay is too short, forcibly closes the connection before long-running requests complete, causing clients to receive 502/503 responses. For high-latency or streaming workloads, the delay must exceed the longest expected request duration.

The `--disable-rollback` flag on `aws cloudformation update-stack` instructs CloudFormation to leave the stack in its failed state instead of reverting to the previous successful template. This is the correct way to prevent rollback because it preserves the partially updated resources—including any S3 buckets, EC2 instances, or custom resources—for root-cause analysis and manual remediation. The stack status becomes `UPDATE_FAILED`, and the original resources remain untouched until you intervene.

Attaching a customer-managed IAM policy with an explicit 'Deny' effect for all actions on all resources immediately revokes both console and programmatic access for the compromised users. IAM's evaluation logic gives explicit denies precedence over any allow, so even if the user still has attached policies with broad permissions, the deny-all policy overrides them. This containment action preserves the user objects and their audit trail for forensic analysis, allowing you to safely investigate and later rotate credentials or delete the users if needed. Unlike disabling keys or changing password policies, this approach covers all access methods simultaneously.

For a custom AWS Config rule to evaluate a resource on configuration changes, the rule's scope must include that resource type. If the rule is defined without AWS::EC2::Instance in its 'Resource types' scope (or if it is scoped to a specific tag/resource ID that does not match), AWS Config will not send evaluation events to the Lambda function for EC2 instances. In this scenario, the rule has the correct trigger type (change) but its scope does not cover EC2 instances, so Config never invokes the Lambda function on instance launch. This is the exact cause of the DevOps team's issue.

VPC Flow Logs capture IP traffic metadata for ENIs in the VPC, recording fields like source address, destination address, port, protocol, and the action — ACCEPT or REJECT — for each connection. By publishing flow logs to Amazon S3 and using Amazon Athena with its SerDe, you can run SQL queries to filter on action = 'REJECT' and aggregate the denied connection attempts by source IP, port, or time. This directly reveals which connections are being blocked, making it the correct way to investigate denied traffic.

CloudWatch Logs for CodeDeploy is the correct source because it centralizes deployment events and error messages. When you configure a log group for the deployment group, lifecycle event execution details—such as BeforeInstall, AfterInstall, ApplicationStart, and the associated script output—are streamed into CloudWatch Logs. This lets you query and filter by deployment ID and instance ID, making it the fastest way to identify which lifecycle hook failed and why, rather than logging into individual instances.

Reserved concurrency caps the number of concurrent executions for the function. When all slots are busy, Lambda immediately rejects new invocations with a Throttle error. Because the code never starts, no START/END/REPORT lines are emitted, so CloudWatch Logs for the function remain empty. The S3 event notification will retry for a few hours, but each throttled attempt leaves no log.

This is the correct cause. CloudWatch Logs acts under the service principal logs.amazonaws.com when performing server-side encryption with an AWS KMS customer managed key. If the KMS key policy does not include a statement granting this principal the kms:Encrypt and kms:DescribeKey actions (and denies are absent), the service cannot encrypt the log events. In such a case, log delivery may continue to succeed but the data is stored without the intended encryption, exactly matching the symptom described.

CodeDeploy enforces a minimum number of healthy hosts as a safety condition, and when the deployment group has exactly one instance, any positive minimum healthy host count makes an in-place deployment impossible. With a setting of 100% or 1, taking that only instance out of service to deploy to it would reduce the healthy host count to 0, violating the constraint and aborting the deployment at the very start. The error message specifically mentions that the deployment was aborted because the minimum number of healthy hosts was not met.

Amazon CloudWatch is the native monitoring service for Amazon RDS, automatically collecting and storing database metrics such as CPU utilization, free memory, read/write throughput, and ReplicaLag for MySQL read replicas. These metrics are published as time-ordered data points and can be visualized on dashboards, trigger alarms via Amazon CloudWatch Alarms, and feed AWS Auto Scaling. With Enhanced Monitoring, it can also expose OS-level metrics, making it the correct source for diagnosing load and replication issues.

AWS WAF provides application-layer (Layer 7) inspection and can be associated directly with an ALB. By creating a web ACL that references an IP set containing the offending client IP and setting the default or custom rule action to 'Block', requests from that IP are denied before they reach the ALB. This is the purpose-built, scalable mechanism for IP-based blocking in front of an ALB, and it can be implemented without altering routing or security group configurations.

CodePipeline natively publishes execution-level log events to Amazon CloudWatch Logs, including stage start/end timestamps, action state transitions, and failure diagnostics. This provides a centralized, queryable repository that can be filtered with CloudWatch Logs Insights, used for metric filters and alarms, and retained beyond the console's default history. Because these logs capture the pipeline's own runtime behavior, they are the authoritative source for troubleshooting execution details.

The 'Rollback' action in the CloudFormation console is the correct approach because CloudFormation maintains an automatic rollback trigger for failed update operations, and when an update enters a failed state, you can explicitly invoke 'Rollback' from the console to restore the stack to its last known good template and parameter state. This action is specifically designed to undo the partial or failed changes, reverting affected AWS resources to their pre-update configuration, and is the direct rollback mechanism within CloudFormation's lifecycle.

Recording processed S3 object keys in a DynamoDB table and checking for existence before processing makes the Lambda function idempotent. Use a conditional write, such as PutItem with ConditionExpression: attribute_not_exists(partition_key), so the first invocation for a given object key proceeds and subsequent duplicates fail the condition and exit without side effects. This is the recommended pattern because it works regardless of how many duplicate events S3 delivers and does not depend on delivery semantics.

MemoryUtilized and MemoryReserved are the correct CloudWatch ECS metrics for Fargate tasks, as they directly measure the task's memory consumption against the memory limit configured in the task definition. When MemoryUtilized consistently approaches or equals MemoryReserved, the container runtime may start swapping memory pages to disk, which degrades performance. Monitoring these two metrics together provides the earliest signal of memory pressure that leads to swapping.

For IAM database authentication, the application must first assume the IAM role 'DatabaseAccessRole' to obtain credentials authorized to generate the RDS token; the trust policy on 'DatabaseAccessRole' must explicitly list 'EC2-AppRole' as a trusted principal. When this trust policy does not allow the EC2 instance's role to assume it, the STS AssumeRole call returns 'AccessDenied', so the application cannot acquire the token required for authentication to RDS. This exactly matches the observed error, confirming the trust policy of 'DatabaseAccessRole' is the root cause.

CloudWatch Logs Insights lets you run SQL-like queries against application logs stored in CloudWatch Logs, allowing you to filter for specific error codes, exception stack traces, or deployment markers that align with the exact timestamp of the metric spike. By correlating log timestamps with the scaling activity, you can identify events like a failed code release, a dependency outage, or a traffic surge that pushed the metric above the alarm threshold. This is the only option that gives access to application-level evidence needed to diagnose the upstream cause of the spike.

Because the web application stores its session state locally—either in memory (e.g., a servlet HttpSession) or on the instance's ephemeral disk—any instance replacement destroys active sessions. During a rolling update, the Auto Scaling group terminates old instances after launching new ones, forcing users who had sessions on those instances to be logged out. Moving session data to a shared external store such as ElastiCache for Redis, DynamoDB, or a central database makes sessions independent of instance lifecycle and prevents this behavior.

The instance OS runs its own packet-filtering firewall—typically iptables or firewalld on Linux—which operates independently of AWS's security groups and network ACLs. Even with a permissive security group and a correct public IP, an iptables rule (e.g., default INPUT policy DROP or a REJECT rule) will drop inbound HTTP packets before they reach the web server. This is a classic scenario where all AWS-side checks pass but the instance remains unreachable, hence the CLI 'running state' does not reflect host-level firewall state.

Lambda allocates CPU proportionally to the configured memory, so increasing memory to 256 MB from a lower value (e.g., 128 MB) roughly doubles the available vCPU fraction, speeding up CPU-bound tasks. This directly targets the performance bottleneck and is a standard first step in Lambda performance tuning. For the stated issue, this change is more likely to reduce execution time than the other options.

AWS Systems Manager Run Command is the correct choice because it uses the SSM Agent already installed on the EC2 instance to execute a script as a one-shot, non-interactive command. It does not require SSH, opening port 22, or managing SSH keys, and it works across multiple instances concurrently with rate control and output logging. Run Command is purpose-built for exactly this ad-hoc script execution scenario, and it leverages the instance's IAM role for permissions, avoiding any need for bastion hosts or direct network access.

VPC Flow Logs on the task's elastic network interface capture connection-level metadata — source and destination IP, ports, protocol, and whether the packet was accepted or rejected — for every flow through the ENI. They can be published to CloudWatch Logs or S3 and queried to correlate application failures with security group rule actions or network ACL denials. Because each Fargate task has a dedicated ENI, flow logs are the only one of these options that provides the raw network reachability data needed to diagnose connectivity issues.

The ECS service scheduler with a REPLICA scheduling strategy maintains the desired number of tasks by automatically launching replacement tasks if any task stops or fails. This is the default and correct approach for long-running services that require high availability. The scheduler continuously monitors the service and reconciles the actual state with the desired state, ensuring that the specified count of 4 tasks is always running.

Modifying the DB instance to increase allocated storage is the correct approach because Amazon RDS for PostgreSQL supports dynamic storage scale-up without any downtime, provided the instance is in the 'Available' state and not in a pending reboot. You can increase storage either via the AWS Console, CLI, or API, and RDS immediately begins the modification while keeping the instance online. The new storage capacity is reflected after the modification is processed, and you can also enable storage autoscaling to prevent future low-storage alerts.

CloudTrail Event history is a built-in feature of the CloudTrail console that displays the last 90 days of management events across all regions, including details like the IAM user identity, event name, and timestamp. It requires no setup and can be searched or filtered directly to find a specific API call and the user who made it. This makes it the fastest and most direct way to answer the question of which user performed a given action.

The Lambda execution role is assigned to the function via the IAM role's trust policy and must include CloudWatch Logs actions like logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents on the relevant log group. Without these permissions, the Lambda runtime's logging agent cannot deliver the function's stdout/stderr output to CloudWatch Logs, causing the invocation to finish successfully while producing zero log bytes. This is the classic cause of a Lambda function that runs without any visible logs, and it also explains why no log group or log stream is created.

The target group's unhealthy threshold is the number of consecutive failed health checks required before ALB deregisters a task and stops sending it traffic. If the threshold is set too low (e.g., 2), a single transient failure—such as a slow response during Fargate instance startup or a momentary network blip—will cause the task to be marked unhealthy and removed from rotation. While it is out of service, if other tasks are also briefly unhealthy or in a draining state, the ALB has no healthy targets and returns HTTP 503 errors until the next successful health check (possibly just seconds later), producing intermittent 503s.

Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service designed specifically to deliver messages to a large number of subscribers across multiple protocols, including email, SMS, mobile push, HTTP/S, Lambda, SQS, and AWS Chatbot. For incident response, SNS topics receive alerts from CloudWatch Alarms or EventBridge rules and fan out to all subscribed endpoints, ensuring that on-call engineers are notified reliably via their preferred channel. Its message delivery retry policies, dead-letter queues, and subscription filtering make it the core AWS-native notification service for operational alerts.

Patch Manager can be configured to write command output to an S3 bucket, either through the Systems Manager settings or per Run Command invocation. These logs capture the full stdout/stderr from the patching process, including detailed error messages, exit codes, and failures from the SSM Agent or patch installation tools. Therefore, checking the S3 bucket is the primary way to obtain the specific reason a patch failed on an instance.

The EC2 Serial Console provides out-of-band server access to the instance's serial port, independent of the network stack and the SSH daemon. It works even when the guest OS is severely degraded or network interfaces are down, making it the correct first step for troubleshooting boot, kernel, and configuration problems. Access is governed through IAM and requires enabling the feature and configuring SSH/RSA keys or a password via IAM policy. Unlike the other options, this is the only one that does not rely on in-band connectivity or a functioning OS network path.

When the Lambda function's concurrency limit is reached, synchronous invocations from API Gateway are throttled. For proxy integrations, a throttled request is not immediately rejected—the Lambda service may wait for a free concurrency slot while API Gateway's 29-second integration timeout is already counting down; if no slot frees up in time, API Gateway drops the connection and returns a 504. This explains intermittent 504s even though a 5-second function would otherwise succeed, because the delay occurs before the function code ever runs.

CloudTrail Insights is the correct choice because it automatically applies machine learning to management events, including IAM AssumeRole, to establish a normal baseline and flag anomalous activity. It requires no manual filter definitions—you simply enable Insights on the trail, and it begins detecting unusual API call rates or error rates, logging them as separate Insights events. This is purpose-built for identifying abnormal role assumption patterns, such as an unexpected spike in AssumeRole calls or a new principal assuming roles outside its normal context.

For a private subnet to reach the internet via a NAT gateway, its route table must contain a route with a destination of 0.0.0.0/0 and a target of the NAT gateway's ID. This route tells the instance's traffic to be forwarded to the NAT gateway, which then performs source NAT using its Elastic IP. Without this specific route, the instance's outbound packets have no defined next hop to the internet, causing connectivity to fail.

The correct remediation is to first raise the Lambda timeout to a value that comfortably covers the actual processing duration for a batch, then set the SQS visibility timeout to at least that same timeout so the queue does not redeliver a message while the function is still processing it. Adding a dead-letter queue to the source SQS provides a safety net: after the configured retries (maxReceiveCount), messages that still fail are diverted to the DLQ, preserving them for analysis instead of silently expiring. This combination directly resolves the timeout issue and handles residual failures cleanly.

The ECS deployment circuit breaker is a native ECS feature that continuously monitors the health of a service deployment by watching for failed health checks, crashes, or task startup failures. If it detects that the new version is unhealthy, it automatically cancels the deployment and rolls back the service to the previous stable revision, without manual intervention. This makes it the only option that directly addresses deployment failures as part of the ECS service update path.

Modifying the RDS instance to a larger instance class is the correct immediate response because it directly adds vCPU, memory, and often dedicated EBS bandwidth to handle the current workload. Amazon RDS supports scaling instance classes with minimal downtime, especially for Multi-AZ deployments where a failover masks the restart. This scale-up action provides the compute headroom needed to bring CPU utilization back to acceptable levels and is the standard first step when a CPU alarm indicates that the instance is simply undersized for the traffic.

With a 5-minute period, 3 evaluation periods, and 3 datapoints to alarm, the alarm enters ALARM state only when every one of the three most recent 5-minute data points breaches the threshold. This means the metric must be continuously in breach for 15 minutes, filtering out transient spikes and providing a reliable signal of a sustained problem. It is the appropriate setting for production alarms that should page responders only after a consistent degradation.

ALB access logs record per-request target status, target IP and timing, so filtering 503s reveals whether targets returned errors or the load balancer itself failed. This directly correlates the ELB 5XX spike with backend latency, satisfying the stem's need to identify the failing tier first.

Fargate task-level CPU and memory metrics in CloudWatch reveal resource exhaustion causing task stops; raising the task definition's CPU and memory values gives tasks sufficient headroom, directly addressing the suspected exhaustion constraint and preventing recurrence.

This is the only option that provides automatic detection and remediation. An AWS Config managed or custom rule can evaluate each security group and mark it NON_COMPLIANT if it contains an ingress rule with 0.0.0.0/0. You can attach that rule to a Systems Manager Automation document, which uses aws:executeAwsApi to call RevokeSecurityGroupIngress and remove the offending rule, or trigger an AWS Lambda function; this remediation runs automatically on each configuration change. Thus it directly satisfies the requirement to revert unauthorized changes.

The SSM Agent maintains a control-plane communication channel over HTTPS to the Systems Manager regional endpoints, either through the public internet, a NAT gateway, or interface VPC endpoints. If outbound access is blocked by security groups, network ACLs, or route tables, the instance cannot register with Systems Manager, receive patch commands, or report status, yet the agent may continue running locally without logging an explicit error. Therefore, verifying that the instance can resolve and connect to endpoints like ssm.<region>.amazonaws.com on port 443 is the first diagnostic step.

Fixing the script error in the application revision directly addresses the root cause: the failure is deterministic in the artifact, so every instance that runs the same script will encounter the same problem. A subsequent redeployment with the corrected AppSpec or associated script lets CodeDeploy re-run the lifecycle hooks on all target instances, ensuring consistent and reproducible success. This is the standard remediation because CodeDeploy deployments are immutable artifacts—changes must be made in the revision, not on live instances.

CloudWatch Logs Insights runs SQL-like queries directly against live CloudWatch Logs data, allowing you to count matching log entries with a query such as 'stats count(*) by status' in real time. CloudWatch Dashboards can embed these query results as graph or numeric widgets, which automatically refresh (on up to a 60-second interval) to provide a live operational view. This is the native, serverless, and lowest-latency solution designed specifically for this use case.

Network ACLs are stateless, subnet-level filters that apply to all traffic crossing the subnet boundary. Even if a security group allows inbound SSH, a deny rule in the NACL inbound table for port 22 will silently drop the connection before it reaches the instance, so inspecting the subnet's inbound NACL rules is an essential first troubleshooting step.

Configuring a CloudWatch Events (now Amazon EventBridge) rule to send a notification to an Amazon SNS topic is a correct and recommended solution for this scenario. You define an event pattern that matches the CreateAccessKey event (source: iam.amazonaws.com, eventName: CreateAccessKey) and set the target to an SNS topic, which then delivers email, text, or other notifications to subscribers. This approach provides near-real-time, event-driven alerts directly from CloudTrail, with no dependence on polling or querying. It is the most direct way to satisfy the requirement of notifying the security team immediately when an access key is created.

Amazon CloudWatch Logs centralizes log streams from EC2 instances, Lambda, and other AWS services via the CloudWatch agent, making logs available for query within seconds of ingestion. CloudWatch Logs Insights provides an interactive, purpose-built query engine that can search, filter, and aggregate log events across multiple log groups using a simple query language, without requiring external infrastructure. This combination supports fast, exploratory incident analysis, real-time alarming via metric filters, and full retention options—making it the most direct and operationally ready choice.

The CodeDeploy console provides a detailed view of each deployment, including the status of each instance and the specific lifecycle events that have succeeded or failed. This information helps pinpoint where the deployment is failing, such as during the BeforeInstall or AfterInstall hooks. It is a quick way to get an overview of the deployment progress and identify the failing stage.

Rebooting the DB instance with the 'Reboot with failover' option selected forces a synchronous failover to the standby instance, typically completing in 60-120 seconds. This is the fastest method to manually initiate a failover while preserving existing data, as the standby is already in sync and becomes the new primary.

The `awslogs` log driver, configured under the `logConfiguration` element in the ECS task definition, makes Docker send the container's `stdout` and `stderr` directly to a specified CloudWatch Logs group and stream. The ECS agent automatically creates log streams, and you can set `awslogs-group`, `awslogs-region`, and `awslogs-stream-prefix`; the task execution role must have `logs:CreateLogStream` and `logs:PutLogEvents` permissions. This approach requires no changes to the application image, works on both Fargate and EC2 launch types, and provides near-real-time access to logs through the CloudWatch console, CLI, or APIs. It is the native, recommended method for centralizing ECS container logs.

The max_connections parameter in the RDS parameter group defines the hard ceiling of allowed simultaneous client connections; if this limit is being hit, legitimate application requests are rejected with 'too many connections'. Reviewing this value against your connection pool settings and raising it if it's legitimately too low can provide immediate relief, but doing so without understanding why the number of connections jumped can exhaust memory or threads because each connection consumes resources. Also, changing the parameter group may require a reboot depending on whether it's a static or dynamic parameter, so monitor after applying.

The health check associated with the primary ALB endpoint continued to receive a valid HTTP 200 response, so Route 53 considered the resource healthy and did not trigger failover to the secondary region. Even though an AZ was experiencing an outage, the ALB is a regional service that can remain available if it is deployed in other AZs, or the outage may have been in a different part of the region. Since the health check threshold was never breached, Route 53 had no reason to update DNS records.

A graceful reboot via the AWS Management Console or CLI sends an ACPI reboot signal to the guest OS, which restarts the operating system and all application processes while preserving the instance ID, private IP, EBS volumes, and attached Elastic IP. This is the fastest and least disruptive recovery action for transient conditions like memory leaks or a stuck process, and it typically resolves the issue within minutes without requiring reconfiguration.

AWS CloudTrail is the correct service because it records all KMS API requests as events, including both management-plane actions like CreateKey and EnableKeyRotation and data-plane operations like Encrypt, Decrypt, and GenerateDataKey. Each event includes details such as the caller identity, source IP address, key ID, and timestamp, which allows you to audit key usage and detect unauthorized access after the fact.

For a CloudWatch alarm to transition from ALARM to OK, it must evaluate a specified number of consecutive periods where the metric is below the threshold (e.g., 3 of 3 datapoints below 90%). After the CPU spike dropped back down, the alarm has only recently started seeing low datapoints; until enough consecutive okay datapoints are evaluated, the alarm state remains ALARM. This is CloudWatch's default state-transition behavior to avoid flapping, not a misconfiguration.

Adding a test stage immediately after the build stage with a script using the AWS CLI or SDK to call ecr:DescribeImages for the specific repository and image tag validates that the expected artifact exists before deployment. This automated gate runs in every pipeline execution, catches missing or mis-tagged images at the earliest practical point, and fails the pipeline with a clear error rather than letting the deploy stage fail late. It is the correct, lightweight fix that does not alter build behavior.

Lambda concurrency is the number of in-flight invocations across all resources. When a function's execution time is long, each invocation holds a concurrency slot for the entire duration, so the configured reserved concurrency of 100 can be reached with relatively few requests. Once all slots are occupied, Lambda throttles additional invocations with a 429 error, and the SQS event source mapping receives a failure, causing messages to remain in the queue. This is the classic cause of throttling with long-running workers, not the other options.

An SCP attached to the affected account or its OU in AWS Organizations acts as a guardrail across every principal in the account, including the account root user and all IAM users and roles. By explicitly denying * , the SCP reduces each principal's effective permissions to an empty set, and because SCPs can only be changed by an administrator in the management account, neither the compromised root user nor any IAM user can detach or bypass the lockdown. This provides full account quarantine, which is exactly what the scenario requires.

Terminating the instance is the correct action because it triggers the Auto Scaling group to detect the lost capacity through its health checks and immediately launch a fresh instance from the launch template, restoring the desired instance count automatically. This approach ensures the replacement is clean, conforms to the group's configuration, and avoids the downtime and statefulness of manual repair, making it the most efficient and reliable recovery mechanism.