CCNA Resilient Cloud Questions

This approach leverages the SQS visibility timeout as a built-in retry buffer: setting it to 6 hours prevents messages from being redelivered to consumers while the downstream service is unhealthy, effectively holding them in the queue. Combined with a high maxReceiveCount (e.g., 100) in the redrive policy, messages are not prematurely moved to the DLQ, allowing the Lambda consumer to keep retrying for hours until the service recovers. This ensures no data loss and avoids manual intervention, making it the correct pattern for intermittent downstream outages.

Defining the service to spread tasks across multiple Availability Zones ensures that the microservice remains available even if a single AZ fails. In Amazon ECS, you can use a placement strategy with 'spread' across 'attribute:ecs.availability-zone' for EC2, or for Fargate you can use the `AvailabilityZoneSpread` placement strategy (or specify AZs in the service definition) to distribute tasks evenly across AZs. This directly mitigates the risk of an AZ outage by maintaining running tasks in other zones.

MFA Delete requires an authenticated AWS user to provide both a valid AWS credential and a one-time code from an MFA device before permanently deleting an object version or toggling the versioning state. This effectively blocks accidental or malicious permanent deletion because an attacker who compromises credentials would still need physical access to the MFA token. It is a strong, targeted defense for critical S3 data, especially when combined with versioning.

Aurora Auto Scaling automatically adjusts the number of Aurora Replicas based on metrics like CPU utilization. Placing replicas in multiple Availability Zones ensures that if one AZ fails, replicas in other AZs continue to serve read traffic. This solution provides automatic scaling and AZ resilience with minimal manual intervention, meeting both requirements.

A CloudWatch alarm on CPUUtilization monitors the metric in near real-time and, when breached, triggers an Auto Scaling policy that terminates the affected instance, after which the Auto Scaling group automatically launches a fresh replacement. This directly addresses the intermittent high latency by reacting to the actual symptom (high CPU) as it occurs, rather than relying on predetermined schedules, and the managed replacement ensures capacity is maintained without manual intervention.

A cross-Region read replica uses asynchronous replication to continuously copy changes from the source DB instance to a replica in the secondary Region, keeping data loss typically within 5 minutes. In a disaster, you can promote this replica to a standalone primary instance, which is a fast, reversible operation that meets the 1-hour RTO. This is the only option that both maintains an up-to-date copy in another Region and provides a ready-to-activate target for write traffic.

Running ECS tasks in multiple Availability Zones ensures that an AZ failure does not cause total loss of capacity. The ALB performs health checks and routes traffic only to healthy targets, so if tasks in one AZ become unhealthy, traffic automatically shifts to tasks in the other AZ. Additionally, ECS service scheduler maintains desired task count across AZs, and with service auto scaling you can scale based on request count or CPU. This architecture provides both resiliency and elasticity.

Configuring three Availability Zones with a desired capacity of three places one instance in each AZ, so if any single AZ fails, the remaining two instances continue serving traffic, preserving 66% of capacity. The Auto Scaling group will automatically detect the unhealthy instances and launch replacements in other healthy AZs, gradually restoring capacity to the desired level. Because the application is stateless, a load balancer can distribute traffic across the surviving instances, providing high availability with minimal disruption.

Route 53 failover routing enables traffic redirection.

ALB invokes Lambda functions via a target group that references a specific function version or alias. When you publish a new version and update the target group, ALB's connection draining process allows existing in-flight connections to complete on the old version before deregistering it. As a result, the old Lambda version can continue serving requests for a short period, causing a temporary gradual rollout until draining finishes.

Circuit breakers are a client-side resilience pattern that monitor outgoing requests to a dependency and, after exceeding a failure threshold, automatically fail fast without attempting the network call. In an ECS microservices environment with service discovery, this stops unhealthy services from being flooded with retries, preventing latency spikes and thread exhaustion in healthy services. By quarantining the failing service from call traffic, circuit breakers effectively stop cascading failures and allow the unhealthy service time to recover.

CloudWatch Events (now EventBridge) can capture Simple Notification Service messages or CloudWatch alarm state changes triggered by a Route 53 health check or EC2 status check, and then invoke an AWS Lambda function. That function can programmatically call ec2-associate-address to detach the Elastic IP from the failed instance and attach it to a healthy one, fully automating active/passive failover. This approach is the standard serverless pattern for EIP failover because it reacts to health signals and directly manages the association.

An ALB's health check marks an instance unhealthy when it repeatedly fails the configured protocol and path check, and the ALB then stops sending traffic to that instance. When the Auto Scaling group is configured to use ELB health checks, the 'ReplaceUnhealthy' process automatically terminates the unhealthy instance and launches a new one to maintain desired capacity. Thus, the health check is the trigger that enables the self-healing replacement of failed instances, ensuring application availability.

Deploying the Elastic Beanstalk environment as a load-balanced, auto-scaling configuration with a minimum of two instances in separate Availability Zones eliminates the web tier as a single point of failure. The load balancer distributes traffic across instances and health-checks them, while Auto Scaling replaces unhealthy instances and can scale out during load spikes. This is the foundational action for high availability of stateless applications because it provides both redundancy and elasticity.

This combination directly addresses a demand spike: API Gateway throttling imposes a maximum request rate per client or across the API, preventing a flood from reaching Lambda. Reserved concurrency allocates a guaranteed number of Lambda executions, insulating the function from account-level throttling and ensuring the spikes are absorbed within the reserved ceiling. DynamoDB auto scaling adjusts provisioned read/write capacity based on live utilization, so the database keeps pace without manual intervention.

Scheduled scaling pre-provisions instances at fixed times, aligning capacity with known upcoming demand, while a step scaling policy reacts to actual CPU utilization through CloudWatch alarms with defined adjustment steps (e.g., add 2 instances when CPU exceeds 80%, add 1 when it exceeds 70%). This combination ensures both proactive readiness for predictable traffic spikes and rapid reactive response to any deviation, giving the highest resilience for mixed traffic patterns.

Amazon CloudFront with an S3 bucket as origin is the intended AWS solution for low-latency global delivery of static content. CloudFront caches objects at hundreds of edge locations, so users receive data from the nearest edge POP rather than the origin, drastically reducing latency. The S3 bucket provides durable, cost-effective storage, and CloudFront minimizes origin requests via cache hits, reducing cost. This combination also improves resilience by absorbing traffic spikes at the edge and supports features like SSL, geo-restriction, and signed URLs.

An explicit Deny in the IAM policy overrides any Allow, and it is conditioned on the absence of SSE-KMS encryption headers. Because the request specifies no server-side encryption, the Deny matches and the upload is rejected.

The bucket policy uses a condition key such as s3:x-amz-acl with a value of bucket-owner-full-control, making that header a mandatory requirement for any successful s3:PutObject call. When the requester omits the x-amz-acl header, the condition evaluates to false, so the allow statement cannot grant the action. With no other applicable allow, the request is implicitly denied and the upload fails. This design ensures the bucket owner can later manage or delete the object by forcing ownership transfer via the canned ACL.

Replicating application data in real time to an Amazon EBS volume gives you a persistent, network-attached copy that survives the EC2 instance's lifecycle. EBS volumes are independently replicated within an Availability Zone, so they remain available if the instance is stopped or terminated. Taking periodic EBS snapshots copies the volume to Amazon S3, providing point-in-time recovery points that can be restored in the same or a different Availability Zone, which protects against both instance failure and EBS volume loss.

RDS Proxy sits between your application and the database, exposing a fixed writer endpoint that masks the underlying instance DNS changes. When a Multi-AZ failover occurs, RDS Proxy automatically redirects existing connections to the new primary, which eliminates the delay caused by clients waiting for DNS TTL to expire. It also pools and reuses database connections, reducing connection-related errors during failover and lowering CPU/memory pressure on the database. This is exactly why it reduces DNS dependency and delivers failover times typically under one second.

RDS Multi-AZ maintains a synchronous standby in a different Availability Zone, so when the primary in us-east-1a fails, the standby in us-east-1b is promoted automatically and the DB instance's CNAME endpoint is repointed to it. This satisfies the stem's automatic failover requirement without manual intervention.

Spreading instances across two or more Availability Zones ensures the application survives an AZ outage, since the Application Load Balancer routes to healthy targets in remaining zones. This directly satisfies the resilience requirement for the stateless workload.

S3 Standard is the default storage class and is engineered to deliver 99.999999999% object durability and 99.99% availability by synchronously storing each object across a minimum of three Availability Zones (AZs) within the same AWS Region. When an AZ becomes unavailable, S3 automatically serves requests from the remaining copies, so the bucket stays accessible without manual intervention. Because the data exists in at least three independent AZs, a single AZ failure does not cause data loss or downtime, making it the appropriate choice for resilience against an AZ disruption.

RDS Multi-AZ only synchronously replicates to a standby in the same Region, so it cannot protect against a regional outage. Amazon Aurora Global Database replicates data to up to five secondary Regions using storage-level replication, typically with an RPO of 1 second or less, while still providing a familiar MySQL/PostgreSQL-compatible endpoint. Promoting a secondary Region during failover is a fast, deliberate action that preserves the database's durability and availability in a disaster recovery scenario.

Amazon Route 53 health checks monitor the primary endpoint (e.g., an Application Load Balancer or an IP address) and automatically detect when it becomes unhealthy. With failover routing, Route 53 stops returning the primary resource's DNS answer and instead returns the DR region's endpoint, effectively steering user traffic within minutes. This directly supports the RTO by eliminating the need for manual DNS changes, and it works with any application architecture as long as the endpoint can be health-checked. However, Route 53 only handles traffic redirection—it does not replicate data or pre-warm compute, so it must be paired with a data replication strategy to also meet the RPO.

The warm standby pattern keeps a fully functional, scaled-down copy of the application running in the DR region, so the entire stack is ready for production traffic almost immediately after failover. RDS data is continuously replicated to the DR region (via cross-region read replicas or Aurora global replication), keeping the RPO near zero—well within the 15-minute target. Because compute, storage, and networking are already provisioned, RTO is also met by simply scaling up and shifting traffic rather than building infrastructure from scratch.

A spread placement strategy with the field attribute:ecs.availability-zone explicitly distributes tasks evenly across the Availability Zones used by the cluster or service. For Fargate, this strategy works in conjunction with your VPC subnets, ensuring tasks are placed in each configured AZ before any are duplicated. This directly satisfies the requirement that a single AZ failure does not take down all instances of the microservice.

Deploying the application in a second AWS Region and using Route 53 failover routing gives you active-passive or active-active DNS-level failover: Route 53 health checks continuously monitor the primary endpoint, and when it is unhealthy, DNS queries are answered with the secondary Region's IP addresses. This directly addresses an entire Region becoming unavailable, as long as the secondary Region has the resources and the data needed to serve traffic. For a critical application, combine this with RDS Cross-Region Read Replicas or Aurora Global Database for proper data durability.

This configuration provides global DNS-level failover by associating Route 53 health checks with endpoints in each region. If the primary region's health check fails, Route 53 automatically rewrites DNS responses to direct traffic to the standby region, with failover typically occurring within a few minutes depending on TTL and health-check intervals. However, this requires the application to be designed for multi-region operation, with data replication between regions and compute capacity pre-provisioned in the secondary region to actually serve traffic. This is the core pattern for regional disaster recovery and meets the requirement for a highly available architecture across regions.

Placing the backend ECS service in a private subnet with no route to an internet gateway ensures it has no public IP and cannot be reached from the internet. This is correct for internal-only workloads because the backend does not need outbound internet access, and any required image pulls can be handled via VPC endpoints or pre-pulled images. This isolation reduces the attack surface and aligns with the principle of least privilege.

An Auto Scaling group spanning multiple Availability Zones and using Elastic Load Balancing health checks meets the resilience requirement: the ELB sends HTTP/HTTPS health checks to each instance, and when an instance is marked unhealthy, the ASG terminates it and launches a new one to maintain desired capacity. Multi-AZ distribution ensures that even if one AZ fails, the remaining instances continue serving traffic, and the ASG can launch replacements in other AZs. This combination provides both automated fault replacement and cross-AZ high availability.

A timeout typically indicates a network connectivity issue between ALB and instance.

The aws:SourceIp condition key in a bucket policy compares the source IP address of the requester as seen by S3, which is the public IP address after any network address translation (NAT) or internet gateway processing. In a VPC, instances typically use private RFC 1918 IP addresses, which are not exposed to S3 when traffic traverses a NAT gateway or the internet. Thus, a policy specifying private IP ranges will never match, causing access to be denied for legitimate VPC clients.

A warm standby architecture places a fully functional but possibly smaller ECS service behind an ALB in us-west-2, and Route 53 health checks automatically shift user traffic when us-east-1's ALB or service is unhealthy. ElastiCache Global Datastore for Redis maintains a cross-region replica with sub-second replication lag, so the secondary can serve reads and writes after promote without a point-in-time restore. This combination keeps both RPO and RTO under 30 minutes because failover is automated and data is already in the secondary region.

An origin group with health checks lets CloudFront monitor the primary origin using HTTP or HTTPS requests; when the origin returns errors or times out, CloudFront automatically fails over to a designated secondary origin. This gives near-instant recovery without manual intervention, directly addressing the overwhelmed origin scenario described in the question. Health checks are essential for the failover mechanism to know when to stop sending traffic to the failing origin.

Installing the CloudWatch Logs agent (or the newer unified CloudWatch agent) on each EC2 instance enables real-time delivery of log data to the CloudWatch Logs service, which stores it durably and independently of the instance lifecycle. Because logs are streamed continuously as they are generated, they survive instance termination, crashes, or scale-in events without requiring manual offload steps. This is the AWS-recommended managed solution for centralized log collection and retention.

Enabling cluster mode on ElastiCache for Redis partitions the keyspace across multiple shards, with each shard having its own primary node to handle writes independently. Adding shards increases aggregate write throughput and lets you scale beyond the limits of a single node, while also supporting larger datasets by distributing memory. This is the correct answer because it directly addresses a write-heavy workload by horizontally scaling the data plane and maintains Redis' low-latency session state access.

CloudFront Origin Failover is the native, minimal-configuration solution: you create an origin group containing two S3 buckets as the primary and secondary origins, and attach that group to your cache behavior. When the primary origin returns a configurable HTTP error code (commonly 5xx) or a connection timeout, CloudFront automatically retries the request against the secondary bucket in us-west-2, all within the same edge location and without involving DNS or custom code. This requires no additional compute, no Route 53 policies, and no application modifications—only enabling Cross-Region Replication between the two buckets so content stays consistent. It is the only option that leverages a built-in CloudFront feature designed specifically for this use case, meeting both the fault-tolerance and low-operational-overhead requirements.

ElastiCache for Redis externalises session state from individual instance memory, so any instance behind the Application Load Balancer can serve any request. This removes the constraint that deployments destroy in-memory sessions, preventing timeouts and errors as instances are replaced.

DynamoDB global tables asynchronously replicate writes to multiple Regions, providing active-active tables with automatic conflict resolution. Deploying Lambda in each Region makes stateless compute locally available, while Route 53 multi-Region routing (for example, failover or latency routing) sends traffic to a healthy Region. Together, these components form a resilient multi-Region serverless architecture with no single Region dependency.

Configuring a dead-letter queue on the SQS queue ensures that any messages that are not successfully processed by the Lambda function are redirected to the DLQ for later analysis and reprocessing. This directly addresses the need to preserve failed events.

An ElastiCache cluster without Multi-AZ deployment means there is only a single primary node with no replica in another Availability Zone. If that node fails, any in-memory session data is lost because there is no replication or automatic failover to a secondary node. Even if ElastiCache replaces the node, the replacement starts empty unless persistence/backups were configured. This exactly matches the symptom of all users being logged out simultaneously.

An Application Auto Scaling target tracking policy with memory utilization as the metric dynamically scales out tasks when memory pressure increases and scales in when it subsides, providing immediate response to unpredictable workload spikes. Amazon ECS service auto-recovery, enabled through service health checks and automatic task replacement, ensures that any tasks that fail or become unhealthy are automatically restarted, maintaining desired availability. Together, these mechanisms deliver both elasticity—scaling with real-time demand—and resilience—self-healing from task or infrastructure failures—for the stateless web application.

Configure the ECS service with a spread placement strategy across Availability Zones (AZs) using either the ability to spread evenly or by AZ as a custom attribute. This guarantees that tasks are distributed redundantly, so if one AZ becomes unavailable, the remaining tasks in other AZs continue to serve traffic and provide capacity for service scaling to replace unhealthy tasks. Without this spread, Amazon ECS could place all tasks in a single AZ, creating a single point of failure that contradicts the goal of high availability.

Cross-Region replication maintains a continuously updated standby database in the DR Region, so the RPO is reduced to the replication lag, which is typically seconds for RDS MySQL/PostgreSQL. The pre-provisioned Auto Scaling group and Application Load Balancer constitute a warm standby that can receive traffic immediately after Route 53 health checks detect a regional impairment and automatically update DNS records to point to the DR endpoint. This combination of async data replication and warm infrastructure is what enables a low RPO and an RTO well under the 30-minute requirement.

The ECS service scheduler continuously monitors running tasks and compares the current count against the desired count. When a task fails due to container exit, OOM, or health check failure, the service automatically starts a replacement task using the same task definition. This is a built-in control loop that requires no custom scripts or external triggers, and it works identically for Fargate and EC2 launch types.

Distributing traffic across multiple Availability Zones directly satisfies the resiliency and load-spreading requirement. The ALB already operates at the regional level, so enabling cross-AZ distribution removes the single-AZ failure domain, ensuring instances in surviving zones continue serving requests when one zone becomes unavailable.

Spreading instances across two Availability Zones with an Auto Scaling group lets it replace capacity in the surviving AZ, while the multi-AZ ALB routes only to healthy targets. This satisfies the AZ-failure constraint by removing the single-AZ dependency and enabling automatic recovery.

Cross-region replication for data stores, such as Amazon S3 CRR, DynamoDB global tables, or Aurora Global Database, synchronizes data between regions automatically, typically with sub-minute RPO. This ensures that when a regional failure occurs, the application can fail over to the DR region with minimal data loss, making it a strong foundation for a multi-region DR strategy. Because replication is continuous rather than point-in-time, it provides a much lower RPO than backup and restore, and it often pairs with per-region compute stacks to achieve low RTO.

Placing EC2 instances in multiple Availability Zones (AZs) and fronting them with an Elastic Load Balancer and an Auto Scaling group ensures that if an entire AZ becomes unavailable, the load balancer can route traffic only to healthy instances in the remaining AZs. This pattern provides fault tolerance at the AZ granularity, which is the foundation of a resilient web architecture. It also allows the application to absorb a single-AZ failure without requiring any manual intervention.

Transient external API failures resolve within seconds, so retrying with exponential backoff lets the application recover without overwhelming the dependency. This directly addresses the intermittent, short-lived errors described, unlike circuit breakers or timeouts that would abort calls rather than succeed on retry.

Increasing the Lambda function timeout to 30 seconds gives the SQS-triggered processor enough wall-clock time to complete network calls, database writes, or third-party integrations that were failing under a shorter timeout, while still remaining within a reasonable operational bound. Configuring a dead-letter queue (DLQ) on the SQS queue ensures that messages that still repeatedly fail after retries are moved to a separate queue for later inspection and redrive, preventing poison messages from consuming the main queue indefinitely. Together, these changes address the immediate failure mode and give you a durable, observable mechanism for handling the few messages that cannot be processed successfully.

Using a mixed instances policy with multiple instance types across different Availability Zones is the recommended way to reduce Spot interruption risk in EMR. This approach makes the cluster's Spot capacity pool more diverse, so a capacity reclamation event in one pool is unlikely to affect all nodes simultaneously. EMR's instance fleets can automatically provision from the specified pools, improving both initial capacity acquisition and fault tolerance during interruptions.

Cross-zone load balancing on the ALB enables each load balancer node to distribute incoming traffic evenly across all healthy targets in all enabled AZs, rather than limiting each node to its own AZ. With this enabled, if an AZ becomes unhealthy or unreachable, the remaining healthy ALB nodes can seamlessly route traffic to healthy targets in other AZs, ensuring continuous availability. This directly addresses the root cause of an ALB failing to route to instances in other AZs during an outage.

Deploying EC2 instances across multiple Availability Zones with an Auto Scaling group is the standard pattern for high availability. If one AZ becomes unavailable, the load balancer routes traffic to instances in the remaining healthy AZs, and the Auto Scaling group maintains instance count across AZs to replace any that are terminated. This eliminates the single-AZ point of failure and ensures application availability during an AZ outage.

Running the application in multiple AWS Regions using an active-active or active-passive pattern is the foundational disaster recovery strategy for a regional outage. Active-active routes live traffic across Regions for automatic failover, while active-passive keeps a warm standby in another Region that can be promoted via Route 53 health checks and failover policies. This approach directly addresses the failure domain of an entire Region.

Amazon RDS Proxy sits between the application and the database, maintaining a warm connection pool that absorbs the spike in connection requests when EC2 instances reconnect during a failover. Because the proxy keeps connections to the RDS instance open and multiplexes client sessions, the primary no longer gets overwhelmed by thousands of short-lived connections. Adding read replicas moves read-heavy queries off the primary, reducing CPU/IO contention that can cause slow queries and cascading failovers. This directly addresses the root cause of connection exhaustion while preserving write consistency on the primary.

The correct fix is to enable the ECS deployment circuit breaker with rollback. This feature monitors the deployment for indicators such as repeated task launch failures, container exits, and health check failures; when it detects that the deployment is failing beyond a configured threshold, it stops the deployment and automatically restores the service to the most recent successful task set definition. This preserves service availability by keeping the existing stable tasks running and eliminates the need for you to manually roll back a bad task definition. Without the circuit breaker, a deployment with continuously crashing tasks will eventually time out and leave the service in a FAILED state with no automatic recovery.

ALB implements graceful connection draining through the target group's deregistration delay. Increasing this delay allows in-flight sticky-session requests to complete before the instance is terminated.

The Lambda execution role must explicitly allow ec2:DescribeSubnets and ec2:DescribeSecurityGroups so that the Lambda service can inspect your VPC and locate the subnets and security groups you specified. These read-only actions are prerequisites for Lambda to create an elastic network interface (ENI); without them, the invocation fails during the VPC provisioning step, even if the role allows creating ENIs. This is why the error specifically mentions missing subnet or security group describe permissions.

Creating an origin access identity (OAI) in CloudFront and updating the bucket policy to permit only that OAI to read objects is the correct approach. The OAI is a special CloudFront user that validates requests to the S3 origin with AWS Signature Version 4, and the bucket policy grants s3:GetObject permission exclusively to this principal. This blocks any request that does not come through the CloudFront distribution, while still allowing the static content to be publicly served to end users via CloudFront.

An EKS managed node group is backed by an Auto Scaling group whose health checks include both Amazon EC2 status checks and Kubernetes node status (including the node-lost and NodeReady conditions). When a node fails or becomes unhealthy, the Auto Scaling group replaces the underlying instance, while Kubernetes' node controller marks the node as NotReady and evicts pods, leading them to be rescheduled onto healthy nodes. This combination of automatic instance replacement and control-plane-driven pod rescheduling directly addresses the failure of a node and is the expected solution for maintaining availability.

Migrating to cluster mode enabled with multiple shards horizontally partitions the Redis keyspace across nodes, which directly lowers per-shard CPU utilization and enables linear scaling as traffic grows. Enabling Multi-AZ with automatic failover and placing read replicas in different AZs provides high availability and lets reads be served by replicas, reducing primary node load and cutting failover time from minutes to seconds—this tackles both the immediate CPU bottleneck and the resilience requirement for a production e-commerce platform.

Amazon RDS Proxy presents a single endpoint to the application while pooling and reusing database connections on the backend, dramatically cutting the CPU and memory load caused by connection handling. It is fully managed and transparent, and during Multi-AZ failovers it can keep connections warm for faster recovery. For a high-traffic web fleet, this directly mitigates CPU exhaustion due to connection volume, making it the most efficient and cost-effective option.

Replacing the NLB with an ALB and enabling sticky sessions via the ALB's load balancer-generated cookie is the correct minimal-change solution. The ALB inserts a stickiness cookie on the first response, and all subsequent requests from that client are routed to the same EC2 instance, preserving the locally stored session state without any application modifications. This leverages the ALB's Layer 7 capabilities to achieve session affinity while keeping the existing web application code unchanged.

DynamoDB Accelerator (DAX) is an in-memory cache that sits in front of a DynamoDB table, serving read-heavy workloads with microsecond latency while absorbing a large fraction of read requests. By caching frequently accessed items (including strongly consistent reads when DAX is enabled), DAX reduces the number of read requests that actually reach DynamoDB, thereby reducing the table's consumed read capacity and preventing read throttling. It is a native, fully managed solution specifically designed for this scenario, preserving the DynamoDB API and requiring no application rewrite beyond adding a DAX client endpoint.

Aurora Global Database replicates data from the primary Region to a secondary cluster using a dedicated storage-based replication channel with typical latency under one second, ensuring an RPO of under one minute. Failover can be initiated either manually or automatically, and a promoted secondary cluster becomes available in minutes without the need to restore from a backup or apply transaction logs. This is the only option that inherently satisfies both the 1-minute RPO and a recovery time objective measured in minutes.

Amazon DynamoDB is a fully managed NoSQL key-value database that delivers single-digit millisecond read/write performance at any scale, making it an excellent external session store. Its fine-grained access control, encryption, backup, and TTL support for automatic item expiration align well with session lifecycle needs. Because DynamoDB is serverless and horizontally scalable, EC2 instances can share session state without statefulness, enabling the application tier to scale freely behind a load balancer.

S3 event notifications triggering Step Functions decouple processing from the API request, letting large files be handled asynchronously with retries and state tracking. This removes the Lambda timeout constraint imposed by synchronous invocation behind API Gateway.

Blue/green deployment in AWS CodeDeploy is the only deployment type that provisions a new, separate environment (green) alongside the existing one (blue), then shifts production traffic to the green environment. This architecture enables instant rollback by simply switching traffic back to the blue environment if the deployment fails or exhibits issues, with no need to reinstall or reconfigure instances. CodeDeploy manages this through lifecycle hooks like AllowTraffic and redirecting traffic via the load balancer, providing the fastest and most reliable rollback path.

Circuit breakers in service clients detect repeated downstream failures and trip open, failing fast instead of holding threads until timeout. This halts the cascade at the caller, satisfying the resilience requirement by preventing upstream exhaustion when a downstream service partially fails.

Deploying RDS in a Multi-AZ configuration creates a synchronous standby replica in a different Availability Zone, and Amazon RDS automatically fails over to the standby if the primary instance becomes unhealthy or the AZ fails. The DNS name stays the same, so the ECS order service can reconnect without code changes, and the standby is continuously updated with synchronous replication to prevent data loss. This directly addresses the database as a single point of failure, which is necessary because the order service depends on durable transactions to record orders.

Distributing EC2 instances across multiple Availability Zones ensures the application can tolerate a complete failure of one physical data center, because the remaining instances continue to serve traffic. Each AZ has independent power, cooling, and network connectivity, so an outage in one AZ does not affect the others. This redundancy is the fundamental building block of high availability on AWS and is a necessary condition for achieving a higher service-level agreement.