https://repost.aws/knowledge-center/cloudformation-update-rollback-failed If your stack is stuck in the UPDATE_ROLLBACK_FAILED state after a failed update, then the only actions that you can perform on the stack are the ContinueUpdateRollback or DeleteStack operations.

https://aws.amazon.com/blogs/mt/how-to-centrally-manage-aws-iot-greengrass-devices-using-aws-systems-manager/?force_isolation=true

AWS CodeDeploy supports deployment of both Lambda functions and ECS services with native integration.

It provides deployment strategies such as canary deployments for Lambda and blue/green deployments for ECS, which minimize downtime and risk.

CodeDeploy automates the deployment process, which reduces manual effort and improves consistency.

AWS Systems Manager Parameter Store is a simple, managed solution for storing configuration data securely and at scale.

Option A uses CloudFormation stack updates with resource replacement, which can cause downtime and is less flexible for minimizing downtime compared to CodeDeploy’s deployment strategies.

Option C adds unnecessary orchestration complexity with Step Functions and cross-region deployments, increasing deployment effort.

Option D’s all-at-once deployments for Lambda and rolling updates for ECS do not minimize downtime as effectively as canary and blue/green strategies. Hence, option B meets the requirement with the least deployment effort and maximizes automation and availability.

Reference from AWS Official Documentation:

Deploying Lambda Functions with CodeDeploy: " AWS CodeDeploy supports canary and linear deployment strategies for AWS Lambda functions to reduce deployment risk. " (CodeDeploy Lambda Deployment)

Deploying ECS Services with CodeDeploy Blue/Green: " CodeDeploy supports blue/green deployments for ECS to minimize downtime during service updates. " (CodeDeploy ECS Blue/Green)

AWS Systems Manager Parameter Store: " Parameter Store provides secure, hierarchical storage for configuration data management. " (Systems Manager Parameter Store)

When you create a pipeline from CodePipeline during the step-by-step it creates a CloudWatch Event rule for a given branch and repo

like this:

{

" source " : [

" aws.codecommit "

],

" detail-type " : [

" CodeCommit Repository State Change "

],

" resources " : [

" arn:aws:codecommit:us-east-1:xxxxx:repo-name "

],

" detail " : {

" event " : [

" referenceCreated " ,

" referenceUpdated "

],

" referenceType " : [

" branch "

],

" referenceName " : [

" master "

]

}

}

https://docs.aws.amazon.com/codepipeline/latest/userguide/pipelines-trigger-source-repo-changes-console.html

A (S3 RTC) is required to meet the “replicated within 15 minutes” requirement in a verifiable way. Replication Time Control is the S3 feature that provides a 15-minute replication time SLA for replicated objects (instead of “best effort” replication timing).

B (S3 Multi-Region Access Point, active-passive) provides the most operationally efficient failover approach. An MRAP gives you a single global access point for S3 across Regions and supports controlled routing to the chosen bucket, avoiding custom DNS logic per application/client.

C (SubmitMultiRegionAccessPointRoutes) is the mechanism to perform failover for an MRAP by changing which Regional bucket is routed for the Multi-Region Access Point. This gives an explicit, API-driven “fail over now” action aligned with active-passive routing.

Why the others aren’t part of the “most operationally efficient” three:

D (Transfer Acceleration) optimizes upload/download performance over long distances , but it does not guarantee cross-Region replication within 15 minutes and doesn’t provide failover control.

E and F (Route 53 ARC) : ARC is great for controlling failover for endpoints behind routing controls, but for S3 bucket access the more direct and operationally simple approach is S3 Multi-Region Access Points with route updates via the S3 API. Using ARC here adds extra components/process compared to MRAP-native routing control.

To meet the requirements of migrating its on-premises Windows and Linux applications to AWS and creating a pilot light DR environment in another AWS Region, the company should use Amazon FSx for NetApp ONTAP for the application storage. Amazon FSx for NetApp ONTAP is a fully managed service that provides highly reliable, scalable, high-performing, and feature-rich file storage built on NetApp’s popular ONTAP file system. FSx for ONTAP supports multiple protocols, including SMB for Windows and NFS for Linux, so the company can access the shared storage from both types of applications. FSx for ONTAP also supports NetApp SnapMirror replication, which enables the company to replicate the storage to the DR Region. NetApp SnapMirror replication is efficient, secure, and incremental, and it preserves the data deduplication and compression benefits of FSx for ONTAP. The company can use automation to launch and configure the EC2 instances in the DR Region and then use NetApp SnapMirror to restore the data from the primary Region.

The other options are not correct because they do not meet the requirements or follow best practices. Using Amazon S3 for the application storage is not a good option because S3 is an object storage service that does not support SMB or NFS protocols natively. The company would need to use additional services or software to mount S3 buckets as file systems, which would add complexity and cost. Using Amazon EBS for the application storage is also not a good option because EBS is a block storage service that does not support SMB or NFS protocols natively. The company would need to set up and manage file servers on EC2 instances to provide shared access to the EBS volumes, which would add overhead and maintenance. Using a Volume Gateway in AWS Storage Gateway for the application storage is not a valid option because Volume Gateway does not support SMB protocol. Volume Gateway only supports iSCSI protocol, which means that only Linux applications can access the shared storage.

1: What is Amazon FSx for NetApp ONTAP? - FSx for ONTAP

2: Amazon FSx for NetApp ONTAP

3: Amazon FSx for NetApp ONTAP | NetApp

4: AWS Announces General Availability of Amazon FSx for NetApp ONTAP

Replicating Data with NetApp SnapMirror - FSx for ONTAP

What Is Amazon S3? - Amazon Simple Storage Service

What Is Amazon Elastic Block Store (Amazon EBS)? - Amazon Elastic Compute Cloud

What Is AWS Storage Gateway? - AWS Storage Gateway

AWS X-Ray provides distributed tracing for microservice-based applications. Deploying the X-Ray daemon as a DaemonSet in the EKS cluster and instrumenting the application with the X-Ray SDK enables end-to-end tracing across microservices, helping identify performance bottlenecks. This method is documented in “Using AWS X-Ray with Amazon EKS” (AWS Observability Guide).

To restrict direct access to API Gateway, add a custom header in the CloudFront distribution origin request and use a Lambda authorizer in API Gateway to validate that header. Only requests routed through CloudFront will include this header. This is the AWS-recommended pattern in “Secure your APIs behind CloudFront using custom headers and Lambda authorizers.”

https://aws.amazon.com/blogs/mt/how-to-set-up-aws-opsworks-stacks-auto-healing-notifications-in-amazon-cloudwatch-events/

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html