Troubleshoot deployment and pipeline failures using AWS CloudFormation stack rollback, AWS CodeDeploy automatic rollback, deployment alarms and pipeline failure states.

A payments service is released through an AWS CodeDeploy blue/green deployment on Amazon ECS. The team wants traffic shifted to the green task set gradually, and they want CodeDeploy to abort the shift and send all traffic back to the original blue task set the moment a CloudWatch alarm on the 5xx response rate fires during the canary window. They consider this rollback non-negotiable for any future deployment. Which configuration MOST directly enforces alarm-driven rollback during the traffic shift?

• AUse an AllAtOnce traffic-shifting configuration and add a BeforeAllowTraffic hook that validates the green task set, so the release is checked before any production traffic ever reaches the new tasks.
• BChoose a canary traffic-shifting configuration, associate the 5xx CloudWatch alarm with the deployment group, and enable automatic rollback when a deployment alarm is triggered so traffic returns to blue.check_circle Correct
• CChoose a canary traffic-shifting configuration and enable automatic rollback when the deployment fails, relying on the ECS deployment circuit breaker to detect the elevated 5xx rate and fail the deployment.
• DChoose a linear traffic-shifting configuration and configure an Amazon EventBridge rule on the alarm that invokes a Lambda function to call StopDeployment, so the function halts the shift when 5xx rates rise.

Why A is wrong: AllAtOnce shifts every request at once and a BeforeAllowTraffic hook runs before live traffic, so neither watches the production 5xx rate during a gradual shift nor triggers the rollback the requirement demands.

Why B is correct: A canary shift exposes a slice of traffic first, and an associated CloudWatch alarm with automatic rollback enabled aborts the shift and routes all traffic back to the blue task set the moment the 5xx alarm fires.

Why C is wrong: Rollback on deployment failure reacts to the deployment status rather than the 5xx alarm, and the ECS circuit breaker is a separate mechanism, so this does not bind the rollback to the specified CloudWatch alarm.

Why D is wrong: A Lambda calling StopDeployment only halts the shift rather than routing traffic back to blue, and it adds custom code where the native deployment alarm with automatic rollback already performs the reroute.