Results

Explanation

With a wait time of zero the worker short-polls: each call queries only a sample of SQS servers and returns at once, so an idle queue produces a stream of billable empty responses, and can even miss messages on unsampled servers. Setting ReceiveMessageWaitTimeSeconds to 20, the maximum, turns on long polling for every call that does not override it: SQS queries all servers and holds the request open until a message arrives or 20 seconds pass, so requests drop by orders of magnitude while a new message is still returned immediately. A 60-second sleep cuts requests but can delay a report by a full minute, which breaks the few-seconds requirement. A larger MaxNumberOfMessages helps on a busy queue but does nothing for an empty one, where every call still returns nothing. DelaySeconds makes each new message invisible for 20 seconds after it is sent; it does not space out receive calls, so it adds latency and leaves the empty polls unchanged.

Explanation

A JWT authorizer on an HTTP API is configuration only: API Gateway fetches the signing keys from the user pool's JWKS endpoint, checks the signature, the issuer, the audience (or the client_id claim that Cognito access tokens carry instead), expiry and any route scopes, and then passes the validated claims to the Lambda integration in the request context. A REQUEST Lambda authorizer can do the same job, but it is exactly the custom verification code the team wants to remove, now running as an extra invocation on every request. IAM authorization would force the app to add an identity pool and SigV4 signing, and the functions would see an IAM identity rather than the user pool claims. HTTP APIs do not support usage plans or API keys at all, and an API key only identifies a caller; it never authenticates one.

Explanation

SAM policy templates such as DynamoDBCrudPolicy take a placeholder value like TableName and expand into an IAM statement that allows the item-level read and write actions on that table and its indexes only, and a SAM connector embedded on the function, with the queue as its destination and Write as its permission, makes SAM compose a policy that includes sqs:SendMessage on that queue's ARN alone. Neither needs a hand-written statement. A permissions boundary is itself a policy that someone has to write, and it leaves the over-broad managed policy in place as the thing being trimmed. A shared execution role for every function is the opposite of least privilege, because each function inherits the others' access. AWSLambdaSQSQueueExecutionRole grants the receive and delete actions used by an event source mapping that polls a queue, on every queue, and does not grant SendMessage.

Explanation

Grouping the filtered error lines with stats count(*) by errorMessage produces one row per distinct message with its number of occurrences, and sorting that count in descending order with limit 10 leaves exactly the ten most frequent messages; Logs Insights discovers the JSON fields automatically, so no parse step is needed. The query that sorts by @timestamp returns the ten newest error lines, which says nothing about frequency and may show the same message ten times. Grouping by bin(1h) counts errors per hourly bucket, which is a trend over time rather than a ranking of messages. The count_distinct query reports how many different messages each errorCode produced, which ranks error codes by variety and never names a message or says how often it occurred.

Explanation

SQS FIFO guarantees ordering within a message group, and the Lambda event source mapping processes different message groups concurrently while keeping each group in order, so using the account ID as the group ID gives one ordered lane per account and lets many accounts drain in parallel. Using the account ID as the deduplication ID would make SQS accept but never deliver any further event for that account sent within the five-minute deduplication interval, silently losing deposits and trades. A standard queue offers at-least-once delivery with best-effort ordering, so events for the same account could be applied out of order. High throughput mode raises the queue's transaction quotas, but a single message group is still delivered strictly in order one batch at a time, so the function stays at a concurrency of one.

Explanation

An identity pool turns a user pool sign-in into short-lived AWS credentials for its authenticated role, and the policy variable cognito-identity.amazonaws.com:sub resolves to the caller's identity ID at request time, so one role policy confines every user to private/identity-id/ without a per-user policy. Together these give direct, credential-free S3 access scoped per user. Creating an IAM user per person puts long-lived keys on every device and hits the IAM user quota long before the app scales. The aws:username variable exists only for IAM users, so it never resolves for a federated role session and the statement matches nothing. Amazon S3 accepts SigV4 signatures, not Cognito JWTs, so sending the access token in the Authorization header is rejected as a malformed authorization.

Explanation

The sam local generate-event command prints a correctly shaped sample payload for a given service and event type, and sam local invoke runs the function once inside a Lambda-like Docker container with that payload passed through -e, so the handler sees a real S3 put event structure and nothing is created in AWS. Running sam sync --watch is useful for fast cloud iteration, but it deploys a stack to an account, which the requirement rules out. The sam local start-api command only serves functions that have Api or HttpApi events in the template, and an S3-triggered function has none, so there is no route to call. The sam local start-lambda command emulates the Lambda Invoke endpoint for SDK and CLI callers, but S3 event notifications cannot be delivered to an endpoint on a laptop.

Explanation

An SNS topic with one SQS queue subscribed per consumer is the fanout pattern: SNS copies every published message into every subscribed queue, and each queue buffers its copy for up to 14 days, so a consumer that is down for hours simply drains its own queue later, and a new consumer needs only a new subscription. Receiving without deleting does not share messages; each one becomes visible again after the visibility timeout, is processed repeatedly by whichever consumer polls first, and stays until retention expires. Sending to three queues from the producer works but hard-codes the consumer list, so adding a fourth team means a producer change. Subscribing HTTPS endpoints directly gives no buffer: SNS retries an unreachable endpoint according to its delivery policy, for at most an hour, and then gives up, so a loader stopped for hours loses messages.

Explanation

Setting StorageResolution to 1 makes CloudWatch store the data points at one-second granularity instead of rolling them into one-minute aggregates, and a high-resolution alarm with a 10-second period then evaluates the backlog every 10 seconds, so a burst is caught well inside 30 seconds; the trade-off is that a high-resolution alarm costs more than a standard one, which operations has accepted. Switching a standard-resolution alarm to Maximum would capture the peak value, but the alarm still evaluates one-minute data points, so the alert can arrive more than a minute after the burst began. High-resolution data under a 60-second Average alarm is averaged back into the same minute that diluted the burst before. A 10-second period on a standard-resolution metric finds data only once a minute, so the alarm keeps lapsing into INSUFFICIENT_DATA rather than detecting anything sooner.

Explanation

With authorizer caching on, API Gateway keys the cached policy on the token in the identity source header and skips the authorizer for repeat requests until the TTL expires; the TTL defaults to 300 seconds and can be raised to 3,600, so 600 seconds fits the accepted revocation window. Because the returned policy already covers every method, the cached result is safe to reuse across the API. Provisioned concurrency only removes cold starts: the function, its DynamoDB read and its 180 ms revocation call still run and bill on every request. Stage caching stores integration responses, not authorization decisions, so the authorizer still runs first on each call. Migrating every partner to Cognito client credentials is a large project when one setting solves the problem.

Explanation

API Gateway substitutes stage variables into the Lambda integration ARN at request time, so ledger-handler:${stageVariables.lambdaAlias} resolves to the dev alias on the dev stage and the prod alias on the prod stage from one deployment. Because the URI is now dynamic, API Gateway does not add the invoke permission itself, and a resource-based permission on the unqualified function does not cover qualified alias ARNs, so each alias needs its own add-permission grant for the API Gateway service principal. A deployment description is free text that API Gateway never reads when it routes a request. Having the handler re-invoke itself under an alias changes the code and doubles every invocation and its cost. The Lambda service does not route an unqualified invocation to an alias based on a header, so a proxy integration header changes nothing.

Explanation

EventBridge event patterns support content filtering, so a pattern that combines a numeric comparison on coolantTempC with a prefix match on regionCode makes the rule match only the few thousand relevant events, and the bus never invokes the function for the rest. An input transformer only reshapes the payload delivered to a target after the rule has matched; it cannot drop an event, so every invocation would still happen. EventBridge Pipes reads from sources such as SQS queues, Kinesis and DynamoDB streams, Amazon MQ and Kafka; an event bus can be a pipe target but not a pipe source. Routing through an SQS queue and filtering on the event source mapping would work, but it adds a queue, a mapping and their permissions to do what the rule pattern does on its own.

Explanation

AssumeRole is the STS operation that crosses accounts: the caller's role is trusted by external-writer, so STS returns an access key, secret key and session token that act as external-writer in account 444455556666, and the application builds its Kinesis client from them (or lets an SDK assume-role credential provider refresh them) before the session expires. GetSessionToken must be called with IAM user or root credentials, cannot be called with role credentials, and never changes the account the caller acts in. GetFederationToken is also an IAM-user operation and returns credentials scoped inside the caller's own account. An instance profile holds exactly one role, so a second role cannot be attached beside tracker-app, and the default chain would not assume it anyway.

Explanation

The callback pattern (the .waitForTaskToken suffix on a service integration) pauses a Standard execution, which can run for up to a year, until something calls SendTaskSuccess or SendTaskFailure with the task token, so the approval application returns the decision directly and the workflow resumes immediately on the matching branch. A synchronous Lambda function cannot wait three days, because an invocation stops at the 15-minute maximum timeout, and polling inside it pays for idle compute. A fixed three-day Wait state always waits the full period, so an application approved in ten minutes still sits for three days. The .sync pattern is supported for job-style services such as AWS Batch, Amazon ECS, AWS Glue, AWS CodeBuild and nested Step Functions executions, not for Amazon SQS, so there is no way to wait on a message deletion.

Explanation

A REST API stage can carry canary settings: a new deployment goes to the canary, API Gateway routes the configured percentage of requests to it, the canary writes its own CloudWatch metrics and log streams, and promoting it makes it the stage's main deployment while the URL never changes. A second prod-v2 stage is exactly what the team wants to avoid, and both stages share the same execute-api host name, so DNS weighting cannot split traffic between them. A weighted Lambda alias splits only the function code, while this release changes the validator, models and mapping templates that live in API Gateway, so those changes would reach every request or none. A usage plan throttles callers but does not route any share of traffic to a different deployment, and a redeploy changes behavior for every client at once.

Explanation

By default the awsxray exporter translates every OpenTelemetry span attribute into X-Ray metadata, which is stored but not indexed; listing clinicId under indexed_attributes in the collector configuration turns that attribute into an annotation, which filter expressions can search, and only the sidecar configuration changes. Switching to the X-Ray SDK rewrites instrumentation code, and the X-Ray SDKs are in maintenance mode with ADOT as the recommended path. A metadata filter is not possible, because filter expressions only query annotations and built-in fields, never metadata. Sampling every request records more traces, but each one still carries clinicId as metadata, so the search still returns nothing. Setting the aws.xray.annotations span attribute in code would also work, but that is a code change.

Explanation

The AWS SDKs already retry throttling errors with exponential backoff and random jitter, which spreads retries out until capacity frees up; the previous configuration disabled that, and the immediate loop retries hardest exactly when the table is saturated. Deleting the loop and restoring SDK retries with a higher maxAttempts fixes it in client configuration alone (adaptive mode also adds client-side rate limiting; standard mode works too). A fixed one-second pause makes every throttled caller retry in lockstep, so the retries collide again a second later. DAX is a write-through cache, so every write still consumes the table's write capacity and is throttled the same way. More memory makes each call marginally faster but adds no write capacity, so the loop simply exhausts its attempts sooner.

Explanation

A task role is delivered only to the containers of that task through the ECS container credentials endpoint, which the AWS SDK default credential chain reads automatically, so invoice-render gets short-lived credentials and no other service on the same hosts inherits them. Putting the permissions on the container instance role grants them to all six services, and to anything else on the instances that can reach the metadata service. The task execution role is used by the ECS agent itself to pull images, write logs and fetch injected secrets; its credentials are not exposed to application code. Moving the IAM user's keys into Secrets Manager hides them better but leaves long-lived keys in place, plus a rotation job that someone must own.

Explanation

The package command zips each local CodeUri and ContentUri folder, uploads the archives to the named S3 bucket, and writes a copy of the template in which those local paths are replaced with S3 locations, which is what CloudFormation needs; sam deploy does the same step implicitly, which is why laptops never hit the error. CAPABILITY_AUTO_EXPAND only acknowledges that the template contains a transform that expands it, and it gives CloudFormation no way to read files on the build host. Committing zip archives still leaves local file names in the template, which CloudFormation cannot open any more than it can open folders. InlineCode suits only small functions without bundled dependencies, it would mean rewriting the function packaging, and a layer has no inline form at all.

Explanation

A circuit breaker turns repeated failures into an open state in which calls are rejected immediately, so the function returns the cached seat map in milliseconds instead of holding an execution environment for ten seconds; after a cooldown it lets a trial request through and closes again once the partner answers. Keeping the state in a shared store such as DynamoDB lets every execution environment see the same breaker. More retries with backoff suit brief throttling, but during a fifteen-minute outage they multiply the time each invocation is stuck and make the concurrency spike worse. A 15-minute timeout lets each stuck call live even longer. Provisioned concurrency is a pre-initialized portion of the account's concurrency, not capacity outside it, and it does nothing to make the calls finish faster.

Explanation

Lambda reuses a warm execution environment for later invocations, so anything created at module level during initialization survives between requests: moving the client and the database connection out of the handler removes the TLS handshake from nearly every request, provided the code reconnects when an idle connection has been closed, and caching the reference file in memory or in /tmp with a one-hour refresh removes the S3 download from all but one request per hour. Provisioned concurrency only pre-runs the initialization code, and here all of the slow work sits inside the handler, so it would still run on every request while adding cost. More memory may shave some time off each handshake and download but still repeats them on every invocation. Environment variables are capped at 4 KB in aggregate, far below a 6 MB file.

Explanation

The dynamodb:LeadingKeys condition key compares the partition key values a request touches with the policy, and the aws:PrincipalTag variable resolves to the session tag at request time, so one static statement lets each session read and write only items whose TenantId equals its own tag; a buggy query for another tenant fails with AccessDenied. A dynamodb:Attributes condition restricts which attribute names may be returned or written, not which items, so it isolates nothing between tenants. IAM cannot require a FilterExpression, and a filter is applied after items are read, so the protection would depend on the same code the auditors distrust. A table per tenant works but adds table sprawl, a policy edit on every sign-up and eventually the role policy size limit.

Explanation

The SAM CLI reads named environments from samconfig.toml, so tables such as [staging.deploy.parameters] and [prod.deploy.parameters] hold each stack name, Region, bucket and parameter_overrides, and sam deploy --config-env prod applies exactly that set from one template that is checked into source control. Two copies of the template drift apart as soon as someone fixes a resource in only one of them. The SAM CLI does not read parameter overrides from arbitrarily named environment variables, so the wrapper script would pass nothing and the stack would fall back to the template defaults. Running a guided deploy every time reintroduces the manual typing that caused the incident, and by default it writes the answers into the default environment of the config file.

Explanation

API Gateway REST APIs validate request bodies against a model written in JSON Schema draft 4, but only when the method also has a request validator that validates the body and the model is set as the method's request model for the content type; together they reject a nonconforming body with 400 Bad Request before the integration is called. A mapping template transforms the payload sent to the backend and never rejects a request, so the invalid body would still reach the function. A WAF size rule blocks large requests, not small well-formed ones with a missing field or a wrong type. A REQUEST Lambda authorizer receives headers, query strings, path parameters, stage variables and request context, but not the request body, and it would still be an extra function to write and pay for.

Explanation

IAM authorization means API Gateway evaluates the SigV4 signature on the request, identifies the signing principal and checks that it is allowed execute-api:Invoke on the specific method ARN, so the role needs that permission scoped to GET /prices/* and the client must sign with the role's temporary credentials for the execute-api service. An API key is used for usage plans and throttling, not for authentication, and an IAM-authorized method still rejects the unsigned request. The apigateway:GET action governs the management API that reads API definitions, not invoking them, and a role ARN in a header is not a credential. Granting execute-api:Invoke alone is not enough either: API Gateway knows nothing about the caller's role unless the request is signed.

Explanation

With a Lambda proxy integration API Gateway passes the function's return value straight through, so it must have the proxy response shape: an integer statusCode, optional headers, and a body that is a string. A bare dictionary has no statusCode and its data is not a string body, so API Gateway reports a malformed proxy response and returns 502; returning statusCode 200 with json.dumps of the result as the body fixes it in one line. The timeouts are irrelevant, because the function finishes in 80 ms and an integration timeout would produce 504, not 502. A non-proxy integration with mapping and method responses would also work, but it is a much larger reconfiguration than a handler change. Method response settings do not reshape a proxy integration's output, so a header defined there leaves the malformed response unchanged.

Explanation

AWS AppConfig deploys a feature flag configuration to an environment using a deployment strategy that controls growth over time, such as a linear rollout over 30 minutes, and it watches the CloudWatch alarms registered as monitors on that environment, rolling the configuration back automatically if one fires during the deployment or bake time. The AppConfig Agent Lambda extension caches the flag locally, so the code reads it without new versions. An environment variable change requires publishing a new version, which the requirement rules out. A Parameter Store value flips for every request at once, so there is no gradual rollout, and the revert logic is custom. A DynamoDB item with a stream-driven reverter is also custom code, adds a read to each invocation, and still offers no gradual exposure.

Explanation

Lambda assigns CPU in proportion to configured memory, reaching the equivalent of one full vCPU at 1,769 MB, so a single-threaded CPU-bound function at 512 MB is starved of compute rather than memory; raising memory shortens the duration roughly in step with the added CPU, and because billing is memory multiplied by duration the cost per invocation stays about flat or falls, which Power Tuning confirms with real measurements. Halving the memory to 256 MB also halves the CPU, roughly doubling the duration, so it saves nothing and makes the function slower. A longer timeout only allows a slow invocation to run longer, and provisioned concurrency removes initialization latency without granting more CPU. Larger /tmp storage helps disk-heavy work, not a CPU-bound resize that fits comfortably in memory.

Explanation

Envelope encryption is the pattern KMS is built for: one GenerateDataKey request returns a plaintext data key and the same key encrypted under alias/visit-notes, the application encrypts the 2 MB document locally with AES-GCM, and only the small encrypted data key needs a Decrypt call later. The AWS Encryption SDK packages exactly this flow. Chunking a 2 MB document into 4 KB pieces costs about 500 Encrypt requests per document and quickly runs into KMS request quotas. The 4,096-byte plaintext limit on Encrypt is fixed, not an adjustable quota. A random value stored in an environment variable is a single static key that never touches KMS again, so access to it is neither controlled by the key policy nor logged per use in CloudTrail.

Explanation

Shared-throughput consumers split each shard's 2 MB per second of reads and its five GetRecords calls per second, so a fifth poller pushes all of them over the limit. An enhanced fan-out consumer gets its own dedicated 2 MB per second per shard, and records are pushed over HTTP/2 through SubscribeToShard with a typical propagation delay of about 70 ms, independent of the other registered consumers. Resharding to 16 shards raises the shared limits, but every application still competes for them and still pays the polling delay. A longer retention period only lets laggards recover later; it does not stop them from lagging. A larger Limit returns more records per call but cannot exceed the 2 MB per second shard read limit, so bigger reads simply hit it sooner.

Explanation

An immutable deployment never touches the running instances: Elastic Beanstalk launches a complete set of new instances with the new version in a temporary Auto Scaling group, moves them into the environment only once they pass health checks, and on failure terminates just the new instances, so capacity stays full and rollback is quick and safe. Rolling with additional batch preserves capacity, but it updates the original instances in place, so a failure part-way leaves a mix of versions and recovery is another deployment. Rolling removes a batch from service at a time and therefore reduces capacity, with the same mixed-version failure mode. All at once updates every instance together, causing a brief outage and leaving no healthy original instances if the new version is broken.

Explanation

TransactWriteItems groups up to 100 actions across one or more tables in the same account and Region into a single all-or-nothing operation, so the conditional debit, the credit and the ledger Put either all commit or, if the balance condition fails or the request conflicts, all are canceled with a TransactionCanceledException that lists the reason per action. BatchWriteItem is not atomic: some writes can succeed while others come back as UnprocessedItems, and it supports only puts and deletes with no condition expressions, so it cannot even express the conditional debit. A stream-driven compensator leaves balances wrong until it runs. Strongly consistent reads show the latest data but give no atomicity, and retrying from code that has already timed out cannot finish the transfer.

Explanation

An explicit Deny conditioned on aws:SecureTransport being false overrides any Allow, whether it comes from an identity-based policy or the bucket policy, so every plain HTTP request to the bucket or its objects is refused no matter which role sends it. Default SSE-KMS encryption protects objects at rest and says nothing about how the request traveled. An Allow conditioned on secure transport does not block anything, because the roles in the same account are already allowed by their identity-based policies and an unmet Allow simply does not apply. Requiring the server-side encryption header again concerns encryption at rest; a script can send that header over plain HTTP and the request would still be accepted.

Explanation

A subscription filter policy is evaluated by SNS before delivery, so with a policy matching eventType RefundIssued on the message attributes, SNS delivers only refund events to refund-ledger and the other 97 percent never invoke the function; it is a configuration change on the subscription with no code involved. An early return in the handler still pays for every invocation and still consumes concurrency, it only makes each wasted call shorter. A dedicated refunds topic works but requires a publisher code change and another topic to operate. Moving the function behind an SQS queue with a batch size of 10 reduces the number of invocations, yet the function still receives and discards every unwanted message, now with a queue to manage as well.

Explanation

A REST API deployment is a snapshot of the API's methods, integrations and mapping templates, and a stage simply points at one, so changing the stage's active deployment from its Deployment history tab, or running update-stage with a replace patch on /deploymentId, puts the earlier snapshot back in service immediately without rebuilding anything. Reverting the commit and letting the pipeline run is a sound long-term fix, but it waits for a full build and deployment while every quote request keeps failing. Deleting and recreating the stage takes the prod URL offline until the new stage exists and discards its stage settings, which must be rebuilt by hand. Re-importing an older OpenAPI file overwrites the current API definition and still needs a new deployment, which is slower and may restore a file that never matched what was live.

Explanation

By default a stream event source mapping retries a failing batch until the records expire, so one poison record holds its shard in place. BisectBatchOnFunctionError splits a failed batch in half repeatedly, so the valid halves succeed and the bad record ends up isolated; MaximumRetryAttempts (or MaximumRecordAgeInSeconds) bounds the retries, after which Lambda discards the record and moves on, and the on-failure destination receives the shard ID, sequence-number range and error context for the discarded batch (metadata only for an SQS destination). A function-level dead-letter queue applies only to asynchronous invocations, and an event source mapping invokes the function synchronously, so nothing would reach it. A higher ParallelizationFactor adds concurrency per shard, but the bad record is still retried indefinitely. Zero retries skips the whole batch of 500 on its first error, discarding the valid records with it and leaving no record of what was lost.

Explanation

The AWS Encryption SDK performs client-side envelope encryption for the application: the KMS keyring obtains a data key under the firm's KMS key, the SDK encrypts the file locally and emits a portable encrypted message that carries the encrypted data key, so only ciphertext ever leaves the workstation and no hand-written cryptography is involved. SSE-KMS encrypts at rest inside Amazon S3, which means S3 receives the plaintext (protected only by TLS in transit), breaking the contract. DSSE-KMS adds a second server-side layer but has the same flaw: the encryption still happens in S3 after the plaintext arrives. Calling KMS Encrypt directly fails for these files, because that operation accepts at most 4,096 bytes of plaintext.

Explanation

Only values in the cache key make CloudFront store separate objects, and a cache policy that includes Accept-Language yields one cached copy per header value, three here; headers in a cache policy are also forwarded to the origin automatically, so the origin still sees the language. A custom origin request policy only controls what reaches the origin on a miss, which AllViewer already does, and values it adds are never part of the cache key, so the first language cached keeps being served to everyone. Zero TTLs stop the wrong copy from being served by disabling caching, which defeats the requirement to serve from the edge. CloudFront does not split its cache on a Vary response header, apart from its own handling of Accept-Encoding, so Vary changes nothing.

Explanation

ValidateService is the last lifecycle event of an EC2 in-place deployment, running after ApplicationStart, so a script there sees the newly started worker, and a nonzero exit code or a timeout fails the deployment for that instance, which can trigger an automatic rollback if the deployment group enables one. BeforeInstall runs before the new revision is copied into place and before the worker has started, so the check would test the old process or nothing. ApplicationStop runs first and uses the scripts from the previously deployed revision, so a new check would not take effect until the next deployment and would still run before the new code starts. A post_build check in CodeBuild tests the artifact in a build container, not the real start-up on each instance, so environment-specific crashes would still slip through.

Explanation

Partial batch responses need both halves: the event source mapping must list ReportBatchItemFailures in FunctionResponseTypes, and the handler must return a batchItemFailures array with the messageId of each failed record as its itemIdentifier. Lambda then deletes the successful messages and only the listed ones become visible again; if the handler raises an exception instead, the whole batch is still treated as failed. A batch size of 1 isolates failures but abandons the batch size the scenario requires and multiplies invocations tenfold. A maxReceiveCount of 1 sends the entire failed batch, valid payouts included, to the dead-letter queue on the next receive. On-failure destinations on event source mappings apply to stream and Kafka sources; for an SQS source, failed messages are handled by the queue's own redrive policy.

Explanation

An encryption context is authenticated additional data: KMS binds it to the ciphertext, Decrypt succeeds only when the identical, case-sensitive context is supplied, and the context appears in plaintext in the CloudTrail record of each call. Adding a key policy condition that ties kms:EncryptionContext:tenantId to the caller's own tenantId tag then stops a role from even asking for another tenant's context, so a misrouted job fails inside KMS, provided no IAM policy on the tenant roles grants kms:Decrypt on the key without the same condition. Aliases are only friendly names; ciphertext is bound to the key, not to the alias used. A ForAllValues test on kms:EncryptionContextKeys checks key names, not values, and also matches requests that carry no context at all, so t-2207 could still send tenantId t-1184. Comparing an S3 tag in application code is the same kind of check the misrouted job already bypassed; KMS would never enforce it.

Explanation

A Lambda layer is a .zip archive that Lambda extracts into /opt, and for Python the contents of its python directory are added to the import path, so the shared libraries are published once and each function references a layer version instead of bundling its own copy. Layer versions are immutable, so a rates-common fix becomes one new layer version, which SAM can roll out to all 34 functions through a single shared resource reference. Downloading from S3 into /tmp needs custom loader code and adds the download to every cold start. EFS mounts require the functions to be attached to a VPC, which the team ruled out, and they add a file system to manage. A Git submodule removes duplication from the source tree only; every package still bundles its own 18 MB copy and must be rebuilt for each fix.

Explanation

A Lambda function packaged as a container image can be up to 10 GB uncompressed, so building from the AWS base image for Python 3.13, pushing it to Amazon ECR and creating the function from the image keeps all 2.1 GB of dependencies inside the deployment artifact. Splitting dependencies across layers does not help, because the 250 MB unzipped limit applies to the function code and all of its layers combined. Uploading the archive through S3 only lifts the 50 MB direct-upload limit on the zipped file, and the 250 MB unzipped limit still applies. Downloading into /tmp at initialization can be made to work, but it moves the dependencies out of the deployment artifact, which the requirement rules out, and adds a large download to every cold start.

Explanation

Automatic rotation for a customer managed key accepts a custom rotation period between 90 and 2,560 days (365 by default), so a 180-day period meets the standard with one setting; the key ID and ARN never change, and KMS retains every previous version of the key material so data keys encrypted years ago still decrypt without any change. Creating a new key and re-encrypting the archive every 180 days is a recurring project, and the ARN-based configuration would still point at the old key. A scheduled on-demand rotation would work, but it rests on the outdated idea that automatic rotation is fixed at one year and adds a function to maintain. KMS never deletes earlier key material on rotation, so re-encrypting the records is unnecessary work.

Explanation

DAX is an in-memory, write-through cache built for DynamoDB that serves eventually consistent reads from cache in microseconds, and its client is API-compatible with the DynamoDB client, so the service swaps the client and keeps its GetItem calls unchanged. On-demand capacity mode changes how throughput is provisioned and billed, but every read still goes to DynamoDB at millisecond latency. ElastiCache can also return cached data in microseconds, but the team would have to write cache-aside logic, choose keys and TTLs, and invalidate entries on every write, which is far more code. A global table replica only moves the data closer to some players; reads against it are still DynamoDB reads measured in milliseconds.

Explanation

Reserved concurrency is both a guarantee and a ceiling, so at 40 the function can never hold more than 40 database connections. Because S3 invokes the function asynchronously, events that arrive while it is at its limit are throttled and kept in Lambda's internal queue, which retries them for up to the six-hour default maximum event age, so the backlog simply drains over the following minutes. Provisioned concurrency only keeps execution environments initialized; it is not a cap, and the function scales past it on demand. RDS Proxy pools connections only for Amazon RDS and Aurora databases, not for PostgreSQL that runs on EC2. Service Quotas takes requests to raise the account-level concurrency quota, not to lower it, and an account-wide limit would throttle every function in the account rather than this one.

Explanation

With --use-container, sam build runs the dependency installation inside a container image that behaves like the Lambda environment for the function's runtime and architecture, so the C extension is compiled for Amazon Linux on x86_64 and imports correctly once deployed; Docker Desktop on the laptop is all it needs. Building a layer on the same laptop moves the Windows-compiled module into another archive without changing what it was compiled for. Switching to arm64 makes the mismatch worse, because Lambda loads native code only when it matches both the operating system and the processor architecture. Lambda never installs packages from requirements.txt at deploy or run time, so uploading only the handler code with sam sync --code leaves the module missing entirely.

Explanation

A presigned URL carries a signature made with the backend's credentials for one operation on one key, so the browser can PUT that single object directly to Amazon S3 for the 15 minutes requested without ever holding credentials; the bucket only needs a CORS rule allowing PUT from the site's origin. A 7-day expiry breaks the 15-minute requirement, and it would not hold anyway: a URL signed with temporary credentials such as a Lambda execution role's stops working when those credentials expire, whatever expiry was requested, and only IAM user credentials reach the 7-day maximum. Routing the video through API Gateway fails because its request payload limit is 10 MB, far below 300 MB. A bucket policy that allows anonymous PutObject makes the prefix publicly writable, which no time or key limit can repair.

Explanation

A single partition key value is served by one partition, which supports up to 1,000 write units per second, so putting all of a day's writes under one eventDate value creates a hot partition no matter how much table capacity exists. Keying on sessionId spreads writes across many partitions and matches the session-based read pattern; because a table's partition key cannot be changed, that means a new table and a migration. Provisioned mode raises table capacity but not the per-partition limit, so the hot key still throttles. A global secondary index adds a second write for every item and leaves the base table's hot key exactly where it was. DAX is a write-through cache, so every write still lands on the same hot partition.

Explanation

CodeDeploy emits a CodeDeploy Deployment State-change Notification event to EventBridge for every deployment, so one rule matching the SUCCESS and FAILURE states for any application and any deployment group, with an SNS topic and email subscriptions as its target, covers all 14 groups and every group created later with no further work. Deployment group triggers do send these events to SNS, but they are configured per group, so every new group needs its own trigger and a forgotten one goes silent. A metric filter on CreateDeployment only sees the API call that starts a deployment, never whether it succeeded or failed. A polling function is custom code to write and maintain, and it reports outcomes up to five minutes late.

Explanation

Amplify Hosting web previews deploy every pull request made against an enabled branch to a unique preview URL, separate from the production URL, and delete that preview, along with any temporary backend environment created for it, when the pull request is closed; each open pull request counts toward the app's branch quota, which closing it releases. Connecting branches manually does give each one a site, but someone has to add and remove every branch, which is exactly the upkeep and the stale sites the reviewers want to avoid. A separate app per developer multiplies build settings, environment variables and domains, and still gives no per-pull-request environment. A custom CodeBuild and CloudFront pipeline reimplements previews by hand and needs its own trigger, routing and cleanup logic.

Explanation

A global secondary index can be added to an existing table at any time; DynamoDB backfills it from the current items, and the dashboard can then Query by assigneeId with ScanIndexForward set to false to return the newest tickets first. A local secondary index must share the table's partition key, so it could not be keyed on assigneeId, and local secondary indexes can only be defined when the table is created. A parallel scan finishes sooner but still reads all 60 million items and consumes even more read capacity per second. A ProjectionExpression trims what is returned, not what is read, because read capacity is charged on the full size of every item scanned before any projection or filter is applied.

Explanation

The pre token generation trigger runs each time Cognito issues tokens, including on refresh, and the V2_0 event (available on the Essentials and Plus plans) lets the function add claims to the access token through accessTokenGeneration.claimsToAddOrOverride, so a single DynamoDB read at issuance puts current org_id and plan values where the API can authorize on them. A V1_0 event customizes only the ID token, apart from group overrides, so its claimsToAddOrOverride never reaches the access token the API validates. Custom user attributes written by a post authentication trigger appear in the ID token, not the access token, and copying billing data into the directory on every sign-in adds writes and staleness. Encoding organizations and plans as groups means thousands of groups and a sync job for every membership and plan change.

Explanation

Optimistic locking makes each write conditional on the item being unchanged since it was read: the PutItem carries a ConditionExpression that the version attribute still equals the value read and sets it one higher, so a concurrent writer gets a ConditionalCheckFailedException, rereads the item and reapplies its rules instead of overwriting. Strongly consistent reads return the latest committed item at read time, but another task can still write between that read and the PutItem. TransactGetItems and TransactWriteItems are separate calls, and no transaction spans them; an unconditional write inside TransactWriteItems overwrites just as PutItem does. A stream-driven reconciler repairs drift only after the lost update has happened, other tasks read the wrong count in the meantime, and it would have to re-derive the business rules from old and new images.

Explanation

A digest is a content hash that identifies one image and can never point at anything else, and tag immutability stops a later push from overwriting an existing tag, so tagging by commit ID and passing the digest through the pipeline makes the test stage and the production stage reference the same bytes. An untagged-image lifecycle policy only cleans up old images; it does nothing to stop release-candidate being moved to a new image. Replication copies whatever is pushed, including the overwriting push, so the production repository would receive the untested image as well. Forcing a new deployment makes tasks pull the current target of the mutable tag, which is exactly the behavior that caused the incident.

Explanation

Two separate settings are needed: choosing alias/claims-env as the at-rest key replaces the AWS managed key, and the encryption helpers encrypt the token client-side with that key, so the stored and returned value is ciphertext that the function decrypts itself with a KMS Decrypt call, cached once during initialization, which needs kms:Decrypt on the execution role. Selecting the customer managed key for encryption at rest alone satisfies the first requirement only, because Lambda decrypts at-rest values transparently and the configuration shows plaintext to anyone allowed to use the key. Keeping the AWS managed key fails the at-rest requirement outright. Lambda never decrypts helper-encrypted values on the function's behalf, so without decryption code the handler receives a base64 ciphertext string.

Explanation

The service health check grace period tells the ECS scheduler to ignore load balancer health check results for that many seconds after a task starts, so 180 seconds covers the 150-second warm-up, and tuning the target group interval and unhealthy threshold keeps detection prompt but tolerant once the grace period ends, so tasks that fail later are still replaced. The circuit breaker would detect the repeated failures and roll back to the old revision, so the new version would never deploy. A minimum healthy percent of 100 keeps capacity up during the rollout, but the new tasks are still killed at 30 seconds and the deployment still never completes. Accepting 200-499 does not help a task that is not yet listening, and it would permanently hide real errors.

Explanation

DynamoDB Time to Live deletes items whose TTL attribute, a Number holding an epoch time in seconds, is in the past, and those background deletions consume no write capacity, so the nightly scan and its delete charges disappear. Deletion is not instant (it typically happens within a few days of expiry), so the application should keep ignoring sessions whose expiresAt has passed. A GSI on expiresAt makes finding expired items cheaper, but every delete is still a paid write and the index adds its own write cost. Rolling daily tables avoid per-item deletes but break sessions that span midnight and add table-management code. DynamoDB Streams keeps change records for a fixed 24 hours; it has no configurable retention and no effect on the items in the table.

Explanation

A mock integration makes API Gateway answer the request itself: the integration request mapping template selects a status code, and the integration responses return the agreed body and headers through mapping templates, so the deployed stage serves the contract over HTTPS with no backend at all and can later be switched to the real Lambda integrations. Placeholder Lambda functions work, but they are backend code that someone has to write, deploy and pay for, which the requirement rules out. API caching stores responses that a backend has already produced and cannot be primed with sample data, so every request would still need an integration. The sam local start-api command runs function code from the template locally, so with no functions written there is nothing to serve, and it would not be a shared endpoint anyway.

Explanation

A CloudWatch Logs data protection policy detects the selected managed data identifiers as events are ingested and masks them at every egress point, including Logs Insights, metric filters and subscription filters, while principals granted logs:Unmask can still see the original values; it needs no code change. It applies only to events ingested after the policy is created, so older events stay as they were. A redaction pipeline built on a subscription filter is custom code to run and pay for, and the original log group still holds the unmasked values that support can query. Amazon Macie analyzes objects in Amazon S3, not CloudWatch Logs log groups, and it reports findings rather than masking data. Metric filters only count matches; every value stays fully visible.

Explanation

DynamoDB Streams captures every item change, and a Lambda event source mapping on the stream invokes the function within seconds, so it can apply an UpdateItem with an ADD expression to the matching campaign's total for each INSERT record. Stream records can be processed more than once after a retry, so the function should guard against double counting, for example with a conditional write keyed on the pledge ID. Amazon Data Firehose has no DynamoDB destination, so it cannot write into CampaignTotals. Contributor Insights reports the most frequently accessed and throttled keys, not sums of attribute values. Scanning every minute still lags by up to a minute and multiplies the already growing scan cost by fifteen.

Explanation

When one resource fails, CloudFormation cancels the operations still in flight and rolls back, so the cause is recorded on the first failure event of the update, and reading the stack events in time order to the earliest CREATE_FAILED or UPDATE_FAILED entry shows the real error, such as a permissions denial or an invalid property, in its status reason. The UPDATE_ROLLBACK_COMPLETE event only reports that the rollback finished. Drift detection compares live resource configuration with the template; after a successful rollback the resources match the previous template, and drift says nothing about why the update failed. Events reading Resource update cancelled are consequences of the first failure, since CloudFormation stopped those updates because something else had already failed.

Explanation

Shareable test events are stored in the Amazon EventBridge schema registry and are visible to everyone in the account who has the schema permissions, so the same named events appear in the Lambda console's test tab, and the SAM CLI manages them with sam remote test-event and sends one to the deployed function with sam remote invoke and --test-event-name. Private test events in the console are visible only to the user who created them, so a shared naming scheme does not share them. Running sam local invoke tests a local container rather than the deployed function, with its real role, configuration and downstream resources. Committing files and calling aws lambda invoke does reach the deployed function, but the events live outside the account and never appear in the console's test tab.

Explanation

DetectPiiEntities is a synchronous API that accepts up to 100 KB of English or Spanish text and returns each PII entity's type, confidence score and begin and end offsets, so notes-writer can swap each span for a label such as [PHONE] and store only redacted text, with the model maintained by AWS. ContainsPiiEntities returns only the entity labels present, which suits a fast yes-or-no check but not span replacement. Encryption at rest with a customer managed key protects the stored bytes, yet every reader with table access still sees the names and numbers in plaintext. Amazon Macie discovers sensitive data in Amazon S3, not in DynamoDB items, and reports findings rather than masking anything. Hand-written regular expressions can catch email addresses but are poor at names and street addresses, and they become a pattern list the team must maintain forever.

Explanation

Amazon OpenSearch Service builds an inverted index with text analyzers, fuzzy matching, relevance scoring and aggregations for facets, which is what full-text search needs, and the DynamoDB zero-ETL integration, built on OpenSearch Ingestion, keeps the index in sync with the table without custom pipeline code while orders and inventory stay in DynamoDB. A begins_with key condition matches only a case-sensitive prefix of one sort key attribute, with no typo tolerance or ranking. DAX caches identical requests, but each distinct search is a new Scan, and a cached scan still has no relevance ranking or fuzzy matching. A PartiQL SELECT whose WHERE clause has no key condition is executed as a full table scan, so it costs the same as the Scan it replaces.