Amazon ECR supports enhanced scanning powered by Amazon Inspector, which provides deeper security scanning for container images including OS and programming language package vulnerabilities.
* Enabling enhanced scanning (Option B) allows detection of CRITICAL and HIGH vulnerabilities.
* Amazon ECR emits scan completion events via EventBridge, which can trigger Lambda functions. The Lambda function can process the scan results from Amazon Inspector and programmatically approve or reject the image in the CI/CD pipeline (Option D).
* Basic scanning (Option A) is limited and does not integrate with Inspector.
* Options C and E describe functionalities not natively supported (ECR does not automatically submit Rejected status; Clair is not used in AWS ECR scanning).
Reference:
Amazon ECR Enhanced Scanning: " Enhanced scanning powered by Amazon Inspector identifies vulnerabilities in container images. " (Amazon ECR Image Scanning) Using EventBridge and Lambda for Scan Status: " ECR emits scan events that can be used to trigger Lambda functions for custom approval workflows. " (Amazon ECR Scan EventBridge)

https://aws.amazon.com/blogs/security/how-to-use-aws-config-to-determine-compliance-of-aws-kms-key-policies-to-your-specifications/

The problem is that the DevOps engineer cannot assume the OrganizationAccountAccessRole IAM role in the new member account that joined AnyCompany's management account through an Organizations invitation.
The solution is to create a new IAM role with the same name and trust policy in the new member account.
Option A is incorrect, as it does not address the root cause of the error. The DevOps engineer's IAM user already has permission to assume the OrganizationAccountAccessRole IAM role in any member account, as this is the default role name that AWS Organizations creates when a new account joins an organization. The error occurs because the new member account does not have this role, as it was not created by AWS Organizations.
Option B is incorrect, as it does not address the root cause of the error. An SCP is a policy that defines the maximum permissions for account members of an organization or organizational unit (OU). An SCP does not grant permissions to IAM users or roles, but rather limits the permissions that identity-based policies or resource-based policies grant to them. An SCP also does not affect how IAM roles are assumed by other principals.
Option C is correct, as it addresses the root cause of the error. By creating a new IAM role with the same name and trust policy as the OrganizationAccountAccessRole IAM role in the new member account, the DevOps engineer can assume this role and access the account. The new role should have the AdministratorAccess AWS managed policy attached, which grants full access to all AWS resources in the account. The trust policy should allow the management account to assume the role, which can be done by specifying the management account ID as a principal in the policy statement.
Option D is incorrect, as it assumes that the new member account already has the OrganizationAccountAccessRole IAM role, which is not true. The new member account does not have this role, as it was not created by AWS Organizations. Editing the trust policy of a non-existent role will not solve the problem.

AWS CodeBuild natively integrates with AWS CodePipeline as a test action and is designed for running automated tests during CI/CD execution. A buildspec.yml file defines the build commands, phases, and exit conditions. By adding test framework commands such as pytest with coverage or JaCoCo to the build phase, the build can produce a coverage report. The buildspec can then evaluate the coverage percentage and call exit
1 if coverage is below 80%, which causes the CodeBuild job to fail with a non-zero exit code, which in turn causes the CodePipeline stage to fail and blocks deployment to production. This requires no additional services or schedulers. Option A relies on a scheduled EventBridge rule, which cannot fail an in-progress pipeline execution in real time. Option B adds Step Functions orchestration unnecessarily. Option D requires managing a Jenkins server, which increases operational overhead significantly.

Deployment of config.txt file based on the appspec.yml:
The appspec.yml file specifies that config/config.txt should be copied to /usr/local/src/config.txt.
The source: / directive in the appspec.yml indicates that the entire directory structure starting from the root of the application source should be copied to the specified destination, which is /var/www/html.
Result of the Deployment:
The config.txt file will be specifically deployed to /usr/local/src/config.txt as per the explicit file mapping.
The entire directory structure including application/web will be copied to /var/www/html, but this does not include config/config.txt since it has a specific destination defined.
Thus, the config.txt file will be deployed only to /usr/local/src/config.txt.
Therefore, the correct answer is:
C). The config.txt file will be deployed to only /usr/local/src/config.txt.
References:
AWS CodeDeploy AppSpec File Reference
AWS CodeDeploy Deployment Process