Step 1: Creating a Centralized Domain in the Shared Services Account
To manage application package dependencies across multiple accounts, the most efficient solution is to create a centralized domain in the shared services account. This allows all application teams to access and manage package repositories within the same domain, ensuring consistency and centralization.
Action: Create a domain in the shared services account.
Why: A single, centralized domain reduces the need for redundant management in each application team's account.
Reference: AWS documentation on AWS CodeArtifact domains and repositories.
This corresponds to Option B: Create a domain in the shared services account. Grant the organization read access and CreateRepository access.
Step 2: Sharing Repositories Across Teams with Upstream ConfigurationsTo share common library packages across the organization, each application team's repository can point to the shared services repository as an upstream repository. This enables teams to access shared packages without managing them individually in each team's account.
Action: Create a repository in the shared services account and set it as the upstream repository for each application team.
Why: Upstream repositories allow package sharing while maintaining individual team repositories for managing their own packages.
Reference: AWS documentation on Upstream repositories in CodeArtifact.
This corresponds to Option D: Create a repository in the shared services account. Grant the organization read access to the repository in the shared services account. Set the repository as the upstream repository in each application team's repository.
Step 3: Using Resource-Based Policies for Cross-Account AccessFor teams that need to share their packages with other application teams, resource-based policies can be applied to grant the necessary permissions. These policies allow cross-account access without having to manage permissions at the individual account level.
Action: Create resource-based policies that allow read access to the repositories across application teams.
Why: This simplifies management by centralizing permissions in the shared services account while allowing cross-team collaboration.
Reference: AWS documentation on CodeArtifact resource-based policies.
This corresponds to Option E: For teams that require shared packages, create resource-based policies that allow read access to the repository from other application teams' accounts.

AWS Control Tower provides Account Factory and Account Factory Customizations (AFC) as the lowest- overhead and most scalable method for creating and configuring new accounts. AFC allows you to define blueprints that include mandatory baseline resources such as IAM roles, logging configurations, guardrails, network settings, and tagging standards. When accounts are created through Account Factory using a customization blueprint, all controls and baseline configurations are applied automatically during provisioning, without any additional automation steps or StackSet deployments.
Option B requires running StackSets after the account is created, which adds manual management overhead and defeats the built-in automation advantages of Control Tower. Options C and D rely on manually provisioning accounts via AWS Organizations, which bypasses Control Tower's governance and would require custom Lambda or StackSet automation to replicate controls that Control Tower already provides automatically.
Because the question explicitly asks for the least operational overhead, the correct answer is to use the Control Tower AFC blueprint, ensuring every account is born compliant with the required guardrails and baseline configuration.

The key requirement is to shift a small percentage of traffic to a new version first to validate changes before rolling out to the entire ECS service, thereby reducing downtime and deployment risk. For ECS services behind an Application Load Balancer, the AWS-recommended and most reliable approach is to use AWS CodeDeploy with blue/green or canary deployments.
Option B directly addresses this requirement. By configuring the ECS service to use CodeDeploy as the deployment controller, CodeDeploy can manage traffic shifting between two ALB target groups: one for the current (stable) version and one for the new version. The CodeDeployDefault.
ECSCanary10Percent15Minutes deployment configuration initially routes 10% of production traffic to the new task set, monitors the deployment for issues, and then shifts the remaining traffic after the defined interval. This enables early detection of application errors while limiting user impact.
Option A and C rely on rolling updates, which replace tasks incrementally but do not provide precise traffic control or automated rollback based on health checks. Option D's slow start setting only affects how quickly targets receive traffic after registration and does not implement true canary testing.
Therefore, using AWS CodeDeploy with ECS canary deployments is the most robust, AWS-supported solution to test changes safely before full rollout.

Action-level states in events
Action state Description
STARTED The action is currently running.
SUCCEEDED The action was completed successfully.
FAILED For Approval actions, the FAILED state means the action was either rejected by the reviewer or failed due to an incorrect action configuration.
CANCELED The action was canceled because the pipeline structure was updated.