https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.
html#appspec-hooks-lambda

AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises. SSM parameter store and AWS Secret manager are both a secure option. However, Secrets manager is more flexible and has more options like password generation. Reference: https://www.1strategy.com/blog/2019/02
/28/aws-parameter-store-vs-aws-secrets-manager/

You need to understand how SCP inheritance works in AWS. The way it works for Deny policies is different that allow policies.
Allow polices are passing down to children ONLY if they don't have an allow policy.
Deny policies always pass down to children.
That's why there is always an SCP set to the Root to allow everything by default. If you limit this policy, the whole organization will be limited, not matter what other policies are saying for the other OUs. So it's not A.
It's not D because it restricts the wrong OU.

The default CPU utilization metric does not reflect the processing backlog in the SQS queue, so the Auto Scaling group is not scaling properly to handle the workload.
To scale the Auto Scaling group based on queue length, you can create a target tracking scaling policy that uses a custom metric that combines the SQS queue ' s ApproximateNumberOfMessagesVisible and the number of instances (GroupIn-ServiceInstances) metric using CloudWatch metric math. This allows the scaling policy to calculate the average number of messages per instance and scale accordingly.
This approach requires no additional Lambda functions or log processing, thus minimizing operational overhead.
Option A and B require Lambda functions to publish custom metrics, which increases operational complexity.
Option D also adds complexity with logging and metric filters.
Reference:
Scaling based on SQS queue length using metric math: " You can create CloudWatch metric math expressions combining SQS and Auto Scaling group metrics to enable target tracking scaling policies that respond to queue backlog. " (AWS Auto Scaling with SQS) Target Tracking Scaling Policies: " Target tracking policies can use metric math expressions as a source to make scaling decisions. " (AWS Auto Scaling Target Tracking)