AWS CloudWatch Events can be used to monitor events across different AWS resources, and a CloudWatch Event Rule can be created to trigger an AWS Lambda function when a deployment issue is detected in the pipeline. The Lambda function can then evaluate the issue and send a notification to the appropriate stakeholders through an Amazon SNS topic. This approach allows for real-time notifications and faster resolution times.

* Impact of Removing FullAWSAccess and Adding Policy for EC2 Actions:
The FullAWSAccess policy allows all actions on all resources by default. Removing this policy from the Department OU will limit the permissions that accounts within this OU inherit from the parent OU.
Adding a policy that allows only Amazon EC2 API operations will restrict the permissions to EC2 actions only.
* Permissions of Administrative IAM Roles:
The administrative IAM roles in the Engineering OU have the AdministratorAccess policy attached, which grants full access to all AWS services and resources.
Since SCPs are restrictions that apply at the organizational level, removing FullAWSAccess and replacing it with a policy allowing only EC2 actions means that for all accounts in the Engineering OU:
They will have full access to EC2 actions due to the new SCP.
They will be restricted in other actions that are not covered by the SCP, hence, non-EC2 API actions will be denied.
* Conclusion:
All API actions on EC2 resources will be allowed.
All other API actions will be denied due to the absence of a broader allow policy.

Use routing configuration on an alias to send a portion of traffic to a second function version. For example, you can reduce the risk of deploying a new version by configuring the alias to send most of the traffic to the existing version, and only a small percentage of traffic to the new version.https://docs.aws.amazon.com
/lambda/latest/dg/configuration-aliases.html
The following are the steps involved in the deploy stage configuration that will meet the requirements:
* Use AWS CodeBuild to add sample event payloads for testing to the Lambda functions.
* Publish a new version of the functions, and include Amazon CloudWatch alarms.
* Update the production alias to point to the new version.
* Configure rollbacks to occur when an alarm is in the ALARM state.
This configuration will help to reduce the customer impact of an unsuccessful deployment by deploying the new version of the functions to a staging environment first. This will allow the DevOps engineer to test the new version of the functions before deploying it to production.
The configuration will also help to monitor for issues by including Amazon CloudWatch alarms. These alarms will alert the DevOps engineer if there are any problems with the new version of the functions.

The operating system (Amazon Linux) uses yum for package management. To use both the default and a custom repository, the simplest method is to add the custom repository configuration file under /etc/yum.repos.
d/ using the yum-config-manager CLI, and enable it. This allows the system to access both repositories during patching automatically.
This approach requires minimal setup and effort and leverages the existing yum patching mechanisms.
Option A and D involve managing multiple patch baselines in Systems Manager Patch Manager, which does not natively support custom repositories - it relies on the underlying OS package manager.
Option B (Direct Connect) is not necessary unless network connectivity is an issue.
Thus, option C meets the requirement with the least effort.
Reference:
Managing Custom Repositories on Amazon Linux: " To add a custom yum repository, add a repo file in /etc
/yum.repos.d/ and enable it using yum-config-manager. " (Amazon Linux Repository Management) AWS Systems Manager Patch Manager: " Patch Manager uses the OS package manager, so custom repositories must be configured at the OS level. " (AWS Patch Manager)