Requirement Summary:
WebSocket-based messaging app using API Gateway WebSocket APIs
Need to:
Identify clients repeatedly connecting/disconnecting
Be able to remove problematic clients
Evaluate Options:
A). Switch to HTTP APIs
HTTP APIs don't support WebSocket connections
B). Switch to REST APIs
REST APIs are not compatible with WebSockets
C). Use the callback URL to disconnect clients
## Possible, but not a direct option
Callback URLs are used for sending messages to connected clients, not for disconnecting D). Track client status in ElastiCache Good solution: Store and update connection state (connected, disconnected, timestamps) Helps track abuse or reconnections E). Implement $connect and $disconnect routes Required to capture connection lifecycle events These can be used to log/store client behavior and decide on removal WebSocket routes in API Gateway: https://docs.aws.amazon.com/apigateway/latest/developerguide
/apigateway-websocket-api-route-selection.html
Managing WebSocket connections: https://docs.aws.amazon.com/apigateway/latest/developerguide
/apigateway-websocket-api-mapping-template-reference.html

The AWS Serverless Application Model Command Line Interface (AWS SAM CLI) is a command-line tool for local development and testing of Serverless applications3. The sam local generate-event command of AWS SAM CLI generates sample events for automated tests3. The sam local invoke command is used to invoke Lambda functions3. Therefore, option C is correct.

When using AWS SAM local (sam local invoke, sam local start-api), the Lambda code runs in a local container on the developer's machine. If that code uses the AWS SDK to call AWS services, it needs AWS credentials available in the local environment. The recommended way is to rely on the AWS SDK's standard credential provider chain, which includes credentials stored by the AWS CLI in ~/.aws/credentials and selected via a named profile.
By running aws configure --profile <profileName>, the developer creates a dedicated set of access keys (and optionally a session token/region) for the test account. Then, running SAM with sam local invoke --profile
<profileName> causes SAM to supply those credentials to the local container so the function can authenticate to AWS and make real API calls in the intended test account. This approach is clean, repeatable, and avoids hardcoding secrets into templates or source code.
Option A is insecure and not the intended use of SAM templates; templates are infrastructure definitions, not secret stores. Option C sets the Lambda execution role for deployed functions in AWS, but it does not automatically grant credentials to code running locally on a laptop. Option D misuses --parameter-overrides, which is meant for overriding template parameters at deployment/build time, not for securely injecting AWS access keys into local execution.
Therefore, the correct approach is B: configure an AWS CLI profile and run SAM local with the --profile option so the Lambda code can call AWS APIs in the test account using standard credential handling.

In AWS X-Ray, filter expressions can filter trace data based on indexed fields that X-Ray can query efficiently. Custom data can be added to segments in two main ways: annotations and metadata. The critical difference is that annotations are indexed and can be used for filtering, while metadata is not indexed and is intended for additional diagnostic context that you do not typically query on.
Therefore, if the developer wants user-specified custom attributes to be usable in X-Ray filter expressions, the developer should record those attributes as annotations in the segment document. Once recorded as annotations, the developer can write filter expressions that match annotation keys/values and return only the relevant traces.
Option B is incorrect because metadata is not indexed and cannot be used in filter expressions for trace search the same way annotations can.
Option C is incorrect because segment documents have a defined schema; adding arbitrary "new segment fields" is not the intended method for searchable custom attributes.
Option D is unrelated: sampling rules control which requests get traced in the first place. They are not used to filter returned results by custom attributes after traces are recorded.

* Visibility Timeout: When an SQS message is processed by a consumer (here, the Lambda function), it's temporarily hidden from other consumers. Visibility timeout controls this duration.
* How It Helps:
* Increase the visibility timeout beyond the maximum processing time your Lambda might typically take for long videos.
* This prevents the message from reappearing in the queue while Lambda is still working, avoiding premature timeouts.
References:
SQS Visibility Timeout: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide
/sqs-visibility-timeout.html