A company defines its app with the AWS Cloud Development Kit (CDK) and deploys it using a pipeline built with AWS CodePipeline and AWS CodeBuild. They want to add unit tests to the pipeline and ensure the deployment only continues if none of the unit tests fail. Which two steps will enforce that requirement?

The first correct option ensures that unit tests are executed before deployment. If any test fails, configuring the OnFailure property to ABORT for the CodeBuild phase will stop the pipeline, preventing the deployment of faulty code. This directly addresses the requirement to halt deployment upon test failure. The second correct option describes how to write effective unit tests for CDK applications. Using the AWS CDK assertions library, specifically template.hasResourceProperties, allows developers to validate that the synthesized CloudFormation template contains resources with the expected configurations. This is a crucial step in ensuring the infrastructure defined by the CDK application is correct before deployment. Adding --rollback true to cdk deploy (an incorrect option) handles deployment failures but doesn't prevent deployment if unit tests fail beforehand. Adding --require-approval any-change (another incorrect option) adds a manual approval step, which is not directly related to automated unit test failures. Creating a test that runs cdk diff and fails if resources change (an incorrect option) is useful for preventing unexpected infrastructure changes but doesn't validate the functional correctness of the application code or the intended resource properties, which unit tests are designed to do.