A company is building an application that uses AWS Lambda for compute. All Lambda changes must be deployed using a canary strategy with automatic rollback on failures. The DevOps team must produce infrastructure-as-code and a CI/CD pipeline to meet these requirements. Which combination of steps will satisfy the requirements? (Choose three.)

The correct options collectively provide a robust solution for canary deployments with automatic rollback. AWS SAM (Serverless Application Model) simplifies defining serverless applications and natively supports canary deployments for Lambda functions through AutoPublishAlias and DeploymentPreference, making it the ideal choice for infrastructure as code. A CodeCommit repository and CodePipeline, integrated with CodeBuild, form a standard CI/CD pipeline. CodeBuild can use a buildspec.yml to build and deploy the SAM application, orchestrating the canary deployment. Finally, CloudWatch alarms on the Errors metric for each Lambda function are crucial for monitoring the new version during the canary deployment. If errors exceed a threshold, these alarms can trigger an automatic rollback, fulfilling the requirement for failure detection and rollback. The incorrect options are less suitable. Using AWS::Lambda::Function and AWS::Lambda::Version directly in CloudFormation requires more manual configuration for canary deployments and rollback logic compared to SAM. Creating a CodeDeploy deployment group for Lambda is not the most direct or integrated approach when SAM provides native support. A composite alarm might not provide the granular, per-function monitoring needed for effective canary deployment rollback.