A company uses AWS CloudFormation for deployments and stores application binaries and templates in versioned Amazon S3 buckets. Developers use an EC2 instance as an IDE, pulling binaries from S3, modifying them, running local unit tests, and uploading results back to S3. The team wants to implement CI/CD with AWS CodePipeline and has these requirements: use AWS CodeCommit for source control; automate unit tests and security scans; notify developers when unit tests fail; enable runtime feature toggles and dynamic deployment customization; require lead-developer approval before deployment. Which solution meets these requirements?

The correct solution effectively integrates AWS services to meet all requirements. AWS CodeBuild is ideal for executing unit tests and security scans within a CI/CD pipeline. An Amazon EventBridge rule can reliably detect CodeBuild failures and trigger Amazon SNS notifications to developers. Implementing solution features as AWS CDK constructs with a manifest file allows for dynamic feature toggles and deployment customization. A manual approval stage in CodePipeline directly addresses the requirement for lead-developer approval. Incorrect options: AWS Lambda is not designed for comprehensive unit testing and security scanning of an entire application. AWS Amplify is for frontend development and not suitable for backend feature toggles in this context. Amazon SES is for email sending, not capturing approvals. Jenkins introduces external management overhead and is not a fully native AWS solution. While CloudFormation nested stacks can manage features, CDK constructs offer more programmatic control. Using Lambda for approval is less direct than CodePipeline's built-in manual approval. AWS CodeDeploy is for deployment, not for running unit tests or security scans. CloudWatch alarms monitor metrics, not directly pipeline stage failures for notifications. Packaging features as Docker images and using the AWS CLI for toggling is less integrated and manageable than CDK constructs.