A company uses AWS CodePipeline with AWS CodeDeploy to deploy an application to Amazon ECS using blue/green deployments. The team needs to run test scripts against the green environment (tests finish within 5 minutes) before shifting traffic. If tests fail, the deployment must roll back. Which approach satisfies this requirement?

The correct approach leverages CodeDeploy's built-in blue/green deployment capabilities for ECS. The AfterAllowTestTraffic lifecycle event is specifically designed for running validation tests against the newly deployed (green) environment before traffic is fully shifted. By configuring an AppSpec hook to invoke a Lambda function for testing, CodeDeploy automatically handles the rollback if the Lambda exits with an error, fulfilling the requirement for automated rollback on test failure. The other options are less efficient or incorrect: Adding a CodeBuild or Lambda stage between source and deploy stages would run tests too early, before the green environment is fully provisioned and ready for traffic, or would require manual intervention to stop the CodeDeploy process. Using AfterAllowTraffic is too late; traffic would already be fully shifted to the green environment before tests run, defeating the purpose of pre-shift validation. Manually calling aws deploy stop-deployment from a hook is also less integrated than CodeDeploy's automatic rollback on Lambda error.