A REST API (API Gateway + Lambda) is deployed with CodePipeline/CodeBuild/CodeDeploy. Recent releases caused widespread customer-impacting errors. The DevOps team wants automatic rollback to the most recent stable version when an error occurs, affecting as few customers as possible. Which solution is most operationally efficient?

The correct solution leverages CodeDeploy's LambdaCanary10Percent10Minutes deployment strategy with automatic rollbacks. Canary deployments minimize customer impact by gradually shifting traffic to the new version, allowing for early detection of issues. The 10Percent10Minutes setting means 10% of traffic is shifted for 10 minutes, providing a testing window before full deployment. A CloudWatch alarm monitoring API Gateway HTTP 502 errors (indicating bad gateway issues, often due to Lambda errors) triggers the automatic rollback, reverting to the last stable version and preventing widespread outages. LambdaAllAtOnce deployments (options 1 and 3) shift all traffic immediately, maximizing customer impact if an error occurs. Manual rollbacks (options 3 and 4) introduce delays and human error, which is less operationally efficient than an automated process. While CloudWatch Logs metric filters can detect errors, a direct CloudWatch alarm on API Gateway metrics is more straightforward for this specific use case.