Your Python application code is stored in AWS CodeCommit and the deployment pipeline uses AWS CodePipeline in the same account. Company security policy requires all code be scanned for vulnerabilities before production deployment, and any findings must stop the deployment. Which solution meets this requirement?

The correct solution leverages AWS CodeBuild to integrate Amazon CodeGuru Security into the CodePipeline workflow. CodeGuru Security is designed for static application security testing (SAST), making it ideal for scanning source code for vulnerabilities. By creating a CodeBuild project that executes CodeGuru Security and is configured to fail on findings, the pipeline will halt if vulnerabilities are detected, satisfying the security policy. Adding this CodeBuild project as a pre-deploy stage ensures the scan occurs before production deployment. An IAM role with appropriate permissions is crucial for CodeBuild to interact with CodeGuru Security. The other options are incorrect because: Amazon Inspector is primarily for scanning EC2 instances, container images, and Lambda functions for vulnerabilities, not directly for source code in a CodeBuild project. Amazon DevOps Guru is an operational intelligence service that identifies operational issues and anomalies, not a security scanner for code. It's not designed to stop deployments based on code vulnerabilities.