The correct choice is Use an AWS SAM template for the serverless app and deploy with AWS CodeDeploy using the Canary5Percent15Minutes deployment type. This approach performs a small initial traffic shift and monitors alarms so it can automatically roll back if errors increase which reduces customer impact.

Using SAM with CodeDeploy gives a built in deployment preference that stages releases and ties pre and post traffic hooks to CloudWatch alarms. The SAM template can auto publish versions and enable the canary deployment configuration so only a small percentage of traffic hits the new code initially. If alarms detect problems the deployment can automatically revert which meets the requirement to reduce risk and enable quick rollbacks.

Use AWS CloudFormation to publish a new Lambda version on each stack update and configure the RoutingConfig of an AWS::Lambda::Alias to weight traffic toward the new version relies on manual alias weight changes and does not provide the integrated pre and post traffic hooks and automated rollback that CodeDeploy offers.

Use AWS CloudFormation to deploy the application and use AWS CodeDeploy with the AllAtOnce deployment type while observing metrics in Amazon CloudWatch pushes all traffic to the new version immediately which maximizes the blast radius and undermines the goal of minimizing impact from failures.

Use AWS AppConfig feature flags to control exposure while updating Lambda code through AWS CloudFormation is useful for configuration toggles but it does not manage Lambda traffic shifting or perform automatic code rollback so it does not satisfy the deployment safety requirement.

Full AWS Practitioner Certification Question