The correct option is Define AppSpec hooks for the ECS deployment and use the AfterAllowTestTraffic event to invoke an AWS Lambda function that runs the tests and if any test fails return an error from the function to trigger rollback. This solution uses AfterAllowTestTraffic to validate the green task set while test traffic is routed and before any production traffic is shifted.

Using the AfterAllowTestTraffic lifecycle event lets the deployment run smoke tests in the blue green window and ensures that returning an error from the invoked Lambda causes CodeDeploy to mark the deployment as failed and automatically roll back to the previous version. The Lambda can run quick checks that complete in under four minutes and any failure is handled natively by CodeDeploy without human intervention.

Insert a stage in CodePipeline before deployment that runs AWS CodeBuild to execute the test scripts and on failures call aws deploy stop-deployment is not ideal because tests run outside the CodeDeploy blue green lifecycle and the approach depends on an out of band CLI call instead of native hook driven rollback.

Add hooks to the CodeDeploy AppSpec and use the AfterAllowTraffic event to run the scripts and on failure stop the deployment with the AWS CLI is incorrect because AfterAllowTraffic fires after production traffic has been shifted so it is too late for pre shift validation.

Create an extra stage in CodePipeline ahead of the deploy stage to invoke an AWS Lambda function that runs the scripts and if errors are detected call aws deploy stop-deployment also bypasses the purpose built AfterAllowTestTraffic hook and relies on manual stop calls, which is less reliable and does not use CodeDeploy automatic rollback behavior.

Full AWS Practitioner Certification Question