A SaaS platform built an EventBridge-triggered Lambda that restarts unhealthy services, but a bad deployment caused it to thrash hundreds of instances and saturate APIs. Leadership wants remediation to continue automatically under strict safety limits. Which controlled remediation design enforces safety constraints with circuit breakers and backoff?

Step Functions orchestration with circuit breaker checks, concurrency limits, and exponential backoff keeps remediation automatic while enforcing safety constraints together. The breaker can stop remediation when failure thresholds are exceeded, concurrency limits bound the blast radius across unhealthy services, and exponential backoff reduces API pressure by spacing retries farther apart. Fixed-interval retries fail because they keep retrying at a constant rate during sustained failures, potentially saturating APIs again. Unlimited concurrent executions fail because remediation can still fan out across services at once, defeating the concurrency safeguard even with a breaker and backoff. Isolated per-invocation breaker checks fail because each execution sees only its own failures; without an aggregate view, fleet-wide thrashing may not trip protection. For exams, remember that backoff or concurrency limits alone do not satisfy a requirement for both circuit breakers and controlled retries. In practice, review Step Functions execution history and CloudWatch concurrency and API-throttling metrics, then test a failed restart to confirm backoff grows and a breaker pauses new remediation without human intervention.