Cheatsheets on Album69

All AWS Services Review

Sun, 04 Oct 2026 00:00:00 +0000

🎯 Quick Service Reference for DOP-C02

Domain 1: SDLC Automation (22%)

CI/CD Core Services

CodePipeline - Orchestrates CI/CD workflows, supports cross-account deployments
CodeBuild - Managed build service, uses buildspec.yml, supports Docker
CodeDeploy - Deployment service, supports blue/green, rolling, canary strategies
CodeCommit - Git repositories (status uncertain — was restricted to existing customers July 2024; verify current availability before the exam)
CodeStar - Retired July 2024. CodeCatalyst - Maintenance mode Nov 2025. See DEPRECATED-SERVICES.md
AppConfig - Managed feature flags and config deployments with validation and auto-rollback
CodeArtifact - Managed artifact repository (npm, Maven, PyPI, NuGet); domain + repository model

Integration & Automation

EventBridge - Event routing, custom events, cross-account event sharing
Step Functions - Workflow orchestration, state machines, error handling
Lambda - Serverless compute, event-driven processing, 15-minute max runtime
API Gateway - REST/HTTP APIs, WebSocket, request/response transformation
X-Ray - Distributed tracing, performance analysis, service maps

Testing & Quality

Automated Testing - Unit, integration, security, performance testing
Artifacts Management - S3 storage, versioning, lifecycle policies
Security Integration - SAST/DAST scanning, vulnerability assessments

Domain 2: Infrastructure as Code (17%)

IaC Services

CloudFormation - Native IaC, YAML/JSON, intrinsic functions, drift detection
CDK - Code-based IaC, synthesizes to CloudFormation, multiple languages
SAM - Serverless application model, extends CloudFormation
Terraform - Third-party IaC, state management, workspaces

Configuration Management

Systems Manager - Parameter Store, Session Manager, Run Command, Patch Manager
Config - Configuration compliance, rules, remediation actions
Service Catalog - Standardized product portfolios, governance

Governance

Organizations - Multi-account management, SCPs, consolidated billing
Control Tower - Landing zones, guardrails, account factory

Domain 3: Resilient Cloud Solutions (15%)

High Availability

Auto Scaling - EC2, ECS, Application Auto Scaling, predictive scaling
Elastic Load Balancing - ALB (Layer 7), NLB (Layer 4), GWLB (Layer 3)
Route 53 - DNS, health checks, failover routing, geolocation
Multi-AZ Deployments - RDS, ElastiCache, EFS cross-AZ replication

Disaster Recovery

S3 Cross-Region Replication - Automatic replication, versioning, lifecycle
RDS Multi-AZ - Synchronous replication, automatic failover
Aurora Global Database - Cross-region read replicas, fast recovery
EKS - Kubernetes orchestration, multi-AZ clusters, managed node groups

Domain 4: Monitoring and Logging (15%)

Monitoring Services

CloudWatch - Metrics, alarms, dashboards, custom metrics, anomaly detection
CloudWatch Logs - Log aggregation, insights, metric filters, retention
X-Ray - Application tracing, service maps, performance bottlenecks
CloudTrail - API logging, governance, compliance, data events

Security Monitoring

Config - Resource compliance, configuration history, rules
GuardDuty - Threat detection, ML-based analysis, findings
Inspector - Vulnerability assessments, network reachability
Security Hub - Centralized security findings, compliance standards

Systems Management

Systems Manager - Operational insights, automation, patch management
Personal Health Dashboard - Service health, maintenance notifications

Domain 5: Incident and Event Response (14%)

Event Processing

EventBridge - Event routing, custom events, third-party integrations
EventBridge Pipes - Point-to-point integrations with filtering and enrichment (source → filter → enrich → target)
EventBridge Scheduler - Serverless cron/rate/one-time scheduling for 200+ AWS API targets
SNS - Pub/sub messaging, mobile push, email, SMS notifications
SQS - Message queuing, FIFO, dead letter queues, visibility timeout
Lambda - Event-driven processing, automatic scaling, multiple triggers

Workflow Orchestration

Step Functions - State machines, parallel processing, error handling
CloudWatch Alarms - Threshold monitoring, composite alarms, actions
Auto Scaling - Dynamic scaling based on metrics, scheduled scaling
Incident Manager - Response plans, escalation, runbooks, dedup string (maintenance mode — know concepts)
ChatOps (Amazon Q in chat) - AWS operations from Slack/Teams; CodePipeline approvals, CloudWatch alarms in chat

Domain 6: Security and Compliance (17%)

Identity & Access

IAM - Users, roles, policies, conditions, cross-account access
IAM Identity Center - Workforce SSO across accounts; permission sets; replaces AWS SSO
Organizations - SCPs, RCPs, account management, consolidated billing
Control Tower - Governance, guardrails, compliance monitoring
Resource Control Policies (RCPs) - Restrict what can be done to resources org-wide (complement to SCPs)

Encryption & Secrets

KMS - Key management, envelope encryption, cross-account access
Secrets Manager - Secret rotation, database credentials, API keys
Certificate Manager - SSL/TLS certificates, automatic renewal

Security Services

WAF - Web application firewall, rate limiting, geo-blocking
Shield - DDoS protection, Standard (free), Advanced (paid)
GuardDuty - Threat detection, behavioral analysis, findings
Macie - Sensitive data discovery in S3; policy findings vs sensitive-data findings
Audit Manager - Automated compliance evidence collection for PCI-DSS, HIPAA, SOC 2, etc.

🔥 High-Impact Integration Patterns

Cross-Account Patterns

Source Account → Assume Role → Target Account
S3 Bucket Policy + KMS Key Policy + IAM Role

CI/CD Pipeline Pattern

CodeCommit → CodeBuild → CodeDeploy → CloudWatch
EventBridge → Lambda → SNS → Step Functions

Event-Driven Architecture

API Gateway → Lambda → EventBridge → [SNS/SQS/Lambda]
CloudWatch Alarm → EventBridge → Lambda → Auto Scaling

Multi-Region Resilience

Route 53 → CloudFront → ALB (Multi-AZ) → Auto Scaling
RDS Multi-AZ → Cross-Region Read Replicas
S3 → Cross-Region Replication

⚡ Critical CLI Commands

CodePipeline

aws codepipeline start-pipeline-execution --name MyPipeline
aws codepipeline get-pipeline-state --name MyPipeline
aws codepipeline stop-pipeline-execution --pipeline-name MyPipeline

CodeBuild

aws codebuild start-build --project-name MyProject
aws codebuild batch-get-builds --ids build-id
aws codebuild list-projects

CloudFormation

aws cloudformation deploy --template-file template.yaml --stack-name MyStack
aws cloudformation describe-stacks --stack-name MyStack
aws cloudformation detect-stack-drift --stack-name MyStack

Auto Scaling

aws autoscaling describe-auto-scaling-groups
aws autoscaling set-desired-capacity --auto-scaling-group-name MyASG --desired-capacity 3
aws autoscaling put-scaling-policy --policy-name MyPolicy

Systems Manager

aws ssm get-parameter --name /myapp/database/url --with-decryption
aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=tag:Environment,Values=prod"
aws ssm start-session --target i-1234567890abcdef0

🎯 Exam Recognition Patterns

Service Selection Triggers

“Cross-account deployment” → IAM roles + trust policies
“Zero-downtime deployment” → Blue/green or canary
“Automatic scaling” → Auto Scaling Groups + CloudWatch
“Event-driven processing” → EventBridge + Lambda
“Secure secrets” → Secrets Manager or Parameter Store (SecureString)
“Infrastructure as Code” → CloudFormation, CDK, or Terraform
“Monitoring and alerting” → CloudWatch + SNS
“Compliance monitoring” → Config + remediation actions

Common Exam Traps

CloudWatch vs CloudTrail vs Config - Metrics vs API logs vs compliance
ALB vs NLB vs GWLB - Layer 7 vs Layer 4 vs Layer 3
Multi-AZ vs Read Replicas - HA vs read scaling
SNS vs SQS - Pub/sub vs queuing
Parameter Store vs Secrets Manager - Configuration vs secrets with rotation

Architecture Decision Trees

Need automatic failover? → Multi-AZ deployment
Need cross-region disaster recovery? → Cross-region replication
Need to process events? → EventBridge + Lambda
Need workflow orchestration? → Step Functions
Need secure parameter storage? → Parameter Store (config) vs Secrets Manager (secrets)

📊 Performance & Cost Optimization

Auto Scaling Optimization

Target Tracking - Maintain specific metric value
Step Scaling - Scale based on alarm breach size
Predictive Scaling - ML-based capacity planning
Scheduled Scaling - Time-based scaling

Lambda Optimization

Memory allocation - Affects CPU and network performance
Provisioned concurrency - Eliminates cold starts
Dead letter queues - Handle failed invocations
Reserved concurrency - Limit concurrent executions

Cost Management

Reserved Instances - Long-term capacity reservations
Spot Instances - Fault-tolerant workloads
S3 Intelligent Tiering - Automatic cost optimization
CloudWatch Logs retention - Manage log storage costs

🚨 Security Best Practices

IAM Principles

Least privilege - Minimum necessary permissions
Role-based access - Use roles instead of users for services
Conditions - Restrict access based on context
Regular reviews - Audit permissions regularly

Encryption Standards

Data at rest - S3, EBS, RDS encryption
Data in transit - TLS/SSL for all communications
Key management - KMS for centralized key management
Envelope encryption - Encrypt data keys with master keys

Network Security

VPC isolation - Separate environments
Security groups - Stateful firewall rules
NACLs - Stateless subnet-level rules
VPC endpoints - Private service access

🎯 Final Exam Checklist

Must Know Cold

Cross-account IAM role assumption process
Blue/green vs rolling vs canary deployment differences
Multi-AZ vs Read Replica use cases
EventBridge event routing and filtering
CloudFormation intrinsic functions (!Ref, !GetAtt, !Sub)
Auto Scaling policy types and triggers
Lambda error handling and retry behavior
Step Functions state types and error handling

Service Integration Patterns

CodePipeline + CodeBuild + CodeDeploy workflow
EventBridge + Lambda + SNS/SQS integration
CloudWatch + Auto Scaling + ELB integration
Route 53 + CloudFront + S3 global architecture
Systems Manager + EC2 + Auto Scaling management

Troubleshooting Scenarios

Pipeline failures and rollback procedures
Auto Scaling issues and debugging
Cross-account access problems
Performance bottlenecks identification
Security incident response procedures

Remember: Think practically, consider cost implications, and always choose the most AWS-native solution when multiple options exist. Good luck! 🚀

Domain 1: SDLC Automation Cheatsheet

Sun, 04 Oct 2026 00:00:00 +0000

Weight: 22% | Focus: CI/CD Pipelines, Testing, Deployment

🔥 MUST KNOW Services

CodePipeline - Orchestration

Stages: Source → Build → Test → Deploy → Monitor
Actions: Source (CodeCommit/GitHub), Build (CodeBuild), Deploy (CodeDeploy/CloudFormation)
Cross-Account: Use IAM roles, not access keys
Artifacts: Stored in S3, encrypted with KMS

CodeBuild - Build Service

buildspec.yml: Root of source, defines build commands
Phases: install → pre_build → build → post_build
Environment: Managed images vs custom Docker
Artifacts: Output location in S3

CodeDeploy - Deployment

Deployment Types: In-place, Blue/Green
Compute Platforms: EC2, Lambda, ECS
Deployment Configs: OneAtATime, HalfAtATime, AllAtOnce
appspec.yml: Defines deployment steps

CodeCommit - Git Repository

Authentication: IAM users, federated access
Encryption: At rest (KMS), in transit (HTTPS/SSH)
Triggers: Lambda, SNS for notifications

⚡ Key Patterns

Multi-Stage Pipeline

Source (CodeCommit) → Build (CodeBuild) → Test → Deploy (CodeDeploy) → Monitor

Cross-Account Deployment

Create cross-account IAM role in target account
Grant CodePipeline permission to assume role
Use role in deployment action

Blue/Green Deployment

EC2: Use Auto Scaling + ELB
Lambda: Use aliases and weighted routing
ECS: Use service with task sets

🎯 Exam Scenarios

Scenario 1: Pipeline fails at build stage

Check buildspec.yml syntax
Verify IAM permissions for CodeBuild
Check environment variables and parameters

Scenario 2: Cross-account deployment not working

Verify cross-account IAM role trust policy
Check S3 bucket policy for artifacts
Ensure KMS key permissions for encryption

Scenario 3: Blue/green deployment stuck

Check health checks configuration
Verify target group settings
Review deployment configuration timeouts

📋 Quick Commands

# Create pipeline
aws codepipeline create-pipeline --pipeline file://pipeline.json

# Start pipeline execution
aws codepipeline start-pipeline-execution --name MyPipeline

# Get pipeline state
aws codepipeline get-pipeline-state --name MyPipeline

# Create CodeBuild project
aws codebuild create-project --name MyProject --source type=CODEPIPELINE

# Create CodeDeploy application
aws deploy create-application --application-name MyApp --compute-platform Server

⚠️ Common Mistakes

Forgetting to enable versioning on S3 artifact bucket
Not configuring proper IAM permissions for cross-account access
Missing buildspec.yml or appspec.yml files
Incorrect deployment configuration for target platform
Not setting up proper health checks for blue/green deployments

🔑 Key Points

CodePipeline orchestrates, doesn’t execute
Cross-account requires IAM roles, not users
Artifacts must be in same region as pipeline
Blue/Green requires health checks and load balancers
buildspec.yml and appspec.yml are mandatory files

Domain 2: Configuration Management & Infrastructure as Code Cheatsheet

Sun, 04 Oct 2026 00:00:00 +0000

Weight: 17% | Focus: CloudFormation, CDK, Config, Systems Manager

🔥 MUST KNOW Services

CloudFormation - Infrastructure as Code

Templates: JSON/YAML, max 51,200 characters
Stacks: Collection of resources, regional
StackSets: Deploy across accounts/regions
Drift Detection: Compare actual vs template
Change Sets: Preview changes before execution

AWS CDK - Code-based IaC

Constructs: L1 (CFn resources), L2 (opinionated), L3 (patterns)
Apps: Top-level construct container
Stacks: Unit of deployment
Synthesis: Converts to CloudFormation

AWS Config - Configuration Compliance

Rules: AWS managed, custom (Lambda)
Conformance Packs: Collection of rules
Remediation: Automatic fix via SSM/Lambda
Multi-Account: Aggregator for organization

Systems Manager - Operations Management

Parameter Store: Secure configuration storage
Session Manager: Shell access without SSH
Patch Manager: OS patching automation
State Manager: Desired state configuration

⚡ Key Patterns

CloudFormation Stack Dependencies

# Export from Stack A
Outputs:
 VPCId:
 Value: !Ref MyVPC
 Export:
 Name: !Sub "${AWS::StackName}-VPC-ID"

# Import in Stack B
VpcId: !ImportValue "StackA-VPC-ID"

Cross-Account CloudFormation

Create execution role in target account
Trust source account
Use role in StackSet operations

Config Remediation

RemediationConfiguration:
 ConfigRuleName: !Ref MyConfigRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-DeleteUnusedSecurityGroup

🎯 Exam Scenarios

Scenario 1: Stack update fails

Check for resource dependencies
Review change set before execution
Verify IAM permissions for resources
Check for resource limits

Scenario 2: Cross-account deployment fails

Verify execution role in target account
Check trust policy allows source account
Ensure S3 template bucket is accessible

Scenario 3: Config rule shows non-compliant

Check rule parameters and scope
Verify resource configuration
Review evaluation logic
Check remediation configuration

📋 Quick Commands

# CloudFormation
aws cloudformation create-stack --stack-name MyStack --template-body file://template.yaml
aws cloudformation update-stack --stack-name MyStack --template-body file://template.yaml
aws cloudformation detect-stack-drift --stack-name MyStack

# CDK
cdk init app --language typescript
cdk synth
cdk deploy
cdk diff

# Config
aws configservice put-config-rule --config-rule file://rule.json
aws configservice start-config-rules-evaluation --config-rule-names MyRule

# Systems Manager
aws ssm get-parameter --name "/myapp/database/url" --with-decryption
aws ssm start-session --target i-1234567890abcdef0

🏗️ CloudFormation Intrinsic Functions

!Ref: Reference parameter/resource
!GetAtt: Get resource attribute
!Join: Join values with delimiter
!Sub: Substitute variables
!ImportValue: Import cross-stack value
!If: Conditional logic

🔧 Systems Manager Key Features

Parameter Store: Free tier (10,000 params), Advanced (charges apply)
Session Manager: No inbound ports, logged to CloudWatch
Patch Manager: Maintenance windows, patch baselines
State Manager: Associations, compliance reporting

⚠️ Common Mistakes

Circular dependencies in CloudFormation stacks
Not using change sets for critical updates
Forgetting to enable Config recorder
Hardcoding values instead of using parameters
Not setting up proper IAM roles for cross-account access

🔑 Key Points

CloudFormation is declarative, idempotent
StackSets require service-linked roles
Config requires delivery channel and recorder
Parameter Store supports hierarchical naming
CDK synthesizes to CloudFormation templates

Domain 3: Resilient Cloud Solutions Cheatsheet

Sun, 04 Oct 2026 00:00:00 +0000

Weight: 15% | Focus: High Availability, Auto Scaling, Load Balancing, Multi-AZ

🔥 MUST KNOW Services

Auto Scaling - Dynamic Capacity

ASG: EC2 instances across AZs
Scaling Policies: Target Tracking, Step, Simple
Health Checks: EC2, ELB
Lifecycle Hooks: Custom launch/terminate actions

Elastic Load Balancer - Traffic Distribution

ALB: Layer 7 (HTTP/HTTPS), path/host routing
NLB: Layer 4 (TCP/UDP), static IPs, high performance
GWLB: Layer 3, third-party appliances
Health Checks: Determine target availability

RDS Multi-AZ - Database HA

Multi-AZ: Synchronous replication, automatic failover
Read Replicas: Asynchronous, read scaling
Cross-Region: Disaster recovery
Failover: 60-120 seconds

Route 53 - DNS & Global Load Balancing

Routing Policies: Simple, Weighted, Latency, Failover, Geolocation
Health Checks: HTTP/HTTPS/TCP monitoring
Alias Records: Free, automatic IP resolution

S3 Cross-Region Replication - Data Resilience

CRR: Cross-region disaster recovery
SRR: Same-region compliance
RTC: 15-minute replication SLA

⚡ Key Patterns

Multi-AZ Web Application

Route 53 → CloudFront → ALB (Multi-AZ) → ASG (Multi-AZ) → RDS Multi-AZ

Auto Scaling Policies

Target Tracking: Maintain specific metric value
Step Scaling: Scale based on metric ranges
Predictive: ML-based forecasting

RDS Failover Scenarios

Primary DB failure → Automatic failover to standby
AZ outage → Failover within 60-120 seconds
Maintenance → Zero-downtime updates

🎯 Exam Scenarios

Scenario 1: Application not scaling properly

Check Auto Scaling policies and thresholds
Verify CloudWatch metrics are being published
Review health check configuration
Check cooldown periods

Scenario 2: Database failover taking too long

Verify Multi-AZ is enabled
Check application connection string (use endpoint, not IP)
Review security group rules
Ensure proper error handling in application

Scenario 3: Global application latency issues

Implement Route 53 latency-based routing
Use CloudFront for static content
Deploy read replicas in multiple regions
Consider Aurora Global Database

📋 Quick Commands

# Auto Scaling
aws autoscaling create-auto-scaling-group --auto-scaling-group-name MyASG
aws autoscaling put-scaling-policy --policy-name ScaleUp --auto-scaling-group-name MyASG

# Load Balancer
aws elbv2 create-load-balancer --name MyALB --subnets subnet-12345 subnet-67890
aws elbv2 create-target-group --name MyTargets --protocol HTTP --port 80

# RDS
aws rds create-db-instance --db-instance-identifier MyDB --multi-az
aws rds reboot-db-instance --db-instance-identifier MyDB --force-failover

# Route 53
aws route53 create-health-check --type HTTP --resource-path /health
aws route53 change-resource-record-sets --hosted-zone-id Z123 --change-batch file://change.json

# S3 Replication
aws s3api put-bucket-replication --bucket MyBucket --replication-configuration file://replication.json

🏗️ Resilience Design Principles

High Availability

Deploy across multiple AZs
Use load balancers for distribution
Implement health checks
Plan for component failures

Fault Tolerance

Design for graceful degradation
Implement circuit breakers
Use retry mechanisms with backoff
Isolate failure domains

Disaster Recovery

RTO: Recovery Time Objective
RPO: Recovery Point Objective
Strategies: Backup/Restore, Pilot Light, Warm Standby, Multi-Site

🔧 Auto Scaling Best Practices

Use target tracking for most scenarios
Set appropriate health check grace periods
Implement lifecycle hooks for stateful apps
Monitor scaling activities and metrics
Use mixed instance types for cost optimization

⚠️ Common Mistakes

Not enabling Multi-AZ for production databases
Using IP addresses instead of DNS names
Insufficient health check grace periods
Not testing failover procedures
Forgetting cross-zone load balancing
Not implementing proper retry logic in applications

🔑 Key Points

Multi-AZ ≠ Read Replicas (HA vs Scaling)
ALB supports path/host routing, NLB for performance
Auto Scaling maintains desired capacity across AZs
Route 53 health checks enable DNS failover
RDS failover is automatic with Multi-AZ
S3 replication requires versioning enabled

Domain 4: Monitoring and Logging Cheatsheet

Sun, 04 Oct 2026 00:00:00 +0000

Weight: 15% | Focus: CloudWatch, X-Ray, CloudTrail, Config

🔥 MUST KNOW Services

CloudWatch - Metrics & Monitoring

Metrics: Standard (5min), Detailed (1min), Custom
Alarms: Metric, Composite, Anomaly Detection
Logs: Centralized logging, retention policies
Dashboards: Visual monitoring interface

X-Ray - Distributed Tracing

Traces: End-to-end request tracking
Segments: Individual service calls
Service Map: Visual application topology
Sampling: Control trace collection rate

CloudTrail - API Auditing

Management Events: Control plane operations (free)
Data Events: Data plane operations (charged)
Insights: Unusual activity detection
Multi-Region: Global event logging

Config - Configuration Monitoring

Configuration Items: Resource snapshots
Rules: Compliance evaluation
Conformance Packs: Rule collections
Remediation: Automatic compliance fixes

⚡ Key Patterns

Comprehensive Monitoring Stack

Application → X-Ray (Tracing) → CloudWatch (Metrics/Logs) → CloudTrail (Audit)

Log Aggregation

EC2/Lambda/ECS → CloudWatch Logs → Log Groups → Metric Filters → Alarms

Compliance Monitoring

Resources → Config Rules → Non-Compliance → Remediation Actions

🎯 Exam Scenarios

Scenario 1: Application performance issues

Enable X-Ray tracing to identify bottlenecks
Create CloudWatch custom metrics for business KPIs
Set up alarms for response time and error rates
Use CloudWatch Insights for log analysis

Scenario 2: Security incident investigation

Check CloudTrail for API calls and user activity
Review VPC Flow Logs for network traffic
Use Config to track resource configuration changes
Correlate events across multiple log sources

Scenario 3: Cost optimization monitoring

Set up billing alarms in CloudWatch
Use Cost Explorer with custom metrics
Monitor resource utilization metrics
Create dashboards for cost tracking

📋 Quick Commands

# CloudWatch
aws cloudwatch put-metric-data --namespace "MyApp" --metric-data MetricName=Errors,Value=1
aws cloudwatch put-metric-alarm --alarm-name HighCPU --metric-name CPUUtilization
aws logs create-log-group --log-group-name /aws/lambda/my-function

# X-Ray
aws xray get-trace-summaries --time-range-type TimeRangeByStartTime
aws xray get-service-graph --start-time 2024-01-01T00:00:00 --end-time 2024-01-01T23:59:59

# CloudTrail
aws cloudtrail create-trail --name MyTrail --s3-bucket-name my-trail-bucket
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreateUser

# Config
aws configservice put-config-rule --config-rule file://rule.json
aws configservice get-compliance-details-by-config-rule --config-rule-name required-tags

📊 CloudWatch Key Metrics

EC2

CPUUtilization, NetworkIn/Out, DiskReadOps/WriteOps
StatusCheckFailed (Instance/System)

RDS

CPUUtilization, DatabaseConnections, FreeableMemory
ReadLatency, WriteLatency, ReplicaLag

Lambda

Duration, Errors, Throttles, ConcurrentExecutions
DeadLetterErrors, IteratorAge (for streams)

ALB

RequestCount, TargetResponseTime, HTTPCode_Target_2XX_Count
HealthyHostCount, UnHealthyHostCount

🔍 X-Ray Integration

Supported Services

Lambda (automatic), EC2 (daemon), ECS (sidecar)
API Gateway, ALB, SNS, SQS
RDS, DynamoDB (via SDK)

Sampling Rules

{
 "version": 2,
 "default": {
 "fixed_target": 1,
 "rate": 0.1
 },
 "rules": [
 {
 "description": "High priority service",
 "service_name": "critical-service",
 "http_method": "*",
 "url_path": "*",
 "fixed_target": 2,
 "rate": 0.5
 }
 ]
}

📋 CloudTrail Event Types

Management Events (Free)

IAM actions, EC2 RunInstances, S3 CreateBucket
VPC operations, Route 53 changes

Data Events (Charged)

S3 object operations (GetObject, PutObject)
Lambda function invocations
DynamoDB item operations

Insight Events

Unusual patterns in management events
Machine learning-based detection

⚠️ Common Mistakes

Not enabling detailed monitoring when needed
Forgetting to set up log retention policies
Not configuring proper IAM permissions for cross-account logging
Missing X-Ray daemon configuration
Not setting up CloudTrail in all regions
Ignoring CloudWatch costs for high-volume logs

🔑 Key Points

CloudWatch Logs retention is forever by default (set retention!)
X-Ray requires SDK instrumentation or daemon
CloudTrail logs to S3, can integrate with CloudWatch Logs
Config requires delivery channel and recorder setup
Custom metrics can have up to 10 dimensions
Composite alarms combine multiple alarm states

Domain 5: Incident and Event Response Cheatsheet

Sun, 04 Oct 2026 00:00:00 +0000

Weight: 14% | Focus: EventBridge, Lambda, SNS/SQS, Step Functions, CloudWatch Alarms

🔥 MUST KNOW Services

EventBridge - Event Routing

Event Buses: Default, Custom, Partner
Rules: Event pattern matching and routing
Targets: Lambda, SNS, SQS, Step Functions, etc.
Schema Registry: Event structure management

Lambda - Serverless Compute

Triggers: 200+ event sources
Concurrency: 1000 default, reserved/provisioned
Error Handling: DLQ, retry, exponential backoff
Monitoring: CloudWatch Logs, X-Ray tracing

SNS/SQS - Messaging

SNS: Pub/Sub, fan-out, mobile push
SQS: Queue, FIFO, DLQ, visibility timeout
Integration: SNS → SQS for reliable processing

Step Functions - Workflow Orchestration

State Types: Task, Choice, Parallel, Wait, Pass, Fail
Workflows: Standard (long-running), Express (high-volume)
Error Handling: Retry, Catch, Fallback

CloudWatch Alarms - Threshold Monitoring

States: OK, ALARM, INSUFFICIENT_DATA
Types: Metric, Composite, Anomaly Detection
Actions: SNS, Auto Scaling, EC2, Lambda

⚡ Key Patterns

Event-Driven Incident Response

CloudWatch Alarm → EventBridge → Lambda → [SNS + Step Functions + SQS]

Fan-Out Processing

EventBridge → SNS Topic → Multiple SQS Queues → Lambda Functions

Automated Remediation

GuardDuty Finding → EventBridge → Step Functions → [Isolate + Notify + Investigate]

🎯 Exam Scenarios

Scenario 1: Automated incident response

CloudWatch Alarm triggers EventBridge rule
EventBridge routes to Lambda for initial response
Lambda creates Step Functions workflow for complex remediation
SNS sends notifications to operations team

Scenario 2: High-volume event processing

Use Express Step Functions for high throughput
Implement SQS with batch processing
Configure DLQ for failed events
Monitor with CloudWatch metrics

Scenario 3: Cross-account event handling

Set up cross-account EventBridge permissions
Use IAM roles for service integration
Implement proper error handling and monitoring
Ensure event delivery and processing

📋 Quick Commands

# EventBridge
aws events put-rule --name MyRule --event-pattern file://pattern.json
aws events put-targets --rule MyRule --targets Id=1,Arn=arn:aws:lambda:us-east-1:123456789012:function:MyFunction

# Lambda
aws lambda create-function --function-name MyFunction --runtime python3.9 --role MyRole --handler index.handler
aws lambda invoke --function-name MyFunction --payload '{"key":"value"}' response.json

# SNS/SQS
aws sns create-topic --name MyTopic
aws sqs create-queue --queue-name MyQueue
aws sns subscribe --topic-arn MyTopicArn --protocol sqs --notification-endpoint MyQueueArn

# Step Functions
aws stepfunctions create-state-machine --name MyStateMachine --definition file://definition.json --role-arn MyRole
aws stepfunctions start-execution --state-machine-arn MyStateMachineArn --input '{"key":"value"}'

# CloudWatch Alarms
aws cloudwatch put-metric-alarm --alarm-name HighCPU --metric-name CPUUtilization --threshold 80

🚨 CloudWatch Alarm Actions

Supported Actions

SNS: Send notifications
Auto Scaling: Scale EC2 instances
EC2: Stop, terminate, reboot, recover
Systems Manager: Execute automation

Alarm States

OK: Metric within threshold
ALARM: Metric breached threshold
INSUFFICIENT_DATA: Not enough data points

🔄 Step Functions State Types

Choice: Conditional branching

Parallel: Execute branches concurrently

Wait: Delay execution

Pass: Pass input to output

Fail: Stop execution with failure

Succeed: Stop execution successfully

📨 SNS/SQS Integration Patterns

Fan-Out Pattern

SNS Topic → Multiple SQS Queues → Different Lambda Functions

FIFO Processing

Application → SQS FIFO Queue → Lambda (ordered processing)

Dead Letter Queue

SQS Queue → Failed Messages → DLQ → Manual Investigation

⚡ Lambda Best Practices

Performance

Use provisioned concurrency for consistent latency
Optimize memory allocation (CPU scales with memory)
Reuse connections and clients outside handler
Use environment variables for configuration

Error Handling

Configure DLQ for async invocations
Implement exponential backoff for retries
Use proper exception handling
Monitor with CloudWatch and X-Ray

⚠️ Common Mistakes

Not configuring DLQ for failed Lambda invocations
Forgetting to set SQS visibility timeout properly
Not implementing proper error handling in Step Functions
Missing IAM permissions for cross-service integration
Not monitoring EventBridge rule metrics
Hardcoding values instead of using environment variables

🔑 Key Points

EventBridge is regional, use replication for multi-region
Lambda has 15-minute max execution time
SQS visibility timeout should be 6x Lambda timeout
Step Functions Standard vs Express (cost vs features)
SNS delivers at-least-once, SQS FIFO exactly-once
CloudWatch Alarms evaluate every period, not continuously

Domain 6: Security and Compliance Cheatsheet

Sun, 04 Oct 2026 00:00:00 +0000

Weight: 17% | Focus: IAM, KMS, Secrets Manager, WAF, Certificate Manager

🔥 MUST KNOW Services

IAM - Identity & Access Management

Users: Long-term credentials, MFA
Roles: Temporary credentials, cross-account access
Policies: JSON documents, least privilege
Groups: Collection of users with shared permissions

KMS - Key Management Service

CMK: Customer Managed Keys ($1/month)
AWS Managed: Free, automatic rotation
Envelope Encryption: Data keys for large objects
Cross-Region: Multi-region keys available

Secrets Manager - Secrets Storage & Rotation

Automatic Rotation: RDS, Aurora, DocumentDB, Redshift
Cross-Region Replication: Disaster recovery
Integration: Lambda, ECS, RDS
Versioning: AWSCURRENT, AWSPENDING, AWSPREVIOUS

WAF - Web Application Firewall

Rule Types: Rate-based, IP, Geo, String match
Managed Rules: AWS and marketplace rules
Integration: CloudFront, ALB, API Gateway
Logging: CloudWatch Logs, S3, Kinesis

Certificate Manager - SSL/TLS Certificates

Public Certs: Free for AWS services
Private CA: Additional charges
Validation: DNS (automated), Email
Integration: CloudFront, ALB, API Gateway

⚡ Key Patterns

Cross-Account Access

Source Account → Assume Role → Target Account Role → Access Resources

Secrets Rotation

Secrets Manager → Lambda Rotation Function → Database → Update Secret

Encryption at Rest

Application → KMS Data Key → Encrypt Data → Store Encrypted Data + Encrypted Key

🎯 Exam Scenarios

Scenario 1: Cross-account S3 access

Create IAM role in target account
Configure trust policy for source account
Grant S3 permissions to role
Source account assumes role to access S3

Scenario 2: Database password rotation

Store credentials in Secrets Manager
Enable automatic rotation with Lambda
Update application to retrieve from Secrets Manager
Monitor rotation success with CloudWatch

Scenario 3: Web application security

Deploy WAF with managed rule groups
Configure rate limiting and geo-blocking
Set up SSL termination with ACM
Monitor attacks with CloudWatch metrics

📋 Quick Commands

# IAM
aws iam create-role --role-name MyRole --assume-role-policy-document file://trust-policy.json
aws iam attach-role-policy --role-name MyRole --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess
aws sts assume-role --role-arn arn:aws:iam::123456789012:role/MyRole --role-session-name MySession

# KMS
aws kms create-key --description "My encryption key"
aws kms encrypt --key-id alias/my-key --plaintext "Hello World"
aws kms decrypt --ciphertext-blob fileb://encrypted-data

# Secrets Manager
aws secretsmanager create-secret --name MySecret --secret-string '{"username":"admin","password":"secret"}'
aws secretsmanager get-secret-value --secret-id MySecret
aws secretsmanager rotate-secret --secret-id MySecret

# WAF
aws wafv2 create-web-acl --name MyWebACL --scope REGIONAL --default-action Allow={}
aws wafv2 associate-web-acl --web-acl-arn MyWebACLArn --resource-arn MyALBArn

# Certificate Manager
aws acm request-certificate --domain-name example.com --validation-method DNS
aws acm list-certificates

🔐 IAM Policy Evaluation Logic

Order of Evaluation

Explicit Deny - Always wins
Explicit Allow - Required for access
Default Deny - No explicit allow = deny

Policy Types

Identity-based: Attached to users, groups, roles
Resource-based: Attached to resources (S3, KMS)
Permission Boundaries: Maximum permissions
SCPs: Organization-level guardrails

🔑 KMS Key Types & Usage

Symmetric Keys (AES-256)

Same key for encrypt/decrypt
Never leaves AWS unencrypted
Used for envelope encryption

Asymmetric Keys

Key pair (public/private)
Public key can be downloaded
Used for encrypt/decrypt or sign/verify

Key Rotation

Automatic: Yearly for customer managed keys
Manual: Create new key, update applications

🔄 Secrets Manager Rotation

Supported Services

RDS (MySQL, PostgreSQL, Oracle, SQL Server)
Aurora (MySQL, PostgreSQL)
DocumentDB, Redshift

Rotation Process

Create: Generate new secret version
Set: Update service with new credentials
Test: Verify new credentials work
Finish: Mark new version as current

🛡️ WAF Rule Types

Rate-based Rules

Limit requests per 5-minute window
Automatic blocking when exceeded
Configurable rate limit

Managed Rule Groups

Core Rule Set: OWASP Top 10
Known Bad Inputs: Common attack patterns
SQL Database: SQL injection protection

📜 Certificate Manager

Validation Methods

DNS: Add CNAME record (recommended)
Email: Click link in validation email

Certificate Types

Public: Free for AWS services
Private: Issued by AWS Private CA (charged)
Imported: Third-party certificates

⚠️ Common Mistakes

Using root user for daily operations
Not enabling MFA for privileged accounts
Hardcoding credentials in code
Not rotating access keys regularly
Overly permissive IAM policies
Not monitoring failed authentication attempts
Forgetting to validate certificates before expiration

🔑 Key Points

IAM is global, policies are JSON
Roles are preferred over users for applications
KMS keys are regional, multi-region keys available
Secrets Manager charges per secret per month
WAF operates at Layer 7 (application layer)
ACM certificates are free for AWS services
Cross-account access requires proper trust policies

DOP-C02 Exam Strategy Guide

Sun, 04 Oct 2026 00:00:00 +0000

🎯 Exam Overview

Exam Details

Duration: 180 minutes (3 hours)
Questions: 75 questions (65 scored + 10 unscored; multiple choice and multiple response)
Passing Score: 750/1000 (approximately 75%)
Cost: $300 USD
Validity: 3 years
Format: Computer-based testing (Pearson VUE)

Domain Breakdown

Domain	Weight	Questions	Time Allocation
1. SDLC Automation	22%	~14-15	40 minutes
2. Infrastructure as Code	17%	~11	31 minutes
3. Resilient Cloud Solutions	15%	~10	27 minutes
4. Monitoring and Logging	15%	~10	27 minutes
5. Incident and Event Response	14%	~9	25 minutes
6. Security and Compliance	17%	~11	31 minutes

⏰ Time Management Strategy

Three-Pass Approach

First Pass (90 minutes) - Answer all questions you’re confident about
Second Pass (60 minutes) - Review flagged questions and difficult scenarios
Final Pass (30 minutes) - Final review and educated guesses

Per-Question Time Allocation

Simple factual questions: 1-2 minutes
Scenario-based questions: 3-4 minutes
Complex multi-service questions: 4-5 minutes
Flag and move on: If unsure after 3 minutes

Time Checkpoints

60 minutes: Should have completed ~22 questions
120 minutes: Should have completed ~43 questions
150 minutes: Should have completed all questions (first pass)

📝 Question Types and Strategies

1. Factual Knowledge Questions (30%)

Example: “Which AWS service provides managed Git repositories?”

DOP-C02 Final Exam Tips - Last Night Review

Sun, 04 Oct 2026 00:00:00 +0000

🎯 Exam Format

75 Questions (65 scored + 10 unscored) | 180 Minutes | Pass Score: 750/1000
Multiple Choice and Multiple Response
Scenario-based questions with real-world situations

⚡ Time Management

2.7 minutes per question average
Flag difficult questions and return later
Read questions carefully - look for key words
Eliminate wrong answers first

🔥 High-Impact Topics (Study These First)

Domain 1 (22%) - CI/CD Automation

✅ CodePipeline cross-account deployments
✅ Blue/green vs rolling deployments
✅ buildspec.yml and appspec.yml syntax
✅ CodeDeploy deployment configurations

Domain 3 (15%) - Resilient Solutions

✅ Multi-AZ vs Read Replicas
✅ Auto Scaling policies and health checks
✅ Route 53 routing policies and failover
✅ Load balancer types and use cases

Domain 2 (17%) - Infrastructure as Code

✅ CloudFormation intrinsic functions
✅ StackSets cross-account deployment
✅ Config rules and remediation
✅ Systems Manager Parameter Store

Domain 5 (14%) - Incident Response

✅ EventBridge event patterns and routing
✅ Step Functions state types and error handling
✅ Lambda error handling and DLQ
✅ SNS/SQS integration patterns

🚨 Common Exam Traps

Service Confusion

CloudWatch vs CloudTrail: Metrics/Logs vs API Auditing
Config vs CloudTrail: Configuration vs API calls
SNS vs SQS: Push vs Pull messaging
ALB vs NLB: Layer 7 vs Layer 4

Cross-Account Patterns

Always use IAM roles, never access keys
Trust policies must allow source account
S3 bucket policies for artifact sharing
KMS key policies for encrypted resources

Deployment Strategies

Blue/Green: Zero downtime, full environment swap
Rolling: Gradual replacement, some downtime
Canary: Gradual traffic shift, risk mitigation
Immutable: New instances, terminate old

📝 Key Formulas & Numbers

RDS

Multi-AZ failover: 60-120 seconds
Read replica lag: Asynchronous
Backup retention: 0-35 days

Lambda

Max execution time: 15 minutes
Default concurrency: 1000
Memory range: 128MB - 10,240MB

Auto Scaling

Health check grace period: 300 seconds default
Cooldown period: 300 seconds default
Scale-out: Faster | Scale-in: Slower

CloudFormation

Template size limit: 51,200 characters
Stack limit per region: 200
Parameter limit: 200

🎯 Scenario Recognition Patterns

“Zero Downtime Deployment” → Blue/Green

“Cross-Account Access” → IAM Roles + Trust Policies

“High Availability Database” → RDS Multi-AZ

“Global Application” → Route 53 + CloudFront + Multi-Region

“Automated Compliance” → Config Rules + Remediation

“Event-Driven Architecture” → EventBridge + Lambda

“Secure Secrets” → Secrets Manager + Rotation

“Web Application Security” → WAF + Shield + ACM

⚠️ Last-Minute Gotchas

IAM

Root user ≠ Administrator user
Explicit deny always wins
Cross-account requires trust policy

KMS

Customer managed keys cost $1/month
AWS managed keys are free
Multi-region keys have same key ID

S3

Cross-region replication requires versioning
Objects existing before CRR setup are NOT replicated
Same-region replication for compliance

CloudFormation

Outputs can be exported for cross-stack reference
DependsOn for explicit dependencies
DeletionPolicy: Retain/Snapshot/Delete

🔧 CLI Command Patterns

Always Remember

# Assume role pattern
aws sts assume-role --role-arn ROLE_ARN --role-session-name SESSION_NAME

# CloudFormation with parameters
aws cloudformation create-stack --stack-name NAME --template-body file://template.yaml --parameters file://params.json

# CodePipeline execution
aws codepipeline start-pipeline-execution --name PIPELINE_NAME

# Auto Scaling policy
aws autoscaling put-scaling-policy --auto-scaling-group-name ASG_NAME --policy-name POLICY_NAME

🎯 Final 30-Minute Review

Read These Sections

Domain weights and key services
Cross-account deployment patterns
Blue/green deployment steps
Multi-AZ vs Read Replica differences
EventBridge event routing patterns
IAM policy evaluation logic
Common service integration patterns

Mental Checklist

✅ Can I explain cross-account IAM roles?
✅ Do I know when to use each deployment strategy?
✅ Can I differentiate between AWS services?
✅ Do I understand event-driven architectures?
✅ Can I design resilient multi-AZ solutions?

💪 You’ve Got This!

Remember: The exam tests practical knowledge and real-world scenarios. Trust your preparation and think like a DevOps engineer solving actual problems.

DOP-C02 Practice Scenarios - Exam Simulation

Sun, 04 Oct 2026 00:00:00 +0000

🎯 High-Frequency Exam Scenarios

Scenario 1: Cross-Account CI/CD Pipeline

Question: A company needs to deploy applications from a development account to production accounts across multiple regions. The solution must be secure, automated, and support rollback capabilities.

Key Requirements:

Cross-account deployment
Multi-region support
Automated rollback
Security best practices

Solution Pattern:

Dev Account: CodeCommit → CodePipeline → CodeBuild
 ↓
Cross-Account IAM Role Assumption
 ↓
Prod Accounts: CloudFormation → Application Deployment
 ↓
CloudWatch Monitoring → Automated Rollback (if needed)

Implementation Steps: