Album69

Amazon API Gateway

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). API Gateway is the front door for serverless APIs. Know REST vs HTTP vs WebSocket, throttling, caching, and integration types.

1. API Types

Type	Protocol	Use Case	Key Features
REST API	HTTP/HTTPS	Full-featured APIs	Caching, usage plans, request validation, API keys
HTTP API	HTTP/HTTPS	Low-latency, low-cost APIs	Simpler, cheaper, JWT auth, no caching
WebSocket API	WebSocket	Real-time bidirectional	Chat, gaming, live dashboards

REST API vs HTTP API:

Amazon CloudFront

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). CloudFront is more than a CDN — it’s a security layer, edge compute platform, and global distribution mechanism. Know origins, cache behaviors, OAC, and WAF integration.

1. Overview

Amazon CloudFront is a global content delivery network (CDN) with 400+ edge locations. It caches content close to users, reduces origin load, and integrates with WAF, Shield, and Lambda@Edge for security and edge compute.

2. Core Components

Distributions

Web distribution: HTTP/HTTPS content (static files, APIs, streaming)
One distribution can have multiple origins and cache behaviors

Origins

Origin Type	Use Case
S3 bucket	Static websites, file downloads
ALB / NLB	Dynamic content, APIs
EC2 / custom HTTP	Any HTTP server
API Gateway	Serverless APIs
MediaStore / MediaPackage	Video streaming

Cache Behaviors

Rules that map URL path patterns to origins and cache settings
Default behavior (*) catches all unmatched paths
More specific paths take precedence (e.g., /api/* before *)

Distribution
├── /api/* → ALB origin (no caching, forward all headers)
├── /static/* → S3 origin (cache 1 year, compress)
└── * → ALB origin (default behavior)

3. Origin Access Control (OAC)

Restricts S3 bucket access to CloudFront only — prevents direct S3 access:

Amazon DynamoDB

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). DynamoDB is a managed key-value/document database that can provide low-latency access at scale when the access pattern, partition key, capacity, and consistency model fit. Know partition keys, GSIs, streams, DAX, Global Tables, and capacity modes.

1. Overview

Amazon DynamoDB is a fully managed NoSQL key-value and document database. It removes database-server provisioning, but table design, capacity mode, quotas, partition-key distribution, consistency, and cost still require architecture decisions. Latency depends on workload and configuration; do not treat a typical service characteristic as an end-to-end guarantee.

Amazon EBS

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). EBS is the block storage behind most EC2 workloads. At the Professional level, focus on volume type selection, snapshot mechanics, and encryption — not just “what is EBS.”

1. Volume Type Selection

Type	Backed by	Use when
gp3	SSD, baseline 3,000 IOPS + 125 MiB/s, independently scalable	Default choice — decouple IOPS/throughput from size
gp2	SSD, bursty IOPS tied to volume size	Legacy; gp3 is cheaper and more flexible for new workloads
io2 / io2 Block Express	SSD, provisioned IOPS, 99.999% durability	I/O-intensive databases needing sustained provisioned IOPS
st1	HDD, throughput-optimized	Big data, log processing — sequential access
sc1	HDD, cold	Infrequent access, lowest cost

Decision rule: Start with gp3 (the current default). Move to io2 only when the workload needs provisioned IOPS beyond what gp3 offers or multi-attach. Use st1/sc1 only for throughput-oriented, non-latency-sensitive workloads — never for boot volumes or databases.

Amazon EC2 Advanced

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). At the professional level, focus on purchasing options, placement groups, instance types for specific workloads, and Spot integration patterns.

1. Purchasing Options

Option	Use Case	Commitment	Discount
On-Demand	Unpredictable, short-term	None	None
Reserved Instances (RI)	Steady-state, predictable	1 or 3 years	Up to 72%
Savings Plans	Flexible steady-state	1 or 3 years	Up to 66%
Spot Instances	Fault-tolerant, flexible	None	Up to 90%
Dedicated Hosts	Licensing, compliance	On-demand or reserved	Varies
Dedicated Instances	Isolation requirement	On-demand or reserved	~10%
Capacity Reservations	Guaranteed capacity in AZ	None (pay on-demand rate)	None

Reserved Instances vs Savings Plans

Feature	Reserved Instances	Savings Plans
Flexibility	Locked to instance type/region	Flexible across instance family, region, OS
Types	Standard, Convertible, Scheduled	Compute, EC2 Instance, SageMaker
Convertible RIs	Can exchange for different type	N/A
Compute Savings Plans	N/A	Most flexible — covers EC2, Lambda, Fargate

Spot Instances

AWS can reclaim with 2-minute warning
Best for: batch processing, CI/CD workers, stateless web servers, HPC
Spot Fleet: mix of Spot + On-Demand across instance types and AZs
EC2 Auto Scaling with Spot: use mixed instances policy for resilience
Spot Blocks (deprecated): verify current availability

2. Placement Groups

Type	Behavior	Use Case
Cluster	Same rack, same AZ	Low latency, high throughput (HPC, ML training)
Spread	Different racks, different AZs	Critical instances, max fault isolation (max 7 per AZ)
Partition	Groups of instances on separate racks	Distributed systems (Hadoop, Kafka, Cassandra)

Cluster: highest network performance (up to 100 Gbps with enhanced networking) but single point of failure at rack level
Spread: max 7 instances per AZ per group — not for large clusters
Partition: up to 7 partitions per AZ, hundreds of instances per partition; each partition is isolated from others

3. Instance Types for Specific Workloads

Family	Optimized For	Examples
C (Compute)	CPU-intensive: web servers, batch, ML inference	c6i, c7g
M (General)	Balanced: app servers, small databases	m6i, m7g
R (Memory)	In-memory databases, caches, big data	r6i, r7g
I (Storage)	High IOPS local NVMe: NoSQL, data warehousing	i3, i4i
G/P (GPU)	ML training, graphics rendering	g5, p4d
Inf (Inferentia)	ML inference (AWS custom chip)	inf2
Trn (Trainium)	ML training (AWS custom chip)	trn1
X (Extra memory)	SAP HANA, large in-memory databases	x2idn
T (Burstable)	Variable workloads with CPU credits	t3, t4g

Graviton (ARM-based)

AWS-designed ARM processors (g suffix: m7g, c7g, r7g)
Up to 40% better price/performance than x86 equivalents
Requires ARM-compatible software/containers
Supported by most Linux distributions and managed services

4. Enhanced Networking and ENA

Elastic Network Adapter (ENA): up to 100 Gbps, lower latency, lower CPU overhead
Elastic Fabric Adapter (EFA): ENA + OS-bypass for HPC/ML (MPI workloads)
Required for cluster placement groups to achieve maximum throughput
Enable with: aws ec2 modify-instance-attribute --ena-support

5. Storage Options

Storage	Type	Use Case
EBS gp3	SSD, network-attached	General purpose, boot volumes
EBS io2 Block Express	SSD, high IOPS	Databases requiring >64K IOPS
EBS st1	HDD, throughput-optimized	Sequential reads: log processing, data warehouse
EBS sc1	HDD, cold	Infrequently accessed large data
Instance Store	NVMe, ephemeral	Temp data, buffers, caches — lost on stop/terminate

EBS Multi-Attach: io1/io2 volumes can attach to multiple instances in same AZ (cluster-aware file systems only)
EBS Snapshots: incremental, stored in S3, can copy cross-region for DR

6. Auto Scaling Integration

Always deploy across multiple AZs with Auto Scaling
Use mixed instances policy for Spot + On-Demand resilience
Warm pools: pre-initialized instances reduce scale-out latency
Instance refresh: rolling replacement of instances with new launch template
Lifecycle hooks: pause instance launch/termination for custom actions (e.g., drain connections, run scripts)

7. Exam Scenarios

Scenario 1: A company runs a tightly coupled HPC workload requiring maximum network throughput between instances. What is the recommended configuration?

Amazon ECS

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). ECS is the AWS-native container orchestration service. Know Fargate vs EC2 launch types, task definitions, service discovery, and deployment strategies.

1. Overview

Amazon Elastic Container Service (ECS) is a fully managed container orchestration service. It runs Docker containers on either AWS-managed infrastructure (Fargate) or EC2 instances you manage.

2. Launch Types

Feature	Fargate	EC2
Infrastructure management	AWS manages	You manage EC2 instances
Scaling	Task-level	Instance + task level
Cost model	Per vCPU/memory per second	EC2 instance cost + task overhead
Use case	Simplicity, variable workloads	GPU, custom AMI, cost optimization at scale
Spot support	Fargate Spot	EC2 Spot instances
Visibility	Limited OS access	Full OS access

3. Core Concepts

Task Definition

Blueprint for a container (image, CPU, memory, ports, env vars, IAM role, logging)
Versioned — new deployments create new revisions
Supports multiple containers per task (sidecar pattern)

Service

Maintains desired number of running tasks
Integrates with ALB/NLB for load balancing
Supports rolling updates, blue/green deployments (via CodeDeploy)
Auto Scaling based on CPU, memory, or custom CloudWatch metrics

Cluster

Logical grouping of tasks and services
For EC2 launch type: also manages the EC2 instances (via ECS Container Agent)

4. IAM Roles

Role	Purpose
Task Role	Permissions for the application running in the container (e.g., S3 access)
Task Execution Role	Permissions for ECS agent (pull ECR image, write CloudWatch logs, read Secrets Manager)

Both roles are required. Task role = application permissions. Execution role = ECS infrastructure permissions.

Amazon EFS

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). EFS is the shared POSIX file system for Linux workloads. Know performance modes, throughput modes, and when to use EFS vs EBS vs FSx.

1. Overview

Amazon Elastic File System (EFS) is a fully managed, scalable NFS file system for Linux workloads. Multiple EC2 instances, ECS tasks, Lambda functions, and EKS pods can mount the same EFS file system simultaneously.

2. Performance Modes

Mode	Use Case	Latency
General Purpose (default)	Web serving, CMS, home directories	Low (sub-ms)
Max I/O	Big data, media processing, parallel workloads	Higher latency, higher aggregate throughput

Set at creation time — cannot change after creation.

Amazon EKS

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). EKS is the managed Kubernetes service. Know node types, networking (VPC CNI), IAM integration (IRSA), and when to choose EKS over ECS.

1. Overview

Amazon Elastic Kubernetes Service (EKS) is a managed Kubernetes control plane. AWS manages the Kubernetes API server and etcd. You manage the worker nodes (or use Fargate).

EKS vs ECS:

Factor	EKS	ECS
Orchestrator	Kubernetes (open standard)	AWS proprietary
Portability	High — runs anywhere Kubernetes runs	AWS-only
Complexity	Higher — Kubernetes expertise required	Lower
Ecosystem	Large Kubernetes ecosystem	AWS-native integrations
Use case	Kubernetes workloads, multi-cloud, existing K8s	AWS-native, simpler container workloads

2. Node Types

Type	Description	Use Case
Managed Node Groups	AWS provisions and manages EC2 nodes	Standard workloads, automated updates
Self-managed nodes	You manage EC2 instances	Custom AMI, specific configurations
Fargate profiles	Serverless pods — no EC2 management	Variable workloads, simplicity

Fargate Profiles

Define which pods run on Fargate using namespace and label selectors
No node management, no capacity planning
Does not support DaemonSets or privileged containers
Each pod gets its own isolated compute environment

3. Networking — VPC CNI

EKS uses the AWS VPC CNI plugin by default:

Amazon ElastiCache

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). ElastiCache is the in-memory caching layer. Know Redis vs Memcached, caching patterns, and when to use DAX instead.

1. Redis vs Memcached

Feature	Redis	Memcached
Data structures	Strings, hashes, lists, sets, sorted sets, bitmaps, streams	Strings only
Persistence	Yes (RDB snapshots, AOF)	No
Replication	Yes (primary + replicas)	No
Multi-AZ	Yes (automatic failover)	No
Clustering	Yes (Redis Cluster — sharding)	Yes (multi-node)
Pub/Sub	Yes	No
Lua scripting	Yes	No
Geospatial	Yes	No
Use case	Sessions, leaderboards, pub/sub, complex data, HA	Simple caching, horizontal scaling, multi-threaded

Choose Redis for almost all production use cases — it supports HA, persistence, and complex data structures. Choose Memcached only when you need simple, multi-threaded caching with no persistence requirement.

Amazon EventBridge

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3. EventBridge is the event routing backbone. Know event buses, rules, pipes, scheduler, and cross-account patterns.

1. Overview

Amazon EventBridge is a serverless event bus that connects AWS services, SaaS applications, and custom applications using events. It enables loosely coupled, event-driven architectures.

2. Event Buses

Bus Type	Source	Use Case
Default	AWS services	Receive events from all AWS services automatically
Custom	Your applications	Route application events
Partner	SaaS partners (Zendesk, Datadog, etc.)	Receive SaaS events

3. Rules

Rules match incoming events and route them to targets:

Amazon FSx

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). FSx covers four file system types. Know which to use for Windows, HPC, NetApp, and OpenZFS workloads.

1. FSx File System Types

Type	Protocol	Use Case
FSx for Windows File Server	SMB	Windows applications, Active Directory, home directories
FSx for Lustre	Lustre	HPC, ML training, financial modeling, media processing
FSx for NetApp ONTAP	NFS, SMB, iSCSI	Enterprise storage, multi-protocol, data management
FSx for OpenZFS	NFS	Linux workloads needing ZFS features, migration from on-prem ZFS

2. FSx for Windows File Server

Fully managed Windows file system built on Windows Server
SMB protocol — compatible with all Windows applications
Active Directory integration — user authentication via AWS Managed AD or self-managed AD
DFS Namespaces: aggregate multiple file shares under a single namespace
Multi-AZ: active-standby configuration for HA; automatic failover
Single-AZ: lower cost, no automatic failover
Supports: shadow copies (VSS), data deduplication, encryption at rest (KMS)

Use Cases

Lift-and-shift Windows file servers
Home directories for Windows users
SharePoint, SQL Server (user databases), .NET applications

3. FSx for Lustre

High-performance parallel file system for compute-intensive workloads
Sub-millisecond latency, hundreds of GB/s throughput, millions of IOPS
S3 integration: link to S3 bucket; lazy-load data on first access; write results back to S3
Deployment types:
- Scratch: temporary, no replication, highest performance — for short-term processing
- Persistent: replicated within AZ, long-term storage — for ongoing workloads

Use Cases

ML training (SageMaker integration)
HPC simulations
Media rendering and transcoding
Financial risk modeling
Genomics processing

4. FSx for NetApp ONTAP

Fully managed NetApp ONTAP file system
Supports NFS, SMB, and iSCSI simultaneously (multi-protocol)
SnapMirror: replicate to on-premises NetApp or another FSx ONTAP
FlexClone: instant zero-cost clones of volumes (dev/test environments)
Tiering: automatically tier cold data to S3
Multi-AZ and Single-AZ deployment options

Use Cases

Lift-and-shift NetApp workloads
Multi-protocol shared storage
Dev/test with instant clones
Hybrid cloud with on-premises NetApp replication

5. FSx for OpenZFS

Fully managed OpenZFS file system
NFS protocol (v3, v4, v4.1, v4.2)
ZFS features: snapshots, clones, compression, data integrity checksums
Up to 1 million IOPS, sub-millisecond latency
Single-AZ only

Use Cases

Migrate on-premises ZFS workloads to AWS
Linux workloads needing ZFS data management features
Dev/test with instant snapshots and clones

6. Comparison Table

Feature	Windows FS	Lustre	ONTAP	OpenZFS
Protocol	SMB	Lustre	NFS/SMB/iSCSI	NFS
OS	Windows	Linux	Both	Linux
AD integration	Yes	No	Yes	No
S3 integration	No	Yes	No	No
Multi-AZ	Yes	No	Yes	No
Multi-protocol	No	No	Yes	No
HPC performance	No	Yes	No	No

7. Exam Scenarios

Scenario 1: A company is migrating Windows file servers to AWS. Users authenticate with Active Directory. What is the solution?

Amazon Kinesis

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). Kinesis is the real-time streaming platform. Know Data Streams vs Firehose vs Data Analytics and when to use Kinesis vs SQS vs MSK.

1. Kinesis Services Overview

Service	Purpose
Kinesis Data Streams	Real-time data streaming, custom consumers
Kinesis Data Firehose	Managed delivery to S3, Redshift, OpenSearch, Splunk
Kinesis Data Analytics	Real-time SQL/Apache Flink analytics on streams
Kinesis Video Streams	Stream video from devices for ML/analytics

2. Kinesis Data Streams

Architecture

Producers → Kinesis Data Stream (shards) → Consumers
(EC2, Lambda, [shard 1] [shard 2] (Lambda, KCL app,
 IoT, mobile) [shard 3] [shard 4] Firehose, Analytics)

Shards

Each shard: 1 MB/s write, 2 MB/s read
Scale by adding/removing shards (resharding)
Enhanced fan-out: 2 MB/s per consumer per shard (dedicated throughput)
Partition key determines which shard receives the record

Retention

Default: 24 hours
Extended: up to 365 days (additional cost)
Records are immutable — consumers track position with sequence numbers

Consumers

Consumer Type	Throughput	Use Case
Standard (polling)	2 MB/s shared across all consumers	Low-volume, cost-sensitive
Enhanced fan-out	2 MB/s per consumer per shard	Multiple consumers, low latency

Lambda Integration

Lambda polls shards (event source mapping)
Batch size: 1–10,000 records
Parallelization factor: up to 10 concurrent Lambda invocations per shard
Failed batches: retry until success or record expires (use bisect on error + DLQ)

3. Kinesis Data Firehose

Fully managed delivery stream — no shards, no consumers to manage
Near real-time: buffers data (60 seconds or 1–128 MB) before delivery
Destinations: S3, Redshift, OpenSearch, Splunk, HTTP endpoints, Datadog
Built-in data transformation via Lambda
Built-in format conversion: JSON → Parquet/ORC (for Athena/Redshift Spectrum)
Automatic scaling — no capacity management

Producers → Firehose → (optional Lambda transform) → S3 / Redshift / OpenSearch

4. Kinesis Data Analytics

Run SQL queries or Apache Flink applications on streaming data
Input: Kinesis Data Streams or Firehose
Output: Kinesis Data Streams, Firehose, Lambda
Use cases: real-time dashboards, anomaly detection, time-series analytics

5. Kinesis vs SQS vs MSK

Feature	Kinesis Data Streams	SQS	MSK (Kafka)
Ordering	Per shard	FIFO only	Per partition
Retention	24h–365 days	Up to 14 days	Configurable (days–forever)
Consumers	Multiple (replay)	One per message	Multiple consumer groups
Replay	Yes	No	Yes
Throughput	MB/s per shard	Unlimited	Very high
Management	Low	None	Higher (MSK managed)
Use case	Real-time streaming, replay	Work queues, decoupling	Kafka ecosystem, high throughput

Key differentiator: Kinesis and Kafka support replay (re-read old records). SQS does not — messages are deleted after consumption.

Amazon MSK (Managed Streaming for Apache Kafka)

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). MSK is the answer when the question mentions Kafka, existing Kafka workloads, or Kafka ecosystem tools.

1. Overview

Amazon MSK is a fully managed Apache Kafka service. It provisions, configures, and maintains Kafka brokers and ZooKeeper nodes. You retain full Kafka API compatibility.

When to choose MSK over Kinesis:

Existing Kafka workloads or Kafka expertise
Need Kafka ecosystem tools (Kafka Connect, Kafka Streams, Schema Registry)
Very high throughput requirements
Long message retention (days to forever)
Multiple consumer groups with independent offsets

2. MSK vs Kinesis Data Streams

Feature	MSK	Kinesis Data Streams
API	Kafka API	AWS proprietary
Ecosystem	Full Kafka ecosystem	AWS-native only
Retention	Configurable (unlimited)	24h–365 days
Consumer groups	Multiple independent	Multiple (enhanced fan-out)
Management	More (broker config, ZooKeeper)	Less (shard management only)
Throughput	Very high	High (per shard)
Pricing	Per broker hour	Per shard hour + data
Use case	Kafka migration, ecosystem tools	AWS-native streaming

3. MSK Serverless

No broker management — fully serverless
Automatically scales capacity
Pay per usage (storage + throughput)
Supports standard Kafka APIs
Use for: variable workloads, new Kafka applications without capacity planning

4. MSK Connect

Managed Kafka Connect — run connectors without managing workers
Source connectors: ingest data from databases, S3, etc. into Kafka
Sink connectors: deliver Kafka data to S3, OpenSearch, databases, etc.
Auto-scaling connector workers

5. Security

Encryption in transit: TLS between clients and brokers
Encryption at rest: KMS
Authentication: TLS mutual auth, SASL/SCRAM, IAM (MSK Serverless)
VPC: brokers deployed in your VPC subnets
Private connectivity: access via VPC, VPN, or Direct Connect

6. Exam Scenarios

Scenario 1: A company is migrating an on-premises Kafka cluster to AWS. They use Kafka Connect, Kafka Streams, and Schema Registry. What is the solution?

Amazon OpenSearch Service

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). OpenSearch is the answer for full-text search and log analytics. Know ingestion patterns, domain design, and integration with CloudWatch and Kinesis.

1. Overview

Amazon OpenSearch Service (formerly Elasticsearch Service) is a managed search and analytics engine. It is used for full-text search, log analytics, real-time application monitoring, and clickstream analytics.

When to choose OpenSearch:

Full-text search with relevance scoring
Log aggregation and analysis (ELK stack replacement)
Real-time analytics on streaming data
Geospatial search

2. Core Concepts

Domain: an OpenSearch cluster (collection of nodes)
Index: collection of documents (like a database table)
Document: JSON object stored in an index
Shard: subdivision of an index for distribution across nodes
Replica shard: copy of a shard for redundancy and read scaling

3. Domain Design

Node Types

Type	Purpose
Data nodes	Store and search data
Master nodes	Cluster management (dedicated recommended for production)
UltraWarm nodes	Low-cost warm storage for infrequently accessed data
Cold storage	S3-backed, lowest cost for rarely accessed data

High Availability

Deploy across 3 AZs with 3 dedicated master nodes
Use Multi-AZ with Standby for automatic failover (OpenSearch 2.x+)
Replica shards in different AZs for data redundancy

4. Ingestion Patterns

Source	Method
CloudWatch Logs	CloudWatch Logs subscription filter → Lambda → OpenSearch
Kinesis Data Firehose	Firehose delivery stream → OpenSearch (built-in integration)
DynamoDB Streams	DynamoDB Streams → Lambda → OpenSearch
S3	S3 → Lambda → OpenSearch
Application	Direct HTTP API (REST)
IoT	IoT Rules → Kinesis → OpenSearch

Kinesis Data Firehose is the recommended pattern for high-volume log ingestion — managed, buffered, no Lambda required.

Amazon RDS and Aurora

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). Compare managed relational options by engine compatibility, application requirements, availability, replication, operations, and cost. Know Multi-AZ versus read replicas, Aurora Global Database, and current Aurora Serverless options.

1. RDS Overview

Amazon RDS is a managed relational database service supporting: MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Db2.

Multi-AZ Deployment

Synchronous replication to a standby in another AZ
Automatic failover; duration and client recovery depend on engine/deployment, connection handling, and DNS/client caching
Standby is not readable — for HA only, not read scaling
Supports Multi-AZ DB Cluster (2 readable standbys) for MySQL and PostgreSQL

Read Replicas

Asynchronous replication — slight lag
Read-replica counts and supported engines/features vary; check current quotas and engine documentation
Can be in different regions (cross-region read replicas)
Can be promoted to standalone DB (for DR or migration)
Readable — offload read traffic from primary

Multi-AZ vs Read Replicas

Feature	Multi-AZ	Read Replica
Purpose	High availability	Read scaling, DR
Replication	Synchronous	Asynchronous
Readable	No (standby)	Yes
Failover	Automatic	Manual promotion
Cross-region	No (same region)	Yes

2. Aurora Overview

Aurora is an AWS relational database engine compatible with MySQL and PostgreSQL. Compatibility does not guarantee identical engine behavior; performance and availability depend on engine/version, cluster design, instance class, and workload. Benchmark representative queries and transactions.

Amazon Route 53

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 1, 2, 3. Route 53 is tested heavily for routing policies, health checks, hybrid DNS, and multi-region failover. Know every routing policy and when to use it.

1. Overview

Amazon Route 53 is a highly available, scalable DNS service that also provides domain registration, health checking, and traffic routing. At the SAP-C02 level, focus on routing policies, health checks, hybrid DNS with Resolver, and multi-region architectures.

2. Routing Policies

Policy	Use Case	Key Behavior
Simple	Single resource, no health checks	Returns all values; client picks randomly
Weighted	A/B testing, gradual traffic shifts	Distributes traffic by weight (0–255)
Latency	Route to lowest-latency region	Based on AWS latency measurements, not geography
Failover	Active-passive DR	Routes to secondary when primary health check fails
Geolocation	Route by user’s geographic location	Country, continent, or default
Geoproximity	Route by proximity with bias	Requires Traffic Flow; can shift traffic with bias value
Multivalue Answer	Simple load balancing with health checks	Returns up to 8 healthy records
IP-based	Route by client IP CIDR	Route specific IP ranges to specific endpoints

Weighted Routing — Traffic Shifting

Record A: weight 90 → us-east-1 (production)
Record B: weight 10 → us-west-2 (canary)

Set weight to 0 to stop sending traffic to a record without deleting it.

Amazon S3 Advanced

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3, 4. S3 is foundational to almost every architecture. At the professional level, focus on storage classes, lifecycle, replication, encryption, and access patterns.

1. Storage Classes

Class	Use Case	Retrieval	Min Duration	Min Size
S3 Standard	Frequently accessed	Immediate	None	None
S3 Intelligent-Tiering	Unknown/changing access	Immediate	None	None
S3 Standard-IA	Infrequent, rapid access	Immediate	30 days	128 KB
S3 One Zone-IA	Infrequent, single AZ	Immediate	30 days	128 KB
S3 Glacier Instant Retrieval	Archive, millisecond access	Milliseconds	90 days	128 KB
S3 Glacier Flexible Retrieval	Archive, minutes-hours	Minutes–hours	90 days	40 KB
S3 Glacier Deep Archive	Long-term archive	12–48 hours	180 days	40 KB

Intelligent-Tiering automatically moves objects between access tiers based on usage — no retrieval fees, small monitoring fee per object.

Amazon SQS and SNS

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). SQS and SNS are the decoupling backbone. Know Standard vs FIFO, fan-out patterns, DLQ, and when to use each.

1. Amazon SQS

Queue Types

Feature	Standard	FIFO
Throughput	Unlimited	3,000 msg/s with batching, 300 without
Ordering	Best-effort	Strict (First-In-First-Out)
Delivery behavior	At-least-once delivery; messages can arrive more than once and out of order	Orders delivery within a message group; deduplicates sends within the deduplication interval
Deduplication	No	Yes (5-minute dedup window)
Use case	High throughput, order not critical	Order-critical, financial transactions

Key Settings

Setting	Description
Visibility timeout	Time a message is hidden after being received (default 30s, max 12h)
Message retention	How long messages stay in queue (default 4 days, max 14 days)
Delivery delay	Delay before message is visible (default 0, max 15 min)
Max message size	256 KB (use S3 + SQS Extended Client for larger)
Long polling	Wait up to 20s for messages — reduces empty responses and cost

Dead Letter Queue (DLQ)

Messages that fail processing N times are moved to DLQ
Set maxReceiveCount on the source queue’s redrive policy
DLQ must be same type as source (Standard → Standard DLQ, FIFO → FIFO DLQ)
Use DLQ alarms to detect processing failures

Lambda Integration

Lambda polls SQS (event source mapping)
Batch size: 1–10,000 messages
Lambda scales up to 1,000 concurrent executions for Standard queues
Failed batches: entire batch returned to queue (or sent to DLQ if configured)
Use bisect on error to identify the failing message in a batch

2. Amazon SNS

Overview

SNS is a pub/sub messaging service. Publishers send messages to topics; subscribers receive messages.

AWS Auto Scaling

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). Auto Scaling is fundamental to every HA architecture. Know scaling policies, warm pools, lifecycle hooks, and multi-service scaling.

1. Overview

AWS Auto Scaling automatically adjusts capacity for EC2, ECS, DynamoDB, Aurora, and other services based on demand. It maintains availability and optimizes cost.

Services covered by AWS Auto Scaling:

EC2 Auto Scaling Groups (ASG)
ECS Service Auto Scaling
DynamoDB table/index capacity
Aurora read replicas
Spot Fleet

2. EC2 Auto Scaling Group (ASG)

Key Settings

Setting	Description
Min capacity	Minimum number of instances always running
Max capacity	Maximum instances allowed
Desired capacity	Target number of instances
Launch template	Defines instance configuration (AMI, type, SG, IAM role)
AZ distribution	Spread instances across AZs for HA

Scaling Policies

Policy	Trigger	Use Case
Target Tracking	Maintain a metric at a target value	CPU at 60%, ALB requests per target
Step Scaling	CloudWatch alarm thresholds with step adjustments	Fine-grained control
Simple Scaling	Single CloudWatch alarm	Legacy, not recommended
Scheduled Scaling	Time-based	Known traffic patterns
Predictive Scaling	ML-based forecast	Proactive scaling before demand

Target Tracking is the recommended default — simplest to configure and most responsive.

AWS CDK

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). CDK lets you define infrastructure in familiar programming languages. Know constructs, stacks, apps, and how CDK relates to CloudFormation.

1. Overview

AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using familiar programming languages (TypeScript, Python, Java, C#, Go). CDK synthesizes to CloudFormation templates.

CDK vs CloudFormation:

Feature	CDK	CloudFormation
Language	TypeScript, Python, Java, C#, Go	JSON / YAML
Abstraction	High-level constructs	Low-level resource definitions
Reuse	Libraries, npm/PyPI packages	Nested stacks, modules
IDE support	Full (autocomplete, type checking)	Limited
Output	Synthesizes to CloudFormation	Native
Learning curve	Requires programming knowledge	Lower for simple templates

2. Core Concepts

App

Root of the CDK application
Contains one or more stacks

Stack

Unit of deployment — maps to a CloudFormation stack
Contains constructs (resources)
Can be deployed to a specific account and region

Constructs

Three levels of abstraction:

AWS CloudFormation

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3, 4. CloudFormation is the AWS-native IaC service. Know stacks, StackSets, nested stacks, drift detection, and change sets.

1. Overview

AWS CloudFormation provisions and manages AWS infrastructure as code using JSON or YAML templates. It ensures consistent, repeatable deployments and tracks resource state.

2. Template Anatomy

AWSTemplateFormatVersion: "2010-09-09"
Description: "My stack"

Parameters:
 Environment:
 Type: String
 AllowedValues: [dev, staging, prod]

Mappings:
 RegionMap:
 us-east-1:
 AMI: ami-12345678

Conditions:
 IsProd: !Equals [!Ref Environment, prod]

Resources:
 MyBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: !Sub "my-bucket-${Environment}"

Outputs:
 BucketName:
 Value: !Ref MyBucket
 Export:
 Name: !Sub "${AWS::StackName}-BucketName"

3. Stack Operations

Operation	Description
Create	Provision all resources in template
Update	Modify existing stack — uses change sets
Delete	Remove all stack resources
Detect drift	Compare actual vs expected resource configuration

Change Sets

Preview changes before applying an update
Shows: resources to add, modify, replace, or delete
Replace = resource will be deleted and recreated (potential downtime)
Always review change sets before executing in production

Stack Policies

JSON policy that protects stack resources from unintended updates
Deny updates to specific resources (e.g., production databases)

4. Nested Stacks

Break large templates into reusable components:

AWS Config

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 1, 3. Config is the detective compliance engine. Know rules, conformance packs, aggregators, and remediation patterns.

1. Overview

AWS Config continuously records AWS resource configurations and evaluates them against desired rules. It provides a configuration history, change notifications, and compliance dashboards.

Problems it solves:

No visibility into what changed, when, and by whom
Manual compliance auditing across accounts
Inability to detect configuration drift from security baselines

2. Core Concepts

Concept	Description
Configuration recorder	Records resource configurations and changes
Delivery channel	Sends snapshots and change notifications to S3 and SNS
Config rule	Evaluates resource configurations against desired state
Conformance pack	Collection of Config rules deployed as a unit
Aggregator	Collects Config data from multiple accounts/regions
Remediation action	SSM Automation document triggered on non-compliance

3. Config Rules

Managed Rules (AWS-provided)

Common exam-relevant managed rules:

AWS Control Tower

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 1 (26%). Control Tower is the AWS-recommended way to set up and govern multi-account environments. Know how it relates to Organizations, SCPs, and Config.

1. Overview

AWS Control Tower automates the setup of a secure, multi-account AWS environment (landing zone) based on AWS best practices. It builds on top of AWS Organizations, AWS Config, CloudTrail, IAM Identity Center, and Service Catalog.

Problems it solves:

Manual, error-prone multi-account setup
Inconsistent security baselines across accounts
No automated guardrails for new accounts
Complex compliance tracking across accounts

2. Core Components

Landing Zone

The overall multi-account environment set up by Control Tower. Includes:

AWS Direct Connect

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 1 (26%). Direct Connect is the standard answer for dedicated, low-latency hybrid connectivity. Know connection types, VIFs, resilience patterns, and encryption.

1. Overview

AWS Direct Connect (DX) provides a dedicated private network connection from on-premises to AWS, bypassing the public internet. It offers consistent bandwidth, lower latency, and reduced data transfer costs compared to internet-based VPN.

Problems it solves:

Inconsistent internet-based connectivity to AWS
High data transfer costs over the internet
Latency-sensitive workloads requiring predictable performance
Compliance requirements for private connectivity

2. Connection Types

Type	Speed	How
Dedicated connection	1, 10, or 100 Gbps	Physical port at DX location, ordered directly from AWS
Hosted connection	50 Mbps – 10 Gbps	Ordered through an APN partner; shares partner’s port

Dedicated: longer lead time (weeks), full port, higher cost
Hosted: faster provisioning, flexible bandwidth, shared infrastructure

3. Virtual Interfaces (VIFs)

VIFs are logical connections over a DX connection:

AWS Global Accelerator

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). Know when to use Global Accelerator vs CloudFront — a common exam trap.

1. Overview

AWS Global Accelerator improves availability and performance of applications by routing traffic through the AWS global network using anycast static IP addresses. It is not a CDN — it does not cache content.

2. How It Works

User → Nearest AWS Edge Location (anycast IP)
 └── AWS Global Network (private backbone)
 └── Optimal endpoint (ALB, NLB, EC2, EIP)

Two static anycast IP addresses assigned per accelerator (global, never change)
Traffic enters the AWS network at the nearest edge location
Routed over AWS private backbone — avoids public internet congestion
Endpoints can be in multiple regions — Global Accelerator routes to the healthiest, lowest-latency endpoint

3. Global Accelerator vs CloudFront

Feature	Global Accelerator	CloudFront
Content caching	No	Yes
Protocol	TCP, UDP	HTTP/HTTPS
Static IPs	Yes (2 anycast IPs)	No
Use case	Non-HTTP (gaming, IoT, VoIP), static IPs, TCP/UDP	HTTP/HTTPS content delivery, caching
Health checks	Yes (endpoint-level)	Via origin health
Failover	Automatic, ~30 seconds	Via Route 53 health checks
DDoS protection	Shield Standard	Shield Standard
Edge caching	No	Yes

Key rule: If the question mentions static IPs, TCP/UDP (non-HTTP), or instant failover → Global Accelerator. If it mentions caching or HTTP content delivery → CloudFront.

AWS IAM

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 1, 2, 3. IAM is the security foundation of every AWS architecture. At the professional level, focus on cross-account patterns, federation, permission boundaries, and policy evaluation.

1. Overview

AWS Identity and Access Management (IAM) controls who can do what on which AWS resources. At the SAP-C02 level, the focus is on:

Cross-account role assumption
Identity federation (SAML, OIDC, web identity)
Permission boundaries and policy evaluation order
Least-privilege design at scale
Integration with Organizations, IAM Identity Center, and resource-based policies

2. Policy Types and Evaluation Order

Policy Type	Attached To	Purpose
Identity-based policy	IAM user/role/group	Grant permissions to a principal
Resource-based policy	AWS resource (S3, KMS, etc.)	Grant access to a resource from any principal
Permission boundary	IAM user/role	Maximum permissions a principal can have
SCP	Organizations account/OU	Maximum permissions for all principals in an account
Session policy	AssumeRole call	Restrict permissions for a specific session
RCP	Organizations account/OU	Restrict what resources can accept

Evaluation Logic (simplified)

1. Explicit DENY anywhere → DENY (final)
2. SCP allows the action? No → DENY
3. RCP allows the action? No → DENY
4. Resource-based policy allows? → ALLOW (for cross-account, both identity + resource policy needed)
5. Permission boundary allows? No → DENY
6. Session policy allows? No → DENY
7. Identity-based policy allows? Yes → ALLOW

3. Cross-Account Role Assumption

The standard pattern for cross-account access:

AWS IAM Identity Center

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 1 (26%). IAM Identity Center is the AWS-recommended solution for workforce identity across multiple accounts. Know permission sets, identity sources, and attribute-based access control.

1. Overview

AWS IAM Identity Center (formerly AWS SSO) provides centralized access management for human users across all AWS accounts in an organization and business applications. It replaces the need for individual IAM users in every account.

Problems it solves:

Managing IAM users in dozens of accounts
Inconsistent access controls across accounts
No single sign-on for AWS console and CLI
Complex SAML federation setup per account

2. Core Concepts

Identity Sources

Source	Use Case
IAM Identity Center directory (built-in)	Small teams, no existing IdP
Active Directory (AWS Managed AD or AD Connector)	Enterprise with on-premises AD
External IdP (Okta, Azure AD, Ping, etc.) via SAML 2.0 / SCIM	Enterprise with existing cloud IdP

Only one identity source can be active at a time. Changing it requires careful planning.

AWS IoT (Core & Greengrass)

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). IoT appears in event-driven and edge scenarios. Know the ingestion paths, the Greengrass vs Outposts distinction, and offline behavior.

1. Overview

AWS IoT connects devices to AWS services for ingestion, processing, and management. At the Professional level, the exam tests architectural choices: how device data enters AWS, what happens during intermittent connectivity, and what runs where.

2. IoT Core Ingestion Paths

Path	Behavior
Message broker (MQTT pub/sub)	Standard path; devices publish, rules engine and subscribers consume
Basic Ingest	Routes device messages directly to the rules engine, skipping the broker pub/sub path

Choose Basic Ingest when device telemetry flows onward for processing (rules engine → Lambda/Kinesis/S3) and nothing needs to consume it via broker subscriptions. It removes cost and hops for the pure-ingestion pattern.

AWS KMS

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 1 and 2. KMS underpins encryption across S3, EBS, RDS, and more. At the Professional level, focus on key types, the key policy vs grant distinction, and cross-account patterns — not just “KMS encrypts things.”

1. Key Types

Type	Control	Use when
AWS-managed key (`aws/<service>`)	AWS creates, manages, rotates	Default; no key policy control
Customer-managed key (CMK)	You define key policy, rotation, aliases	Cross-account access, audit requirements, custom rotation
AWS-owned key	Fully AWS-managed, invisible	Default S3-SSE, no configuration

Decision rule: Use AWS-managed keys unless the scenario requires cross-account sharing, custom key policies, or CloudTrail audit of key usage — then it is a CMK. The exam often hides the requirement in “the security team must audit key usage” or “shared with another account.”

AWS Lambda

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3, 4. Lambda is the serverless compute foundation. Know concurrency, triggers, destinations, VPC integration, and SnapStart.

1. Overview

AWS Lambda runs code in response to events without provisioning or managing servers. You pay only for compute time consumed (per 1-ms increments).

Key characteristics:

Max execution timeout: 15 minutes
Max memory: 10,240 MB (10 GB)
Max deployment package: 50 MB (zipped), 250 MB (unzipped), 10 GB (container image)
Ephemeral storage (/tmp): up to 10 GB

2. Concurrency

Type	Description
Unreserved concurrency	Shared pool across all functions in the account
Reserved concurrency	Guarantees capacity for a function; limits its max concurrency
Provisioned concurrency	Pre-initialized execution environments — eliminates cold starts

Default account limit: 1,000 concurrent executions (can be increased)
Reserved concurrency = 0 → function is throttled (useful to disable a function)
Provisioned concurrency → use for latency-sensitive functions; costs more

Cold Starts

Occur when a new execution environment is initialized
Affected by: runtime (Java/C# slower than Python/Node), VPC attachment, package size
Mitigations: Provisioned Concurrency, SnapStart (Java 11+, Python 3.12+, .NET 8+), keep-warm pings (not recommended at scale)

SnapStart (Java, Python, .NET)

Takes a snapshot of initialized execution environment
Restores from snapshot instead of initializing from scratch
Reduces cold start latency for Java functions by up to 90%
Supported for Java 11+ on Corretto runtime

3. Triggers and Event Sources

Trigger	Invocation Type	Notes
API Gateway / ALB	Synchronous	Request/response
S3	Asynchronous	Object events
DynamoDB Streams	Polling (stream)	Ordered, per-shard
Kinesis Data Streams	Polling (stream)	Ordered, per-shard
SQS	Polling (queue)	Batch processing, DLQ support
SNS	Asynchronous	Fan-out pattern
EventBridge	Asynchronous	Event-driven
CloudWatch Events/Logs	Asynchronous	Scheduled, log-based
Cognito	Synchronous	User pool triggers
Step Functions	Synchronous/Async	Orchestration

Invocation Types

Synchronous: caller waits for response (API Gateway, ALB, Cognito)
Asynchronous: Lambda queues the event; retries on failure (S3, SNS, EventBridge)
Polling: Lambda polls the source (SQS, Kinesis, DynamoDB Streams)

4. Destinations (Async Invocations)

Configure what happens after an async invocation succeeds or fails:

AWS Landing Zone Design

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 1 (26%). Landing zone design is a core SAP-C02 topic. Know the components, account structure, and customization options.

1. What Is a Landing Zone?

A landing zone is a pre-configured, secure, multi-account AWS environment that serves as a starting point for deploying workloads at scale. It enforces security baselines, centralized logging, and governance guardrails from day one.

AWS provides two paths:

AWS Control Tower — managed landing zone with automated setup (recommended)
Custom landing zone — built manually using Organizations, CloudFormation StackSets, and Config

2. Core Accounts

Account	Purpose
Management account	Organizations root, billing, Control Tower management. No workloads.
Log Archive account	Centralized S3 bucket for CloudTrail logs, Config snapshots, VPC flow logs
Audit account	Security team read-only access, Security Hub/GuardDuty delegated admin
Network Hub account	Transit Gateway, Direct Connect, shared DNS (Route 53 Resolver)
Shared Services account	Shared AMIs, Service Catalog, common tooling
Workload accounts	Dev, Staging, Prod — isolated per environment or per application

3. OU Design Principles

Root
├── Security OU (restricted SCPs — no workloads)
│ ├── Log Archive Account
│ └── Audit Account
├── Infrastructure OU
│ ├── Network Hub Account
│ └── Shared Services Account
├── Sandbox OU (loose SCPs — experimentation)
├── Workloads OU
│ ├── Dev OU
│ │ └── Dev Accounts (per team or per app)
│ ├── Staging OU
│ └── Prod OU
│ └── Prod Accounts
├── Suspended OU (closed/decommissioned accounts)
└── Exceptions OU (accounts needing SCP exemptions)

Design principles:

AWS Organizations

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 1 (26%). Foundation of every multi-account architecture question. Appears in Domains 3 and 4 as well.

1. Overview

AWS Organizations lets you centrally manage multiple AWS accounts under a single management account. It provides consolidated billing, policy-based governance via SCPs, and integration with nearly every AWS governance service.

Problems it solves:

Sprawling, ungoverned AWS accounts
Inconsistent security controls across teams
Complex cross-account billing and cost allocation
Manual account provisioning and configuration

2. Core Concepts

Account Types

Account Type	Role
Management account	Root of the organization. Creates and manages member accounts. SCPs do NOT apply to it.
Member account	Any account that joins the organization. Subject to SCPs.
Delegated administrator	Member account granted admin rights for a specific AWS service (e.g., GuardDuty, Security Hub).

Organizational Units (OUs)

Hierarchical grouping of accounts under the root
SCPs applied to an OU are inherited by all child OUs and accounts
Best practice: model OUs around security/compliance boundaries, not team structure
Maximum OU nesting depth: 5 levels

Root

Top-level container for all OUs and accounts
SCPs applied at root affect all accounts (except management account)

Policies

Policy Type	Purpose
Service Control Policies (SCPs)	Restrict what actions principals in member accounts can perform
Resource Control Policies (RCPs)	Restrict what resources in member accounts can accept (data perimeter)
Tag Policies	Enforce tag key/value standards across accounts
Backup Policies	Enforce AWS Backup plans across accounts
AI Services Opt-Out Policies	Control whether AWS AI services can use data for improvement

3. Architecture Patterns

Recommended OU Structure

Root
├── Security OU
│ ├── Log Archive Account ← centralized CloudTrail, S3 access logs
│ └── Audit Account ← Security Hub, GuardDuty delegated admin
├── Infrastructure OU
│ └── Network Hub Account ← Transit Gateway, Direct Connect, DNS
├── Sandbox OU ← developer experimentation, loose SCPs
├── Workloads OU
│ ├── Dev OU
│ ├── Staging OU
│ └── Prod OU
└── Exceptions OU ← accounts needing SCP exemptions

Consolidated Billing

All member account charges roll up to the management account
Volume discounts (e.g., S3, EC2 Reserved Instances) are pooled across the organization
Use Cost Allocation Tags + AWS Cost Explorer for per-account visibility

Delegated Administration

Management Account
 └── enables GuardDuty
 └── delegates admin to Audit Account
 └── Audit Account manages GuardDuty for all member accounts

Supported services for delegated admin include: GuardDuty, Security Hub, Config, Firewall Manager, IAM Access Analyzer, Macie, Inspector, and more.

AWS Resource Access Manager (RAM)

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 1 (26%). RAM is the mechanism for sharing AWS resources across accounts without cross-account IAM roles. Know what can be shared and how it integrates with Organizations.

1. Overview

AWS Resource Access Manager (RAM) lets you share AWS resources with other AWS accounts, OUs, or your entire organization — without duplicating resources or creating complex cross-account IAM setups.

Problems it solves:

Duplicating resources (e.g., Transit Gateway) in every account
Complex cross-account IAM role chains for shared infrastructure
Inconsistent shared resource configurations across accounts

2. Commonly Shared Resources

Resource	Use Case
Transit Gateway	Central network hub shared to all spoke accounts
VPC Subnets	VPC sharing — workload accounts deploy into shared subnets
Route 53 Resolver Rules	Share DNS forwarding rules to all accounts
AWS License Manager configurations	Share license rules across accounts
Aurora DB clusters	Share read replicas across accounts
AWS Glue Data Catalog	Share data catalog across accounts
AWS Network Firewall policies	Share firewall policies
Resource Groups	Share resource groups
EC2 Capacity Reservations	Share reserved capacity across accounts

Verify the current full list at https://docs.aws.amazon.com/ram/latest/userguide/shareable.html

AWS Security Hub

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 1, 3. Security Hub is the central security findings aggregator. Know standards, integrations, and automated response patterns.

1. Overview

AWS Security Hub provides a centralized view of security findings across AWS accounts, aggregating results from AWS security services and third-party tools. It evaluates your environment against security standards and best practices.

Problems it solves:

Security findings scattered across GuardDuty, Inspector, Macie, Config, etc.
No single compliance dashboard across accounts
Manual security review processes

2. Core Concepts

Security Standards

Pre-built compliance frameworks evaluated automatically:

AWS Step Functions

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3. Step Functions is the orchestration layer for complex workflows. Know Standard vs Express, state types, error handling, and integration patterns.

1. Overview

AWS Step Functions is a serverless orchestration service that coordinates distributed components using visual workflows (state machines). It manages state, retries, error handling, and parallel execution.

When to use Step Functions:

Multi-step workflows with branching, parallel execution, or error handling
Long-running processes (up to 1 year)
Coordinating multiple Lambda functions or AWS services
Human approval workflows

2. Workflow Types

Feature	Standard	Express
Max duration	1 year	5 minutes
Execution semantics	Exactly-once workflow execution unless Retry behavior is configured	Asynchronous: at-least-once; synchronous: at-most-once
Execution rate	Region/account quotas vary; check current Service Quotas	Region/account quotas vary; check current Service Quotas
Pricing	Per state transition	Per execution, duration, and memory consumed
Audit history	Full execution history	CloudWatch Logs only
Use case	Long-running, durable, auditable workflows	High-volume, short-duration processing where the chosen delivery semantics fit

Express subtypes:

AWS Transit Gateway

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 1 (26%). Transit Gateway is the standard answer for hub-and-spoke networking at scale. Know route tables, inter-region peering, and multicast.

1. Overview

AWS Transit Gateway (TGW) is a regional network transit hub that connects VPCs and on-premises networks through a central gateway. It replaces complex VPC peering meshes with a scalable hub-and-spoke model.

Problems it solves:

VPC peering does not scale (N*(N-1)/2 connections for N VPCs)
Separate VPN connections per VPC
No transitive routing between peered VPCs
Complex on-premises connectivity to multiple VPCs

2. Core Concepts

Attachments

Attachment Type	Connects
VPC attachment	VPC to TGW
VPN attachment	Site-to-Site VPN to TGW
Direct Connect Gateway attachment	DX Gateway to TGW
TGW peering attachment	TGW in another region or account
Connect attachment	SD-WAN/third-party appliances via GRE

Route Tables

TGW has one or more route tables
Each attachment is associated with one route table (for inbound routing)
Each attachment can propagate routes to one or more route tables
Default: all attachments share one route table (full mesh)
Custom: separate route tables per environment (Dev, Prod, Shared) for isolation

Associations vs Propagations

Association: which route table an attachment uses to look up routes (one per attachment)
Propagation: which route tables an attachment advertises its CIDR into (can be multiple)

3. Architecture Patterns

Basic Hub-and-Spoke

 Transit Gateway
 / | \
 VPC-Dev VPC-Prod VPC-Shared
 |
 On-Premises
 (VPN or DX)

All VPCs route through TGW. On-premises connects once to TGW and reaches all VPCs.

AWS VPN

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 1 (26%). VPN is the cost-effective hybrid connectivity option and the standard DX backup. Know Site-to-Site VPN, Client VPN, and accelerated VPN.

1. Overview

AWS offers two VPN services:

AWS Site-to-Site VPN — connects on-premises networks to AWS VPCs over IPsec tunnels
AWS Client VPN — allows individual users to connect to AWS or on-premises resources over OpenVPN

2. Site-to-Site VPN

Components

Component	Description
Virtual Private Gateway (VGW)	AWS-side VPN endpoint, attached to a VPC
Transit Gateway (TGW)	AWS-side VPN endpoint for multi-VPC connectivity
Customer Gateway (CGW)	Represents the on-premises VPN device in AWS
VPN Connection	IPsec tunnel between CGW and VGW/TGW

Tunnel Details

Each VPN connection has 2 tunnels for redundancy (different AWS endpoints)
Both tunnels should be configured on the customer device
Supports static routing or dynamic routing (BGP)
BGP is recommended — enables automatic failover and route propagation

Bandwidth and Limits

Limit	Value
Max throughput per tunnel	~1.25 Gbps
Max throughput per VPN connection (2 tunnels)	~2.5 Gbps with ECMP
Max VPN connections per VGW	10
Max VPN connections per TGW	5,000

ECMP with Transit Gateway

Attach multiple VPN connections to a TGW
Enable ECMP on TGW
Traffic is distributed across all active tunnels
Effectively aggregates bandwidth beyond single-tunnel limits

On-Premises ──── VPN Connection 1 (2 tunnels) ──┐
On-Premises ──── VPN Connection 2 (2 tunnels) ──┤── TGW (ECMP) ──── VPCs
On-Premises ──── VPN Connection 3 (2 tunnels) ──┘

3. Accelerated Site-to-Site VPN

Routes VPN traffic over AWS Global Accelerator instead of the public internet
Reduces latency and improves consistency for geographically distant sites
Requires TGW attachment (not VGW)
Additional cost for Global Accelerator usage

On-Premises ──── Internet ──── AWS Global Accelerator ──── TGW ──── VPCs
 (nearest AWS edge location)

4. Client VPN

Overview

AWS Client VPN is a managed OpenVPN service for individual users to connect to AWS or on-premises resources.

Backup General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3. AWS Backup is the centralized backup service. Know backup plans, vaults, cross-region/cross-account backup, and supported services.

1. Overview

AWS Backup is a fully managed, centralized backup service that automates and consolidates backup tasks across AWS services and accounts. It replaces service-specific backup configurations with a single policy-driven approach.

2. Supported Services

Category	Services
Compute	EC2 instances (EBS volumes)
Storage	EFS, FSx (all types), S3
Databases	RDS, Aurora, DynamoDB, DocumentDB, Neptune
Hybrid	VMware workloads (on-premises via AWS Backup Gateway)
Other	Storage Gateway volumes

3. Core Concepts

Backup Plan

Policy that defines: backup frequency, retention period, lifecycle rules, vault destination
Assign resources by tag, resource ID, or resource type

BackupPlan:
 Rules:
 - RuleName: DailyBackup
 TargetBackupVault: MyVault
 ScheduleExpression: "cron(0 2 * * ? *)" # 2 AM daily
 StartWindowMinutes: 60
 CompletionWindowMinutes: 120
 Lifecycle:
 DeleteAfterDays: 35
 - RuleName: MonthlyBackup
 TargetBackupVault: MyVault
 ScheduleExpression: "cron(0 2 1 * ? *)" # 1st of month
 Lifecycle:
 MoveToColdStorageAfterDays: 90
 DeleteAfterDays: 365

Backup Vault

Encrypted container for backup recovery points
Vault Lock: WORM protection — backups cannot be deleted before retention period
- Governance mode: admins with special permissions can override
- Compliance mode: no one can delete — even root
Default vault uses AWS-managed KMS key; create custom vaults with customer-managed keys

Recovery Points

Individual backup of a resource
Stored in the backup vault
Restore from recovery point to original or new resource

4. Cross-Region Backup

Copy backups to another region for DR
Configure in backup plan as a copy action
Destination vault must exist in the target region

CopyActions:
 - DestinationBackupVaultArn: arn:aws:backup:eu-west-1:123456789012:backup-vault:DR-Vault
 Lifecycle:
 DeleteAfterDays: 90

5. Cross-Account Backup

Copy backups to another AWS account for additional protection
Requires: backup vault in destination account with resource policy allowing source account
Use Organizations integration for simplified cross-account backup policies
Protects against accidental deletion or ransomware in the source account

6. AWS Backup for Organizations

Deploy backup policies (Backup Plans) across all accounts in an OU or organization
Centrally manage and monitor backup compliance
Backup compliance reports: identify resources not covered by backup plans
Delegated admin: manage from a dedicated backup account

7. Exam Scenarios

Scenario 1: A company needs to ensure all RDS databases, DynamoDB tables, and EFS file systems are backed up daily with 35-day retention, and monthly backups retained for 1 year. What is the solution?

Cloudtrail General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 1, 3. CloudTrail is the API audit log for AWS. Know trail types, event types, CloudTrail Lake, and Insights.

1. Overview

AWS CloudTrail records API calls made to AWS services — who did what, when, from where. It is the primary tool for security auditing, compliance, and operational troubleshooting.

What CloudTrail captures:

AWS Management Console actions
AWS CLI and SDK calls
AWS service-to-service calls
CloudFormation stack operations
IAM changes, S3 bucket policy changes, security group modifications

2. Event Types

Type	Description	Default
Management events	Control plane operations (create, delete, modify resources)	Enabled (free)
Data events	Data plane operations (S3 GetObject, Lambda Invoke, DynamoDB GetItem)	Disabled (additional cost)
Insights events	Unusual API activity detection	Disabled (additional cost)

Management Events

Read events: Describe*, List*, Get* (low security value, high volume)
Write events: Create*, Delete*, Modify*, Put* (high security value)
Can filter to write-only to reduce cost

Data Events

High-volume, resource-level operations:

Cloudwatch General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3, 4. CloudWatch is the observability foundation. Know metrics, alarms, Logs Insights, dashboards, Container Insights, and cross-account observability.

1. Overview

Amazon CloudWatch is the unified observability service for AWS. It collects metrics, logs, and traces, and enables alarms, dashboards, and automated actions.

2. Metrics

Namespaces and Dimensions

Namespace: logical grouping (e.g., AWS/EC2, AWS/RDS, custom)
Dimension: key-value pair that identifies a metric (e.g., InstanceId=i-1234)
Resolution: standard (1-minute) or high-resolution (1-second) for custom metrics

Key Metrics by Service

Service	Key Metrics
EC2	CPUUtilization, NetworkIn/Out, StatusCheckFailed — no memory/disk by default
RDS/Aurora	CPUUtilization, FreeStorageSpace, DatabaseConnections, ReadLatency
ALB	RequestCount, TargetResponseTime, HTTPCode_Target_5XX, HealthyHostCount
Lambda	Invocations, Errors, Duration, Throttles, ConcurrentExecutions
SQS	ApproximateNumberOfMessagesVisible, NumberOfMessagesSent, ApproximateAgeOfOldestMessage
DynamoDB	ConsumedReadCapacityUnits, ConsumedWriteCapacityUnits, ThrottledRequests

EC2 memory and disk metrics require the CloudWatch Agent — not available by default.

Computeoptimizer General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 3 (25%). Compute Optimizer uses ML to recommend optimal resource configurations. Know supported resources, recommendation types, and how it differs from Cost Explorer rightsizing.

1. Overview

AWS Compute Optimizer analyzes historical utilization metrics using machine learning and recommends optimal AWS resource configurations to reduce cost and improve performance.

Compute Optimizer vs Cost Explorer Rightsizing:

Feature	Compute Optimizer	Cost Explorer Rightsizing
ML-based	Yes	No (threshold-based)
Supported resources	EC2, ASG, Lambda, ECS Fargate, EBS, RDS	EC2 only
Performance risk	Shows risk of under-provisioning	Not shown
Enhanced metrics	Yes (CloudWatch Agent memory)	Yes (CloudWatch Agent)
Cost	Free (standard), paid (enhanced)	Free

2. Supported Resources

Resource	What It Optimizes
EC2 instances	Instance type, size
EC2 Auto Scaling Groups	Instance type, size
EBS volumes	Volume type, size, IOPS
Lambda functions	Memory size
ECS services on Fargate	CPU and memory
RDS DB instances	Instance class (preview)

3. Recommendation Types

Each recommendation includes:

Containers Migration General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 4. Container migration and modernization patterns: packaging applications, choosing orchestration, and designing for production operations.

1. When Containers Fit

Containers package an application and its dependencies into an image, improving deployment consistency and portability. They are useful for applications that need controlled runtime environments, faster repeatable releases, service decomposition, or orchestration. Containerization alone does not make an application cloud-native: state, scaling, resilience, security, and operations still need design.

Cost Visibility and Optimization

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 1 (26%). Cost optimization and visibility is not merely choosing a cheaper instance: establish who owns spend, how usage is measured, and how the architecture can change safely.

1. Cost Management Tool Selection

Need	Tool	Decision cue
Explore historical spend, trends, forecasts, and filters	AWS Cost Explorer	Analysis and investigation; not a real-time billing ledger
Notify when actual or forecast spend crosses a threshold	AWS Budgets	Budget alerts, actions, and anomaly notifications; configure lead time and recipients
Detailed line-item billing data for custom queries	AWS Cost and Usage Report (CUR / Data Exports)	Deliver billing data to S3, then query with Athena or visualize with QuickSight
Estimate a proposed architecture before deployment	AWS Pricing Calculator	Estimate only; assumptions, regional prices, discounts, and usage drive accuracy
Detect unusual spend patterns	Cost Anomaly Detection	Identify anomalous spend and route alerts; it does not replace budgets or cost allocation
Attribute spend to teams/products	Cost allocation tags, Cost Categories, Organizations billing views	Define owners, tag policies, activation, and a remediation process for untagged resources
Find rightsizing opportunities	Compute Optimizer and Trusted Advisor	Recommendations require workload validation and have plan/coverage constraints

2. A Practical Visibility Loop

Define account/OU ownership and cost-allocation model
 |
Apply tags and Cost Categories; activate cost-allocation tags
 |
Use Cost Explorer for trends + CUR/Data Exports for detail
 |
Set Budgets and anomaly alerts with named owners
 |
Investigate drivers -> validate with workload telemetry
 |
Change architecture/commitments -> measure actual outcome

Use AWS Organizations consolidated billing and account separation to align spend with teams, products, and environments.
Standardize tag keys and allowed values. Tags are not retroactive for every report and do not automatically allocate all shared costs.
Allocate shared networking, support, security, and platform costs with an explicit model; do not leave them invisible.
Give teams dashboards and alerts, but central FinOps should own shared policies and commitment decisions.

3. Purchasing and Architecture Decisions

On-Demand: flexible, no usage commitment; useful for uncertain or short-lived demand.
Savings Plans / Reserved Instances: commitment discounts for eligible usage; analyze the stable baseline, flexibility, term, payment option, and utilization before purchase.
Spot: discounted spare capacity with interruption risk; use for fault-tolerant, restartable, or checkpointed work.
Storage tiers: compare capacity price with retrieval, request, transition, minimum-duration, and restore-time costs.
Data transfer: model inter-AZ, inter-Region, internet egress, NAT, Direct Connect, and replication traffic; high-availability designs may increase data movement.
Managed versus self-managed: include operational labor, patching, backup, resilience, and idle capacity, not just hourly resource price.

4. Governance and Security

Separate payer/management responsibilities from workload administration; restrict access to billing data using least privilege.
Use tag policies and account vending controls to improve allocation at creation time.
Protect CUR/Data Export buckets with scoped IAM and KMS policies; billing data reveals resource and usage metadata.
Use budgets and anomaly alerts as detection/notification controls, not as a guaranteed hard spending cap. Budget actions can restrict selected resources only after configuration and should be tested carefully.

5. Exam Scenario

Scenario: A company sees a 30% increase in cloud spend, but its monthly invoice only identifies account totals. Product owners need cost responsibility, and leadership wants early warning before budget overruns.

Costexplorer General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 3 (25%). Cost Explorer is the primary tool for analyzing and forecasting AWS costs. Know filtering, grouping, rightsizing recommendations, and Savings Plans analysis.

1. Overview

AWS Cost Explorer provides interactive visualizations and analysis of AWS costs and usage. It helps identify cost drivers, forecast future spend, and find optimization opportunities.

2. Key Features

Cost and Usage Analysis

Visualize costs by: service, account, region, tag, instance type, purchase option
Filter by: time range (up to 13 months historical), service, linked account, tag
Group by multiple dimensions simultaneously
Daily, monthly, or hourly granularity (hourly requires additional cost)

Forecasting

ML-based cost forecast for up to 12 months
Based on historical usage patterns
Confidence intervals included
Use for: budget planning, capacity planning

Rightsizing Recommendations

Identifies over-provisioned EC2 instances
Recommends instance type changes based on CloudWatch utilization metrics
Shows estimated monthly savings
Requires Cost Explorer rightsizing recommendations enabled (free)
Considers: CPU, memory (requires CloudWatch Agent), network utilization

Savings Plans Recommendations

Recommends Compute, EC2 Instance, or SageMaker Savings Plans
Based on historical On-Demand usage
Shows: recommended commitment, estimated savings, coverage
Lookback period: 7, 30, or 60 days

3. Cost Allocation Tags

Tag resources to track costs by project, team, environment, cost center
AWS-generated tags: aws:createdBy (who created the resource)
User-defined tags: custom key-value pairs
Activate tags in Cost Explorer for cost allocation
Tags appear in Cost Explorer after 24 hours

4. Budgets Integration

Create budgets based on Cost Explorer data
Alert when actual or forecasted costs exceed thresholds
Budget types: cost, usage, Savings Plans coverage, reservation coverage
Actions: notify via SNS, apply IAM policy, apply SCP (to restrict spending)

5. Exam Scenarios

Scenario 1: A company wants to identify which AWS accounts and services are driving the most cost increase over the last 3 months. What is the solution?

Databasemigration Patterns General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 4. Database migration and modernization patterns: engine choice, conversion, replication, and cutover.

1. Start with the Outcome

Choose a database migration pattern from business and technical requirements: engine compatibility, data volume, write rate, downtime, RPO/RTO, application coupling, licensing, compliance, performance, operational skills, and cost. “Move to a managed database” is not sufficient design input.

2. Common Migration Approaches

Pattern	Fits when	Main risks
Backup/restore or native dump/load	Same-engine move or outage window is acceptable	Long downtime, large restore duration, version/extension compatibility
Snapshot/physical replication	Compatible engines/platforms and supported procedure	Engine-specific limitations, storage/network transfer, failover semantics
Full load + CDC with AWS DMS	Low-downtime data movement and supported source/target pair	Log retention, CDC lag, object conversion, transaction consistency
Schema conversion + DMS	Heterogeneous engine move	Incomplete automatic conversion, SQL/semantic differences, query performance
Logical application migration	Large redesign or different data model is justified	Dual-write consistency, longer project, cutover and reconciliation complexity

Assess engine and application dependencies
 |
Same engine? -------------------- Different engine?
 | |
native tools / DMS assess + convert schema
 | |
full load or replication full load + CDC where supported
 \ /
 validate -> controlled cutover -> observe

3. Heterogeneous Migration Checklist

Inventory schemas, indexes, constraints, views, procedures, triggers, extensions, jobs, users, encodings, collations, and application SQL.
Assess conversion coverage and manually remediate unsupported or behaviorally different objects.
Benchmark representative queries and transaction patterns against the target; data compatibility does not guarantee equivalent performance.
Select target service/class based on availability, scaling, storage, network, backup, encryption, and operational needs.
Plan endpoint changes, connection pools, DNS TTL, certificates, secrets, IAM authentication where supported, and rollback.
Test data types, null behavior, time zones, numeric precision, isolation/locking, transaction semantics, and edge cases.

4. Low-Downtime Cutover with DMS

Prepare and secure source/target endpoints and replication capacity.
Convert/apply schema using a supported assessment/conversion path.
Run full load and validate table state.
Continue CDC; monitor lag, errors, source log retention, and target apply capacity.
Exercise application against a test target and run reconciliation.
Freeze source writes or use an explicit dual-write strategy; do not improvise during cutover.
Wait for final changes to apply, validate critical invariants, switch clients, and monitor.
Retain source and rollback access until target writes and business acceptance meet the defined gate.

A low-downtime plan is not automatically zero downtime or zero data loss. Define exactly when the source stops accepting writes and how divergent writes are handled if rollback occurs.

Datasync General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 4. DataSync is the managed, accelerated file and object transfer service for storage-to-storage movement — not server block replication, database CDC, or a backup catalog.

1. Purpose and Exam Relevance

AWS DataSync is a managed, accelerated service for transferring file and object data to, from, and between supported storage systems. Common patterns include moving on-premises NAS data to Amazon S3, EFS, or FSx; recurring replication; and moving cold data to an archival S3 storage class. DataSync handles transfer orchestration, integrity checks, encryption, scheduling, and monitoring.

Deployment Strategies and CI/CD

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). Official Domain 2 task 2.1 covers deployment strategy, change management, rollback, IaC, configuration management, and managed services. Choose a rollout pattern from business risk and recovery requirements.

1. Service Roles

Service	Role	Not a substitute for
AWS CodePipeline	Orchestrates source, build, test, approval, and deploy stages	Build execution or application deployment engine by itself
AWS CodeBuild	Runs managed build/test commands in build environments	Release orchestration or production rollback policy
AWS CodeDeploy	Coordinates supported in-place/blue-green deployments for EC2, on-premises, Lambda, and ECS targets	General-purpose source/build pipeline
AWS CloudFormation / CDK	Provisions and updates infrastructure as code	Application testing or safe data migration
AWS Systems Manager	Configuration, automation, patching, and operational actions	Application release strategy on its own

A typical pipeline uses version control, immutable build artifacts, automated tests, approval gates where required, infrastructure deployment, application rollout, and post-deployment validation. Use least-privilege service roles for each stage.

Deprecated and Restricted Services

Fri, 09 Oct 2026 00:00:00 +0000

Single reference for retired, restricted, or exam-irrelevant AWS services. Do not create study files for services listed here. Cross-reference this file if a service appears in older study materials.

Retired / End-of-Life Services

Service	Status	Notes
AWS OpsWorks	Retired	End of life June 2024. Replaced by Systems Manager and CloudFormation. Do not study for SAP-C02.
AWS CodeStar (project service)	Retired	Shut down July 2024. Do not treat CodeCatalyst as a one-to-one replacement; select currently supported source-control, build, and deployment services for the requirements.
Amazon WorkMail (exam relevance)	Low	Rarely tested at professional level. Skip unless exam guide explicitly lists it.
AWS Managed Blockchain (Ethereum)	Limited	Ethereum network support ended. Hyperledger Fabric remains but is low exam priority.
Amazon WorkDocs	Retired	Managed document collaboration service; closed and end-of-life. Treat it only as a legacy distractor in scenarios; current answers use S3-based patterns or third-party SaaS.

Services in Maintenance Mode / Limited Investment

Service	Status	Notes
AWS CodeCommit	No new customers (Oct 2023)	Existing customers can still use it. Exam may still reference it — verify against current exam guide. Prefer GitHub/GitLab integration patterns in new scenarios.
Amazon CodeCatalyst	No new customers	Existing customers can continue to use it; AWS provides migration guidance. Do not recommend it for a new customer without checking current service lifecycle guidance.
AWS Cloud9	No new customers	IDE service restricted. Not a primary SAP-C02 topic.

Services Outside SAP-C02 Scope

Service	Notes
Amazon Chime	Collaboration tool, not an architecture service. Not tested.
Amazon Connect (deep config)	High-level awareness only. Deep configuration not in scope.
AWS RoboMaker	Niche robotics service. Not in SAP-C02 exam guide.

Last updated: 2026-10-08 (CodeCatalyst lifecycle entry). Other lifecycle entries have not all been revalidated in this review. Verify every entry against current AWS documentation and the official exam guide before the exam. See CHANGELOG.md for history of content decisions.

Dms General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 4. DMS moves data between supported database engines with full load and ongoing change data capture (CDC); schema and code conversion are separate concerns.

1. Purpose and Exam Relevance

AWS Database Migration Service (AWS DMS) moves data between supported database and analytics engines, including migrations into, within, or out of AWS. It supports one-time full-load migrations and ongoing change data capture (CDC) so a target can stay close to the source until cutover. DMS is central when a database must move independently from its application servers or when downtime must be minimized.

Domain 1 Cheatsheet: Design Solutions for Organizational Complexity

Fri, 09 Oct 2026 00:00:00 +0000

Deeper notes: Domain 1 overview and the linked service guides.

Focus: governance, identity, multi-account operations, hybrid connectivity, and shared services. Use the current exam guide for exact objective wording.

Governance and Identity

Need	Prefer	Remember
Account vending and governed multi-account baseline	AWS Organizations + Control Tower	Landing zone, OUs, account factory, centralized logging/security; plan customization and drift
Set maximum permissions for accounts/OUs	SCP	Does not grant permissions; IAM still must allow
Central workforce sign-in to many AWS accounts	IAM Identity Center	Permission sets provision roles; integrate identity source and lifecycle
Limit access to supported resources across an organization	RCP	Resource-side maximum guardrail; does not grant access
Share supported resources across accounts	AWS RAM	Share only needed resource types/scopes; understand owner/consumer responsibilities
Delegate security administration	Service delegated admin + Organizations	Keep management account use limited; centralize findings and response
Access AWS APIs from workloads/users	IAM role + temporary credentials	Prefer federation/roles over long-lived access keys

Policy evaluation: explicit deny wins. SCP/RCP set ceilings; identity/resource policies must still allow access.
Organization design: separate accounts by environment, workload, and ownership; use OUs for policy inheritance without making OU depth unmanageable.
Break glass: tightly controlled emergency access, tested, monitored, and independent of ordinary federation failure modes.

Network and Hybrid Patterns

Requirement	Pattern	Watch for
Many VPCs and on-premises sites	Transit Gateway hub-and-spoke	Route tables, propagation/association, segmentation, attachment scale, cross-Region design
Dedicated private connectivity	Direct Connect	Not encrypted by default; use VPN/IPsec over DX when encryption is required
Quick encrypted site connectivity	Site-to-Site VPN	Internet path can vary; design redundant tunnels/endpoints and routing
Centralized outbound/inbound inspection	Network Firewall / inspection VPC via TGW	Symmetric routing, stateful inspection, AZ failure behavior, capacity
Private access to AWS services	VPC endpoints	Gateway endpoints for S3/DynamoDB; interface endpoints use PrivateLink and have cost/DNS considerations
Hybrid DNS	Route 53 Resolver inbound/outbound endpoints	Resolver rules, forwarding direction, on-premises DNS, endpoint security groups
Global DNS failover	Route 53 health checks and routing policy	DNS TTL/caching means failover is not instant

Cross-Account Design Checklist

Use IAM roles with explicit trust, external IDs where appropriate, and scoped session permissions.
Centralize CloudTrail, Config, security findings, and log retention in dedicated accounts.
Share networks/resources through approved mechanisms; avoid broad peering meshes.
Design account bootstrap, identity, quota, and regional enablement before migrating workloads.
Apply encryption/key policies across account boundaries and test the consumer role path end to end.

Common Traps

SCPs and RCPs do not grant access.
Direct Connect is private connectivity, not automatically encrypted or redundant.
VPC peering is non-transitive; do not use it as a scalable hub-and-spoke substitute.
Control Tower guardrails do not replace workload-specific security architecture.
A shared-services account is not a reason to centralize every workload permission or failure domain.
Route 53 health checks and low TTLs cannot eliminate resolver/client caching delays.

30-Second Review

Identify account boundary and who owns the resource.
Separate authentication, authorization, and organization guardrails.
Pick hub-and-spoke or private service access based on traffic flow and segmentation.
Add resilience, encryption, centralized logging, and tested break-glass access.
Verify current policy behavior, service support, and quotas in official docs.

Official References

Domain 2 Cheatsheet: Design for New Solutions

Fri, 09 Oct 2026 00:00:00 +0000

Deeper notes: Domain 2 overview and the linked service guides.

Focus: choose an architecture that meets scale, availability, security, performance, and cost requirements. Pick the simplest service model that satisfies explicit constraints.

Compute and Networking

Requirement	Candidate	Decision cue
Full OS control / specialized software	EC2	Own patching, AMI lifecycle, capacity, and host hardening
Fleet size changes with demand	Auto Scaling	Pair with health checks and appropriate load balancing
AWS-native container orchestration	ECS	Strong default when Kubernetes compatibility is not required
Kubernetes APIs/ecosystem	EKS	More cluster/add-on/upgrade operations; justify with requirements/team skills
Event-driven short execution	Lambda	Check runtime, duration, concurrency, payload, and downstream limits
HTTP application load balancing	ALB	Layer 7 routing; path/host rules and supported targets
Static IP / high-performance Layer 4	NLB	TCP/UDP/TLS use cases; validate source-IP and target behavior
Inspect and route network appliances	GWLB	Transparent insertion of virtual appliances
Global static anycast IPs and fast endpoint failover	Global Accelerator	TCP/UDP global entry point; not a content cache
Cache and accelerate web content	CloudFront	Edge caching, origin protection, TLS/WAF integration
Managed API front door	API Gateway	Auth, throttling, stages, transformations, private APIs; select API type by need

Storage and Databases

Need	Candidate	Key distinction
Object storage, lifecycle, replication	S3	Strong consistency; choose class from access/retrieval/retention economics
Block storage for EC2	EBS	Choose volume type by IOPS/throughput; snapshots for backup, multi-attach where supported
Shared Linux file system	EFS	NFS, elastic shared file access
Windows SMB / Windows semantics	FSx for Windows File Server	AD integration and SMB feature fit
High-performance parallel/HPC file data	FSx for Lustre	Link to S3 and validate workload throughput/metadata needs
NetApp ONTAP feature compatibility	FSx for ONTAP	Multi-protocol, snapshots, replication; assess operational fit
Relational database with managed HA	RDS/Aurora	Multi-AZ for HA; read replicas for read scaling/DR patterns, not substitutes
Key-value/document at scale	DynamoDB	Access-pattern-first schema, partition design, consistency and capacity mode
In-memory cache	ElastiCache	Cache is not the system of record; handle invalidation/failures
Search and log analytics	OpenSearch	Search/index workload; plan shard sizing, ingestion, and domain operations

Messaging and Integration

Requirement	Prefer
Decouple work with durable competing consumers	SQS
Fanout notifications to subscribers	SNS
Filter/route domain or SaaS events	EventBridge
Ordered/replayable high-volume streaming	Kinesis Data Streams
Managed Apache Kafka ecosystem	MSK
Durable orchestration with retries/branches	Step Functions

Use queues to buffer bursts and protect downstream capacity.
Design consumers for duplicate delivery and idempotency; use DLQs and replay procedures.
Choose synchronous APIs only when the caller needs an immediate response and dependency availability/latency are acceptable.

Infrastructure as Code

CloudFormation: declarative AWS resource stacks, drift/change sets, nested or StackSets patterns.
CDK: define infrastructure in programming languages, synthesize to CloudFormation; review generated templates and construct versions.
Make deployments repeatable; keep secrets out of templates and parameter values; plan rollback and stateful-resource replacement carefully.

Common Traps

Multi-AZ database deployment improves availability; a read replica is for read scale/DR and may require promotion.
Global Accelerator routes users to healthy endpoints; CloudFront caches content at edge.
SQS, SNS, EventBridge, Kinesis, and MSK solve different messaging/streaming shapes.
S3 storage class savings can be offset by retrieval, request, transition, and minimum-duration costs.
Adding a cache improves performance only if the access pattern and invalidation strategy fit.
Managed services reduce infrastructure tasks, not IAM, network, quota, monitoring, or cost responsibilities.

30-Second Review

State latency, data consistency, RTO/RPO, scale, and operational constraints.
Select compute and persistence independently; avoid forcing one service to do everything.
Identify failure domains and scaling bottlenecks.
Add least privilege, encryption, observability, and tested recovery.
Compare plausible alternatives on total operational cost, not service price alone.

Official References

Domain 3 Cheatsheet: Continuous Improvement

Fri, 09 Oct 2026 00:00:00 +0000

Deeper notes: Domain 3 overview and the linked service guides.

Focus: improve an existing workload using evidence. Measure first, identify the bottleneck or risk, apply the smallest effective change, and verify the outcome.

Observability and Operations

Question	Service / pattern
What are metrics, logs, alarms, dashboards?	CloudWatch
Who made an AWS API call or changed a resource?	CloudTrail
Where is latency/failure occurring across service calls?	X-Ray / distributed tracing
How do I automate fleet operations and patching?	Systems Manager
How do I assess architecture against best practices?	Well-Architected Tool / Framework
How do I monitor/request service quotas?	Service Quotas + CloudWatch alarms where supported

Use correlation IDs and traces across service boundaries; metrics alone rarely pinpoint distributed latency.
Separate audit logs (CloudTrail) from application logs and performance telemetry.
Automate repeatable operational actions with Systems Manager, controlled roles, approvals, and audit trails.

Reliability and Recovery

Requirement	Pattern
Recover after AZ failure	Multi-AZ architecture, health checks, automated failover
Recover after Region loss with lowest cost	Backup and restore
Faster recovery with some standby footprint	Pilot light / warm standby
Near-continuous service across Regions	Multi-site active-active, with explicit data consistency design
Centralized policy-driven backups	AWS Backup; cross-account/cross-Region copy where supported

RTO = acceptable recovery time; RPO = acceptable data loss window.
Replication is not backup; protect against logical corruption/deletion and test restore.
Distinguish high availability within one Region from disaster recovery across Regions.
Test runbooks, failover, failback, DNS/traffic behavior, and data promotion—not only backup completion.

Cost and Performance

Tool / practice	Use
Cost Explorer	Historical cost, trends, forecasts, filters, rightsizing views
Compute Optimizer	Utilization-based rightsizing recommendations for supported resources
Trusted Advisor	Broad best-practice checks; available checks/features depend on support plan/current offering
Savings Plans / Reserved options	Commit to steady eligible usage after analyzing duration and flexibility
S3 lifecycle/storage analysis	Tier data based on access and retrieval economics
Load/performance testing	Confirm bottleneck before scaling or caching

Optimization loop: baseline -> identify idle/oversized or bottleneck -> choose low-risk change -> measure cost/performance/reliability -> document rollback.

Domain 4 Cheatsheet: Migration and Modernization

Fri, 09 Oct 2026 00:00:00 +0000

Deeper notes: Domain 4 overview and the linked service guides.

Focus: select the right workload strategy, tool, target, and cutover plan. Validate service availability and current exam-guide objectives.

The 7 Rs (Terminology Varies)

Strategy	Cue
Retire	Decommission an unneeded workload after dependency/owner validation
Retain	Keep due to timing, compliance, technical constraints, or business need
Rehost	Move with minimal changes; MGN can replicate eligible servers to EC2
Relocate	Move a supported platform/environment with limited redesign; confirm current support
Repurchase	Replace with SaaS or a different product
Replatform	Make limited cloud optimizations without a full redesign
Refactor / re-architect	Change architecture to achieve business outcomes unavailable through smaller changes

Tool Selection

Work unit / requirement	Tool or pattern	Not this
Physical/virtual server rehost with block replication	AWS Transform MGN	DMS or Migration Hub
Database full load + ongoing CDC	AWS DMS; schema conversion assessed separately	MGN
Online file/object copy, repeatable tasks, integrity checks	DataSync	Transfer Family for bulk NAS migration
Partner SFTP/FTPS/AS2 interface to S3/EFS	Transfer Family	DataSync for per-user protocol access
Migration inventory and wave progress	Migration Hub / discovery tools	Data replication engine
Structured migration program, assessment, mobilization	AWS MAP	Technical migration service
Physical/offline transfer	Current eligible physical transfer option	Assume Snowball Edge is open to new customers

Cutover Checklist

Inventory owners, dependencies, data classification, source/target regions, licenses, and network flows.
Define RTO/RPO, allowed outage, freeze strategy, validation checks, go/no-go authority, and rollback.
Verify agent/endpoints, routes, DNS, identity, encryption, security groups, quotas, target capacity, and service compatibility.
Test representative workloads in target; confirm application behavior, not just infrastructure status.
Monitor replication/CDC lag or transfer errors; set a measurable cutover threshold.
Keep source systems/data recoverable until the acceptance window closes.

Modernization Choices

Microservices: independent business capabilities need separate scale/release/ownership; avoid distributed monoliths and shared writable databases.
Containers: package compatible applications; choose ECS for AWS-native simplicity, EKS for Kubernetes needs; state must live in durable external services.
Serverless: event-driven or variable workloads with managed operations; design for retries, idempotency, quotas, and downstream limits.
Database modernization: assess engine semantics, schema conversion, CDC, application SQL, performance, and cutover consistency separately.

Common Traps

Migration Hub tracks; it does not copy data.
DMS moves database data; it does not automatically convert every schema object or application query.
MGN rehosts servers; it does not containerize/refactor them.
Replication is not backup, nor proof of application consistency.
Physical transfer may meet bandwidth constraints but has eligibility, shipment, import, and scheduling risks.
“Zero downtime” requires a precise write and rollback strategy, not only a replication product.

Official References

Elastic Disaster Recovery General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 3. AWS Elastic Disaster Recovery (AWS DRS) continuously replicates supported source servers to a low-cost staging area in AWS and supports recovery launches into EC2. It is a disaster-recovery service, distinct from AWS Transform MGN, which is primarily used to migrate servers to AWS.

1. When to Use DRS

Use DRS when the recovery objective requires a tested server-level recovery environment in AWS for on-premises or supported cloud source servers. It can support recovery from source-site outages, ransomware events, and other disruptions when the replication and recovery plan are configured appropriately.

Elastic Load Balancing

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). Know when to use ALB vs NLB vs GWLB. This is a frequent decision point in architecture scenarios.

1. Load Balancer Types

Feature	ALB	NLB	GWLB
Layer	7 (HTTP/HTTPS)	4 (TCP/UDP/TLS)	3 (IP)
Routing	Path, host, header, query, method	IP, port	Transparent bump-in-wire
Static IP	No (use Global Accelerator)	Yes (Elastic IPs)	Yes
WebSocket	Yes	Yes	N/A
gRPC	Yes	No	N/A
TLS termination	Yes	Yes (TLS passthrough or terminate)	No
Health checks	HTTP/HTTPS	TCP/HTTP/HTTPS	HTTP/HTTPS
Use case	Web apps, microservices, containers	TCP/UDP, static IP, extreme performance	Inline traffic inspection
Target types	Instance, IP, Lambda	Instance, IP, ALB	Instance, IP

2. Application Load Balancer (ALB)

Routing Rules

Path-based: /api/* → service A, /web/* → service B
Host-based: api.example.com → service A, app.example.com → service B
Header-based: route by HTTP header value
Query string: route by query parameter
HTTP method: route by GET/POST/etc.
Source IP: route by client IP CIDR

Target Groups

Targets: EC2 instances, ECS tasks, Lambda functions, IP addresses
Health check: HTTP/HTTPS on configurable path and port
Stickiness: session affinity via cookie (duration-based or application-based)

Authentication

Native OIDC and Cognito authentication at the ALB level
Redirects unauthenticated users to IdP — no application code changes needed

Connection Draining (Deregistration Delay)

Allows in-flight requests to complete before deregistering a target
Default: 300 seconds; set to 0 for immediate deregistration

3. Network Load Balancer (NLB)

Operates at Layer 4 — routes based on IP and port
Handles millions of requests per second with ultra-low latency
Static IPs: one per AZ — useful for whitelisting in firewalls
Elastic IPs: assign your own EIPs to NLB for fixed IPs
TLS termination: NLB can terminate TLS or pass through to targets
Preserve source IP: targets see the client’s real IP (unlike ALB which uses X-Forwarded-For)
Supports PrivateLink — expose services to other VPCs/accounts

NLB + ALB

NLB can target an ALB — combines static IPs (NLB) with advanced routing (ALB):

Map General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 4. MAP is the structured migration program — assessment, mobilization, migration methodology, and conditional program support — not a data-transfer service.

1. Purpose and Exam Relevance

The AWS Migration Acceleration Program (MAP) is a structured program to help organizations assess, mobilize, migrate, and modernize workloads on AWS. It combines methodology, migration expertise, tools, and (for eligible engagements) financial incentives or credits subject to current program terms. MAP is not a data-transfer service and does not replace architecture, migration execution, or operational ownership.

Mgn General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 4. MGN is the server rehosting service: continuous block-level replication of source servers to a staging area in the target Region, then EC2 test and cutover launches.

AWS documentation currently refers to Application Migration Service as AWS Transform MGN (often shortened to MGN). Product names and supported source/target configurations can change; confirm them in the linked guide before implementation.

1. Purpose and Exam Relevance

MGN is a rehosting service for moving physical, virtual, and cloud servers to Amazon EC2 with limited application changes. It continuously replicates source-server block storage to a staging area in the target Region, then launches converted EC2 test and cutover instances. It is useful when the priority is to move server workloads quickly and defer redesign.

Microservices Patterns General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 4. Microservices modernization patterns: decomposition, strangler migration, service boundaries, and data ownership.

1. When Microservices Fit

Microservices can help when independently deployable business capabilities need separate scaling, release cadence, fault boundaries, or team ownership. They are not a default upgrade for every monolith. A well-structured monolith may be cheaper and simpler when the domain is cohesive, scaling needs are shared, or teams cannot support distributed operations.

2. Decomposition and Migration

Legacy monolith AWS target
+----------------------+ +----------------------------+
| Orders | Billing | | | API Gateway / ALB |
| Catalog | Shipping | ----->| Order service -> own data |
+----------------------+ | Billing service -> own data |
 shared DB | Events / queues between |
 | bounded contexts |
 +----------------------------+

Decompose around business capabilities and bounded contexts, not technical layers or arbitrary table boundaries.
Use the strangler pattern: place a routing layer in front of the legacy system, move one capability at a time, and route selected calls to the new service.
Establish clear service ownership, APIs/events, data contracts, SLOs, and rollback behavior before broad decomposition.
Avoid a distributed monolith: services that must deploy together, share a schema, and synchronously call each other across every request have moved complexity without gaining independence.

3. Communication and Data Patterns

Need	Pattern	Trade-off
Immediate query/command response	Synchronous API (API Gateway, ALB, service endpoint)	Simpler caller flow, but latency and availability are coupled
Loose coupling and burst absorption	SQS queue	Durable buffer and retry; adds eventual consistency and queue operations
Publish domain events to multiple subscribers	EventBridge or SNS	Fan-out and routing; consumers must be idempotent and tolerate reordering/duplicates where applicable
Multi-step business workflow	Step Functions or application saga	Explicit state/retry/compensation; workflow design becomes a first-class concern
Atomic database update plus event publication	Transactional outbox/CDC pattern	Avoids dual-write loss; adds outbox processing and deduplication

Prefer data ownership per service. Cross-service joins and shared writable databases couple release and failure domains. Replicate read models or compose APIs for cross-domain views; define consistency and staleness expectations explicitly.

Migrationhub General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 4. Migration Hub is the planning and tracking layer for migration portfolios — application inventory, waves, and status. It does not replicate servers, databases, or files.

1. Purpose and Exam Relevance

AWS Migration Hub provides a place to discover/organize migration information and track application migration progress across supported AWS and partner tools. It helps teams group servers into applications, coordinate waves, and report status across a portfolio. It is a planning and tracking layer, not the data plane that copies servers, databases, or files.

Original SAP-C02 Practice Scenarios

Fri, 09 Oct 2026 00:00:00 +0000

These are free, original architecture exercises, not actual or reconstructed exam questions and not a timed/scored mock exam. Use a separate practice exam for full-length test simulation. Map each exercise to the current guide and decide before reading the recommendation.

Domain 1: Organizational Complexity

1. Organization-Wide Data Guardrails

Problem: A company has dozens of AWS accounts. Security requires that teams cannot disable central audit logging, while workload teams must still create resources independently. A small set of security administrators needs centralized findings.

Purpose-Built Database Selector

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 2 (29%). Start from access patterns, consistency, latency, scale, query shape, and operational constraints. “NoSQL” and “managed” are not sufficient selection criteria.

1. Fast Selection Table

Workload shape	Candidate	Strong fit when	Main design work
Relational OLTP, joins, transactions	Amazon RDS / Aurora	SQL and relational integrity are central	Engine/version fit, HA, connection behavior, backups, read scaling
Key-value/document with known access patterns	DynamoDB	Horizontally scaled, low-latency key access fits the data model	Partition/sort keys, indexes, consistency, hot keys, capacity
MongoDB-compatible document workload	DocumentDB	Application uses supported MongoDB APIs/semantics	Compatibility gaps, indexes, query behavior, migration testing
Apache Cassandra-compatible wide-column workload	Keyspaces	Cassandra-compatible APIs and partitioned workloads fit	Partition keys, clustering, consistency, throughput, query restrictions
Highly connected graph traversal	Neptune	Relationships and graph queries are first-class	Graph model/query language, traversals, replication, workload testing
Time-stamped operational metrics/events	Timestream	Time-series ingest, retention, and time-window queries dominate	Memory/magnetic store retention, dimensions, late-arriving data, query cost
Data warehouse / BI analytics	Redshift	Large analytical scans, joins, aggregations, and warehouse SQL fit	Distribution/sort strategy, concurrency, ingestion, workload isolation
Search, log analytics, text retrieval	OpenSearch	Full-text/search and indexed analytics are required	Index mapping, shard sizing, ingestion, refresh, lifecycle, security
In-memory cache	ElastiCache	Repeated reads or ephemeral low-latency state justify caching	Eviction, TTL, invalidation, failover, cache stampede
Object data lake / durable files	S3 + analytics services	Data is object-shaped and consumers can query/process it	Layout, catalog, governance, lifecycle, query/scan cost

2. Decision Sequence

Define operations: point lookup, range, joins, graph traversal, full-text search, time-window aggregation, or analytical scans.
Define correctness: transactions, read/write consistency, ordering, conflict resolution, and acceptable staleness.
Define scale and shape: read/write rate, item size, skew/hot keys, retention, growth, and regional distribution.
Choose the data model before the service: relational schema, key-value/document, wide column, graph, time series, search index, or warehouse.
Plan migration: engine compatibility, schema/code conversion, data movement, CDC, validation, cutover, rollback, and application changes.
Measure total cost: compute, storage, I/O, replicas, backup, requests, data transfer, retrieval, licensing, and operational effort.

3. Common Near-Misses

DynamoDB vs Keyspaces: access-pattern-first key-value/document design versus Cassandra-compatible wide-column APIs and query model.
DocumentDB vs RDS: document compatibility does not replace relational joins/transactions; validate MongoDB API compatibility for the actual application.
Neptune vs OpenSearch: graph relationship traversals versus text/search and indexed-document retrieval.
Timestream vs DynamoDB: time-series-specific retention/query behavior versus a key-value/document model that can store time-stamped items.
Redshift vs RDS/Aurora: analytical warehouse scans/aggregations versus transactional OLTP.
Cache vs source of truth: ElastiCache can reduce latency/load, but data correctness, invalidation, and cache failure behavior remain application concerns.
S3 data lake vs warehouse: flexible object storage and decoupled analytics versus a managed SQL warehouse with dedicated analytical compute.

4. Exam Scenario

Scenario: A telemetry platform stores device measurements, customer profiles, and device-to-device relationships. Analysts need daily fleet-wide aggregates; the application needs millisecond profile lookups and relationship traversal.

Resilience Patterns General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3. DR strategies and resilience patterns are core SAP-C02 topics. Know the 4 DR strategies, RTO/RPO trade-offs, and multi-region patterns cold.

1. RTO and RPO

Metric	Definition	Lower =
RTO (Recovery Time Objective)	Max acceptable downtime after a disaster	Faster recovery, higher cost
RPO (Recovery Point Objective)	Max acceptable data loss (time since last backup)	Less data loss, higher cost

2. DR Strategies (AWS)

1. Backup and Restore

Active Region DR Region
Primary workload ──── backup ──→ S3 / AWS Backup (snapshots)
 ↓ (disaster occurs)
 Restore from backup (hours)

RTO: hours
RPO: hours (depends on backup frequency)
Cost: lowest — pay only for storage
Use case: non-critical workloads, cost-sensitive

2. Pilot Light

Active Region DR Region
Full workload ──── replicate ──→ Core services only (DB replica, minimal infra)
 ↓ (disaster occurs)
 Scale up remaining services (minutes to hours)

RTO: minutes to hours (need to scale up)
RPO: minutes (near real-time replication)
Cost: low — only core services running in DR
Use case: critical data, moderate recovery time acceptable

3. Warm Standby

Active Region DR Region
Full workload ──── replicate ──→ Scaled-down but functional workload
 ↓ (disaster occurs)
 Scale up to full capacity (minutes)

RTO: minutes
RPO: seconds to minutes
Cost: moderate — DR environment always running at reduced capacity
Use case: business-critical workloads

4. Multi-Site Active-Active

Active Region (us-east-1) Active Region (eu-west-1)
Full workload ←── Route 53 ──→ Full workload
 (latency routing)
Both application stacks can serve traffic; the data write model needs its own consistency/conflict design

RTO: can be low with healthy capacity and tested traffic controls; not guaranteed to be zero
RPO: depends on the replication and consistency model; asynchronous replication can lose acknowledged writes
Cost: highest — full infrastructure in multiple regions
Use case: mission-critical, zero-downtime requirement

3. DR Strategy Comparison

Strategy	RTO	RPO	Cost	Complexity
Backup & Restore	Usually longest; measured restore time	Depends on backup frequency and consistency	Lowest ongoing infrastructure cost	Lower steady-state, higher recovery effort
Pilot Light	Depends on provisioning, scaling, and validation	Depends on replication/backup design	Low-to-moderate	Medium
Warm Standby	Faster when continuously tested and ready	Depends on replication mode and lag	Moderate-to-high	Medium-high
Multi-Site Active-Active	Can reduce traffic-recovery time; not automatically zero	Depends on consistency and replication model	Highest	High

These are relative patterns, not fixed service guarantees. Measure failover, recovery, and data-loss windows against the workload’s actual RTO/RPO.

Resource Control Policies (RCPs)

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 1 (26%). RCPs are a newer Organizations policy type (2024). Know how they differ from SCPs and how they form the data perimeter.

1. Overview

Resource Control Policies (RCPs) are an Organizations policy type that set the maximum permissions available to resources in member accounts. While SCPs restrict what principals can do, RCPs restrict what resources can accept.

RCPs enable the resource side of a data perimeter — ensuring that even if a resource policy is misconfigured, resources cannot be accessed by untrusted principals or from untrusted networks.

SAP-C02 All-Services Review

Fri, 09 Oct 2026 00:00:00 +0000

One-line decision cues for final review. A service name is not an architecture: validate the workload, integration, limits, cost, and failure behavior in the linked notes and current AWS documentation.

Domain 1: Organizational Complexity

Service / topic	Recall cue
AWS Organizations	Multi-account hierarchy, consolidated governance, delegated administration
Service Control Policies	Account/OU maximum permissions; does not grant permissions
AWS Control Tower	Governed landing zone, account provisioning, controls
Landing zones	Account, identity, network, logging, security foundations
IAM	Workload/user authorization, roles, policies, federation
IAM Identity Center	Workforce SSO and permission sets across accounts
Resource Control Policies	Resource-side organization guardrails; does not grant access
AWS RAM	Share supported resources across accounts/OUs
AWS Config	Resource configuration history, rules, and compliance
Security Hub	Centralize security findings and standards checks
Security service selector	GuardDuty threat detection; Inspector vulnerability scanning; Macie S3 data discovery; WAF/Shield/Firewall Manager boundaries
Cost visibility	Cost Explorer analysis, Budgets alerts, billing exports, tags, commitments
Deployment strategies	CodePipeline orchestration, CodeBuild, CodeDeploy, canary/blue-green/rollback
Purpose-built database selector	Document, wide-column, graph, time-series, warehouse, search, cache, relational
AWS Elastic Disaster Recovery	Server replication to staging, recovery drills, launch, and failback
Transit Gateway	Scalable routed hub for VPCs and hybrid attachments
Direct Connect	Dedicated hybrid connectivity; encryption is not automatic
Site-to-Site VPN	IPsec tunnels for encrypted hybrid connectivity
Advanced VPC design	Routing, endpoints, inspection, segmentation, and hybrid DNS
Route 53	DNS, routing policies, health checks, and resolver integration

Domain 2: New Solutions

Service / topic	Recall cue
EC2	OS/instance control, specialized software, lift-and-shift
Auto Scaling	Replace/scale fleet capacity from demand and health signals
ECS	AWS-native container orchestration
EKS	Kubernetes API/ecosystem and associated operations
Lambda	Event-driven functions within runtime and quota constraints
CloudFront	Edge content delivery and caching
API Gateway	Managed API front door, auth, throttling, and integrations
Elastic Load Balancing	ALB L7, NLB L4, GWLB appliance insertion
Global Accelerator	Anycast static IPs and health-based global traffic routing
S3	Durable object storage, lifecycle, replication, and access controls
EFS	Shared elastic NFS file storage
FSx	Managed file systems for Windows, Lustre, ONTAP, and OpenZFS use cases
RDS / Aurora	Managed relational engines, HA, read scaling, and recovery
DynamoDB	Key-value/document access-pattern-first design
ElastiCache	In-memory cache; plan invalidation and fallback
OpenSearch	Search and log analytics with index/shard operations
Step Functions	Durable orchestration, retries, branches, and state
EventBridge	Event routing and filtering across services/accounts
SQS / SNS	Queue-based decoupling versus pub/sub fanout
Kinesis	Ordered/replayable streaming ingestion patterns
Amazon MSK	Managed Apache Kafka for Kafka-compatible workloads
CloudFormation	Declarative AWS infrastructure lifecycle and drift management
AWS CDK	Programmatic infrastructure synthesized to CloudFormation

Domain 3: Continuous Improvement

Service / topic	Recall cue
CloudWatch	Metrics, logs, alarms, dashboards, and operational signals
CloudTrail	AWS API audit events and governance evidence
X-Ray	Distributed request tracing and service maps
Systems Manager	Fleet operations, patching, sessions, automation
Cost Explorer	Analyze historical spend, trends, and forecasts
Compute Optimizer	Utilization-based rightsizing recommendations
Trusted Advisor	Broad best-practice checks; capabilities vary by plan
Well-Architected Tool	Review workloads against the six pillars
AWS Backup	Centralized policy-based backup and recovery
Resilience patterns	RTO/RPO, DR choices, failover, and fault isolation
Service Quotas	Monitor/request regional service capacity before limits

Domain 4: Migration and Modernization

Service / topic	Recall cue
AWS Transform MGN	Server block replication and EC2 rehost cutover
AWS DMS	Database full load, CDC, and supported engine migrations
DataSync	Online managed file/object transfers and recurring tasks
Snow Family	Physical data transfer concept; verify current eligibility/availability
Transfer Family	Managed SFTP/FTPS/FTP/AS2 and browser transfer interfaces
Migration Hub	Inventory and progress tracking, not replication
AWS MAP	Migration assessment/mobilization program, not a data mover
Microservices	Decompose by business boundary; migrate incrementally
Container migration	Package workloads; select ECS/EKS/Fargate based on fit
Serverless migration	Event-driven managed compute with retries/idempotency
Database migration patterns	Separate engine conversion, replication, validation, and cutover

Cross-Domain Rules

Explicit constraints outrank general preferences; reject any option that violates a hard requirement.
Identify the failure domain: host, AZ, Region, account, data store, network, or dependency.
Replication is not backup; multi-AZ is not multi-Region; a private connection is not automatically encrypted.
“Managed” does not remove the need for IAM, network, quotas, observability, testing, and cost controls.
Verify version-sensitive service availability, limits, pricing, and exam facts in current official sources.

🎯 Architecture Decision Notes

Textract — choose document intelligence, not just OCR

When the input is a scanned or photographed document and the requirement goes beyond “read the characters,” prefer a managed document-analysis service to building an OCR pipeline. The decision ladder:

SAP-C02 Exam Strategy

Fri, 09 Oct 2026 00:00:00 +0000

Confirm the current exam format and policies on the official AWS certification page before exam day. The study materials currently use 75 questions and 180 minutes as a planning baseline; if that changes, adjust all pacing below.

Time and Pacing

At 75 questions in 180 minutes, the arithmetic average is about 2.4 minutes per question. Long scenarios may need more time; short ones should give time back.

First pass: answer questions you can reason through confidently; mark uncertain or unusually long items and move on when progress stalls.
Second pass: return to marked items, compare the remaining options against the hard constraints, and use remaining time deliberately.
Final check: review unanswered questions, multi-select count, and accidental changes. Keep a time buffer rather than spending the whole exam on one scenario.
Avoid imposing an exact per-question deadline if the current exam interface or format differs; use checkpoints and adjust.

Parse Each Scenario

Name the business outcome: migrate by a deadline, reduce cost, increase availability, improve performance, meet compliance, or simplify operations.
Extract hard constraints: RTO/RPO, outage window, data loss, throughput/latency, protocols, region/account boundaries, encryption, licensing, budget, and “no code change” requirements.
Separate constraints from preferences: words such as “must,” “cannot,” and “minimum” usually disqualify options; “prefer” and “ideally” are optimization goals.
Identify the workload unit: account, network, server, database, file set, event stream, API, or application capability.
Choose the right layer: governance/planning, connectivity, migration execution, compute, data, or observability.
Check operational ownership: who patches, scales, restores, rotates credentials, tests failover, and responds to errors?

Eliminate Options

Reject options that:

SAP-C02 Final Exam Tips

Fri, 09 Oct 2026 00:00:00 +0000

The Last Review

Recheck the official exam guide, domain names, question count, duration, and test-day policies.
Review weak-domain cheatsheets first; spend remaining time on service comparisons and original scenarios.
Prioritize architecture decisions and trade-offs over memorizing console click paths or unstable quotas.
Sleep, prepare identification and appointment details, and follow the current testing-provider instructions.

High-Value Distinctions

SCP/RCP: permission ceilings, not grants.
Direct Connect/VPN: dedicated connectivity versus encrypted IPsec tunnels; DX is not encrypted by default.
ALB/NLB/GWLB: Layer 7 application routing / Layer 4 network performance / virtual appliance insertion.
CloudFront/Global Accelerator: content caching / global anycast routing to healthy endpoints.
SQS/SNS/EventBridge/Kinesis/MSK: queue / fanout / event routing / streaming data / Kafka-compatible event streaming.
Multi-AZ/read replica/backup/DR: availability / read scaling or recovery option / point-in-time protection / regional or broader recovery strategy.
CloudWatch/CloudTrail/X-Ray: telemetry / AWS API audit / distributed tracing.
MGN/DMS/DataSync/Transfer Family/Migration Hub: server rehost / database migration / file-object copy / partner protocol endpoint / migration tracking.

Scenario Habits

Underline non-negotiable requirements: downtime, data loss, encryption, access boundary, latency, compatibility, and budget.
Determine if the problem is new design, migration, modernization, or improvement of an existing system.
Draw the data and control flows. Mark trust boundaries, failure domains, and source of truth.
Pick the smallest viable architecture that meets the hard requirements.
Check the failure case, recovery path, and operational owner.
Eliminate options that add unneeded code changes, manual steps, or cost when a managed fit exists.

Common Traps — the 30 that decide pass/fail

Identity & access

SAP-C02 In-Scope Service Coverage Map

Fri, 09 Oct 2026 00:00:00 +0000

Version: SAP-C02, compared with AWS’s official in-scope service list and domain tasks on October 8, 2026. AWS states that the service list is non-exhaustive and subject to change; inclusion does not imply equal exam weight. This repo is not SAP-C03 material.

Use this map to distinguish deep study notes from short awareness cues. A service without a standalone file can still appear in an architecture scenario; use its official guide when a requirement depends on detailed feature behavior.

SAP-C02 Readiness Tracker

Fri, 09 Oct 2026 00:00:00 +0000

This is a study aid, not a score predictor. AWS reports a scaled score and does not define a raw-practice percentage that guarantees a pass. Use the official exam guide and AWS practice resources alongside this tracker.

Requested 90% Practice Target

Use 90% raw accuracy on two separate, fresh, timed full-length practice sets as a personal stretch target, with no domain below 85%. Take those mock exams separately through AWS or a provider such as Tutorial Dojo; this repository contains study notes and original scenario exercises, not full-length mock exams. Review every miss and retest the underlying objective with different questions before treating a result as evidence of readiness.

Security Service Selection

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 1 (26%). Security scenarios often require several controls — select services by the control plane they provide, then design IAM, network, data, response, and governance integrations around them.

1. Which Service Answers Which Question?

Requirement	Service / control	Role and boundary
Detect suspicious account/API/network behavior	Amazon GuardDuty	Threat detection from supported data sources; findings require triage/remediation
Find software vulnerabilities and unintended exposure	Amazon Inspector	Vulnerability management for supported compute, container, and code resources
Discover sensitive data in S3	Amazon Macie	Sensitive-data discovery and classification for S3; scope findings and access carefully
Investigate relationships around security findings	Amazon Detective	Helps analyze and visualize security data; complements, does not replace, detection
Aggregate/normalize security findings and posture signals	AWS Security Hub CSPM	Central security posture/findings view; it does not generate every integrated service’s finding
Detect configuration drift/noncompliance	AWS Config	Resource configuration history and rule evaluation; remediation needs automation/policy
Analyze unintended resource access	IAM Access Analyzer	Findings for public/cross-account access and policy validation features
Filter HTTP/S requests to web applications	AWS WAF	Web ACLs, managed/custom rules, rate controls; applies at supported associations
Mitigate common and large-scale DDoS risks	AWS Shield	Standard protections plus paid Advanced capabilities; use WAF/architecture controls as required
Inspect and filter VPC network traffic	AWS Network Firewall	Stateful/stateless network policy at VPC boundaries; design routing and symmetry
Centrally apply supported security policies across accounts/resources	AWS Firewall Manager	Organization-wide policy management when prerequisites and supported resource types fit
Manage encryption keys	AWS KMS / CloudHSM	Select managed key service or dedicated HSM control based on key custody/compliance requirements
Store/rotate application secrets	AWS Secrets Manager / Systems Manager Parameter Store	Choose secret rotation and lifecycle features versus parameter/configuration storage needs

2. Layered Detection and Response Pattern

GuardDuty / Inspector / Macie / Config
 |
 Security Hub CSPM (aggregate)
 |
 EventBridge finding rule / workflow
 |
 Lambda or Systems Manager Automation
 |
 ticket, isolate, revoke, notify, remediate
 |
 CloudTrail + CloudWatch evidence

Keep management, delegated administration, and workload accounts distinct; use Organizations/Control Tower for enrollment and guardrails.
Configure least-privilege service roles, organization enablement, delegated administrators, Regions, and finding aggregation explicitly.
Make remediation idempotent, auditable, and reversible where possible. A finding should not automatically trigger a destructive action without severity/context checks.
Protect findings, logs, and investigation data with retention, encryption, and access controls.

3. Network and Web Application Controls

Use security groups for stateful workload boundaries; NACLs for subnet-level stateless filtering; route tables and firewall appliances for traffic paths.
Use AWS WAF for application-layer request inspection at supported endpoints. Shield addresses DDoS resilience; neither replaces application scaling, caching, origin protection, or incident plans.
Use Network Firewall or a centralized inspection design for VPC network traffic. Validate return paths, AZ resilience, routing symmetry, and throughput.
Use Firewall Manager when central policy administration across an Organization is required and its supported resource types match.

4. Exam Scenario

Scenario: A regulated organization needs to find exposed S3 buckets, detect suspicious account behavior, identify vulnerable EC2 packages, and route high-severity findings to a security team across many accounts.

Serverless Migration General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 4. Serverless migration and modernization patterns: event-driven decomposition, service selection, and design constraints.

1. When Serverless Fits

Serverless architectures are useful when teams want managed scaling and reduced infrastructure operations for event-driven, variable, or independently deployable workloads. AWS services such as Lambda, API Gateway, EventBridge, SQS, SNS, Step Functions, and managed data stores can form the target. Serverless is not automatically cheaper, and it does not remove security, reliability, integration, or capacity planning.

Service Control Policies (SCPs)

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 1 (26%). SCPs appear in almost every multi-account governance scenario. Know deny strategies, inheritance, and interaction with IAM policies cold.

1. Overview

SCPs are a type of Organizations policy that set the maximum permissions available to IAM principals (users, roles) in member accounts. They do not grant permissions — they define the ceiling.

Effective permissions = IAM policy permissions ∩ SCP permissions

If an action is denied by an SCP, no IAM policy can allow it. If an action is not in the SCP allow list (allow-list strategy), it cannot be performed regardless of IAM.

Servicequotas General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 3 (25%). Service Quotas is the centralized way to view and request quota increases. Know how to monitor quotas proactively and integrate with CloudWatch.

1. Overview

AWS Service Quotas provides a central location to view and manage AWS service quotas (formerly called limits) across all services and regions. It enables proactive quota management before hitting limits.

2. Key Concepts

Concept	Description
Quota	Maximum value for a resource or operation (e.g., 5 VPCs per region)
Default quota	AWS-defined starting value
Applied quota	Current quota for your account (may be higher than default after increase)
Adjustable quota	Can be increased via request
Non-adjustable quota	Hard limit — cannot be increased

3. Quota Increase Requests

Submit increase requests directly from Service Quotas console
Requests go to AWS Support automatically
Track request status in Service Quotas console
Some quotas are auto-approved; others require manual review

# Request quota increase via CLI
aws service-quotas request-service-quota-increase \
 --service-code ec2 \
 --quota-code L-1216C47A \
 --desired-value 100

4. CloudWatch Integration

Monitor quota utilization proactively:

Snowfamily General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 4. Snow Family covers the offline-transfer decision — physical shipment versus network transfer — and the operational, security, and chain-of-custody controls it requires.

Availability caveat: AWS documentation states that Snowball Edge is no longer available to new customers. Existing eligible customers should follow current service guidance. For new projects, validate current regional options such as AWS Data Transfer Terminal or AWS Partner solutions; do not assume a Snow device can be ordered.

Systemsmanager General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3. Systems Manager is the operational backbone for EC2 and hybrid environments. Know Parameter Store, Session Manager, Run Command, Patch Manager, and Automation.

1. Overview

AWS Systems Manager (SSM) provides operational management capabilities for EC2 instances, on-premises servers, and other AWS resources. It replaces SSH/RDP access and manual operational tasks with secure, auditable automation.

Key capabilities:

Secure remote access without SSH/RDP (Session Manager)
Run scripts across fleets of instances (Run Command)
Automated patching (Patch Manager)
Configuration and secrets storage (Parameter Store)
Automated operational runbooks (Automation)
Inventory and compliance (Inventory, State Manager)

2. SSM Agent

Required on EC2 instances and on-premises servers
Pre-installed on most AWS-provided AMIs (Amazon Linux 2, Windows Server 2016+)
Requires IAM instance profile with AmazonSSMManagedInstanceCore policy
Communicates with SSM service over HTTPS (port 443) — no inbound ports needed

3. Session Manager

Secure, browser-based or CLI shell access to instances without SSH/RDP:

Transferfamily General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 4. Transfer Family provides managed file-transfer protocols and interfaces (SFTP, FTPS, FTP, AS2, web apps) backed by S3/EFS — partner-facing workflows, not bulk NAS migration.

1. Purpose and Exam Relevance

AWS Transfer Family provides managed endpoints and interfaces for moving files into and out of AWS storage while preserving familiar file-transfer workflows. It supports SFTP, FTPS, FTP, AS2, and browser-based experiences for supported use cases, with Amazon S3 and Amazon EFS as storage backends. Use it when employees, customers, or business partners need a managed protocol-compatible interface; it is not a bulk NAS migration engine.

Trustedadvisor General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 1 and 3. Trusted Advisor provides checks across six categories. These are not the six Well-Architected pillars. Check availability depends on the current AWS Support plan and is changing; verify the current plan and check reference before relying on a specific check.

1. Overview

AWS Trusted Advisor inspects your AWS environment and provides recommendations based on AWS best practices. Check refresh behavior and availability depend on the plan and check; do not assume every result is real-time.

VPC Advanced

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 1 (26%), Domain 2 (29%). Advanced VPC features are tested heavily at the professional level. Know VPC sharing, PrivateLink, endpoints, and peering limitations.

1. VPC Endpoints

Gateway Endpoints

Free; route-table based
Supported services: S3 and DynamoDB only
Traffic stays within AWS network — does not leave to internet
Add a route in the route table pointing to the endpoint

Interface Endpoints (AWS PrivateLink)

ENI with private IP in your VPC subnet
Supports 100+ AWS services and custom services
Billed per hour + per GB
DNS resolves service hostname to private IP within VPC
Supports endpoint policies to restrict access

VPC
├── Subnet
│ └── Interface Endpoint ENI (private IP: 10.0.1.50)
│ └── PrivateLink → AWS Service (e.g., Secrets Manager)
└── Route Table (no change needed — DNS-based)

Gateway Load Balancer Endpoints

Used for inline traffic inspection (third-party appliances)
Integrates with Gateway Load Balancer for transparent bump-in-the-wire inspection

VPC sharing allows multiple accounts to use subnets from a single VPC owned by one account (the owner).

Wellarchitected Tool General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 3 (25%). The Well-Architected Framework and Tool are the structured approach to architecture improvement. Know the 6 pillars, key design principles, and how the tool works.

1. The Six Pillars

Pillar	Focus
Operational Excellence	Run and monitor systems, improve processes
Security	Protect data, systems, and assets
Reliability	Recover from failures, meet demand
Performance Efficiency	Use resources efficiently
Cost Optimization	Avoid unnecessary costs
Sustainability	Minimize environmental impact

2. Key Design Principles per Pillar

Operational Excellence

Perform operations as code (IaC, runbooks)
Make frequent, small, reversible changes
Anticipate failure — test failure scenarios
Learn from operational events

Security

Implement a strong identity foundation (least privilege, IAM)
Enable traceability (CloudTrail, CloudWatch)
Apply security at all layers
Automate security best practices
Protect data in transit and at rest

Reliability

Automatically recover from failure
Test recovery procedures
Scale horizontally to increase availability
Stop guessing capacity — use Auto Scaling
Manage change through automation

Performance Efficiency

Democratize advanced technologies (use managed services)
Go global in minutes (multi-region)
Use serverless architectures
Experiment more often
Consider mechanical sympathy (match resource to workload)

Cost Optimization

Implement cloud financial management
Adopt a consumption model (pay for what you use)
Measure overall efficiency
Stop spending money on undifferentiated heavy lifting
Analyze and attribute expenditure

Sustainability

Understand your impact
Establish sustainability goals
Maximize utilization
Use managed services
Reduce downstream impact

3. AWS Well-Architected Tool

A free service in the AWS console for conducting architecture reviews:

Xray General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3. X-Ray is the distributed tracing service. Know service maps, sampling, annotations, and integration with Lambda, ECS, and API Gateway.

1. Overview

AWS X-Ray provides distributed tracing for applications. It tracks requests as they travel through microservices, Lambda functions, databases, and external APIs — helping identify latency bottlenecks and errors.

Problems it solves:

Latency is high but you don’t know which service is slow
Errors occur but you can’t trace them across services
No visibility into downstream dependency performance

2. Core Concepts

Concept	Description
Trace	End-to-end record of a request across all services
Segment	Data from a single service (one segment per service)
Subsegment	Granular data within a segment (DB call, HTTP call, custom)
Service map	Visual graph of services and their connections
Annotation	Key-value pair indexed for filtering (searchable)
Metadata	Key-value pair not indexed (for debugging, not filtering)
Sampling	Percentage of requests traced (reduces cost and overhead)

3. Service Map

Visual representation of your application’s architecture
Shows: services, connections, latency, error rates, throttle rates
Color-coded: green (healthy), yellow (slow), red (errors)
Drill down into any node to see traces

4. Sampling

By default: first request per second + 5% of additional requests
Custom sampling rules: define rate by service, URL, method, host
Higher sampling = more visibility, higher cost
Use reservoir (fixed number per second) + rate (percentage above reservoir)

{
 "version": 2,
 "rules": [{
 "description": "High-value transactions",
 "host": "*",
 "http_method": "POST",
 "url_path": "/api/payment*",
 "fixed_target": 10,
 "rate": 0.5
 }]
}

5. Integration with AWS Services

Service	Integration
Lambda	Built-in — enable Active Tracing in function config
API Gateway	Enable X-Ray tracing on stage
ECS	Add X-Ray daemon as sidecar container
EC2	Install X-Ray daemon, instrument SDK
Elastic Beanstalk	Enable via configuration option
App Mesh	Native integration
SNS / SQS	Trace propagation via message attributes

Lambda Active Tracing

# SAM template
Properties:
 Tracing: Active  # Enables X-Ray for Lambda

Lambda automatically creates a segment. Add subsegments for downstream calls using the X-Ray SDK.

All AWS Services Review

Sun, 04 Oct 2026 00:00:00 +0000

🎯 Quick Service Reference for DOP-C02

Domain 1: SDLC Automation (22%)

CI/CD Core Services

CodePipeline - Orchestrates CI/CD workflows, supports cross-account deployments
CodeBuild - Managed build service, uses buildspec.yml, supports Docker
CodeDeploy - Deployment service, supports blue/green, rolling, canary strategies
CodeCommit - Git repositories (status uncertain — was restricted to existing customers July 2024; verify current availability before the exam)
CodeStar - Retired July 2024. CodeCatalyst - Maintenance mode Nov 2025. See DEPRECATED-SERVICES.md
AppConfig - Managed feature flags and config deployments with validation and auto-rollback
CodeArtifact - Managed artifact repository (npm, Maven, PyPI, NuGet); domain + repository model

Integration & Automation

EventBridge - Event routing, custom events, cross-account event sharing
Step Functions - Workflow orchestration, state machines, error handling
Lambda - Serverless compute, event-driven processing, 15-minute max runtime
API Gateway - REST/HTTP APIs, WebSocket, request/response transformation
X-Ray - Distributed tracing, performance analysis, service maps

Testing & Quality

Automated Testing - Unit, integration, security, performance testing
Artifacts Management - S3 storage, versioning, lifecycle policies
Security Integration - SAST/DAST scanning, vulnerability assessments

Domain 2: Infrastructure as Code (17%)

IaC Services

CloudFormation - Native IaC, YAML/JSON, intrinsic functions, drift detection
CDK - Code-based IaC, synthesizes to CloudFormation, multiple languages
SAM - Serverless application model, extends CloudFormation
Terraform - Third-party IaC, state management, workspaces

Configuration Management

Systems Manager - Parameter Store, Session Manager, Run Command, Patch Manager
Config - Configuration compliance, rules, remediation actions
Service Catalog - Standardized product portfolios, governance

Governance

Organizations - Multi-account management, SCPs, consolidated billing
Control Tower - Landing zones, guardrails, account factory

Domain 3: Resilient Cloud Solutions (15%)

High Availability

Auto Scaling - EC2, ECS, Application Auto Scaling, predictive scaling
Elastic Load Balancing - ALB (Layer 7), NLB (Layer 4), GWLB (Layer 3)
Route 53 - DNS, health checks, failover routing, geolocation
Multi-AZ Deployments - RDS, ElastiCache, EFS cross-AZ replication

Disaster Recovery

S3 Cross-Region Replication - Automatic replication, versioning, lifecycle
RDS Multi-AZ - Synchronous replication, automatic failover
Aurora Global Database - Cross-region read replicas, fast recovery
EKS - Kubernetes orchestration, multi-AZ clusters, managed node groups

Domain 4: Monitoring and Logging (15%)

Monitoring Services

CloudWatch - Metrics, alarms, dashboards, custom metrics, anomaly detection
CloudWatch Logs - Log aggregation, insights, metric filters, retention
X-Ray - Application tracing, service maps, performance bottlenecks
CloudTrail - API logging, governance, compliance, data events

Security Monitoring

Config - Resource compliance, configuration history, rules
GuardDuty - Threat detection, ML-based analysis, findings
Inspector - Vulnerability assessments, network reachability
Security Hub - Centralized security findings, compliance standards

Systems Management

Systems Manager - Operational insights, automation, patch management
Personal Health Dashboard - Service health, maintenance notifications

Domain 5: Incident and Event Response (14%)

Event Processing

EventBridge - Event routing, custom events, third-party integrations
EventBridge Pipes - Point-to-point integrations with filtering and enrichment (source → filter → enrich → target)
EventBridge Scheduler - Serverless cron/rate/one-time scheduling for 200+ AWS API targets
SNS - Pub/sub messaging, mobile push, email, SMS notifications
SQS - Message queuing, FIFO, dead letter queues, visibility timeout
Lambda - Event-driven processing, automatic scaling, multiple triggers

Workflow Orchestration

Step Functions - State machines, parallel processing, error handling
CloudWatch Alarms - Threshold monitoring, composite alarms, actions
Auto Scaling - Dynamic scaling based on metrics, scheduled scaling
Incident Manager - Response plans, escalation, runbooks, dedup string (maintenance mode — know concepts)
ChatOps (Amazon Q in chat) - AWS operations from Slack/Teams; CodePipeline approvals, CloudWatch alarms in chat

Domain 6: Security and Compliance (17%)

Identity & Access

IAM - Users, roles, policies, conditions, cross-account access
IAM Identity Center - Workforce SSO across accounts; permission sets; replaces AWS SSO
Organizations - SCPs, RCPs, account management, consolidated billing
Control Tower - Governance, guardrails, compliance monitoring
Resource Control Policies (RCPs) - Restrict what can be done to resources org-wide (complement to SCPs)

Encryption & Secrets

KMS - Key management, envelope encryption, cross-account access
Secrets Manager - Secret rotation, database credentials, API keys
Certificate Manager - SSL/TLS certificates, automatic renewal

Security Services

WAF - Web application firewall, rate limiting, geo-blocking
Shield - DDoS protection, Standard (free), Advanced (paid)
GuardDuty - Threat detection, behavioral analysis, findings
Macie - Sensitive data discovery in S3; policy findings vs sensitive-data findings
Audit Manager - Automated compliance evidence collection for PCI-DSS, HIPAA, SOC 2, etc.

🔥 High-Impact Integration Patterns

Cross-Account Patterns

Source Account → Assume Role → Target Account
S3 Bucket Policy + KMS Key Policy + IAM Role

CI/CD Pipeline Pattern

CodeCommit → CodeBuild → CodeDeploy → CloudWatch
EventBridge → Lambda → SNS → Step Functions

Event-Driven Architecture

API Gateway → Lambda → EventBridge → [SNS/SQS/Lambda]
CloudWatch Alarm → EventBridge → Lambda → Auto Scaling

Multi-Region Resilience

Route 53 → CloudFront → ALB (Multi-AZ) → Auto Scaling
RDS Multi-AZ → Cross-Region Read Replicas
S3 → Cross-Region Replication

⚡ Critical CLI Commands

CodePipeline

aws codepipeline start-pipeline-execution --name MyPipeline
aws codepipeline get-pipeline-state --name MyPipeline
aws codepipeline stop-pipeline-execution --pipeline-name MyPipeline

CodeBuild

aws codebuild start-build --project-name MyProject
aws codebuild batch-get-builds --ids build-id
aws codebuild list-projects

CloudFormation

aws cloudformation deploy --template-file template.yaml --stack-name MyStack
aws cloudformation describe-stacks --stack-name MyStack
aws cloudformation detect-stack-drift --stack-name MyStack

Auto Scaling

aws autoscaling describe-auto-scaling-groups
aws autoscaling set-desired-capacity --auto-scaling-group-name MyASG --desired-capacity 3
aws autoscaling put-scaling-policy --policy-name MyPolicy

Systems Manager

aws ssm get-parameter --name /myapp/database/url --with-decryption
aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=tag:Environment,Values=prod"
aws ssm start-session --target i-1234567890abcdef0

🎯 Exam Recognition Patterns

Service Selection Triggers

“Cross-account deployment” → IAM roles + trust policies
“Zero-downtime deployment” → Blue/green or canary
“Automatic scaling” → Auto Scaling Groups + CloudWatch
“Event-driven processing” → EventBridge + Lambda
“Secure secrets” → Secrets Manager or Parameter Store (SecureString)
“Infrastructure as Code” → CloudFormation, CDK, or Terraform
“Monitoring and alerting” → CloudWatch + SNS
“Compliance monitoring” → Config + remediation actions

Common Exam Traps

CloudWatch vs CloudTrail vs Config - Metrics vs API logs vs compliance
ALB vs NLB vs GWLB - Layer 7 vs Layer 4 vs Layer 3
Multi-AZ vs Read Replicas - HA vs read scaling
SNS vs SQS - Pub/sub vs queuing
Parameter Store vs Secrets Manager - Configuration vs secrets with rotation

Architecture Decision Trees

Need automatic failover? → Multi-AZ deployment
Need cross-region disaster recovery? → Cross-region replication
Need to process events? → EventBridge + Lambda
Need workflow orchestration? → Step Functions
Need secure parameter storage? → Parameter Store (config) vs Secrets Manager (secrets)

📊 Performance & Cost Optimization

Auto Scaling Optimization

Target Tracking - Maintain specific metric value
Step Scaling - Scale based on alarm breach size
Predictive Scaling - ML-based capacity planning
Scheduled Scaling - Time-based scaling

Lambda Optimization

Memory allocation - Affects CPU and network performance
Provisioned concurrency - Eliminates cold starts
Dead letter queues - Handle failed invocations
Reserved concurrency - Limit concurrent executions

Cost Management

Reserved Instances - Long-term capacity reservations
Spot Instances - Fault-tolerant workloads
S3 Intelligent Tiering - Automatic cost optimization
CloudWatch Logs retention - Manage log storage costs

🚨 Security Best Practices

IAM Principles

Least privilege - Minimum necessary permissions
Role-based access - Use roles instead of users for services
Conditions - Restrict access based on context
Regular reviews - Audit permissions regularly

Encryption Standards

Data at rest - S3, EBS, RDS encryption
Data in transit - TLS/SSL for all communications
Key management - KMS for centralized key management
Envelope encryption - Encrypt data keys with master keys

Network Security

VPC isolation - Separate environments
Security groups - Stateful firewall rules
NACLs - Stateless subnet-level rules
VPC endpoints - Private service access

🎯 Final Exam Checklist

Must Know Cold

Cross-account IAM role assumption process
Blue/green vs rolling vs canary deployment differences
Multi-AZ vs Read Replica use cases
EventBridge event routing and filtering
CloudFormation intrinsic functions (!Ref, !GetAtt, !Sub)
Auto Scaling policy types and triggers
Lambda error handling and retry behavior
Step Functions state types and error handling

Service Integration Patterns

CodePipeline + CodeBuild + CodeDeploy workflow
EventBridge + Lambda + SNS/SQS integration
CloudWatch + Auto Scaling + ELB integration
Route 53 + CloudFront + S3 global architecture
Systems Manager + EC2 + Auto Scaling management

Troubleshooting Scenarios

Pipeline failures and rollback procedures
Auto Scaling issues and debugging
Cross-account access problems
Performance bottlenecks identification
Security incident response procedures

Remember: Think practically, consider cost implications, and always choose the most AWS-native solution when multiple options exist. Good luck! 🚀

Amazon CloudWatch Synthetics

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What it is: Proactive monitoring using canaries — configurable scripts that run on a schedule and simulate user interactions with your endpoints. Synthetics finds problems before real users do.

What problem it solves: Reactive monitoring (alarms on real traffic metrics) only fires after users are already affected. Synthetics runs synthetic transactions continuously so you detect outages, broken APIs, and slow pages even during low-traffic periods.

2. Canaries

A canary is a script (Node.js or Python) that runs on a schedule in a managed Lambda-like environment. It makes HTTP requests, checks responses, and reports pass/fail to CloudWatch.

Amazon EventBridge

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is EventBridge?

Serverless event bus service for application integration
Routes events between AWS services, SaaS applications, and custom applications
Formerly known as CloudWatch Events
Event-driven architecture foundation

Key Components

Event Buses - Receive and route events
Rules - Match events and route to targets
Targets - Destinations for matched events
Events - JSON messages describing state changes

Use Cases

Application decoupling
Real-time data processing
Automated incident response
Cross-account event routing
SaaS integration

2. Event Buses

Default Event Bus

Automatically created in each account
Receives events from AWS services
Cannot be deleted
Regional service

Custom Event Buses

User-created event buses
Isolate events by application or team
Cross-account sharing capabilities
Resource-based policies

# Create custom event bus
aws events create-event-bus --name "MyApplicationBus"

# Put resource policy on event bus
aws events put-permission \
 --principal "123456789012" \
 --action "events:PutEvents" \
 --statement-id "CrossAccountAccess"

Partner Event Buses

Created by SaaS providers
Receive events from partner applications
Automatic provisioning when configured

3. Events and Event Patterns

Event Structure

{
 "version": "0",
 "id": "6a7e8feb-b491-4cf7-a9f1-bf3703467718",
 "detail-type": "EC2 Instance State-change Notification",
 "source": "aws.ec2",
 "account": "123456789012",
 "time": "2024-01-15T10:30:00Z",
 "region": "us-east-1",
 "detail": {
 "instance-id": "i-1234567890abcdef0",
 "state": "running"
 }
}

Event Patterns

{
 "source": ["aws.ec2"],
 "detail-type": ["EC2 Instance State-change Notification"],
 "detail": {
 "state": ["running", "stopped"]
 }
}

Custom Events

# Send custom event
aws events put-events \
 --entries '[
 {
 "Source": "myapp.orders",
 "DetailType": "Order Placed",
 "Detail": "{\"orderId\":\"12345\",\"customerId\":\"67890\",\"amount\":99.99}"
 }
 ]'

4. Rules and Targets

Create Rule

# Create rule for EC2 state changes
aws events put-rule \
 --name "EC2StateChange" \
 --event-pattern '{
 "source": ["aws.ec2"],
 "detail-type": ["EC2 Instance State-change Notification"],
 "detail": {
 "state": ["running", "stopped"]
 }
 }' \
 --state ENABLED

Rule Targets

# Add Lambda target
aws events put-targets \
 --rule "EC2StateChange" \
 --targets '[
 {
 "Id": "1",
 "Arn": "arn:aws:lambda:us-east-1:123456789012:function:ProcessEC2StateChange"
 }
 ]'

# Add SNS target
aws events put-targets \
 --rule "EC2StateChange" \
 --targets '[
 {
 "Id": "2",
 "Arn": "arn:aws:sns:us-east-1:123456789012:ec2-notifications"
 }
 ]'

Supported Targets

Lambda functions
SNS topics
SQS queues
Kinesis streams
Step Functions
ECS tasks
Systems Manager Run Command
API Gateway
HTTP endpoints

5. Incident Response Automation

Automated EC2 Response

import boto3
import json

def lambda_handler(event, context):
 """Automated response to EC2 incidents"""
 
 detail = event['detail']
 instance_id = detail['instance-id']
 state = detail['state']
 
 if state == 'stopped' and 'unexpected' in detail.get('reason', ''):
 # Investigate unexpected stop
 investigate_instance_stop(instance_id)
 
 # Restart if healthy
 if is_instance_healthy(instance_id):
 restart_instance(instance_id)
 else:
 create_incident_ticket(instance_id, 'Instance health check failed')

def investigate_instance_stop(instance_id):
 """Investigate why instance stopped"""
 ec2 = boto3.client('ec2')
 
 # Get instance details
 response = ec2.describe_instances(InstanceIds=[instance_id])
 
 # Check CloudTrail for stop events
 cloudtrail = boto3.client('cloudtrail')
 events = cloudtrail.lookup_events(
 LookupAttributes=[
 {
 'AttributeKey': 'ResourceName',
 'AttributeValue': instance_id
 }
 ]
 )
 
 return events

Security Incident Response

def handle_security_incident(event, context):
 """Handle GuardDuty security findings"""
 
 finding = event['detail']
 severity = finding['severity']
 
 if severity >= 7.0: # High severity
 # Isolate affected resources
 isolate_compromised_resources(finding)
 
 # Create incident
 create_security_incident(finding)
 
 # Notify security team
 notify_security_team(finding)
 
 elif severity >= 4.0: # Medium severity
 # Log for investigation
 log_security_event(finding)
 
 # Apply automated remediation
 apply_security_remediation(finding)

def isolate_compromised_resources(finding):
 """Isolate compromised EC2 instances"""
 ec2 = boto3.client('ec2')
 
 for resource in finding.get('service', {}).get('resources', []): # was: iterated a boolean (== comparison), which raises TypeError
 if resource['resourceType'] == 'Instance':
 instance_id = resource['instanceDetails']['instanceId']
 
 # Create isolation security group
 isolation_sg = create_isolation_security_group()
 
 # Apply to instance
 ec2.modify_instance_attribute(
 InstanceId=instance_id,
 Groups=[isolation_sg]
 )

6. Application Integration Patterns

Microservices Communication

{
 "Rules": [
 {
 "Name": "OrderProcessing",
 "EventPattern": {
 "source": ["ecommerce.orders"],
 "detail-type": ["Order Placed"]
 },
 "Targets": [
 {
 "Id": "inventory-service",
 "Arn": "arn:aws:lambda:us-east-1:123456789012:function:UpdateInventory"
 },
 {
 "Id": "payment-service", 
 "Arn": "arn:aws:lambda:us-east-1:123456789012:function:ProcessPayment"
 },
 {
 "Id": "notification-service",
 "Arn": "arn:aws:sns:us-east-1:123456789012:order-notifications"
 }
 ]
 }
 ]
}

Cross-Account Event Routing

# Grant cross-account permissions
aws events put-permission \
 --principal "111122223333" \
 --action "events:PutEvents" \
 --statement-id "CrossAccountOrderEvents"

# Create cross-account rule
aws events put-rule \
 --name "CrossAccountOrders" \
 --event-pattern '{
 "source": ["partner.orders"],
 "account": ["111122223333"]
 }'

7. Monitoring and Observability

EventBridge Metrics

import boto3

def monitor_eventbridge_metrics():
 """Monitor EventBridge performance"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Get rule invocation metrics
 response = cloudwatch.get_metric_statistics(
 Namespace='AWS/Events',
 MetricName='InvocationsCount',
 Dimensions=[
 {
 'Name': 'RuleName',
 'Value': 'EC2StateChange'
 }
 ],
 StartTime=datetime.utcnow() - timedelta(hours=1),
 EndTime=datetime.utcnow(),
 Period=300,
 Statistics=['Sum']
 )
 
 return response['Datapoints']

Dead Letter Queues

# Create DLQ for failed events
aws sqs create-queue --queue-name "eventbridge-dlq"

# Configure rule with DLQ
aws events put-targets \
 --rule "MyRule" \
 --targets '[
 {
 "Id": "1",
 "Arn": "arn:aws:lambda:us-east-1:123456789012:function:MyFunction",
 "DeadLetterConfig": {
 "Arn": "arn:aws:sqs:us-east-1:123456789012:eventbridge-dlq"
 }
 }
 ]'

8. Schema Registry

Event Schema Management

# Create schema registry
aws schemas create-registry --registry-name "MyAppRegistry"

# Create schema
aws schemas create-schema \
 --registry-name "MyAppRegistry" \
 --schema-name "OrderPlaced" \
 --type "JSONSchemaDraft4" \
 --content '{
 "type": "object",
 "properties": {
 "orderId": {"type": "string"},
 "customerId": {"type": "string"},
 "amount": {"type": "number"}
 },
 "required": ["orderId", "customerId", "amount"]
 }'

Schema Discovery

import boto3

def discover_event_schemas():
 """Automatically discover event schemas"""
 
 schemas = boto3.client('schemas')
 
 # Start schema discovery
 response = schemas.start_discoverer(
 DiscovererId='MyAppDiscoverer',
 SourceArn='arn:aws:events:us-east-1:123456789012:event-bus/MyAppBus'
 )
 
 return response

9. Error Handling and Retry

Retry Configuration

{
 "RetryPolicy": {
 "MaximumRetryAttempts": 3,
 "MaximumEventAge": 3600
 },
 "DeadLetterConfig": {
 "Arn": "arn:aws:sqs:us-east-1:123456789012:failed-events"
 }
}

Error Handling Patterns

def robust_event_handler(event, context):
 """Event handler with error handling"""
 
 try:
 # Process event
 result = process_event(event)
 
 # Log success
 logger.info(f"Successfully processed event: {event['id']}")
 
 return result
 
 except RetryableError as e:
 # Log for retry
 logger.warning(f"Retryable error processing event: {e}")
 raise e
 
 except FatalError as e:
 # Log and send to DLQ
 logger.error(f"Fatal error processing event: {e}")
 send_to_dlq(event, str(e))
 
 except Exception as e:
 # Unknown error - log and investigate
 logger.error(f"Unknown error processing event: {e}")
 create_investigation_ticket(event, str(e))
 raise e

10. Performance Optimization

Batch Processing

def batch_event_processor(event, context):
 """Process multiple events in batch"""
 
 # EventBridge can send up to 10 events per invocation
 records = event.get('Records', [])
 
 batch_size = 10
 for i in range(0, len(records), batch_size):
 batch = records[i:i + batch_size]
 process_event_batch(batch)

def process_event_batch(events):
 """Process batch of events efficiently"""
 
 # Group events by type
 events_by_type = {}
 for event in events:
 event_type = event['detail-type']
 if event_type not in events_by_type:
 events_by_type[event_type] = []
 events_by_type[event_type].append(event)
 
 # Process each type efficiently
 for event_type, type_events in events_by_type.items():
 processor = get_processor_for_type(event_type)
 processor.process_batch(type_events)

Connection Pooling

import boto3
from botocore.config import Config

# Configure connection pooling
config = Config(
 max_pool_connections=50,
 retries={'max_attempts': 3}
)

# Reuse clients
eventbridge = boto3.client('events', config=config)
lambda_client = boto3.client('lambda', config=config)

11. Common Exam Scenarios

Scenario 1: Automate incident response for failed deployments

Solution:

Amazon EventBridge Pipes

Sun, 04 Oct 2026 00:00:00 +0000

Launched: November 2022. Pipes are a distinct EventBridge feature from rules/buses — know the difference.

1. Overview

What it is: A point-to-point integration that connects a single source to a single target with optional filtering and enrichment in between — all without writing glue code.

What problem it solves: Before Pipes, connecting an SQS queue to a Lambda enricher to a Step Functions workflow required custom Lambda code just to pass messages along. Pipes does that wiring declaratively, with built-in batching, filtering, and enrichment.

Amazon Macie

Sun, 04 Oct 2026 00:00:00 +0000

What it is: Data security for S3 — machine learning plus pattern matching that finds sensitive data and bucket misconfigurations, then routes findings into your response workflow.

Exam-testable facts:

Two finding types: policy findings (bucket-level: publicly accessible, unencrypted, etc.) and sensitive data findings (object-level: credentials, financial data, personal/PII/PHI, custom identifiers, or multiple categories at once).
Discovery modes: automated sensitive data discovery (continuous, sampled) vs sensitive data discovery jobs (targeted, one-time or scheduled).
Custom data identifiers (regex) catch proprietary formats; allow lists suppress known-safe matches to cut noise.
Finding flow: findings go to EventBridge and Security Hub for automated response; full discovery details land in a customer-owned S3 bucket; findings retained 30 days.
Sensitive data findings are always treated as new — re-detecting the same object creates a fresh finding (unlike policy findings, which update in place).

Common traps:

Automated Testing in the SDLC

Sun, 04 Oct 2026 00:00:00 +0000

Automated testing is a cornerstone of modern DevOps practices and a critical topic for the DOP-C02 exam. Each stage of a CI/CD pipeline acts as a quality gate. If a problem is found, the code is prevented from progressing, ensuring that only high-quality, verified code reaches production.

For the exam, you must know the different types of tests, where they fit into the CI/CD pipeline, and how to implement automated testing using various AWS services.

AWS API Gateway

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is API Gateway?

Fully managed service for creating, publishing, and managing APIs
Supports REST, HTTP, and WebSocket APIs
Handles traffic management, authorization, monitoring, and API versioning
Integrates with Lambda, EC2, and other AWS services

Key Benefits

Serverless - No infrastructure to manage
Scalable - Handles thousands of concurrent API calls
Secure - Built-in authorization and authentication
Monitoring - CloudWatch integration and X-Ray tracing
Cost Effective - Pay per API call

2. API Types

REST API

# Create REST API
aws apigateway create-rest-api \
 --name "my-rest-api" \
 --description "REST API for microservices" \
 --endpoint-configuration types=REGIONAL

HTTP API

# Create HTTP API (faster and cheaper)
aws apigatewayv2 create-api \
 --name "my-http-api" \
 --protocol-type HTTP \
 --target "arn:aws:lambda:us-east-1:123456789012:function:MyFunction"

WebSocket API

# Create WebSocket API
aws apigatewayv2 create-api \
 --name "my-websocket-api" \
 --protocol-type WEBSOCKET \
 --route-selection-expression '$request.body.action'

3. Integration with CI/CD

CodePipeline Integration

# buildspec.yml for API deployment
version: 0.2
phases:
 install:
 runtime-versions:
 nodejs: 14
 pre_build:
 commands:
 - npm install -g aws-cli
 build:
 commands:
 - aws apigateway create-deployment --rest-api-id $API_ID --stage-name prod
 post_build:
 commands:
 - echo "API deployed successfully"

SAM Template for API

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
 MyApi:
 Type: AWS::Serverless::Api
 Properties:
 StageName: prod
 Auth:
 DefaultAuthorizer: MyCognitoAuthorizer
 Authorizers:
 MyCognitoAuthorizer:
 UserPoolArn: !GetAtt MyCognitoUserPool.Arn
 
 MyFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: src/
 Handler: index.handler
 Runtime: nodejs14.x
 Events:
 ApiEvent:
 Type: Api
 Properties:
 RestApiId: !Ref MyApi
 Path: /users
 Method: get

4. Authentication and Authorization

Cognito Integration

def create_cognito_authorizer():
 """Create Cognito User Pool authorizer"""
 
 apigateway = boto3.client('apigateway')
 
 response = apigateway.create_authorizer(
 restApiId='api-id',
 name='CognitoAuthorizer',
 type='COGNITO_USER_POOLS',
 providerARNs=[
 'arn:aws:cognito-idp:us-east-1:123456789012:userpool/us-east-1_ABC123'
 ],
 identitySource='method.request.header.Authorization'
 )
 
 return response

Lambda Authorizer

def lambda_authorizer(event, context):
 """Custom Lambda authorizer"""
 
 token = event['authorizationToken']
 
 # Validate token
 if validate_token(token):
 policy = generate_policy('user', 'Allow', event['methodArn'])
 else:
 policy = generate_policy('user', 'Deny', event['methodArn'])
 
 return policy

def generate_policy(principal_id, effect, resource):
 """Generate IAM policy for API Gateway"""
 
 return {
 'principalId': principal_id,
 'policyDocument': {
 'Version': '2012-10-17',
 'Statement': [
 {
 'Action': 'execute-api:Invoke',
 'Effect': effect,
 'Resource': resource
 }
 ]
 }
 }

5. Deployment Strategies

Blue/Green Deployment

def blue_green_api_deployment():
 """Implement blue/green deployment for API Gateway"""
 
 apigateway = boto3.client('apigateway')
 
 # Create new deployment (green)
 green_deployment = apigateway.create_deployment(
 restApiId='api-id',
 stageName='green',
 description='Green deployment for testing'
 )
 
 # Test green deployment
 if test_deployment('green'):
 # Switch traffic to green
 apigateway.update_stage(
 restApiId='api-id',
 stageName='prod',
 patchOps=[
 {
 'op': 'replace',
 'path': '/deploymentId',
 'value': green_deployment['id']
 }
 ]
 )
 
 # Clean up old blue deployment
 cleanup_old_deployment('blue')
 else:
 # Rollback - keep blue active
 rollback_deployment('blue')

Canary Deployment

# Create canary deployment
aws apigateway create-deployment \
 --rest-api-id "api-id" \
 --stage-name "prod" \
 --canary-settings '{
 "percentTraffic": 10,
 "deploymentId": "new-deployment-id",
 "useStageCache": false
 }'

6. Monitoring and Logging

CloudWatch Integration

def setup_api_monitoring():
 """Set up API Gateway monitoring"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Create alarm for high error rate
 cloudwatch.put_metric_alarm(
 AlarmName='API-HighErrorRate',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=2,
 MetricName='4XXError',
 Namespace='AWS/ApiGateway',
 Period=300,
 Statistic='Sum',
 Threshold=10,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:api-alerts'
 ],
 Dimensions=[
 {
 'Name': 'ApiName',
 'Value': 'my-rest-api'
 }
 ]
 )

X-Ray Tracing

# Enable X-Ray tracing
aws apigateway update-stage \
 --rest-api-id "api-id" \
 --stage-name "prod" \
 --patch-ops op=replace,path=/tracingConfig/tracingEnabled,value=true

7. Common Exam Scenarios

Scenario 1: Secure API with authentication

Solution:

AWS AppConfig

Sun, 04 Oct 2026 00:00:00 +0000

What it is: Managed application-configuration service: deploy config changes (feature flags, throttling limits, allow-lists) with the same safety as code deploys — validation, deployment strategies, automatic rollback.

Exam-testable facts: Configuration stored as hosted documents, validated against a schema before deployment; deployment strategies include all-at-once, linear, and canary with bake time; CloudWatch alarms trigger automatic rollback; integrates with CodePipeline/CodeDeploy as a deployment action.

Why it matters: “Safely roll out a config change with canary + auto-rollback” → AppConfig, not a Parameter Store edit.

AWS Audit Manager

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What it is: A service that continuously collects evidence from your AWS environment to help you audit compliance with frameworks like PCI-DSS, HIPAA, SOC 2, CIS, and GDPR — replacing manual evidence collection with automated, always-on gathering.

What problem it solves: Compliance audits traditionally require manually pulling screenshots, logs, and config snapshots before an audit. Audit Manager automates that collection continuously, so when an auditor asks for evidence you already have it.

AWS Auto Scaling

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is Auto Scaling?

Automatically adjusts compute capacity based on demand
Maintains application availability and performance
Optimizes costs by scaling resources up and down
Multiple scaling services across different AWS resources

Auto Scaling Services

EC2 Auto Scaling - EC2 instances
Application Auto Scaling - ECS, Lambda, DynamoDB, etc.
AWS Auto Scaling - Unified scaling across services
Predictive Scaling - ML-based capacity planning

2. EC2 Auto Scaling

Auto Scaling Groups (ASG)

# Create launch template
aws ec2 create-launch-template \
 --launch-template-name "web-server-template" \
 --launch-template-data '{
 "ImageId": "ami-0abcdef1234567890",
 "InstanceType": "t3.micro",
 "SecurityGroupIds": ["sg-12345678"],
 "UserData": "IyEvYmluL2Jhc2gKeXVtIHVwZGF0ZSAteQp5dW0gaW5zdGFsbCAteSBodHRwZApzZXJ2aWNlIGh0dHBkIHN0YXJ0"
 }'

# Create Auto Scaling group
aws autoscaling create-auto-scaling-group \
 --auto-scaling-group-name "web-servers-asg" \
 --launch-template LaunchTemplateName=web-server-template,Version='$Latest' \
 --min-size 2 \
 --max-size 10 \
 --desired-capacity 3 \
 --vpc-zone-identifier "subnet-12345678,subnet-87654321" \
 --target-group-arns "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-servers/1234567890123456"

Scaling Policies

# Target tracking scaling policy
aws autoscaling put-scaling-policy \
 --auto-scaling-group-name "web-servers-asg" \
 --policy-name "cpu-target-tracking" \
 --policy-type "TargetTrackingScaling" \
 --target-tracking-configuration '{
 "TargetValue": 70.0,
 "PredefinedMetricSpecification": {
 "PredefinedMetricType": "ASGAverageCPUUtilization"
 },
 "ScaleOutCooldown": 300,
 "ScaleInCooldown": 300
 }'

# Step scaling policy
aws autoscaling put-scaling-policy \
 --auto-scaling-group-name "web-servers-asg" \
 --policy-name "scale-out-policy" \
 --policy-type "StepScaling" \
 --adjustment-type "ChangeInCapacity" \
 --step-adjustments '[
 {
 "MetricIntervalLowerBound": 0,
 "MetricIntervalUpperBound": 50,
 "ScalingAdjustment": 1
 },
 {
 "MetricIntervalLowerBound": 50,
 "ScalingAdjustment": 2
 }
 ]'

3. Application Auto Scaling

ECS Service Scaling

import boto3

def setup_ecs_auto_scaling():
 """Configure Auto Scaling for ECS service"""
 
 autoscaling = boto3.client('application-autoscaling')
 
 # Register scalable target
 autoscaling.register_scalable_target(
 ServiceNamespace='ecs',
 ResourceId='service/my-cluster/my-service',
 ScalableDimension='ecs:service:DesiredCount',
 MinCapacity=2,
 MaxCapacity=20
 )
 
 # Create scaling policy
 autoscaling.put_scaling_policy(
 PolicyName='cpu-scaling-policy',
 ServiceNamespace='ecs',
 ResourceId='service/my-cluster/my-service',
 ScalableDimension='ecs:service:DesiredCount',
 PolicyType='TargetTrackingScaling',
 TargetTrackingScalingPolicyConfiguration={
 'TargetValue': 70.0,
 'PredefinedMetricSpecification': {
 'PredefinedMetricType': 'ECSServiceAverageCPUUtilization'
 },
 'ScaleOutCooldown': 300,
 'ScaleInCooldown': 300
 }
 )

DynamoDB Auto Scaling

# Register DynamoDB table for scaling
aws application-autoscaling register-scalable-target \
 --service-namespace dynamodb \
 --resource-id "table/MyTable" \
 --scalable-dimension "dynamodb:table:ReadCapacityUnits" \
 --min-capacity 5 \
 --max-capacity 100

# Create scaling policy for DynamoDB
aws application-autoscaling put-scaling-policy \
 --policy-name "MyTableReadScalingPolicy" \
 --service-namespace dynamodb \
 --resource-id "table/MyTable" \
 --scalable-dimension "dynamodb:table:ReadCapacityUnits" \
 --policy-type "TargetTrackingScaling" \
 --target-tracking-scaling-policy-configuration '{
 "TargetValue": 70.0,
 "PredefinedMetricSpecification": {
 "PredefinedMetricType": "DynamoDBReadCapacityUtilization"
 }
 }'

4. Predictive Scaling

ML-Based Capacity Planning

def enable_predictive_scaling():
 """Enable predictive scaling for ASG"""
 
 autoscaling = boto3.client('autoscaling')
 
 # Create predictive scaling policy
 response = autoscaling.put_scaling_policy(
 AutoScalingGroupName='web-servers-asg',
 PolicyName='predictive-scaling-policy',
 PolicyType='PredictiveScaling',
 PredictiveScalingConfiguration={
 'MetricSpecifications': [
 {
 'TargetValue': 70.0,
 'PredefinedMetricPairSpecification': {
 'PredefinedMetricType': 'ASGCPUUtilization'
 }
 }
 ],
 'Mode': 'ForecastAndScale',
 'SchedulingBufferTime': 300,
 'MaxCapacityBreachBehavior': 'HonorMaxCapacity',
 'MaxCapacityBuffer': 10
 }
 )
 
 return response

5. Multi-AZ and Cross-Region Resilience

Multi-AZ Deployment

# Create ASG across multiple AZs
aws autoscaling create-auto-scaling-group \
 --auto-scaling-group-name "resilient-web-asg" \
 --launch-template LaunchTemplateName=web-template,Version='$Latest' \
 --min-size 3 \
 --max-size 15 \
 --desired-capacity 6 \
 --vpc-zone-identifier "subnet-1a,subnet-1b,subnet-1c" \
 --availability-zones "us-east-1a,us-east-1b,us-east-1c" \
 --health-check-type "ELB" \
 --health-check-grace-period 300

Cross-Region Auto Scaling

def setup_cross_region_scaling():
 """Set up Auto Scaling across multiple regions"""
 
 regions = ['us-east-1', 'us-west-2', 'eu-west-1']
 
 for region in regions:
 autoscaling = boto3.client('autoscaling', region_name=region)
 
 # Create ASG in each region
 autoscaling.create_auto_scaling_group(
 AutoScalingGroupName=f'web-asg-{region}',
 LaunchTemplate={
 'LaunchTemplateName': f'web-template-{region}',
 'Version': '$Latest'
 },
 MinSize=2,
 MaxSize=10,
 DesiredCapacity=3,
 VPCZoneIdentifier=get_subnets_for_region(region),
 HealthCheckType='ELB',
 HealthCheckGracePeriod=300
 )

6. Health Checks and Instance Replacement

Health Check Configuration

def configure_health_checks():
 """Configure comprehensive health checks"""
 
 autoscaling = boto3.client('autoscaling')
 
 # Update ASG with ELB health checks
 autoscaling.update_auto_scaling_group(
 AutoScalingGroupName='web-servers-asg',
 HealthCheckType='ELB',
 HealthCheckGracePeriod=300
 )
 
 # Create custom health check Lambda
 lambda_code = '''
import boto3
import json

def lambda_handler(event, context):
 """Custom health check for application"""
 
 instance_id = event['instance_id']
 
 # Perform application-specific health checks
 if check_application_health(instance_id):
 return {'healthy': True}
 else:
 # Mark instance unhealthy
 autoscaling = boto3.client('autoscaling')
 autoscaling.set_instance_health(
 InstanceId=instance_id,
 HealthStatus='Unhealthy'
 )
 return {'healthy': False}

def check_application_health(instance_id):
 """Check application-specific health metrics"""
 # Implementation for custom health checks
 return True
'''

7. Lifecycle Hooks

Instance Lifecycle Management

# Create lifecycle hook for launch
aws autoscaling put-lifecycle-hook \
 --lifecycle-hook-name "launch-hook" \
 --auto-scaling-group-name "web-servers-asg" \
 --lifecycle-transition "autoscaling:EC2_INSTANCE_LAUNCHING" \
 --heartbeat-timeout 300 \
 --notification-target-arn "arn:aws:sns:us-east-1:123456789012:asg-notifications" \
 --role-arn "arn:aws:iam::123456789012:role/AutoScalingNotificationRole"

# Create lifecycle hook for termination
aws autoscaling put-lifecycle-hook \
 --lifecycle-hook-name "terminate-hook" \
 --auto-scaling-group-name "web-servers-asg" \
 --lifecycle-transition "autoscaling:EC2_INSTANCE_TERMINATING" \
 --heartbeat-timeout 300 \
 --default-result "ABANDON"

Lifecycle Hook Processing

def process_lifecycle_hook(event, context):
 """Process Auto Scaling lifecycle hooks"""
 
 message = json.loads(event['Records'][0]['Sns']['Message'])
 
 lifecycle_transition = message['LifecycleTransition']
 instance_id = message['EC2InstanceId']
 lifecycle_action_token = message['LifecycleActionToken']
 auto_scaling_group_name = message['AutoScalingGroupName']
 lifecycle_hook_name = message['LifecycleHookName']
 
 autoscaling = boto3.client('autoscaling')
 
 try:
 if lifecycle_transition == 'autoscaling:EC2_INSTANCE_LAUNCHING':
 # Perform launch initialization
 initialize_instance(instance_id)
 result = 'CONTINUE'
 
 elif lifecycle_transition == 'autoscaling:EC2_INSTANCE_TERMINATING':
 # Perform graceful shutdown
 graceful_shutdown(instance_id)
 result = 'CONTINUE'
 
 # Complete lifecycle action
 autoscaling.complete_lifecycle_action(
 LifecycleHookName=lifecycle_hook_name,
 AutoScalingGroupName=auto_scaling_group_name,
 InstanceId=instance_id,
 LifecycleActionToken=lifecycle_action_token,
 LifecycleActionResult=result
 )
 
 except Exception as e:
 # Abandon on error
 autoscaling.complete_lifecycle_action(
 LifecycleHookName=lifecycle_hook_name,
 AutoScalingGroupName=auto_scaling_group_name,
 InstanceId=instance_id,
 LifecycleActionToken=lifecycle_action_token,
 LifecycleActionResult='ABANDON'
 )

8. Monitoring and Metrics

CloudWatch Integration

def monitor_auto_scaling_metrics():
 """Monitor Auto Scaling group metrics"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Create custom metrics
 cloudwatch.put_metric_data(
 Namespace='AutoScaling/Custom',
 MetricData=[
 {
 'MetricName': 'HealthyInstanceCount',
 'Value': get_healthy_instance_count(),
 'Unit': 'Count',
 'Dimensions': [
 {
 'Name': 'AutoScalingGroupName',
 'Value': 'web-servers-asg'
 }
 ]
 }
 ]
 )
 
 # Create alarms for scaling events
 cloudwatch.put_metric_alarm(
 AlarmName='ASGScalingActivity',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=1,
 MetricName='GroupTotalInstances',
 Namespace='AWS/AutoScaling',
 Period=300,
 Statistic='Average',
 Threshold=8.0,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:scaling-alerts'
 ],
 Dimensions=[
 {
 'Name': 'AutoScalingGroupName',
 'Value': 'web-servers-asg'
 }
 ]
 )

9. Cost Optimization

Spot Instance Integration

# Create mixed instances policy with Spot
aws autoscaling create-auto-scaling-group \
 --auto-scaling-group-name "cost-optimized-asg" \
 --mixed-instances-policy '{
 "LaunchTemplate": {
 "LaunchTemplateSpecification": {
 "LaunchTemplateName": "web-template",
 "Version": "$Latest"
 },
 "Overrides": [
 {
 "InstanceType": "t3.micro",
 "WeightedCapacity": "1"
 },
 {
 "InstanceType": "t3.small",
 "WeightedCapacity": "2"
 }
 ]
 },
 "InstancesDistribution": {
 "OnDemandBaseCapacity": 2,
 "OnDemandPercentageAboveBaseCapacity": 25,
 "SpotAllocationStrategy": "diversified",
 "SpotInstancePools": 4,
 "SpotMaxPrice": "0.05"
 }
 }' \
 --min-size 2 \
 --max-size 20 \
 --desired-capacity 4

Scheduled Scaling

# Create scheduled action for predictable load
aws autoscaling put-scheduled-update-group-action \
 --auto-scaling-group-name "web-servers-asg" \
 --scheduled-action-name "morning-scale-up" \
 --recurrence "0 8 * * MON-FRI" \
 --desired-capacity 10 \
 --min-size 5 \
 --max-size 15

# Scale down for off-hours
aws autoscaling put-scheduled-update-group-action \
 --auto-scaling-group-name "web-servers-asg" \
 --scheduled-action-name "evening-scale-down" \
 --recurrence "0 18 * * MON-FRI" \
 --desired-capacity 3 \
 --min-size 2 \
 --max-size 10

10. Common Exam Scenarios

Scenario 1: High availability web application

Solution:

AWS Backup

Sun, 04 Oct 2026 00:00:00 +0000

What it is: Centralized, policy-based backup orchestration across AWS services — one place to define what gets backed up, how often, how long it’s kept, and where copies go, replacing per-service snapshot scripts.

Exam-testable facts:

Backup plan: one or more rules; each rule sets a schedule (cron/rate), a backup window, a lifecycle (transition to cold storage after N days, expire after M days), copy actions, and the target vault.
Backup vault: the encrypted container holding recovery points (KMS-encrypted; each vault has its own key).
Vault Lock: makes recovery points immutable (WORM). Compliance mode cannot be undone — not even by the root user — which is the ransomware-protection answer. Governance mode is reversible.
Resource assignment: pick protected resources by tag, resource type, or ARN — policy decoupled from individual resources.
Cross-Region and cross-account copy: built into the plan for DR and blast-radius isolation; Organizations integration pushes data-protection policies org-wide.
Coverage: EBS, EC2, RDS/Aurora, DynamoDB, EFS, FSx, S3, DocumentDB, Neptune, Redshift, Storage Gateway, and more.
Backup Audit Manager: frameworks that prove resources are backed up per policy. Restore testing automatically validates that backups are actually recoverable.
Continuous backup enables point-in-time recovery (PITR) for supported services.

Common traps:

AWS CDK (Cloud Development Kit)

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CDK is an open-source software development framework for defining cloud infrastructure using familiar programming languages like TypeScript, Python, Java, C#, and Go.

Key Characteristics

Programming languages - Use familiar languages instead of JSON/YAML
Higher-level abstractions - Constructs provide sensible defaults
Type safety - Compile-time error checking
IDE support - IntelliSense, refactoring, debugging
Reusable components - Share constructs across projects
CloudFormation integration - Synthesizes to CloudFormation templates
AWS service integration - Native support for all AWS services

What Problem Does It Solve?

Eliminates verbose CloudFormation JSON/YAML syntax
Provides programming language benefits (loops, conditions, functions)
Enables infrastructure testing with standard testing frameworks
Facilitates code reuse through object-oriented programming
Supports complex logic and data transformations
Integrates with existing development workflows

2. Core Concepts

Constructs

// Level 1 (L1) - Direct CloudFormation mapping
import { CfnBucket } from 'aws-cdk-lib/aws-s3';

const cfnBucket = new CfnBucket(this, 'MyBucket', {
 bucketName: 'my-bucket-name',
 versioningConfiguration: {
 status: 'Enabled'
 }
});

// Level 2 (L2) - Higher-level with sensible defaults
import { Bucket, BucketEncryption } from 'aws-cdk-lib/aws-s3';

const bucket = new Bucket(this, 'MyBucket', {
 bucketName: 'my-bucket-name',
 versioned: true,
 encryption: BucketEncryption.S3_MANAGED,
 removalPolicy: RemovalPolicy.DESTROY
});

// Level 3 (L3) - Patterns combining multiple resources
import { ApplicationLoadBalancedFargateService } from 'aws-cdk-lib/aws-ecs-patterns';

const service = new ApplicationLoadBalancedFargateService(this, 'MyService', {
 taskImageOptions: {
 image: ContainerImage.fromRegistry('nginx'),
 containerPort: 80
 },
 memoryLimitMiB: 512,
 cpu: 256,
 desiredCount: 2
});

Stacks and Apps

// app.ts
import { App } from 'aws-cdk-lib';
import { VpcStack } from './vpc-stack';
import { DatabaseStack } from './database-stack';
import { WebStack } from './web-stack';

const app = new App();

const vpcStack = new VpcStack(app, 'VpcStack', {
 env: {
 account: process.env.CDK_DEFAULT_ACCOUNT,
 region: process.env.CDK_DEFAULT_REGION
 }
});

const dbStack = new DatabaseStack(app, 'DatabaseStack', {
 vpc: vpcStack.vpc,
 env: vpcStack.env
});

const webStack = new WebStack(app, 'WebStack', {
 vpc: vpcStack.vpc,
 database: dbStack.database,
 env: vpcStack.env
});

// Add dependencies
dbStack.addDependency(vpcStack);
webStack.addDependency(dbStack);

Stack Definition

// vpc-stack.ts
import { Stack, StackProps } from 'aws-cdk-lib';
import { Vpc, SubnetType } from 'aws-cdk-lib/aws-ec2';
import { Construct } from 'constructs';

export interface VpcStackProps extends StackProps {
 cidrBlock?: string;
}

export class VpcStack extends Stack {
 public readonly vpc: Vpc;

 constructor(scope: Construct, id: string, props?: VpcStackProps) {
 super(scope, id, props);

 this.vpc = new Vpc(this, 'MainVpc', {
 cidr: props?.cidrBlock || '10.0.0.0/16',
 maxAzs: 3,
 subnetConfiguration: [
 {
 cidrMask: 24,
 name: 'Public',
 subnetType: SubnetType.PUBLIC
 },
 {
 cidrMask: 24,
 name: 'Private',
 subnetType: SubnetType.PRIVATE_WITH_EGRESS
 },
 {
 cidrMask: 28,
 name: 'Database',
 subnetType: SubnetType.PRIVATE_ISOLATED
 }
 ],
 natGateways: 1
 });
 }
}

3. CDK Pipelines

Self-Mutating Pipeline

// pipeline-stack.ts
import { Stack, StackProps } from 'aws-cdk-lib';
import { CodePipeline, CodePipelineSource, ShellStep } from 'aws-cdk-lib/pipelines';
import { Repository } from 'aws-cdk-lib/aws-codecommit';

export class PipelineStack extends Stack {
 constructor(scope: Construct, id: string, props?: StackProps) {
 super(scope, id, props);

 const repo = Repository.fromRepositoryName(this, 'Repo', 'my-cdk-app');

 const pipeline = new CodePipeline(this, 'Pipeline', {
 pipelineName: 'MyAppPipeline',
 synth: new ShellStep('Synth', {
 input: CodePipelineSource.codeCommit(repo, 'main'),
 commands: [
 'npm ci',
 'npm run build',
 'npx cdk synth'
 ]
 })
 });

 // Add application stages
 const devStage = new MyAppStage(this, 'Dev', {
 env: { account: '111111111111', region: 'us-east-1' }
 });
 
 const prodStage = new MyAppStage(this, 'Prod', {
 env: { account: '222222222222', region: 'us-east-1' }
 });

 pipeline.addStage(devStage, {
 pre: [
 new ShellStep('UnitTests', {
 commands: ['npm test']
 })
 ],
 post: [
 new ShellStep('IntegrationTests', {
 commands: ['npm run test:integration']
 })
 ]
 });

 pipeline.addStage(prodStage, {
 pre: [
 new ManualApprovalStep('PromoteToProd')
 ]
 });
 }
}

Application Stage

// app-stage.ts
import { Stage, StageProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { VpcStack } from './vpc-stack';
import { DatabaseStack } from './database-stack';
import { WebStack } from './web-stack';

export class MyAppStage extends Stage {
 constructor(scope: Construct, id: string, props?: StageProps) {
 super(scope, id, props);

 const vpcStack = new VpcStack(this, 'VpcStack');
 const dbStack = new DatabaseStack(this, 'DatabaseStack', {
 vpc: vpcStack.vpc
 });
 const webStack = new WebStack(this, 'WebStack', {
 vpc: vpcStack.vpc,
 database: dbStack.database
 });
 }
}

4. Testing CDK Applications

Unit Testing

// test/vpc-stack.test.ts
import { Template } from 'aws-cdk-lib/assertions';
import { App } from 'aws-cdk-lib';
import { VpcStack } from '../lib/vpc-stack';

describe('VpcStack', () => {
 test('creates VPC with correct configuration', () => {
 const app = new App();
 const stack = new VpcStack(app, 'TestVpcStack');
 const template = Template.fromStack(stack);

 // Assert VPC exists
 template.hasResourceProperties('AWS::EC2::VPC', {
 CidrBlock: '10.0.0.0/16',
 EnableDnsHostnames: true,
 EnableDnsSupport: true
 });

 // Assert subnets are created
 template.resourceCountIs('AWS::EC2::Subnet', 6); // 3 AZs * 2 subnet types
 
 // Assert NAT Gateway exists
 template.resourceCountIs('AWS::EC2::NatGateway', 1);
 });

 test('allows custom CIDR block', () => {
 const app = new App();
 const stack = new VpcStack(app, 'TestVpcStack', {
 cidrBlock: '172.16.0.0/16'
 });
 const template = Template.fromStack(stack);

 template.hasResourceProperties('AWS::EC2::VPC', {
 CidrBlock: '172.16.0.0/16'
 });
 });
});

Integration Testing

// test/integration.test.ts
import { IntegTest } from '@aws-cdk/integ-tests-alpha';
import { App } from 'aws-cdk-lib';
import { VpcStack } from '../lib/vpc-stack';

const app = new App();
const stack = new VpcStack(app, 'IntegTestVpcStack');

new IntegTest(app, 'VpcIntegTest', {
 testCases: [stack],
 diffAssets: true,
 stackUpdateWorkflow: true
});

5. Custom Constructs

Reusable Construct

// lib/constructs/web-server.ts
import { Construct } from 'constructs';
import { Instance, InstanceType, MachineImage, Vpc, SecurityGroup } from 'aws-cdk-lib/aws-ec2';
import { Role, ServicePrincipal, ManagedPolicy } from 'aws-cdk-lib/aws-iam';

export interface WebServerProps {
 vpc: Vpc;
 instanceType?: InstanceType;
 keyName?: string;
}

export class WebServer extends Construct {
 public readonly instance: Instance;
 public readonly securityGroup: SecurityGroup;

 constructor(scope: Construct, id: string, props: WebServerProps) {
 super(scope, id);

 // Security Group
 this.securityGroup = new SecurityGroup(this, 'SecurityGroup', {
 vpc: props.vpc,
 description: 'Security group for web server',
 allowAllOutbound: true
 });

 this.securityGroup.addIngressRule(
 Peer.anyIpv4(),
 Port.tcp(80),
 'Allow HTTP traffic'
 );

 this.securityGroup.addIngressRule(
 Peer.anyIpv4(),
 Port.tcp(443),
 'Allow HTTPS traffic'
 );

 // IAM Role
 const role = new Role(this, 'Role', {
 assumedBy: new ServicePrincipal('ec2.amazonaws.com'),
 managedPolicies: [
 ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore')
 ]
 });

 // EC2 Instance
 this.instance = new Instance(this, 'Instance', {
 vpc: props.vpc,
 instanceType: props.instanceType || InstanceType.of(InstanceClass.T3, InstanceSize.MICRO),
 machineImage: MachineImage.latestAmazonLinux(),
 securityGroup: this.securityGroup,
 role: role,
 keyName: props.keyName,
 userData: UserData.forLinux()
 });

 // User data script
 this.instance.userData.addCommands(
 'yum update -y',
 'yum install -y httpd',
 'systemctl start httpd',
 'systemctl enable httpd',
 'echo "<h1>Hello from CDK!</h1>" > /var/www/html/index.html'
 );
 }
}

Using Custom Construct

// lib/web-stack.ts
import { Stack, StackProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { WebServer } from './constructs/web-server';

export interface WebStackProps extends StackProps {
 vpc: Vpc;
}

export class WebStack extends Stack {
 constructor(scope: Construct, id: string, props: WebStackProps) {
 super(scope, id, props);

 const webServer = new WebServer(this, 'WebServer', {
 vpc: props.vpc,
 instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.SMALL)
 });

 new CfnOutput(this, 'WebServerInstanceId', {
 value: webServer.instance.instanceId,
 description: 'Web server instance ID'
 });
 }
}

6. Environment and Context

Environment Configuration

// cdk.json
{
 "app": "npx ts-node --prefer-ts-exts bin/app.ts",
 "context": {
 "@aws-cdk/core:enableStackNameDuplicates": true,
 "aws-cdk:enableDiffNoFail": true,
 "@aws-cdk/core:stackRelativeExports": true
 }
}

// Environment-specific configuration
const app = new App();

// Development environment
new MyAppStack(app, 'MyApp-Dev', {
 env: {
 account: '111111111111',
 region: 'us-east-1'
 },
 tags: {
 Environment: 'Development',
 CostCenter: 'Engineering'
 }
});

// Production environment
new MyAppStack(app, 'MyApp-Prod', {
 env: {
 account: '222222222222',
 region: 'us-east-1'
 },
 tags: {
 Environment: 'Production',
 CostCenter: 'Operations'
 }
});

Context Values

// Using context for configuration
export class MyStack extends Stack {
 constructor(scope: Construct, id: string, props?: StackProps) {
 super(scope, id, props);

 const instanceType = this.node.tryGetContext('instanceType') || 't3.micro';
 const enableMonitoring = this.node.tryGetContext('enableMonitoring') === 'true';
 
 const instance = new Instance(this, 'Instance', {
 instanceType: new InstanceType(instanceType),
 // ... other properties
 });

 if (enableMonitoring) {
 // Add CloudWatch monitoring
 }
 }
}

// Set context via CLI
// cdk deploy -c instanceType=t3.small -c enableMonitoring=true

7. CDK CLI Commands

# Initialize new CDK project
cdk init app --language typescript
cdk init app --language python

# Install dependencies
npm install
pip install -r requirements.txt

# Synthesize CloudFormation template
cdk synth
cdk synth MyStack

# Deploy stacks
cdk deploy
cdk deploy MyStack
cdk deploy --all

# Destroy stacks
cdk destroy
cdk destroy MyStack

# Diff changes
cdk diff
cdk diff MyStack

# List stacks
cdk list

# Bootstrap CDK environment
cdk bootstrap
cdk bootstrap aws://123456789012/us-east-1

# Watch for changes (CDK v2)
cdk watch
cdk watch MyStack

8. CDK vs CloudFormation vs Terraform

Feature	CDK	CloudFormation	Terraform
Language	Programming languages	JSON/YAML	HCL
Type Safety	Yes	No	Limited
IDE Support	Full	Limited	Good
Testing	Unit/Integration	Limited	Limited
Reusability	High (OOP)	Medium (nested stacks)	High (modules)
Learning Curve	Moderate	Steep	Moderate
Multi-cloud	AWS only	AWS only	Yes
State Management	CloudFormation	AWS managed	External

9. Common Exam Scenarios

Scenario 1: Multi-Stack Application

// Cross-stack references
export class DatabaseStack extends Stack {
 public readonly database: DatabaseInstance;
 
 constructor(scope: Construct, id: string, props: StackProps) {
 super(scope, id, props);
 
 this.database = new DatabaseInstance(this, 'Database', {
 // configuration
 });
 }
}

export class WebStack extends Stack {
 constructor(scope: Construct, id: string, props: WebStackProps) {
 super(scope, id, props);
 
 // Reference database from another stack
 const dbEndpoint = props.database.instanceEndpoint.hostname;
 
 // Use in application configuration
 }
}

Scenario 2: Conditional Resources

export class ConditionalStack extends Stack {
 constructor(scope: Construct, id: string, props?: StackProps) {
 super(scope, id, props);

 const environment = this.node.tryGetContext('environment') || 'dev';
 
 // Conditional resource creation
 if (environment === 'prod') {
 new DatabaseInstance(this, 'Database', {
 instanceType: InstanceType.of(InstanceClass.R5, InstanceSize.LARGE),
 multiAz: true,
 backupRetention: Duration.days(30)
 });
 } else {
 new DatabaseInstance(this, 'Database', {
 instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.MICRO),
 multiAz: false,
 backupRetention: Duration.days(7)
 });
 }
 }
}

Scenario 3: Custom Resource

import { CustomResource, CustomResourceProvider } from 'aws-cdk-lib';
import { Function, Runtime, Code } from 'aws-cdk-lib/aws-lambda';

export class CustomResourceStack extends Stack {
 constructor(scope: Construct, id: string, props?: StackProps) {
 super(scope, id, props);

 // Lambda function for custom resource
 const customResourceLambda = new Function(this, 'CustomResourceLambda', {
 runtime: Runtime.PYTHON_3_9,
 handler: 'index.handler',
 code: Code.fromInline(`
import boto3
import json

def handler(event, context):
 if event['RequestType'] == 'Create':
 # Custom logic here
 return {
 'PhysicalResourceId': 'custom-resource-id',
 'Data': {'Result': 'Success'}
 }
 return {'PhysicalResourceId': event['PhysicalResourceId']}
 `)
 });

 // Custom resource
 const customResource = new CustomResource(this, 'CustomResource', {
 serviceToken: customResourceLambda.functionArn,
 properties: {
 CustomProperty: 'CustomValue'
 }
 });
 }
}

10. Exam Tips

Understand construct levels - L1, L2, L3 constructs and when to use each
Master stack dependencies - Cross-stack references and deployment order
Know CDK Pipelines - Self-mutating pipelines and multi-environment deployment
Practice testing - Unit tests with assertions, integration tests
Understand synthesis - How CDK generates CloudFormation templates
Learn custom constructs - Creating reusable components
Know CLI commands - Bootstrap, deploy, diff, destroy operations
Understand context - Environment-specific configuration
Practice with patterns - Common architectural patterns in CDK
Compare with alternatives - When to use CDK vs CloudFormation vs Terraform

AWS Certificate Manager (ACM)

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is ACM?

Managed service for provisioning and managing SSL/TLS certificates
Free SSL/TLS certificates for AWS services
Automatic certificate renewal
Integration with AWS services (CloudFront, ALB, API Gateway)

Key Benefits

Free Certificates - No cost for AWS-integrated certificates
Automatic Renewal - Certificates renewed automatically before expiration
Easy Deployment - One-click deployment to AWS services
Centralized Management - Single place to manage certificates
Security - Private keys never leave AWS infrastructure

Use Cases

HTTPS for web applications
SSL/TLS termination at load balancers
API Gateway custom domains
CloudFront distributions
Elastic Beanstalk applications

2. Certificate Types

Public Certificates

Issued by Amazon Certificate Authority (CA)
Free for use with AWS services
Domain validation (DV) certificates
Wildcard certificates supported
Subject Alternative Names (SAN) supported

Private Certificates

Issued by AWS Private Certificate Authority (PCA)
For internal applications and services
Additional charges apply
Full control over certificate hierarchy
Custom certificate policies

Imported Certificates

Third-party certificates imported into ACM
Self-signed certificates
Certificates from other CAs
Manual renewal required
Additional validation steps

3. Certificate Provisioning

Request Public Certificate

# Request certificate with DNS validation
aws acm request-certificate \
 --domain-name "example.com" \
 --subject-alternative-names "*.example.com" "api.example.com" \
 --validation-method DNS \
 --tags Key=Environment,Value=Production

Domain Validation Methods

DNS Validation - Add CNAME record to DNS (recommended)
Email Validation - Receive validation email at domain contacts

DNS Validation Process

Request certificate with domain names
ACM provides CNAME records for validation
Add CNAME records to DNS zone
ACM validates domain ownership
Certificate issued and ready for use

Email Validation Process

Request certificate with email validation
ACM sends validation emails to domain contacts
Click validation link in email
Certificate issued after validation

4. Certificate Management

List Certificates

# List all certificates
aws acm list-certificates

# List certificates with specific status
aws acm list-certificates --certificate-statuses ISSUED PENDING_VALIDATION

Describe Certificate

# Get certificate details
aws acm describe-certificate \
 --certificate-arn "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"

Certificate Renewal

Automatic Renewal - ACM handles renewal for in-use certificates
Manual Renewal - Required for imported certificates
Renewal Timeline - Attempts renewal 60 days before expiration
Validation Required - DNS/email validation must remain valid

Certificate Deletion

# Delete certificate (only if not in use)
aws acm delete-certificate \
 --certificate-arn "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"

5. Integration with AWS Services

CloudFront Integration

# Create CloudFront distribution with ACM certificate
aws cloudfront create-distribution \
 --distribution-config '{
 "CallerReference": "my-distribution-2024",
 "Aliases": {
 "Quantity": 1,
 "Items": ["example.com"]
 },
 "DefaultRootObject": "index.html",
 "Origins": {
 "Quantity": 1,
 "Items": [{
 "Id": "my-origin",
 "DomainName": "my-bucket.s3.amazonaws.com",
 "S3OriginConfig": {
 "OriginAccessIdentity": ""
 }
 }]
 },
 "DefaultCacheBehavior": {
 "TargetOriginId": "my-origin",
 "ViewerProtocolPolicy": "redirect-to-https",
 "TrustedSigners": {
 "Enabled": false,
 "Quantity": 0
 },
 "ForwardedValues": {
 "QueryString": false,
 "Cookies": {"Forward": "none"}
 }
 },
 "ViewerCertificate": {
 "ACMCertificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012",
 "SSLSupportMethod": "sni-only",
 "MinimumProtocolVersion": "TLSv1.2_2021"
 },
 "Enabled": true
 }'

Application Load Balancer Integration

# Create HTTPS listener with ACM certificate
aws elbv2 create-listener \
 --load-balancer-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/1234567890123456" \
 --protocol HTTPS \
 --port 443 \
 --certificates CertificateArn="arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012" \
 --default-actions Type=forward,TargetGroupArn="arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/my-targets/1234567890123456"

API Gateway Integration

# Create custom domain for API Gateway
aws apigateway create-domain-name \
 --domain-name "api.example.com" \
 --certificate-arn "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012" \
 --security-policy TLS_1_2

6. Private Certificate Authority (PCA)

Create Private CA

# Create private certificate authority
aws acm-pca create-certificate-authority \
 --certificate-authority-configuration '{
 "KeyAlgorithm": "RSA_2048",
 "SigningAlgorithm": "SHA256WITHRSA",
 "Subject": {
 "Country": "US",
 "Organization": "Example Corp",
 "OrganizationalUnit": "IT Department",
 "CommonName": "Example Corp Root CA"
 }
 }' \
 --certificate-authority-type ROOT \
 --tags Key=Environment,Value=Production

Issue Private Certificate

# Issue certificate from private CA
aws acm-pca issue-certificate \
 --certificate-authority-arn "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012" \
 --csr fileb://certificate-request.csr \
 --signing-algorithm SHA256WITHRSA \
 --validity Value=365,Type=DAYS

Private CA Use Cases

Internal applications and services
IoT device certificates
Code signing certificates
Custom certificate hierarchies
Air-gapped environments

7. Certificate Import

Import Third-Party Certificate

# Import certificate from external CA
aws acm import-certificate \
 --certificate fileb://certificate.pem \
 --private-key fileb://private-key.pem \
 --certificate-chain fileb://certificate-chain.pem \
 --tags Key=Source,Value=ThirdParty

Certificate Requirements

Certificate Format - PEM-encoded X.509
Private Key - RSA or ECC private key
Certificate Chain - Intermediate certificates (if any)
Key Size - Minimum 1024-bit RSA or 224-bit ECC

Import Validation

Certificate and private key must match
Certificate must be valid (not expired)
Certificate chain must be complete
Private key must not be encrypted

8. Monitoring and Compliance

CloudWatch Integration

Certificate expiration monitoring
Custom metrics for certificate status
Alarms for certificate renewal failures

Certificate Expiration Monitoring

import boto3
from datetime import datetime, timedelta

def check_certificate_expiration():
 """Monitor certificate expiration dates"""
 
 acm = boto3.client('acm')
 cloudwatch = boto3.client('cloudwatch')
 
 # List all certificates
 response = acm.list_certificates(CertificateStatuses=['ISSUED'])
 
 for cert in response['CertificateSummaryList']:
 cert_arn = cert['CertificateArn']
 
 # Get certificate details
 cert_details = acm.describe_certificate(CertificateArn=cert_arn)
 
 # Check expiration
 not_after = cert_details['Certificate']['NotAfter']
 days_until_expiry = (not_after - datetime.now()).days
 
 # Send metric to CloudWatch
 cloudwatch.put_metric_data(
 Namespace='ACM/Certificates',
 MetricData=[
 {
 'MetricName': 'DaysUntilExpiry',
 'Dimensions': [
 {
 'Name': 'CertificateArn',
 'Value': cert_arn
 }
 ],
 'Value': days_until_expiry,
 'Unit': 'Count'
 }
 ]
 )

CloudTrail Integration

All ACM API calls logged
Certificate lifecycle events
Compliance and audit trails

Config Integration

Track certificate configuration changes
Compliance rules for certificate management
Automated remediation actions

9. Security Best Practices

Certificate Security

Use strong key algorithms (RSA 2048+ or ECC 256+)
Enable perfect forward secrecy
Use modern TLS versions (1.2+)
Implement HSTS headers
Regular security assessments

Access Control

Use IAM policies for ACM access
Principle of least privilege
Separate roles for certificate management
Monitor certificate operations

Operational Security

Automate certificate deployment
Monitor certificate expiration
Implement certificate rotation procedures
Document certificate management processes

10. Automation and DevOps

Infrastructure as Code

# CloudFormation template for ACM certificate
AWSTemplateFormatVersion: '2010-09-09'
Resources:
 SSLCertificate:
 Type: AWS::CertificateManager::Certificate
 Properties:
 DomainName: example.com
 SubjectAlternativeNames:
 - '*.example.com'
 - api.example.com
 ValidationMethod: DNS
 DomainValidationOptions:
 - DomainName: example.com
 HostedZoneId: !Ref HostedZone
 - DomainName: '*.example.com'
 HostedZoneId: !Ref HostedZone
 Tags:
 - Key: Environment
 Value: Production

Terraform Configuration

# Terraform configuration for ACM certificate
resource "aws_acm_certificate" "example" {
 domain_name = "example.com"
 subject_alternative_names = ["*.example.com", "api.example.com"]
 validation_method = "DNS"

 lifecycle {
 create_before_destroy = true
 }

 tags = {
 Environment = "Production"
 }
}

resource "aws_acm_certificate_validation" "example" {
 certificate_arn = aws_acm_certificate.example.arn
 validation_record_fqdns = [for record in aws_route53_record.example : record.fqdn]
}

Automated Certificate Deployment

import boto3

def deploy_certificate_to_alb(cert_arn, alb_arn):
 """Deploy certificate to Application Load Balancer"""
 
 elbv2 = boto3.client('elbv2')
 
 # Get existing listeners
 listeners = elbv2.describe_listeners(LoadBalancerArn=alb_arn)
 
 # Update HTTPS listener with new certificate
 for listener in listeners['Listeners']:
 if listener['Protocol'] == 'HTTPS':
 elbv2.modify_listener(
 ListenerArn=listener['ListenerArn'],
 Certificates=[{'CertificateArn': cert_arn}]
 )
 print(f"Updated listener {listener['ListenerArn']} with certificate {cert_arn}")

11. Cost Optimization

ACM Pricing

Public Certificates - Free for AWS services
Private Certificates - Charged per certificate issued
Private CA - Monthly fee per CA
API Calls - No additional charges

Cost Optimization Strategies

Use public certificates when possible
Consolidate domains with wildcard certificates
Monitor private certificate usage
Automate certificate lifecycle management
Regular cleanup of unused certificates

12. Multi-Region Considerations

Regional Availability

ACM is available in most AWS regions
Certificates are region-specific
CloudFront requires certificates in us-east-1
Cross-region certificate replication not supported

Global Applications

# Request certificate in us-east-1 for CloudFront
aws acm request-certificate \
 --region us-east-1 \
 --domain-name "global.example.com" \
 --validation-method DNS

# Request certificate in application region for ALB
aws acm request-certificate \
 --region us-west-2 \
 --domain-name "app.example.com" \
 --validation-method DNS

13. Common Exam Scenarios

Scenario 1: Enable HTTPS for web application

Solution:

AWS CloudFormation

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CloudFormation is a service that helps you model and set up your AWS resources using Infrastructure as Code (IaC). You create templates that describe your AWS resources, and CloudFormation provisions and configures those resources for you.

Key Characteristics

Infrastructure as Code - Define infrastructure in JSON/YAML templates
Declarative - Specify what you want, not how to create it
Version controlled - Templates can be stored in source control
Repeatable - Create identical environments consistently
Rollback capable - Automatic rollback on failure
Change management - Preview changes before applying
Cross-region - Deploy to multiple regions

What Problem Does It Solve?

Eliminates manual resource provisioning
Ensures consistent infrastructure deployment
Enables version control of infrastructure
Provides automated rollback on failures
Manages resource dependencies automatically
Enables infrastructure replication across environments
Supports compliance and governance requirements

2. Core Concepts

Template

JSON or YAML file describing AWS resources
Declarative specification of infrastructure
Version controlled and reusable
Maximum size: 460,800 bytes (450 KB)

Stack

Collection of AWS resources created from template
Unit of deployment and management
Has lifecycle (create, update, delete)
Resources created/updated/deleted together

Change Set

Preview of changes before stack update
Shows what will be added, modified, or deleted
Allows review before execution
Can be executed or discarded

Parameters

Input values for templates
Make templates reusable and flexible
Can have default values and constraints
Referenced using !Ref or Ref function

Outputs

Values returned from stack
Can be exported for use by other stacks
Useful for sharing resource information
Referenced using !ImportValue function

Resources

AWS resources to be created
Only required section in template
Each resource has Type and Properties
Can reference other resources

Mappings

Static lookup tables in template
Key-value pairs for conditional logic
Often used for AMI IDs by region
Referenced using !FindInMap function

Conditions

Control resource creation based on parameters
Boolean logic (equals, not equals, and, or)
Applied to resources and outputs
Evaluated at stack creation/update time

3. Template Structure

Basic Template Structure (YAML)

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Sample CloudFormation template'

Parameters:
 EnvironmentName:
 Type: String
 Default: Development
 AllowedValues:
 - Development
 - Staging
 - Production
 Description: Environment name

 InstanceType:
 Type: String
 Default: t3.micro
 AllowedValues:
 - t3.micro
 - t3.small
 - t3.medium
 Description: EC2 instance type

Mappings:
 RegionMap:
 us-east-1:
 AMI: ami-0abcdef1234567890
 us-west-2:
 AMI: ami-0fedcba0987654321

Conditions:
 IsProduction: !Equals [!Ref EnvironmentName, Production]
 CreateLargeInstance: !Equals [!Ref InstanceType, t3.medium]

Resources:
 MyVPC:
 Type: AWS::EC2::VPC
 Properties:
 CidrBlock: 10.0.0.0/16
 EnableDnsHostnames: true
 EnableDnsSupport: true
 Tags:
 - Key: Name
 Value: !Sub '${EnvironmentName}-VPC'

 MySubnet:
 Type: AWS::EC2::Subnet
 Properties:
 VpcId: !Ref MyVPC
 CidrBlock: 10.0.1.0/24
 AvailabilityZone: !Select [0, !GetAZs '']
 MapPublicIpOnLaunch: true
 Tags:
 - Key: Name
 Value: !Sub '${EnvironmentName}-Subnet'

 MySecurityGroup:
 Type: AWS::EC2::SecurityGroup
 Properties:
 GroupDescription: Security group for web server
 VpcId: !Ref MyVPC
 SecurityGroupIngress:
 - IpProtocol: tcp
 FromPort: 80
 ToPort: 80
 CidrIp: 0.0.0.0/0
 - IpProtocol: tcp
 FromPort: 443
 ToPort: 443
 CidrIp: 0.0.0.0/0

 MyInstance:
 Type: AWS::EC2::Instance
 Condition: IsProduction
 Properties:
 ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', AMI]
 InstanceType: !Ref InstanceType
 SubnetId: !Ref MySubnet
 SecurityGroupIds:
 - !Ref MySecurityGroup
 Tags:
 - Key: Name
 Value: !Sub '${EnvironmentName}-Instance'

Outputs:
 VPCId:
 Description: VPC ID
 Value: !Ref MyVPC
 Export:
 Name: !Sub '${EnvironmentName}-VPC-ID'

 InstanceId:
 Description: Instance ID
 Value: !Ref MyInstance
 Condition: IsProduction

 WebsiteURL:
 Description: Website URL
 Value: !Sub 'http://${MyInstance.PublicDnsName}'
 Condition: IsProduction

Template Structure (JSON)

{
 "AWSTemplateFormatVersion": "2010-09-09",
 "Description": "Sample CloudFormation template",
 "Parameters": {
 "InstanceType": {
 "Type": "String",
 "Default": "t3.micro",
 "AllowedValues": ["t3.micro", "t3.small", "t3.medium"]
 }
 },
 "Resources": {
 "MyInstance": {
 "Type": "AWS::EC2::Instance",
 "Properties": {
 "ImageId": "ami-0abcdef1234567890",
 "InstanceType": {"Ref": "InstanceType"}
 }
 }
 },
 "Outputs": {
 "InstanceId": {
 "Value": {"Ref": "MyInstance"}
 }
 }
}

4. Intrinsic Functions

Common Functions

!Ref (Reference)

# Reference parameter
InstanceType: !Ref InstanceTypeParameter

# Reference resource (returns resource ID)
VpcId: !Ref MyVPC

!GetAtt (Get Attribute)

# Get resource attribute
PublicIP: !GetAtt MyInstance.PublicIp
DNSName: !GetAtt MyLoadBalancer.DNSName

!Sub (Substitute)

# String substitution
Name: !Sub '${EnvironmentName}-${AWS::Region}-bucket'
UserData: !Sub |
 #!/bin/bash
 echo "Instance ID: ${AWS::InstanceId}" > /tmp/instance-info

!Join

# Join strings with delimiter
SecurityGroupIds: !Join
 - ','
 - - !Ref SecurityGroup1
 - !Ref SecurityGroup2

!Select

# Select item from list by index
AvailabilityZone: !Select [0, !GetAZs '']

!GetAZs

# Get availability zones for region
AvailabilityZones: !GetAZs ''
SpecificRegionAZs: !GetAZs 'us-west-2'

!FindInMap

# Find value in mapping
ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', AMI]

!ImportValue

# Import exported value from another stack
VpcId: !ImportValue NetworkStack-VPC-ID

!If (Conditional)

# Conditional value assignment
InstanceType: !If [IsProduction, t3.large, t3.micro]

!Equals, !And, !Or, !Not

Conditions:
 IsProduction: !Equals [!Ref Environment, Production]
 IsLargeInstance: !Equals [!Ref InstanceType, t3.large]
 CreateProdLarge: !And
 - !Condition IsProduction
 - !Condition IsLargeInstance
 NotDevelopment: !Not [!Equals [!Ref Environment, Development]]

5. Stack Operations

Stack Lifecycle

Create Stack

aws cloudformation create-stack \
 --stack-name my-stack \
 --template-body file://template.yaml \
 --parameters ParameterKey=InstanceType,ParameterValue=t3.small \
 --capabilities CAPABILITY_IAM

Update Stack

aws cloudformation update-stack \
 --stack-name my-stack \
 --template-body file://updated-template.yaml \
 --parameters ParameterKey=InstanceType,ParameterValue=t3.medium

Delete Stack

aws cloudformation delete-stack --stack-name my-stack

Change Sets

Create Change Set

aws cloudformation create-change-set \
 --stack-name my-stack \
 --change-set-name my-changeset \
 --template-body file://updated-template.yaml \
 --parameters ParameterKey=InstanceType,ParameterValue=t3.medium

Execute Change Set

aws cloudformation execute-change-set \
 --change-set-name my-changeset \
 --stack-name my-stack

Stack Policies

{
 "Statement": [
 {
 "Effect": "Deny",
 "Principal": "*",
 "Action": "Update:Delete",
 "Resource": "*",
 "Condition": {
 "StringEquals": {
 "ResourceType": ["AWS::RDS::DBInstance"]
 }
 }
 },
 {
 "Effect": "Allow",
 "Principal": "*",
 "Action": "Update:*",
 "Resource": "*"
 }
 ]
}

6. Nested Stacks & Cross-Stack References

Nested Stacks

Resources:
 NetworkStack:
 Type: AWS::CloudFormation::Stack
 Properties:
 TemplateURL: https://s3.amazonaws.com/my-bucket/network-template.yaml
 Parameters:
 VpcCidr: 10.0.0.0/16
 Environment: !Ref Environment
 TimeoutInMinutes: 10

 ApplicationStack:
 Type: AWS::CloudFormation::Stack
 DependsOn: NetworkStack
 Properties:
 TemplateURL: https://s3.amazonaws.com/my-bucket/app-template.yaml
 Parameters:
 VpcId: !GetAtt NetworkStack.Outputs.VpcId
 SubnetId: !GetAtt NetworkStack.Outputs.SubnetId

Cross-Stack References

Export from Stack A

Outputs:
 VPCId:
 Description: VPC ID
 Value: !Ref MyVPC
 Export:
 Name: !Sub '${AWS::StackName}-VPC-ID'

Import in Stack B

Resources:
 MyInstance:
 Type: AWS::EC2::Instance
 Properties:
 SubnetId: !ImportValue NetworkStack-Subnet-ID
 SecurityGroupIds:
 - !ImportValue NetworkStack-SecurityGroup-ID

7. IAM Roles & Permissions

CloudFormation Service Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "ec2:*",
 "s3:*",
 "iam:*",
 "rds:*",
 "lambda:*"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:CreateStack",
 "cloudformation:UpdateStack",
 "cloudformation:DeleteStack",
 "cloudformation:DescribeStacks",
 "cloudformation:DescribeStackEvents",
 "cloudformation:DescribeStackResources"
 ],
 "Resource": "*"
 }
 ]
}

User Permissions for CloudFormation

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:CreateStack",
 "cloudformation:UpdateStack",
 "cloudformation:DeleteStack",
 "cloudformation:DescribeStacks",
 "cloudformation:DescribeStackEvents",
 "cloudformation:DescribeStackResources",
 "cloudformation:CreateChangeSet",
 "cloudformation:ExecuteChangeSet",
 "cloudformation:DescribeChangeSet",
 "cloudformation:DeleteChangeSet"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": "iam:PassRole",
 "Resource": "arn:aws:iam::123456789012:role/CloudFormationServiceRole"
 }
 ]
}

Resource-Level Permissions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "cloudformation:*",
 "Resource": [
 "arn:aws:cloudformation:us-east-1:123456789012:stack/MyApp-*/*",
 "arn:aws:cloudformation:us-east-1:123456789012:stackset/MyApp-*:*"
 ]
 }
 ]
}

8. Advanced Features

Custom Resources

Resources:
 CustomResource:
 Type: AWS::CloudFormation::CustomResource
 Properties:
 ServiceToken: !GetAtt CustomResourceFunction.Arn
 CustomProperty1: Value1
 CustomProperty2: Value2

 CustomResourceFunction:
 Type: AWS::Lambda::Function
 Properties:
 Runtime: python3.9
 Handler: index.handler
 Code:
 ZipFile: |
 import json
 import boto3
 import cfnresponse
 
 def handler(event, context):
 try:
 if event['RequestType'] == 'Create':
 # Custom create logic
 response_data = {'Message': 'Resource created'}
 elif event['RequestType'] == 'Update':
 # Custom update logic
 response_data = {'Message': 'Resource updated'}
 elif event['RequestType'] == 'Delete':
 # Custom delete logic
 response_data = {'Message': 'Resource deleted'}
 
 cfnresponse.send(event, context, cfnresponse.SUCCESS, response_data)
 except Exception as e:
 cfnresponse.send(event, context, cfnresponse.FAILED, {})

Stack Sets

# Create stack set
aws cloudformation create-stack-set \
 --stack-set-name my-stackset \
 --template-body file://template.yaml \
 --capabilities CAPABILITY_IAM

# Create stack instances
aws cloudformation create-stack-instances \
 --stack-set-name my-stackset \
 --accounts 123456789012 210987654321 \
 --regions us-east-1 us-west-2

Drift Detection

# Detect drift
aws cloudformation detect-stack-drift --stack-name my-stack

# Get drift results
aws cloudformation describe-stack-drift-detection-status \
 --stack-drift-detection-id drift-detection-id

9. Integration with CI/CD Services

CodePipeline Integration

- Name: Deploy
 Actions:
 - Name: CreateChangeSet
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_REPLACE
 StackName: MyStack
 ChangeSetName: MyChangeSet
 TemplatePath: BuildArtifact::template.yaml
 Capabilities: CAPABILITY_IAM
 RoleArn: arn:aws:iam::123456789012:role/CloudFormationRole
 InputArtifacts:
 - Name: BuildArtifact

 - Name: ExecuteChangeSet
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_EXECUTE
 StackName: MyStack
 ChangeSetName: MyChangeSet
 RunOrder: 2

CodeBuild Integration

# buildspec.yml
version: 0.2
phases:
 install:
 runtime-versions:
 python: 3.9
 pre_build:
 commands:
 - pip install cfn-lint
 build:
 commands:
 - cfn-lint template.yaml
 - aws cloudformation validate-template --template-body file://template.yaml
 post_build:
 commands:
 - echo "Template validation completed"
artifacts:
 files:
 - template.yaml
 - parameters.json

Parameter Overrides in Pipeline

{
 "ParameterOverrides": {
 "Environment": "Production",
 "InstanceType": "t3.large",
 "DBPassword": {"Fn::GetParam": ["MyParameters", "parameters.json", "DBPassword"]}
 }
}

10. Security Best Practices

Template Security

Use least privilege IAM roles
Avoid hardcoding secrets in templates
Use AWS Secrets Manager or Parameter Store
Enable termination protection for critical stacks
Use stack policies to prevent accidental deletions

Secrets Management

Parameters:
 DBPassword:
 Type: String
 NoEcho: true
 Description: Database password

Resources:
 DBInstance:
 Type: AWS::RDS::DBInstance
 Properties:
 MasterUserPassword: !Ref DBPassword
 # Better approach: use Secrets Manager
 ManageMasterUserPassword: true
 MasterUserSecret:
 Description: RDS Master User Secret
 KmsKeyId: alias/aws/secretsmanager

Using Secrets Manager

Resources:
 DBSecret:
 Type: AWS::SecretsManager::Secret
 Properties:
 Description: RDS Master User Secret
 GenerateSecretString:
 SecretStringTemplate: '{"username": "admin"}'
 GenerateStringKey: 'password'
 PasswordLength: 16
 ExcludeCharacters: '"@/\'

 DBInstance:
 Type: AWS::RDS::DBInstance
 Properties:
 MasterUsername: !Sub '{{resolve:secretsmanager:${DBSecret}:SecretString:username}}'
 MasterUserPassword: !Sub '{{resolve:secretsmanager:${DBSecret}:SecretString:password}}'

Cross-Account Deployment

# Assume role for cross-account deployment
Resources:
 CrossAccountRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 AWS: arn:aws:iam::111111111111:root
 Action: sts:AssumeRole
 Condition:
 StringEquals:
 'sts:ExternalId': 'unique-external-id'

11. Monitoring & Troubleshooting

CloudWatch Events Integration

Resources:
 StackEventRule:
 Type: AWS::Events::Rule
 Properties:
 Description: Monitor CloudFormation stack events
 EventPattern:
 source:
 - aws.cloudformation
 detail-type:
 - CloudFormation Stack Status Change
 detail:
 status-details:
 status:
 - CREATE_FAILED
 - UPDATE_FAILED
 - DELETE_FAILED
 Targets:
 - Arn: !Ref SNSTopic
 Id: StackFailureNotification

Stack Notifications

Resources:
 MyStack:
 Type: AWS::CloudFormation::Stack
 Properties:
 TemplateURL: https://s3.amazonaws.com/my-bucket/template.yaml
 NotificationARNs:
 - !Ref SNSTopic

Common Issues & Solutions

Stack Rollback

Cause: Resource creation failure
Solution: Check CloudFormation events, fix template, retry
Prevention: Validate template, test in dev environment

Resource Already Exists

Cause: Resource name conflict
Solution: Use unique names, check existing resources
Prevention: Use dynamic naming with !Sub function

Insufficient Permissions

Cause: IAM role lacks required permissions
Solution: Add necessary permissions to service role
Prevention: Use least privilege principle

Template Size Limit

Cause: Template exceeds 460KB limit
Solution: Use nested stacks, store template in S3
Prevention: Modularize templates

Troubleshooting Commands

# Describe stack events
aws cloudformation describe-stack-events --stack-name my-stack

# Get stack status
aws cloudformation describe-stacks --stack-name my-stack

# List stack resources
aws cloudformation list-stack-resources --stack-name my-stack

# Describe failed resource
aws cloudformation describe-stack-resource \
 --stack-name my-stack \
 --logical-resource-id MyResource

12. Common Exam Scenarios

Solution:

AWS CloudFormation Advanced Features

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

This document covers advanced CloudFormation features that are critical for the DOP-C02 exam but not covered in the general CloudFormation notes. These include StackSets, Custom Resources, Dynamic References, CloudFormation Registry, and advanced deployment patterns.

Key Advanced Features

StackSets - Multi-account and multi-region deployments
Custom Resources - Extend CloudFormation with Lambda
Dynamic References - Retrieve values from Parameter Store and Secrets Manager
CloudFormation Registry - Third-party resource providers
Rollback Configuration - Advanced rollback controls
Stack Notifications - SNS integration for stack events
Termination Protection - Prevent accidental stack deletion

2. StackSets

Overview

StackSets enable you to create, update, or delete stacks across multiple accounts and regions with a single operation.

AWS CloudFormation Drift Detection

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CloudFormation Drift Detection is a feature that identifies differences between the expected configuration of stack resources (as defined in CloudFormation templates) and their actual configuration in AWS. This helps maintain infrastructure consistency and detect unauthorized or accidental changes.

Key Characteristics

Configuration validation - Compares actual vs expected resource state
Automated detection - Identifies configuration drift across resources
Detailed reporting - Shows specific property differences
Stack-level analysis - Analyzes entire stacks or individual resources
Non-intrusive - Read-only operation, doesn’t modify resources
Scheduled capability - Can be automated for regular monitoring
Compliance support - Helps maintain governance and compliance

What Problem Does It Solve?

Detects manual changes made outside CloudFormation
Identifies configuration drift from intended state
Supports compliance and governance requirements
Helps troubleshoot unexpected resource behavior
Enables proactive infrastructure management
Provides audit trail for configuration changes
Supports automated remediation workflows

2. Core Concepts

Drift Detection

Process of comparing actual resource configuration with CloudFormation template
Identifies resources that have drifted from expected state
Provides detailed analysis of configuration differences
Supports both stack-level and resource-level detection

Drift Status

IN_SYNC - Resource matches template configuration
MODIFIED - Resource has been changed outside CloudFormation
DELETED - Resource was deleted outside CloudFormation
NOT_CHECKED - Resource doesn’t support drift detection

Stack Drift Status

DRIFTED - One or more resources have drifted
IN_SYNC - All resources match template configuration
UNKNOWN - Drift detection hasn’t been performed
NOT_CHECKED - Stack contains resources that don’t support drift detection

Drift Detection Operation

Asynchronous process that analyzes stack resources
Returns operation ID for tracking progress
Generates detailed drift report upon completion
Can be performed on entire stack or specific resources

Supported Resources

Most AWS resources support drift detection
Some resources have limitations or exclusions
New resources continuously added to support list
Custom resources don’t support drift detection

3. Drift Detection Process

Detection Workflow

Initiate Detection - Start drift detection operation
Resource Analysis - Compare actual vs expected configuration
Status Determination - Classify each resource drift status
Report Generation - Create detailed drift report
Result Retrieval - Access drift detection results

Detection Scope

Stack-level - Analyze all resources in stack
Resource-level - Analyze specific resources
Nested stacks - Analyze parent and child stacks
Cross-stack references - Handle imported values

4. Configuration Examples

Basic Drift Detection

# Detect drift for entire stack
aws cloudformation detect-stack-drift --stack-name MyStack

# Detect drift for specific resources
aws cloudformation detect-stack-resource-drift \
 --stack-name MyStack \
 --logical-resource-id MyEC2Instance

Automated Drift Detection Lambda

import boto3
import json
import logging

logger = logging.getLogger()
logger.setLevel(logging.INFO)

cloudformation = boto3.client('cloudformation')
sns = boto3.client('sns')

def lambda_handler(event, context):
 """
 Automated drift detection for CloudFormation stacks
 """
 try:
 # Get stacks to monitor
 stacks_to_monitor = get_monitored_stacks()
 
 drift_results = []
 
 for stack_name in stacks_to_monitor:
 logger.info(f"Starting drift detection for stack: {stack_name}")
 
 # Initiate drift detection
 response = cloudformation.detect_stack_drift(StackName=stack_name)
 drift_detection_id = response['StackDriftDetectionId']
 
 # Wait for completion and get results
 drift_status = wait_for_drift_detection(drift_detection_id)
 
 if drift_status == 'DRIFTED':
 # Get detailed drift information
 drift_details = get_drift_details(stack_name)
 drift_results.append({
 'StackName': stack_name,
 'Status': drift_status,
 'Details': drift_details
 })
 
 logger.warning(f"Drift detected in stack: {stack_name}")
 
 # Send notifications if drift detected
 if drift_results:
 send_drift_notification(drift_results)
 
 return {
 'statusCode': 200,
 'body': json.dumps({
 'message': 'Drift detection completed',
 'drifted_stacks': len(drift_results)
 })
 }
 
 except Exception as e:
 logger.error(f"Error in drift detection: {str(e)}")
 raise

def get_monitored_stacks():
 """Get list of stacks to monitor for drift"""
 
 # Get stacks with specific tag
 paginator = cloudformation.get_paginator('describe_stacks')
 
 monitored_stacks = []
 for page in paginator.paginate():
 for stack in page['Stacks']:
 # Check for monitoring tag
 tags = stack.get('Tags', [])
 for tag in tags:
 if tag['Key'] == 'DriftMonitoring' and tag['Value'] == 'Enabled':
 monitored_stacks.append(stack['StackName'])
 break
 
 return monitored_stacks

def wait_for_drift_detection(drift_detection_id):
 """Wait for drift detection to complete"""
 
 import time
 
 while True:
 response = cloudformation.describe_stack_drift_detection_status(
 StackDriftDetectionId=drift_detection_id
 )
 
 status = response['DetectionStatus']
 
 if status in ['DETECTION_COMPLETE', 'DETECTION_FAILED']:
 return response.get('StackDriftStatus', 'UNKNOWN')
 
 time.sleep(10) # Wait 10 seconds before checking again

def get_drift_details(stack_name):
 """Get detailed drift information for stack"""
 
 try:
 response = cloudformation.describe_stack_resource_drifts(
 StackName=stack_name,
 StackResourceDriftStatusFilters=['MODIFIED', 'DELETED']
 )
 
 drift_details = []
 for drift in response['StackResourceDrifts']:
 drift_details.append({
 'LogicalResourceId': drift['LogicalResourceId'],
 'ResourceType': drift['ResourceType'],
 'DriftStatus': drift['StackResourceDriftStatus'],
 'PropertyDifferences': drift.get('PropertyDifferences', [])
 })
 
 return drift_details
 
 except Exception as e:
 logger.error(f"Error getting drift details: {str(e)}")
 return []

def send_drift_notification(drift_results):
 """Send SNS notification about detected drift"""
 
 topic_arn = 'arn:aws:sns:us-east-1:123456789012:cloudformation-drift-alerts'
 
 message = {
 'Subject': 'CloudFormation Drift Detected',
 'DriftedStacks': drift_results,
 'Timestamp': context.aws_request_id
 }
 
 sns.publish(
 TopicArn=topic_arn,
 Message=json.dumps(message, indent=2),
 Subject='CloudFormation Drift Alert'
 )

EventBridge Rule for Scheduled Drift Detection

Resources:
 DriftDetectionSchedule:
 Type: AWS::Events::Rule
 Properties:
 Description: 'Schedule drift detection for CloudFormation stacks'
 ScheduleExpression: 'cron(0 2 * * ? *)' # Daily at 2 AM UTC
 State: ENABLED
 Targets:
 - Arn: !GetAtt DriftDetectionFunction.Arn
 Id: DriftDetectionTarget

 DriftDetectionPermission:
 Type: AWS::Lambda::Permission
 Properties:
 FunctionName: !Ref DriftDetectionFunction
 Action: lambda:InvokeFunction
 Principal: events.amazonaws.com
 SourceArn: !GetAtt DriftDetectionSchedule.Arn

Drift Remediation Lambda

import boto3
import json

cloudformation = boto3.client('cloudformation')

def lambda_handler(event, context):
 """
 Automated drift remediation
 """
 
 # Parse drift detection results
 drift_results = json.loads(event['Records'][0]['Sns']['Message'])
 
 for stack_info in drift_results['DriftedStacks']:
 stack_name = stack_info['StackName']
 
 # Analyze drift details
 remediation_action = determine_remediation_action(stack_info)
 
 if remediation_action == 'UPDATE_STACK':
 # Update stack to bring resources back in sync
 update_stack_to_fix_drift(stack_name)
 elif remediation_action == 'IMPORT_RESOURCES':
 # Import manually created resources
 import_drifted_resources(stack_name, stack_info['Details'])
 elif remediation_action == 'ALERT_ONLY':
 # Just log and alert, no automatic remediation
 log_drift_for_manual_review(stack_name, stack_info)

def determine_remediation_action(stack_info):
 """Determine appropriate remediation action based on drift type"""
 
 # Analyze drift details to determine action
 for detail in stack_info['Details']:
 if detail['DriftStatus'] == 'DELETED':
 return 'UPDATE_STACK' # Recreate deleted resources
 elif detail['DriftStatus'] == 'MODIFIED':
 # Check if changes are safe to revert
 if is_safe_to_revert(detail):
 return 'UPDATE_STACK'
 else:
 return 'ALERT_ONLY'
 
 return 'ALERT_ONLY'

def is_safe_to_revert(drift_detail):
 """Check if drift changes are safe to automatically revert"""
 
 # Define safe properties that can be automatically reverted
 safe_properties = [
 'Tags',
 'Description'
 # NOTE: UserData is deliberately excluded - changing it in the template
 # does NOT touch an already-running instance, so an "automatic revert"
 # of UserData drift would silently no-op. Handle it via instance replacement.
 ]
 
 for prop_diff in drift_detail.get('PropertyDifferences', []):
 if prop_diff['PropertyPath'] not in safe_properties:
 return False
 
 return True

5. IAM Roles & Permissions

Drift Detection Permissions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:DetectStackDrift",
 "cloudformation:DetectStackResourceDrift",
 "cloudformation:DescribeStackDriftDetectionStatus",
 "cloudformation:DescribeStackResourceDrifts",
 "cloudformation:DescribeStacks",
 "cloudformation:DescribeStackResources"
 ],
 "Resource": "*"
 }
 ]
}

Comprehensive Drift Management Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:DetectStackDrift",
 "cloudformation:DetectStackResourceDrift",
 "cloudformation:DescribeStackDriftDetectionStatus",
 "cloudformation:DescribeStackResourceDrifts",
 "cloudformation:DescribeStacks",
 "cloudformation:DescribeStackResources",
 "cloudformation:ListStacks"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "ec2:Describe*",
 "s3:GetBucketLocation",
 "s3:GetBucketVersioning",
 "s3:GetBucketPolicy",
 "iam:GetRole",
 "iam:GetRolePolicy",
 "lambda:GetFunction",
 "rds:DescribeDBInstances"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "sns:Publish"
 ],
 "Resource": "arn:aws:sns:*:*:cloudformation-drift-*"
 }
 ]
}

Cross-Account Drift Detection

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:role/DriftDetectionRole"
 },
 "Action": [
 "cloudformation:DetectStackDrift",
 "cloudformation:DescribeStackDriftDetectionStatus",
 "cloudformation:DescribeStackResourceDrifts"
 ],
 "Resource": "*",
 "Condition": {
 "StringEquals": {
 "aws:RequestedRegion": ["us-east-1", "us-west-2"]
 }
 }
 }
 ]
}

6. Integration with AWS Services

CloudWatch Integration

Resources:
 DriftDetectionAlarm:
 Type: AWS::CloudWatch::Alarm
 Properties:
 AlarmName: CloudFormation-Drift-Detected
 AlarmDescription: Alert when CloudFormation drift is detected
 MetricName: DriftDetected
 Namespace: CloudFormation/Drift
 Statistic: Sum
 Period: 300
 EvaluationPeriods: 1
 Threshold: 1
 ComparisonOperator: GreaterThanOrEqualToThreshold
 AlarmActions:
 - !Ref DriftNotificationTopic

 DriftMetricFilter:
 Type: AWS::Logs::MetricFilter
 Properties:
 LogGroupName: /aws/lambda/drift-detection-function
 FilterPattern: '[timestamp, requestId, level="ERROR", message="Drift detected"]'
 MetricTransformations:
 - MetricNamespace: CloudFormation/Drift
 MetricName: DriftDetected
 MetricValue: '1'

EventBridge Integration

Resources:
 DriftDetectionRule:
 Type: AWS::Events::Rule
 Properties:
 Description: 'Trigger on CloudFormation drift detection completion'
 EventPattern:
 source:
 - aws.cloudformation
 detail-type:
 - CloudFormation Drift Detection Status Change
 detail:
 status:
 - DETECTION_COMPLETE
 drift-status:
 - DRIFTED
 Targets:
 - Arn: !GetAtt DriftRemediationFunction.Arn
 Id: DriftRemediationTarget

AWS Config Integration

Resources:
 ConfigRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: cloudformation-stack-drift-detection-check
 Description: Checks whether CloudFormation stacks have drift detection enabled
 Source:
 Owner: AWS
 SourceIdentifier: CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK
 InputParameters: |
 {
 "cloudformationRoleArn": "arn:aws:iam::123456789012:role/ConfigRole"
 }

Systems Manager Integration

Resources:
 DriftDetectionDocument:
 Type: AWS::SSM::Document
 Properties:
 DocumentType: Automation
 Content:
 schemaVersion: '0.3'
 description: 'Automated CloudFormation drift detection and remediation'
 assumeRole: '{{ AutomationAssumeRole }}'
 parameters:
 StackName:
 type: String
 description: Name of the CloudFormation stack
 AutomationAssumeRole:
 type: String
 description: IAM role for automation
 mainSteps:
 - name: DetectDrift
 action: 'aws:executeAwsApi'
 inputs:
 Service: cloudformation
 Api: DetectStackDrift
 StackName: '{{ StackName }}'
 outputs:
 - Name: DriftDetectionId
 Selector: $.StackDriftDetectionId
 - name: WaitForDetection
 action: 'aws:waitForAwsResourceProperty'
 inputs:
 Service: cloudformation
 Api: DescribeStackDriftDetectionStatus
 StackDriftDetectionId: '{{ DetectDrift.DriftDetectionId }}'
 PropertySelector: $.DetectionStatus
 DesiredValues:
 - DETECTION_COMPLETE
 - name: CheckDriftStatus
 action: 'aws:executeAwsApi'
 inputs:
 Service: cloudformation
 Api: DescribeStackDriftDetectionStatus
 StackDriftDetectionId: '{{ DetectDrift.DriftDetectionId }}'

7. Security Best Practices

Least Privilege Access

Grant minimum permissions required for drift detection
Use resource-level permissions where possible
Implement time-based access controls
Regular audit of drift detection permissions

Secure Automation

def secure_drift_detection(stack_name, allowed_stacks):
 """Secure drift detection with validation"""
 
 # Validate stack name against allowed list
 if stack_name not in allowed_stacks:
 raise ValueError(f"Stack {stack_name} not authorized for drift detection")
 
 # Validate stack exists and is accessible
 try:
 cloudformation.describe_stacks(StackName=stack_name)
 except ClientError as e:
 if e.response['Error']['Code'] == 'ValidationError':
 raise ValueError(f"Stack {stack_name} does not exist")
 raise
 
 # Perform drift detection
 response = cloudformation.detect_stack_drift(StackName=stack_name)
 
 return response['StackDriftDetectionId']

Audit and Compliance

Resources:
 DriftDetectionTrail:
 Type: AWS::CloudTrail::Trail
 Properties:
 TrailName: CloudFormation-Drift-Detection-Audit
 S3BucketName: !Ref AuditBucket
 IncludeGlobalServiceEvents: true
 IsMultiRegionTrail: true
 EnableLogFileValidation: true
 EventSelectors:
 - ReadWriteType: All
 IncludeManagementEvents: true
 # NOTE: CloudFormation stacks are NOT a valid CloudTrail data-event resource type.
 # Data events cover S3 objects, Lambda functions, and DynamoDB streams.
 # For stack API auditing, rely on management events (default) instead.

8. Monitoring & Troubleshooting

CloudWatch Metrics for Drift Detection

import boto3

cloudwatch = boto3.client('cloudwatch')

def publish_drift_metrics(stack_name, drift_status, resource_count, drifted_count):
 """Publish custom metrics for drift detection"""
 
 cloudwatch.put_metric_data(
 Namespace='CloudFormation/Drift',
 MetricData=[
 {
 'MetricName': 'StacksChecked',
 'Dimensions': [
 {'Name': 'StackName', 'Value': stack_name}
 ],
 'Value': 1,
 'Unit': 'Count'
 },
 {
 'MetricName': 'ResourcesChecked',
 'Dimensions': [
 {'Name': 'StackName', 'Value': stack_name}
 ],
 'Value': resource_count,
 'Unit': 'Count'
 },
 {
 'MetricName': 'DriftedResources',
 'Dimensions': [
 {'Name': 'StackName', 'Value': stack_name},
 {'Name': 'DriftStatus', 'Value': drift_status}
 ],
 'Value': drifted_count,
 'Unit': 'Count'
 }
 ]
 )

Comprehensive Drift Monitoring

def comprehensive_drift_analysis(stack_name):
 """Perform comprehensive drift analysis with detailed logging"""
 
 logger.info(f"Starting comprehensive drift analysis for {stack_name}")
 
 try:
 # Initiate drift detection
 response = cloudformation.detect_stack_drift(StackName=stack_name)
 drift_detection_id = response['StackDriftDetectionId']
 
 logger.info(f"Drift detection initiated: {drift_detection_id}")
 
 # Monitor detection progress
 while True:
 status_response = cloudformation.describe_stack_drift_detection_status(
 StackDriftDetectionId=drift_detection_id
 )
 
 detection_status = status_response['DetectionStatus']
 logger.info(f"Detection status: {detection_status}")
 
 if detection_status == 'DETECTION_COMPLETE':
 break
 elif detection_status == 'DETECTION_FAILED':
 logger.error(f"Drift detection failed: {status_response.get('DetectionStatusReason')}")
 return None
 
 time.sleep(30)
 
 # Get drift results
 stack_drift_status = status_response['StackDriftStatus']
 logger.info(f"Stack drift status: {stack_drift_status}")
 
 if stack_drift_status == 'DRIFTED':
 # Get detailed drift information
 drift_details = cloudformation.describe_stack_resource_drifts(
 StackName=stack_name,
 StackResourceDriftStatusFilters=['MODIFIED', 'DELETED']
 )
 
 # Log detailed drift information
 for drift in drift_details['StackResourceDrifts']:
 logger.warning(f"Drifted resource: {drift['LogicalResourceId']} "
 f"({drift['ResourceType']}) - Status: {drift['StackResourceDriftStatus']}")
 
 # Log property differences
 for prop_diff in drift.get('PropertyDifferences', []):
 logger.warning(f" Property: {prop_diff['PropertyPath']}")
 logger.warning(f" Expected: {prop_diff['ExpectedValue']}")
 logger.warning(f" Actual: {prop_diff['ActualValue']}")
 
 return {
 'StackName': stack_name,
 'DriftStatus': stack_drift_status,
 'DetectionId': drift_detection_id,
 'Timestamp': status_response['Timestamp']
 }
 
 except Exception as e:
 logger.error(f"Error in drift analysis: {str(e)}")
 raise

Common Issues & Solutions

Detection Timeout

Issue: Drift detection takes too long or times out
Solution: Check stack size, reduce concurrent detections
Prevention: Monitor detection duration, optimize stack design

Unsupported Resources

Issue: Some resources don’t support drift detection
Solution: Use AWS Config rules for unsupported resources
Prevention: Check resource support before relying on drift detection

False Positives

Issue: Drift detected for expected changes
Solution: Update CloudFormation template to match current state
Prevention: Keep templates synchronized with manual changes

9. Common Exam Scenarios

Scenario 1: Detect manual changes to EC2 security groups

Solution:

AWS CloudFormation Macros

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CloudFormation Macros are custom processing functions that enable you to perform template-wide processing operations, such as transforming entire templates or specific template sections. Macros are powered by AWS Lambda functions and allow you to extend CloudFormation’s native capabilities.

Key Characteristics

Template transformation - Modify templates before processing
Lambda-powered - Custom logic implemented in Lambda functions
Reusable - Share macros across multiple templates and accounts
Flexible - Transform entire templates or specific sections
Extensible - Add custom functionality to CloudFormation
Version controlled - Macro versions can be managed and updated

What Problem Does It Solve?

Eliminates repetitive template code through abstraction
Enables custom template processing logic
Provides template-wide transformations
Allows creation of custom CloudFormation “functions”
Enables advanced template generation and manipulation
Supports complex conditional logic beyond native functions
Facilitates template standardization across organizations

2. Core Concepts

Macro

Lambda function that processes CloudFormation templates
Registered in CloudFormation with a unique name
Can be applied to entire templates or specific fragments
Returns transformed template content

Transform

Directive in CloudFormation template that invokes a macro
Can be template-level or resource-level
Processed before template validation and resource creation
Multiple transforms can be chained

Fragment

Portion of template processed by a macro
Can be a single resource, multiple resources, or template section
Passed to macro Lambda function as input
Replaced by macro output in final template

Template Processing Order

Template uploaded to CloudFormation
Transforms identified and executed in order
Macro Lambda functions process template/fragments
Transformed template validated
Resources created from final template

3. Macro Types

Template-Level Macros

Process entire CloudFormation template
Applied using Transform section at template root
Receive complete template as input
Return complete transformed template

Fragment-Level Macros

Process specific template sections
Applied using Fn::Transform intrinsic function
Receive template fragment as input
Return transformed fragment

4. Creating Macros

Macro Lambda Function Structure

import json
import boto3

def lambda_handler(event, context):
 """
 CloudFormation Macro Lambda function
 """
 # Extract macro input
 template_parameter_values = event.get('templateParameterValues', {})
 template = event.get('fragment', event.get('template'))
 account_id = event.get('accountId')
 region = event.get('region')
 
 # Process template/fragment
 try:
 # Custom transformation logic here
 transformed_template = process_template(template, template_parameter_values)
 
 # Return success response
 return {
 'requestId': event['requestId'],
 'status': 'SUCCESS',
 'fragment': transformed_template
 }
 except Exception as e:
 # Return failure response
 return {
 'requestId': event['requestId'],
 'status': 'FAILED',
 'errorMessage': str(e)
 }

def process_template(template, parameters):
 """
 Custom template processing logic
 """
 # Example: Add common tags to all resources
 if 'Resources' in template:
 for resource_name, resource in template['Resources'].items():
 if 'Properties' not in resource:
 resource['Properties'] = {}
 
 # Add tags if resource supports them
 if resource['Type'] in ['AWS::EC2::Instance', 'AWS::S3::Bucket']:
 if 'Tags' not in resource['Properties']:
 resource['Properties']['Tags'] = []
 
 # Add common tags
 resource['Properties']['Tags'].extend([
 {'Key': 'Environment', 'Value': parameters.get('Environment', 'Unknown')},
 {'Key': 'ManagedBy', 'Value': 'CloudFormation'},
 {'Key': 'CreatedBy', 'Value': 'Macro'}
 ])
 
 return template

Macro Registration Template

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Register CloudFormation Macro'

Parameters:
 MacroName:
 Type: String
 Default: CommonTagsMacro
 Description: Name of the macro

Resources:
 MacroFunction:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: !Sub '${MacroName}-Function'
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt MacroExecutionRole.Arn
 Code:
 ZipFile: |
 import json
 
 def lambda_handler(event, context):
 template = event.get('fragment', event.get('template'))
 
 # Add common tags to all taggable resources
 if 'Resources' in template:
 for resource_name, resource in template['Resources'].items():
 if resource['Type'] in ['AWS::EC2::Instance', 'AWS::S3::Bucket']:
 if 'Properties' not in resource:
 resource['Properties'] = {}
 if 'Tags' not in resource['Properties']:
 resource['Properties']['Tags'] = []
 
 resource['Properties']['Tags'].extend([
 {'Key': 'ManagedBy', 'Value': 'CloudFormation'},
 {'Key': 'MacroProcessed', 'Value': 'true'}
 ])
 
 return {
 'requestId': event['requestId'],
 'status': 'SUCCESS',
 'fragment': template
 }

 MacroExecutionRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: lambda.amazonaws.com
 Action: sts:AssumeRole
 ManagedPolicyArns:
 - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

 Macro:
 Type: AWS::CloudFormation::Macro
 Properties:
 Name: !Ref MacroName
 FunctionName: !GetAtt MacroFunction.Arn
 Description: 'Adds common tags to resources'

Outputs:
 MacroName:
 Description: Name of the registered macro
 Value: !Ref MacroName
 Export:
 Name: !Sub '${AWS::StackName}-MacroName'

5. Using Macros in Templates

Template-Level Transform

AWSTemplateFormatVersion: '2010-09-09'
Transform: CommonTagsMacro
Description: 'Template using macro transform'

Parameters:
 Environment:
 Type: String
 Default: Development

Resources:
 MyBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: !Sub 'my-bucket-${Environment}'

 MyInstance:
 Type: AWS::EC2::Instance
 Properties:
 ImageId: ami-0abcdef1234567890
 InstanceType: t3.micro

Fragment-Level Transform

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Template using fragment transform'

Resources:
 ProcessedResources:
 Fn::Transform:
 Name: CommonTagsMacro
 Parameters:
 Environment: Production
 Fragment:
 MyBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: my-production-bucket
 
 MyInstance:
 Type: AWS::EC2::Instance
 Properties:
 ImageId: ami-0abcdef1234567890
 InstanceType: t3.small

Multiple Transforms

AWSTemplateFormatVersion: '2010-09-09'
Transform:
 - AWS::Serverless-2016-10-31  # SAM transform
 - CommonTagsMacro  # Custom macro
 - SecurityMacro  # Another custom macro

Resources:
 MyFunction:
 Type: AWS::Serverless::Function
 Properties:
 Runtime: python3.9
 Handler: index.handler
 CodeUri: src/

6. Advanced Macro Examples

Resource Generator Macro

def lambda_handler(event, context):
 """
 Macro that generates multiple similar resources
 """
 template = event.get('fragment', event.get('template'))
 parameters = event.get('templateParameterValues', {})
 
 # Look for resource generators
 if 'Resources' in template:
 new_resources = {}
 resources_to_remove = []
 
 for resource_name, resource in template['Resources'].items():
 if resource.get('Type') == 'Custom::ResourceGenerator':
 # Generate multiple resources based on configuration
 config = resource.get('Properties', {})
 resource_type = config.get('ResourceType')
 count = int(config.get('Count', 1))
 base_properties = config.get('BaseProperties', {})
 
 # Generate resources
 for i in range(count):
 new_resource_name = f"{resource_name}{i+1}"
 new_resources[new_resource_name] = {
 'Type': resource_type,
 'Properties': {
 **base_properties,
 'Tags': [
 {'Key': 'Name', 'Value': f"{config.get('NamePrefix', 'Resource')}-{i+1}"},
 {'Key': 'Index', 'Value': str(i+1)}
 ]
 }
 }
 
 # Mark original for removal
 resources_to_remove.append(resource_name)
 
 # Add new resources and remove generators
 template['Resources'].update(new_resources)
 for resource_name in resources_to_remove:
 del template['Resources'][resource_name]
 
 return {
 'requestId': event['requestId'],
 'status': 'SUCCESS',
 'fragment': template
 }

Conditional Resource Macro

def lambda_handler(event, context):
 """
 Macro for advanced conditional resource creation
 """
 template = event.get('fragment', event.get('template'))
 parameters = event.get('templateParameterValues', {})
 
 if 'Resources' in template:
 resources_to_remove = []
 
 for resource_name, resource in template['Resources'].items():
 # Check for conditional properties
 if 'Condition' in resource:
 condition = resource['Condition']
 
 # Evaluate complex conditions
 if not evaluate_condition(condition, parameters):
 resources_to_remove.append(resource_name)
 
 # Remove resources that don't meet conditions
 for resource_name in resources_to_remove:
 del template['Resources'][resource_name]
 
 return {
 'requestId': event['requestId'],
 'status': 'SUCCESS',
 'fragment': template
 }

def evaluate_condition(condition, parameters):
 """
 Custom condition evaluation logic
 """
 # Example: Environment-based conditions
 if condition == 'IsProduction':
 return parameters.get('Environment') == 'Production'
 elif condition == 'HasHighAvailability':
 return parameters.get('HighAvailability', 'false').lower() == 'true'
 
 return True

7. IAM Roles & Permissions

Macro Lambda Execution Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "logs:CreateLogGroup",
 "logs:CreateLogStream",
 "logs:PutLogEvents"
 ],
 "Resource": "arn:aws:logs:*:*:*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:DescribeStacks",
 "cloudformation:DescribeStackResources"
 ],
 "Resource": "*"
 }
 ]
}

Macro Registration Permissions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:CreateMacro",
 "cloudformation:UpdateMacro",
 "cloudformation:DeleteMacro",
 "cloudformation:DescribeMacro",
 "cloudformation:ListMacros"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "lambda:InvokeFunction"
 ],
 "Resource": "arn:aws:lambda:*:*:function:*-macro-*"
 }
 ]
}

Cross-Account Macro Usage

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": [
 "arn:aws:iam::111111111111:root",
 "arn:aws:iam::222222222222:root"
 ]
 },
 "Action": "lambda:InvokeFunction",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:shared-macro-function"
 }
 ]
}

8. Integration with CI/CD Services

CodePipeline with Macro Validation

- Name: ValidateMacro
 Actions:
 - Name: TestMacro
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: 1
 Configuration:
 FunctionName: MacroValidationFunction
 UserParameters: |
 {
 "templatePath": "template.yaml",
 "macroName": "CommonTagsMacro"
 }
 InputArtifacts:
 - Name: SourceOutput

- Name: DeployWithMacro
 Actions:
 - Name: CreateChangeSet
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_REPLACE
 StackName: MyStack
 ChangeSetName: MyChangeSet
 TemplatePath: SourceOutput::template.yaml
 Capabilities: CAPABILITY_IAM
 InputArtifacts:
 - Name: SourceOutput

CodeBuild Macro Testing

# buildspec.yml
version: 0.2
phases:
 install:
 runtime-versions:
 python: 3.9
 pre_build:
 commands:
 - pip install boto3 pytest
 build:
 commands:
 # Test macro function locally
 - python -m pytest tests/test_macro.py -v
 
 # Validate template with macro
 - aws cloudformation validate-template --template-body file://template-with-macro.yaml
 
 # Test macro transformation
 - python scripts/test_macro_transform.py
 post_build:
 commands:
 - echo "Macro validation completed"

Macro Testing Script

# scripts/test_macro_transform.py
import json
import boto3
from moto import mock_lambda, mock_cloudformation

def test_macro_transformation():
 """Test macro transformation logic"""
 
 # Mock event data
 event = {
 'requestId': 'test-request-id',
 'fragment': {
 'Resources': {
 'TestBucket': {
 'Type': 'AWS::S3::Bucket',
 'Properties': {
 'BucketName': 'test-bucket'
 }
 }
 }
 },
 'templateParameterValues': {
 'Environment': 'Test'
 }
 }
 
 # Import and test macro function
 from macro_function import lambda_handler
 
 result = lambda_handler(event, {})
 
 # Validate transformation
 assert result['status'] == 'SUCCESS'
 assert 'Tags' in result['fragment']['Resources']['TestBucket']['Properties']
 
 print("Macro transformation test passed!")

if __name__ == '__main__':
 test_macro_transformation()

9. Security Best Practices

Macro Function Security

Use least privilege IAM roles for Lambda functions
Validate all input parameters and template content
Implement proper error handling and logging
Use AWS Secrets Manager for sensitive configuration
Enable CloudTrail logging for macro invocations

Input Validation

def validate_input(event):
 """Validate macro input for security"""
 
 # Check required fields
 required_fields = ['requestId', 'fragment']
 for field in required_fields:
 if field not in event:
 raise ValueError(f"Missing required field: {field}")
 
 # Validate template size
 template_str = json.dumps(event['fragment'])
 if len(template_str) > 460800: # 450KB limit
 raise ValueError("Template fragment too large")
 
 # Validate resource types (whitelist approach)
 allowed_types = [
 'AWS::EC2::Instance',
 'AWS::S3::Bucket',
 'AWS::IAM::Role',
 'AWS::Lambda::Function'
 ]
 
 fragment = event['fragment']
 if 'Resources' in fragment:
 for resource_name, resource in fragment['Resources'].items():
 if resource.get('Type') not in allowed_types:
 raise ValueError(f"Unsupported resource type: {resource.get('Type')}")
 
 return True

Secure Macro Registration

Resources:
 MacroFunction:
 Type: AWS::Lambda::Function
 Properties:
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt MacroRole.Arn
 Environment:
 Variables:
 LOG_LEVEL: INFO
 ReservedConcurrencyLimit: 10 # Prevent abuse
 DeadLetterConfig:
 TargetArn: !GetAtt MacroErrorQueue.Arn

 MacroRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: lambda.amazonaws.com
 Action: sts:AssumeRole
 Condition:
 StringEquals:
 'aws:SourceAccount': !Ref 'AWS::AccountId'

10. Monitoring & Troubleshooting

CloudWatch Logging

import logging
import json

# Configure logging
logger = logging.getLogger()
logger.setLevel(logging.INFO)

def lambda_handler(event, context):
 """Macro with comprehensive logging"""
 
 request_id = event.get('requestId', 'unknown')
 
 try:
 logger.info(f"Processing macro request: {request_id}")
 logger.debug(f"Input event: {json.dumps(event, default=str)}")
 
 # Process template
 result = process_template(event)
 
 logger.info(f"Macro processing completed successfully: {request_id}")
 return result
 
 except Exception as e:
 logger.error(f"Macro processing failed: {request_id}, Error: {str(e)}")
 return {
 'requestId': request_id,
 'status': 'FAILED',
 'errorMessage': str(e)
 }

CloudWatch Metrics

import boto3

cloudwatch = boto3.client('cloudwatch')

def publish_macro_metrics(macro_name, status, processing_time):
 """Publish custom metrics for macro execution"""
 
 cloudwatch.put_metric_data(
 Namespace='CloudFormation/Macros',
 MetricData=[
 {
 'MetricName': 'Invocations',
 'Dimensions': [
 {'Name': 'MacroName', 'Value': macro_name},
 {'Name': 'Status', 'Value': status}
 ],
 'Value': 1,
 'Unit': 'Count'
 },
 {
 'MetricName': 'ProcessingTime',
 'Dimensions': [
 {'Name': 'MacroName', 'Value': macro_name}
 ],
 'Value': processing_time,
 'Unit': 'Milliseconds'
 }
 ]
 )

Error Handling Patterns

def lambda_handler(event, context):
 """Robust error handling for macros"""
 
 request_id = event.get('requestId', 'unknown')
 
 try:
 # Validate input
 validate_input(event)
 
 # Process template
 transformed_template = process_template(event['fragment'])
 
 return {
 'requestId': request_id,
 'status': 'SUCCESS',
 'fragment': transformed_template
 }
 
 except ValueError as e:
 # Input validation errors
 logger.error(f"Validation error: {str(e)}")
 return {
 'requestId': request_id,
 'status': 'FAILED',
 'errorMessage': f"Input validation failed: {str(e)}"
 }
 
 except KeyError as e:
 # Missing required data
 logger.error(f"Missing data error: {str(e)}")
 return {
 'requestId': request_id,
 'status': 'FAILED',
 'errorMessage': f"Required data missing: {str(e)}"
 }
 
 except Exception as e:
 # Unexpected errors
 logger.error(f"Unexpected error: {str(e)}")
 return {
 'requestId': request_id,
 'status': 'FAILED',
 'errorMessage': "Internal processing error"
 }

11. Common Exam Scenarios

Scenario 1: Standardize resource tagging across organization

Solution:

AWS CloudTrail

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account by logging, continuously monitoring, and retaining account activity related to actions across your AWS infrastructure.

Key Characteristics

Audit logging - Records API calls and account activity
Compliance - Meets regulatory and compliance requirements
Security analysis - Detect unusual activity patterns
Operational troubleshooting - Debug issues with API calls
Multi-region - Can log activity across all regions
Real-time - Near real-time event delivery
Integrated - Works with CloudWatch, S3, EventBridge

What Problem Does It Solve?

Provides visibility into user and resource activity
Enables security analysis and compliance reporting
Helps with operational troubleshooting
Tracks changes to AWS resources
Enables forensic analysis after security incidents
Supports compliance audits and governance

2. Core Concepts

Trail

Configuration that enables logging of AWS API calls
Defines where logs are stored (S3 bucket)
Can be single-region or multi-region
Can include global services (IAM, CloudFront, Route 53)

Event

Record of an activity in AWS account
Contains details about API call, user, time, source IP
Types: Management events, Data events, Insight events
JSON format with standardized fields

Management Events

Control plane operations (create, delete, modify resources)
Enabled by default in trails
Examples: CreateInstance, DeleteBucket, PutBucketPolicy
Read events vs Write events

Data Events

Data plane operations (object-level operations)
Not enabled by default (additional cost)
Examples: GetObject, PutObject, DeleteObject
High volume events

Insight Events

Identify unusual activity patterns
Machine learning-based analysis
Detect spikes in API call volume
Additional cost feature

Event History

90-day searchable history
Available by default (no trail needed)
Management events only
Free of charge

3. Trail Configuration

Basic Trail Configuration

{
 "TrailName": "MyTrail",
 "S3BucketName": "my-cloudtrail-bucket",
 "S3KeyPrefix": "cloudtrail-logs/",
 "IncludeGlobalServiceEvents": true,
 "IsMultiRegionTrail": true,
 "EnableLogFileValidation": true,
 "EventSelectors": [
 {
 "ReadWriteType": "All",
 "IncludeManagementEvents": true,
 "DataResources": [
 {
 "Type": "AWS::S3::Object",
 "Values": ["arn:aws:s3:::my-bucket/*"]
 }
 ]
 }
 ]
}

CloudFormation Template

AWSTemplateFormatVersion: '2010-09-09'
Resources:
 CloudTrail:
 Type: AWS::CloudTrail::Trail
 Properties:
 TrailName: MyCloudTrail
 S3BucketName: !Ref CloudTrailBucket
 S3KeyPrefix: cloudtrail-logs/
 IncludeGlobalServiceEvents: true
 IsMultiRegionTrail: true
 EnableLogFileValidation: true
 EventSelectors:
 - ReadWriteType: All
 IncludeManagementEvents: true
 DataResources:
 - Type: AWS::S3::Object
 Values: 
 - "arn:aws:s3:::my-sensitive-bucket/*"
 
 CloudTrailBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: my-cloudtrail-logs-bucket
 PublicAccessBlockConfiguration:
 BlockPublicAcls: true
 BlockPublicPolicy: true
 IgnorePublicAcls: true
 RestrictPublicBuckets: true

4. Event Structure

Standard Event Format

{
 "eventVersion": "1.08",
 "userIdentity": {
 "type": "IAMUser",
 "principalId": "AIDACKCEVSQ6C2EXAMPLE",
 "arn": "arn:aws:iam::123456789012:user/johndoe",
 "accountId": "123456789012",
 "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
 "userName": "johndoe"
 },
 "eventTime": "2023-11-15T14:30:00Z",
 "eventSource": "ec2.amazonaws.com",
 "eventName": "RunInstances",
 "awsRegion": "us-east-1",
 "sourceIPAddress": "203.0.113.12",
 "userAgent": "aws-cli/2.0.0 Python/3.8.0",
 "requestParameters": {
 "instanceType": "t3.micro",
 "minCount": 1,
 "maxCount": 1
 },
 "responseElements": {
 "instancesSet": {
 "items": [
 {
 "instanceId": "i-1234567890abcdef0",
 "imageId": "ami-12345678",
 "state": {
 "code": 0,
 "name": "pending"
 }
 }
 ]
 }
 },
 "requestID": "12345678-1234-1234-1234-123456789012",
 "eventID": "87654321-4321-4321-4321-210987654321",
 "eventType": "AwsApiCall",
 "recipientAccountId": "123456789012",
 "serviceEventDetails": {
 "responseElements": null
 }
}

Key Event Fields

eventVersion - CloudTrail record format version
userIdentity - Information about user/role that made request
eventTime - Date and time of request (UTC)
eventSource - AWS service that request was made to
eventName - Requested action
awsRegion - AWS region where request was made
sourceIPAddress - IP address of requester
userAgent - Agent through which request was made
requestParameters - Parameters sent with request
responseElements - Response elements for actions that make changes
errorCode - AWS service error if request returned error
errorMessage - Description of error

5. IAM Roles & Permissions

CloudTrail Service Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "logs:CreateLogGroup",
 "logs:CreateLogStream",
 "logs:PutLogEvents",
 "logs:DescribeLogGroups",
 "logs:DescribeLogStreams"
 ],
 "Resource": "arn:aws:logs:*:*:*"
 }
 ]
}

S3 Bucket Policy for CloudTrail

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "AWSCloudTrailAclCheck",
 "Effect": "Allow",
 "Principal": {
 "Service": "cloudtrail.amazonaws.com"
 },
 "Action": "s3:GetBucketAcl",
 "Resource": "arn:aws:s3:::my-cloudtrail-bucket"
 },
 {
 "Sid": "AWSCloudTrailWrite",
 "Effect": "Allow",
 "Principal": {
 "Service": "cloudtrail.amazonaws.com"
 },
 "Action": "s3:PutObject",
 "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*",
 "Condition": {
 "StringEquals": {
 "s3:x-amz-acl": "bucket-owner-full-control"
 }
 }
 }
 ]
}

Cross-Account CloudTrail Access

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:root"
 },
 "Action": [
 "s3:GetBucketAcl",
 "s3:ListBucket"
 ],
 "Resource": "arn:aws:s3:::central-cloudtrail-bucket"
 },
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:root"
 },
 "Action": "s3:GetObject",
 "Resource": "arn:aws:s3:::central-cloudtrail-bucket/*"
 }
 ]
}

User Permissions for CloudTrail Analysis

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "cloudtrail:LookupEvents",
 "cloudtrail:GetTrailStatus",
 "cloudtrail:DescribeTrails"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:ListBucket"
 ],
 "Resource": [
 "arn:aws:s3:::my-cloudtrail-bucket",
 "arn:aws:s3:::my-cloudtrail-bucket/*"
 ]
 }
 ]
}

6. Integration with AWS Services

CloudWatch Logs Integration

{
 "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/MyTrail:*",
 "CloudWatchLogsRoleArn": "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role"
}

EventBridge Integration

CloudTrail events automatically sent to EventBridge
Create rules to trigger on specific API calls
Real-time response to security events

EventBridge Rule Example

{
 "Rules": [
 {
 "Name": "DetectRootLogin",
 "EventPattern": {
 "source": ["aws.signin"],
 "detail-type": ["AWS Console Sign In via CloudTrail"],
 "detail": {
 "userIdentity": {
 "type": ["Root"]
 }
 }
 },
 "Targets": [
 {
 "Arn": "arn:aws:sns:us-east-1:123456789012:security-alerts",
 "Id": "1"
 }
 ]
 }
 ]
}

AWS Config Integration

CloudTrail provides “who” and “when”
Config provides “what changed”
Combined view of configuration changes

Amazon Athena Integration

Query CloudTrail logs using SQL
Analyze patterns and trends
Cost-effective for large-scale analysis

Athena Table Creation

CREATE EXTERNAL TABLE cloudtrail_logs (
 eventversion STRING,
 useridentity STRUCT<
 type:STRING,
 principalid:STRING,
 arn:STRING,
 accountid:STRING,
 invokedby:STRING,
 accesskeyid:STRING,
 userName:STRING,
 sessioncontext:STRUCT<
 attributes:STRUCT<
 mfaauthenticated:STRING,
 creationdate:STRING>,
 sessionissuer:STRUCT<
 type:STRING,
 principalId:STRING,
 arn:STRING,
 accountId:STRING,
 userName:STRING>>>,
 eventtime STRING,
 eventsource STRING,
 eventname STRING,
 awsregion STRING,
 sourceipaddress STRING,
 useragent STRING,
 errorcode STRING,
 errormessage STRING,
 requestparameters STRING,
 responseelements STRING,
 additionaleventdata STRING,
 requestid STRING,
 eventid STRING,
 resources ARRAY<STRUCT<
 ARN:STRING,
 accountId:STRING,
 type:STRING>>,
 eventtype STRING,
 apiversion STRING,
 readonly STRING,
 recipientaccountid STRING,
 serviceeventdetails STRING,
 sharedeventid STRING,
 vpcendpointid STRING
)
PARTITIONED BY (
 region string,
 year string,
 month string,
 day string
)
STORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'
OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'
LOCATION 's3://my-cloudtrail-bucket/AWSLogs/123456789012/CloudTrail/'

7. Security Best Practices

Encryption

S3 bucket encryption - Enable default encryption
SSE-KMS - Use customer managed keys for additional control
Log file validation - Enable to detect tampering

S3 Bucket Security

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "DenyInsecureConnections",
 "Effect": "Deny",
 "Principal": "*",
 "Action": "s3:*",
 "Resource": [
 "arn:aws:s3:::my-cloudtrail-bucket",
 "arn:aws:s3:::my-cloudtrail-bucket/*"
 ],
 "Condition": {
 "Bool": {
 "aws:SecureTransport": "false"
 }
 }
 },
 {
 "Sid": "DenyUnencryptedObjectUploads",
 "Effect": "Deny",
 "Principal": "*",
 "Action": "s3:PutObject",
 "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*",
 "Condition": {
 "StringNotEquals": {
 "s3:x-amz-server-side-encryption": "AES256"
 }
 }
 }
 ]
}

Access Control

Use least privilege for CloudTrail access
Separate read and write permissions
Use resource-based policies for cross-account access
Enable MFA for sensitive operations

Monitoring

Monitor CloudTrail configuration changes
Alert on trail deletion or modification
Monitor for unusual API activity patterns
Set up CloudWatch alarms for critical events

8. Monitoring & Troubleshooting

CloudWatch Metrics

ErrorCount - Number of errors in log delivery
TotalSizeBytes - Size of log files delivered

CloudWatch Alarms

{
 "AlarmName": "CloudTrail-LogDeliveryErrors",
 "MetricName": "ErrorCount",
 "Namespace": "AWS/CloudTrail",
 "Statistic": "Sum",
 "Period": 300,
 "EvaluationPeriods": 1,
 "Threshold": 1,
 "ComparisonOperator": "GreaterThanOrEqualToThreshold",
 "AlarmActions": [
 "arn:aws:sns:us-east-1:123456789012:cloudtrail-alerts"
 ]
}

Common Issues

Trail Not Logging

Check trail status: aws cloudtrail get-trail-status
Verify S3 bucket permissions
Check IAM role permissions
Verify trail is enabled

Missing Events

Check if event type is enabled (management vs data events)
Verify region configuration (single vs multi-region)
Check event selectors configuration
Verify global services events setting

Log Delivery Delays

Normal delay: 5-15 minutes
Check CloudWatch metrics for errors
Verify S3 bucket accessibility
Check for S3 bucket policy restrictions

Troubleshooting Commands

# Check trail status
aws cloudtrail get-trail-status --name MyTrail

# Describe trail configuration
aws cloudtrail describe-trails --trail-name-list MyTrail

# Look up recent events
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances

# Validate log file integrity
aws cloudtrail validate-logs --trail-arn arn:aws:cloudtrail:us-east-1:123456789012:trail/MyTrail --start-time 2023-11-15T00:00:00Z

9. Common Exam Scenarios

Scenario 1: Detect root account usage

Solution:

AWS CloudWatch Alarms

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What are CloudWatch Alarms?

Monitoring service that watches CloudWatch metrics
Triggers actions when metric thresholds are breached
Essential component of incident detection and response
Integrates with SNS, Auto Scaling, EC2, and other services

Key Components

Metrics - Data points that alarms monitor
Thresholds - Values that trigger alarm state changes
Actions - What happens when alarm state changes
States - OK, ALARM, INSUFFICIENT_DATA

Use Cases for Incident Response

Infrastructure monitoring and alerting
Application performance monitoring
Security incident detection
Automated scaling and remediation
Cost monitoring and optimization

2. Alarm States and Transitions

Alarm States

OK - Metric is within threshold
ALARM - Metric has breached threshold
INSUFFICIENT_DATA - Not enough data to determine state

State Transitions

def monitor_alarm_state_changes(event, context):
 """Handle CloudWatch alarm state changes"""
 
 detail = event['detail']
 alarm_name = detail['alarmName']
 old_state = detail['previousState']['value']
 new_state = detail['newState']['value']
 reason = detail['newState']['reason']
 
 logger.info(f"Alarm {alarm_name} changed from {old_state} to {new_state}")
 
 if new_state == 'ALARM':
 handle_alarm_triggered(alarm_name, reason, detail)
 elif new_state == 'OK' and old_state == 'ALARM':
 handle_alarm_resolved(alarm_name, detail)
 elif new_state == 'INSUFFICIENT_DATA':
 handle_insufficient_data(alarm_name, detail)

def handle_alarm_triggered(alarm_name, reason, detail):
 """Handle alarm entering ALARM state"""
 
 # Create incident
 incident = create_incident(
 title=f"CloudWatch Alarm: {alarm_name}",
 description=reason,
 severity=determine_severity_from_alarm(alarm_name),
 alarm_details=detail
 )
 
 # Send notifications
 send_alarm_notification(incident)
 
 # Trigger automated response
 trigger_automated_response(alarm_name, incident)

3. Metric-Based Alarms

EC2 Instance Monitoring

# CPU utilization alarm
aws cloudwatch put-metric-alarm \
 --alarm-name "HighCPUUtilization" \
 --alarm-description "Triggers when CPU exceeds 80%" \
 --metric-name CPUUtilization \
 --namespace AWS/EC2 \
 --statistic Average \
 --period 300 \
 --threshold 80 \
 --comparison-operator GreaterThanThreshold \
 --evaluation-periods 2 \
 --alarm-actions "arn:aws:sns:us-east-1:123456789012:cpu-alerts" \
 --dimensions Name=InstanceId,Value=i-1234567890abcdef0

# Memory utilization alarm (custom metric)
aws cloudwatch put-metric-alarm \
 --alarm-name "HighMemoryUtilization" \
 --alarm-description "Triggers when memory exceeds 85%" \
 --metric-name MemoryUtilization \
 --namespace CWAgent \
 --statistic Average \
 --period 300 \
 --threshold 85 \
 --comparison-operator GreaterThanThreshold \
 --evaluation-periods 2 \
 --alarm-actions "arn:aws:sns:us-east-1:123456789012:memory-alerts" \
 --dimensions Name=InstanceId,Value=i-1234567890abcdef0

Application Load Balancer Monitoring

# High error rate alarm
aws cloudwatch put-metric-alarm \
 --alarm-name "ALBHighErrorRate" \
 --alarm-description "Triggers when 5XX error rate exceeds 5%" \
 --metric-name HTTPCode_ELB_5XX_Count \
 --namespace AWS/ApplicationELB \
 --statistic Sum \
 --period 300 \
 --threshold 10 \
 --comparison-operator GreaterThanThreshold \
 --evaluation-periods 2 \
 --alarm-actions "arn:aws:sns:us-east-1:123456789012:alb-alerts" \
 --dimensions Name=LoadBalancer,Value=app/my-alb/50dc6c495c0c9188

# High response time alarm
aws cloudwatch put-metric-alarm \
 --alarm-name "ALBHighResponseTime" \
 --alarm-description "Triggers when response time exceeds 2 seconds" \
 --metric-name TargetResponseTime \
 --namespace AWS/ApplicationELB \
 --statistic Average \
 --period 300 \
 --threshold 2 \
 --comparison-operator GreaterThanThreshold \
 --evaluation-periods 3 \
 --alarm-actions "arn:aws:sns:us-east-1:123456789012:performance-alerts"

RDS Database Monitoring

# Database connection alarm
aws cloudwatch put-metric-alarm \
 --alarm-name "RDSHighConnections" \
 --alarm-description "Triggers when connection count exceeds 80% of max" \
 --metric-name DatabaseConnections \
 --namespace AWS/RDS \
 --statistic Average \
 --period 300 \
 --threshold 80 \
 --comparison-operator GreaterThanThreshold \
 --evaluation-periods 2 \
 --alarm-actions "arn:aws:sns:us-east-1:123456789012:rds-alerts" \
 --dimensions Name=DBInstanceIdentifier,Value=mydb-instance

4. Composite Alarms

Multi-Metric Monitoring

def create_composite_alarm():
 """Create composite alarm for application health"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Create composite alarm that triggers when multiple conditions are met
 response = cloudwatch.put_composite_alarm(
 AlarmName='ApplicationHealthComposite',
 AlarmDescription='Composite alarm for overall application health',
 AlarmRule=(
 "ALARM('HighCPUUtilization') OR "
 "ALARM('ALBHighErrorRate') OR "
 "ALARM('RDSHighConnections')"
 ),
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:critical-alerts'
 ],
 OKActions=[
 'arn:aws:sns:us-east-1:123456789012:recovery-notifications'
 ]
 )
 
 return response

Complex Logic Alarms

# Composite alarm with AND/OR logic
aws cloudwatch put-composite-alarm \
 --alarm-name "CriticalSystemFailure" \
 --alarm-description "Critical system failure detected" \
 --alarm-rule "(ALARM('HighCPUUtilization') AND ALARM('ALBHighErrorRate')) OR ALARM('DatabaseDown')" \
 --actions-enabled \
 --alarm-actions "arn:aws:sns:us-east-1:123456789012:emergency-alerts"

5. Custom Metrics and Alarms

Application Metrics

import boto3
import time

def publish_custom_metrics():
 """Publish custom application metrics"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Business metrics
 cloudwatch.put_metric_data(
 Namespace='MyApp/Business',
 MetricData=[
 {
 'MetricName': 'OrdersPerMinute',
 'Value': get_orders_per_minute(),
 'Unit': 'Count/Second',
 'Dimensions': [
 {
 'Name': 'Environment',
 'Value': 'Production'
 }
 ]
 },
 {
 'MetricName': 'PaymentFailureRate',
 'Value': get_payment_failure_rate(),
 'Unit': 'Percent',
 'Dimensions': [
 {
 'Name': 'PaymentProvider',
 'Value': 'Stripe'
 }
 ]
 }
 ]
 )

def create_business_metric_alarms():
 """Create alarms for business metrics"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Low order rate alarm
 cloudwatch.put_metric_alarm(
 AlarmName='LowOrderRate',
 AlarmDescription='Order rate has dropped significantly',
 MetricName='OrdersPerMinute',
 Namespace='MyApp/Business',
 Statistic='Average',
 Period=300,
 Threshold=10,
 ComparisonOperator='LessThanThreshold',
 EvaluationPeriods=3,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:business-alerts'
 ],
 Dimensions=[
 {
 'Name': 'Environment',
 'Value': 'Production'
 }
 ]
 )
 
 # High payment failure rate alarm
 cloudwatch.put_metric_alarm(
 AlarmName='HighPaymentFailureRate',
 AlarmDescription='Payment failure rate is too high',
 MetricName='PaymentFailureRate',
 Namespace='MyApp/Business',
 Statistic='Average',
 Period=300,
 Threshold=5,
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=2,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:payment-alerts'
 ]
 )

6. Alarm Actions and Automation

def setup_alarm_notifications():
 """Set up SNS topics for alarm notifications"""
 
 sns = boto3.client('sns')
 
 # Create topics for different severity levels
 topics = {
 'critical': 'critical-alerts',
 'warning': 'warning-alerts',
 'info': 'info-alerts'
 }
 
 topic_arns = {}
 
 for severity, topic_name in topics.items():
 response = sns.create_topic(Name=topic_name)
 topic_arn = response['TopicArn']
 topic_arns[severity] = topic_arn
 
 # Subscribe appropriate endpoints
 if severity == 'critical':
 # SMS for critical alerts
 sns.subscribe(
 TopicArn=topic_arn,
 Protocol='sms',
 Endpoint='+1234567890'
 )
 # Email for critical alerts
 sns.subscribe(
 TopicArn=topic_arn,
 Protocol='email',
 Endpoint='oncall@example.com'
 )
 
 # Email for all alerts
 sns.subscribe(
 TopicArn=topic_arn,
 Protocol='email',
 Endpoint='alerts@example.com'
 )
 
 return topic_arns

Auto Scaling Integration

# Create scaling policy
aws autoscaling put-scaling-policy \
 --auto-scaling-group-name "my-asg" \
 --policy-name "scale-up-policy" \
 --policy-type "StepScaling" \
 --adjustment-type "ChangeInCapacity" \
 --step-adjustments MetricIntervalLowerBound=0,MetricIntervalUpperBound=50,ScalingAdjustment=1 \
 MetricIntervalLowerBound=50,ScalingAdjustment=2

# Create alarm that triggers scaling
aws cloudwatch put-metric-alarm \
 --alarm-name "ScaleUpAlarm" \
 --alarm-description "Scale up when CPU is high" \
 --metric-name CPUUtilization \
 --namespace AWS/EC2 \
 --statistic Average \
 --period 300 \
 --threshold 70 \
 --comparison-operator GreaterThanThreshold \
 --evaluation-periods 2 \
 --alarm-actions "arn:aws:autoscaling:us-east-1:123456789012:scalingPolicy:policy-id"

Lambda Integration

def create_lambda_alarm_handler():
 """Create Lambda function to handle alarm events"""
 
 lambda_code = '''
import json
import boto3

def lambda_handler(event, context):
 """Handle CloudWatch alarm events"""
 
 # Parse SNS message
 message = json.loads(event['Records'][0]['Sns']['Message'])
 
 alarm_name = message['AlarmName']
 new_state = message['NewStateValue']
 reason = message['NewStateReason']
 
 if new_state == 'ALARM':
 # Trigger incident response
 trigger_incident_response(alarm_name, reason)
 
 return {'statusCode': 200}

def trigger_incident_response(alarm_name, reason):
 """Trigger automated incident response"""
 
 if 'HighCPU' in alarm_name:
 # Scale up resources
 trigger_auto_scaling()
 elif 'HighErrorRate' in alarm_name:
 # Restart application
 restart_application()
 elif 'DatabaseDown' in alarm_name:
 # Failover to backup
 trigger_database_failover()
'''
 
 # Create Lambda function
 lambda_client = boto3.client('lambda')
 
 response = lambda_client.create_function(
 FunctionName='AlarmResponseHandler',
 Runtime='python3.9',
 Role='arn:aws:iam::123456789012:role/LambdaExecutionRole',
 Handler='lambda_function.lambda_handler',
 Code={'ZipFile': lambda_code.encode()},
 Description='Handles CloudWatch alarm events'
 )
 
 return response

7. Anomaly Detection

Anomaly Detector Alarms

def create_anomaly_detection_alarm():
 """Create alarm based on anomaly detection"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Create anomaly detector
 cloudwatch.put_anomaly_detector(
 Namespace='AWS/EC2',
 MetricName='CPUUtilization',
 Dimensions=[
 {
 'Name': 'InstanceId',
 'Value': 'i-1234567890abcdef0'
 }
 ],
 Stat='Average'
 )
 
 # Create alarm based on anomaly detection
 cloudwatch.put_metric_alarm(
 AlarmName='CPUAnomalyDetection',
 AlarmDescription='Detects CPU usage anomalies',
 ComparisonOperator='LessThanLowerOrGreaterThanUpperThreshold',
 EvaluationPeriods=2,
 Metrics=[
 {
 'Id': 'm1',
 'MetricStat': {
 'Metric': {
 'Namespace': 'AWS/EC2',
 'MetricName': 'CPUUtilization',
 'Dimensions': [
 {
 'Name': 'InstanceId',
 'Value': 'i-1234567890abcdef0'
 }
 ]
 },
 'Period': 300,
 'Stat': 'Average'
 }
 },
 {
 'Id': 'ad1',
 'Expression': 'ANOMALY_DETECTION_FUNCTION(m1, 2)'
 }
 ],
 ThresholdMetricId='ad1',
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:anomaly-alerts'
 ]
 )

8. Monitoring and Troubleshooting

Alarm History

def analyze_alarm_history(alarm_name, days=7):
 """Analyze alarm history for patterns"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 end_time = datetime.utcnow()
 start_time = end_time - timedelta(days=days)
 
 # Get alarm history
 response = cloudwatch.describe_alarm_history(
 AlarmName=alarm_name,
 StartDate=start_time,
 EndDate=end_time,
 MaxRecords=100
 )
 
 # Analyze patterns
 state_changes = []
 for item in response['AlarmHistoryItems']:
 if item['HistoryItemType'] == 'StateUpdate':
 state_changes.append({
 'timestamp': item['Timestamp'],
 'summary': item['HistorySummary'],
 'data': json.loads(item['HistoryData'])
 })
 
 # Calculate alarm frequency
 alarm_count = len([sc for sc in state_changes 
 if 'to ALARM' in sc['summary']])
 
 return {
 'alarm_name': alarm_name,
 'period_days': days,
 'total_state_changes': len(state_changes),
 'alarm_count': alarm_count,
 'alarm_frequency': alarm_count / days,
 'state_changes': state_changes
 }

Alarm Effectiveness Metrics

def calculate_alarm_effectiveness():
 """Calculate metrics for alarm effectiveness"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Get all alarms
 alarms = cloudwatch.describe_alarms()
 
 effectiveness_metrics = {}
 
 for alarm in alarms['MetricAlarms']:
 alarm_name = alarm['AlarmName']
 
 # Get alarm history
 history = analyze_alarm_history(alarm_name, days=30)
 
 # Calculate effectiveness metrics
 effectiveness_metrics[alarm_name] = {
 'total_alarms': history['alarm_count'],
 'false_positive_rate': calculate_false_positive_rate(alarm_name),
 'mean_time_to_resolution': calculate_mttr(alarm_name),
 'alarm_frequency': history['alarm_frequency']
 }
 
 return effectiveness_metrics

def calculate_false_positive_rate(alarm_name):
 """Calculate false positive rate for alarm"""
 # Implementation would analyze incident outcomes
 # vs alarm triggers to determine false positives
 return 0.15 # Example: 15% false positive rate

def calculate_mttr(alarm_name):
 """Calculate mean time to resolution"""
 # Implementation would analyze time between
 # alarm trigger and resolution
 return 45 # Example: 45 minutes average

9. Cost Optimization

Alarm Cost Management

def optimize_alarm_costs():
 """Optimize CloudWatch alarm costs"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Get all alarms
 alarms = cloudwatch.describe_alarms()
 
 optimization_recommendations = []
 
 for alarm in alarms['MetricAlarms']:
 alarm_name = alarm['AlarmName']
 
 # Check if alarm has triggered recently
 history = analyze_alarm_history(alarm_name, days=90)
 
 if history['alarm_count'] == 0:
 # Alarm hasn't triggered in 90 days
 optimization_recommendations.append({
 'alarm_name': alarm_name,
 'recommendation': 'Consider disabling - no triggers in 90 days',
 'potential_savings': 0.10 # $0.10 per alarm per month
 })
 
 elif history['false_positive_rate'] > 0.8:
 # High false positive rate
 optimization_recommendations.append({
 'alarm_name': alarm_name,
 'recommendation': 'Tune threshold - high false positive rate',
 'false_positive_rate': history['false_positive_rate']
 })
 
 return optimization_recommendations

10. Common Exam Scenarios

Scenario 1: High CPU utilization incident response

Solution:

AWS CloudWatch Logs

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CloudWatch Logs enables you to monitor, store, and access your log files from Amazon EC2 instances, AWS CloudTrail, Route 53, and other sources. It provides centralized log management with real-time monitoring and analysis capabilities.

Key Characteristics

Centralized logging - Collect logs from multiple sources in one location
Real-time monitoring - Stream logs in real-time for immediate analysis
Log retention - Configurable retention periods from 1 day to never expire
Log insights - Query and analyze log data using CloudWatch Logs Insights
Metric filters - Extract metrics from log data for monitoring and alerting
Subscription filters - Stream log data to other services for processing
Cross-account access - Share logs across AWS accounts
Encryption - Server-side encryption for log data at rest

What Problem Does It Solve?

Centralizes log management across distributed systems
Provides real-time log monitoring and alerting
Enables log-based troubleshooting and debugging
Facilitates compliance and audit requirements
Supports automated log analysis and processing
Reduces operational overhead of log management

2. Core Components

Log Groups and Log Streams

# Create log group
aws logs create-log-group --log-group-name /aws/lambda/my-function

# Set retention policy
aws logs put-retention-policy \
 --log-group-name /aws/lambda/my-function \
 --retention-in-days 30

# Create log stream
aws logs create-log-stream \
 --log-group-name /aws/lambda/my-function \
 --log-stream-name 2023/12/01/stream1

# Put log events
aws logs put-log-events \
 --log-group-name /aws/lambda/my-function \
 --log-stream-name 2023/12/01/stream1 \
 --log-events timestamp=1640995200000,message="Application started"

CloudFormation Configuration

Resources:
 ApplicationLogGroup:
 Type: AWS::Logs::LogGroup
 Properties:
 LogGroupName: /aws/application/myapp
 RetentionInDays: 14
 KmsKeyId: !Ref LogsKMSKey

 LambdaLogGroup:
 Type: AWS::Logs::LogGroup
 Properties:
 LogGroupName: !Sub "/aws/lambda/${LambdaFunction}"
 RetentionInDays: 30

 # Custom log group with subscription filter
 CustomLogGroup:
 Type: AWS::Logs::LogGroup
 Properties:
 LogGroupName: /custom/application/logs
 RetentionInDays: 7

 LogSubscriptionFilter:
 Type: AWS::Logs::SubscriptionFilter
 Properties:
 LogGroupName: !Ref CustomLogGroup
 FilterPattern: "[timestamp, request_id, level=\"ERROR\", ...]"
 DestinationArn: !GetAtt ProcessingLambda.Arn

 # Metric filter for error counting
 ErrorMetricFilter:
 Type: AWS::Logs::MetricFilter
 Properties:
 LogGroupName: !Ref ApplicationLogGroup
 FilterPattern: "ERROR"
 MetricTransformations:
 - MetricNamespace: MyApp/Errors
 MetricName: ErrorCount
 MetricValue: "1"
 DefaultValue: 0

3. Log Agents and Collection

CloudWatch Agent Configuration

{
 "agent": {
 "metrics_collection_interval": 60,
 "run_as_user": "cwagent"
 },
 "logs": {
 "logs_collected": {
 "files": {
 "collect_list": [
 {
 "file_path": "/var/log/messages",
 "log_group_name": "/aws/ec2/system",
 "log_stream_name": "{instance_id}/messages",
 "timezone": "UTC",
 "timestamp_format": "%b %d %H:%M:%S"
 },
 {
 "file_path": "/var/log/httpd/access_log",
 "log_group_name": "/aws/ec2/httpd",
 "log_stream_name": "{instance_id}/access",
 "timezone": "UTC",
 "timestamp_format": "[%d/%b/%Y:%H:%M:%S %z]"
 },
 {
 "file_path": "/opt/myapp/logs/application.log",
 "log_group_name": "/aws/application/myapp",
 "log_stream_name": "{instance_id}",
 "timezone": "UTC",
 "multi_line_start_pattern": "^\\d{4}-\\d{2}-\\d{2}",
 "timestamp_format": "%Y-%m-%d %H:%M:%S"
 }
 ]
 },
 "windows_events": {
 "collect_list": [
 {
 "event_name": "System",
 "event_levels": ["ERROR", "WARNING"],
 "log_group_name": "/aws/ec2/windows/system",
 "log_stream_name": "{instance_id}"
 }
 ]
 }
 }
 },
 "metrics": {
 "namespace": "CWAgent",
 "metrics_collected": {
 "cpu": {
 "measurement": ["cpu_usage_idle", "cpu_usage_iowait"],
 "metrics_collection_interval": 60
 },
 "disk": {
 "measurement": ["used_percent"],
 "metrics_collection_interval": 60,
 "resources": ["*"]
 },
 "mem": {
 "measurement": ["mem_used_percent"],
 "metrics_collection_interval": 60
 }
 }
 }
}

Container Logging

# ECS Task Definition with CloudWatch Logs
Resources:
 TaskDefinition:
 Type: AWS::ECS::TaskDefinition
 Properties:
 Family: myapp-task
 NetworkMode: awsvpc
 RequiresCompatibilities:
 - FARGATE
 Cpu: 256
 Memory: 512
 ExecutionRoleArn: !GetAtt TaskExecutionRole.Arn
 ContainerDefinitions:
 - Name: myapp
 Image: myapp:latest
 LogConfiguration:
 LogDriver: awslogs
 Options:
 awslogs-group: !Ref ApplicationLogGroup
 awslogs-region: !Ref AWS::Region
 awslogs-stream-prefix: ecs
 Environment:
 - Name: LOG_LEVEL
 Value: INFO

# Kubernetes with Fluent Bit
apiVersion: v1
kind: ConfigMap
metadata:
 name: fluent-bit-config
data:
 fluent-bit.conf: |
 [SERVICE]
 Flush 1
 Log_Level info
 Daemon off
 Parsers_File parsers.conf
 HTTP_Server On
 HTTP_Listen 0.0.0.0
 HTTP_Port 2020

 [INPUT]
 Name tail
 Tag kube.*
 Path /var/log/containers/*.log
 Parser docker
 DB /var/log/flb_kube.db
 Mem_Buf_Limit 50MB
 Skip_Long_Lines On
 Refresh_Interval 10

 [OUTPUT]
 Name cloudwatch_logs
 Match kube.*
 region us-east-1
 log_group_name /aws/eks/cluster/logs
 log_stream_prefix ${HOSTNAME}-
 auto_create_group true

4. Log Insights and Querying

CloudWatch Logs Insights Queries

-- Find errors in the last hour
fields @timestamp, @message
| filter @message like /ERROR/
| sort @timestamp desc
| limit 100

-- Analyze Lambda function performance
fields @timestamp, @duration, @billedDuration, @memorySize, @maxMemoryUsed
| filter @type = "REPORT"
| stats avg(@duration), max(@duration), min(@duration) by bin(5m)

-- Parse and analyze application logs
fields @timestamp, @message
| parse @message /(?<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) \[(?<level>\w+)\] (?<message>.*)/
| filter level = "ERROR"
| stats count() by bin(1h)

-- Monitor API Gateway access patterns
fields @timestamp, @message
| filter @message like /\[.*\] ".*" \d{3}/
| parse @message /\[(?<timestamp>.*)\] "(?<method>\w+) (?<path>.*) HTTP\/\d\.\d" (?<status>\d{3})/
| stats count() by status, method
| sort count desc

-- Analyze ECS container logs
fields @timestamp, @message, @logStream
| filter @message like /ERROR/
| parse @logStream /ecs\/(?<service>.*?)\/(?<task>.*)/
| stats count() by service
| sort count desc

-- Custom application metrics from logs
fields @timestamp, @message
| parse @message /response_time=(?<response_time>\d+)ms/
| filter ispresent(response_time)
| stats avg(response_time), max(response_time), min(response_time) by bin(5m)

Programmatic Log Analysis

import boto3
import json
from datetime import datetime, timedelta

class CloudWatchLogsAnalyzer:
 def __init__(self):
 self.logs_client = boto3.client('logs')
 
 def run_insights_query(self, log_group, query, start_time, end_time):
 """Run CloudWatch Logs Insights query"""
 
 response = self.logs_client.start_query(
 logGroupName=log_group,
 startTime=int(start_time.timestamp()),
 endTime=int(end_time.timestamp()),
 queryString=query
 )
 
 query_id = response['queryId']
 
 # Wait for query to complete
 while True:
 result = self.logs_client.get_query_results(queryId=query_id)
 
 if result['status'] == 'Complete':
 return result['results']
 elif result['status'] == 'Failed':
 raise Exception(f"Query failed: {result.get('statistics', {}).get('recordsMatched', 0)}")
 
 time.sleep(1)
 
 def analyze_error_patterns(self, log_group, hours_back=24):
 """Analyze error patterns in logs"""
 
 end_time = datetime.utcnow()
 start_time = end_time - timedelta(hours=hours_back)
 
 query = """
 fields @timestamp, @message
 | filter @message like /ERROR/
 | parse @message /ERROR: (?<error_type>.*?) - (?<error_message>.*)/
 | stats count() by error_type
 | sort count desc
 """
 
 results = self.run_insights_query(log_group, query, start_time, end_time)
 
 error_summary = {}
 for result in results:
 error_type = next((field['value'] for field in result if field['field'] == 'error_type'), 'Unknown')
 count = int(next((field['value'] for field in result if field['field'] == 'count'), 0))
 error_summary[error_type] = count
 
 return error_summary
 
 def get_log_events(self, log_group, log_stream=None, start_time=None, end_time=None, filter_pattern=None):
 """Get log events with optional filtering"""
 
 params = {
 'logGroupName': log_group,
 'startFromHead': True
 }
 
 if log_stream:
 params['logStreamNames'] = [log_stream]
 
 if start_time:
 params['startTime'] = int(start_time.timestamp() * 1000)
 
 if end_time:
 params['endTime'] = int(end_time.timestamp() * 1000)
 
 if filter_pattern:
 params['filterPattern'] = filter_pattern
 
 events = []
 paginator = self.logs_client.get_paginator('filter_log_events')
 
 for page in paginator.paginate(**params):
 events.extend(page['events'])
 
 return events
 
 def create_metric_filter(self, log_group, filter_name, filter_pattern, metric_name, metric_namespace):
 """Create metric filter from log data"""
 
 self.logs_client.put_metric_filter(
 logGroupName=log_group,
 filterName=filter_name,
 filterPattern=filter_pattern,
 metricTransformations=[
 {
 'metricName': metric_name,
 'metricNamespace': metric_namespace,
 'metricValue': '1',
 'defaultValue': 0
 }
 ]
 )
 
 def export_logs_to_s3(self, log_group, s3_bucket, s3_prefix, start_time, end_time):
 """Export logs to S3 for long-term storage"""
 
 response = self.logs_client.create_export_task(
 logGroupName=log_group,
 fromTime=int(start_time.timestamp() * 1000),
 to=int(end_time.timestamp() * 1000),
 destination=s3_bucket,
 destinationPrefix=s3_prefix
 )
 
 return response['taskId']

5. Subscription Filters and Real-time Processing

Lambda Processing

# Lambda function for log processing
import json
import gzip
import base64
import boto3

def lambda_handler(event, context):
 """Process CloudWatch Logs via subscription filter"""
 
 # Decode and decompress log data
 compressed_payload = base64.b64decode(event['awslogs']['data'])
 uncompressed_payload = gzip.decompress(compressed_payload)
 log_data = json.loads(uncompressed_payload)
 
 processed_events = []
 
 for log_event in log_data['logEvents']:
 message = log_event['message']
 timestamp = log_event['timestamp']
 
 # Parse log message
 if 'ERROR' in message:
 # Extract error information
 error_info = parse_error_message(message)
 
 # Send to SNS for alerting
 send_error_alert(error_info, timestamp)
 
 # Store in DynamoDB for tracking
 store_error_event(error_info, timestamp)
 
 # Process metrics
 if 'response_time=' in message:
 response_time = extract_response_time(message)
 send_custom_metric('ResponseTime', response_time, timestamp)
 
 processed_events.append({
 'timestamp': timestamp,
 'message': message,
 'processed': True
 })
 
 return {
 'statusCode': 200,
 'body': json.dumps(f'Processed {len(processed_events)} log events')
 }

def parse_error_message(message):
 """Parse error message to extract structured information"""
 
 # Example parsing logic
 import re
 
 pattern = r'ERROR: (?P<error_type>.*?) - (?P<error_message>.*?) \[(?P<component>.*?)\]'
 match = re.search(pattern, message)
 
 if match:
 return {
 'error_type': match.group('error_type'),
 'error_message': match.group('error_message'),
 'component': match.group('component')
 }
 
 return {'error_type': 'Unknown', 'error_message': message, 'component': 'Unknown'}

def send_error_alert(error_info, timestamp):
 """Send error alert via SNS"""
 
 sns = boto3.client('sns')
 
 message = f"""
 Error Alert:
 Type: {error_info['error_type']}
 Message: {error_info['error_message']}
 Component: {error_info['component']}
 Timestamp: {timestamp}
 """
 
 sns.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:error-alerts',
 Message=message,
 Subject=f"Application Error: {error_info['error_type']}"
 )

def send_custom_metric(metric_name, value, timestamp):
 """Send custom metric to CloudWatch"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 cloudwatch.put_metric_data(
 Namespace='MyApp/Performance',
 MetricData=[
 {
 'MetricName': metric_name,
 'Value': float(value),
 'Timestamp': datetime.fromtimestamp(timestamp / 1000),
 'Unit': 'Milliseconds'
 }
 ]
 )

Kinesis Data Streams Integration

# CloudFormation for Kinesis integration
Resources:
 LogProcessingStream:
 Type: AWS::Kinesis::Stream
 Properties:
 Name: log-processing-stream
 ShardCount: 2
 RetentionPeriodHours: 24

 LogSubscriptionFilter:
 Type: AWS::Logs::SubscriptionFilter
 Properties:
 LogGroupName: !Ref ApplicationLogGroup
 FilterPattern: "[timestamp, request_id, level, message]"
 DestinationArn: !GetAtt LogProcessingStream.Arn
 RoleArn: !GetAtt LogsRole.Arn

 # Kinesis Analytics for real-time processing
 LogAnalyticsApplication:
 Type: AWS::KinesisAnalytics::Application
 Properties:
 ApplicationName: log-analytics
 ApplicationDescription: Real-time log analysis
 ApplicationCode: |
 CREATE OR REPLACE STREAM "DESTINATION_SQL_STREAM" (
 timestamp TIMESTAMP,
 level VARCHAR(10),
 message VARCHAR(1000),
 error_count INTEGER
 );
 
 CREATE OR REPLACE PUMP "STREAM_PUMP" AS INSERT INTO "DESTINATION_SQL_STREAM"
 SELECT STREAM
 ROWTIME_TO_TIMESTAMP(ROWTIME) as timestamp,
 level,
 message,
 CASE WHEN level = 'ERROR' THEN 1 ELSE 0 END as error_count
 FROM "SOURCE_SQL_STREAM_001"
 WHERE level IN ('ERROR', 'WARN', 'INFO');
 Inputs:
 - NamePrefix: SOURCE_SQL_STREAM
 KinesisStreamsInput:
 ResourceARN: !GetAtt LogProcessingStream.Arn
 RoleARN: !GetAtt AnalyticsRole.Arn
 InputSchema:
 RecordColumns:
 - Name: timestamp
 SqlType: TIMESTAMP
 Mapping: $.timestamp
 - Name: level
 SqlType: VARCHAR(10)
 Mapping: $.level
 - Name: message
 SqlType: VARCHAR(1000)
 Mapping: $.message

Cross-Account Access Setup

# Destination account (log aggregation account)
Resources:
 LogDestination:
 Type: AWS::Logs::Destination
 Properties:
 DestinationName: central-log-destination
 RoleArn: !GetAtt CrossAccountLogsRole.Arn
 TargetArn: !GetAtt CentralLogGroup.Arn
 DestinationPolicy: !Sub |
 {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "AllowSourceAccounts",
 "Effect": "Allow",
 "Principal": {
 "AWS": [
 "arn:aws:iam::111111111111:root",
 "arn:aws:iam::222222222222:root"
 ]
 },
 "Action": "logs:PutSubscriptionFilter",
 "Resource": "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:destination:central-log-destination"
 }
 ]
 }

 CrossAccountLogsRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: logs.amazonaws.com
 Action: sts:AssumeRole
 Policies:
 - PolicyName: LogsDeliveryPolicy
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - logs:PutLogEvents
 Resource: !GetAtt CentralLogGroup.Arn

 CentralLogGroup:
 Type: AWS::Logs::LogGroup
 Properties:
 LogGroupName: /central/aggregated-logs
 RetentionInDays: 90

Source Account Configuration

# Python script to setup cross-account log streaming
import boto3

def setup_cross_account_logging(source_log_group, destination_arn, filter_pattern=""):
 """Setup cross-account log streaming"""
 
 logs_client = boto3.client('logs')
 
 # Create subscription filter pointing to destination account
 logs_client.put_subscription_filter(
 logGroupName=source_log_group,
 filterName=f"{source_log_group}-cross-account-filter",
 filterPattern=filter_pattern,
 destinationArn=destination_arn
 )
 
 print(f"Cross-account logging setup for {source_log_group}")

# Usage
setup_cross_account_logging(
 source_log_group="/aws/lambda/my-function",
 destination_arn="arn:aws:logs:us-east-1:999999999999:destination:central-log-destination",
 filter_pattern="[timestamp, request_id, level=\"ERROR\", ...]"
)

7. Security and Encryption

Encryption Configuration

Resources:
 LogsKMSKey:
 Type: AWS::KMS::Key
 Properties:
 Description: KMS key for CloudWatch Logs encryption
 KeyPolicy:
 Version: '2012-10-17'
 Statement:
 - Sid: Enable IAM User Permissions
 Effect: Allow
 Principal:
 AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
 Action: "kms:*"
 Resource: "*"
 - Sid: Allow CloudWatch Logs
 Effect: Allow
 Principal:
 Service: !Sub "logs.${AWS::Region}.amazonaws.com"
 Action:
 - kms:Encrypt
 - kms:Decrypt
 - kms:ReEncrypt*
 - kms:GenerateDataKey*
 - kms:DescribeKey
 Resource: "*"
 Condition:
 ArnEquals:
 "kms:EncryptionContext:aws:logs:arn": !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/secure/application/*"

 LogsKMSKeyAlias:
 Type: AWS::KMS::Alias
 Properties:
 AliasName: alias/cloudwatch-logs
 TargetKeyId: !Ref LogsKMSKey

 SecureLogGroup:
 Type: AWS::Logs::LogGroup
 Properties:
 LogGroupName: /secure/application/logs
 RetentionInDays: 30
 KmsKeyId: !GetAtt LogsKMSKey.Arn

IAM Policies for Log Access

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "CloudWatchLogsFullAccess",
 "Effect": "Allow",
 "Action": [
 "logs:CreateLogGroup",
 "logs:CreateLogStream",
 "logs:PutLogEvents",
 "logs:DescribeLogGroups",
 "logs:DescribeLogStreams"
 ],
 "Resource": [
 "arn:aws:logs:*:*:log-group:/aws/lambda/*",
 "arn:aws:logs:*:*:log-group:/application/*"
 ]
 },
 {
 "Sid": "CloudWatchLogsInsights",
 "Effect": "Allow",
 "Action": [
 "logs:StartQuery",
 "logs:StopQuery",
 "logs:GetQueryResults",
 "logs:DescribeQueries"
 ],
 "Resource": "*"
 },
 {
 "Sid": "MetricFiltersAccess",
 "Effect": "Allow",
 "Action": [
 "logs:PutMetricFilter",
 "logs:DeleteMetricFilter",
 "logs:DescribeMetricFilters"
 ],
 "Resource": "arn:aws:logs:*:*:log-group:*"
 },
 {
 "Sid": "SubscriptionFiltersAccess",
 "Effect": "Allow",
 "Action": [
 "logs:PutSubscriptionFilter",
 "logs:DeleteSubscriptionFilter",
 "logs:DescribeSubscriptionFilters"
 ],
 "Resource": "arn:aws:logs:*:*:log-group:*",
 "Condition": {
 "StringEquals": {
 "logs:destination-arn": [
 "arn:aws:lambda:*:*:function:log-processor",
 "arn:aws:kinesis:*:*:stream/log-stream"
 ]
 }
 }
 }
 ]
}

8. Integration with CI/CD

CodePipeline Integration

# CloudFormation for CI/CD log monitoring
Resources:
 PipelineLogGroup:
 Type: AWS::Logs::LogGroup
 Properties:
 LogGroupName: /aws/codepipeline/deployment-pipeline
 RetentionInDays: 14

 BuildLogGroup:
 Type: AWS::Logs::LogGroup
 Properties:
 LogGroupName: /aws/codebuild/build-project
 RetentionInDays: 7

 # Metric filter for deployment failures
 DeploymentFailureMetric:
 Type: AWS::Logs::MetricFilter
 Properties:
 LogGroupName: !Ref PipelineLogGroup
 FilterPattern: "[timestamp, request_id, level=\"FAILED\", stage, ...]"
 MetricTransformations:
 - MetricNamespace: CI/CD/Pipeline
 MetricName: DeploymentFailures
 MetricValue: "1"
 DefaultValue: 0

 # Alarm for deployment failures
 DeploymentFailureAlarm:
 Type: AWS::CloudWatch::Alarm
 Properties:
 AlarmName: DeploymentFailures
 AlarmDescription: Alert on deployment failures
 MetricName: DeploymentFailures
 Namespace: CI/CD/Pipeline
 Statistic: Sum
 Period: 300
 EvaluationPeriods: 1
 Threshold: 1
 ComparisonOperator: GreaterThanOrEqualToThreshold
 AlarmActions:
 - !Ref DeploymentAlertsTopic

Application Deployment Monitoring

# Lambda function for deployment log analysis
import boto3
import json
from datetime import datetime, timedelta

def lambda_handler(event, context):
 """Analyze deployment logs for issues"""
 
 logs_client = boto3.client('logs')
 cloudwatch = boto3.client('cloudwatch')
 
 # Analyze recent deployment logs
 end_time = datetime.utcnow()
 start_time = end_time - timedelta(hours=1)
 
 # Query for deployment events
 query = """
 fields @timestamp, @message
 | filter @message like /DEPLOYMENT/
 | parse @message /DEPLOYMENT (?<status>\w+): (?<service>.*?) - (?<details>.*)/
 | stats count() by status, service
 """
 
 try:
 response = logs_client.start_query(
 logGroupName='/aws/codepipeline/deployment-pipeline',
 startTime=int(start_time.timestamp()),
 endTime=int(end_time.timestamp()),
 queryString=query
 )
 
 query_id = response['queryId']
 
 # Wait for results
 while True:
 result = logs_client.get_query_results(queryId=query_id)
 
 if result['status'] == 'Complete':
 break
 elif result['status'] == 'Failed':
 raise Exception("Query failed")
 
 time.sleep(1)
 
 # Process results and send metrics
 for row in result['results']:
 status = next((field['value'] for field in row if field['field'] == 'status'), 'Unknown')
 service = next((field['value'] for field in row if field['field'] == 'service'), 'Unknown')
 count = int(next((field['value'] for field in row if field['field'] == 'count'), 0))
 
 # Send custom metrics
 cloudwatch.put_metric_data(
 Namespace='CI/CD/Deployments',
 MetricData=[
 {
 'MetricName': f'Deployment{status}',
 'Dimensions': [
 {
 'Name': 'Service',
 'Value': service
 }
 ],
 'Value': count,
 'Unit': 'Count',
 'Timestamp': end_time
 }
 ]
 )
 
 return {
 'statusCode': 200,
 'body': json.dumps('Deployment analysis completed')
 }
 
 except Exception as e:
 print(f"Error analyzing deployment logs: {str(e)}")
 return {
 'statusCode': 500,
 'body': json.dumps(f'Error: {str(e)}')
 }

9. Common Exam Scenarios

Scenario 1: Centralized Logging Architecture

# Complete centralized logging setup
import boto3
import json

class CentralizedLoggingSetup:
 def __init__(self):
 self.logs_client = boto3.client('logs')
 self.iam_client = boto3.client('iam')
 self.lambda_client = boto3.client('lambda')
 
 def setup_centralized_logging(self, applications):
 """Setup centralized logging for multiple applications"""
 
 # Create central log groups
 central_groups = {}
 
 for app in applications:
 log_group_name = f"/central/{app['name']}/logs"
 
 try:
 self.logs_client.create_log_group(
 logGroupName=log_group_name,
 kmsKeyId=app.get('kms_key_id'),
 tags={
 'Application': app['name'],
 'Environment': app['environment'],
 'LogType': 'Centralized'
 }
 )
 
 # Set retention policy
 self.logs_client.put_retention_policy(
 logGroupName=log_group_name,
 retentionInDays=app.get('retention_days', 30)
 )
 
 central_groups[app['name']] = log_group_name
 
 except self.logs_client.exceptions.ResourceAlreadyExistsException:
 central_groups[app['name']] = log_group_name
 
 # Setup log aggregation Lambda
 aggregation_function = self.create_log_aggregation_function()
 
 # Create subscription filters
 for app in applications:
 for source_log_group in app['source_log_groups']:
 self.create_subscription_filter(
 source_log_group,
 aggregation_function['FunctionArn'],
 app.get('filter_pattern', '')
 )
 
 return {
 'central_log_groups': central_groups,
 'aggregation_function': aggregation_function['FunctionArn']
 }
 
 def create_log_aggregation_function(self):
 """Create Lambda function for log aggregation"""
 
 function_code = '''
import json
import gzip
import base64
import boto3
import re
from datetime import datetime

def lambda_handler(event, context):
 # Decode log data
 compressed_payload = base64.b64decode(event['awslogs']['data'])
 uncompressed_payload = gzip.decompress(compressed_payload)
 log_data = json.loads(uncompressed_payload)
 
 logs_client = boto3.client('logs')
 
 # Process each log event
 for log_event in log_data['logEvents']:
 # Parse and enrich log message
 enriched_message = enrich_log_message(
 log_event['message'],
 log_data['logGroup'],
 log_data['logStream']
 )
 
 # Send to central log group
 central_log_group = determine_central_log_group(log_data['logGroup'])
 
 logs_client.put_log_events(
 logGroupName=central_log_group,
 logStreamName=f"aggregated-{datetime.now().strftime('%Y/%m/%d')}",
 logEvents=[
 {
 'timestamp': log_event['timestamp'],
 'message': enriched_message
 }
 ]
 )
 
 return {'statusCode': 200}

def enrich_log_message(message, log_group, log_stream):
 # Add metadata to log message
 enriched = {
 'original_message': message,
 'source_log_group': log_group,
 'source_log_stream': log_stream,
 'processed_timestamp': datetime.utcnow().isoformat(),
 'metadata': extract_metadata(message)
 }
 
 return json.dumps(enriched)

def extract_metadata(message):
 # Extract structured data from log message
 metadata = {}
 
 # Extract log level
 level_match = re.search(r'\\b(DEBUG|INFO|WARN|ERROR|FATAL)\\b', message)
 if level_match:
 metadata['level'] = level_match.group(1)
 
 # Extract request ID
 request_id_match = re.search(r'request[_-]?id[=:]\\s*([a-zA-Z0-9-]+)', message, re.IGNORECASE)
 if request_id_match:
 metadata['request_id'] = request_id_match.group(1)
 
 return metadata

def determine_central_log_group(source_log_group):
 # Map source log groups to central log groups
 mapping = {
 '/aws/lambda/': '/central/lambda/logs',
 '/aws/apigateway/': '/central/apigateway/logs',
 '/aws/ecs/': '/central/ecs/logs'
 }
 
 for prefix, central_group in mapping.items():
 if source_log_group.startswith(prefix):
 return central_group
 
 return '/central/unknown/logs'
 '''
 
 # Create IAM role for Lambda
 role_response = self.iam_client.create_role(
 RoleName='LogAggregationLambdaRole',
 AssumeRolePolicyDocument=json.dumps({
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {"Service": "lambda.amazonaws.com"},
 "Action": "sts:AssumeRole"
 }
 ]
 })
 )
 
 # Attach policies
 self.iam_client.attach_role_policy(
 RoleName='LogAggregationLambdaRole',
 PolicyArn='arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
 )
 
 # Create custom policy for logs access
 self.iam_client.put_role_policy(
 RoleName='LogAggregationLambdaRole',
 PolicyName='LogsAccess',
 PolicyDocument=json.dumps({
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "logs:CreateLogStream",
 "logs:PutLogEvents",
 "logs:DescribeLogGroups",
 "logs:DescribeLogStreams"
 ],
 "Resource": "arn:aws:logs:*:*:log-group:/central/*"
 }
 ]
 })
 )
 
 # Create Lambda function
 function_response = self.lambda_client.create_function(
 FunctionName='log-aggregation-function',
 Runtime='python3.9',
 Role=role_response['Role']['Arn'],
 Handler='index.lambda_handler',
 Code={'ZipFile': function_code.encode()},
 Description='Centralized log aggregation function',
 Timeout=60,
 MemorySize=256
 )
 
 return function_response

Scenario 2: Real-time Log Monitoring and Alerting

# Complete real-time monitoring setup
Resources:
 # Application log group
 ApplicationLogGroup:
 Type: AWS::Logs::LogGroup
 Properties:
 LogGroupName: /aws/application/myapp
 RetentionInDays: 14

 # Error rate metric filter
 ErrorRateMetricFilter:
 Type: AWS::Logs::MetricFilter
 Properties:
 LogGroupName: !Ref ApplicationLogGroup
 FilterPattern: "ERROR"
 MetricTransformations:
 - MetricNamespace: MyApp/Errors
 MetricName: ErrorRate
 MetricValue: "1"
 DefaultValue: 0

 # Response time metric filter
 ResponseTimeMetricFilter:
 Type: AWS::Logs::MetricFilter
 Properties:
 LogGroupName: !Ref ApplicationLogGroup
 FilterPattern: "[timestamp, request_id, level, message, response_time_ms]"
 MetricTransformations:
 - MetricNamespace: MyApp/Performance
 MetricName: ResponseTime
 MetricValue: "$response_time_ms"
 DefaultValue: 0

 # High error rate alarm
 HighErrorRateAlarm:
 Type: AWS::CloudWatch::Alarm
 Properties:
 AlarmName: HighErrorRate
 AlarmDescription: Alert when error rate is high
 MetricName: ErrorRate
 Namespace: MyApp/Errors
 Statistic: Sum
 Period: 300
 EvaluationPeriods: 2
 Threshold: 10
 ComparisonOperator: GreaterThanThreshold
 AlarmActions:
 - !Ref ErrorAlertsTopic
 TreatMissingData: notBreaching

 # Slow response time alarm
 SlowResponseAlarm:
 Type: AWS::CloudWatch::Alarm
 Properties:
 AlarmName: SlowResponseTime
 AlarmDescription: Alert when response time is slow
 MetricName: ResponseTime
 Namespace: MyApp/Performance
 Statistic: Average
 Period: 300
 EvaluationPeriods: 3
 Threshold: 2000
 ComparisonOperator: GreaterThanThreshold
 AlarmActions:
 - !Ref PerformanceAlertsTopic

 # Real-time log processing
 LogProcessingFunction:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: real-time-log-processor
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt LogProcessingRole.Arn
 Code:
 ZipFile: |
 import json
 import gzip
 import base64
 import boto3
 import re
 from datetime import datetime
 
 def lambda_handler(event, context):
 # Process real-time log events
 compressed_payload = base64.b64decode(event['awslogs']['data'])
 uncompressed_payload = gzip.decompress(compressed_payload)
 log_data = json.loads(uncompressed_payload)
 
 sns = boto3.client('sns')
 cloudwatch = boto3.client('cloudwatch')
 
 critical_errors = []
 performance_issues = []
 
 for log_event in log_data['logEvents']:
 message = log_event['message']
 timestamp = log_event['timestamp']
 
 # Detect critical errors
 if re.search(r'CRITICAL|FATAL|OutOfMemoryError', message, re.IGNORECASE):
 critical_errors.append({
 'timestamp': timestamp,
 'message': message
 })
 
 # Detect performance issues
 response_time_match = re.search(r'response_time=(\d+)ms', message)
 if response_time_match:
 response_time = int(response_time_match.group(1))
 if response_time > 5000: # 5 seconds
 performance_issues.append({
 'timestamp': timestamp,
 'response_time': response_time,
 'message': message
 })
 
 # Send immediate alerts for critical errors
 if critical_errors:
 sns.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:critical-alerts',
 Message=json.dumps(critical_errors, indent=2),
 Subject=f'CRITICAL: {len(critical_errors)} critical errors detected'
 )
 
 # Send performance alerts
 if performance_issues:
 sns.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:performance-alerts',
 Message=json.dumps(performance_issues, indent=2),
 Subject=f'Performance Issue: {len(performance_issues)} slow responses detected'
 )
 
 return {
 'statusCode': 200,
 'body': json.dumps({
 'critical_errors': len(critical_errors),
 'performance_issues': len(performance_issues)
 })
 }

 # Subscription filter for real-time processing
 RealTimeSubscriptionFilter:
 Type: AWS::Logs::SubscriptionFilter
 Properties:
 LogGroupName: !Ref ApplicationLogGroup
 FilterPattern: ""
 DestinationArn: !GetAtt LogProcessingFunction.Arn

 # Permission for CloudWatch Logs to invoke Lambda
 LogsLambdaPermission:
 Type: AWS::Lambda::Permission
 Properties:
 FunctionName: !Ref LogProcessingFunction
 Action: lambda:InvokeFunction
 Principal: logs.amazonaws.com
 SourceArn: !Sub "${ApplicationLogGroup}:*"

10. Exam Tips

Understand log hierarchy - Log groups contain log streams, streams contain events
Master retention policies - Know default retention (never expire) and cost implications
Know metric filters - Extract metrics from log data for monitoring
Practice Logs Insights - Query syntax and common patterns
Understand subscription filters - Real-time log processing and destinations
Learn cross-account sharing - Log destinations and IAM policies
Know encryption options - KMS integration and key policies
Practice troubleshooting - Common issues with log agents and permissions
Understand cost optimization - Retention policies, log compression, S3 export
Master integration patterns - Lambda, Kinesis, ElasticSearch, S3 integration

AWS CodeArtifact

Sun, 04 Oct 2026 00:00:00 +0000

What it is: A fully managed artifact repository for language-native package managers (npm, Maven, Gradle, pip/twine, NuGet, and others). The AWS-native answer to self-hosted Nexus/Artifactory, sitting between your developers and CodeBuild/CodePipeline.

Exam-testable facts:

Two-level model: a Domain is the top-level container — it owns a single KMS key, stores each asset once no matter how many repositories reference it (dedupe), and is where org-wide policy lives. Repositories are the per-format endpoints clients publish to and resolve from; repositories are polyglot (one repo can hold multiple package types) and cannot be moved between domains.
Upstream repositories: a repository can chain to other CodeArtifact repositories as upstreams, so one package-manager endpoint transparently resolves packages living in several repositories.
External connections: one repository gets a maximum of one external connection to a public registry (npmjs, Maven Central, PyPI, NuGet). Public packages fetched through it are cached and retained inside your domain.
Package origin controls: govern whether a given package name may be published directly or only ingested from upstream — the defense against dependency-confusion attacks.
Auth: short-lived tokens from get-authorization-token (12-hour default), wired into npm/pip/mvn/dotnet client config. Resource policies grant cross-account repository access.
Events: package publish/update/delete events flow to EventBridge, so a new artifact version can kick off a CodePipeline execution or a Lambda.

Common traps:

AWS CodeBuild

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages ready for deployment.

Key Characteristics

Fully managed - No servers to provision or manage
Pay-as-you-go - Only pay for build minutes used
Scalable - Automatically scales to meet build demand
Pre-configured environments - Supports Java, Python, Node.js, Ruby, Go, Docker, .NET Core, PHP, and more
Custom environments - Use custom Docker images
Integrated - Works seamlessly with CodePipeline, CodeCommit, S3, GitHub, Bitbucket

2. Core Components

Build Project

Configuration that defines how to run a build
Includes: source location, build environment, build commands, output location

Build Environment

Docker container where build runs
AWS provides managed images or use custom Docker images
Compute types: BUILD_GENERAL1_SMALL, MEDIUM, LARGE, 2XLARGE

Build Specification (buildspec.yml)

YAML file defining build commands and settings
Can be in source code root or specified inline
Defines phases: install, pre_build, build, post_build

Source Providers

AWS CodeCommit
Amazon S3
GitHub / GitHub Enterprise
Bitbucket
No source (for testing)

Artifacts

Output files from build process
Stored in S3 bucket
Can be encrypted with KMS

3. Buildspec.yml Structure

Basic Structure

version: 0.2

env:
 variables:
 JAVA_HOME: "/usr/lib/jvm/java-8-openjdk-amd64"
 parameter-store:
 LOGIN_PASSWORD: /myapp/password
 secrets-manager:
 DOCKER_HUB_TOKEN: dockerhub:token

phases:
 install:
 runtime-versions:
 nodejs: 14
 commands:
 - echo "Installing dependencies"
 - npm install
 
 pre_build:
 commands:
 - echo "Running tests"
 - npm test
 
 build:
 commands:
 - echo "Building application"
 - npm run build
 
 post_build:
 commands:
 - echo "Build completed"

artifacts:
 files:
 - '**/*'
 base-directory: build
 name: myapp-$(date +%Y%m%d-%H%M%S)

cache:
 paths:
 - 'node_modules/**/*'

Build Phases

install - Install packages in build environment
pre_build - Commands before build (e.g., login to registries, install dependencies)
build - Actual build commands
post_build - Commands after build (e.g., packaging, notifications)

Environment Variables

variables - Plain text variables
parameter-store - Retrieve from AWS Systems Manager Parameter Store
secrets-manager - Retrieve from AWS Secrets Manager
exported-variables - Export variables to later build stages

4. Build Environments

Managed Images

Amazon Linux 2 (AL2)
Ubuntu
Windows Server Core 2019

Compute Types

Type	vCPU	Memory	Disk Space
BUILD_GENERAL1_SMALL	2	3 GB	64 GB
BUILD_GENERAL1_MEDIUM	4	7 GB	128 GB
BUILD_GENERAL1_LARGE	8	15 GB	128 GB
BUILD_GENERAL1_2XLARGE	72	145 GB	824 GB

Custom Docker Images

Use custom images from ECR or Docker Hub
Specify in build project configuration
Must include CodeBuild agent for managed builds

Privileged Mode

Required for Docker builds (Docker-in-Docker)
Allows access to Docker daemon
Enable in build project settings

5. VPC Configuration

When to Use VPC

Access private resources (RDS, ElastiCache, internal APIs)
Access resources in private subnets
Comply with network isolation requirements

VPC Setup Requirements

VPC ID - The VPC where resources exist
Subnets - Private subnets (typically)
Security Groups - Control inbound/outbound traffic
ENI - CodeBuild creates ENI in your subnet

Required IAM Permissions for VPC

ec2:CreateNetworkInterface
ec2:DescribeNetworkInterfaces
ec2:DeleteNetworkInterface
ec2:DescribeSubnets
ec2:DescribeSecurityGroups
ec2:DescribeDhcpOptions
ec2:DescribeVpcs
ec2:CreateNetworkInterfacePermission

Internet Access from VPC

NAT Gateway - For internet access from private subnet
VPC Endpoints - For AWS service access (S3, DynamoDB, ECR, etc.)
No IGW needed - If only accessing AWS services via endpoints

6. Caching

Cache Types

S3 Cache

Stores cache in S3 bucket
Shared across build projects
Slower than local cache
Good for dependencies that don’t change often

Local Cache

Stores cache on build instance
Faster than S3 cache
Types:
- LOCAL_SOURCE_CACHE - Caches Git metadata
- LOCAL_DOCKER_LAYER_CACHE - Caches Docker layers
- LOCAL_CUSTOM_CACHE - Caches directories specified in buildspec

Cache Configuration in buildspec.yml

cache:
 paths:
 - '/root/.m2/**/*'
 - '/root/.npm/**/*'
 - 'node_modules/**/*'

Best Practices

Use local cache for Docker builds
Use S3 cache for large dependencies
Combine both for optimal performance
Clear cache if builds behave unexpectedly

7. Security & IAM

Service Role

IAM role that CodeBuild assumes during build
Grants permissions to access AWS resources
Required permissions:
- CloudWatch Logs (create log groups/streams)
- S3 (read source, write artifacts)
- ECR (pull/push images)
- SSM/Secrets Manager (retrieve secrets)
- VPC (if VPC-enabled)

Minimal Service Role Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "logs:CreateLogGroup",
 "logs:CreateLogStream",
 "logs:PutLogEvents"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:PutObject"
 ],
 "Resource": [
 "arn:aws:s3:::my-source-bucket/*",
 "arn:aws:s3:::my-artifact-bucket/*"
 ]
 }
 ]
}

Encryption

Artifacts - Encrypted with S3-managed keys or KMS
Environment Variables - Encrypted at rest
Secrets - Use Parameter Store or Secrets Manager
Cache - Encrypted with S3 encryption

Best Practices

Use least privilege IAM roles
Store secrets in Parameter Store/Secrets Manager
Enable artifact encryption with KMS
Use VPC endpoints for private access
Rotate credentials regularly
Never hardcode credentials in buildspec

8. Integration with Other AWS Services

CodePipeline

CodeBuild as build/test stage
Automatic triggering on source changes
Pass artifacts between stages
Use pipeline variables in buildspec

CloudWatch

Logs - Build logs stored in CloudWatch Logs
Events - Trigger on build state changes
Metrics - Build duration, success/failure rates
Alarms - Alert on build failures

SNS/EventBridge

Send notifications on build events
Trigger Lambda functions
Integrate with third-party tools

ECR

Pull base images for builds
Push built Docker images
Scan images for vulnerabilities

S3

Source code location
Artifact storage
Cache storage
Build logs (alternative to CloudWatch)

Systems Manager Parameter Store

Store configuration values
Store secrets (encrypted)
Reference in buildspec.yml

Secrets Manager

Store database credentials
Store API keys
Automatic rotation support

9. Monitoring & Troubleshooting

CloudWatch Logs

Default logging destination
Log group: /aws/codebuild/project-name
Stream per build execution
Retention configurable

CloudWatch Metrics

Builds - Total number of builds
Duration - Build execution time
SucceededBuilds - Successful builds count
FailedBuilds - Failed builds count

Build Status

SUCCEEDED - Build completed successfully
FAILED - Build failed
FAULT - Build encountered an error
STOPPED - Build was stopped
TIMED_OUT - Build exceeded timeout
IN_PROGRESS - Build is running

Common Issues & Solutions

Build Timeout

Default: 60 minutes
Max: 480 minutes (8 hours)
Increase timeout in project settings

Insufficient Permissions

Check service role permissions
Verify S3 bucket policies
Check KMS key policies

VPC Connectivity Issues

Verify security group rules
Check subnet routing
Ensure NAT/VPC endpoints configured

Docker Build Failures

Enable privileged mode
Check Docker image availability
Verify ECR permissions

Cache Not Working

Verify cache paths in buildspec
Check S3 bucket permissions
Clear cache and rebuild

10. Test Reports

Overview

Visualize test results in CodeBuild console
Support for multiple test frameworks
Track test trends over time

Supported Formats

JUnit XML
NUnit XML
Cucumber JSON
TestNG XML
Visual Studio TRX

Configuration in buildspec.yml

reports:
 junit-reports:
 files:
 - 'target/surefire-reports/*.xml'
 file-format: 'JUNITXML'
 
 coverage-reports:
 files:
 - 'coverage/cobertura-coverage.xml'
 file-format: 'COBERTURAXML'

Benefits

Track test pass/fail rates
Identify flaky tests
Monitor code coverage
Historical trend analysis

11. Advanced Features

Batch Builds

Run multiple builds in parallel
Build matrix (different configurations)
Useful for testing across environments

Build Badges

Embed build status in README
Public visibility of build status
Supports CodeCommit, GitHub, Bitbucket

Webhooks

Trigger builds on Git events
Filter by branch, tag, or file path
Support for pull requests

Environment Variables from CodePipeline

env:
 exported-variables:
 - BUILD_ID
 - BUILD_NUMBER

Secondary Sources

Include multiple source repositories
Combine code from different locations
Useful for monorepo builds

Secondary Artifacts

Produce multiple artifact outputs
Different artifacts for different purposes
Example: binaries + documentation

12. Cost Optimization

Strategies

Use appropriate compute type (don’t over-provision)
Enable caching to reduce build time
Use build timeouts to prevent runaway builds
Clean up old artifacts from S3
Use spot instances for non-critical builds (via custom environments)

Pricing Model

Charged per build minute
Varies by compute type
Free tier: 100 build minutes/month (general1.small)

13. Common Exam Scenarios

Scenario 1: Build needs to access private RDS database

Solution:

AWS CodeCommit

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CodeCommit is a fully managed source control service that hosts secure Git-based repositories. It eliminates the need to operate your own source control system or worry about scaling its infrastructure.

Key Characteristics

Fully managed Git - Standard Git functionality
Secure - Encrypted at rest and in transit
Scalable - No repository size limits
Highly available - Redundant storage across multiple facilities
Integrated - Works with existing Git tools and AWS services
No servers - No infrastructure to manage

What Problem Does It Solve?

Eliminates need for self-hosted Git servers
Provides secure, compliant source control
Integrates natively with AWS CI/CD services
Scales automatically without capacity planning

2. Core Concepts

Repositories

Git repositories hosted in AWS
Support all standard Git operations (clone, push, pull, branch, merge)
No size limits on repositories
Encrypted by default

Branches

Standard Git branching model
Default branch (usually main or master)
Feature branches, release branches, hotfix branches
Branch permissions via IAM

Commits

Standard Git commits
Immutable once pushed
Tracked with commit ID (SHA-1 hash)

Pull Requests

Code review mechanism
Approval rules can be enforced
Integration with approval rule templates
Comments and discussions
Merge strategies: Fast-forward, Squash, Three-way

Triggers

Automated actions on repository events
Can invoke SNS topics or Lambda functions
Events: Push to branch, create/delete branch, create/delete tag

Notifications

EventBridge integration for repository events
SNS notifications for pull request events
CloudWatch Events (legacy, use EventBridge)

3. Authentication & Access Control

Authentication Methods

HTTPS (Git Credentials)

Generate Git credentials in IAM console
Username and password for Git operations
Recommended for most users
Credentials are IAM user-specific

HTTPS (AWS CLI Credential Helper)

Uses AWS CLI credentials
No separate Git credentials needed
Automatically refreshes credentials
Configure in .gitconfig:

git config --global credential.helper '!aws codecommit credential-helper $@'
git config --global credential.UseHttpPath true

SSH

Upload SSH public key to IAM user
Use SSH key for authentication
SSH Key ID required in SSH config
Configure in ~/.ssh/config:

Host git-codecommit.*.amazonaws.com
 User APKAEIBAERJR2EXAMPLE
 IdentityFile ~/.ssh/codecommit_rsa

Federated Access (SAML/OIDC)

Use temporary credentials from federation
Requires credential helper
Good for enterprise environments

IAM Permissions

Repository-Level Permissions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "codecommit:GitPull",
 "codecommit:GitPush"
 ],
 "Resource": "arn:aws:codecommit:us-east-1:123456789012:MyRepo"
 }
 ]
}

Common Actions

codecommit:GitPull - Clone, fetch, pull
codecommit:GitPush - Push commits
codecommit:CreateBranch - Create branches
codecommit:DeleteBranch - Delete branches
codecommit:CreatePullRequest - Create pull requests
codecommit:MergePullRequest - Merge pull requests
codecommit:GetBranch - View branch details
codecommit:ListRepositories - List repositories

Branch-Level Permissions

Restrict push/merge to specific branches
Protect main/production branches
Example: Deny direct push to main

{
 "Effect": "Deny",
 "Action": [
 "codecommit:GitPush",
 "codecommit:DeleteBranch",
 "codecommit:PutFile",
 "codecommit:MergeBranchesByFastForward"
 ],
 "Resource": "arn:aws:codecommit:us-east-1:123456789012:MyRepo",
 "Condition": {
 "StringEqualsIfExists": {
 "codecommit:References": [
 "refs/heads/main"
 ]
 }
 }
}

4. Security

Encryption

At Rest

Encrypted using AWS KMS
Automatic encryption
Can use AWS managed key or customer managed key
Applies to all repository data

In Transit

All data encrypted via HTTPS or SSH
TLS 1.2 or higher
Git protocol over HTTPS/SSH

Cross-Account Access

Use IAM roles for cross-account access
Resource-based policies not supported
Assume role from another account
Example:

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:root"
 },
 "Action": "sts:AssumeRole"
 }
 ]
}

Compliance

HIPAA eligible
PCI DSS compliant
SOC compliant
ISO compliant
FedRAMP authorized

5. Pull Requests & Approval Rules

Pull Request Workflow

Create feature branch
Make changes and commit
Create pull request
Code review and comments
Approval (if rules configured)
Merge to target branch

Approval Rules

Require approvals before merge
Define number of approvals needed
Specify approval pool (IAM users/roles)
Can use approval rule templates

Approval Rule Template

{
 "Version": "2018-11-08",
 "DestinationReferences": ["refs/heads/main"],
 "Statements": [
 {
 "Type": "Approvers",
 "NumberOfApprovalsNeeded": 2,
 "ApprovalPoolMembers": [
 "arn:aws:sts::123456789012:assumed-role/CodeReviewRole/*"
 ]
 }
 ]
}

Merge Strategies

Fast-forward - Linear history, no merge commit
Squash - Combine all commits into one
Three-way merge - Creates merge commit

6. Triggers & Notifications

Triggers

Execute actions on repository events
Target: SNS topic or Lambda function
Events:
- All repository events
- Push to existing branch
- Create branch or tag
- Delete branch or tag

Trigger Configuration

{
 "repositoryName": "MyRepo",
 "trigger": {
 "name": "MyTrigger",
 "destinationArn": "arn:aws:sns:us-east-1:123456789012:MyTopic",
 "events": ["all"],
 "branches": ["main", "develop"]
 }
}

EventBridge Integration

More flexible than triggers
Filter events with patterns
Multiple targets per rule
Events:
- Pull request state change
- Comment on pull request
- Comment on commit
- Branch/tag reference created/deleted
- Repository state change

EventBridge Pattern Example

{
 "source": ["aws.codecommit"],
 "detail-type": ["CodeCommit Pull Request State Change"],
 "detail": {
 "event": ["pullRequestCreated"],
 "repositoryNames": ["MyRepo"]
 }
}

7. Integration with CI/CD

CodePipeline Integration

CodeCommit as source stage
Automatic pipeline trigger on commit
Branch filtering
Detect changes via CloudWatch Events

CodeBuild Integration

Build source code from CodeCommit
Webhook triggers on push
Pull request builds
Branch-specific builds

Third-Party Integration

Jenkins via AWS CodeCommit plugin
GitHub Actions via OIDC
GitLab CI via mirroring
Any Git-compatible tool

8. Migration & Mirroring

Migrate from Other Git Providers

From GitHub

git clone --mirror https://github.com/user/repo.git
cd repo.git
git push https://git-codecommit.us-east-1.amazonaws.com/v1/repos/MyRepo --all
git push https://git-codecommit.us-east-1.amazonaws.com/v1/repos/MyRepo --tags

From Bitbucket/GitLab

Same process as GitHub
Use git clone --mirror and git push --mirror

Repository Mirroring

Keep CodeCommit in sync with external Git
Use scheduled Lambda or CodeBuild
Bidirectional or unidirectional sync

9. Monitoring & Logging

CloudWatch Metrics

No built-in metrics for CodeCommit
Create custom metrics via EventBridge + Lambda

CloudWatch Logs

No direct logging to CloudWatch
Use triggers/EventBridge to log events

AWS CloudTrail

Logs all API calls to CodeCommit
Tracks:
- Repository creation/deletion
- Branch creation/deletion
- IAM permission changes
- Pull request actions
Does NOT log Git operations (push, pull, clone)

CloudTrail Event Example

{
 "eventName": "CreateRepository",
 "eventSource": "codecommit.amazonaws.com",
 "requestParameters": {
 "repositoryName": "MyRepo"
 },
 "responseElements": {
 "repositoryMetadata": {
 "repositoryId": "12345678-1234-1234-1234-123456789012"
 }
 }
}

10. Best Practices

Security

Use IAM roles instead of IAM users where possible
Enable MFA for sensitive repositories
Use branch protection for main/production branches
Implement approval rules for critical branches
Rotate Git credentials regularly
Use credential helper instead of storing passwords
Enable CloudTrail logging

Repository Management

Use meaningful branch names
Implement branching strategy (GitFlow, trunk-based)
Keep repositories focused (single purpose)
Use tags for releases
Regular cleanup of stale branches
Document repository structure in README

Code Review

Require pull requests for all changes to main
Use approval rules with minimum reviewers
Use approval rule templates for consistency
Comment on code during review
Link pull requests to issue tracking

CI/CD Integration

Trigger builds on every commit
Use branch-specific pipelines
Implement automated testing
Use CodePipeline for full automation
Tag releases for deployment tracking

Performance

Use shallow clones for large repositories
Use Git LFS for large binary files
Keep repository size manageable
Archive old repositories

11. Common Exam Scenarios

Scenario 1: Developer cannot push to repository

Possible Causes:

AWS CodeDeploy

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CodeDeploy is a fully managed deployment service that automates software deployments to various compute services including EC2, Fargate, Lambda, and on-premises servers.

Key Characteristics

Fully managed - No deployment infrastructure to maintain
Automated - Handles deployment complexity and rollback
Flexible - Multiple deployment strategies (in-place, blue/green)
Platform agnostic - Works with any application
Integrated - Works with CodePipeline, GitHub, S3
Scalable - Deploy to one or thousands of instances

What Problem Does It Solve?

Eliminates manual deployment errors
Provides consistent deployment process
Enables automated rollback on failure
Supports zero-downtime deployments
Tracks deployment history and status
Enables gradual rollouts with traffic shifting

2. Core Concepts

Application

Logical container for deployment components
Unique name within AWS account and region
Contains deployment groups and revisions
Compute platform: EC2/On-Premises, Lambda, or ECS

Deployment Group

Set of instances or targets for deployment
Defines deployment configuration
Specifies deployment type (in-place or blue/green)
Contains tags, Auto Scaling groups, or ECS services
One application can have multiple deployment groups

Deployment Configuration

Rules for deployment execution
Defines success/failure criteria
Controls deployment speed
Predefined or custom configurations

Revision

Deployable content (application files + AppSpec file)
Stored in S3 or GitHub
Uniquely identified by location
Contains AppSpec file defining deployment actions

AppSpec File

Application specification file
Defines deployment actions and lifecycle hooks
Format: YAML or JSON
Different structure for EC2, Lambda, and ECS
Must be named appspec.yml or appspec.yaml

Deployment

Process of installing revision to deployment group
Tracked with deployment ID
Has status: Created, Queued, InProgress, Succeeded, Failed, Stopped
Can be rolled back automatically or manually

CodeDeploy Agent

Software installed on EC2/on-premises instances
Communicates with CodeDeploy service
Downloads and installs revisions
Reports deployment status
Required for EC2/On-Premises deployments

3. Compute Platforms

EC2/On-Premises

Deploy to EC2 instances or on-premises servers
Requires CodeDeploy agent
Supports in-place and blue/green deployments
Uses tags or Auto Scaling groups to identify instances

AWS Lambda

Deploy Lambda function versions
Shift traffic between versions
Supports canary, linear, and all-at-once deployments
No agent required
Integrates with Lambda aliases

Amazon ECS

Deploy ECS services (Fargate or EC2)
Blue/green deployments only
Traffic shifting via Application Load Balancer
No agent required
Updates task definitions

4. Deployment Types

In-Place Deployment (Rolling Update)

Characteristics

Application stopped on each instance
Latest revision installed
Instance briefly out of service
Same instances reused
Capacity reduced during deployment

Use Cases

Cost-sensitive deployments
Simple applications
Non-critical environments
When blue/green not feasible

Supported Platforms

EC2/On-Premises only
NOT supported for Lambda or ECS

Process

Stop application on instance
Install new revision
Start application
Validate deployment
Move to next instance(s)

Blue/Green Deployment

Characteristics

New instances (green) provisioned
Traffic shifted from old (blue) to new (green)
Old instances kept for rollback
Zero downtime
Full capacity maintained

Use Cases

Production deployments
Zero-downtime requirements
Easy rollback needed
Critical applications

Supported Platforms

EC2/On-Premises
Lambda
ECS

Process

Provision new instances/environment
Deploy application to new environment
Test new environment
Shift traffic to new environment
Keep old environment for rollback
Terminate old environment (optional)

5. Deployment Configurations

Predefined Configurations

EC2/On-Premises

CodeDeployDefault.OneAtATime - Deploy to one instance at a time
CodeDeployDefault.HalfAtATime - Deploy to half of instances at once
CodeDeployDefault.AllAtOnce - Deploy to all instances simultaneously

Lambda

CodeDeployDefault.LambdaCanary10Percent5Minutes - 10% traffic for 5 min, then 100%
CodeDeployDefault.LambdaCanary10Percent10Minutes - 10% traffic for 10 min, then 100%
CodeDeployDefault.LambdaCanary10Percent15Minutes - 10% traffic for 15 min, then 100%
CodeDeployDefault.LambdaCanary10Percent30Minutes - 10% traffic for 30 min, then 100%
CodeDeployDefault.LambdaLinear10PercentEvery1Minute - Add 10% every 1 min
CodeDeployDefault.LambdaLinear10PercentEvery2Minutes - Add 10% every 2 min
CodeDeployDefault.LambdaLinear10PercentEvery3Minutes - Add 10% every 3 min
CodeDeployDefault.LambdaLinear10PercentEvery10Minutes - Add 10% every 10 min
CodeDeployDefault.LambdaAllAtOnce - Immediate 100% traffic shift

ECS

CodeDeployDefault.ECSCanary10Percent5Minutes - 10% traffic for 5 min, then 100%
CodeDeployDefault.ECSCanary10Percent15Minutes - 10% traffic for 15 min, then 100%
CodeDeployDefault.ECSLinear10PercentEvery1Minute - Add 10% every 1 min
CodeDeployDefault.ECSLinear10PercentEvery3Minutes - Add 10% every 3 min
CodeDeployDefault.ECSAllAtOnce - Immediate 100% traffic shift

Custom Configurations

Define minimum healthy instances/hosts
Specify as percentage or count
Example: 75% minimum healthy = deploy to 25% at a time

6. AppSpec File Structure

EC2/On-Premises AppSpec

version: 0.0
os: linux
files:
 - source: /
 destination: /var/www/html
 - source: /config/
 destination: /etc/myapp

permissions:
 - object: /var/www/html
 owner: apache
 group: apache
 mode: 755
 type:
 - directory
 - object: /var/www/html/*
 owner: apache
 group: apache
 mode: 644
 type:
 - file

hooks:
 ApplicationStop:
 - location: scripts/stop_server.sh
 timeout: 300
 runas: root
 
 BeforeInstall:
 - location: scripts/install_dependencies.sh
 timeout: 300
 runas: root
 
 AfterInstall:
 - location: scripts/configure_app.sh
 timeout: 300
 runas: root
 
 ApplicationStart:
 - location: scripts/start_server.sh
 timeout: 300
 runas: root
 
 ValidateService:
 - location: scripts/validate_service.sh
 timeout: 300
 runas: root

Lambda AppSpec

version: 0.0
Resources:
 - MyFunction:
 Type: AWS::Lambda::Function
 Properties:
 Name: myLambdaFunction
 Alias: live
 CurrentVersion: 1
 TargetVersion: 2

Hooks:
 - BeforeAllowTraffic: BeforeAllowTrafficHookFunctionName
 - AfterAllowTraffic: AfterAllowTrafficHookFunctionName

ECS AppSpec

version: 0.0
Resources:
 - TargetService:
 Type: AWS::ECS::Service
 Properties:
 TaskDefinition: "arn:aws:ecs:us-east-1:123456789012:task-definition/my-task:2"
 LoadBalancerInfo:
 ContainerName: "my-container"
 ContainerPort: 80
 PlatformVersion: "LATEST"

Hooks:
 - BeforeInstall: "BeforeInstallHookFunctionName"
 - AfterInstall: "AfterInstallHookFunctionName"
 - AfterAllowTestTraffic: "AfterAllowTestTrafficHookFunctionName"
 - BeforeAllowTraffic: "BeforeAllowTrafficHookFunctionName"
 - AfterAllowTraffic: "AfterAllowTrafficHookFunctionName"

7. Lifecycle Event Hooks

EC2/On-Premises Lifecycle Events (In Order)

ApplicationStop - Stop current application version
DownloadBundle - Download revision (automatic, no script)
BeforeInstall - Pre-installation tasks (backup, decrypt)
Install - Copy files to destination (automatic, no script)
AfterInstall - Post-installation tasks (configuration, permissions)
ApplicationStart - Start application
ValidateService - Verify deployment success

Lambda Lifecycle Events

BeforeAllowTraffic - Run tasks before traffic shift (tests, validation)
AllowTraffic - Traffic shift (automatic)
AfterAllowTraffic - Run tasks after traffic shift (monitoring, validation)

ECS Lifecycle Events

BeforeInstall - Before replacement task set created
Install - Create replacement task set (automatic)
AfterInstall - After replacement task set created
AfterAllowTestTraffic - After test traffic routed
BeforeAllowTraffic - Before production traffic shift
AllowTraffic - Production traffic shift (automatic)
AfterAllowTraffic - After production traffic shift

8. IAM Roles & Permissions

Service Role (CodeDeploy Service Role)

Role assumed by CodeDeploy service
Grants permissions to interact with other AWS services
Required for all deployments

Required Permissions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "ec2:DescribeInstances",
 "ec2:DescribeInstanceStatus",
 "ec2:TerminateInstances",
 "tag:GetResources",
 "autoscaling:CompleteLifecycleAction",
 "autoscaling:DeleteLifecycleHook",
 "autoscaling:DescribeAutoScalingGroups",
 "autoscaling:DescribeLifecycleHooks",
 "autoscaling:PutLifecycleHook",
 "autoscaling:RecordLifecycleActionHeartbeat"
 ],
 "Resource": "*"
 }
 ]
}

For Lambda Deployments

{
 "Effect": "Allow",
 "Action": [
 "lambda:InvokeFunction",
 "lambda:GetFunction",
 "lambda:UpdateAlias"
 ],
 "Resource": "*"
}

For ECS Deployments

{
 "Effect": "Allow",
 "Action": [
 "ecs:DescribeServices",
 "ecs:CreateTaskSet",
 "ecs:UpdateServicePrimaryTaskSet",
 "ecs:DeleteTaskSet",
 "elasticloadbalancing:DescribeTargetGroups",
 "elasticloadbalancing:DescribeListeners",
 "elasticloadbalancing:ModifyListener",
 "elasticloadbalancing:DescribeRules",
 "elasticloadbalancing:ModifyRule"
 ],
 "Resource": "*"
}

Instance Role (EC2 Instance Profile)

Role attached to EC2 instances
Allows CodeDeploy agent to access S3 and other services

Required Permissions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:ListBucket"
 ],
 "Resource": [
 "arn:aws:s3:::my-deployment-bucket/*",
 "arn:aws:s3:::aws-codedeploy-us-east-1/*"
 ]
 }
 ]
}

9. Auto Scaling Integration

Deployment to Auto Scaling Groups

CodeDeploy integrates with Auto Scaling
Automatically deploys to new instances
Handles scaling events during deployment

Deployment Options

Suspend Auto Scaling

Suspend scaling during deployment
Prevents new instances during deployment
Resume after deployment completes

Keep Auto Scaling Active

Allow scaling during deployment
New instances automatically get latest revision
CodeDeploy handles deployment to new instances

Blue/Green with Auto Scaling

Create new Auto Scaling group (green)
Deploy to new group
Shift traffic via load balancer
Terminate old group (blue)

10. Load Balancer Integration

Supported Load Balancers

Application Load Balancer (ALB)
Network Load Balancer (NLB)
Classic Load Balancer (CLB)

Blue/Green Deployment Process

Register new instances with load balancer
Deploy application to new instances
Run validation tests
Shift traffic from old to new instances
Deregister old instances
Terminate old instances (optional)

Connection Draining

Allows in-flight requests to complete
Configurable timeout period
Prevents abrupt connection termination

11. Rollback Mechanisms

Automatic Rollback

Triggered by deployment failure
Triggered by CloudWatch alarms
Redeploys last known good revision
Configure in deployment group settings

Automatic Rollback Triggers

Deployment fails - Any instance fails deployment
Alarm thresholds met - CloudWatch alarm triggered
Both - Either condition triggers rollback

Manual Rollback

Stop current deployment
Create new deployment with previous revision
Use “Redeploy” option in console

Rollback for Blue/Green

Keep blue environment for quick rollback
Shift traffic back to blue environment
No redeployment needed

12. Monitoring & Logging

CloudWatch Integration

Deployment events sent to CloudWatch Events/EventBridge
Create alarms for automatic rollback
Monitor deployment metrics

CloudWatch Metrics

No built-in metrics for CodeDeploy
Create custom metrics via EventBridge + Lambda

CloudWatch Alarms for Rollback

{
 "AlarmName": "HighErrorRate",
 "MetricName": "5XXError",
 "Namespace": "AWS/ApplicationELB",
 "Statistic": "Sum",
 "Period": 60,
 "EvaluationPeriods": 2,
 "Threshold": 10,
 "ComparisonOperator": "GreaterThanThreshold"
}

CloudWatch Logs

Deployment logs from lifecycle hooks
Agent logs on EC2 instances
Location: /var/log/aws/codedeploy-agent/

AWS CloudTrail

Logs all API calls to CodeDeploy
Tracks deployment creation, updates, deletions
Audit trail for compliance

EventBridge Events

Deployment state changes
Instance state changes
Deployment group changes
Trigger Lambda, SNS, or other targets

13. On-Premises Deployments

Requirements

CodeDeploy agent installed
Instance registered with CodeDeploy
IAM user credentials configured
Network connectivity to AWS

Instance Registration

aws deploy register-on-premises-instance \
 --instance-name my-server \
 --iam-user-arn arn:aws:iam::123456789012:user/CodeDeployUser

Agent Installation

# Download agent
wget https://aws-codedeploy-us-east-1.s3.amazonaws.com/latest/install

# Install agent
chmod +x ./install
sudo ./install auto

# Configure credentials
sudo aws configure --profile codedeploy

Tagging On-Premises Instances

aws deploy add-tags-to-on-premises-instances \
 --instance-names my-server \
 --tags Key=Environment,Value=Production

14. Security Best Practices

IAM

Use least privilege for service roles
Separate roles for different environments
Use instance profiles for EC2 instances
Rotate IAM credentials regularly

Encryption

Encrypt revisions in S3 with KMS
Use HTTPS for agent communication
Encrypt sensitive data in AppSpec hooks

Network Security

Use VPC endpoints for private deployments
Restrict security group rules
Use private subnets with NAT for outbound

Compliance

Enable CloudTrail logging
Use AWS Config for compliance monitoring
Tag resources for governance
Implement approval workflows

15. Common Exam Scenarios

Scenario 1: Deployment fails on some instances

Possible Causes:

AWS CodePipeline

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CodePipeline is a fully managed continuous delivery service that automates the build, test, and deploy phases of your release process every time there is a code change.

Key Characteristics

Fully managed - No servers to provision or manage
Automated - Orchestrates entire release process
Flexible - Integrates with AWS and third-party tools
Fast - Rapid delivery with parallel execution
Configurable - Custom actions and approval gates
Visual - Pipeline visualization in console

What Problem Does It Solve?

Eliminates manual release processes
Provides consistent deployment workflow
Enables rapid and reliable releases
Integrates multiple tools into single workflow
Tracks release history and status
Enables continuous delivery practices

2. Core Concepts

Pipeline

Workflow that describes release process
Contains stages executed in sequence
Defined in JSON or created via console
Has unique name within region
Can be started manually or automatically

Stage

Logical grouping of actions
Executed sequentially in pipeline
Contains one or more actions
Examples: Source, Build, Test, Deploy, Approval

Action

Task performed on artifacts
Executed within a stage
Can run in parallel within stage
Types: Source, Build, Test, Deploy, Approval, Invoke
Has input/output artifacts

Artifact

Files worked on by actions
Stored in S3 artifact store
Passed between actions
Versioned automatically
Encrypted by default

Transition

Connection between stages
Can be enabled or disabled
Useful for testing or maintenance
Prevents automatic progression

Execution

Single run through pipeline
Has unique execution ID
Tracks status of each action
Can be stopped or retried

3. Pipeline Structure

Basic Pipeline Structure

{
 "pipeline": {
 "name": "MyPipeline",
 "roleArn": "arn:aws:iam::123456789012:role/CodePipelineServiceRole",
 "artifactStore": {
 "type": "S3",
 "location": "my-pipeline-artifacts"
 },
 "stages": [
 {
 "name": "Source",
 "actions": [
 {
 "name": "SourceAction",
 "actionTypeId": {
 "category": "Source",
 "owner": "AWS",
 "provider": "CodeCommit",
 "version": "1"
 },
 "configuration": {
 "RepositoryName": "MyRepo",
 "BranchName": "main"
 },
 "outputArtifacts": [
 {"name": "SourceOutput"}
 ]
 }
 ]
 },
 {
 "name": "Build",
 "actions": [
 {
 "name": "BuildAction",
 "actionTypeId": {
 "category": "Build",
 "owner": "AWS",
 "provider": "CodeBuild",
 "version": "1"
 },
 "configuration": {
 "ProjectName": "MyBuildProject"
 },
 "inputArtifacts": [
 {"name": "SourceOutput"}
 ],
 "outputArtifacts": [
 {"name": "BuildOutput"}
 ]
 }
 ]
 },
 {
 "name": "Deploy",
 "actions": [
 {
 "name": "DeployAction",
 "actionTypeId": {
 "category": "Deploy",
 "owner": "AWS",
 "provider": "CodeDeploy",
 "version": "1"
 },
 "configuration": {
 "ApplicationName": "MyApp",
 "DeploymentGroupName": "Production"
 },
 "inputArtifacts": [
 {"name": "BuildOutput"}
 ]
 }
 ]
 }
 ]
 }
}

4. Action Types

Source Actions

CodeCommit - AWS Git repository
S3 - S3 bucket as source
GitHub - GitHub repository (v1 and v2)
Bitbucket - Bitbucket repository
ECR - Container image source
GitHub Enterprise - Self-hosted GitHub

Build Actions

CodeBuild - AWS build service
Jenkins - Jenkins build server
CloudBees - CloudBees CI/CD
TeamCity - JetBrains TeamCity

Test Actions

CodeBuild - Run tests in CodeBuild
AWS Device Farm - Mobile app testing
Jenkins - Jenkins test execution
Third-party - Custom test providers

Deploy Actions

CodeDeploy - Deploy to EC2, Lambda, ECS
CloudFormation - Infrastructure deployment
ECS - Direct ECS deployment
Elastic Beanstalk - Beanstalk deployment
S3 - Deploy to S3 bucket
Service Catalog - Service Catalog products

Approval Actions

Manual Approval - Human approval gate
SNS notification - Alert approvers
Custom URL - Link to external review

Invoke Actions

Lambda - Invoke Lambda function
Step Functions - Start Step Functions execution

5. Source Providers

CodeCommit

Native AWS integration
Automatic trigger on commit
Branch and tag filtering
CloudWatch Events for triggering

GitHub (Version 2)

Recommended GitHub integration
Uses GitHub App connection
Webhook-based triggering
Supports GitHub Enterprise Cloud

GitHub (Version 1)

Legacy OAuth token integration
Being deprecated
Migrate to Version 2

S3

Trigger on object upload
Versioning required
CloudWatch Events or polling
Useful for pre-built artifacts

ECR

Container image as source
Trigger on image push
Tag-based filtering
Useful for container deployments

Bitbucket

Bitbucket Cloud integration
Webhook-based triggering
OAuth connection

6. Artifact Management

Artifact Store

S3 bucket for storing artifacts
One per region
Encrypted with KMS
Versioned automatically

Artifact Types

Input artifacts - Consumed by action
Output artifacts - Produced by action
Can have multiple per action

Artifact Naming

Unique names within pipeline
Referenced by name in actions
Example: SourceOutput, BuildOutput

Cross-Region Artifacts

Replicate artifacts to multiple regions
Required for cross-region deployments
Separate artifact store per region

Artifact Encryption

Default: AWS managed KMS key
Custom: Customer managed KMS key
Encrypted at rest in S3

7. Variables

Pipeline Variables

Available throughout pipeline execution
System-generated or custom
Referenced with #{variable} syntax

System Variables

#{codepipeline.PipelineExecutionId} - Unique execution ID
#{codepipeline.PipelineName} - Pipeline name
#{codepipeline.PipelineVersion} - Pipeline version

Action Variables

Output from actions
Namespace format: #{Namespace.Variable}
Example: #{SourceVariables.CommitId}

Common Source Variables

CodeCommit: CommitId, CommitMessage, AuthorDate, BranchName
GitHub: CommitId, CommitMessage, CommitUrl, BranchName
S3: ETag, VersionId

Using Variables

{
 "name": "BuildAction",
 "configuration": {
 "ProjectName": "MyProject",
 "EnvironmentVariables": "[{\"name\":\"COMMIT_ID\",\"value\":\"#{SourceVariables.CommitId}\",\"type\":\"PLAINTEXT\"}]"
 },
 "namespace": "BuildVariables"
}

8. Manual Approval Actions

Configuration

{
 "name": "ManualApproval",
 "actionTypeId": {
 "category": "Approval",
 "owner": "AWS",
 "provider": "Manual",
 "version": "1"
 },
 "configuration": {
 "NotificationArn": "arn:aws:sns:us-east-1:123456789012:ApprovalTopic",
 "CustomData": "Please review and approve deployment to production",
 "ExternalEntityLink": "https://example.com/review"
 }
}

Approval Process

Pipeline reaches approval action
SNS notification sent (if configured)
Approver reviews via console or API
Approver approves or rejects
Pipeline continues or stops

IAM Permissions for Approval

{
 "Effect": "Allow",
 "Action": [
 "codepipeline:GetPipelineState",
 "codepipeline:PutApprovalResult"
 ],
 "Resource": "arn:aws:codepipeline:us-east-1:123456789012:MyPipeline/Production/ManualApproval"
}

9. Parallel Actions

Configuration

Multiple actions in same stage
Execute simultaneously
Improve pipeline speed
Share input artifacts

Example: Parallel Deployments

{
 "name": "Deploy",
 "actions": [
 {
 "name": "DeployToUSEast",
 "runOrder": 1,
 "actionTypeId": {"category": "Deploy", "provider": "CodeDeploy"},
 "configuration": {"ApplicationName": "MyApp-USEast"}
 },
 {
 "name": "DeployToUSWest",
 "runOrder": 1,
 "actionTypeId": {"category": "Deploy", "provider": "CodeDeploy"},
 "configuration": {"ApplicationName": "MyApp-USWest"}
 }
 ]
}

Run Order

Actions with same runOrder execute in parallel
Lower runOrder executes first
Default runOrder is 1

10. Cross-Region Deployments

Requirements

Artifact store in each region
Replication configuration
Service role with cross-region permissions

Configuration

{
 "artifactStores": {
 "us-east-1": {
 "type": "S3",
 "location": "pipeline-artifacts-us-east-1"
 },
 "us-west-2": {
 "type": "S3",
 "location": "pipeline-artifacts-us-west-2"
 }
 }
}

Cross-Region Action

{
 "name": "DeployToWest",
 "region": "us-west-2",
 "actionTypeId": {
 "category": "Deploy",
 "provider": "CodeDeploy"
 },
 "configuration": {
 "ApplicationName": "MyApp"
 }
}

11. IAM Roles & Permissions

Service Role

Role assumed by CodePipeline
Grants permissions to interact with other services
Required for all pipelines

Service Role Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:PutObject",
 "s3:GetBucketLocation",
 "s3:ListBucket"
 ],
 "Resource": [
 "arn:aws:s3:::my-pipeline-artifacts",
 "arn:aws:s3:::my-pipeline-artifacts/*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "codecommit:GetBranch",
 "codecommit:GetCommit",
 "codecommit:UploadArchive",
 "codecommit:GetUploadArchiveStatus"
 ],
 "Resource": "arn:aws:codecommit:us-east-1:123456789012:MyRepo"
 },
 {
 "Effect": "Allow",
 "Action": [
 "codebuild:BatchGetBuilds",
 "codebuild:StartBuild"
 ],
 "Resource": "arn:aws:codebuild:us-east-1:123456789012:project/MyProject"
 },
 {
 "Effect": "Allow",
 "Action": [
 "codedeploy:CreateDeployment",
 "codedeploy:GetApplication",
 "codedeploy:GetApplicationRevision",
 "codedeploy:GetDeployment",
 "codedeploy:GetDeploymentConfig",
 "codedeploy:RegisterApplicationRevision"
 ],
 "Resource": "*"
 }
 ]
}

CloudFormation Permissions

{
 "Effect": "Allow",
 "Action": [
 "cloudformation:CreateStack",
 "cloudformation:DescribeStacks",
 "cloudformation:DeleteStack",
 "cloudformation:UpdateStack",
 "cloudformation:CreateChangeSet",
 "cloudformation:ExecuteChangeSet",
 "cloudformation:DeleteChangeSet",
 "cloudformation:DescribeChangeSet"
 ],
 "Resource": "*"
}

12. Triggers & Event Detection

CloudWatch Events (EventBridge)

Recommended trigger method
Real-time event detection
More reliable than polling
Lower latency

Polling

Legacy trigger method
Periodic checks for changes
Higher latency
Not recommended for new pipelines

Webhook

Used by GitHub, Bitbucket
Push-based triggering
Immediate execution
Requires connection setup

Event Pattern Example

{
 "source": ["aws.codecommit"],
 "detail-type": ["CodeCommit Repository State Change"],
 "detail": {
 "event": ["referenceCreated", "referenceUpdated"],
 "referenceType": ["branch"],
 "referenceName": ["main"]
 }
}

13. CloudFormation Integration

Action Types

Create/Update Stack

{
 "name": "CreateStack",
 "actionTypeId": {
 "category": "Deploy",
 "provider": "CloudFormation",
 "version": "1"
 },
 "configuration": {
 "ActionMode": "CREATE_UPDATE",
 "StackName": "MyStack",
 "TemplatePath": "BuildOutput::template.yaml",
 "Capabilities": "CAPABILITY_IAM",
 "RoleArn": "arn:aws:iam::123456789012:role/CloudFormationRole"
 }
}

Change Set

{
 "name": "CreateChangeSet",
 "configuration": {
 "ActionMode": "CHANGE_SET_REPLACE",
 "StackName": "MyStack",
 "ChangeSetName": "MyChangeSet",
 "TemplatePath": "BuildOutput::template.yaml"
 }
}

Execute Change Set

{
 "name": "ExecuteChangeSet",
 "configuration": {
 "ActionMode": "CHANGE_SET_EXECUTE",
 "StackName": "MyStack",
 "ChangeSetName": "MyChangeSet"
 }
}

Parameter Overrides

{
 "configuration": {
 "ParameterOverrides": "{\"Environment\":\"Production\",\"InstanceType\":\"t3.large\"}"
 }
}

14. Lambda Integration

Invoke Lambda Action

{
 "name": "InvokeLambda",
 "actionTypeId": {
 "category": "Invoke",
 "owner": "AWS",
 "provider": "Lambda",
 "version": "1"
 },
 "configuration": {
 "FunctionName": "MyFunction",
 "UserParameters": "{\"key\":\"value\"}"
 }
}

Lambda Function Requirements

Must complete within 15 minutes
Return success/failure to CodePipeline
Use put_job_success_result or put_job_failure_result

Lambda Function Example

import boto3

codepipeline = boto3.client('codepipeline')

def lambda_handler(event, context):
 job_id = event['CodePipeline.job']['id']
 
 try:
 # Perform custom logic
 result = perform_validation()
 
 if result:
 codepipeline.put_job_success_result(jobId=job_id)
 else:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': 'Validation failed'}
 )
 except Exception as e:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': str(e)}
 )

15. Monitoring & Notifications

CloudWatch Events/EventBridge

Pipeline execution state changes
Stage execution state changes
Action execution state changes
Manual approval needed

Event Pattern

{
 "source": ["aws.codepipeline"],
 "detail-type": ["CodePipeline Pipeline Execution State Change"],
 "detail": {
 "state": ["FAILED"],
 "pipeline": ["MyPipeline"]
 }
}

Manual approval notifications
Custom notifications via EventBridge + SNS
Email, SMS, or other endpoints

CloudWatch Metrics

No built-in metrics
Create custom metrics via EventBridge + Lambda

CloudTrail Logging

All API calls logged
Pipeline creation, updates, deletions
Execution starts, stops
Approval decisions

16. Security Best Practices

IAM

Use least privilege service roles
Separate roles per environment
Use resource-based policies where possible
Rotate credentials regularly

Encryption

Encrypt artifacts with KMS
Use customer managed keys for compliance
Encrypt secrets in Parameter Store/Secrets Manager
Use HTTPS for all connections

Secrets Management

Store secrets in Secrets Manager or Parameter Store
Reference secrets in actions
Never hardcode credentials
Rotate secrets regularly

Network Security

Use VPC endpoints for private access
Restrict S3 bucket access
Use private subnets for build/deploy
Enable VPC Flow Logs

Compliance

Enable CloudTrail logging
Use AWS Config for compliance monitoring
Tag all resources
Implement approval workflows for production

17. Common Exam Scenarios

Scenario 1: Pipeline not triggering on commit

Possible Causes:

AWS CodePipeline Cross-Account Deployments

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CodePipeline Cross-Account Deployments enable you to deploy applications across multiple AWS accounts from a centralized CI/CD pipeline. This pattern is essential for enterprise environments where different accounts represent different environments (dev, staging, production) or organizational boundaries.

Key Characteristics

Centralized CI/CD - Single pipeline manages multi-account deployments
Account isolation - Each environment in separate AWS account
Cross-account IAM - Secure role assumption across accounts
Artifact sharing - S3 buckets accessible across accounts
Governance - Centralized control with distributed execution
Security - Least privilege access with account boundaries
Compliance - Audit trails across organizational structure

What Problem Does It Solve?

Enables enterprise-scale CI/CD across account boundaries
Provides secure deployment to production accounts
Maintains environment isolation while enabling automation
Supports organizational governance and compliance requirements
Enables centralized pipeline management with distributed resources
Facilitates secure artifact sharing across accounts
Supports complex approval workflows across teams

2. Core Concepts

Cross-Account Pipeline Architecture

Central Account - Hosts the CodePipeline and shared resources
Target Accounts - Destination accounts for deployments
Cross-Account Roles - IAM roles for secure access across accounts
Artifact Buckets - S3 buckets accessible from multiple accounts
KMS Keys - Encryption keys shared across accounts

Account Structure Patterns

Environment-based - Dev, Staging, Production accounts
Team-based - Separate accounts per team or business unit
Workload-based - Accounts per application or service
Compliance-based - Accounts based on regulatory requirements

Trust Relationships

Role Assumption - Central account assumes roles in target accounts
Resource Policies - S3 buckets and KMS keys allow cross-account access
External ID - Additional security for role assumption
Condition Keys - Fine-grained access control

3. Cross-Account IAM Setup

Central Account Pipeline Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "codepipeline:*",
 "codebuild:BatchGetBuilds",
 "codebuild:StartBuild",
 "codecommit:GetBranch",
 "codecommit:GetCommit",
 "codecommit:UploadArchive",
 "codecommit:GetUploadArchiveStatus"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:PutObject",
 "s3:GetBucketLocation",
 "s3:ListBucket"
 ],
 "Resource": [
 "arn:aws:s3:::central-pipeline-artifacts",
 "arn:aws:s3:::central-pipeline-artifacts/*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "kms:Decrypt",
 "kms:GenerateDataKey",
 "kms:DescribeKey"
 ],
 "Resource": "arn:aws:kms:us-east-1:111111111111:key/12345678-1234-1234-1234-123456789012"
 },
 {
 "Effect": "Allow",
 "Action": "sts:AssumeRole",
 "Resource": [
 "arn:aws:iam::222222222222:role/CrossAccountDeploymentRole",
 "arn:aws:iam::333333333333:role/CrossAccountDeploymentRole"
 ]
 }
 ]
}

Target Account Deployment Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:CreateStack",
 "cloudformation:UpdateStack",
 "cloudformation:DeleteStack",
 "cloudformation:DescribeStacks",
 "cloudformation:DescribeStackEvents",
 "cloudformation:DescribeStackResources",
 "cloudformation:CreateChangeSet",
 "cloudformation:ExecuteChangeSet",
 "cloudformation:DeleteChangeSet",
 "cloudformation:DescribeChangeSet"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:ListBucket"
 ],
 "Resource": [
 "arn:aws:s3:::central-pipeline-artifacts",
 "arn:aws:s3:::central-pipeline-artifacts/*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "kms:Decrypt",
 "kms:DescribeKey"
 ],
 "Resource": "arn:aws:kms:us-east-1:111111111111:key/12345678-1234-1234-1234-123456789012"
 },
 {
 "Effect": "Allow",
 "Action": "iam:PassRole",
 "Resource": "arn:aws:iam::222222222222:role/CloudFormationExecutionRole"
 }
 ]
}

Trust Policy for Cross-Account Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:role/CodePipelineServiceRole"
 },
 "Action": "sts:AssumeRole",
 "Condition": {
 "StringEquals": {
 "sts:ExternalId": "unique-external-id-12345"
 }
 }
 }
 ]
}

4. S3 Artifact Bucket Configuration

Cross-Account Bucket Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "AllowCentralAccount",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:root"
 },
 "Action": [
 "s3:GetObject",
 "s3:PutObject",
 "s3:ListBucket",
 "s3:GetBucketLocation"
 ],
 "Resource": [
 "arn:aws:s3:::central-pipeline-artifacts",
 "arn:aws:s3:::central-pipeline-artifacts/*"
 ]
 },
 {
 "Sid": "AllowTargetAccounts",
 "Effect": "Allow",
 "Principal": {
 "AWS": [
 "arn:aws:iam::222222222222:role/CrossAccountDeploymentRole",
 "arn:aws:iam::333333333333:role/CrossAccountDeploymentRole"
 ]
 },
 "Action": [
 "s3:GetObject",
 "s3:ListBucket"
 ],
 "Resource": [
 "arn:aws:s3:::central-pipeline-artifacts",
 "arn:aws:s3:::central-pipeline-artifacts/*"
 ]
 },
 {
 "Sid": "DenyInsecureConnections",
 "Effect": "Deny",
 "Principal": "*",
 "Action": "s3:*",
 "Resource": [
 "arn:aws:s3:::central-pipeline-artifacts",
 "arn:aws:s3:::central-pipeline-artifacts/*"
 ],
 "Condition": {
 "Bool": {
 "aws:SecureTransport": "false"
 }
 }
 }
 ]
}

KMS Key Policy for Cross-Account Access

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "EnableCentralAccountAccess",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:root"
 },
 "Action": "kms:*",
 "Resource": "*"
 },
 {
 "Sid": "AllowTargetAccountDecryption",
 "Effect": "Allow",
 "Principal": {
 "AWS": [
 "arn:aws:iam::222222222222:role/CrossAccountDeploymentRole",
 "arn:aws:iam::333333333333:role/CrossAccountDeploymentRole"
 ]
 },
 "Action": [
 "kms:Decrypt",
 "kms:DescribeKey"
 ],
 "Resource": "*"
 },
 {
 "Sid": "AllowCodePipelineAccess",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:role/CodePipelineServiceRole"
 },
 "Action": [
 "kms:Decrypt",
 "kms:GenerateDataKey",
 "kms:DescribeKey"
 ],
 "Resource": "*"
 }
 ]
}

5. Cross-Account Pipeline Configuration

Complete Pipeline Example

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Cross-account CodePipeline'

Parameters:
 DevAccountId:
 Type: String
 Default: '222222222222'
 
 ProdAccountId:
 Type: String
 Default: '333333333333'

Resources:
 ArtifactBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: central-pipeline-artifacts
 VersioningConfiguration:
 Status: Enabled
 BucketEncryption:
 ServerSideEncryptionConfiguration:
 - ServerSideEncryptionByDefault:
 SSEAlgorithm: aws:kms
 KMSMasterKeyID: !Ref ArtifactKMSKey
 PublicAccessBlockConfiguration:
 BlockPublicAcls: true
 BlockPublicPolicy: true
 IgnorePublicAcls: true
 RestrictPublicBuckets: true

 ArtifactKMSKey:
 Type: AWS::KMS::Key
 Properties:
 Description: 'KMS Key for cross-account pipeline artifacts'
 KeyPolicy:
 Version: '2012-10-17'
 Statement:
 - Sid: EnableCentralAccountAccess
 Effect: Allow
 Principal:
 AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
 Action: 'kms:*'
 Resource: '*'
 - Sid: AllowTargetAccountDecryption
 Effect: Allow
 Principal:
 AWS:
 - !Sub 'arn:aws:iam::${DevAccountId}:role/CrossAccountDeploymentRole'
 - !Sub 'arn:aws:iam::${ProdAccountId}:role/CrossAccountDeploymentRole'
 Action:
 - kms:Decrypt
 - kms:DescribeKey
 Resource: '*'

 CodePipelineServiceRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: codepipeline.amazonaws.com
 Action: sts:AssumeRole
 Policies:
 - PolicyName: PipelineExecutionPolicy
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - s3:GetObject
 - s3:PutObject
 - s3:ListBucket
 Resource:
 - !Sub '${ArtifactBucket}/*'
 - !Ref ArtifactBucket
 - Effect: Allow
 Action:
 - kms:Decrypt
 - kms:GenerateDataKey
 - kms:DescribeKey
 Resource: !GetAtt ArtifactKMSKey.Arn
 - Effect: Allow
 Action: sts:AssumeRole
 Resource:
 - !Sub 'arn:aws:iam::${DevAccountId}:role/CrossAccountDeploymentRole'
 - !Sub 'arn:aws:iam::${ProdAccountId}:role/CrossAccountDeploymentRole'
 - Effect: Allow
 Action:
 - codecommit:GetBranch
 - codecommit:GetCommit
 - codecommit:UploadArchive
 - codecommit:GetUploadArchiveStatus
 - codebuild:BatchGetBuilds
 - codebuild:StartBuild
 Resource: '*'

 CrossAccountPipeline:
 Type: AWS::CodePipeline::Pipeline
 Properties:
 Name: CrossAccountDeploymentPipeline
 RoleArn: !GetAtt CodePipelineServiceRole.Arn
 ArtifactStore:
 Type: S3
 Location: !Ref ArtifactBucket
 EncryptionKey:
 Id: !GetAtt ArtifactKMSKey.Arn
 Type: KMS
 Stages:
 - Name: Source
 Actions:
 - Name: SourceAction
 ActionTypeId:
 Category: Source
 Owner: AWS
 Provider: CodeCommit
 Version: 1
 Configuration:
 RepositoryName: MyApplication
 BranchName: main
 OutputArtifacts:
 - Name: SourceOutput

 - Name: Build
 Actions:
 - Name: BuildAction
 ActionTypeId:
 Category: Build
 Owner: AWS
 Provider: CodeBuild
 Version: 1
 Configuration:
 ProjectName: MyApplicationBuild
 InputArtifacts:
 - Name: SourceOutput
 OutputArtifacts:
 - Name: BuildOutput

 - Name: DeployToDev
 Actions:
 - Name: CreateChangeSetDev
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_REPLACE
 StackName: MyApp-Dev
 ChangeSetName: MyApp-Dev-ChangeSet
 TemplatePath: BuildOutput::packaged-template.yaml
 Capabilities: CAPABILITY_IAM
 RoleArn: !Sub 'arn:aws:iam::${DevAccountId}:role/CloudFormationExecutionRole'
 ParameterOverrides: |
 {
 "Environment": "Development"
 }
 InputArtifacts:
 - Name: BuildOutput
 RoleArn: !Sub 'arn:aws:iam::${DevAccountId}:role/CrossAccountDeploymentRole'
 RunOrder: 1

 - Name: ExecuteChangeSetDev
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_EXECUTE
 StackName: MyApp-Dev
 ChangeSetName: MyApp-Dev-ChangeSet
 RoleArn: !Sub 'arn:aws:iam::${DevAccountId}:role/CrossAccountDeploymentRole'
 RunOrder: 2

 - Name: ApprovalForProduction
 Actions:
 - Name: ManualApproval
 ActionTypeId:
 Category: Approval
 Owner: AWS
 Provider: Manual
 Version: 1
 Configuration:
 NotificationArn: !Ref ApprovalTopic
 CustomData: 'Please review the development deployment and approve for production'

 - Name: DeployToProduction
 Actions:
 - Name: CreateChangeSetProd
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_REPLACE
 StackName: MyApp-Prod
 ChangeSetName: MyApp-Prod-ChangeSet
 TemplatePath: BuildOutput::packaged-template.yaml
 Capabilities: CAPABILITY_IAM
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CloudFormationExecutionRole'
 ParameterOverrides: |
 {
 "Environment": "Production"
 }
 InputArtifacts:
 - Name: BuildOutput
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CrossAccountDeploymentRole'
 RunOrder: 1

 - Name: ExecuteChangeSetProd
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_EXECUTE
 StackName: MyApp-Prod
 ChangeSetName: MyApp-Prod-ChangeSet
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CrossAccountDeploymentRole'
 RunOrder: 2

 ApprovalTopic:
 Type: AWS::SNS::Topic
 Properties:
 TopicName: PipelineApprovals
 DisplayName: Pipeline Approval Notifications

6. Advanced Cross-Account Patterns

Multi-Region Cross-Account Deployment

CrossAccountMultiRegionPipeline:
 Type: AWS::CodePipeline::Pipeline
 Properties:
 Name: MultiRegionCrossAccountPipeline
 RoleArn: !GetAtt CodePipelineServiceRole.Arn
 ArtifactStores:
 - Region: us-east-1
 ArtifactStore:
 Type: S3
 Location: !Ref ArtifactBucketUSEast1
 EncryptionKey:
 Id: !GetAtt ArtifactKMSKeyUSEast1.Arn
 Type: KMS
 - Region: us-west-2
 ArtifactStore:
 Type: S3
 Location: !Ref ArtifactBucketUSWest2
 EncryptionKey:
 Id: !GetAtt ArtifactKMSKeyUSWest2.Arn
 Type: KMS
 Stages:
 - Name: Source
 Actions:
 - Name: SourceAction
 ActionTypeId:
 Category: Source
 Owner: AWS
 Provider: CodeCommit
 Version: 1
 Configuration:
 RepositoryName: MyApplication
 BranchName: main
 OutputArtifacts:
 - Name: SourceOutput

 - Name: ParallelRegionDeployment
 Actions:
 - Name: DeployUSEast1
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CREATE_UPDATE
 StackName: MyApp-USEast1
 TemplatePath: SourceOutput::template.yaml
 Capabilities: CAPABILITY_IAM
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CloudFormationExecutionRole'
 InputArtifacts:
 - Name: SourceOutput
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CrossAccountDeploymentRole'
 Region: us-east-1
 RunOrder: 1

 - Name: DeployUSWest2
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CREATE_UPDATE
 StackName: MyApp-USWest2
 TemplatePath: SourceOutput::template.yaml
 Capabilities: CAPABILITY_IAM
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CloudFormationExecutionRole'
 InputArtifacts:
 - Name: SourceOutput
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CrossAccountDeploymentRole'
 Region: us-west-2
 RunOrder: 1

Cross-Account with External ID

# Lambda function for dynamic external ID generation
import boto3
import json
import uuid

def lambda_handler(event, context):
 """
 Generate unique external ID for cross-account role assumption
 """
 
 # Generate unique external ID
 external_id = str(uuid.uuid4())
 
 # Store in Parameter Store for pipeline use
 ssm = boto3.client('ssm')
 ssm.put_parameter(
 Name='/pipeline/cross-account/external-id',
 Value=external_id,
 Type='SecureString',
 Overwrite=True
 )
 
 # Update trust policy in target accounts
 update_trust_policies(external_id, event['target_accounts'])
 
 return {
 'statusCode': 200,
 'body': json.dumps({
 'external_id': external_id,
 'message': 'External ID updated successfully'
 })
 }

def update_trust_policies(external_id, target_accounts):
 """Update trust policies in target accounts"""
 
 for account_id in target_accounts:
 # Assume role in target account to update trust policy
 sts = boto3.client('sts')
 assumed_role = sts.assume_role(
 RoleArn=f'arn:aws:iam::{account_id}:role/TrustPolicyUpdateRole',
 RoleSessionName='UpdateTrustPolicy'
 )
 
 # Create IAM client with assumed role credentials
 iam = boto3.client(
 'iam',
 aws_access_key_id=assumed_role['Credentials']['AccessKeyId'],
 aws_secret_access_key=assumed_role['Credentials']['SecretAccessKey'],
 aws_session_token=assumed_role['Credentials']['SessionToken']
 )
 
 # Update trust policy
 trust_policy = {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:role/CodePipelineServiceRole"
 },
 "Action": "sts:AssumeRole",
 "Condition": {
 "StringEquals": {
 "sts:ExternalId": external_id
 }
 }
 }
 ]
 }
 
 iam.update_assume_role_policy(
 RoleName='CrossAccountDeploymentRole',
 PolicyDocument=json.dumps(trust_policy)
 )

7. Security Best Practices

Least Privilege Access

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:CreateStack",
 "cloudformation:UpdateStack",
 "cloudformation:DescribeStacks",
 "cloudformation:CreateChangeSet",
 "cloudformation:ExecuteChangeSet",
 "cloudformation:DescribeChangeSet"
 ],
 "Resource": [
 "arn:aws:cloudformation:*:*:stack/MyApp-*/*",
 "arn:aws:cloudformation:*:*:changeSet/MyApp-*/*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject"
 ],
 "Resource": "arn:aws:s3:::central-pipeline-artifacts/*",
 "Condition": {
 "StringEquals": {
 "s3:ExistingObjectTag/Pipeline": "MyApp"
 }
 }
 }
 ]
}

Time-Based Access Control

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "sts:AssumeRole",
 "Resource": "arn:aws:iam::*:role/CrossAccountDeploymentRole",
 "Condition": {
 "DateGreaterThan": {
 "aws:CurrentTime": "2024-01-01T00:00:00Z"
 },
 "DateLessThan": {
 "aws:CurrentTime": "2024-12-31T23:59:59Z"
 },
 "IpAddress": {
 "aws:SourceIp": ["203.0.113.0/24", "198.51.100.0/24"]
 }
 }
 }
 ]
}

Audit and Compliance

Resources:
 CrossAccountAuditTrail:
 Type: AWS::CloudTrail::Trail
 Properties:
 TrailName: CrossAccountPipelineAudit
 S3BucketName: !Ref AuditBucket
 IncludeGlobalServiceEvents: true
 IsMultiRegionTrail: true
 EnableLogFileValidation: true
 EventSelectors:
 - ReadWriteType: All
 IncludeManagementEvents: true
 DataResources:
 - Type: AWS::S3::Object
 Values: 
 - !Sub '${ArtifactBucket}/*'

 ComplianceRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: cross-account-pipeline-compliance
 Description: Ensures cross-account pipeline follows security best practices
 Source:
 Owner: AWS
 SourceIdentifier: IAM_ROLE_MANAGED_POLICY_CHECK
 InputParameters: |
 {
 "managedPolicyArns": "arn:aws:iam::aws:policy/ReadOnlyAccess"
 }

8. Monitoring & Troubleshooting

CloudWatch Monitoring

import boto3
import json

def monitor_cross_account_pipeline(event, context):
 """
 Monitor cross-account pipeline executions
 """
 
 codepipeline = boto3.client('codepipeline')
 cloudwatch = boto3.client('cloudwatch')
 
 # Get pipeline execution details
 pipeline_name = event['detail']['pipeline']
 execution_id = event['detail']['execution-id']
 
 try:
 execution = codepipeline.get_pipeline_execution(
 pipelineName=pipeline_name,
 pipelineExecutionId=execution_id
 )
 
 # Check for cross-account action failures
 if execution['pipelineExecution']['status'] == 'Failed':
 failed_actions = get_failed_cross_account_actions(pipeline_name, execution_id)
 
 for action in failed_actions:
 # Publish custom metrics
 cloudwatch.put_metric_data(
 Namespace='Pipeline/CrossAccount',
 MetricData=[
 {
 'MetricName': 'CrossAccountActionFailure',
 'Dimensions': [
 {'Name': 'PipelineName', 'Value': pipeline_name},
 {'Name': 'ActionName', 'Value': action['actionName']},
 {'Name': 'TargetAccount', 'Value': action['targetAccount']}
 ],
 'Value': 1,
 'Unit': 'Count'
 }
 ]
 )
 
 # Send detailed alert
 send_cross_account_failure_alert(pipeline_name, action)
 
 except Exception as e:
 print(f"Error monitoring pipeline: {str(e)}")

def get_failed_cross_account_actions(pipeline_name, execution_id):
 """Get details of failed cross-account actions"""
 
 codepipeline = boto3.client('codepipeline')
 
 # Get action execution details
 response = codepipeline.list_action_executions(
 pipelineName=pipeline_name,
 filter={
 'pipelineExecutionId': execution_id
 }
 )
 
 failed_actions = []
 for action in response['actionExecutionDetails']:
 if (action['status'] == 'Failed' and 
 'roleArn' in action.get('actionExecutionId', {}).get('actionTypeId', {})):
 
 # Extract target account from role ARN
 role_arn = action['actionExecutionId']['actionTypeId'].get('roleArn', '')
 if 'arn:aws:iam::' in role_arn:
 target_account = role_arn.split(':')[4]
 failed_actions.append({
 'actionName': action['actionName'],
 'targetAccount': target_account,
 'errorMessage': action.get('output', {}).get('executionResult', {}).get('errorDetails', {}).get('message', 'Unknown error')
 })
 
 return failed_actions

Troubleshooting Common Issues

#!/bin/bash
# Cross-account pipeline troubleshooting script

PIPELINE_NAME="CrossAccountDeploymentPipeline"
CENTRAL_ACCOUNT="111111111111"
TARGET_ACCOUNTS=("222222222222" "333333333333")

echo "Troubleshooting cross-account pipeline: $PIPELINE_NAME"

# Check pipeline status
echo "=== Pipeline Status ==="
aws codepipeline get-pipeline-state --name $PIPELINE_NAME

# Check artifact bucket access
echo "=== Artifact Bucket Access ==="
aws s3 ls s3://central-pipeline-artifacts/ --recursive

# Test cross-account role assumption
echo "=== Testing Cross-Account Role Assumption ==="
for account in "${TARGET_ACCOUNTS[@]}"; do
 echo "Testing access to account: $account"
 
 # Attempt to assume role
 ROLE_ARN="arn:aws:iam::$account:role/CrossAccountDeploymentRole"
 
 aws sts assume-role \
 --role-arn $ROLE_ARN \
 --role-session-name "TroubleshootingSession" \
 --external-id "unique-external-id-12345" \
 --query 'Credentials.AccessKeyId' \
 --output text
 
 if [ $? -eq 0 ]; then
 echo "✓ Successfully assumed role in account $account"
 else
 echo "✗ Failed to assume role in account $account"
 fi
done

# Check KMS key access
echo "=== KMS Key Access ==="
KMS_KEY_ID="12345678-1234-1234-1234-123456789012"
aws kms describe-key --key-id $KMS_KEY_ID

# Check recent pipeline executions
echo "=== Recent Pipeline Executions ==="
aws codepipeline list-pipeline-executions \
 --pipeline-name $PIPELINE_NAME \
 --max-items 5

9. Common Exam Scenarios

Scenario 1: Setup cross-account deployment from central CI/CD account

Solution:

AWS CodePipeline Integrations

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CodePipeline Integrations encompass the comprehensive ecosystem of services, tools, and platforms that can be connected to CodePipeline to create sophisticated CI/CD workflows. These integrations enable end-to-end automation from source code to production deployment across multiple environments and platforms.

Key Characteristics

Native AWS integrations - Seamless connectivity with AWS services
Third-party integrations - Support for external tools and platforms
Event-driven workflows - Automated triggering and notifications
Flexible action types - Source, build, test, deploy, approval, invoke actions
Custom integrations - Lambda-based custom actions
Multi-platform support - Deploy to various compute platforms
Artifact management - Seamless data flow between integrated services

What Problem Does It Solve?

Eliminates manual handoffs between development tools
Provides unified workflow across heterogeneous toolchains
Enables automated quality gates and compliance checks
Facilitates integration with existing enterprise tools
Supports complex deployment patterns across multiple platforms
Enables real-time monitoring and notification workflows
Provides audit trails across the entire CI/CD process

2. Core Integration Categories

Source Integrations

AWS CodeCommit - Native Git repository service
GitHub - Public and enterprise GitHub repositories
Bitbucket - Atlassian Bitbucket repositories
Amazon S3 - Object storage for pre-built artifacts
Amazon ECR - Container image repositories

Build Integrations

AWS CodeBuild - Managed build service
Jenkins - Open-source automation server
TeamCity - JetBrains CI/CD platform
CloudBees - Enterprise Jenkins platform

Test Integrations

AWS CodeBuild - Test execution environment
AWS Device Farm - Mobile application testing
Third-party testing tools - Via custom actions

Deploy Integrations

AWS CodeDeploy - Application deployment service
AWS CloudFormation - Infrastructure as Code
Amazon ECS - Container orchestration
AWS Elastic Beanstalk - Platform as a Service
Amazon S3 - Static website deployment
AWS Service Catalog - Governed service provisioning

Notification Integrations

Amazon SNS - Simple Notification Service
Amazon EventBridge - Event-driven architecture
AWS Chatbot - Slack and Microsoft Teams integration
Custom webhooks - Via Lambda functions

3. AWS Service Integrations

CodeCommit Integration

- Name: Source
 Actions:
 - Name: SourceAction
 ActionTypeId:
 Category: Source
 Owner: AWS
 Provider: CodeCommit
 Version: 1
 Configuration:
 RepositoryName: MyApplication
 BranchName: main
 PollForSourceChanges: false # Use EventBridge instead
 OutputArtifacts:
 - Name: SourceOutput

# EventBridge rule for automatic triggering
Resources:
 CodeCommitRule:
 Type: AWS::Events::Rule
 Properties:
 Description: 'Trigger pipeline on CodeCommit push'
 EventPattern:
 source:
 - aws.codecommit
 detail-type:
 - CodeCommit Repository State Change
 detail:
 event:
 - referenceCreated
 - referenceUpdated
 referenceType:
 - branch
 referenceName:
 - main
 Targets:
 - Arn: !Sub 'arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:pipeline/MyPipeline'
 Id: CodePipelineTarget
 RoleArn: !GetAtt EventBridgeRole.Arn

CodeBuild Integration

- Name: Build
 Actions:
 - Name: BuildAction
 ActionTypeId:
 Category: Build
 Owner: AWS
 Provider: CodeBuild
 Version: 1
 Configuration:
 ProjectName: MyBuildProject
 PrimarySource: SourceOutput
 EnvironmentVariables: |
 [
 {
 "name": "ENVIRONMENT",
 "value": "#{codepipeline.PipelineName}",
 "type": "PLAINTEXT"
 },
 {
 "name": "COMMIT_ID",
 "value": "#{SourceVariables.CommitId}",
 "type": "PLAINTEXT"
 }
 ]
 InputArtifacts:
 - Name: SourceOutput
 OutputArtifacts:
 - Name: BuildOutput
 Namespace: BuildVariables

CloudFormation Integration

- Name: Deploy
 Actions:
 - Name: CreateChangeSet
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_REPLACE
 StackName: MyApplication-Stack
 ChangeSetName: MyApplication-ChangeSet
 TemplatePath: BuildOutput::packaged-template.yaml
 Capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM
 RoleArn: !GetAtt CloudFormationRole.Arn
 ParameterOverrides: |
 {
 "Environment": "Production",
 "Version": "#{BuildVariables.BuildNumber}",
 "CommitId": "#{SourceVariables.CommitId}"
 }
 InputArtifacts:
 - Name: BuildOutput
 RunOrder: 1

 - Name: ExecuteChangeSet
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_EXECUTE
 StackName: MyApplication-Stack
 ChangeSetName: MyApplication-ChangeSet
 RunOrder: 2

ECS Integration

- Name: DeployToECS
 Actions:
 - Name: DeployToECS
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: ECS
 Version: 1
 Configuration:
 ClusterName: MyCluster
 ServiceName: MyService
 FileName: imagedefinitions.json
 InputArtifacts:
 - Name: BuildOutput

# imagedefinitions.json format
[
 {
 "name": "my-container",
 "imageUri": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest"
 }
]

Lambda Integration

- Name: CustomProcessing
 Actions:
 - Name: InvokeLambda
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: 1
 Configuration:
 FunctionName: MyProcessingFunction
 UserParameters: |
 {
 "environment": "production",
 "version": "#{BuildVariables.BuildNumber}",
 "artifacts": "#{codepipeline.PipelineExecutionId}"
 }
 InputArtifacts:
 - Name: BuildOutput

4. Third-Party Integrations

GitHub Integration (Version 2)

- Name: Source
 Actions:
 - Name: SourceAction
 ActionTypeId:
 Category: Source
 Owner: AWS
 Provider: GitHub
 Version: 2
 Configuration:
 Owner: myorganization
 Repo: myrepository
 Branch: main
 ConnectionArn: arn:aws:codestar-connections:us-east-1:123456789012:connection/12345678-1234-1234-1234-123456789012
 OutputArtifacts:
 - Name: SourceOutput

# CodeStar connections for GitHub (live service - unrelated to the retired CodeStar project service)
Resources:
 GitHubConnection:
 Type: AWS::CodeStarConnections::Connection
 Properties:
 ConnectionName: MyGitHubConnection
 ProviderType: GitHub

Jenkins Integration

- Name: Build
 Actions:
 - Name: JenkinsBuild
 ActionTypeId:
 Category: Build
 Owner: ThirdParty
 Provider: Jenkins
 Version: 1
 Configuration:
 ServerURL: https://jenkins.example.com
 ProjectName: MyProject
 InputArtifacts:
 - Name: SourceOutput
 OutputArtifacts:
 - Name: JenkinsOutput

# Jenkins plugin configuration
{
 "serverURL": "https://jenkins.example.com",
 "username": "jenkins-user",
 "password": "jenkins-token",
 "projectName": "MyProject",
 "parameterOverrides": {
 "BRANCH_NAME": "#{SourceVariables.BranchName}",
 "COMMIT_ID": "#{SourceVariables.CommitId}"
 }
}

Resources:
 SlackNotificationTopic:
 Type: AWS::SNS::Topic
 Properties:
 TopicName: PipelineNotifications

 SlackChatbot:
 Type: AWS::Chatbot::SlackChannelConfiguration
 Properties:
 ConfigurationName: PipelineSlackBot
 SlackChannelId: C1234567890
 SlackWorkspaceId: T1234567890
 SnsTopicArns:
 - !Ref SlackNotificationTopic
 IamRoleArn: !GetAtt ChatbotRole.Arn

 PipelineEventRule:
 Type: AWS::Events::Rule
 Properties:
 Description: 'Pipeline state changes'
 EventPattern:
 source:
 - aws.codepipeline
 detail-type:
 - CodePipeline Pipeline Execution State Change
 detail:
 state:
 - SUCCEEDED
 - FAILED
 Targets:
 - Arn: !Ref SlackNotificationTopic
 Id: SlackNotificationTarget

5. Custom Integration Patterns

Custom Action with Lambda

import json
import boto3
import requests

def lambda_handler(event, context):
 """
 Custom CodePipeline action for third-party integration
 """
 
 codepipeline = boto3.client('codepipeline')
 
 # Extract job data
 job_id = event['CodePipeline.job']['id']
 job_data = event['CodePipeline.job']['data']
 
 try:
 # Get user parameters
 user_parameters = json.loads(
 job_data['actionConfiguration']['configuration']['UserParameters']
 )
 
 # Get input artifacts
 input_artifacts = job_data['inputArtifacts']
 s3_client = boto3.client('s3')
 
 # Process artifacts
 for artifact in input_artifacts:
 bucket = artifact['location']['s3Location']['bucketName']
 key = artifact['location']['s3Location']['objectKey']
 
 # Download artifact
 response = s3_client.get_object(Bucket=bucket, Key=key)
 artifact_content = response['Body'].read()
 
 # Custom processing logic
 result = process_artifact(artifact_content, user_parameters)
 
 # Call third-party API
 api_response = call_third_party_api(result, user_parameters)
 
 if api_response['status'] == 'success':
 # Signal success
 codepipeline.put_job_success_result(jobId=job_id)
 else:
 # Signal failure
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': api_response['error']}
 )
 
 except Exception as e:
 # Signal failure
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': str(e)}
 )

def process_artifact(content, parameters):
 """Process artifact content"""
 # Custom processing logic
 return {
 'processed_data': content.decode('utf-8'),
 'metadata': parameters
 }

def call_third_party_api(data, parameters):
 """Call external API"""
 
 api_url = parameters.get('api_url')
 api_key = parameters.get('api_key')
 
 headers = {
 'Authorization': f'Bearer {api_key}',
 'Content-Type': 'application/json'
 }
 
 try:
 response = requests.post(api_url, json=data, headers=headers)
 response.raise_for_status()
 
 return {
 'status': 'success',
 'data': response.json()
 }
 except requests.exceptions.RequestException as e:
 return {
 'status': 'error',
 'error': str(e)
 }

Webhook Integration

import json
import boto3
import hmac
import hashlib

def lambda_handler(event, context):
 """
 Webhook handler for external system integration
 """
 
 # Verify webhook signature
 if not verify_signature(event):
 return {
 'statusCode': 401,
 'body': json.dumps({'error': 'Invalid signature'})
 }
 
 # Parse webhook payload
 payload = json.loads(event['body'])
 
 # Determine action based on webhook type
 if payload.get('event_type') == 'deployment_complete':
 handle_deployment_complete(payload)
 elif payload.get('event_type') == 'test_results':
 handle_test_results(payload)
 
 return {
 'statusCode': 200,
 'body': json.dumps({'message': 'Webhook processed successfully'})
 }

def verify_signature(event):
 """Verify webhook signature"""
 
 signature = event['headers'].get('X-Hub-Signature-256', '')
 secret = get_webhook_secret()
 
 expected_signature = 'sha256=' + hmac.new(
 secret.encode('utf-8'),
 event['body'].encode('utf-8'),
 hashlib.sha256
 ).hexdigest()
 
 return hmac.compare_digest(signature, expected_signature)

def handle_deployment_complete(payload):
 """Handle deployment completion webhook"""
 
 codepipeline = boto3.client('codepipeline')
 
 # Extract deployment information
 deployment_id = payload.get('deployment_id')
 status = payload.get('status')
 
 if status == 'success':
 # Trigger next stage in pipeline
 codepipeline.start_pipeline_execution(
 name='MyPipeline'
 )
 else:
 # Send failure notification
 send_failure_notification(deployment_id, payload.get('error'))

def get_webhook_secret():
 """Get webhook secret from Parameter Store"""
 
 ssm = boto3.client('ssm')
 response = ssm.get_parameter(
 Name='/webhook/secret',
 WithDecryption=True
 )
 return response['Parameter']['Value']

6. EventBridge Integration Patterns

Pipeline State Change Monitoring

Resources:
 PipelineStateChangeRule:
 Type: AWS::Events::Rule
 Properties:
 Description: 'Monitor pipeline state changes'
 EventPattern:
 source:
 - aws.codepipeline
 detail-type:
 - CodePipeline Pipeline Execution State Change
 detail:
 pipeline:
 - MyPipeline
 state:
 - STARTED
 - SUCCEEDED
 - FAILED
 - CANCELED
 - SUPERSEDED
 Targets:
 - Arn: !GetAtt PipelineMonitorFunction.Arn
 Id: PipelineMonitorTarget

 ActionStateChangeRule:
 Type: AWS::Events::Rule
 Properties:
 Description: 'Monitor action state changes'
 EventPattern:
 source:
 - aws.codepipeline
 detail-type:
 - CodePipeline Stage Execution State Change
 detail:
 pipeline:
 - MyPipeline
 state:
 - FAILED
 Targets:
 - Arn: !Ref FailureNotificationTopic
 Id: FailureNotificationTarget

Cross-Service Event Orchestration

import boto3
import json

def lambda_handler(event, context):
 """
 Orchestrate cross-service events based on pipeline state
 """
 
 detail = event['detail']
 pipeline_name = detail['pipeline']
 execution_id = detail['execution-id']
 state = detail['state']
 
 if state == 'SUCCEEDED':
 handle_pipeline_success(pipeline_name, execution_id)
 elif state == 'FAILED':
 handle_pipeline_failure(pipeline_name, execution_id, detail)
 elif state == 'STARTED':
 handle_pipeline_start(pipeline_name, execution_id)

def handle_pipeline_success(pipeline_name, execution_id):
 """Handle successful pipeline execution"""
 
 # Update deployment tracking system
 update_deployment_status(execution_id, 'SUCCESS')
 
 # Trigger downstream processes
 trigger_post_deployment_tests(pipeline_name)
 
 # Update monitoring dashboards
 update_deployment_metrics(pipeline_name, 'SUCCESS')
 
 # Send success notifications
 send_success_notification(pipeline_name, execution_id)

def handle_pipeline_failure(pipeline_name, execution_id, detail):
 """Handle failed pipeline execution"""
 
 # Get failure details
 failure_reason = get_failure_details(pipeline_name, execution_id)
 
 # Create incident ticket
 create_incident_ticket(pipeline_name, execution_id, failure_reason)
 
 # Trigger rollback if needed
 if should_auto_rollback(pipeline_name, failure_reason):
 trigger_rollback(pipeline_name)
 
 # Send failure alerts
 send_failure_alert(pipeline_name, execution_id, failure_reason)

def trigger_post_deployment_tests(pipeline_name):
 """Trigger post-deployment testing"""
 
 stepfunctions = boto3.client('stepfunctions')
 
 stepfunctions.start_execution(
 stateMachineArn='arn:aws:states:us-east-1:123456789012:stateMachine:PostDeploymentTests',
 input=json.dumps({
 'pipeline_name': pipeline_name,
 'test_suite': 'integration'
 })
 )

7. Security Integration Patterns

Security Scanning Integration

- Name: SecurityScan
 Actions:
 - Name: StaticAnalysis
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: 1
 Configuration:
 FunctionName: SecurityScanFunction
 UserParameters: |
 {
 "scan_type": "static_analysis",
 "severity_threshold": "HIGH",
 "fail_on_findings": true
 }
 InputArtifacts:
 - Name: SourceOutput

 - Name: DependencyCheck
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: 1
 Configuration:
 FunctionName: DependencyCheckFunction
 UserParameters: |
 {
 "scan_type": "dependency_vulnerability",
 "exclude_dev_dependencies": true
 }
 InputArtifacts:
 - Name: SourceOutput
 RunOrder: 1

 - Name: ContainerScan
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: 1
 Configuration:
 FunctionName: ContainerScanFunction
 UserParameters: |
 {
 "registry": "ecr",
 "image_tag": "#{BuildVariables.ImageTag}"
 }
 InputArtifacts:
 - Name: BuildOutput
 RunOrder: 2

Compliance Gate Integration

import boto3
import json

def lambda_handler(event, context):
 """
 Compliance gate for pipeline progression
 """
 
 codepipeline = boto3.client('codepipeline')
 job_id = event['CodePipeline.job']['id']
 
 try:
 # Get user parameters
 user_parameters = json.loads(
 event['CodePipeline.job']['data']['actionConfiguration']['configuration']['UserParameters']
 )
 
 compliance_checks = [
 check_security_scan_results(),
 check_code_coverage_threshold(user_parameters.get('coverage_threshold', 80)),
 check_license_compliance(),
 check_vulnerability_scan_results(),
 check_policy_compliance()
 ]
 
 # All checks must pass
 if all(compliance_checks):
 # Generate compliance report
 report = generate_compliance_report(compliance_checks)
 
 # Store compliance artifacts
 store_compliance_artifacts(report)
 
 codepipeline.put_job_success_result(
 jobId=job_id,
 outputVariables={
 'ComplianceStatus': 'PASSED',
 'ComplianceScore': str(calculate_compliance_score(compliance_checks))
 }
 )
 else:
 # Generate failure report
 failure_report = generate_failure_report(compliance_checks)
 
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={
 'message': f'Compliance checks failed: {failure_report}',
 'type': 'JobFailed'
 }
 )
 
 except Exception as e:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': str(e)}
 )

def check_security_scan_results():
 """Check security scan results from previous stage"""
 
 # Query security scanning service
 security_client = boto3.client('inspector2')
 
 # Get recent findings
 findings = security_client.list_findings(
 filterCriteria={
 'severity': ['HIGH', 'CRITICAL']
 }
 )
 
 # Return True if no high/critical findings
 return len(findings['findings']) == 0

8. Monitoring and Observability Integration

CloudWatch Integration

Resources:
 PipelineMetricsFunction:
 Type: AWS::Lambda::Function
 Properties:
 Runtime: python3.9
 Handler: index.handler
 Code:
 ZipFile: |
 import boto3
 import json
 from datetime import datetime
 
 def handler(event, context):
 cloudwatch = boto3.client('cloudwatch')
 
 detail = event['detail']
 pipeline_name = detail['pipeline']
 state = detail['state']
 
 # Publish custom metrics
 cloudwatch.put_metric_data(
 Namespace='CodePipeline/Custom',
 MetricData=[
 {
 'MetricName': 'PipelineExecutions',
 'Dimensions': [
 {'Name': 'PipelineName', 'Value': pipeline_name},
 {'Name': 'State', 'Value': state}
 ],
 'Value': 1,
 'Unit': 'Count',
 'Timestamp': datetime.utcnow()
 }
 ]
 )
 
 # Calculate and publish duration for completed pipelines
 if state in ['SUCCEEDED', 'FAILED']:
 duration = calculate_pipeline_duration(detail)
 cloudwatch.put_metric_data(
 Namespace='CodePipeline/Custom',
 MetricData=[
 {
 'MetricName': 'PipelineDuration',
 'Dimensions': [
 {'Name': 'PipelineName', 'Value': pipeline_name}
 ],
 'Value': duration,
 'Unit': 'Seconds'
 }
 ]
 )

 PipelineDashboard:
 Type: AWS::CloudWatch::Dashboard
 Properties:
 DashboardName: CodePipelineDashboard
 DashboardBody: !Sub |
 {
 "widgets": [
 {
 "type": "metric",
 "properties": {
 "metrics": [
 ["CodePipeline/Custom", "PipelineExecutions", "PipelineName", "MyPipeline", "State", "SUCCEEDED"],
 [".", ".", ".", ".", ".", "FAILED"]
 ],
 "period": 300,
 "stat": "Sum",
 "region": "${AWS::Region}",
 "title": "Pipeline Executions"
 }
 },
 {
 "type": "metric",
 "properties": {
 "metrics": [
 ["CodePipeline/Custom", "PipelineDuration", "PipelineName", "MyPipeline"]
 ],
 "period": 300,
 "stat": "Average",
 "region": "${AWS::Region}",
 "title": "Average Pipeline Duration"
 }
 }
 ]
 }

X-Ray Tracing Integration

from aws_xray_sdk.core import xray_recorder
from aws_xray_sdk.core import patch_all
import boto3

# Patch AWS SDK calls
patch_all()

@xray_recorder.capture('pipeline_integration')
def lambda_handler(event, context):
 """
 Lambda function with X-Ray tracing for pipeline integration
 """
 
 # Create subsegment for external API call
 with xray_recorder.in_subsegment('external_api_call'):
 result = call_external_api(event)
 
 # Create subsegment for database operation
 with xray_recorder.in_subsegment('database_update'):
 update_deployment_status(result)
 
 return result

@xray_recorder.capture('external_api')
def call_external_api(event):
 """Call external API with tracing"""
 
 # Add metadata to trace
 xray_recorder.current_subsegment().put_metadata('api_endpoint', 'https://api.example.com')
 xray_recorder.current_subsegment().put_annotation('pipeline_name', event.get('pipeline_name'))
 
 # Make API call
 import requests
 response = requests.get('https://api.example.com/status')
 
 # Add response metadata
 xray_recorder.current_subsegment().put_metadata('response_status', response.status_code)
 
 return response.json()

9. Common Exam Scenarios

Scenario 1: Integrate pipeline with external testing service

Solution:

AWS CodeStar & CodeCatalyst

Sun, 04 Oct 2026 00:00:00 +0000

Status correction (2026 review): AWS CodeStar support ended July 31, 2024 (retired). Amazon CodeCatalyst closed to new customers November 7, 2025 and is in maintenance mode (no new features). Do NOT build new projects on either. This file is kept as historical reference: know what these services were in case the exam mentions them, and know that the live CodeStar connections service (GitHub/GitLab/Bitbucket source connections for CodePipeline) is a separate, still-supported service despite the similar name.

AWS Compliance and Governance

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS Compliance Framework

Shared responsibility model for compliance
AWS manages infrastructure compliance
Customers responsible for data and application compliance
Extensive compliance certifications and attestations

Key Compliance Programs

SOC 1/2/3 - Service Organization Control reports
PCI DSS - Payment Card Industry Data Security Standard
HIPAA - Health Insurance Portability and Accountability Act
FedRAMP - Federal Risk and Authorization Management Program
ISO 27001 - Information Security Management System
GDPR - General Data Protection Regulation

Governance Principles

Accountability - Clear ownership and responsibility
Transparency - Visibility into operations and decisions
Compliance - Adherence to regulations and standards
Risk Management - Identification and mitigation of risks
Continuous Improvement - Regular assessment and enhancement

2. AWS Config for Compliance

What is AWS Config?

Configuration management and compliance service
Tracks resource configurations and changes
Evaluates configurations against compliance rules
Provides configuration history and change notifications

Config Rules

AWS Managed Rules - Pre-built compliance checks
Custom Rules - Lambda-based custom logic
Conformance Packs - Collection of related rules
Organizational Rules - Rules applied across AWS Organizations

Common Compliance Rules

# Enable required tags rule
aws configservice put-config-rule \
 --config-rule '{
 "ConfigRuleName": "required-tags",
 "Source": {
 "Owner": "AWS",
 "SourceIdentifier": "REQUIRED_TAGS"
 },
 "InputParameters": "{\"tag1Key\":\"Environment\",\"tag2Key\":\"Owner\"}"
 }'

Remediation Actions

# CloudFormation template for Config remediation
Resources:
 RemediationConfiguration:
 Type: AWS::Config::RemediationConfiguration
 Properties:
 ConfigRuleName: !Ref ConfigRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-RemoveUnrestrictedSourceInSecurityGroup
 TargetVersion: "1"
 Parameters:
 AutomationAssumeRole:
 StaticValue: !GetAtt RemediationRole.Arn
 GroupId:
 ResourceValue: RESOURCE_ID

3. AWS Organizations for Governance

Organizational Structure

Management Account - Central billing and administration
Member Accounts - Individual AWS accounts in organization
Organizational Units (OUs) - Logical groupings of accounts
Service Control Policies (SCPs) - Guardrails for account permissions

Service Control Policies

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "DenyRootAccess",
 "Effect": "Deny",
 "Principal": "*",
 "Action": "*",
 "Resource": "*",
 "Condition": {
 "StringEquals": {
 "aws:PrincipalType": "Root"
 }
 }
 },
 {
 "Sid": "RequireSSLRequestsOnly",
 "Effect": "Deny",
 "Principal": "*",
 "Action": "s3:*",
 "Resource": [
 "arn:aws:s3:::*/*",
 "arn:aws:s3:::*"
 ],
 "Condition": {
 "Bool": {
 "aws:SecureTransport": "false"
 }
 }
 }
 ]
}

Account Management

# Create new account in organization
aws organizations create-account \
 --email "newaccount@example.com" \
 --account-name "Production Account" \
 --role-name "OrganizationAccountAccessRole"

# Move account to OU
aws organizations move-account \
 --account-id "123456789012" \
 --source-parent-id "r-examplerootid111" \
 --destination-parent-id "ou-exampleou111"

4. AWS Control Tower

What is Control Tower?

Landing zone setup and governance service
Pre-configured multi-account environment
Guardrails for compliance and security
Account Factory for standardized account provisioning

Guardrails

Preventive Guardrails - SCPs that prevent actions
Detective Guardrails - Config rules that detect violations
Mandatory Guardrails - Cannot be disabled
Strongly Recommended - Best practice guardrails
Elective Guardrails - Optional additional controls

Account Factory

# Service Catalog product for new accounts
Parameters:
 AccountName:
 Type: String
 Description: Name for the new account
 AccountEmail:
 Type: String
 Description: Email address for the new account
 OrganizationalUnit:
 Type: String
 Description: OU to place the account in
 AllowedValues:
 - Production
 - Development
 - Sandbox

Customizations

# Custom Control Tower customization
import boto3

def deploy_custom_guardrail():
 """Deploy custom guardrail across organization"""
 
 config = boto3.client('config')
 organizations = boto3.client('organizations')
 
 # Get all accounts in organization
 accounts = organizations.list_accounts()
 
 for account in accounts['Accounts']:
 if account['Status'] == 'ACTIVE':
 # Deploy Config rule to each account
 deploy_config_rule_to_account(account['Id'])

def deploy_config_rule_to_account(account_id):
 """Deploy Config rule to specific account"""
 # Implementation for cross-account Config rule deployment
 pass

5. AWS CloudTrail for Audit

CloudTrail Configuration

Management Events - Control plane operations
Data Events - Data plane operations (S3, Lambda)
Insight Events - Unusual activity patterns
Multi-Region Trails - Global event logging

Compliance Logging

# Create compliance trail
aws cloudtrail create-trail \
 --name "ComplianceTrail" \
 --s3-bucket-name "compliance-audit-logs" \
 --s3-key-prefix "cloudtrail-logs/" \
 --include-global-service-events \
 --is-multi-region-trail \
 --enable-log-file-validation \
 --kms-key-id "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"

Log Analysis

import boto3
import json

def analyze_compliance_events():
 """Analyze CloudTrail events for compliance violations"""
 
 s3 = boto3.client('s3')
 
 # List CloudTrail log files
 response = s3.list_objects_v2(
 Bucket='compliance-audit-logs',
 Prefix='cloudtrail-logs/'
 )
 
 violations = []
 
 for obj in response.get('Contents', []):
 # Download and analyze log file
 log_data = s3.get_object(Bucket='compliance-audit-logs', Key=obj['Key'])
 
 # Parse CloudTrail events
 events = json.loads(log_data['Body'].read())
 
 for event in events.get('Records', []):
 if is_compliance_violation(event):
 violations.append(event)
 
 return violations

def is_compliance_violation(event):
 """Check if event represents compliance violation"""
 # Implement compliance checking logic
 return False

6. Data Protection and Privacy

Data Classification

Public - No restrictions on access
Internal - Restricted to organization
Confidential - Restricted to specific individuals
Restricted - Highest level of protection

Data Encryption

# CloudFormation template for encrypted resources
Resources:
 EncryptedS3Bucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketEncryption:
 ServerSideEncryptionConfiguration:
 - ServerSideEncryptionByDefault:
 SSEAlgorithm: aws:kms
 KMSMasterKeyID: !Ref KMSKey
 BucketKeyEnabled: true
 
 EncryptedRDSInstance:
 Type: AWS::RDS::DBInstance
 Properties:
 StorageEncrypted: true
 KmsKeyId: !Ref KMSKey
 
 EncryptedEBSVolume:
 Type: AWS::EC2::Volume
 Properties:
 Encrypted: true
 KmsKeyId: !Ref KMSKey

Data Loss Prevention

import boto3

def implement_dlp_controls():
 """Implement data loss prevention controls"""
 
 # Enable GuardDuty for threat detection
 guardduty = boto3.client('guardduty')
 guardduty.create_detector(Enable=True)
 
 # Enable Macie for data discovery
 macie = boto3.client('macie2')
 macie.enable_macie()
 
 # Configure CloudWatch for monitoring
 cloudwatch = boto3.client('cloudwatch')
 cloudwatch.put_metric_alarm(
 AlarmName='UnauthorizedDataAccess',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=1,
 MetricName='UnauthorizedAPICallsCount',
 Namespace='CloudTrailMetrics',
 Period=300,
 Statistic='Sum',
 Threshold=10.0,
 ActionsEnabled=True,
 AlarmActions=['arn:aws:sns:us-east-1:123456789012:security-alerts']
 )

7. Identity and Access Management Governance

IAM Best Practices

Least Privilege - Minimum necessary permissions
Regular Reviews - Periodic access reviews
Role-Based Access - Use roles instead of users
MFA Enforcement - Multi-factor authentication
Password Policies - Strong password requirements

Access Reviews

import boto3
from datetime import datetime, timedelta

def perform_access_review():
 """Perform regular IAM access review"""
 
 iam = boto3.client('iam')
 
 # Get all users
 users = iam.list_users()
 
 inactive_users = []
 
 for user in users['Users']:
 username = user['UserName']
 
 # Check last activity
 last_used = get_user_last_activity(username)
 
 if last_used and (datetime.now() - last_used).days > 90:
 inactive_users.append(username)
 
 return inactive_users

def get_user_last_activity(username):
 """Get user's last activity date"""
 iam = boto3.client('iam')
 
 try:
 response = iam.get_user(UserName=username)
 return response['User'].get('PasswordLastUsed')
 except:
 return None

Permission Boundaries

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:PutObject",
 "s3:DeleteObject"
 ],
 "Resource": "arn:aws:s3:::allowed-bucket/*"
 },
 {
 "Effect": "Deny",
 "Action": [
 "iam:*",
 "organizations:*",
 "account:*"
 ],
 "Resource": "*"
 }
 ]
}

8. Compliance Monitoring and Reporting

Automated Compliance Checks

import boto3

def run_compliance_checks():
 """Run automated compliance checks"""
 
 config = boto3.client('config')
 
 # Trigger Config rule evaluations
 rules = config.describe_config_rules()
 
 results = {}
 
 for rule in rules['ConfigRules']:
 rule_name = rule['ConfigRuleName']
 
 # Get compliance status
 compliance = config.get_compliance_details_by_config_rule(
 ConfigRuleName=rule_name
 )
 
 results[rule_name] = {
 'compliant': len([r for r in compliance['EvaluationResults'] 
 if r['ComplianceType'] == 'COMPLIANT']),
 'non_compliant': len([r for r in compliance['EvaluationResults'] 
 if r['ComplianceType'] == 'NON_COMPLIANT'])
 }
 
 return results

Compliance Dashboard

import boto3
import json

def generate_compliance_dashboard():
 """Generate compliance dashboard data"""
 
 # Collect compliance data from various sources
 config_compliance = get_config_compliance()
 security_findings = get_security_hub_findings()
 access_analyzer_findings = get_access_analyzer_findings()
 
 dashboard_data = {
 'timestamp': datetime.now().isoformat(),
 'config_compliance': config_compliance,
 'security_findings': security_findings,
 'access_findings': access_analyzer_findings,
 'overall_score': calculate_compliance_score(
 config_compliance, security_findings, access_analyzer_findings
 )
 }
 
 return dashboard_data

def calculate_compliance_score(config_data, security_data, access_data):
 """Calculate overall compliance score"""
 # Implementation for compliance scoring
 return 85.5 # Example score

9. Incident Response and Forensics

Incident Response Plan

Detection - Identify security incidents
Analysis - Assess impact and scope
Containment - Limit damage and spread
Eradication - Remove threats
Recovery - Restore normal operations
Lessons Learned - Improve processes

Forensic Data Collection

import boto3

def collect_forensic_data(incident_id, start_time, end_time):
 """Collect forensic data for incident investigation"""
 
 # Collect CloudTrail logs
 cloudtrail_logs = collect_cloudtrail_logs(start_time, end_time)
 
 # Collect VPC Flow Logs
 vpc_flow_logs = collect_vpc_flow_logs(start_time, end_time)
 
 # Collect GuardDuty findings
 guardduty_findings = collect_guardduty_findings(start_time, end_time)
 
 # Create forensic package
 forensic_package = {
 'incident_id': incident_id,
 'collection_time': datetime.now().isoformat(),
 'cloudtrail_logs': cloudtrail_logs,
 'vpc_flow_logs': vpc_flow_logs,
 'guardduty_findings': guardduty_findings
 }
 
 # Store in secure S3 bucket
 store_forensic_data(forensic_package)
 
 return forensic_package

Automated Response

import boto3

def automated_incident_response(finding):
 """Automated response to security findings"""
 
 if finding['severity'] == 'HIGH':
 # Isolate affected resources
 isolate_compromised_instance(finding['resource_id'])
 
 # Create snapshot for forensics
 create_forensic_snapshot(finding['resource_id'])
 
 # Notify security team
 send_security_alert(finding)
 
 elif finding['severity'] == 'MEDIUM':
 # Log for investigation
 log_security_event(finding)
 
 # Apply remediation if available
 apply_automated_remediation(finding)

def isolate_compromised_instance(instance_id):
 """Isolate compromised EC2 instance"""
 ec2 = boto3.client('ec2')
 
 # Create isolation security group
 isolation_sg = create_isolation_security_group()
 
 # Apply isolation security group
 ec2.modify_instance_attribute(
 InstanceId=instance_id,
 Groups=[isolation_sg]
 )

10. Regulatory Compliance Frameworks

Data Protection by Design - Privacy built into systems
Data Subject Rights - Access, rectification, erasure
Data Processing Records - Documentation of processing activities
Data Protection Impact Assessments - Risk assessments

HIPAA Compliance

Administrative Safeguards - Policies and procedures
Physical Safeguards - Physical access controls
Technical Safeguards - Access controls and encryption
Business Associate Agreements - Third-party compliance

PCI DSS Compliance

Build and Maintain Secure Networks - Firewalls and security
Protect Cardholder Data - Encryption and access controls
Maintain Vulnerability Management - Security testing and updates
Implement Strong Access Control - Authentication and authorization

11. Common Exam Scenarios

Scenario 1: Implement organization-wide compliance monitoring

Solution:

AWS Config

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It continuously monitors and records AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations.

Key Characteristics

Configuration monitoring - Continuous tracking of resource configurations
Compliance evaluation - Automated compliance checking with rules
Change tracking - Historical configuration changes and relationships
Remediation - Automated remediation of non-compliant resources
Multi-account support - Centralized compliance across AWS accounts
Integration - Works with CloudTrail, CloudWatch, SNS, Lambda
Governance - Supports organizational compliance and governance

What Problem Does It Solve?

Provides visibility into resource configurations and changes
Enables automated compliance checking and governance
Facilitates security analysis and audit requirements
Supports change management and impact analysis
Enables automated remediation of configuration drift
Provides historical configuration data for troubleshooting

2. Core Concepts

Configuration Item (CI)

Point-in-time snapshot of resource configuration
Contains resource metadata, attributes, and relationships
Automatically created when resource changes occur
Stored in S3 bucket for historical analysis

Configuration Recorder

Records configuration changes for AWS resources
Must be enabled to start recording configurations
Can be configured for specific resource types
One recorder per region per account

Delivery Channel

Delivers configuration snapshots and history files to S3
Can send notifications via SNS
Configurable delivery frequency
Required for Config to function

Config Rules

Desired configuration settings for resources
Evaluate compliance automatically
Can be AWS managed or custom (Lambda-based)
Trigger evaluation on configuration changes or periodically

Remediation Configuration

Automated actions to fix non-compliant resources
Uses Systems Manager Automation documents
Can be automatic or manual remediation
Supports rollback and error handling

3. Configuration Recorder Setup

Basic Configuration Recorder

Resources:
 ConfigurationRecorder:
 Type: AWS::Config::ConfigurationRecorder
 Properties:
 Name: default
 RoleARN: !GetAtt ConfigRole.Arn
 RecordingGroup:
 AllSupported: true
 IncludeGlobalResourceTypes: true
 ResourceTypes: []

 DeliveryChannel:
 Type: AWS::Config::DeliveryChannel
 Properties:
 Name: default
 S3BucketName: !Ref ConfigBucket
 S3KeyPrefix: config/
 ConfigSnapshotDeliveryProperties:
 DeliveryFrequency: Daily
 
 ConfigBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: !Sub 'config-bucket-${AWS::AccountId}-${AWS::Region}'
 PublicAccessBlockConfiguration:
 BlockPublicAcls: true
 BlockPublicPolicy: true
 IgnorePublicAcls: true
 RestrictPublicBuckets: true

 ConfigRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: config.amazonaws.com
 Action: sts:AssumeRole
 ManagedPolicyArns:
 - arn:aws:iam::aws:policy/service-role/ConfigRole
 Policies:
 - PolicyName: ConfigBucketPolicy
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - s3:GetBucketAcl
 - s3:ListBucket
 Resource: !Sub 'arn:aws:s3:::config-bucket-${AWS::AccountId}-${AWS::Region}'
 - Effect: Allow
 Action: s3:PutObject
 Resource: !Sub 'arn:aws:s3:::config-bucket-${AWS::AccountId}-${AWS::Region}/*'
 Condition:
 StringEquals:
 's3:x-amz-acl': bucket-owner-full-control

Selective Resource Recording

ConfigurationRecorder:
 Type: AWS::Config::ConfigurationRecorder
 Properties:
 Name: selective-recorder
 RoleARN: !GetAtt ConfigRole.Arn
 RecordingGroup:
 AllSupported: false
 IncludeGlobalResourceTypes: false
 ResourceTypes:
 - AWS::EC2::Instance
 - AWS::EC2::SecurityGroup
 - AWS::S3::Bucket
 - AWS::IAM::Role
 - AWS::Lambda::Function
 - AWS::RDS::DBInstance

4. Config Rules

AWS Managed Rules

Resources:
 # Security group rule
 SecurityGroupSSHRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: incoming-ssh-disabled
 Description: Checks whether security groups disallow unrestricted incoming SSH traffic
 Source:
 Owner: AWS
 SourceIdentifier: INCOMING_SSH_DISABLED
 Scope:
 ComplianceResourceTypes:
 - AWS::EC2::SecurityGroup

 # S3 bucket encryption rule
 S3BucketEncryptionRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: s3-bucket-server-side-encryption-enabled
 Description: Checks that S3 buckets have server-side encryption enabled
 Source:
 Owner: AWS
 SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
 Scope:
 ComplianceResourceTypes:
 - AWS::S3::Bucket

 # Root access key rule
 RootAccessKeyRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: root-access-key-check
 Description: Checks whether root access key is available
 Source:
 Owner: AWS
 SourceIdentifier: ROOT_ACCESS_KEY_CHECK
 MaximumExecutionFrequency: Daily

Custom Config Rule with Lambda

import boto3
import json

def lambda_handler(event, context):
 """
 Custom Config rule to check EC2 instance tags
 """
 
 config = boto3.client('config')
 
 # Get the configuration item
 configuration_item = event['configurationItem']
 
 # Check if resource is EC2 instance
 if configuration_item['resourceType'] != 'AWS::EC2::Instance':
 return {
 'compliance_type': 'NOT_APPLICABLE',
 'annotation': 'Rule only applies to EC2 instances'
 }
 
 # Check required tags
 required_tags = ['Environment', 'Owner', 'Project']
 resource_tags = configuration_item.get('tags', {})
 
 missing_tags = []
 for tag in required_tags:
 if tag not in resource_tags:
 missing_tags.append(tag)
 
 if missing_tags:
 compliance_type = 'NON_COMPLIANT'
 annotation = f'Missing required tags: {", ".join(missing_tags)}'
 else:
 compliance_type = 'COMPLIANT'
 annotation = 'All required tags are present'
 
 # Put evaluation result
 evaluation = {
 'ComplianceResourceType': configuration_item['resourceType'],
 'ComplianceResourceId': configuration_item['resourceId'],
 'ComplianceType': compliance_type,
 'Annotation': annotation,
 'OrderingTimestamp': configuration_item['configurationItemCaptureTime']
 }
 
 config.put_evaluations(
 Evaluations=[evaluation],
 ResultToken=event['resultToken']
 )
 
 return {
 'statusCode': 200,
 'body': json.dumps('Evaluation completed')
 }

# CloudFormation template for custom rule
CustomTagRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: ec2-required-tags
 Description: Checks if EC2 instances have required tags
 Source:
 Owner: AWS_LAMBDA
 SourceIdentifier: !GetAtt CustomTagRuleFunction.Arn
 SourceDetails:
 - EventSource: aws.config
 MessageType: ConfigurationItemChangeNotification
 MaximumExecutionFrequency: Daily
 Scope:
 ComplianceResourceTypes:
 - AWS::EC2::Instance

5. Remediation Configuration

Automatic Remediation

Resources:
 # Remediation for non-compliant S3 buckets
 S3EncryptionRemediation:
 Type: AWS::Config::RemediationConfiguration
 Properties:
 ConfigRuleName: !Ref S3BucketEncryptionRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-EnableS3BucketDefaultEncryption
 TargetVersion: '1'
 Parameters:
 AutomationAssumeRole:
 StaticValue: !GetAtt RemediationRole.Arn
 BucketName:
 ResourceValue: RESOURCE_ID
 SSEAlgorithm:
 StaticValue: AES256
 Automatic: true
 MaximumAutomaticAttempts: 3

 # Remediation for security group rules
 SecurityGroupRemediation:
 Type: AWS::Config::RemediationConfiguration
 Properties:
 ConfigRuleName: !Ref SecurityGroupSSHRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-RemoveUnrestrictedSourceInSecurityGroup
 TargetVersion: '1'
 Parameters:
 AutomationAssumeRole:
 StaticValue: !GetAtt RemediationRole.Arn
 GroupId:
 ResourceValue: RESOURCE_ID
 IpProtocol:
 StaticValue: tcp
 FromPort:
 StaticValue: '22'
 ToPort:
 StaticValue: '22'
 Automatic: false # Manual approval required

 RemediationRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: ssm.amazonaws.com
 Action: sts:AssumeRole
 Policies:
 - PolicyName: RemediationPolicy
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - s3:PutEncryptionConfiguration
 - ec2:AuthorizeSecurityGroupIngress
 - ec2:RevokeSecurityGroupIngress
 - ec2:DescribeSecurityGroups
 Resource: '*'

Custom Remediation with Lambda

def lambda_handler(event, context):
 """
 Custom remediation for non-compliant resources
 """
 
 # Parse SSM automation event
 resource_id = event['ResourceId']
 resource_type = event['ResourceType']
 
 if resource_type == 'AWS::EC2::Instance':
 remediate_ec2_instance(resource_id)
 elif resource_type == 'AWS::S3::Bucket':
 remediate_s3_bucket(resource_id)
 
 return {
 'statusCode': 200,
 'body': json.dumps('Remediation completed')
 }

def remediate_ec2_instance(instance_id):
 """Remediate non-compliant EC2 instance"""
 
 ec2 = boto3.client('ec2')
 
 # Add required tags
 ec2.create_tags(
 Resources=[instance_id],
 Tags=[
 {'Key': 'Environment', 'Value': 'Unknown'},
 {'Key': 'Owner', 'Value': 'AutoRemediation'},
 {'Key': 'Project', 'Value': 'Compliance'}
 ]
 )
 
 print(f"Added compliance tags to instance {instance_id}")

def remediate_s3_bucket(bucket_name):
 """Remediate non-compliant S3 bucket"""
 
 s3 = boto3.client('s3')
 
 # Enable default encryption
 s3.put_bucket_encryption(
 Bucket=bucket_name,
 ServerSideEncryptionConfiguration={
 'Rules': [
 {
 'ApplyServerSideEncryptionByDefault': {
 'SSEAlgorithm': 'AES256'
 }
 }
 ]
 }
 )
 
 print(f"Enabled encryption for bucket {bucket_name}")

6. Multi-Account Configuration

Config Aggregator

Resources:
 ConfigAggregator:
 Type: AWS::Config::ConfigurationAggregator
 Properties:
 ConfigurationAggregatorName: OrganizationAggregator
 OrganizationAggregationSource:
 RoleArn: !GetAtt AggregatorRole.Arn
 AwsRegions:
 - us-east-1
 - us-west-2
 - eu-west-1
 AllAwsRegions: false

 AggregatorRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: config.amazonaws.com
 Action: sts:AssumeRole
 ManagedPolicyArns:
 - arn:aws:iam::aws:policy/service-role/ConfigRole
 Policies:
 - PolicyName: OrganizationAccess
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - organizations:DescribeOrganization
 - organizations:ListAccounts
 - organizations:ListAWSServiceAccessForOrganization
 Resource: '*'

Cross-Account Authorization

# In member accounts
ConfigAuthorizationRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 AWS: arn:aws:iam::MASTER-ACCOUNT-ID:root
 Action: sts:AssumeRole
 ManagedPolicyArns:
 - arn:aws:iam::aws:policy/service-role/ConfigRole

# CLI command to authorize aggregator
aws configservice put-aggregation-authorization \
 --authorized-account-id MASTER-ACCOUNT-ID \
 --authorized-aws-region us-east-1

7. CI/CD Integration

Config Rules in CI/CD Pipeline

- Name: ComplianceCheck
 Actions:
 - Name: ConfigComplianceGate
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: 1
 Configuration:
 FunctionName: ConfigComplianceChecker
 UserParameters: |
 {
 "required_rules": [
 "s3-bucket-server-side-encryption-enabled",
 "incoming-ssh-disabled",
 "ec2-required-tags"
 ],
 "compliance_threshold": 95
 }
 InputArtifacts:
 - Name: DeploymentOutput

Compliance Gate Lambda

def lambda_handler(event, context):
 """
 Check Config compliance before allowing deployment
 """
 
 codepipeline = boto3.client('codepipeline')
 config = boto3.client('config')
 
 job_id = event['CodePipeline.job']['id']
 user_parameters = json.loads(
 event['CodePipeline.job']['data']['actionConfiguration']['configuration']['UserParameters']
 )
 
 try:
 required_rules = user_parameters['required_rules']
 threshold = user_parameters.get('compliance_threshold', 100)
 
 # Check compliance for each rule
 compliance_results = []
 
 for rule_name in required_rules:
 response = config.get_compliance_details_by_config_rule(
 ConfigRuleName=rule_name
 )
 
 total_resources = len(response['EvaluationResults'])
 compliant_resources = len([
 r for r in response['EvaluationResults'] 
 if r['ComplianceType'] == 'COMPLIANT'
 ])
 
 compliance_percentage = (compliant_resources / total_resources * 100) if total_resources > 0 else 100
 
 compliance_results.append({
 'rule': rule_name,
 'compliance_percentage': compliance_percentage,
 'compliant_resources': compliant_resources,
 'total_resources': total_resources
 })
 
 # Calculate overall compliance
 overall_compliance = sum(r['compliance_percentage'] for r in compliance_results) / len(compliance_results)
 
 if overall_compliance >= threshold:
 codepipeline.put_job_success_result(
 jobId=job_id,
 outputVariables={
 'CompliancePercentage': str(overall_compliance),
 'ComplianceStatus': 'PASSED'
 }
 )
 else:
 failure_details = f"Compliance {overall_compliance:.1f}% below threshold {threshold}%"
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': failure_details}
 )
 
 except Exception as e:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': str(e)}
 )

8. Common Exam Scenarios

Scenario 1: Implement organization-wide compliance monitoring

Solution:

AWS Config

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

Key Characteristics

Configuration recording - Tracks resource configuration changes over time
Compliance monitoring - Evaluates resources against configuration rules
Change tracking - Historical view of configuration changes
Automated remediation - Automatic correction of non-compliant resources
Multi-account aggregation - Centralized compliance across accounts
Integration - Works with CloudTrail, CloudWatch, SNS, Lambda
Inventory management - Complete inventory of AWS resources

What Problem Does It Solve?

Provides visibility into resource configurations and changes
Enables compliance monitoring and governance
Facilitates security analysis and troubleshooting
Supports change management and audit requirements
Automates compliance remediation
Enables configuration drift detection

2. Core Components

Configuration Recorder

{
 "name": "default",
 "roleARN": "arn:aws:iam::123456789012:role/config-role",
 "recordingGroup": {
 "allSupported": true,
 "includeGlobalResourceTypes": true,
 "resourceTypes": []
 }
}

Delivery Channel

{
 "name": "default",
 "s3BucketName": "config-bucket-123456789012",
 "s3KeyPrefix": "config",
 "snsTopicARN": "arn:aws:sns:us-east-1:123456789012:config-topic",
 "configSnapshotDeliveryProperties": {
 "deliveryFrequency": "TwentyFour_Hours"
 }
}

Configuration Items

{
 "version": "1.3",
 "accountId": "123456789012",
 "configurationItemCaptureTime": "2023-01-15T12:00:00.000Z",
 "configurationItemStatus": "ResourceDiscovered",
 "configurationStateId": "1642248000000",
 "resourceType": "AWS::EC2::Instance",
 "resourceId": "i-1234567890abcdef0",
 "resourceName": "MyInstance",
 "ARN": "arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0",
 "awsRegion": "us-east-1",
 "availabilityZone": "us-east-1a",
 "resourceCreationTime": "2023-01-15T10:00:00.000Z",
 "tags": {
 "Environment": "Production",
 "Owner": "TeamA"
 },
 "configuration": {
 "instanceId": "i-1234567890abcdef0",
 "imageId": "ami-0abcdef1234567890",
 "state": {
 "code": 16,
 "name": "running"
 },
 "privateDnsName": "ip-10-0-1-100.ec2.internal",
 "publicDnsName": "ec2-54-123-45-67.compute-1.amazonaws.com",
 "instanceType": "t3.medium",
 "keyName": "my-key-pair",
 "securityGroups": [
 {
 "groupName": "default",
 "groupId": "sg-12345678"
 }
 ],
 "subnetId": "subnet-12345678",
 "vpcId": "vpc-12345678"
 }
}

3. Config Rules

AWS Managed Rules

# CloudFormation template for Config rules
Resources:
 # Check if EC2 instances are in VPC
 EC2InstancesInVPCRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: ec2-instances-in-vpc
 Description: Checks whether EC2 instances are in a VPC
 Source:
 Owner: AWS
 SourceIdentifier: INSTANCES_IN_VPC
 DependsOn: ConfigurationRecorder

 # Check if S3 buckets are publicly readable
 S3BucketPublicReadProhibitedRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: s3-bucket-public-read-prohibited
 Description: Checks that S3 buckets do not allow public read access
 Source:
 Owner: AWS
 SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
 DependsOn: ConfigurationRecorder

 # Check if RDS instances have backup enabled
 RDSBackupEnabledRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: rds-backup-enabled
 Description: Checks whether RDS DB instances have backups enabled
 Source:
 Owner: AWS
 SourceIdentifier: DB_INSTANCE_BACKUP_ENABLED
 InputParameters: |
 {
 "backupRetentionPeriod": "7"
 }
 DependsOn: ConfigurationRecorder

 # Check if security groups allow unrestricted SSH
 SecurityGroupSSHRestrictedRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: incoming-ssh-disabled
 Description: Checks whether security groups disallow unrestricted incoming SSH traffic
 Source:
 Owner: AWS
 SourceIdentifier: INCOMING_SSH_DISABLED
 DependsOn: ConfigurationRecorder

Custom Config Rules

# Lambda function for custom Config rule
import boto3
import json

def lambda_handler(event, context):
 """
 Custom Config rule to check if EC2 instances have required tags
 """
 
 # Get the configuration item
 config_item = event['configurationItem']
 
 # Check if this is an EC2 instance
 if config_item['resourceType'] != 'AWS::EC2::Instance':
 return {
 'compliance_type': 'NOT_APPLICABLE',
 'annotation': 'Rule only applies to EC2 instances'
 }
 
 # Required tags
 required_tags = ['Environment', 'Owner', 'Project']
 
 # Get instance tags
 instance_tags = config_item.get('tags', {})
 
 # Check if all required tags are present
 missing_tags = []
 for tag in required_tags:
 if tag not in instance_tags:
 missing_tags.append(tag)
 
 if missing_tags:
 return {
 'compliance_type': 'NON_COMPLIANT',
 'annotation': f'Missing required tags: {", ".join(missing_tags)}'
 }
 else:
 return {
 'compliance_type': 'COMPLIANT',
 'annotation': 'All required tags are present'
 }

# CloudFormation template for custom rule
Resources:
 CustomConfigRuleFunction:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: custom-config-rule-required-tags
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt ConfigRuleLambdaRole.Arn
 Code:
 ZipFile: |
 # Lambda function code here

 CustomConfigRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: ec2-required-tags
 Description: Checks if EC2 instances have required tags
 Source:
 Owner: AWS_LAMBDA
 SourceIdentifier: !GetAtt CustomConfigRuleFunction.Arn
 SourceDetail:
 - EventSource: aws.config
 MessageType: ConfigurationItemChangeNotification
 - EventSource: aws.config
 MessageType: OversizedConfigurationItemChangeNotification
 DependsOn: ConfigurationRecorder

 ConfigRulePermission:
 Type: AWS::Lambda::Permission
 Properties:
 FunctionName: !Ref CustomConfigRuleFunction
 Action: lambda:InvokeFunction
 Principal: config.amazonaws.com

4. Remediation Actions

Automatic Remediation

Resources:
 # Remediation configuration for S3 bucket encryption
 S3BucketEncryptionRemediation:
 Type: AWS::Config::RemediationConfiguration
 Properties:
 ConfigRuleName: !Ref S3BucketServerSideEncryptionEnabledRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-EnableS3BucketDefaultEncryption
 TargetVersion: "1"
 Parameters:
 AutomationAssumeRole:
 StaticValue: !GetAtt RemediationRole.Arn
 BucketName:
 ResourceValue: RESOURCE_ID
 SSEAlgorithm:
 StaticValue: AES256
 Automatic: true
 MaximumAutomaticAttempts: 3

 # Remediation for security group with unrestricted SSH
 SecurityGroupSSHRemediation:
 Type: AWS::Config::RemediationConfiguration
 Properties:
 ConfigRuleName: !Ref SecurityGroupSSHRestrictedRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-RemoveUnrestrictedSourceInSecurityGroup
 TargetVersion: "1"
 Parameters:
 AutomationAssumeRole:
 StaticValue: !GetAtt RemediationRole.Arn
 GroupId:
 ResourceValue: RESOURCE_ID
 IpProtocol:
 StaticValue: tcp
 FromPort:
 StaticValue: "22"
 ToPort:
 StaticValue: "22"
 Automatic: true
 MaximumAutomaticAttempts: 2

 # Custom remediation using Lambda
 CustomRemediationFunction:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: custom-config-remediation
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt RemediationLambdaRole.Arn
 Code:
 ZipFile: |
 import boto3
 import json
 
 def lambda_handler(event, context):
 """Custom remediation function"""
 
 # Get resource information from Config
 resource_id = event['configurationItem']['resourceId']
 resource_type = event['configurationItem']['resourceType']
 
 if resource_type == 'AWS::EC2::Instance':
 ec2 = boto3.client('ec2')
 
 # Add required tags to EC2 instance
 ec2.create_tags(
 Resources=[resource_id],
 Tags=[
 {'Key': 'ComplianceStatus', 'Value': 'Remediated'},
 {'Key': 'RemediationDate', 'Value': str(datetime.now())}
 ]
 )
 
 return {
 'statusCode': 200,
 'body': json.dumps('Remediation completed')
 }

Manual Remediation Workflow

# Lambda function for manual remediation workflow
import boto3
import json

def lambda_handler(event, context):
 """
 Creates remediation tickets for non-compliant resources
 """
 
 # Parse Config rule evaluation result
 config_item = event['configurationItem']
 compliance_type = event['newEvaluationResult']['complianceType']
 
 if compliance_type == 'NON_COMPLIANT':
 # Create ServiceNow ticket or send notification
 sns = boto3.client('sns')
 
 message = {
 'resource_id': config_item['resourceId'],
 'resource_type': config_item['resourceType'],
 'compliance_issue': event['newEvaluationResult']['annotation'],
 'account_id': config_item['accountId'],
 'region': config_item['awsRegion']
 }
 
 sns.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:compliance-alerts',
 Message=json.dumps(message),
 Subject=f'Compliance Issue: {config_item["resourceType"]} {config_item["resourceId"]}'
 )
 
 return {
 'statusCode': 200,
 'body': json.dumps('Notification sent')
 }

5. Multi-Account Configuration

Organization Config Setup

# Master account setup
Resources:
 ConfigurationAggregator:
 Type: AWS::Config::ConfigurationAggregator
 Properties:
 ConfigurationAggregatorName: OrganizationConfigAggregator
 OrganizationAggregationSource:
 RoleArn: !GetAtt AggregatorRole.Arn
 AllAwsRegions: true

 # Organizational Config rules
 OrganizationalConfigRule:
 Type: AWS::Config::OrganizationConfigRule
 Properties:
 OrganizationConfigRuleName: s3-bucket-ssl-requests-only
 OrganizationManagedRuleMetadata:
 RuleIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY
 Description: Checks whether S3 buckets have policies that require SSL requests
 ExcludedAccounts:
 - "111111111111" # Exclude specific accounts if needed

 # Organizational remediation
 OrganizationalRemediationConfiguration:
 Type: AWS::Config::OrganizationRemediationConfiguration
 Properties:
 OrganizationConfigRuleName: !Ref OrganizationalConfigRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-EnableS3BucketSSLRequestsOnly
 TargetVersion: "1"
 Parameters:
 AutomationAssumeRole:
 StaticValue: !Sub "arn:aws:iam::{account}:role/ConfigRemediationRole"
 BucketName:
 ResourceValue: RESOURCE_ID
 Automatic: false
 MaximumAutomaticAttempts: 1

Cross-Account Access

# Member account role for Config aggregation
Resources:
 ConfigAggregationRole:
 Type: AWS::IAM::Role
 Properties:
 RoleName: ConfigAggregationRole
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 AWS: !Sub "arn:aws:iam::${MasterAccountId}:root"
 Action: sts:AssumeRole
 Condition:
 StringEquals:
 'sts:ExternalId': !Ref ExternalId
 ManagedPolicyArns:
 - arn:aws:iam::aws:policy/service-role/ConfigRole
 Policies:
 - PolicyName: ConfigAggregationPolicy
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - config:GetComplianceDetailsByConfigRule
 - config:GetComplianceDetailsByResource
 - config:ListDiscoveredResources
 - config:GetResourceConfigHistory
 Resource: '*'

6. Config with CI/CD Integration

Compliance Gates in Pipeline

# Lambda function for pipeline compliance check
import boto3
import json

def lambda_handler(event, context):
 """
 Check Config compliance before deployment
 """
 
 config_client = boto3.client('config')
 codepipeline = boto3.client('codepipeline')
 
 # Get job details from CodePipeline
 job_id = event['CodePipeline.job']['id']
 
 try:
 # Check compliance for critical rules
 critical_rules = [
 's3-bucket-public-read-prohibited',
 'incoming-ssh-disabled',
 'rds-backup-enabled'
 ]
 
 non_compliant_resources = []
 
 for rule_name in critical_rules:
 response = config_client.get_compliance_details_by_config_rule(
 ConfigRuleName=rule_name,
 ComplianceTypes=['NON_COMPLIANT']
 )
 
 if response['EvaluationResults']:
 non_compliant_resources.extend(response['EvaluationResults'])
 
 if non_compliant_resources:
 # Fail the pipeline
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={
 'message': f'Found {len(non_compliant_resources)} non-compliant resources',
 'type': 'JobFailed'
 }
 )
 else:
 # Continue the pipeline
 codepipeline.put_job_success_result(jobId=job_id)
 
 except Exception as e:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={
 'message': str(e),
 'type': 'JobFailed'
 }
 )
 
 return {
 'statusCode': 200,
 'body': json.dumps('Compliance check completed')
 }

Infrastructure Compliance Validation

# CodeBuild project for Config compliance validation
Resources:
 ComplianceValidationProject:
 Type: AWS::CodeBuild::Project
 Properties:
 Name: config-compliance-validation
 ServiceRole: !GetAtt CodeBuildRole.Arn
 Artifacts:
 Type: CODEPIPELINE
 Environment:
 Type: LINUX_CONTAINER
 ComputeType: BUILD_GENERAL1_SMALL
 Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0
 Source:
 Type: CODEPIPELINE
 BuildSpec: |
 version: 0.2
 phases:
 install:
 runtime-versions:
 python: 3.9
 commands:
 - pip install boto3
 pre_build:
 commands:
 - echo "Starting compliance validation..."
 build:
 commands:
 - python compliance_check.py
 post_build:
 commands:
 - echo "Compliance validation completed"

7. Config API and CLI

Common CLI Commands

# Start configuration recorder
aws configservice start-configuration-recorder --configuration-recorder-name default

# Stop configuration recorder
aws configservice stop-configuration-recorder --configuration-recorder-name default

# Get configuration recorder status
aws configservice describe-configuration-recorder-status

# Get compliance by config rule
aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-public-read-prohibited

# Get compliance by resource
aws configservice get-compliance-details-by-resource --resource-type AWS::S3::Bucket --resource-id my-bucket

# List discovered resources
aws configservice list-discovered-resources --resource-type AWS::EC2::Instance

# Get resource config history
aws configservice get-resource-config-history --resource-type AWS::EC2::Instance --resource-id i-1234567890abcdef0

# Deliver configuration snapshot
aws configservice deliver-config-snapshot --delivery-channel-name default

# Put evaluations (for custom rules)
aws configservice put-evaluations --evaluations file://evaluations.json --result-token <token>

Programmatic Access

import boto3
from datetime import datetime, timedelta

def get_compliance_summary():
 """Get compliance summary across all rules"""
 
 config_client = boto3.client('config')
 
 # Get compliance summary
 response = config_client.get_compliance_summary_by_config_rule()
 
 summary = {
 'compliant': response['ComplianceSummary']['CompliantResourceCount']['CappedCount'],
 'non_compliant': response['ComplianceSummary']['NonCompliantResourceCount']['CappedCount'],
 'not_applicable': response['ComplianceSummary']['NotApplicableResourceCount']['CappedCount']
 }
 
 return summary

def get_configuration_changes(resource_type, hours=24):
 """Get configuration changes for a resource type in the last N hours"""
 
 config_client = boto3.client('config')
 
 end_time = datetime.utcnow()
 start_time = end_time - timedelta(hours=hours)
 
 # List resources
 resources = config_client.list_discovered_resources(
 resourceType=resource_type
 )
 
 changes = []
 
 for resource in resources['resourceIdentifiers']:
 # Get configuration history
 history = config_client.get_resource_config_history(
 resourceType=resource_type,
 resourceId=resource['resourceId'],
 laterTime=end_time,
 earlierTime=start_time
 )
 
 if history['configurationItems']:
 changes.extend(history['configurationItems'])
 
 return changes

def remediate_non_compliant_resources(rule_name):
 """Trigger remediation for non-compliant resources"""
 
 config_client = boto3.client('config')
 
 # Get non-compliant resources
 response = config_client.get_compliance_details_by_config_rule(
 ConfigRuleName=rule_name,
 ComplianceTypes=['NON_COMPLIANT']
 )
 
 resource_keys = []
 for evaluation in response['EvaluationResults']:
 resource_keys.append({
 'resourceType': evaluation['EvaluationResultIdentifier']['EvaluationResultQualifier']['ResourceType'],
 'resourceId': evaluation['EvaluationResultIdentifier']['EvaluationResultQualifier']['ResourceId']
 })
 
 if resource_keys:
 # Start remediation
 config_client.start_remediation_execution(
 ConfigRuleName=rule_name,
 ResourceKeys=resource_keys
 )
 
 return len(resource_keys)

8. Common Exam Scenarios

Scenario 1: Compliance Monitoring Setup

# Complete Config setup for compliance monitoring
Resources:
 # S3 bucket for Config
 ConfigBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: !Sub "config-bucket-${AWS::AccountId}-${AWS::Region}"
 BucketEncryption:
 ServerSideEncryptionConfiguration:
 - ServerSideEncryptionByDefault:
 SSEAlgorithm: AES256

 # Config service role
 ConfigRole:
 Type: AWS::IAM::ServiceLinkedRole
 Properties:
 AWSServiceName: config.amazonaws.com

 # Configuration recorder
 ConfigurationRecorder:
 Type: AWS::Config::ConfigurationRecorder
 Properties:
 Name: default
 RoleARN: !Sub "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig"
 RecordingGroup:
 AllSupported: true
 IncludeGlobalResourceTypes: true

 # Delivery channel
 DeliveryChannel:
 Type: AWS::Config::DeliveryChannel
 Properties:
 Name: default
 S3BucketName: !Ref ConfigBucket
 ConfigSnapshotDeliveryProperties:
 DeliveryFrequency: TwentyFour_Hours

 # Essential compliance rules
 S3BucketPublicAccessProhibited:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: s3-bucket-public-access-prohibited
 Source:
 Owner: AWS
 SourceIdentifier: S3_BUCKET_PUBLIC_ACCESS_PROHIBITED
 DependsOn: ConfigurationRecorder

 EC2SecurityGroupAttachedToENI:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: ec2-security-group-attached-to-eni
 Source:
 Owner: AWS
 SourceIdentifier: EC2_SECURITY_GROUP_ATTACHED_TO_ENI
 DependsOn: ConfigurationRecorder

Scenario 2: Automated Remediation Pipeline

# Complete automated remediation workflow
import boto3
import json
from datetime import datetime

class ConfigRemediationOrchestrator:
 def __init__(self):
 self.config_client = boto3.client('config')
 self.ssm_client = boto3.client('ssm')
 self.sns_client = boto3.client('sns')
 
 def lambda_handler(self, event, context):
 """Main handler for Config rule evaluation changes"""
 
 # Parse the Config evaluation result
 config_item = event['configurationItem']
 evaluation_result = event.get('newEvaluationResult', {})
 
 if evaluation_result.get('complianceType') == 'NON_COMPLIANT':
 return self.handle_non_compliance(config_item, evaluation_result)
 
 return {'statusCode': 200, 'body': 'No action required'}
 
 def handle_non_compliance(self, config_item, evaluation_result):
 """Handle non-compliant resources"""
 
 resource_type = config_item['resourceType']
 resource_id = config_item['resourceId']
 rule_name = evaluation_result.get('configRuleName', '')
 
 # Define remediation actions
 remediation_actions = {
 'AWS::S3::Bucket': {
 's3-bucket-public-read-prohibited': self.remediate_s3_public_access,
 's3-bucket-ssl-requests-only': self.remediate_s3_ssl_policy
 },
 'AWS::EC2::SecurityGroup': {
 'incoming-ssh-disabled': self.remediate_security_group_ssh
 },
 'AWS::EC2::Instance': {
 'ec2-instance-managed-by-systems-manager': self.remediate_ssm_agent
 }
 }
 
 # Execute remediation if available
 if resource_type in remediation_actions and rule_name in remediation_actions[resource_type]:
 try:
 result = remediation_actions[resource_type]rule_name
 self.send_notification(resource_id, rule_name, 'SUCCESS', result)
 return {'statusCode': 200, 'body': f'Remediation successful: {result}'}
 except Exception as e:
 self.send_notification(resource_id, rule_name, 'FAILED', str(e))
 return {'statusCode': 500, 'body': f'Remediation failed: {str(e)}'}
 else:
 # Manual remediation required
 self.create_manual_remediation_ticket(resource_id, resource_type, rule_name)
 return {'statusCode': 200, 'body': 'Manual remediation ticket created'}
 
 def remediate_s3_public_access(self, bucket_name, config_item):
 """Remove public access from S3 bucket"""
 s3_client = boto3.client('s3')
 
 # Block public access
 s3_client.put_public_access_block(
 Bucket=bucket_name,
 PublicAccessBlockConfiguration={
 'BlockPublicAcls': True,
 'IgnorePublicAcls': True,
 'BlockPublicPolicy': True,
 'RestrictPublicBuckets': True
 }
 )
 
 return f'Public access blocked for bucket {bucket_name}'
 
 def remediate_security_group_ssh(self, sg_id, config_item):
 """Remove unrestricted SSH access from security group"""
 ec2_client = boto3.client('ec2')
 
 # Revoke unrestricted SSH access
 ec2_client.revoke_security_group_ingress(
 GroupId=sg_id,
 IpPermissions=[
 {
 'IpProtocol': 'tcp',
 'FromPort': 22,
 'ToPort': 22,
 'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
 }
 ]
 )
 
 return f'Removed unrestricted SSH access from security group {sg_id}'
 
 def send_notification(self, resource_id, rule_name, status, details):
 """Send remediation notification"""
 message = {
 'timestamp': datetime.utcnow().isoformat(),
 'resource_id': resource_id,
 'rule_name': rule_name,
 'remediation_status': status,
 'details': details
 }
 
 self.sns_client.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:config-remediation',
 Message=json.dumps(message),
 Subject=f'Config Remediation {status}: {resource_id}'
 )

9. Exam Tips

Understand Config components - Recorder, delivery channel, rules, remediation
Know rule types - AWS managed vs custom Lambda-based rules
Master remediation - Automatic vs manual remediation workflows
Practice multi-account - Organization Config and aggregation
Learn integration patterns - Config with CloudTrail, CloudWatch, SNS
Understand compliance - Evaluation results and compliance types
Know API operations - Key CLI commands and programmatic access
Practice troubleshooting - Common Config setup and rule issues
Understand costs - Configuration items, rule evaluations, remediation costs
Master CI/CD integration - Compliance gates and infrastructure validation

AWS Control Tower

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS Control Tower provides an easy way to set up and govern a secure, multi-account AWS environment based on best practices established through AWS’s experience working with thousands of enterprises.

Key Characteristics

Landing Zone - Pre-configured multi-account environment
Guardrails - Preventive and detective controls for governance
Account Factory - Automated account provisioning and configuration
Dashboard - Centralized visibility and compliance monitoring
Service Catalog integration - Self-service account provisioning
Organizations integration - Built on AWS Organizations foundation
Config integration - Continuous compliance monitoring
CloudTrail integration - Centralized logging and auditing

What Problem Does It Solve?

Simplifies multi-account AWS environment setup and governance
Enforces security and compliance policies across accounts
Provides centralized visibility and control
Automates account provisioning with consistent configuration
Reduces operational overhead for managing multiple accounts
Ensures adherence to AWS best practices and compliance requirements

2. Core Components

Landing Zone

# Landing Zone automatically creates:
# 1. Root Organization Unit (OU)
# 2. Security OU (for shared security accounts)
# 3. Sandbox OU (for development/testing accounts)
# 4. Log Archive Account (centralized logging)
# 5. Audit Account (security and compliance monitoring)

# Example OU structure after Control Tower setup:
Root
├── Security OU
│ ├── Log Archive Account
│ └── Audit Account
├── Sandbox OU
│ ├── Development Account 1
│ ├── Development Account 2
│ └── Testing Account
└── Production OU (custom)
 ├── Production Account 1
 └── Production Account 2

Guardrails

{
 "preventiveGuardrails": [
 {
 "name": "Disallow policy changes to log archive",
 "description": "Prevents modification of CloudTrail logs in log archive account",
 "severity": "Mandatory",
 "implementation": "SCP (Service Control Policy)"
 },
 {
 "name": "Disallow changes to encryption configuration for log archive",
 "description": "Prevents changes to S3 bucket encryption in log archive",
 "severity": "Mandatory",
 "implementation": "SCP"
 },
 {
 "name": "Disallow configuration changes to CloudTrail",
 "description": "Prevents unauthorized changes to CloudTrail configuration",
 "severity": "Mandatory",
 "implementation": "SCP"
 }
 ],
 "detectiveGuardrails": [
 {
 "name": "Detect whether public read access to Amazon S3 buckets is allowed",
 "description": "Monitors S3 buckets for public read access",
 "severity": "Strongly Recommended",
 "implementation": "AWS Config Rule"
 },
 {
 "name": "Detect whether public write access to Amazon S3 buckets is allowed",
 "description": "Monitors S3 buckets for public write access",
 "severity": "Strongly Recommended",
 "implementation": "AWS Config Rule"
 },
 {
 "name": "Detect whether MFA for the root user is enabled",
 "description": "Checks if MFA is enabled for root user",
 "severity": "Strongly Recommended",
 "implementation": "AWS Config Rule"
 }
 ]
}

Account Factory

# Account Factory creates accounts with:
# 1. Baseline security configuration
# 2. Guardrails applied
# 3. CloudTrail logging enabled
# 4. Config recording enabled
# 5. Cross-account access roles

# Example Account Factory configuration
AccountFactoryConfiguration:
 AccountEmail: "new-account@company.com"
 AccountName: "Production-WebApp"
 OrganizationalUnit: "Production OU"
 SSOUserEmail: "admin@company.com"
 SSOUserFirstName: "Admin"
 SSOUserLastName: "User"
 ManagedOrganizationalUnit: "Production OU"
 
 # Baseline configuration applied:
 BaselineConfiguration:
 - CloudTrail: Enabled
 - Config: Enabled
 - GuardrailsApplied: All mandatory + selected optional
 - CrossAccountRoles:
 - AWSControlTowerExecution
 - OrganizationAccountAccessRole

3. Guardrails Implementation

Service Control Policies (SCPs)

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "PreventCloudTrailDisabling",
 "Effect": "Deny",
 "Action": [
 "cloudtrail:StopLogging",
 "cloudtrail:DeleteTrail",
 "cloudtrail:PutEventSelectors"
 ],
 "Resource": "*",
 "Condition": {
 "StringNotEquals": {
 "aws:PrincipalArn": [
 "arn:aws:iam::*:role/AWSControlTowerExecution"
 ]
 }
 }
 },
 {
 "Sid": "PreventConfigDisabling",
 "Effect": "Deny",
 "Action": [
 "config:StopConfigurationRecorder",
 "config:DeleteConfigurationRecorder",
 "config:DeleteDeliveryChannel"
 ],
 "Resource": "*",
 "Condition": {
 "StringNotEquals": {
 "aws:PrincipalArn": [
 "arn:aws:iam::*:role/AWSControlTowerExecution"
 ]
 }
 }
 },
 {
 "Sid": "PreventLogArchiveModification",
 "Effect": "Deny",
 "Action": [
 "s3:DeleteBucket",
 "s3:DeleteBucketPolicy",
 "s3:PutBucketPolicy"
 ],
 "Resource": [
 "arn:aws:s3:::aws-controltower-logs-*",
 "arn:aws:s3:::aws-controltower-s3-access-logs-*"
 ],
 "Condition": {
 "StringNotEquals": {
 "aws:PrincipalArn": [
 "arn:aws:iam::*:role/AWSControlTowerExecution"
 ]
 }
 }
 }
 ]
}

Config Rules for Detective Guardrails

# CloudFormation template for custom guardrails
Resources:
 # Custom detective guardrail for EC2 instance compliance
 EC2InstanceComplianceRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: ct-ec2-instance-compliance
 Description: Detect non-compliant EC2 instances
 Source:
 Owner: AWS_LAMBDA
 SourceIdentifier: !GetAtt ComplianceFunction.Arn
 SourceDetail:
 - EventSource: aws.config
 MessageType: ConfigurationItemChangeNotification
 MaximumExecutionFrequency: TwentyFour_Hours

 ComplianceFunction:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: ct-ec2-compliance-check
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt ComplianceFunctionRole.Arn
 Code:
 ZipFile: |
 import boto3
 import json
 
 def lambda_handler(event, context):
 config_item = event['configurationItem']
 
 if config_item['resourceType'] != 'AWS::EC2::Instance':
 return {
 'compliance_type': 'NOT_APPLICABLE',
 'annotation': 'Rule only applies to EC2 instances'
 }
 
 # Check required tags
 required_tags = ['Environment', 'Owner', 'CostCenter']
 instance_tags = config_item.get('tags', {})
 
 missing_tags = [tag for tag in required_tags if tag not in instance_tags]
 
 if missing_tags:
 return {
 'compliance_type': 'NON_COMPLIANT',
 'annotation': f'Missing required tags: {", ".join(missing_tags)}'
 }
 
 # Check instance type restrictions
 allowed_types = ['t3.micro', 't3.small', 't3.medium', 't3.large']
 instance_type = config_item['configuration']['instanceType']
 
 if instance_type not in allowed_types:
 return {
 'compliance_type': 'NON_COMPLIANT',
 'annotation': f'Instance type {instance_type} not allowed'
 }
 
 return {
 'compliance_type': 'COMPLIANT',
 'annotation': 'Instance meets all compliance requirements'
 }

 # Remediation for non-compliant resources
 ComplianceRemediation:
 Type: AWS::Config::RemediationConfiguration
 Properties:
 ConfigRuleName: !Ref EC2InstanceComplianceRule
 TargetType: SSM_DOCUMENT
 TargetId: !Ref RemediationDocument
 TargetVersion: "1"
 Parameters:
 AutomationAssumeRole:
 StaticValue: !GetAtt RemediationRole.Arn
 InstanceId:
 ResourceValue: RESOURCE_ID
 Automatic: false
 MaximumAutomaticAttempts: 1

 RemediationDocument:
 Type: AWS::SSM::Document
 Properties:
 DocumentType: Automation
 DocumentFormat: YAML
 Content:
 schemaVersion: '0.3'
 description: Remediate non-compliant EC2 instances
 assumeRole: '{{ AutomationAssumeRole }}'
 parameters:
 InstanceId:
 type: String
 description: EC2 Instance ID
 AutomationAssumeRole:
 type: String
 description: IAM role for automation
 mainSteps:
 - name: AddComplianceTags
 action: 'aws:executeAwsApi'
 inputs:
 Service: ec2
 Api: CreateTags
 Resources:
 - '{{ InstanceId }}'
 Tags:
 - Key: ComplianceStatus
 Value: Remediated
 - Key: RemediationDate
 Value: '{{ global:DATE_TIME }}'

4. Account Factory Automation

Service Catalog Integration

# Account Factory as Service Catalog product
Resources:
 AccountFactoryPortfolio:
 Type: AWS::ServiceCatalog::Portfolio
 Properties:
 DisplayName: AWS Control Tower Account Factory
 Description: Automated account provisioning with Control Tower
 ProviderName: AWS Control Tower

 AccountFactoryProduct:
 Type: AWS::ServiceCatalog::CloudFormationProduct
 Properties:
 Name: AWS Control Tower Account Factory
 Description: Create new AWS account with Control Tower baseline
 Owner: AWS Control Tower
 ProvisioningArtifactParameters:
 - Name: v1.0
 Description: Account Factory template
 Info:
 LoadTemplateFromURL: !Sub "https://${TemplateBucket}.s3.amazonaws.com/account-factory-template.yaml"

 # Custom account provisioning workflow
 CustomAccountFactory:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: custom-account-factory
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt AccountFactoryRole.Arn
 Code:
 ZipFile: |
 import boto3
 import json
 import time
 
 def lambda_handler(event, context):
 """Custom account factory with additional configuration"""
 
 servicecatalog = boto3.client('servicecatalog')
 organizations = boto3.client('organizations')
 
 # Extract account details from event
 account_name = event['AccountName']
 account_email = event['AccountEmail']
 ou_name = event['OrganizationalUnit']
 
 try:
 # Provision account through Service Catalog
 response = servicecatalog.provision_product(
 ProductId='prod-account-factory',
 ProvisioningArtifactId='pa-latest',
 ProvisionedProductName=f"Account-{account_name}",
 ProvisioningParameters=[
 {'Key': 'AccountName', 'Value': account_name},
 {'Key': 'AccountEmail', 'Value': account_email},
 {'Key': 'OrganizationalUnitName', 'Value': ou_name},
 {'Key': 'SSOUserEmail', 'Value': event.get('SSOUserEmail', account_email)},
 {'Key': 'SSOUserFirstName', 'Value': event.get('SSOUserFirstName', 'Admin')},
 {'Key': 'SSOUserLastName', 'Value': event.get('SSOUserLastName', 'User')}
 ]
 )
 
 record_id = response['RecordDetail']['RecordId']
 
 # Wait for provisioning to complete
 while True:
 record = servicecatalog.describe_record(Id=record_id)
 status = record['RecordDetail']['Status']
 
 if status == 'SUCCEEDED':
 # Get account ID from outputs
 account_id = None
 for output in record['RecordDetail']['RecordOutputs']:
 if output['OutputKey'] == 'AccountId':
 account_id = output['OutputValue']
 break
 
 if account_id:
 # Apply additional configuration
 apply_custom_configuration(account_id, event)
 
 return {
 'statusCode': 200,
 'body': json.dumps({
 'AccountId': account_id,
 'Status': 'SUCCESS'
 })
 }
 
 elif status in ['FAILED', 'ERROR']:
 return {
 'statusCode': 500,
 'body': json.dumps({
 'Status': 'FAILED',
 'Error': record['RecordDetail'].get('RecordErrors', [])
 })
 }
 
 time.sleep(30) # Wait 30 seconds before checking again
 
 except Exception as e:
 return {
 'statusCode': 500,
 'body': json.dumps({
 'Status': 'FAILED',
 'Error': str(e)
 })
 }
 
 def apply_custom_configuration(account_id, config):
 """Apply custom configuration to newly created account"""
 
 # Assume role in target account
 sts = boto3.client('sts')
 assumed_role = sts.assume_role(
 RoleArn=f"arn:aws:iam::{account_id}:role/OrganizationAccountAccessRole",
 RoleSessionName='CustomConfiguration'
 )
 
 # Create session with assumed role credentials
 session = boto3.Session(
 aws_access_key_id=assumed_role['Credentials']['AccessKeyId'],
 aws_secret_access_key=assumed_role['Credentials']['SecretAccessKey'],
 aws_session_token=assumed_role['Credentials']['SessionToken']
 )
 
 # Apply custom configurations
 if config.get('EnableCloudTrail'):
 setup_additional_cloudtrail(session, config)
 
 if config.get('CreateVPC'):
 create_default_vpc(session, config)
 
 if config.get('SetupBudgets'):
 setup_cost_budgets(session, config)

Automated Account Onboarding

# Complete account onboarding workflow
import boto3
import json
from datetime import datetime, timedelta

class ControlTowerAccountManager:
 def __init__(self):
 self.servicecatalog = boto3.client('servicecatalog')
 self.organizations = boto3.client('organizations')
 self.sts = boto3.client('sts')
 self.stepfunctions = boto3.client('stepfunctions')
 
 def create_account_with_workflow(self, account_request):
 """Create account with complete onboarding workflow"""
 
 # Start Step Functions workflow for account creation
 workflow_input = {
 'AccountRequest': account_request,
 'Timestamp': datetime.utcnow().isoformat()
 }
 
 response = self.stepfunctions.start_execution(
 stateMachineArn='arn:aws:states:us-east-1:123456789012:stateMachine:AccountOnboarding',
 name=f"account-{account_request['AccountName']}-{int(time.time())}",
 input=json.dumps(workflow_input)
 )
 
 return response['executionArn']
 
 def provision_account_factory(self, account_details):
 """Provision account through Control Tower Account Factory"""
 
 # Find Account Factory product
 products = self.servicecatalog.search_products(
 Filters={'FullTextSearch': ['AWS Control Tower Account Factory']}
 )
 
 if not products['ProductViewSummaries']:
 raise ValueError("Account Factory product not found")
 
 product = products['ProductViewSummaries'][0]
 
 # Get latest provisioning artifact
 product_details = self.servicecatalog.describe_product(Id=product['ProductId'])
 latest_artifact = product_details['ProvisioningArtifacts'][-1]
 
 # Provision account
 response = self.servicecatalog.provision_product(
 ProductId=product['ProductId'],
 ProvisioningArtifactId=latest_artifact['Id'],
 ProvisionedProductName=f"Account-{account_details['AccountName']}",
 ProvisioningParameters=[
 {'Key': 'AccountName', 'Value': account_details['AccountName']},
 {'Key': 'AccountEmail', 'Value': account_details['AccountEmail']},
 {'Key': 'OrganizationalUnitName', 'Value': account_details['OrganizationalUnit']},
 {'Key': 'SSOUserEmail', 'Value': account_details['SSOUserEmail']},
 {'Key': 'SSOUserFirstName', 'Value': account_details['SSOUserFirstName']},
 {'Key': 'SSOUserLastName', 'Value': account_details['SSOUserLastName']}
 ],
 Tags=[
 {'Key': 'CreatedBy', 'Value': 'ControlTowerAccountManager'},
 {'Key': 'CreationDate', 'Value': datetime.utcnow().isoformat()},
 {'Key': 'Department', 'Value': account_details.get('Department', 'Unknown')}
 ]
 )
 
 return response['RecordDetail']
 
 def setup_account_baseline(self, account_id, baseline_config):
 """Setup baseline configuration for new account"""
 
 # Assume role in target account
 assumed_role = self.sts.assume_role(
 RoleArn=f"arn:aws:iam::{account_id}:role/OrganizationAccountAccessRole",
 RoleSessionName='BaselineSetup'
 )
 
 # Create session with assumed role
 session = boto3.Session(
 aws_access_key_id=assumed_role['Credentials']['AccessKeyId'],
 aws_secret_access_key=assumed_role['Credentials']['SecretAccessKey'],
 aws_session_token=assumed_role['Credentials']['SessionToken']
 )
 
 # Setup baseline components
 results = {}
 
 if baseline_config.get('CreateVPC'):
 results['VPC'] = self.create_baseline_vpc(session, baseline_config['VPC'])
 
 if baseline_config.get('SetupBudgets'):
 results['Budgets'] = self.setup_cost_budgets(session, baseline_config['Budgets'])
 
 if baseline_config.get('CreateRoles'):
 results['Roles'] = self.create_baseline_roles(session, baseline_config['Roles'])
 
 if baseline_config.get('SetupCloudWatch'):
 results['CloudWatch'] = self.setup_cloudwatch_baseline(session, baseline_config['CloudWatch'])
 
 return results
 
 def create_baseline_vpc(self, session, vpc_config):
 """Create baseline VPC configuration"""
 
 ec2 = session.client('ec2')
 
 # Create VPC
 vpc_response = ec2.create_vpc(
 CidrBlock=vpc_config.get('CidrBlock', '10.0.0.0/16'),
 TagSpecifications=[
 {
 'ResourceType': 'vpc',
 'Tags': [
 {'Key': 'Name', 'Value': vpc_config.get('Name', 'BaselineVPC')},
 {'Key': 'CreatedBy', 'Value': 'ControlTowerBaseline'}
 ]
 }
 ]
 )
 
 vpc_id = vpc_response['Vpc']['VpcId']
 
 # Create subnets
 subnets = []
 for i, subnet_config in enumerate(vpc_config.get('Subnets', [])):
 subnet_response = ec2.create_subnet(
 VpcId=vpc_id,
 CidrBlock=subnet_config['CidrBlock'],
 AvailabilityZone=subnet_config['AvailabilityZone'],
 TagSpecifications=[
 {
 'ResourceType': 'subnet',
 'Tags': [
 {'Key': 'Name', 'Value': subnet_config['Name']},
 {'Key': 'Type', 'Value': subnet_config.get('Type', 'Private')}
 ]
 }
 ]
 )
 subnets.append(subnet_response['Subnet']['SubnetId'])
 
 return {
 'VpcId': vpc_id,
 'Subnets': subnets
 }
 
 def setup_cost_budgets(self, session, budget_config):
 """Setup cost budgets for the account"""
 
 budgets = session.client('budgets')
 account_id = session.client('sts').get_caller_identity()['Account']
 
 created_budgets = []
 
 for budget in budget_config:
 budget_definition = {
 'BudgetName': budget['Name'],
 'BudgetLimit': {
 'Amount': str(budget['Amount']),
 'Unit': 'USD'
 },
 'TimeUnit': budget.get('TimeUnit', 'MONTHLY'),
 'BudgetType': budget.get('Type', 'COST'),
 'CostFilters': budget.get('CostFilters', {}),
 'TimePeriod': {
 'Start': datetime.utcnow().replace(day=1),
 'End': datetime.utcnow().replace(day=28) + timedelta(days=4)
 }
 }
 
 # Create budget
 budgets.create_budget(
 AccountId=account_id,
 Budget=budget_definition,
 NotificationsWithSubscribers=[
 {
 'Notification': {
 'NotificationType': 'ACTUAL',
 'ComparisonOperator': 'GREATER_THAN',
 'Threshold': 80.0,
 'ThresholdType': 'PERCENTAGE'
 },
 'Subscribers': [
 {
 'SubscriptionType': 'EMAIL',
 'Address': budget['NotificationEmail']
 }
 ]
 }
 ]
 )
 
 created_budgets.append(budget['Name'])
 
 return created_budgets

# Step Functions state machine for account onboarding
step_functions_definition = {
 "Comment": "Account onboarding workflow",
 "StartAt": "ProvisionAccount",
 "States": {
 "ProvisionAccount": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:provision-account",
 "Next": "WaitForProvisioning"
 },
 "WaitForProvisioning": {
 "Type": "Wait",
 "Seconds": 300,
 "Next": "CheckProvisioningStatus"
 },
 "CheckProvisioningStatus": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:check-provisioning-status",
 "Next": "IsProvisioningComplete"
 },
 "IsProvisioningComplete": {
 "Type": "Choice",
 "Choices": [
 {
 "Variable": "$.Status",
 "StringEquals": "SUCCEEDED",
 "Next": "SetupBaseline"
 },
 {
 "Variable": "$.Status",
 "StringEquals": "FAILED",
 "Next": "ProvisioningFailed"
 }
 ],
 "Default": "WaitForProvisioning"
 },
 "SetupBaseline": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:setup-baseline",
 "Next": "NotifyCompletion"
 },
 "NotifyCompletion": {
 "Type": "Task",
 "Resource": "arn:aws:states:::sns:publish",
 "Parameters": {
 "TopicArn": "arn:aws:sns:us-east-1:123456789012:account-onboarding",
 "Message.$": "$.CompletionMessage"
 },
 "End": True
 },
 "ProvisioningFailed": {
 "Type": "Task",
 "Resource": "arn:aws:states:::sns:publish",
 "Parameters": {
 "TopicArn": "arn:aws:sns:us-east-1:123456789012:account-onboarding-failures",
 "Message.$": "$.ErrorMessage"
 },
 "End": True
 }
 }
}

5. Customization and Extensions

Custom Guardrails

# Custom guardrail for encryption compliance
Resources:
 EncryptionComplianceRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: ct-encryption-compliance
 Description: Ensure all resources use encryption
 Source:
 Owner: AWS_LAMBDA
 SourceIdentifier: !GetAtt EncryptionComplianceFunction.Arn
 SourceDetail:
 - EventSource: aws.config
 MessageType: ConfigurationItemChangeNotification

 EncryptionComplianceFunction:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: ct-encryption-compliance
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt ComplianceFunctionRole.Arn
 Code:
 ZipFile: |
 import boto3
 import json
 
 def lambda_handler(event, context):
 config_item = event['configurationItem']
 resource_type = config_item['resourceType']
 
 # Check encryption for different resource types
 if resource_type == 'AWS::S3::Bucket':
 return check_s3_encryption(config_item)
 elif resource_type == 'AWS::RDS::DBInstance':
 return check_rds_encryption(config_item)
 elif resource_type == 'AWS::EBS::Volume':
 return check_ebs_encryption(config_item)
 else:
 return {
 'compliance_type': 'NOT_APPLICABLE',
 'annotation': f'Encryption check not applicable for {resource_type}'
 }
 
 def check_s3_encryption(config_item):
 """Check S3 bucket encryption"""
 configuration = config_item['configuration']
 
 # Check if bucket has encryption configuration
 if 'serverSideEncryptionConfiguration' in configuration:
 encryption_rules = configuration['serverSideEncryptionConfiguration']['rules']
 if encryption_rules:
 return {
 'compliance_type': 'COMPLIANT',
 'annotation': 'S3 bucket has encryption enabled'
 }
 
 return {
 'compliance_type': 'NON_COMPLIANT',
 'annotation': 'S3 bucket does not have encryption enabled'
 }
 
 def check_rds_encryption(config_item):
 """Check RDS encryption"""
 configuration = config_item['configuration']
 
 if configuration.get('storageEncrypted', False):
 return {
 'compliance_type': 'COMPLIANT',
 'annotation': 'RDS instance has encryption enabled'
 }
 
 return {
 'compliance_type': 'NON_COMPLIANT',
 'annotation': 'RDS instance does not have encryption enabled'
 }
 
 def check_ebs_encryption(config_item):
 """Check EBS volume encryption"""
 configuration = config_item['configuration']
 
 if configuration.get('encrypted', False):
 return {
 'compliance_type': 'COMPLIANT',
 'annotation': 'EBS volume is encrypted'
 }
 
 return {
 'compliance_type': 'NON_COMPLIANT',
 'annotation': 'EBS volume is not encrypted'
 }

 # Deploy custom guardrail to all accounts
 CustomGuardrailStackSet:
 Type: AWS::CloudFormation::StackSet
 Properties:
 StackSetName: ct-custom-encryption-guardrail
 Description: Deploy custom encryption guardrail to all accounts
 Capabilities:
 - CAPABILITY_IAM
 Parameters:
 - ParameterKey: GuardrailName
 ParameterValue: ct-encryption-compliance
 PermissionModel: SERVICE_MANAGED
 AutoDeployment:
 Enabled: true
 RetainStacksOnAccountRemoval: false
 OperationPreferences:
 RegionConcurrencyType: PARALLEL
 MaxConcurrentPercentage: 100
 FailureTolerancePercentage: 10
 TemplateBody: !Sub |
 AWSTemplateFormatVersion: '2010-09-09'
 Description: Custom encryption compliance guardrail
 Parameters:
 GuardrailName:
 Type: String
 Resources:
 ${EncryptionComplianceRule}
 ${EncryptionComplianceFunction}
 ${ComplianceFunctionRole}

Lifecycle Management

# Account lifecycle management
import boto3
import json
from datetime import datetime, timedelta

class ControlTowerLifecycleManager:
 def __init__(self):
 self.organizations = boto3.client('organizations')
 self.controltower = boto3.client('controltower')
 self.config = boto3.client('config')
 self.cloudwatch = boto3.client('cloudwatch')
 
 def monitor_account_compliance(self):
 """Monitor compliance across all managed accounts"""
 
 # Get all accounts in organization
 accounts = self.organizations.list_accounts()
 
 compliance_report = {
 'timestamp': datetime.utcnow().isoformat(),
 'total_accounts': len(accounts['Accounts']),
 'compliant_accounts': 0,
 'non_compliant_accounts': 0,
 'violations': []
 }
 
 for account in accounts['Accounts']:
 account_id = account['Id']
 account_name = account['Name']
 
 # Skip master account and suspended accounts
 if account['Status'] != 'ACTIVE':
 continue
 
 # Check guardrail compliance
 violations = self.check_account_guardrails(account_id)
 
 if violations:
 compliance_report['non_compliant_accounts'] += 1
 compliance_report['violations'].extend([
 {
 'account_id': account_id,
 'account_name': account_name,
 'violation': violation
 } for violation in violations
 ])
 else:
 compliance_report['compliant_accounts'] += 1
 
 # Send compliance metrics to CloudWatch
 self.send_compliance_metrics(compliance_report)
 
 return compliance_report
 
 def check_account_guardrails(self, account_id):
 """Check guardrail compliance for a specific account"""
 
 violations = []
 
 try:
 # Assume role in target account to check Config compliance
 sts = boto3.client('sts')
 assumed_role = sts.assume_role(
 RoleArn=f"arn:aws:iam::{account_id}:role/AWSControlTowerExecution",
 RoleSessionName='ComplianceCheck'
 )
 
 # Create session with assumed role
 session = boto3.Session(
 aws_access_key_id=assumed_role['Credentials']['AccessKeyId'],
 aws_secret_access_key=assumed_role['Credentials']['SecretAccessKey'],
 aws_session_token=assumed_role['Credentials']['SessionToken']
 )
 
 config_client = session.client('config')
 
 # Get compliance summary
 compliance_summary = config_client.get_compliance_summary_by_config_rule()
 
 # Check for non-compliant rules
 for rule_name in self.get_mandatory_guardrails():
 try:
 compliance_details = config_client.get_compliance_details_by_config_rule(
 ConfigRuleName=rule_name,
 ComplianceTypes=['NON_COMPLIANT']
 )
 
 if compliance_details['EvaluationResults']:
 violations.append({
 'rule_name': rule_name,
 'non_compliant_resources': len(compliance_details['EvaluationResults']),
 'details': compliance_details['EvaluationResults'][:5] # First 5 violations
 })
 
 except config_client.exceptions.NoSuchConfigRuleException:
 violations.append({
 'rule_name': rule_name,
 'error': 'Config rule not found - guardrail may not be enabled'
 })
 
 except Exception as e:
 violations.append({
 'error': f'Unable to check compliance: {str(e)}'
 })
 
 return violations
 
 def get_mandatory_guardrails(self):
 """Get list of mandatory Control Tower guardrails"""
 return [
 'ct-s3-bucket-public-read-prohibited',
 'ct-s3-bucket-public-write-prohibited',
 'ct-cloudtrail-enabled',
 'ct-config-enabled',
 'ct-root-mfa-enabled'
 ]
 
 def remediate_account_violations(self, account_id, violations):
 """Attempt to remediate violations in an account"""
 
 remediation_results = []
 
 for violation in violations:
 rule_name = violation.get('rule_name')
 
 if rule_name == 'ct-s3-bucket-public-read-prohibited':
 result = self.remediate_s3_public_access(account_id, violation)
 remediation_results.append(result)
 
 elif rule_name == 'ct-cloudtrail-enabled':
 result = self.remediate_cloudtrail_configuration(account_id, violation)
 remediation_results.append(result)
 
 # Add more remediation actions as needed
 
 return remediation_results
 
 def send_compliance_metrics(self, compliance_report):
 """Send compliance metrics to CloudWatch"""
 
 self.cloudwatch.put_metric_data(
 Namespace='ControlTower/Compliance',
 MetricData=[
 {
 'MetricName': 'CompliantAccounts',
 'Value': compliance_report['compliant_accounts'],
 'Unit': 'Count',
 'Timestamp': datetime.utcnow()
 },
 {
 'MetricName': 'NonCompliantAccounts',
 'Value': compliance_report['non_compliant_accounts'],
 'Unit': 'Count',
 'Timestamp': datetime.utcnow()
 },
 {
 'MetricName': 'TotalViolations',
 'Value': len(compliance_report['violations']),
 'Unit': 'Count',
 'Timestamp': datetime.utcnow()
 }
 ]
 )

6. Integration with CI/CD

Account Provisioning Pipeline

# CodePipeline for automated account provisioning
Resources:
 AccountProvisioningPipeline:
 Type: AWS::CodePipeline::Pipeline
 Properties:
 RoleArn: !GetAtt CodePipelineRole.Arn
 ArtifactStore:
 Type: S3
 Location: !Ref ArtifactsBucket
 Stages:
 - Name: Source
 Actions:
 - Name: SourceAction
 ActionTypeId:
 Category: Source
 Owner: AWS
 Provider: S3
 Version: '1'
 Configuration:
 S3Bucket: !Ref RequestsBucket
 S3ObjectKey: account-requests/
 PollForSourceChanges: true
 OutputArtifacts:
 - Name: SourceOutput

 - Name: Validate
 Actions:
 - Name: ValidateRequest
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: '1'
 Configuration:
 FunctionName: !Ref ValidateAccountRequestFunction
 InputArtifacts:
 - Name: SourceOutput
 OutputArtifacts:
 - Name: ValidatedOutput

 - Name: Approval
 Actions:
 - Name: ManualApproval
 ActionTypeId:
 Category: Approval
 Owner: AWS
 Provider: Manual
 Version: '1'
 Configuration:
 CustomData: 'Please review the account provisioning request'

 - Name: Provision
 Actions:
 - Name: ProvisionAccount
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: StepFunctions
 Version: '1'
 Configuration:
 StateMachineArn: !Ref AccountProvisioningStateMachine
 Input: |
 {
 "AccountRequest.$": "$.AccountRequest"
 }
 InputArtifacts:
 - Name: ValidatedOutput

 - Name: Configure
 Actions:
 - Name: ConfigureBaseline
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: '1'
 Configuration:
 FunctionName: !Ref ConfigureBaselineFunction
 InputArtifacts:
 - Name: ValidatedOutput

 - Name: Notify
 Actions:
 - Name: NotifyCompletion
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: SNS
 Version: '1'
 Configuration:
 TopicArn: !Ref AccountProvisioningNotifications
 Message: 'Account provisioning completed successfully'

7. Common Exam Scenarios

Scenario 1: Multi-Account Governance Setup

# Complete Control Tower setup with custom guardrails
Resources:
 # Custom OU for production workloads
 ProductionOU:
 Type: AWS::Organizations::OrganizationalUnit
 Properties:
 Name: Production
 ParentId: !Ref RootId

 # Custom guardrail for production OU
 ProductionGuardrail:
 Type: AWS::Config::OrganizationConfigRule
 Properties:
 OrganizationConfigRuleName: production-encryption-required
 OrganizationManagedRuleMetadata:
 RuleIdentifier: ENCRYPTED_VOLUMES
 Description: Ensure all EBS volumes are encrypted in production
 IncludedAccounts:
 - !Ref ProductionAccountId1
 - !Ref ProductionAccountId2

 # SCP for production OU
 ProductionSCP:
 Type: AWS::Organizations::Policy
 Properties:
 Name: ProductionSecurityPolicy
 Description: Security policy for production accounts
 Type: SERVICE_CONTROL_POLICY
 Content: |
 {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "DenyUnencryptedStorage",
 "Effect": "Deny",
 "Action": [
 "ec2:CreateVolume",
 "rds:CreateDBInstance"
 ],
 "Resource": "*",
 "Condition": {
 "Bool": {
 "ec2:Encrypted": "false"
 }
 }
 },
 {
 "Sid": "RequireMFAForSensitiveActions",
 "Effect": "Deny",
 "Action": [
 "ec2:TerminateInstances",
 "rds:DeleteDBInstance",
 "s3:DeleteBucket"
 ],
 "Resource": "*",
 "Condition": {
 "BoolIfExists": {
 "aws:MultiFactorAuthPresent": "false"
 }
 }
 }
 ]
 }

 # Attach SCP to production OU
 ProductionSCPAttachment:
 Type: AWS::Organizations::PolicyAttachment
 Properties:
 PolicyId: !Ref ProductionSCP
 TargetId: !Ref ProductionOU
 TargetType: ORGANIZATIONAL_UNIT

Scenario 2: Automated Compliance Monitoring

# Complete compliance monitoring and remediation system
import boto3
import json
from datetime import datetime, timedelta

class ControlTowerComplianceOrchestrator:
 def __init__(self):
 self.organizations = boto3.client('organizations')
 self.config = boto3.client('config')
 self.sns = boto3.client('sns')
 self.stepfunctions = boto3.client('stepfunctions')
 
 def lambda_handler(self, event, context):
 """Main handler for compliance monitoring"""
 
 # Scheduled compliance check
 if event.get('source') == 'aws.events':
 return self.run_scheduled_compliance_check()
 
 # Config rule evaluation change
 elif event.get('source') == 'aws.config':
 return self.handle_config_evaluation_change(event)
 
 # Manual compliance check
 else:
 return self.run_manual_compliance_check(event)
 
 def run_scheduled_compliance_check(self):
 """Run scheduled compliance check across all accounts"""
 
 # Get all accounts in organization
 accounts = self.organizations.list_accounts()
 
 compliance_summary = {
 'timestamp': datetime.utcnow().isoformat(),
 'total_accounts': 0,
 'compliant_accounts': 0,
 'non_compliant_accounts': 0,
 'critical_violations': 0,
 'accounts_details': []
 }
 
 for account in accounts['Accounts']:
 if account['Status'] != 'ACTIVE':
 continue
 
 compliance_summary['total_accounts'] += 1
 account_compliance = self.check_account_compliance(account['Id'])
 
 if account_compliance['is_compliant']:
 compliance_summary['compliant_accounts'] += 1
 else:
 compliance_summary['non_compliant_accounts'] += 1
 
 # Count critical violations
 critical_violations = [v for v in account_compliance['violations'] 
 if v.get('severity') == 'CRITICAL']
 compliance_summary['critical_violations'] += len(critical_violations)
 
 # Trigger remediation for critical violations
 if critical_violations:
 self.trigger_remediation_workflow(account['Id'], critical_violations)
 
 compliance_summary['accounts_details'].append({
 'account_id': account['Id'],
 'account_name': account['Name'],
 'compliance_status': 'COMPLIANT' if account_compliance['is_compliant'] else 'NON_COMPLIANT',
 'violations_count': len(account_compliance['violations'])
 })
 
 # Send summary notification
 self.send_compliance_summary(compliance_summary)
 
 return compliance_summary
 
 def check_account_compliance(self, account_id):
 """Check compliance for a specific account"""
 
 violations = []
 is_compliant = True
 
 try:
 # Assume role in target account
 sts = boto3.client('sts')
 assumed_role = sts.assume_role(
 RoleArn=f"arn:aws:iam::{account_id}:role/AWSControlTowerExecution",
 RoleSessionName='ComplianceCheck'
 )
 
 session = boto3.Session(
 aws_access_key_id=assumed_role['Credentials']['AccessKeyId'],
 aws_secret_access_key=assumed_role['Credentials']['SecretAccessKey'],
 aws_session_token=assumed_role['Credentials']['SessionToken']
 )
 
 config_client = session.client('config')
 
 # Check mandatory guardrails
 mandatory_rules = [
 {'name': 'ct-s3-bucket-public-read-prohibited', 'severity': 'CRITICAL'},
 {'name': 'ct-s3-bucket-public-write-prohibited', 'severity': 'CRITICAL'},
 {'name': 'ct-cloudtrail-enabled', 'severity': 'HIGH'},
 {'name': 'ct-config-enabled', 'severity': 'HIGH'},
 {'name': 'ct-root-mfa-enabled', 'severity': 'CRITICAL'}
 ]
 
 for rule in mandatory_rules:
 try:
 compliance_details = config_client.get_compliance_details_by_config_rule(
 ConfigRuleName=rule['name'],
 ComplianceTypes=['NON_COMPLIANT']
 )
 
 if compliance_details['EvaluationResults']:
 is_compliant = False
 violations.append({
 'rule_name': rule['name'],
 'severity': rule['severity'],
 'non_compliant_resources': len(compliance_details['EvaluationResults']),
 'resources': [r['EvaluationResultIdentifier']['EvaluationResultQualifier'] 
 for r in compliance_details['EvaluationResults'][:10]]
 })
 
 except config_client.exceptions.NoSuchConfigRuleException:
 is_compliant = False
 violations.append({
 'rule_name': rule['name'],
 'severity': 'CRITICAL',
 'error': 'Config rule not found - guardrail not enabled'
 })
 
 except Exception as e:
 is_compliant = False
 violations.append({
 'error': f'Unable to check compliance: {str(e)}',
 'severity': 'HIGH'
 })
 
 return {
 'is_compliant': is_compliant,
 'violations': violations
 }
 
 def trigger_remediation_workflow(self, account_id, violations):
 """Trigger Step Functions workflow for remediation"""
 
 workflow_input = {
 'AccountId': account_id,
 'Violations': violations,
 'Timestamp': datetime.utcnow().isoformat()
 }
 
 self.stepfunctions.start_execution(
 stateMachineArn='arn:aws:states:us-east-1:123456789012:stateMachine:ComplianceRemediation',
 name=f"remediation-{account_id}-{int(datetime.utcnow().timestamp())}",
 input=json.dumps(workflow_input)
 )
 
 def send_compliance_summary(self, summary):
 """Send compliance summary notification"""
 
 message = f"""
Control Tower Compliance Summary
===============================

Timestamp: {summary['timestamp']}
Total Accounts: {summary['total_accounts']}
Compliant Accounts: {summary['compliant_accounts']}
Non-Compliant Accounts: {summary['non_compliant_accounts']}
Critical Violations: {summary['critical_violations']}

Compliance Rate: {(summary['compliant_accounts'] / summary['total_accounts'] * 100):.1f}%

Account Details:
{json.dumps(summary['accounts_details'], indent=2)}
 """
 
 self.sns.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:controltower-compliance',
 Message=message,
 Subject=f"Control Tower Compliance Report - {summary['non_compliant_accounts']} Non-Compliant Accounts"
 )

8. Exam Tips

Understand Landing Zone - Core components and automatic setup
Master Guardrails - Preventive (SCP) vs Detective (Config) guardrails
Know Account Factory - Service Catalog integration and automation
Practice customization - Custom guardrails and OU structures
Learn integration - Organizations, Config, CloudTrail, Service Catalog
Understand governance - Multi-account governance and compliance
Know limitations - What Control Tower can and cannot do
Practice troubleshooting - Common setup and guardrail issues
Understand costs - Control Tower pricing and cost optimization
Master automation - Account provisioning and lifecycle management

AWS EKS (Elastic Kubernetes Service)

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is EKS?

Managed Kubernetes service for running containerized applications
Provides highly available and secure Kubernetes control plane
Integrates with AWS services for networking, security, and monitoring
Supports both EC2 and Fargate compute options

Key Benefits

Managed Control Plane - AWS manages Kubernetes masters
High Availability - Multi-AZ control plane deployment
Security - Integration with IAM and VPC
Scalability - Auto scaling for nodes and pods
AWS Integration - Native integration with AWS services

2. Cluster Architecture

Control Plane

Managed by AWS across multiple AZs
Includes API server, etcd, scheduler, and controller manager
Automatic updates and patching
99.95% SLA for control plane availability

Worker Nodes

# Create managed node group
aws eks create-nodegroup \
 --cluster-name "my-cluster" \
 --nodegroup-name "worker-nodes" \
 --subnets "subnet-12345678" "subnet-87654321" \
 --instance-types "t3.medium" \
 --ami-type "AL2_x86_64" \
 --node-role "arn:aws:iam::123456789012:role/NodeInstanceRole" \
 --scaling-config minSize=1,maxSize=10,desiredSize=3

Fargate Integration

# Fargate profiles are created via the AWS CLI/API - NOT via kubectl manifests.
# (There is no "Fargate profile" Kubernetes object; a ConfigMap cannot define one.)
aws eks create-fargate-profile \
 --cluster-name my-cluster \
 --fargate-profile-name default \
 --pod-execution-role-arn arn:aws:iam::123456789012:role/eks-fargate-pod-execution-role \
 --selectors namespace=default,labels={compute-type=fargate} \
 --subnets subnet-12345678 subnet-87654321

3. IAM Roles for Service Accounts (IRSA)

OIDC Identity Provider Setup

# Create OIDC identity provider
eksctl utils associate-iam-oidc-provider \
 --cluster my-cluster \
 --approve

Service Account with IAM Role

apiVersion: v1
kind: ServiceAccount
metadata:
 name: s3-access-sa
 namespace: default
 annotations:
 eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/S3AccessRole

IAM Role Trust Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "Federated": "arn:aws:iam::123456789012:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E"
 },
 "Action": "sts:AssumeRoleWithWebIdentity",
 "Condition": {
 "StringEquals": {
 "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:sub": "system:serviceaccount:default:s3-access-sa",
 "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:aud": "sts.amazonaws.com"
 }
 }
 }
 ]
}

4. Node Groups and Scaling

Managed Node Groups

def create_managed_node_group():
 """Create EKS managed node group with auto scaling"""
 
 eks = boto3.client('eks')
 
 response = eks.create_nodegroup(
 clusterName='my-cluster',
 nodegroupName='production-nodes',
 scalingConfig={
 'minSize': 2,
 'maxSize': 20,
 'desiredSize': 5
 },
 instanceTypes=['t3.medium', 't3.large'],
 amiType='AL2_x86_64',
 nodeRole='arn:aws:iam::123456789012:role/NodeInstanceRole',
 subnets=[
 'subnet-12345678',
 'subnet-87654321',
 'subnet-13579246'
 ],
 tags={
 'Environment': 'Production',
 'Team': 'DevOps'
 },
 launchTemplate={
 'name': 'eks-node-template',
 'version': '$Latest'
 }
 )
 
 return response

Cluster Autoscaler

apiVersion: apps/v1
kind: Deployment
metadata:
 name: cluster-autoscaler
 namespace: kube-system
spec:
 replicas: 1
 selector:
 matchLabels:
 app: cluster-autoscaler
 template:
 metadata:
 labels:
 app: cluster-autoscaler
 spec:
 serviceAccountName: cluster-autoscaler
 containers:
 - image: registry.k8s.io/autoscaling/cluster-autoscaler:v1.21.0  # k8s.gcr.io is deprecated; use registry.k8s.io
 name: cluster-autoscaler
 resources:
 limits:
 cpu: 100m
 memory: 300Mi
 command:
 - ./cluster-autoscaler
 - --v=4
 - --stderrthreshold=info
 - --cloud-provider=aws
 - --skip-nodes-with-local-storage=false
 - --expander=least-waste
 - --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,k8s.io/cluster-autoscaler/my-cluster

5. Networking and Security

VPC Configuration

def setup_eks_networking():
 """Set up EKS networking with proper security"""
 
 ec2 = boto3.client('ec2')
 
 # Create security group for EKS cluster
 cluster_sg = ec2.create_security_group(
 GroupName='eks-cluster-sg',
 Description='Security group for EKS cluster',
 VpcId='vpc-12345678'
 )
 
 # Allow HTTPS traffic from worker nodes
 ec2.authorize_security_group_ingress(
 GroupId=cluster_sg['GroupId'],
 IpPermissions=[
 {
 'IpProtocol': 'tcp',
 'FromPort': 443,
 'ToPort': 443,
 'UserIdGroupPairs': [
 {
 'GroupId': 'sg-worker-nodes',
 'Description': 'HTTPS from worker nodes'
 }
 ]
 }
 ]
 )
 
 return cluster_sg['GroupId']

Network Policies

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: deny-all-ingress
 namespace: production
spec:
 podSelector: {}
 policyTypes:
 - Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: allow-frontend-to-backend
 namespace: production
spec:
 podSelector:
 matchLabels:
 app: backend
 policyTypes:
 - Ingress
 ingress:
 - from:
 - podSelector:
 matchLabels:
 app: frontend
 ports:
 - protocol: TCP
 port: 8080

6. Monitoring and Logging

Container Insights

# Deploy CloudWatch Container Insights
curl https://raw.githubusercontent.com/aws-samples/amazon-cloudwatch-container-insights/latest/k8s-deployment-manifest-templates/deployment-mode/daemonset/container-insights-monitoring/quickstart/cwagent-fluentd-quickstart.yaml | sed "s/{{cluster_name}}/my-cluster/;s/{{region_name}}/us-east-1/" | kubectl apply -f -

Prometheus and Grafana

# Prometheus configuration
apiVersion: v1
kind: ConfigMap
metadata:
 name: prometheus-config
 namespace: monitoring
data:
 prometheus.yml: |
 global:
 scrape_interval: 15s
 scrape_configs:
 - job_name: 'kubernetes-pods'
 kubernetes_sd_configs:
 - role: pod
 relabel_configs:
 - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
 action: keep
 regex: true

7. Application Deployment Patterns

Blue/Green Deployment

# Blue deployment
apiVersion: apps/v1
kind: Deployment
metadata:
 name: app-blue
 labels:
 version: blue
spec:
 replicas: 3
 selector:
 matchLabels:
 app: myapp
 version: blue
 template:
 metadata:
 labels:
 app: myapp
 version: blue
 spec:
 containers:
 - name: app
 image: myapp:v1.0
 ports:
 - containerPort: 8080
---
# Service pointing to blue
apiVersion: v1
kind: Service
metadata:
 name: app-service
spec:
 selector:
 app: myapp
 version: blue
 ports:
 - port: 80
 targetPort: 8080

Canary Deployment with Istio

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
 name: app-canary
spec:
 http:
 - match:
 - headers:
 canary:
 exact: "true"
 route:
 - destination:
 host: app-service
 subset: v2
 - route:
 - destination:
 host: app-service
 subset: v1
 weight: 90
 - destination:
 host: app-service
 subset: v2
 weight: 10

8. Disaster Recovery and Backup

Velero Backup

# Install Velero
velero install \
 --provider aws \
 --plugins velero/velero-plugin-for-aws:v1.2.0 \
 --bucket my-backup-bucket \
 --backup-location-config region=us-east-1 \
 --snapshot-location-config region=us-east-1

# Create backup
velero backup create my-backup --include-namespaces production

Cross-Region Cluster Setup

def setup_cross_region_eks():
 """Set up EKS clusters across regions for DR"""
 
 regions = ['us-east-1', 'us-west-2']
 
 for region in regions:
 eks = boto3.client('eks', region_name=region)
 
 # Create cluster in each region
 cluster_config = {
 'name': f'production-cluster-{region}',
 'version': '1.21',
 'roleArn': f'arn:aws:iam::123456789012:role/EKSServiceRole',
 'resourcesVpcConfig': {
 'subnetIds': get_subnets_for_region(region),
 'securityGroupIds': [get_security_group_for_region(region)]
 },
 'logging': {
 'enable': [
 {
 'types': ['api', 'audit', 'authenticator', 'controllerManager', 'scheduler']
 }
 ]
 }
 }
 
 eks.create_cluster(**cluster_config)

9. Common Exam Scenarios

Scenario 1: Secure microservices communication

Solution:

AWS Elastic Load Balancing (ELB)

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is ELB?

Distributes incoming traffic across multiple targets
Provides high availability and fault tolerance
Automatically scales to handle traffic demands
Integrates with Auto Scaling and health checks

Load Balancer Types

Application Load Balancer (ALB) - Layer 7 (HTTP/HTTPS)
Network Load Balancer (NLB) - Layer 4 (TCP/UDP/TLS)
Gateway Load Balancer (GWLB) - Layer 3 (IP packets)
Classic Load Balancer (CLB) - Legacy (Layer 4 & 7)

2. Application Load Balancer (ALB)

Core Features

HTTP/HTTPS traffic routing
Content-based routing
WebSocket and HTTP/2 support
Integration with AWS services

Target Groups and Health Checks

# Create target group
aws elbv2 create-target-group \
 --name "web-servers-tg" \
 --protocol HTTP \
 --port 80 \
 --vpc-id vpc-12345678 \
 --health-check-protocol HTTP \
 --health-check-path "/health" \
 --health-check-interval-seconds 30 \
 --health-check-timeout-seconds 5 \
 --healthy-threshold-count 2 \
 --unhealthy-threshold-count 3

# Register targets
aws elbv2 register-targets \
 --target-group-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-servers-tg/1234567890123456" \
 --targets Id=i-1234567890abcdef0,Port=80 Id=i-0987654321fedcba0,Port=80

Advanced Routing

# Create ALB
aws elbv2 create-load-balancer \
 --name "web-application-alb" \
 --subnets subnet-12345678 subnet-87654321 \
 --security-groups sg-12345678 \
 --scheme internet-facing \
 --type application \
 --ip-address-type ipv4

# Create listener with rules
aws elbv2 create-listener \
 --load-balancer-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/web-application-alb/1234567890123456" \
 --protocol HTTPS \
 --port 443 \
 --certificates CertificateArn="arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012" \
 --default-actions Type=forward,TargetGroupArn="arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-servers-tg/1234567890123456"

# Create routing rule
aws elbv2 create-rule \
 --listener-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/web-application-alb/1234567890123456/1234567890123456" \
 --priority 100 \
 --conditions Field=path-pattern,Values="/api/*" \
 --actions Type=forward,TargetGroupArn="arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/api-servers-tg/1234567890123456"

Sticky Sessions

def configure_sticky_sessions():
 """Configure session stickiness for ALB"""
 
 elbv2 = boto3.client('elbv2')
 
 # Enable stickiness on target group
 response = elbv2.modify_target_group_attributes(
 TargetGroupArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-servers-tg/1234567890123456',
 Attributes=[
 {
 'Key': 'stickiness.enabled',
 'Value': 'true'
 },
 {
 'Key': 'stickiness.type',
 'Value': 'lb_cookie'
 },
 {
 'Key': 'stickiness.lb_cookie.duration_seconds',
 'Value': '86400' # 24 hours
 }
 ]
 )
 
 return response

3. Network Load Balancer (NLB)

High Performance Layer 4 Routing

# Create NLB
aws elbv2 create-load-balancer \
 --name "high-performance-nlb" \
 --subnets subnet-12345678 subnet-87654321 \
 --scheme internet-facing \
 --type network \
 --ip-address-type ipv4

# Create target group for NLB
aws elbv2 create-target-group \
 --name "tcp-servers-tg" \
 --protocol TCP \
 --port 80 \
 --vpc-id vpc-12345678 \
 --health-check-protocol TCP \
 --health-check-port 80 \
 --health-check-interval-seconds 30 \
 --healthy-threshold-count 3 \
 --unhealthy-threshold-count 3

Static IP and Cross-Zone Load Balancing

def configure_nlb_features():
 """Configure NLB advanced features"""
 
 elbv2 = boto3.client('elbv2')
 
 # Enable cross-zone load balancing
 elbv2.modify_load_balancer_attributes(
 LoadBalancerArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/net/high-performance-nlb/1234567890123456',
 Attributes=[
 {
 'Key': 'load_balancing.cross_zone.enabled',
 'Value': 'true'
 },
 {
 'Key': 'deletion_protection.enabled',
 'Value': 'true'
 }
 ]
 )
 
 # Configure target group attributes
 elbv2.modify_target_group_attributes(
 TargetGroupArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/tcp-servers-tg/1234567890123456',
 Attributes=[
 {
 'Key': 'preserve_client_ip.enabled',
 'Value': 'true'
 },
 {
 'Key': 'proxy_protocol_v2.enabled',
 'Value': 'false'
 }
 ]
 )

4. Gateway Load Balancer (GWLB)

Third-Party Appliance Integration

# Create GWLB for security appliances
aws elbv2 create-load-balancer \
 --name "security-appliance-gwlb" \
 --subnets subnet-12345678 subnet-87654321 \
 --type gateway

# Create target group for GWLB
aws elbv2 create-target-group \
 --name "security-appliances-tg" \
 --protocol GENEVE \
 --port 6081 \
 --vpc-id vpc-12345678 \
 --health-check-protocol HTTP \
 --health-check-path "/health" \
 --health-check-port 80

5. Multi-AZ and Cross-Region Resilience

Multi-AZ Deployment

def create_resilient_alb():
 """Create highly available ALB across multiple AZs"""
 
 elbv2 = boto3.client('elbv2')
 ec2 = boto3.client('ec2')
 
 # Get subnets across multiple AZs
 subnets = ec2.describe_subnets(
 Filters=[
 {'Name': 'vpc-id', 'Values': ['vpc-12345678']},
 {'Name': 'availability-zone', 'Values': ['us-east-1a', 'us-east-1b', 'us-east-1c']}
 ]
 )
 
 subnet_ids = [subnet['SubnetId'] for subnet in subnets['Subnets']]
 
 # Create ALB with multi-AZ subnets
 response = elbv2.create_load_balancer(
 Name='resilient-web-alb',
 Subnets=subnet_ids,
 SecurityGroups=['sg-12345678'],
 Scheme='internet-facing',
 Type='application',
 IpAddressType='ipv4'
 )
 
 return response

Cross-Region Load Balancing with Route 53

def setup_cross_region_load_balancing():
 """Set up cross-region load balancing with Route 53"""
 
 route53 = boto3.client('route53')
 
 # Create health checks for each region
 health_checks = []
 regions = ['us-east-1', 'us-west-2', 'eu-west-1']
 
 for region in regions:
 health_check = route53.create_health_check(
 Type='HTTPS',
 ResourcePath='/health',
 FullyQualifiedDomainName=f'alb-{region}.example.com',
 Port=443,
 RequestInterval=30,
 FailureThreshold=3
 )
 health_checks.append(health_check['HealthCheck']['Id'])
 
 # Create weighted routing records
 for i, region in enumerate(regions):
 route53.change_resource_record_sets(
 HostedZoneId='Z123456789',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'app.example.com',
 'Type': 'CNAME',
 'SetIdentifier': f'region-{region}',
 'Weight': 100,
 'TTL': 60,
 'ResourceRecords': [{'Value': f'alb-{region}.example.com'}],
 'HealthCheckId': health_checks[i]
 }
 }]
 }
 )

6. SSL/TLS Termination and Security

SSL Certificate Management

# Create HTTPS listener with SSL termination
aws elbv2 create-listener \
 --load-balancer-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/web-alb/1234567890123456" \
 --protocol HTTPS \
 --port 443 \
 --certificates CertificateArn="arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012" \
 --ssl-policy "ELBSecurityPolicy-TLS-1-2-2017-01" \
 --default-actions Type=forward,TargetGroupArn="arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-tg/1234567890123456"

# Redirect HTTP to HTTPS
aws elbv2 create-listener \
 --load-balancer-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/web-alb/1234567890123456" \
 --protocol HTTP \
 --port 80 \
 --default-actions Type=redirect,RedirectConfig='{Protocol=HTTPS,Port=443,StatusCode=HTTP_301}'

WAF Integration

def integrate_waf_with_alb():
 """Integrate AWS WAF with Application Load Balancer"""
 
 wafv2 = boto3.client('wafv2')
 
 # Associate WAF with ALB
 response = wafv2.associate_web_acl(
 WebACLArn='arn:aws:wafv2:us-east-1:123456789012:regional/webacl/MyWebACL/12345678-1234-1234-1234-123456789012',
 ResourceArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/web-alb/1234567890123456'
 )
 
 return response

7. Health Checks and Monitoring

Advanced Health Check Configuration

def configure_advanced_health_checks():
 """Configure comprehensive health checks"""
 
 elbv2 = boto3.client('elbv2')
 
 # Configure detailed health check
 response = elbv2.modify_target_group(
 TargetGroupArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-tg/1234567890123456',
 HealthCheckProtocol='HTTP',
 HealthCheckPath='/health/detailed',
 HealthCheckIntervalSeconds=15,
 HealthCheckTimeoutSeconds=10,
 HealthyThresholdCount=2,
 UnhealthyThresholdCount=5,
 Matcher={'HttpCode': '200,202'}
 )
 
 return response

CloudWatch Metrics and Alarms

def setup_elb_monitoring():
 """Set up comprehensive ELB monitoring"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Create alarm for high latency
 cloudwatch.put_metric_alarm(
 AlarmName='ALB-HighLatency',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=2,
 MetricName='TargetResponseTime',
 Namespace='AWS/ApplicationELB',
 Period=300,
 Statistic='Average',
 Threshold=2.0,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:alb-alerts'
 ],
 Dimensions=[
 {
 'Name': 'LoadBalancer',
 'Value': 'app/web-alb/1234567890123456'
 }
 ]
 )
 
 # Create alarm for high error rate
 cloudwatch.put_metric_alarm(
 AlarmName='ALB-HighErrorRate',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=2,
 MetricName='HTTPCode_ELB_5XX_Count',
 Namespace='AWS/ApplicationELB',
 Period=300,
 Statistic='Sum',
 Threshold=10,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:error-alerts'
 ]
 )

8. Auto Scaling Integration

Target Group Auto Scaling

def integrate_with_auto_scaling():
 """Integrate ELB with Auto Scaling groups"""
 
 autoscaling = boto3.client('autoscaling')
 
 # Create Auto Scaling group with target group
 autoscaling.create_auto_scaling_group(
 AutoScalingGroupName='web-servers-asg',
 LaunchTemplate={
 'LaunchTemplateName': 'web-server-template',
 'Version': '$Latest'
 },
 MinSize=2,
 MaxSize=10,
 DesiredCapacity=3,
 TargetGroupARNs=[
 'arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-tg/1234567890123456'
 ],
 HealthCheckType='ELB',
 HealthCheckGracePeriod=300,
 VPCZoneIdentifier='subnet-12345678,subnet-87654321'
 )
 
 # Create scaling policy based on ALB metrics
 autoscaling.put_scaling_policy(
 AutoScalingGroupName='web-servers-asg',
 PolicyName='alb-request-count-scaling',
 PolicyType='TargetTrackingScaling',
 TargetTrackingConfiguration={
 'TargetValue': 1000.0,
 'PredefinedMetricSpecification': {
 'PredefinedMetricType': 'ALBRequestCountPerTarget',
 'ResourceLabel': 'app/web-alb/1234567890123456/targetgroup/web-tg/1234567890123456'
 }
 }
 )

9. Connection Draining and Blue/Green Deployments

Connection Draining

def configure_connection_draining():
 """Configure connection draining for graceful shutdowns"""
 
 elbv2 = boto3.client('elbv2')
 
 # Configure deregistration delay
 elbv2.modify_target_group_attributes(
 TargetGroupArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-tg/1234567890123456',
 Attributes=[
 {
 'Key': 'deregistration_delay.timeout_seconds',
 'Value': '300' # 5 minutes
 }
 ]
 )

Blue/Green Deployment Support

def blue_green_deployment():
 """Implement blue/green deployment with ELB"""
 
 elbv2 = boto3.client('elbv2')
 
 # Create green target group
 green_tg = elbv2.create_target_group(
 Name='web-servers-green-tg',
 Protocol='HTTP',
 Port=80,
 VpcId='vpc-12345678',
 HealthCheckPath='/health'
 )
 
 green_tg_arn = green_tg['TargetGroups'][0]['TargetGroupArn']
 
 # Register new instances to green target group
 elbv2.register_targets(
 TargetGroupArn=green_tg_arn,
 Targets=[
 {'Id': 'i-newinstance1', 'Port': 80},
 {'Id': 'i-newinstance2', 'Port': 80}
 ]
 )
 
 # Wait for health checks to pass
 wait_for_healthy_targets(green_tg_arn)
 
 # Switch traffic to green target group
 elbv2.modify_listener(
 ListenerArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/web-alb/1234567890123456/1234567890123456',
 DefaultActions=[
 {
 'Type': 'forward',
 'TargetGroupArn': green_tg_arn
 }
 ]
 )

10. Common Exam Scenarios

Scenario 1: High availability web application

Solution:

AWS EventBridge

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

Amazon EventBridge is a serverless event bus service that connects applications using events from AWS services, custom applications, and SaaS applications.

Key Characteristics

Serverless - No infrastructure to manage
Event-driven - React to state changes in real-time
Scalable - Automatically scales with event volume
Flexible routing - Route events to multiple targets
Schema registry - Discover and manage event schemas
Archive & replay - Store and replay events

What Problem Does It Solve?

Decouples event producers from consumers
Enables event-driven architectures
Simplifies integration between services
Provides centralized event routing
Enables real-time application responses
Facilitates SaaS integration

2. Core Concepts

Event

JSON object representing state change
Contains metadata and data
Immutable once created
Maximum size: 256 KB

Event Bus

Receives events from sources
Routes events to targets based on rules
Types: Default, Custom, Partner
One default bus per account per region

Rule

Matches incoming events using patterns
Routes matched events to targets
Can have multiple targets (up to 5)
Can transform event before sending to target

Event Pattern

JSON structure for filtering events
Matches event fields
Supports exact match, prefix, suffix, numeric ranges
Logical operators: OR (array), AND (nested)

Target

Destination for matched events
AWS services or custom endpoints
Can transform input before delivery
Supports retry and dead-letter queues

Event Source

Origin of events
AWS services, custom applications, SaaS partners
Publishes events to event bus

3. Event Structure

Standard Event Format

{
 "version": "0",
 "id": "6a7e8feb-b491-4cf7-a9f1-bf3703467718",
 "detail-type": "EC2 Instance State-change Notification",
 "source": "aws.ec2",
 "account": "123456789012",
 "time": "2023-11-15T22:34:12Z",
 "region": "us-east-1",
 "resources": [
 "arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0"
 ],
 "detail": {
 "instance-id": "i-1234567890abcdef0",
 "state": "running"
 }
}

Event Fields

version - Event format version (always “0”)
id - Unique event identifier (UUID)
detail-type - Free-form string describing event
source - Event source identifier
account - AWS account ID
time - Event timestamp (ISO 8601)
region - AWS region
resources - ARNs of affected resources
detail - Event-specific data (custom structure)

4. Event Buses

Default Event Bus

Automatically created in each account/region
Receives events from AWS services
Cannot be deleted
Name: “default”

Custom Event Bus

Created for custom applications
Isolate events by application/team
Can set resource-based policies
Can be deleted when not needed

Partner Event Bus

Created when connecting to SaaS partners
Receives events from partner applications
Examples: Datadog, PagerDuty, Zendesk
Automatically created upon partner authorization

Cross-Account Event Bus

Send events to another AWS account
Requires resource-based policy on target bus
Use case: Centralized event processing

5. Event Patterns

Exact Match

{
 "source": ["aws.ec2"],
 "detail-type": ["EC2 Instance State-change Notification"]
}

Prefix Match

{
 "source": [{
 "prefix": "aws."
 }]
}

Suffix Match

{
 "detail": {
 "filename": [{
 "suffix": ".jpg"
 }]
 }
}

Anything-but Match

{
 "detail": {
 "state": [{
 "anything-but": "initializing"
 }]
 }
}

Numeric Match

{
 "detail": {
 "temperature": [{
 "numeric": [">", 0, "<=", 100]
 }]
 }
}

Exists Match

{
 "detail": {
 "errorCode": [{
 "exists": true
 }]
 }
}

OR Logic (Array)

{
 "source": ["aws.ec2", "aws.ecs"]
}

AND Logic (Nested)

{
 "source": ["aws.ec2"],
 "detail-type": ["EC2 Instance State-change Notification"],
 "detail": {
 "state": ["running"]
 }
}

Complex Pattern

{
 "source": ["aws.ec2"],
 "detail-type": ["EC2 Instance State-change Notification"],
 "detail": {
 "state": ["running", "stopped"],
 "instance-type": [{
 "prefix": "t3."
 }]
 }
}

6. Targets

Supported Targets

Lambda - Invoke function
SNS - Publish to topic
SQS - Send message to queue
Kinesis Data Streams - Put record
Kinesis Data Firehose - Deliver data
Step Functions - Start execution
CodePipeline - Start pipeline
CodeBuild - Start build
ECS Task - Run task
Batch - Submit job
Systems Manager - Run command, automation
EC2 - Create snapshot, reboot, stop, terminate
API Gateway - Invoke REST API
EventBridge API Destination - HTTP endpoint
Another Event Bus - Cross-account or same account

Target Configuration

{
 "Targets": [
 {
 "Id": "1",
 "Arn": "arn:aws:lambda:us-east-1:123456789012:function:MyFunction",
 "RetryPolicy": {
 "MaximumRetryAttempts": 2,
 "MaximumEventAge": 3600
 },
 "DeadLetterConfig": {
 "Arn": "arn:aws:sqs:us-east-1:123456789012:dlq"
 }
 }
 ]
}

7. Input Transformation

Input Path

Extract specific fields from event
Create variables for use in template
JSONPath syntax

Input Template

Define structure of data sent to target
Reference variables from input path
Can add static values

Example Transformation

{
 "InputPath": "$.detail",
 "InputTemplate": "\"Instance <instance-id> is now <state>\""
}

Full Example

{
 "InputPathsMap": {
 "instance": "$.detail.instance-id",
 "state": "$.detail.state",
 "time": "$.time"
 },
 "InputTemplate": "{\"message\": \"Instance <instance> changed to <state> at <time>\"}"
}

8. Archive & Replay

Archive Configuration

{
 "ArchiveName": "MyArchive",
 "EventSourceArn": "arn:aws:events:us-east-1:123456789012:event-bus/default",
 "Description": "Archive all EC2 events",
 "EventPattern": "{\"source\":[\"aws.ec2\"]}",
 "RetentionDays": 90
}

Replay

Replay archived events to event bus
Specify time range
Events replayed with original timestamp
Use case: Testing, recovery, reprocessing

Replay Configuration

{
 "ReplayName": "MyReplay",
 "EventSourceArn": "arn:aws:events:us-east-1:123456789012:archive/MyArchive",
 "EventStartTime": "2023-01-01T00:00:00Z",
 "EventEndTime": "2023-01-31T23:59:59Z",
 "Destination": {
 "Arn": "arn:aws:events:us-east-1:123456789012:event-bus/default"
 }
}

9. Schema Registry

Overview

Discover event schemas automatically
Version control for schemas
Generate code bindings
OpenAPI 3.0 format

Schema Discovery

Automatically infer schemas from events
Enable on event bus
Schemas stored in registry
Versioned automatically

Schema Registry Types

AWS event schemas - Pre-defined for AWS services
Discovered schemas - Auto-discovered from custom events
Custom schemas - Manually uploaded

Code Bindings

Generate code for Java, Python, TypeScript
Strongly typed event handling
Download from console or CLI

10. API Destinations

Overview

Send events to HTTP endpoints
Support for any HTTP API
Authentication support
Retry and DLQ support

Connection

Stores authentication credentials
Types: Basic, OAuth, API Key
Encrypted with Secrets Manager
Reusable across destinations

API Destination Configuration

{
 "Name": "MyAPIDestination",
 "ConnectionArn": "arn:aws:events:us-east-1:123456789012:connection/MyConnection",
 "InvocationEndpoint": "https://api.example.com/webhook",
 "HttpMethod": "POST",
 "InvocationRateLimitPerSecond": 10
}

Connection Configuration

{
 "Name": "MyConnection",
 "AuthorizationType": "OAUTH_CLIENT_CREDENTIALS",
 "AuthParameters": {
 "OAuthParameters": {
 "ClientParameters": {
 "ClientID": "my-client-id"
 },
 "AuthorizationEndpoint": "https://auth.example.com/oauth/authorize",
 "HttpMethod": "POST"
 }
 }
}

11. Cross-Account Events

Setup Process

Create custom event bus in target account
Add resource-based policy to allow source account
Create rule in source account to send to target bus
Create rule in target account to process events

Resource-Based Policy (Target Account)

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "AllowAccountToPublish",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:root"
 },
 "Action": "events:PutEvents",
 "Resource": "arn:aws:events:us-east-1:222222222222:event-bus/central-bus"
 }
 ]
}

Rule in Source Account

{
 "Name": "SendToCentralBus",
 "EventPattern": "{\"source\":[\"custom.app\"]}",
 "Targets": [
 {
 "Arn": "arn:aws:events:us-east-1:222222222222:event-bus/central-bus",
 "RoleArn": "arn:aws:iam::111111111111:role/EventBridgeRole"
 }
 ]
}

12. IAM Permissions

PutEvents Permission

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "events:PutEvents",
 "Resource": "arn:aws:events:us-east-1:123456789012:event-bus/default"
 }
 ]
}

Rule Management Permissions

{
 "Effect": "Allow",
 "Action": [
 "events:PutRule",
 "events:DeleteRule",
 "events:DescribeRule",
 "events:EnableRule",
 "events:DisableRule",
 "events:PutTargets",
 "events:RemoveTargets"
 ],
 "Resource": "arn:aws:events:us-east-1:123456789012:rule/*"
}

Target Invocation Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "lambda:InvokeFunction",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:MyFunction"
 }
 ]
}

Trust Policy for EventBridge

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "Service": "events.amazonaws.com"
 },
 "Action": "sts:AssumeRole"
 }
 ]
}

13. Integration with AWS Services

CodePipeline

{
 "source": ["aws.codepipeline"],
 "detail-type": ["CodePipeline Pipeline Execution State Change"],
 "detail": {
 "state": ["FAILED"],
 "pipeline": ["MyPipeline"]
 }
}

CodeBuild

{
 "source": ["aws.codebuild"],
 "detail-type": ["CodeBuild Build State Change"],
 "detail": {
 "build-status": ["FAILED", "STOPPED"]
 }
}

CodeDeploy

{
 "source": ["aws.codedeploy"],
 "detail-type": ["CodeDeploy Deployment State-change Notification"],
 "detail": {
 "state": ["FAILURE"]
 }
}

CodeCommit

{
 "source": ["aws.codecommit"],
 "detail-type": ["CodeCommit Repository State Change"],
 "detail": {
 "event": ["referenceCreated", "referenceUpdated"],
 "referenceType": ["branch"],
 "referenceName": ["main"]
 }
}

EC2

{
 "source": ["aws.ec2"],
 "detail-type": ["EC2 Instance State-change Notification"],
 "detail": {
 "state": ["terminated"]
 }
}

Auto Scaling

{
 "source": ["aws.autoscaling"],
 "detail-type": ["EC2 Instance Launch Successful"]
}

ECS

{
 "source": ["aws.ecs"],
 "detail-type": ["ECS Task State Change"],
 "detail": {
 "lastStatus": ["STOPPED"],
 "stoppedReason": [{
 "exists": true
 }]
 }
}

CloudFormation

{
 "source": ["aws.cloudformation"],
 "detail-type": ["CloudFormation Stack Status Change"],
 "detail": {
 "status-details": {
 "status": ["CREATE_COMPLETE", "UPDATE_COMPLETE"]
 }
 }
}

14. Scheduled Events (Cron/Rate)

Rate Expression

rate(5 minutes)
rate(1 hour)
rate(1 day)

Cron Expression

cron(0 12 * * ? *) # Every day at 12:00 PM UTC
cron(15 10 ? * MON-FRI *) # Weekdays at 10:15 AM UTC
cron(0 18 ? * MON *) # Every Monday at 6:00 PM UTC
cron(0/5 * * * ? *) # Every 5 minutes

Cron Format

cron(Minutes Hours Day-of-month Month Day-of-week Year)

Schedule Rule Example

{
 "Name": "DailyBackup",
 "ScheduleExpression": "cron(0 2 * * ? *)",
 "State": "ENABLED",
 "Targets": [
 {
 "Arn": "arn:aws:lambda:us-east-1:123456789012:function:BackupFunction",
 "Id": "1"
 }
 ]
}

15. Monitoring & Logging

CloudWatch Metrics

Invocations - Number of times target invoked
FailedInvocations - Failed target invocations
TriggeredRules - Rules that matched events
MatchedEvents - Events matched by rules
ThrottledRules - Rules throttled

CloudTrail Logging

All API calls logged
Rule creation, updates, deletions
PutEvents calls (optional)
Target modifications

Dead Letter Queues

Capture failed event deliveries
SQS queue as DLQ
Analyze and retry failed events
Set on target configuration

Retry Policy

Automatic retries for failed deliveries
Configure max retry attempts (0-185)
Configure max event age (60-86400 seconds)
Exponential backoff

16. Common Exam Scenarios

Scenario 1: Trigger Lambda on EC2 state change

Solution: