AWS Certified DevOps Engineer Professional: Configuration Management and IaC Study Guide

Learning Objectives

After studying this guide, you should be able to:

• Select the appropriate AWS service for specific configuration management tasks (e.g., SSM vs. AWS Config vs. OpsWorks).
• Design reusable infrastructure components using AWS CloudFormation, SAM, and CDK.
• Implement multi-account and multi-region deployment strategies using CloudFormation StackSets.
• Automate system inventory, patching, and state enforcement using AWS Systems Manager.
• Establish governance and compliance guardrails using AWS Control Tower and Service Control Policies (SCPs).

Key Terms & Glossary

• Infrastructure as Code (IaC): The practice of managing and provisioning computing infrastructure through machine-readable definition files, rather than physical hardware configuration or interactive configuration tools.
• Drift: The phenomenon where the actual configuration of a resource in the environment deviates from the expected state defined in IaC templates.
• Idempotency: A property of deployment operations where multiple applications of the same operation result in the same outcome, preventing duplicate resources or errors.
• State Manager (SSM): A secure and scalable configuration management service that automates the process of keeping managed instances in a defined state.
• Golden Image: A template for a virtual machine or container that is pre-configured with a specific operating system and software stack.

The "Big Idea"

The core of AWS DevOps Professionalism is moving away from manual, snowflake server configurations toward Self-Healing, Immutable, and Auditable Infrastructure. By treating infrastructure as software (IaC) and utilizing automated configuration management, organizations achieve the speed of delivery required for modern business without sacrificing security or reliability. The goal is a "closed-loop" system where configuration is defined, deployed, monitored for drift, and automatically remediated.

Formula / Concept Box

Hierarchical Outline

• I. Infrastructure as Code (IaC) Frameworks
  • AWS CloudFormation: Standard JSON/YAML declarative templates.
  • AWS CDK: High-level constructs using programming languages (Python, TypeScript, etc.).
  • AWS SAM: Extension of CloudFormation specialized for Serverless resources.
  • StackSets: Mechanism to deploy stacks across Multiple Accounts and Regions.
• II. Configuration Management Services
  • AWS Systems Manager (SSM):
    • Patch Manager: Automates OS updates.
    • State Manager: Enforces software configuration.
    • Parameter Store: Secure string/secret management.
  • AWS Config: Tracks resource history and enforces compliance via Config Rules.
  • AWS AppConfig: Manages application-level configuration flags and parameters.
• III. Multi-Account Governance
  • AWS Organizations: Centralized billing and account grouping.
  • Service Control Policies (SCPs): Top-down permission guardrails that override IAM.
  • AWS Control Tower: Orchestrator for setting up a secure multi-account landing zone.

Visual Anchors

The Configuration Lifecycle

Multi-Account Organization Structure

Definition-Example Pairs

• AWS Config Rule: A logic-based check that evaluates if an AWS resource matches a desired configuration.
  • Example: A rule that checks if all EBS volumes in the production account are encrypted. If an unencrypted volume is found, it is marked "Non-Compliant."
• SSM Document: A JSON or YAML file that defines the actions Systems Manager performs on your managed instances.
  • Example: A document that runs a shell script to install the CloudWatch Agent and start the service across a fleet of 500 EC2 instances.
• CloudFormation Module: A way to package resource configurations into reusable building blocks.
  • Example: A company creates a "StandardS3Bucket" module that includes logging, versioning, and encryption by default, which developers then use in their own templates.

Worked Examples

Scenario: Remediating Public S3 Buckets Automatically

Problem: Security policy forbids public S3 buckets. You need a system that detects and fixes this in real-time.

Step-by-Step Solution:

1. Detection: Enable AWS Config and create a managed rule s3-bucket-public-read-prohibited.
2. Trigger: When a bucket is created or modified with public access, AWS Config marks it as Non-Compliant.
3. Action: Configure a Remediation Action using an SSM Automation Document (AWS-DisableS3BucketPublicReadWrite).
4. Verification: The SSM document executes a script via the AWS SDK to update the bucket ACL/Policy, returning the bucket to a compliant state.

Checkpoint Questions

1. What is the primary difference between an IAM Policy and an SCP in an AWS Organization?
2. Which SSM feature would you use to ensure that a specific version of an anti-virus agent is installed on all EC2 instances every 24 hours?
3. How do CloudFormation StackSets handle deployment failures in a specific region when performing a multi-region update?
4. When would you choose AWS OpsWorks over AWS Systems Manager State Manager?

Muddy Points & Cross-Refs

• SSM vs. AWS Config: Beginners often confuse these. Remember: SSM is for doing things (patching, running scripts, state enforcement), while AWS Config is for auditing things (inventory history, compliance rules).
• CDK vs. CloudFormation: CDK compiles into CloudFormation. Use CDK if you need loops and logic; use CloudFormation for simple, static declarations.
• Service Catalog: This isn't just a store; it’s a governance tool. It allows users to deploy approved IaC templates without needing direct permissions to the underlying services.

Comparison Tables

IaC Tools Comparison

Multi-Account Management