AWS Certified DevOps Engineer - Professional (DOP-C02): Core Skills Study Guide

This guide covers the essential domains of the DOP-C02 exam, focusing on resilient cloud solutions, monitoring, logging, and automated security enforcement.

Learning Objectives

By the end of this study guide, you should be able to:

• Design and Implement event-driven, asynchronous architectures using Amazon EventBridge, Lambda, and SQS.
• Configure and Scale multi-region AWS environments including compute (EC2, ECS, EKS) and data layers (DynamoDB, RDS).
• Automate Security Controls and governance using Service Control Policies (SCPs), AWS Config, and Security Hub.
• Execute Advanced Deployment Strategies such as Blue/Green and Canary for instance-based and serverless environments.
• Establish Monitoring & Logging Pipelines using CloudWatch agents, metric filters, and X-Ray for root cause analysis.

Key Terms & Glossary

• RTO (Recovery Time Objective): The maximum acceptable delay between the interruption of service and restoration.
• RPO (Recovery Point Objective): The maximum acceptable amount of data loss measured in time.
• SSM Agent: A tool installed on EC2 instances or on-premises servers that allows Systems Manager to communicate with and manage the resource.
• EventBridge: A serverless event bus that makes it easy to connect applications using data from your own apps, integrated SaaS apps, and AWS services.
• Service Control Policy (SCP): A type of organization policy used to manage permissions in your organization, acting as a guardrail for what accounts can do.
• Metric Filter: A CloudWatch feature that searches and transforms log data into numerical CloudWatch metrics.

The "Big Idea"

In the AWS Professional DevOps mindset, Automation is the bedrock of Reliability and Security. Instead of manual intervention, a DevOps engineer designs systems that self-heal (through Auto Scaling and AWS Config remediations), self-deploy (via CI/CD pipelines), and self-audit (using GuardDuty and CloudWatch). The transition from 'Professional' level expects you to handle multi-account, multi-region complexities where manual configuration is no longer feasible.

Formula / Concept Box

Hierarchical Outline

• I. Monitoring and Logging
  • Custom Metric Collection: Using the CloudWatch Agent for disk/memory metrics.
  • Log Processing: S3 Event Notifications $\rightarrow$ Lambda $\rightarrow$ OpenSearch.
  • Dashboarding: Visualizing health via CloudWatch and QuickSight.
• II. Incident and Event Response
  • Event-Driven Design: Asynchronous fan-out patterns using SNS and SQS.
  • Auto Scaling: RDS storage autoscaling and ECS capacity providers.
  • Remediation: Using AWS Config rules to fix non-compliant resources automatically.
• III. Resilient Cloud Solutions
  • Disaster Recovery (DR): Pilot Light, Warm Standby, and Multi-Site (Active/Active).
  • High Availability: Load balancing across Multiple Availability Zones (AZs).
  • Data Replication: DynamoDB Global Tables and RDS Cross-Region Read Replicas.
• IV. Security and Compliance
  • Identity at Scale: IAM Permissions Boundaries and Organization SCPs.
  • Defense in Depth: Combining WAF, Shield, and Network Firewall.
  • Data Protection: KMS for encryption at rest and ACM for SSL/TLS in transit.

Visual Anchors

Event-Driven Architecture Flow

Deployment Strategy Visualization

Definition-Example Pairs

• Multi-Account Governance: The process of centralizing control over multiple AWS accounts.
  • Example: Using AWS Control Tower to set up a landing zone with pre-configured SCPs that prevent any account from disabling CloudTrail.
• Self-Healing Infrastructure: Systems that automatically correct deviations from the desired state.
  • Example: An AWS Config Rule detects an S3 bucket is public and triggers a Systems Manager Automation document to set the bucket to private immediately.
• Metric Filter: Searching specific patterns in logs to create data points.
  • Example: Searching for the string "ERROR" in CloudWatch Logs and creating a custom metric that triggers an alarm if the error count exceeds 10 per minute.

Worked Examples

Example 1: Remediating Security Drift

Scenario: A developer accidentally opens Port 22 (SSH) to 0.0.0.0/0 on a production Security Group.

1. Detection: AWS Config monitors the restricted-common-ports rule.
2. Trigger: Config identifies the change as "Non-Compliant."
3. Remediation: Config triggers a Lambda function or SSM Automation document.
4. Action: The automation script removes the ingress rule from the Security Group.
5. Notification: SNS sends an alert to the DevOps team regarding the unauthorized change and subsequent fix.

Example 2: Cross-Region DR for a Stateful App

Scenario: A requirement for an RTO of 15 minutes and RPO of 1 minute for a web app using RDS.

1. Strategy: Warm Standby.
2. Setup: Create an RDS Cross-Region Read Replica in the DR region.
3. App Layer: Deploy a minimal EC2 fleet in the DR region behind an ALB (stopped or at minimum capacity).
4. Failover: If the primary region fails, Route 53 Health Checks trigger a DNS failover. The Read Replica is promoted to a standalone instance, and the EC2 Auto Scaling group scales up the app servers.

Checkpoint Questions

1. What is the main difference between a Canary deployment and a Blue/Green deployment?
2. How does a CloudWatch Metric Stream differ from a standard CloudWatch Metric?
3. Which service would you use to centralize security findings from GuardDuty, Inspector, and IAM Access Analyzer?
4. True or False: An SCP can grant permissions to an IAM user that does not have an attached IAM policy.

Muddy Points & Cross-Refs

• EventBridge vs. S3 Event Notifications: S3 notifications are limited to S3 events only. EventBridge can capture events from almost any AWS service and allows for complex pattern matching (filtering) before sending to a target.
• Systems Manager (SSM) vs. OpsWorks: SSM is the modern tool for fleet management, patching, and configuration. OpsWorks (based on Chef/Puppet) is generally for specific legacy configuration management needs.
• Canary vs. Linear Deployment: In CodeDeploy, a Canary shift moves a small percentage (e.g., 10%) and then the rest after a delay. Linear moves traffic in equal increments (e.g., 10% every 2 minutes).

Comparison Tables

Deployment Strategies

Disaster Recovery Strategies