AWS Certified DevOps Engineer Professional (DOP-C02): Master Study Guide

This guide focuses on the critical automation, monitoring, and resiliency skills required for the DOP-C02 exam, grounded in event-driven architectures and multi-region deployment strategies.

Learning Objectives

After studying this guide, you should be able to:

• Design event-driven remediation using Amazon EventBridge, AWS Lambda, and AWS Config.
• Implement scalable architectures across EC2, ECS, EKS, and DynamoDB.
• Configure multi-region recovery strategies to meet specific RTO and RPO targets.
• Automate security compliance and identity management at scale using Service Control Policies (SCPs) and AWS Security Hub.
• Analyze and troubleshoot deployment failures and system performance using CloudWatch and X-Ray.

Key Terms & Glossary

• Idempotency: The property of certain operations in which they can be applied multiple times without changing the result beyond the initial application (critical for Lambda and IaC).
• RTO (Recovery Time Objective): The maximum acceptable delay between the interruption of service and restoration.
• RPO (Recovery Point Objective): The maximum acceptable amount of data loss measured in time.
• Drift Detection: The process of identifying whether a CloudFormation stack's actual configuration differs from its expected template configuration.
• Fan-out Pattern: A messaging pattern where a single event is sent to multiple subscribers (e.g., S3 Event -> SNS -> Multiple Lambdas).

The "Big Idea"

The transition from a DevOps Engineer to a Professional level requires moving beyond simple automation to Self-Healing Systems. This involves creating tight feedback loops where monitoring (CloudWatch/X-Ray) informs automated response (Lambda/Systems Manager) to maintain a desired state (AWS Config/IaC) without human intervention.

Formula / Concept Box

Hierarchical Outline

1. SDLC Automation
   • Artifact Management: Using CodeArtifact and S3 for secure, versioned storage.
   • Deployment Strategies: Blue/Green (immutable) vs. Canary (traffic shifting).
2. Configuration Management & IaC
   • Fleet Management: SSM Agent for EC2 configuration and patching.
   • Governance: AWS Organizations, SCPs, and Control Tower for multi-account guardrails.
3. Resiliency & Scalability
   • Compute Scaling: EC2 Auto Scaling, ECS Capacity Providers, EKS Autoscalers.
   • Data Resiliency: Aurora Global Databases, DynamoDB Global Tables.
4. Monitoring & Logging
   • Custom Metrics: CloudWatch Agent for disk/memory utilization.
   • Analysis: Athena and CloudWatch Logs Insights for searching petabytes of log data.

Visual Anchors

Event-Driven Remediation Flow

Multi-Region High Availability Architecture

Definition-Example Pairs

• Metric Filter: A CloudWatch feature that turns log data into numerical metrics.
  • Example: Extracting the count of "404 Error" strings from access logs to trigger an alarm.
• Systems Manager State Manager: A tool to maintain managed instances in a defined configuration.
  • Example: Ensuring that a specific antivirus agent is always installed and running on every EC2 instance in a fleet.
• Canary Deployment: A deployment strategy that releases software to a small subset of users first.
  • Example: Route 53 weighted routing sending 5% of traffic to a new version of a Lambda-based API.

Worked Examples

Scenario: Automating RDS Storage Scaling

Problem: An RDS instance is running out of storage frequently due to unpredictable log growth.

Step-by-Step Solution:

1. Enable Storage Autoscaling: In the RDS console, set the "Maximum Storage Threshold."
2. CloudWatch Alarm: Create an alarm for the FreeStorageSpace metric.
3. EventBridge Rule: Trigger an event when the alarm state changes to ALARM.
4. Notification: Send a message via Amazon SNS to the DevOps team alias to notify them that the auto-scale was triggered.

Scenario: Remediating Public S3 Buckets

1. AWS Config: Deploy the s3-bucket-public-read-prohibited managed rule.
2. Remediation Action: Link the rule to an SSM Automation Document (AWS-ConfigureS3BucketPublicAccessBlock).
3. Execution: When a user creates a public bucket, Config detects it and SSM automatically applies the Public Access Block within seconds.

Checkpoint Questions

1. What is the difference between a CloudWatch Metric Filter and a CloudWatch Agent custom metric?
2. Which service would you use to aggregate compliance status across 50 AWS accounts in an Organization?
3. In a Blue/Green deployment using CodeDeploy, what happens to the "Green" environment if the deployment fails?
4. How does Amazon EventBridge differ from S3 Event Notifications for processing file uploads?

Muddy Points & Cross-Refs

• SSM vs. OpsWorks: Use SSM for lightweight, agent-based management and patching. Use OpsWorks if you specifically need Chef or Puppet recipes.
• CloudWatch Logs Insights vs. Athena: Use Insights for quick, ad-hoc queries on CloudWatch log groups. Use Athena for long-term analysis of logs archived in S3 (e.g., CloudTrail or VPC Flow Logs).
• EventBridge vs. SNS: Use EventBridge for complex pattern matching (e.g., "Only if EC2 state is 'running'"). Use SNS for high-throughput, simple fan-out notifications.

Comparison Tables

Disaster Recovery (DR) Strategies

Deployment Strategies