AWS Certified DevOps Engineer - Professional (DOP-C02): Practical Skills & Automation Study Guide

This guide focuses on the high-level practical skills required for the DOP-C02 exam, specifically targeting automated monitoring, security enforcement, and resilient event response.

Learning Objectives

By the end of this study guide, you will be able to:

• Configure and deploy management agents (SSM, CloudWatch) on EC2 fleets.
• Design event-driven remediation workflows using EventBridge, Lambda, and AWS Config.
• Implement complex deployment strategies including Blue/Green and Canary patterns.
• Orchestrate multi-account security using Service Control Policies (SCPs) and AWS Organizations.
• Manage artifact lifecycles across S3, ECR, and CodeArtifact.

Key Terms & Glossary

• SSM Agent: A component of AWS Systems Manager that enables the service to update, manage, and configure EC2 instances.
• CloudWatch Metric Filter: A feature that searches and matches terms, phrases, or values in your log events to turn them into numerical data for graphing/alarming.
• RTO (Recovery Time Objective): The maximum acceptable delay between the interruption of service and restoration.
• RPO (Recovery Point Objective): The maximum acceptable amount of data loss measured in time.
• Blue/Green Deployment: A release technique that reduces risk by running two identical production environments, only one of which serves traffic at a time.
• Service Control Policy (SCP): A type of organization policy used to manage permissions in your organization, offering central control over the maximum available permissions for all accounts.

The "Big Idea"

The transition from "SysOps" to "DevOps Professional" is marked by the move from manual troubleshooting to automated self-healing. In the AWS ecosystem, this means every event—be it a security violation (AWS Config), a performance dip (CloudWatch Alarms), or a resource change (EventBridge)—should trigger a programmatic response that restores the system to its "desired state" without human intervention.

Formula / Concept Box

Hierarchical Outline

• I. Monitoring and Logging (Unit 4)
  • A. Collection & Storage: Utilizing CloudWatch Agents for custom metrics (RAM/Disk) and S3 Lifecycle for long-term log storage.
  • B. Analysis: Searching log data via CloudWatch Logs Insights and creating real-time streams via Kinesis Data Firehose.
  • C. Anomaly Detection: Implementing CloudWatch Anomaly Detection to reduce alarm fatigue.
• II. Incident and Event Response (Unit 5)
  • A. Event Sources: Integration of AWS Health, CloudTrail, and EventBridge.
  • B. Remediating State: Using AWS Config Rules to automatically fix non-compliant resources (e.g., closing public S3 buckets).
  • C. Fleet Management: Utilizing Systems Manager (SSM) State Manager to maintain consistent configuration across instances.
• III. Resilient Cloud Solutions (Unit 3)
  • A. Global Scalability: Deploying DynamoDB Global Tables and Route 53 Health Checks for multi-region failover.
  • B. Deployment Strategies: Differentiating between Canary (incremental traffic shift) and Blue/Green (all-at-once shift).

Visual Anchors

Automated Remediation Workflow

Multi-Region High Availability

Definition-Example Pairs

• Event-Driven Design: An architecture where actions are triggered by changes in state.
  • Example: An S3 Event Notification triggers a Lambda function to resize an image the moment it is uploaded.
• Immutable Infrastructure: A strategy where servers are never modified after they are deployed; updates are done by replacing the server with a new version.
  • Example: Using EC2 Image Builder to create a fresh AMI and replacing the Auto Scaling Group instances instead of SSH-ing in to run yum update.
• Configuration Drift: When the actual state of a resource deviates from its defined (IaC) state.
  • Example: A developer manually changes a Security Group rule in the console, but the CloudFormation Drift Detection flags it as non-compliant.

Worked Examples

Scenario: Creating a CloudWatch Metric Filter for Error Tracking

Goal: Notify the DevOps team whenever a specific application log contains the word "CRITICAL-ERROR".

1. Identify the Log Group: Locate the /aws/lambda/my-app-function log group.
2. Define the Filter Pattern: Navigate to "Metric Filters" and create a filter with the pattern [..., status="CRITICAL-ERROR", message].
3. Assign Metric: Name the metric CriticalErrorCount and assign a value of 1 for every occurrence.
4. Create Alarm: Set a CloudWatch Alarm where CriticalErrorCount > 5 over a 5-minute period.
5. Action: Set the alarm action to send a message to an SNS Topic (e.g., DevOps-Alerts).

Checkpoint Questions

1. Q: What is the primary difference between a Blue/Green deployment and a Canary deployment?
   • A: Blue/Green shifts 100% of traffic to the new version at once, while Canary shifts traffic in small, incremental percentages to test stability.
2. Q: Which AWS service is best suited for maintaining a consistent patch level across 500 EC2 instances?
   • A: AWS Systems Manager (SSM) Patch Manager.
3. Q: How can you prevent an AWS account within an organization from deleting CloudTrail logs, even if the account root user tries to do so?
   • A: Apply a Service Control Policy (SCP) at the OU or Account level that explicitly Denies the cloudtrail:DeleteTrail action.

Muddy Points & Cross-Refs

• EventBridge vs. SNS: Use EventBridge for complex pattern matching (e.g., "Only if instance-id is X and state is stopped"). Use SNS for high-throughput, simple message delivery (e.g., "Blast this alert to 5000 subscribers").
• Config Rules vs. IAM: IAM controls who can do something. Config Rules check what was done and if it meets company policy (e.g., "All EBS volumes must be encrypted").

Comparison Tables

Deployment Strategies

Security & Monitoring Services