AWS Certified DevOps Engineer - Professional (DOP-C02): Advanced Skills Study Guide

This guide focuses on the critical "Skills" required for the DOP-C02 exam, specifically centering on event-driven automation, resilient architectures, and advanced security monitoring.

---

Learning Objectives

By the end of this study guide, you will be able to:

• Configure advanced monitoring agents and custom metrics to track application health.
• Design event-driven, asynchronous architectures for automated remediation and notification.
• Implement multi-region and multi-AZ resilience strategies to meet strict RTO/RPO requirements.
• Automate security controls and identity management at scale across multi-account environments.
• Manage the full lifecycle of artifacts and deployment strategies for diverse compute platforms.

---

Key Terms & Glossary

• EventBridge (formerly CloudWatch Events): A serverless event bus that makes it easy to connect applications using data from your own applications, integrated SaaS applications, and AWS services.
• RTO (Recovery Time Objective): The maximum acceptable amount of time that a system, network, or application can be down after a failure.
• RPO (Recovery Point Objective): The maximum acceptable amount of data loss measured in time (e.g., "we can lose 5 minutes of data").
• SCP (Service Control Policy): A type of organization policy used to manage permissions in your organization, acting as a guardrail for what actions IAM users/roles can perform.
• Metric Filter: A CloudWatch feature that allows you to search for and match terms, phrases, or values in your log events and turn them into numerical metrics.

---

The "Big Idea"

The transition from an Associate to a Professional DevOps Engineer is marked by the move from manual configuration to automated governance. The "Big Idea" is the creation of a Self-Healing Infrastructure. Instead of waiting for an alarm to trigger a manual ticket, the Professional DevOps Engineer uses EventBridge, Lambda, and AWS Config to detect deviations from the desired state and remediate them automatically in real-time.

---

Formula / Concept Box

---

Hierarchical Outline

1. Monitoring and Logging Mastery
   • Agent Deployment: Installing SSM and CloudWatch agents on EC2 for memory/disk metrics.
   • Log Processing: Using CloudWatch Log Subscriptions to stream data to OpenSearch or Kinesis.
   • Custom Metrics: Creating metrics from logs via Metric Filters to trigger alarms.
2. Event-Driven Automation
   • Asynchronous Patterns: S3 Event Notifications $\rightarrow$ Lambda for automated log processing.
   • Remediation: AWS Config Rules $\rightarrow$ Systems Manager Automation to fix non-compliant resources.
3. Resilience & Scalability
   • Auto Scaling: Configuring ECS Capacity Providers and DynamoDB Auto Scaling for fluctuating loads.
   • Disaster Recovery: Implementing Pilot Light vs. Warm Standby across regions.
4. Security at Scale
   • Identity: Designing IAM Permission Boundaries to delegate admin tasks safely.
   • Defense in Depth: Combining WAF, Shield, and Network Firewall for multi-layer protection.

---

Visual Anchors

Automated Remediation Workflow

Multi-Region Resilience Strategy

---

Definition-Example Pairs

• Term: Metric Filter
  • Definition: A mechanism to extract numerical data from text-based logs.
  • Example: Creating a filter for the string "ERROR" in application logs and incrementing a count. If the count exceeds 10 in 1 minute, a CloudWatch Alarm notifies the DevOps team via SNS.
• Term: Immutable Deployment
  • Definition: A deployment strategy where you never update existing instances, but rather replace them with new ones.
  • Example: Using Blue/Green deployment in CodeDeploy. You provision a completely new "Green" fleet, test it, then shift traffic from the "Blue" fleet via the Load Balancer.

---

Worked Examples

Scenario: Automating Log Delivery to OpenSearch

Goal: Securely move application logs from EC2 to an OpenSearch cluster for analysis.

1. Step 1: Agent Installation. Install the CloudWatch Agent on the EC2 instances using SSM Run Command.
2. Step 2: Log Group Creation. Configure the agent to push /var/log/app.log to a CloudWatch Log Group named AppLogs.
3. Step 3: Subscription Filter. Create a CloudWatch Logs Subscription Filter. Choose "Amazon OpenSearch Service" as the destination.
4. Step 4: IAM Permissions. Ensure the Lambda function (managed by the subscription) has an IAM role that can access the OpenSearch domain and the KMS key used for log encryption.
5. Step 5: Verification. Perform a search in Dashboards to confirm real-time ingestion.

---

Checkpoint Questions

1. What is the difference between a CloudWatch Alarm and a CloudWatch Event (EventBridge)?
2. How does a Permission Boundary differ from an SCP in a multi-account environment?
3. Which DR strategy offers a lower RTO: Pilot Light or Warm Standby?
4. How would you capture memory utilization on an EC2 instance since it is not a default metric?

▶Click to see answers

1. An Alarm monitors a metric over time and changes state; an Event is a point-in-time notification of a resource change.
2. SCPs set the maximum permissions for an entire account; Permission Boundaries set the maximum permissions for a specific IAM entity (user/role).
3. Warm Standby (as it has scaled-down functional services running, whereas Pilot Light only has the data layer).
4. Install the CloudWatch Agent; memory is an OS-level metric not visible to the hypervisor.

---

Muddy Points & Cross-Refs

• Cross-Account Observability: Many students struggle with viewing logs across 100+ accounts. Cross-Account Observability in CloudWatch now allows a central monitoring account to sink logs/metrics from source accounts.
• X-Ray vs. CloudWatch Logs: Use X-Ray for tracing (finding where latency occurs in a microservice chain) and CloudWatch for logging (what happened inside a single service).
• Deployment Agents: Remember that CodeDeploy requires an agent on EC2/On-Premises, but not for Lambda or ECS deployments.

---

Comparison Tables

Disaster Recovery Strategies

EventBridge vs. SNS