AWS DOP-C02: Operational Excellence, Security, and Resilience

This study guide focuses on the technical skills required to automate incident response, manage configurations at scale, and implement high-availability architectures as defined in the DOP-C02 exam guide.

Learning Objectives

After studying this guide, you should be able to:

• Configure and deploy AWS Systems Manager (SSM) and CloudWatch agents on EC2 fleets.
• Implement event-driven remediation workflows using AWS Config, EventBridge, and Lambda.
• Design multi-Region and multi-AZ architectures to meet specific RTO and RPO requirements.
• Manage identity and access at scale using IAM Permissions Boundaries and Service Control Policies (SCPs).
• Automate security auditing and data protection using Security Hub and Macie.

Key Terms & Glossary

• RTO (Recovery Time Objective): The maximum acceptable delay between the interruption of service and restoration.
• RPO (Recovery Point Objective): The maximum acceptable amount of data loss measured in time.
• SSM Agent: Software installed on EC2 instances or on-premises servers to enable management via AWS Systems Manager.
• Metric Filter: A CloudWatch feature that searches and transforms log data into numerical metrics for graphing or alarming.
• Drift Detection: A CloudFormation feature that identifies if a stack's actual configuration has deviated from its template.
• SCP (Service Control Policy): An organization policy used to manage permissions in your organization, acting as a guardrail for IAM entities.

The "Big Idea"

The core philosophy of the AWS DevOps Professional track is the Elimination of Manual Intervention. Whether it is scaling a fleet, remediating a security vulnerability, or recovering from a Regional outage, the goal is to build a self-healing, event-driven system where the infrastructure responds to metrics and events automatically, governed by Infrastructure as Code (IaC).

Formula / Concept Box

Hierarchical Outline

• I. Event-Driven Operations
  • Event Sources: CloudTrail (API logs), AWS Health (Service status), CloudWatch (Performance).
  • Processing: EventBridge (Rules/Patterns), S3 Event Notifications.
  • Action: Lambda (Compute), SNS (Notification), SSM Automation (Remediation).
• II. Configuration & IaC
  • Provisioning: CloudFormation (Stacks/StackSets), AWS CDK (High-level constructs).
  • Compliance: AWS Config (Rules/Remediation), SSM State Manager (Desired state).
• III. Resilience & Scalability
  • Compute Scaling: EC2 Auto Scaling (Predictive/Dynamic), ECS Capacity Providers.
  • Data Scaling: RDS Storage Auto Scaling, DynamoDB (Provisioned vs. On-Demand).
  • High Availability: Route 53 (Health checks/Failover), ALB (Target Groups).

Visual Anchors

Event-Driven Remediation Flow

Multi-Region Disaster Recovery Strategy

Definition-Example Pairs

• Blue/Green Deployment: A strategy that uses two identical environments (Blue is live, Green is new).
  • Example: Swapping CNAMEs in Route 53 to point users to a new version of an app while keeping the old one as a rollback target.
• Canary Deployment: Rolling out a change to a small subset of users before the whole fleet.
  • Example: Using an ALB weighted target group to send 5% of traffic to a new Lambda function version.
• Immutable Infrastructure: Components are replaced rather than updated in place.
  • Example: Instead of patching an EC2 instance via SSH, you bake a new AMI with the patch and trigger an Auto Scaling Instance Refresh.

Worked Examples

Example 1: Remediating Compliance Breaches

Scenario: A developer accidentally opens Port 22 (SSH) to the world 0.0.0.0/0 in a Security Group.

1. Detection: AWS Config rule restricted-common-ports identifies the non-compliant resource.
2. Trigger: The change in compliance status triggers a CloudWatch Event (EventBridge).
3. Action: An SSM Automation Document (AWS-DisablePublicAccessForSecurityGroup) is invoked.
4. Verification: The Security Group is modified to remove the wide-open ingress rule, and AWS Config updates the resource status to 'Compliant'.

Example 2: Log Aggregation at Scale

Scenario: You need to analyze 5xx errors across 100 EC2 instances.

1. Collection: Install the CloudWatch Agent on all instances via SSM State Manager.
2. Filtering: Create a Metric Filter on the access.log group to look for the " 500 " pattern.
3. Alarming: Create a CloudWatch Alarm if the 5xx count exceeds 50 per minute.
4. Analysis: Use CloudWatch Logs Insights to run a query: filter @message like /500/ | stats count(*) by bin(1m).

Checkpoint Questions

1. What is the primary difference between an IAM Permissions Boundary and a Service Control Policy (SCP)?
2. Which service would you use to find the root cause of high latency in a microservices architecture using distributed tracing?
3. An Auto Scaling group is not scaling out despite high CPU. What is the first thing to check in the Scaling Policy?
4. How does Route 53 distinguish between a "Primary" and "Secondary" resource in a failover routing policy?
5. Name two services that can natively trigger a Lambda function based on an object being uploaded to S3.

Muddy Points & Cross-Refs

• EventBridge vs. CloudWatch Events: They are essentially the same underlying service, but EventBridge is the evolved version that supports schema registries and 3rd-party SaaS integrations. Use the EventBridge console/APIs for modern implementations.
• SSM Parameter Store vs. Secrets Manager: Use Parameter Store for standard config (plain text or encrypted). Use Secrets Manager for items requiring automatic rotation (like RDS passwords).
• Control Tower vs. Organizations: Organizations is the core service for account management; Control Tower is a high-level "orchestrator" that sets up a Landing Zone using Organizations, SCPs, and AWS Config.

Comparison Tables

Disaster Recovery Strategies

Deployment Strategies