AWS Certified DevOps Engineer - Professional (DOP-C02) Study Guide

This guide covers the core competencies required for the DOP-C02 exam, focusing on monitoring, event-driven automation, high availability, and security at scale.

Learning Objectives

By the end of this guide, you should be able to:

• Configure advanced monitoring and logging using CloudWatch and X-Ray.
• Architect event-driven response systems using EventBridge and Lambda.
• Implement multi-Region and multi-AZ resilient architectures.
• Automate security controls and identity management across a multi-account organization.
• Design complex deployment strategies (Blue/Green, Canary) for various compute platforms.

Key Terms & Glossary

• RTO (Recovery Time Objective): The maximum acceptable delay between the interruption of service and restoration of service.
• RPO (Recovery Point Objective): The maximum acceptable amount of data loss measured in time (e.g., losing 4 hours of data).
• SCP (Service Control Policy): A type of organization policy used to manage permissions in your organization, acting as a guardrail for IAM roles.
• Drift Detection: A feature in CloudFormation that identifies if stack resources have been modified outside of the template.
• Canary Deployment: A deployment strategy where a small percentage of traffic is shifted to a new version to test stability before full rollout.

The "Big Idea"

The core philosophy of the AWS DevOps Professional mindset is "Automate Everything." Beyond just writing code, this means creating self-healing infrastructure where monitoring (CloudWatch) triggers automated responses (Lambda/EventBridge) to maintain security (AWS Config) and performance (Auto Scaling) without human intervention.

Formula / Concept Box

Hierarchical Outline

• I. Monitoring and Logging (Domain 4)
  • CloudWatch Logs: Log groups, retention, and subscription filters (Kinesis, Lambda, OpenSearch).
  • Metrics & Alarms: Custom metrics via CloudWatch Agent; Anomaly detection for baseline-shifting.
  • AWS X-Ray: Distributed tracing for microservices and serverless (Lambda/API Gateway).
• II. Incident and Event Response (Domain 5)
  • Event Sources: AWS Health, CloudTrail, S3 Event Notifications.
  • Processing Workflows: EventBridge patterns -> SNS/SQS -> Lambda/Step Functions.
  • Auto-Remediation: Using AWS Config rules to trigger SSM Automation for non-compliant resources.
• III. Resilient Cloud Solutions (Domain 3)
  • High Availability: Multi-AZ for RDS/EC2; Multi-Region for S3/DynamoDB Global Tables.
  • Disaster Recovery: Pilot Light, Warm Standby, and Multi-Site Active-Active strategies.
• IV. Security and Compliance (Domain 6)
  • Identity at Scale: IAM Identity Center (SSO), Permission Boundaries, and SCPs.
  • Data Protection: KMS for encryption at rest; ACM for encryption in transit.
  • Security Automation: GuardDuty findings triggering Lambda-based isolation of compromised instances.

Visual Anchors

Event-Driven Remediation Flow

Multi-Region High Availability

Definition-Example Pairs

• Term: AWS Config Remediation
  • Definition: Automatically fixing a resource that violates a compliance rule.
  • Example: An S3 bucket is created without encryption. AWS Config detects it and triggers an SSM Automation document to enable AES-256 encryption immediately.
• Term: CloudWatch Metric Filter
  • Definition: Extracting numerical data from log files to create a searchable metric.
  • Example: Searching application logs for the string "Error 500" and creating a metric that counts occurrences, then setting an alarm if errors exceed 10 per minute.
• Term: IAM Permission Boundary
  • Definition: An advanced feature used to delegate administration to users while ensuring they cannot exceed a specific set of permissions.
  • Example: Allowing a developer to create IAM roles for Lambda, but only if those roles do not grant access to the Finance S3 bucket.

Worked Examples

Scenario: Automating Log Analysis and Alerting

Problem: A web application on EC2 is experiencing intermittent latency. We need to alert the team when latency exceeds 2 seconds for more than 5 minutes.

1. Step 1: Metric Collection. Install the CloudWatch Agent on the EC2 instances to collect mem_used and custom application metrics.
2. Step 2: Metric Creation. Use the CloudWatch PutMetricData API (or custom agent config) to push ResponseTime data.
3. Step 3: Alarm Configuration. Create a CloudWatch Alarm:
   • Metric: ResponseTime
   • Statistic: Average
   • Period: 1 minute
   • Threshold: > 2000ms
   • Datapoints to Alarm: 5 out of 5
4. Step 4: Notification. Set the alarm action to send a message to an Amazon SNS topic named DevOps-Alerts subscribed to the team's email/Slack.

Checkpoint Questions

1. What is the difference between a Pilot Light and a Warm Standby DR strategy?
2. How can you ensure that no user in an AWS Organization can disable CloudTrail, even if they have Administrator access?
3. Which service would you use to trace a request as it moves from API Gateway to Lambda to DynamoDB?
4. What is the primary benefit of using an ECS Capacity Provider over a standard Auto Scaling Group for containers?

Muddy Points & Cross-Refs

• Service Linked Roles vs. Service Roles: Service Linked Roles are predefined by AWS; Service Roles are created by you for a specific service to assume. (Cross-ref: IAM Domain).
• EventBridge vs. SNS: EventBridge is for routing events based on patterns; SNS is for high-throughput message broadcasting (Pub/Sub). Use EventBridge for "If X happens, do Y" logic.
• Deployment strategies: Remember that Blue/Green is for complete environment swaps, while Canary is for incremental traffic shifting. Canary is generally safer for microservices.

Comparison Tables

Deployment Strategy Comparison

SQS vs. Kinesis Data Streams