DOP-C02 Master Study Guide: Applied DevOps Skills

This study guide focuses on the practical application of AWS services to achieve high availability, automated security, and event-driven responsiveness as required for the AWS Certified DevOps Engineer - Professional exam.

Learning Objectives

After studying this guide, you should be able to:

• Configure advanced monitoring solutions using CloudWatch custom metrics, filters, and dashboards.
• Implement automated remediation workflows using AWS Config, EventBridge, and Lambda.
• Design multi-account and multi-region architectures that meet specific RTO and RPO requirements.
• Manage complex CI/CD pipelines including artifact versioning and varied deployment strategies (Blue/Green, Canary).
• Apply security at scale using SCPs, IAM Identity Center, and automated security control enforcement.

Key Terms & Glossary

• RTO (Recovery Time Objective): The maximum acceptable delay between the interruption of service and restoration.
• RPO (Recovery Point Objective): The maximum acceptable amount of data loss measured in time.
• SCP (Service Control Policy): A type of organization policy used to manage permissions in your organization.
• Metric Filter: A CloudWatch feature that searches and transforms log data into numerical metrics.
• Immutable Deployment: A pattern where instead of updating an existing server, you replace it with a new one (e.g., Blue/Green).
• Event-Driven Architecture: A software architecture pattern promoting the production, detection, and consumption of events.

The "Big Idea"

The core philosophy of the DOP-C02 exam is "Infrastructure as Code and Automated Remediation." It isn't enough to just build a system; you must build a system that monitors itself, heals itself, and scales itself based on real-time data without human intervention. This requires a deep understanding of how events (EventBridge) trigger actions (Lambda/SSM) to maintain a "Desired State."

Formula / Concept Box

Hierarchical Outline

• I. Monitoring and Logging
  • CloudWatch Mastery: Custom metrics, high-resolution metrics (1-second), and Metric Streams for 3rd party integration.
  • Log Processing: Using CloudWatch Logs Insights for analysis and Kinesis Data Firehose for delivery to OpenSearch.
  • Tracing: AWS X-Ray for identifying bottlenecks in distributed microservices.
• II. Resilient Cloud Solutions
  • Auto Scaling: Horizontal scaling for EC2, RDS Storage, DynamoDB (RCU/WCU), and ECS/EKS Capacity Providers.
  • High Availability: Multi-AZ deployments for RDS and ALB; Multi-Region for S3 Cross-Region Replication and Aurora Global Databases.
• III. Event and Incident Response
  • EventBridge: Central bus for routing AWS service events to targets like SNS or Step Functions.
  • AWS Config: Monitoring configuration drift and triggering automated remediation via SSM Automation documents.
• IV. Security and Compliance
  • Identity at Scale: Using IAM Permissions Boundaries to delegate authority without escalating privilege.
  • Data Protection: Macie for PII discovery; KMS for envelope encryption and key rotation.

Visual Anchors

Automated Remediation Flow

High Availability Architecture (TikZ)

Definition-Example Pairs

• Metric Filter
  • Definition: A mechanism to extract data from logs to create numerical time-series data.
  • Example: Creating a filter that looks for the string "ERROR" in application logs and increments a CloudWatch metric every time it appears.
• Permissions Boundary
  • Definition: An advanced IAM feature used to set the maximum permissions that an identity-based policy can grant to an IAM entity.
  • Example: Allowing a junior admin to create IAM roles for Lambda functions, but ensuring those roles cannot access the Billing dashboard, regardless of what the junior admin specifies.
• Canary Deployment
  • Definition: Shifting traffic to a new version in small increments to test stability.
  • Example: Using Route 53 Weighted Routing to send 5% of traffic to a new production stack, monitoring for 4xx/5xx errors before increasing to 100%.

Worked Examples

Scenario: Automating S3 Log Processing

Problem: You need to process VPC Flow Logs stored in S3 and send alerts if unauthorized IP addresses are detected.

1. S3 Event Notification: Configure the S3 bucket where Flow Logs are delivered to emit an event on s3:ObjectCreated:*.
2. EventBridge Rule: Create a rule that matches the S3 event and sets a Lambda function as the target.
3. Lambda Logic: The Lambda function downloads the log file, parses the content, and compares IPs against a DynamoDB blacklist.
4. SNS Alert: If a match is found, Lambda publishes a message to an SNS topic subscribed to by the security team.

Scenario: Remediating Unencrypted S3 Buckets

Problem: Your organization requires all S3 buckets to have server-side encryption enabled.

1. AWS Config Rule: Use the managed rule s3-bucket-server-side-encryption-enabled.
2. Remediation Action: Associate an SSM Automation document (AWS-EnableS3BucketEncryption) with the rule.
3. Execution: When Config detects an unencrypted bucket, it automatically triggers the SSM document to apply the default AES-256 encryption setting to that bucket.

Checkpoint Questions

1. What is the difference between an EventBridge Rule and an AWS Config Remediation action?
2. Which CloudWatch feature allows you to stream metrics to a Kinesis Data Firehose destination in real-time?
3. How do SCPs interact with IAM policies in a multi-account environment?
4. What is the benefit of using an ECS Capacity Provider over a standard Auto Scaling Group for container workloads?

Muddy Points & Cross-Refs

• SSM vs. Lambda for Remediation: Use SSM Automation for standard tasks (restarting instances, encrypting buckets) as it's easier to maintain. Use Lambda for complex logic requiring custom code.
• CloudWatch Agent vs. SSM Agent: The SSM Agent is for management tasks (patching, run commands); the CloudWatch Agent is specifically for collecting OS-level metrics (Disk, Memory) and logs.
• Deployment Cross-Ref: Refer to AWS CodeDeploy documentation for the difference between CodeDeployDefault.LambdaCanary10Percent5Minutes and CodeDeployDefault.LambdaLinear10PercentEvery1Minute.

Comparison Tables