Mastering Infrastructure as Code (IaC) and Configuration Management on AWS

This study guide covers the essential tools and strategies for codifying infrastructure, managing configurations, and automating account provisioning within the AWS ecosystem, specifically tailored for the DevOps Engineer Professional (DOP-C02) exam.

Learning Objectives

By the end of this module, you should be able to:

• Differentiate between AWS CloudFormation, AWS CDK, and AWS SAM for various use cases.
• Implement CloudFormation StackSets for multi-account and multi-region deployments.
• Evaluate and select appropriate configuration management services like AWS Systems Manager and AWS OpsWorks.
• Design automated account onboarding and governance using AWS Control Tower and AWS Organizations.
• Apply security and compliance controls at scale using AWS Config and Service Catalog.

Key Terms & Glossary

• Infrastructure as Code (IaC): The practice of managing and provisioning computing infrastructure through machine-readable definition files (JSON/YAML) rather than manual processes.
• Stack: A collection of AWS resources that you can manage as a single unit in CloudFormation.
• Construct: The basic building block of AWS CDK applications; it represents a "cloud component" and can encapsulate one or more AWS resources.
• Drift Detection: A CloudFormation feature that identifies if stack resources have been changed outside of CloudFormation management (e.g., via the console).
• Idempotency: A property of IaC where applying the same template multiple times results in the same infrastructure state without side effects.

The "Big Idea"

In traditional IT, infrastructure was a manual, error-prone "craft." Infrastructure as Code (IaC) transforms infrastructure into software. By treating your environment like application code—storing it in Git, versioning it, and testing it—you achieve immutability and consistency. This shift allows for rapid disaster recovery, instant scaling across regions, and the elimination of "snowflake" servers that no one knows how to replicate.

Formula / Concept Box

Hierarchical Outline

1. Core IaC Authoring Tools
   • AWS CloudFormation: The foundational "engine." Uses JSON/YAML. Supports Rollback Triggers and Change Sets.
   • AWS CDK: Programmatic modeling. High-level abstractions (L2/L3 constructs). Compiles to CloudFormation.
   • AWS SAM: Extension of CloudFormation optimized for Serverless (Lambda, API Gateway, DynamoDB).
2. Governance and Scale
   • AWS Organizations & Control Tower: Automated account factory, guardrails, and centralized billing.
   • AWS Service Catalog: Curated list of approved IT services for end-users to deploy autonomously.
3. Configuration Management
   • AWS Systems Manager (SSM): Fleet management, Patch Manager, and Parameter Store.
   • AWS OpsWorks: Managed Chef and Puppet for complex application-stack orchestration.
   • AWS Config: Continuous monitoring and assessment of resource configurations against compliance rules.

Visual Anchors

The CDK-to-Cloud Workflow

Multi-Account Governance Structure

Definition-Example Pairs

• Service Catalog Module: A reusable snippet of CloudFormation code that encapsulates a specific pattern (e.g., an encrypted S3 bucket).
  • Example: An enterprise creates a "Standard S3 Module" that includes mandatory encryption and logging, which all developers must use for new storage.
• StackSet: A container for CloudFormation stacks managed across multiple accounts.
  • Example: Deploying an IAM role for a security audit team into 50 different AWS accounts across 3 regions with one click.
• AWS Config Rule: A logic-based check that evaluates if a resource configuration is compliant.
  • Example: A rule that flags any S3 bucket as "Non-compliant" if it has public read access enabled.

Worked Examples

Example 1: Resolving CloudFormation Rollbacks

Scenario: A deployment fails because an S3 bucket name already exists globally.

1. Identification: CloudFormation enters ROLLBACK_IN_PROGRESS state.
2. Action: Check the "Events" tab in the console to identify the specific resource failure (e.g., BucketName already exists).
3. Fix: Update the template with a unique name or use GeneratePhysicalName: true. Re-run the update.

Example 2: Automating Patching with SSM

Scenario: 100 EC2 instances need critical security patches applied without manual login.

1. Step 1: Use SSM Inventory to list current patch levels.
2. Step 2: Create a Patch Baseline defining which patches are "Approved."
3. Step 3: Use Maintenance Windows to schedule the AWS-RunPatchBaseline document to run during off-hours.

Checkpoint Questions

1. What is the primary difference between a Change Set and Drift Detection?
2. In which scenario would you choose AWS SAM over the AWS CDK?
3. How does AWS Control Tower implement governance for new AWS accounts?
4. What service would you use to enforce that all EC2 instances must be of the t3.medium type?
5. Explain the purpose of a CloudFormation Rollback Trigger.

Muddy Points & Cross-Refs

• SSM vs. OpsWorks: Use SSM for general fleet management and simple state (State Manager). Use OpsWorks only if you have heavy existing investments in Chef or Puppet recipes.
• CDK vs. CloudFormation: CDK is easier for developers (loops, logic), but CloudFormation is the "assembly language" underneath. Always understand how to read the synthesized YAML.
• AppConfig vs. Parameter Store: Parameter Store is for static values (DB passwords). AppConfig is for dynamic feature flags or configuration data that needs validation and controlled rollout.

Comparison Tables

IaC Tool Comparison

Management & Governance Comparison