☁️ AWS

Free AWS Certified Developer - Associate (DVA-C02) Study Resources

Comprehensive AWS Certified Developer - Associate (DVA-C02) hive provides study notes, question bank with practice tests, flashcards, and hands-on labs, all supported by a personal AI tutor to help you master the AWS Certified Developer - Associate (DVA-C02) certification.

570
Practice Questions
9
Mock Exams
131
Study Notes
450
Flashcard Decks
2
Source Materials

AWS Certified Developer - Associate (DVA-C02) Study Notes & Guides

131 AI-generated study notes covering the full AWS Certified Developer - Associate (DVA-C02) curriculum. Showing 10 complete guides below.

Study Guide864 words

AWS X-Ray: Mastering Annotations and Metadata for Service Tracing

Add annotations for tracing services

Read full article

AWS X-Ray: Mastering Annotations and Metadata for Service Tracing

This guide focuses on Skill 4.2.4 of the AWS Certified Developer - Associate (DVA-C02) exam: adding annotations for tracing services. Effective instrumentation allows developers to move beyond simple logging into the realm of true observability, enabling deep-dive analysis of distributed microservices.


Learning Objectives

By the end of this module, you will be able to:

  • Differentiate between Annotations and Metadata in AWS X-Ray.
  • Implement the AWS X-Ray SDK to record custom trace data.
  • Use Filter Expressions in the X-Ray console to search for specific traces based on indexed annotations.
  • Explain the performance and architectural impact of tracing on application latency.

Key Terms & Glossary

  • Segment: A JSON object that represents a logical unit of work in your application (e.g., a single HTTP request).
  • Subsegment: A more granular breakdown of a segment, representing calls to downstream services (RDS, S3) or specific code blocks.
  • Annotation: A key-value pair that is indexed by AWS X-Ray for use with filter expressions.
  • Metadata: A key-value pair that is not indexed and can contain any data type (including objects/arrays).
  • Sampling: The process of selecting which requests are traced to minimize performance overhead and cost.

The "Big Idea"

In a monolithic application, debugging is often as simple as looking at a stack trace. In a microservices architecture, a single user request might touch ten different services. Annotations act like "tags" or "labels" on a package; without them, you can see the package moved through the warehouse, but you don't know which customer it belongs to or if it was marked "Urgent." Annotations make your traces searchable, turning a mountain of telemetry data into actionable intelligence.


Formula / Concept Box

FeatureAnnotationsMetadata
Searchable?Yes (Indexed)No (Not Indexed)
Data TypesString, Number, BooleanAny (JSON objects, lists, etc.)
Use CaseFiltering traces in the consoleStoring rich debugging context
Limit50 annotations per segmentNo strict count (limited by segment size)
ExampleUserID, Region, IsPremiumRaw_HTTP_Response, Stack_Trace

Hierarchical Outline

  1. Instrumenting the Application
    • Use the AWS X-Ray SDK to wrap your application code.
    • Initialize the X-Ray recorder and start segments/subsegments.
  2. Adding Contextual Data
    • Annotations: Focus on high-value search terms.
    • Metadata: Focus on detailed debug information not needed for filtering.
  3. Querying Traces
    • Using the X-Ray Console Filter Expressions (e.g., annotation.UserID = "12345").
    • Visualizing the Service Map to identify bottlenecks.
  4. Performance Optimization
    • Configuring Sampling Rules to balance visibility vs. cost.
    • Asynchronous reporting via the X-Ray Daemon.

Visual Anchors

Trace Data Flow

Loading Diagram...

Search Latency vs. Trace Density

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Annotation Implementation: Using the SDK to add an indexed field.
    • Example: AWSXRay.addAnnotation("MembershipLevel", "Gold"); allows a developer to run a query like annotation.MembershipLevel = "Gold" to see if premium users are experiencing higher latency.
  • Metadata Storage: Using the SDK to store diagnostic data.
    • Example: AWSXRay.addMetadata("Payload", myLargeJsonObject); stores the exact request data for a failed transaction, allowing the developer to inspect the state without needing a search index for that large object.

Worked Examples

Example 1: Instrumenting a Lambda Function (Node.js)

Scenario: You need to track which specific CustomerType experiences slow DynamoDB queries.

javascript
const AWSXRay = require('aws-xray-sdk-core'); const AWS = AWSXRay.captureAWS(require('aws-sdk')); exports.handler = async (event) => { // Access the current segment const segment = AWSXRay.getSegment(); // 1. Add Annotation for filtering segment.addAnnotation("CustomerType", event.customerType); // 2. Add Metadata for debugging (not indexed) segment.addMetadata("RequestHeader", event.headers); try { const data = await ddb.getItem(params).promise(); return data; } catch (err) { segment.addAnnotation("ErrorType", "DatabaseConnection"); throw err; } };

Example 2: X-Ray Filter Expression

Scenario: Find all traces where the response was slow (over 2 seconds) for a specific user.

  • Filter Expression: responsetime > 2 AND annotation.UserID = "UserA"
  • Outcome: The console displays only the relevant traces, significantly reducing the "noise" in high-traffic environments.

Checkpoint Questions

  1. Question: Can you use a JSON object as a value for an X-Ray Annotation?
    • Answer: No. Annotations only support strings, numbers, and booleans because they are indexed. Use Metadata for objects.
  2. Question: What is the primary advantage of using Annotations over simply logging the data to CloudWatch Logs?
    • Answer: Annotations integrate directly with the X-Ray Service Map and Trace Search, allowing you to filter visual representations of your architecture by specific business data (e.g., specific tenant IDs in a SaaS app).
  3. Question: If you add 100 annotations to a single segment, what happens?
    • Answer: X-Ray has a limit of 50 annotations per segment. Excess annotations will be ignored or cause an error depending on the SDK version.
  4. Question: How do you search for a trace in the X-Ray console that has the annotation Environment set to Production?
    • Answer: Use the filter expression: annotation.Environment = "Production".
Study Guide945 words

Mastering Application Performance Analysis: AWS DVA-C02 Study Guide

Analyze application performance issues

Read full article

Mastering Application Performance Analysis

This study guide focuses on identifying, analyzing, and resolving performance bottlenecks within AWS-hosted applications. It covers the essential tools and strategies required for the AWS Certified Developer - Associate (DVA-C02) exam, specifically within the Troubleshooting and Optimization domain.

Learning Objectives

After studying this guide, you should be able to:

  • Profile application performance to identify compute and memory requirements.
  • Interpret application metrics, logs, and traces using Amazon CloudWatch and AWS X-Ray.
  • Implement application-level caching and optimize resource usage.
  • Perform root cause analysis (RCA) using structured logging and custom metrics.
  • Tune AWS Lambda functions for optimal concurrency and performance.

Key Terms & Glossary

  • Observability: The ability to measure the internal state of a system by examining its outputs (logs, metrics, and traces).
  • Profiling: The process of measuring the space (memory) or time complexity of code, the duration of particular function calls, or the frequency of function calls.
  • Concurrency: In AWS Lambda, this is the number of requests that your function is serving at any given time.
  • Embedded Metric Format (EMF): A JSON specification used to instruct CloudWatch Logs to automatically extract custom metrics from log streams.
  • Throttling: The process of limiting the rate of requests to a service (e.g., API Gateway or Lambda) to protect resources.
  • Cold Start: The latency observed when a Lambda function is triggered for the first time or after being idle, requiring a new execution environment to be provisioned.

The "Big Idea"

Performance analysis is not a one-time event but a continuous lifecycle. In a distributed cloud environment, the "Big Idea" is Observability over Monitoring. While monitoring tells you that a system is failing (e.g., "CPU is at 90%"), observability allows you to understand why it is failing by correlating metrics with distributed traces and granular logs. Optimization then follows by right-sizing resources (compute/memory) and implementing caching layers to reduce latency.

Formula / Concept Box

ConceptFormula / Key RuleImplementation Note
Lambda Execution CostCost=Invocations×Duration×Provisioned Memory\text{Cost} = \text{Invocations} \times \text{Duration} \times \text{Provisioned Memory}Increasing memory also increases CPU power linearly.
Cache Hit RatioCache HitsCache Hits+extCacheMisses\frac{\text{Cache Hits}}{\text{Cache Hits} + ext{Cache Misses}}Aim for high ratios to reduce backend load.
Lambda ConcurrencyRequests per second×Avg. Execution Duration (sec)\text{Requests per second} \times \text{Avg. Execution Duration (sec)}Essential for calculating required concurrency limits.

Hierarchical Outline

  • I. Performance Instrumentation
    • Logging: Implementation of structured logging for automated parsing.
    • Monitoring: Using CloudWatch for standard metrics (CPU, Disk I/O).
    • Tracing: Adding annotations and metadata in AWS X-Ray to track request flow.
  • II. Bottleneck Identification
    • Compute Analysis: Determining minimum memory/compute via profiling.
    • Log Querying: Using CloudWatch Logs Insights to identify error patterns.
    • Integration Issues: Debugging service-to-service communication (e.g., SQS to Lambda).
  • III. Optimization Strategies
    • Caching: Application-level (ElastiCache) vs. Edge-level (CloudFront/API Gateway).
    • Messaging: Using SNS Subscription Filter Policies to reduce unnecessary downstream processing.
    • Resource Tuning: Adjusting Lambda memory and timeout settings.

Visual Anchors

Troubleshooting Flowchart

Loading Diagram...

Performance Saturation Curve

This diagram illustrates the "Knee of the Curve," where response time increases exponentially as load approaches resource capacity.

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Term: Subscription Filter Policy
    • Definition: A feature of Amazon SNS that allows a subscriber to receive only a subset of messages based on attributes.
    • Example: A "Shipping" Lambda function only receives messages where the order_type attribute is set to physical, ignoring digital orders to save compute costs.
  • Term: Application-Level Caching
    • Definition: Storing the results of expensive database queries or API calls in local memory or a dedicated cache (like Redis).
    • Example: An e-commerce app stores the "Product Catalog" in an ElastiCache cluster for 10 minutes instead of querying DynamoDB for every page load.

Worked Examples

Scenario: Troubleshooting a Slow Lambda Function

Problem: A Lambda function triggered by API Gateway is intermittently timing out after 29 seconds.

  1. Step 1: Metric Analysis: Review CloudWatch Metrics for the Duration and Throttles metrics. You notice Duration is consistently hitting the 29s mark, which is the API Gateway integration timeout.
  2. Step 2: Log Investigation: Use CloudWatch Logs Insights to run a query: fields @timestamp, @message | filter @message like /Task timed out/ This confirms the timeouts are occurring.
  3. Step 3: Distributed Tracing: Enable AWS X-Ray and view the service map. You see a specific call to an external 3rd-party API taking 25+ seconds.
  4. Step 4: Resolution:
    • Implement Retry Logic with Exponential Backoff for the 3rd-party call.
    • Implement a Circuit Breaker pattern to fail fast if the 3rd-party service is down.
    • Increase Lambda Memory, which provides more CPU power to handle the overhead of the connection faster.

Checkpoint Questions

  1. What is the primary difference between a System Status Check and an Instance Status Check for EC2?
  2. How does the CloudWatch Embedded Metric Format (EMF) help in high-throughput applications compared to the PutMetricData API?
  3. If a Lambda function is experiencing high latency during initialization, which configuration should you investigate first?
  4. How can Amazon Q Developer assist in the performance analysis lifecycle?
Click to view answers
  1. System Status Checks monitor the AWS infrastructure (hardware/network/power), while Instance Status Checks monitor the software and network configuration of the individual instance.
  2. EMF is more efficient because it sends metrics as part of the log stream (asynchronously), reducing API call overhead and potential throttling encountered with PutMetricData.
  3. Investigate Provisioned Concurrency to eliminate cold starts or increase Memory to speed up the initialization code.
  4. Amazon Q Developer can generate automated test events (JSON payloads) to simulate load and identify bottlenecks, and it can help generate unit tests to verify performance-critical code.
Study Guide1,050 words

Optimizing Application Resource Requirements

Apply application requirements for resources (for example, memory, cores)

Read full article

Optimizing Application Resource Requirements

This study guide focuses on the critical task of determining and applying the correct resource specifications—specifically memory and CPU (cores)—to AWS-hosted applications. Mastering this ensures that your applications are both cost-effective and performant, avoiding the twin pitfalls of over-provisioning and resource starvation.


Learning Objectives

After studying this guide, you should be able to:

  • Profile application performance to determine minimum memory and compute requirements.
  • Configure AWS Lambda resources, understanding the proportional relationship between memory and CPU.
  • Implement ECS Task Placement Strategies to optimize resource utilization across a cluster.
  • Select Scaling Policies (Target Tracking, Step, Simple) based on application demand patterns.
  • Define infrastructure resources using Infrastructure as Code (IaC) templates (SAM/CloudFormation).

Key Terms & Glossary

  • Profiling: The process of analyzing an application's behavior (memory usage, CPU cycles, I/O) during execution to identify bottlenecks.
  • Concurrency: In AWS Lambda, the number of requests that your function is serving at any given time.
  • Binpacking: An ECS placement strategy that minimizes the number of instances used by packing tasks onto the instance with the least available CPU or memory.
  • Target Tracking: A scaling policy that maintains a specific metric (e.g., 70% average CPU utilization) by automatically adjusting capacity.
  • Vertical Scaling: Increasing the capacity of a single resource (e.g., more RAM for a Lambda function).
  • Horizontal Scaling: Increasing the number of resource units (e.g., adding more EC2 instances to an Auto Scaling Group).

The "Big Idea"

[!IMPORTANT] Resource optimization in the cloud is a balancing act. If you under-provision, your application crashes or throttles (Performance Risk). If you over-provision, you pay for idle capacity (Cost Risk). The goal is to use data-driven profiling to find the "Goldilocks" zone where performance meets cost-efficiency.

Formula / Concept Box

ServiceKey Resource ConfigurationBehavior
AWS LambdaMemory (128 MB to 10,240 MB)CPU power scales proportionally with memory. Doubling memory doubles CPU.
Amazon ECSCPU/Memory ReservationTasks will not be placed on instances without sufficient available resources.
Amazon EC2Instance Type (vCPUs/RAM)Fixed hardware profiles (e.g., t3.medium has 2 vCPUs, 4 GiB RAM).
API GatewayThrottling/QuotaLimits requests per second (RPS) to prevent downstream resource exhaustion.

Hierarchical Outline

  1. Performance Profiling & Baseline
    • Application Logs: Identify bottlenecks using CloudWatch Logs and Insights.
    • Metrics: Use CloudWatch metrics (CPUUtilization, MemoryUtilization) to find peak usage.
  2. AWS Lambda Resource Management
    • Memory Configuration: Allocating more memory provides more vCPU and networking bandwidth.
    • Timeouts: Define the maximum execution time to prevent runaway costs from hung processes.
  3. Amazon ECS Resource Optimization
    • Task Placement Strategies:
      • Binpack: Prioritizes cost (minimal instances).
      • Spread: Prioritizes High Availability (across AZs).
      • Random: Distributed randomly.
    • Task Placement Constraints: distinctInstance or memberOf (e.g., only run on t3.micro).
  4. Auto Scaling Mechanisms
    • Target Tracking: Most common; keeps a metric at a setpoint.
    • Step Scaling: Increases capacity in specific "steps" based on alarm severity.
    • Simple Scaling: Single adjustment based on a single alarm.

Visual Anchors

Lambda Resource Relationship

Increasing memory in Lambda isn't just about RAM; it's the primary lever for compute power.

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

ECS Task Placement Flow

Loading Diagram...

Definition-Example Pairs

  • Resource Reservation: Reserving a specific amount of CPU/Memory that a container is guaranteed to have.
    • Example: Setting an ECS task memory reservation to 512MiB ensures it won't be killed unless it exceeds that limit, and it won't be placed on a host with only 256MiB free.
  • Canary Deployment: A deployment strategy that shifts traffic to a new version in small increments.
    • Example: Updating an AWS SAM template to shift 10% of traffic to a new Lambda version with higher memory settings to test performance before a full rollout.
  • Profiling: Using tools to measure resource consumption.
    • Example: Using AWS Lambda Power Tuning to run a function with different memory settings and selecting the one that offers the best price-to-performance ratio.

Worked Examples

Example 1: Configuring Lambda in AWS SAM

You need to deploy a Lambda function that processes large images and requires at least 2 vCPUs to perform efficiently.

Solution: Since 1 vCPU is roughly equivalent to 1,769 MB of memory in Lambda, you should set the memory to at least 3,072 MB to ensure access to multiple cores.

yaml
MyImageProcessor: Type: AWS::Serverless::Function Properties: CodeUri: hello_world/ Handler: app.lambda_handler Runtime: python3.9 MemorySize: 3072 Timeout: 30

Example 2: ECS Binpack Strategy

A startup wants to minimize its EC2 bill by using as few instances as possible for its microservices.

Solution: Implement the binpack strategy in the service definition, focusing on memory to ensure instances are fully utilized before a new one is provisioned by the Auto Scaling Group.

json
"placementStrategy": [ { "field": "memory", "type": "binpack" } ]

Checkpoint Questions

  1. If a Lambda function is timing out while performing heavy mathematical computations, what is the most effective way to increase its CPU power?
  2. Which ECS placement strategy is best suited for High Availability across multiple Availability Zones?
  3. What is the difference between a Task Placement Constraint and a Task Placement Strategy?
  4. Why might you use Target Tracking scaling instead of Simple Scaling for a web application?
Click to see answers
  1. Increase the MemorySize setting (Memory and CPU scale proportionally).
  2. The Spread strategy (specifically field: attribute:ecs.availability-zone).
  3. A Constraint is a hard requirement (e.g., "must run on t2.large"); a Strategy is a preference for how tasks are distributed (e.g., "pack them tightly").
  4. Target Tracking is more "set and forget"; it automatically calculates the scaling adjustments needed to stay at a target, whereas Simple Scaling requires manual threshold tuning and cooldowns.
Study Guide985 words

Mastering Root Cause Analysis: AWS Developer Associate Study Guide

Assist in a root cause analysis

Read full article

Mastering Root Cause Analysis (RCA)

Root Cause Analysis in the context of AWS development is the process of identifying the underlying origin of an application failure, performance degradation, or deployment error. This guide covers the essential tools and methodologies required for the DVA-C02 exam.

Learning Objectives

After studying this guide, you should be able to:

  • Debug code effectively to identify logical and runtime defects.
  • Interpret and correlate application metrics, logs, and traces.
  • Execute complex queries against log data using Amazon CloudWatch Logs Insights.
  • Implement custom metrics using the CloudWatch Embedded Metric Format (EMF).
  • Assess application health through centralized dashboards and service insights.
  • Troubleshoot deployment failures by analyzing service-specific output logs.

Key Terms & Glossary

  • RCA (Root Cause Analysis): A systematic process for identifying the "root" of a problem rather than just addressing its symptoms.
  • CloudWatch Logs Insights: An interactive query service for CloudWatch Logs that allows for high-performance searching and visualization of log data.
  • X-Ray: An AWS service that collects data about requests that your application serves and provides tools to view, filter, and gain insights into that data to identify issues and opportunities for optimization.
  • EMF (Embedded Metric Format): A structured JSON specification used to instruct CloudWatch Logs to automatically extract metric values from log events.
  • Trace: A representation of a single request's journey through multiple services or components in a distributed system.

The "Big Idea"

In a distributed, serverless, or microservices environment, failures are rarely isolated. The "Big Idea" behind modern RCA is Observability. You cannot fix what you cannot see. By correlating Logs (what happened), Metrics (how the system behaved), and Traces (where the request spent time), a developer can move from "something is wrong" to "this specific line of code in Lambda A failed because of a timeout in DynamoDB B" in minutes rather than hours.

Formula / Concept Box

FeatureCore PurposeExample AWS Tool
MetricsQuantitative data (CPU, Latency, Error Count)CloudWatch Metrics
LogsQualitative data (Textual events, Stack traces)CloudWatch Logs
TracesEnd-to-end request flow (Dependency analysis)AWS X-Ray
EMFLog-to-Metric conversionCloudWatch EMF Library

[!TIP] Remember: Metrics tell you that you have a problem; Logs and Traces tell you why you have that problem.

Hierarchical Outline

  1. Debugging Code & Defects
    • Local vs. Remote Debugging: Using SAM CLI for local Lambda emulation vs. X-Ray for production.
    • Defect Identification: Identifying logical errors (wrong output) vs. runtime errors (crashes).
  2. Telemetry Data Interpretation
    • Metrics: Interpreting 4XX (client-side) vs. 5XX (server-side) error spikes.
    • Logs: Analyzing standard output (stdout) and standard error (stderr).
    • Traces: Identifying "cold starts" and high-latency segments in X-Ray service maps.
  3. Log Querying & Insights
    • Syntax: Using filter, stats, sort, and limit keywords.
    • Use Case: Finding the most frequent error messages across a 24-hour window.
  4. Custom Metrics & Dashboards
    • Embedded Metric Format (EMF): Writing logs as JSON to generate high-cardinality metrics asynchronously.
    • CloudWatch Dashboards: Aggregating disparate widgets (Logs, Metrics, Alarms) into a single pane of glass.
  5. Service-Specific Troubleshooting
    • Lambda: Checking Init duration and Memory usage.
    • API Gateway: Reviewing Execution Logs and Access Logs.
    • Deployment: Checking CodeDeploy and CloudFormation event logs for rollbacks.

Visual Anchors

The Troubleshooting Workflow

Loading Diagram...

The Three Pillars of Observability

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Structured Logging: A practice where logs are written as JSON instead of plain text.
    • Example: Instead of logging "User 123 logged in", you log {"event": "Login", "userId": 123, "status": "success"}. This allows for easier machine parsing.
  • X-Ray Annotation: Key-value pairs added to traces to allow for indexing and filtering.
    • Example: Adding segment.putAnnotation("IsPremiumUser", "true") to see if performance issues only affect specific user tiers.
  • Health Check: A mechanism to determine if an application instance is capable of handling traffic.
    • Example: A Route 53 health check hitting a /health endpoint that returns a 200 OK only if the database connection is active.

Worked Examples

Example 1: Finding the "Top 10" Slowest API Requests

Scenario: Your API Gateway is experiencing intermittent slowness. You need to find which specific endpoints are the slowest using CloudWatch Logs Insights.

The Query:

sql
filter @type = "REPORT" | stats max(@duration) as max_duration by @requestId | sort max_duration desc | limit 10

Step-by-Step Breakdown:

  1. filter @type = "REPORT": This focuses on the Lambda report lines that contain execution metadata.
  2. stats max(@duration): Calculates the maximum execution time.
  3. by @requestId: Groups the results so we see duration per unique request.
  4. sort ... desc: Puts the slowest requests at the top.

Example 2: Implementing EMF in Python

Scenario: You want to record the duration of a specific processing step without making a blocking call to the CloudWatch PutMetricData API.

Code Snippet:

python
import json import time def lambda_handler(event, context): start = time.time() # ... perform logic ... duration = (time.time() - start) * 1000 # EMF Format metrics = { "_aws": { "Timestamp": int(time.time() * 1000), "CloudWatchMetrics": [{ "Namespace": "MyApp", "Dimensions": [["FunctionName"]], "Metrics": [{"Name": "ProcessingTime", "Unit": "Milliseconds"}] }] }, "FunctionName": context.function_name, "ProcessingTime": duration } print(json.dumps(metrics))

Checkpoint Questions

  1. What is the primary difference between an X-Ray Annotation and an X-Ray Metadata?
    • Answer: Annotations are indexed for searching/filtering; Metadata is not indexed and is used for storing additional data for debugging only.
  2. You see a spike in Lambda Throttles in CloudWatch. Which metric should you check next to determine if it is due to a regional limit or a function-specific limit?
    • Answer: Check the ConcurrentExecutions metric and compare it against your Reserved Concurrency settings.
  3. Why is CloudWatch EMF preferred over the PutMetricData API for high-throughput applications?
    • Answer: EMF is asynchronous (it writes to logs) and doesn't introduce network latency or API throttling risks during execution.
  4. In a CloudWatch Logs Insights query, what keyword is used to calculate aggregate values like averages or counts?
    • Answer: The stats keyword.

Muddy Points & Cross-Refs

  • Tracing vs. Logging: New developers often confuse these. Remember that a log is a discrete event, while a trace connects those events across multiple services.
  • Deployment Logs: If an Elastic Beanstalk deployment fails, don't just look at the AWS Console status; look at the /var/log/eb-activity.log on the instance for the actual error.
  • Cross-Ref: For more on how these metrics trigger actions, see Unit 4.2: Instrument code for observability regarding Alert Notifications.
Hands-On Lab920 words

Root Cause Analysis Mastery: Debugging Serverless Applications on AWS

Assist in a root cause analysis

Read full article

Root Cause Analysis Mastery: Debugging Serverless Applications on AWS

This lab focuses on the critical DVA-C02 skill of Assisting in a Root Cause Analysis (RCA). You will act as a developer troubleshooting a failing serverless data pipeline. You'll move from identifying a failure in logs to tracing the execution path in X-Ray and eventually fixing the defect.

[!WARNING] Remember to run the teardown commands at the end of this lab to avoid ongoing charges to your AWS account.

Prerequisites

Before starting, ensure you have:

  • An AWS Account with administrative access.
  • AWS CLI configured with credentials (aws configure).
  • Basic familiarity with Python and JSON.
  • IAM permissions to create Lambda, S3, DynamoDB, and CloudWatch resources.

Learning Objectives

By the end of this lab, you will be able to:

  1. Query CloudWatch Logs using Log Insights to find specific application errors.
  2. Analyze X-Ray Traces to identify service integration bottlenecks and failures.
  3. Implement Custom Metrics using the CloudWatch Embedded Metric Format (EMF).
  4. Perform an RCA by correlating logs, traces, and metrics to identify a code defect.

Architecture Overview

We are troubleshooting a "Thumbnail Processor" application. An image is uploaded to S3, triggering a Lambda function that logs metadata to DynamoDB. Currently, the metadata step is failing.

Loading Diagram...

Step-by-Step Instructions

Step 1: Deploy the Faulty Infrastructure

We will deploy a CloudFormation stack that intentionally contains a bug in the Lambda code's integration with DynamoDB.

bash
aws cloudformation deploy \ --stack-name brainybee-rca-lab \ --template-body https://raw.githubusercontent.com/aws-samples/aws-serverless-workshops/master/Observability/template.yaml \ --capabilities CAPABILITY_IAM
Console alternative

Navigate to CloudFormation > Create stack > With new resources. Upload the template URL and follow the wizard to name the stack

brainybee-rca-lab

.

Step 2: Trigger the Failure

Upload a test file to the newly created S3 bucket to trigger the Lambda function.

bash
# Get the bucket name from stack outputs BUCKET_NAME=$(aws cloudformation describe-stacks --stack-name brainybee-rca-lab --query "Stacks[0].Outputs[?OutputKey=='BucketName'].OutputValue" --output text) echo "test data" > test-image.jpg aws s3 cp test-image.jpg s3://$BUCKET_NAME/test-image.jpg

Step 3: Query Logs with CloudWatch Insights

The Lambda failed silently. We need to find the specific error message.

bash
# Start a query for the last 5 minutes QUERY_ID=$(aws logs start-query \ --log-group-name /aws/lambda/ThumbnailFunction \ --start-time $(date +%s -d "5 minutes ago") \ --end-time $(date +%s) \ --query-string 'fields @timestamp, @message | filter @message like /Error/ | sort @timestamp desc' \ --query 'queryId' --output text) # Wait 5 seconds, then get results aws logs get-query-results --query-id $QUERY_ID

[!TIP] In the CloudWatch Console, go to Logs Insights, select the log group, and run: fields @timestamp, @message | filter @message like /Error/

Step 4: Analyze the Trace in X-Ray

Logs show a ResourceNotFoundException. We need to see which service integration is actually failing.

bash
# Get trace summaries for the last minute aws xray get-trace-summaries --start-time $(date +%s -d "1 minute ago") --end-time $(date +%s)
Console alternative

Navigate to CloudWatch > X-Ray traces > Service map. You will see a red circle around the connection between Lambda and DynamoDB, indicating a 400-series error.

Checkpoints

  • S3 Upload: Is the file visible in aws s3 ls s3://$BUCKET_NAME?
  • Logs: Did the Log Insights query return an error string like Requested resource not found (Table: MetadataTable)?
  • Traces: Does the X-Ray Service Map show a failed node for DynamoDB?

Teardown

To avoid costs, delete the resources created during this lab.

bash
# Empty the bucket first aws s3 rm s3://$BUCKET_NAME --recursive # Delete the stack aws cloudformation delete-stack --stack-name brainybee-rca-lab

Troubleshooting

IssuePossible CauseFix
AccessDenied on S3 uploadIAM permissions missingEnsure your CLI user has s3:PutObject for the bucket.
Query returns 0 resultsLambda hasn't logged yetWait 30 seconds for CloudWatch to ingest the logs and retry.
Stack deletion hangsS3 bucket not emptyManually delete files in the S3 bucket before deleting the stack.

Challenge

Goal: Implement an automated monitor.

  1. Create a CloudWatch Metric Filter that looks for the word "Error" in the /aws/lambda/ThumbnailFunction log group.
  2. Assign this filter to a custom metric named ProcessingErrors.
  3. Create a CloudWatch Alarm that sends an SNS notification if ProcessingErrors > 0 for a 1-minute period.

Cost Estimate

  • Lambda: Free tier (first 1M requests/mo).
  • S3: $0.023 per GB (negligible for this lab).
  • CloudWatch Logs: $0.50 per GB ingested.
  • X-Ray: Free tier (first 100,000 traces/mo).
  • Total Estimated Cost: < $0.05 (well within AWS Free Tier).

Concept Review

In this lab, we performed a standard Root Cause Analysis (RCA) flow. This flow typically narrows down from a broad symptom to a specific code or configuration defect.

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Key Comparisons

ToolPrimary PurposeBest Used For...
CloudWatch LogsDiscrete event recordingFinding stack traces and specific error messages.
CloudWatch MetricsNumerical aggregationDetecting trends and triggering automated alarms.
AWS X-RayDistributed request tracingIdentifying high latency or failures in multi-service calls.
Log InsightsLog queryingSifting through thousands of log lines using a SQL-like syntax.
Study Guide865 words

Mastering IAM Role Assumption & AWS STS

Assume an IAM role

Read full article

Mastering IAM Role Assumption & AWS STS

This guide covers the mechanisms, security benefits, and implementation patterns for assuming IAM roles using the AWS Security Token Service (STS), a core competency for the AWS Certified Developer - Associate (DVA-C02) exam.

Learning Objectives

By the end of this study guide, you should be able to:

  • Explain how AWS STS generates and manages temporary security credentials.
  • Differentiate between Trust Policies and Identity-based Policies.
  • Configure EC2 Instance Profiles to eliminate hardcoded credentials.
  • Implement Cross-Account Access using delegation patterns.
  • Understand the limitations and constraints of Role Chaining.

Key Terms & Glossary

  • STS (Security Token Service): A global AWS service that grants limited-privilege, temporary credentials to users/services.
  • AssumeRole: An API operation that returns temporary credentials (Access Key ID, Secret Access Key, and Session Token).
  • Trust Policy: A JSON document attached to a role defining which principals (users, services, or accounts) are allowed to assume it.
  • Instance Profile: A container for an IAM role that allows an EC2 instance to automatically receive temporary credentials.
  • Trusted Account: The account containing the user/identity that needs access.
  • Trusting Account: The account containing the resource (e.g., S3 bucket) and the IAM Role.

The "Big Idea"

In cloud security, long-term credentials are a liability. If a developer hardcodes an Access Key into an application, a single leak compromises the account indefinitely until the key is manually rotated.

IAM Role Assumption flips this script: instead of "having" a key, an entity "requests" a temporary session. This reduces the blast radius of a credential leak because the session automatically expires, and no sensitive secrets are stored in the application source code.

Formula / Concept Box

ComponentDescriptionDefault / Max
Credential OutputAccess Key ID, Secret Access Key, Security TokenN/A
Session DurationDurationSeconds parameter1h (Default) / 12h (Max)
Role Chaining LimitMax session duration when one role assumes another1 hour (Hard Limit)
Global Endpointhttps://sts.amazonaws.comRedirects to us-east-1

Hierarchical Outline

  1. Identity Federation & STS
    • Mechanism: STS generates credentials based on attached policies.
    • Expiration: Credentials last from minutes to hours; once expired, they are invalid.
  2. EC2 Instance Roles
    • Instance Profiles: Acts as the bridge between the EC2 and the IAM Role.
    • Security: Removes the need for ~/.aws/credentials files on servers.
  3. Cross-Account Delegation
    • Step 1: Define the role in the Trusting Account.
    • Step 2: Define the Trust Policy (Allow Account A to assume).
    • Step 3: Grant sts:AssumeRole permissions in the Trusted Account.
  4. Role Chaining
    • Occurs when Role A assumes Role B.
    • Constraint: Session duration is strictly limited to 1 hour.

Visual Anchors

Flow: EC2 Instance Profile Pattern

Loading Diagram...

Cross-Account Access Logic

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Term: Trust Policy

    • Definition: A resource-based policy attached to an IAM role that defines which principals can assume the role.
    • Example: A Lambda function in Account 111122223333 needs to write to DynamoDB in Account 444455556666. The role in Account 444455556666 must have a Trust Policy listing the Lambda's ARN as a trusted principal.
  • Term: Role Chaining

    • Definition: The process of using a set of temporary credentials to assume yet another role.
    • Example: An administrator logs into a "Jump Account" role and then assumes a "Production Manager" role in a different account to perform maintenance.

Worked Examples

Scenario: Configuring S3 Access for an EC2-hosted App

The Problem: A developer needs their web app on EC2 to download images from S3 without putting secret keys in the app.config file.

The Solution:

  1. Create IAM Role: Create a role named S3-ReadOnly-Role.
  2. Attach Permissions: Attach the AmazonS3ReadOnlyAccess managed policy.
  3. Define Trust: Ensure the Trust Policy allows ec2.amazonaws.com to assume the role.
  4. Create Instance Profile: Attach the S3-ReadOnly-Role to an Instance Profile.
  5. Assign to EC2: Go to the EC2 console, select the instance, and choose "Modify IAM Role." Pick the new profile.
  6. Verification: Run aws s3 ls on the EC2 terminal. It works without any aws configure setup because the SDK automatically fetches tokens from the Instance Metadata Service.

Checkpoint Questions

  1. True or False: IAM Roles use long-term credentials like usernames and passwords. (Answer: False. They use temporary credentials managed by STS.)
  2. What is the default duration for a session when calling AssumeRole? (Answer: 1 hour.)
  3. If you are performing "Role Chaining," what is the maximum session duration you can request? (Answer: 1 hour.)
  4. Which policy defines who can assume a role? (Answer: The Trust Policy.)
  5. Why is using Instance Profiles better than hardcoding keys? (Answer: It prevents credential theft from source code and removes the burden of manual key rotation.)

[!IMPORTANT] When configuring cross-account access, remember: permissions are required in both accounts. The trusting account must allow the access, and the trusted account must give the user permission to switch to that role.

Study Guide865 words

Automating Deployment Testing in AWS

Automate deployment testing

Read full article

Automating Deployment Testing in AWS

This guide focuses on Task 3: Automate deployment testing within the AWS Certified Developer - Associate (DVA-C02) curriculum. It covers the mechanisms for environment isolation, test event creation, and the integration of automated tests within CI/CD pipelines.

Learning Objectives

By the end of this module, you will be able to:

  • Generate and use JSON test events for Lambda and API Gateway.
  • Configure environments using Lambda aliases, container tags, and API Gateway stages.
  • Deploy Infrastructure as Code (IaC) templates using AWS SAM and CloudFormation to support automated testing.
  • Utilize Amazon Q Developer to accelerate the creation of unit and integration tests.
  • Differentiate between various deployment strategies like Blue/Green and Canary within an automated context.

Key Terms & Glossary

  • Lambda Alias: A pointer to a specific version of a Lambda function (e.g., PROD pointing to version 5).
  • Stage Variables: Name-value pairs used in API Gateway to change configuration based on the stage (e.g., lambdaAlias = "beta").
  • Infrastructure as Code (IaC): The process of managing and provisioning computer data centers through machine-readable definition files (e.g., CloudFormation).
  • JSON Payload: The data format used to simulate events (like an S3 upload or HTTP request) when testing serverless functions.
  • Amazon Q Developer: An AI-powered assistant that can generate test code and explain complex logic.

The "Big Idea"

[!IMPORTANT] The core goal of automated deployment testing is to shift-left: moving testing earlier in the development lifecycle. Instead of manual verification after a deploy, we use automation to ensure that code satisfies requirements before it ever reaches a production user. In AWS, this is achieved by treating infrastructure as code and using logical environment isolation (aliases and stages) to test in "production-like" settings.

Formula / Concept Box

FeaturePurpose in TestingCommon Practice
Lambda AliasesTraffic ShiftingPoint TEST alias to $LATEST and PROD to a stable version number.
API Gateway StagesEnvironment IsolationCreate v1, v2, dev, and prod stages to isolate traffic.
SAM TemplatesRepeatabilityUse sam deploy with different --parameter-overrides for Dev vs. Test.
Test EventsSimulationStore standard JSON payloads in a tests/ directory for local and cloud testing.

Hierarchical Outline

  1. Environment Isolation Strategies
    • Lambda Versioning: Immutable snapshots of code.
    • Lambda Aliases: Mutable pointers for canary deployments.
    • API Gateway Stages: Distinct URL endpoints for different lifecycle phases.
  2. Infrastructure as Code (IaC)
    • AWS SAM: Extension of CloudFormation for serverless; uses template.yaml.
    • Deployment Actions: Committing code triggers build and test in AWS CodePipeline.
  3. Test Event Generation
    • JSON Payloads: Simulating service-to-service triggers (S3, SNS, SQS).
    • Amazon Q Developer: Using AI to generate unit tests and mock data.

Visual Anchors

Automated CI/CD Pipeline Flow

Loading Diagram...

Lambda Alias Traffic Shifting

This diagram visualizes how an Alias can distribute traffic between two versions (Canary Testing).

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Canary Deployment: A strategy where a small portion of traffic is sent to a new version to test stability.
    • Example: Deploying Lambda Version 2 and setting the "Prod" alias to send only 5% of traffic to Version 2 while monitoring for errors.
  • Integration Testing: Testing how different AWS services interact (e.g., API Gateway -> Lambda -> DynamoDB).
    • Example: Sending a JSON payload to an API Gateway stage that triggers a Lambda, then verifying the record appears in DynamoDB.
  • Mocking: Simulating a service response without calling the actual service.
    • Example: Using a local Mock API to simulate an external payment gateway during the build phase in CodeBuild.

Worked Examples

Example 1: Creating a Lambda Test Event

To test a Lambda function that processes S3 events, you must provide a JSON payload that mimics the structure S3 sends.

The Payload (s3-event.json):

json
{ "Records": [ { "s3": { "bucket": { "name": "my-test-bucket" }, "object": { "key": "test-image.jpg" } } } ] }

The Command (using AWS SAM):

bash
sam local invoke MyFunction -e s3-event.json

This allows developers to debug the function locally before deploying to AWS.

Example 2: API Gateway Stage Variables

Imagine you have two Lambda functions: MyFunc-Dev and MyFunc-Prod.

  1. Create a Stage Variable in API Gateway named lambdaAlias.
  2. Set the value to dev in the dev stage and prod in the prod stage.
  3. In the API Gateway integration request, set the Lambda ARN to: arn:aws:lambda:region:account-id:function:MyFunc:${stageVariables.lambdaAlias}

[!TIP] This allows the same API definition to point to different backends automatically based on the URL used.

Checkpoint Questions

  1. What is the primary difference between a Lambda Version and a Lambda Alias? (Answer: A version is immutable/static; an alias is a pointer that can be updated to point to different versions.)
  2. Which AWS service is best suited for orchestrating the transition of code from a repository through build, test, and deployment phases? (Answer: AWS CodePipeline.)
  3. How can you ensure that an AWS SAM template uses a specific environment's configuration (like a different DB name for testing)? (Answer: Use Template Parameters and Parameter Overrides during the sam deploy process.)
  4. If you want to perform a Blue/Green deployment on ECS, which service handles the traffic shifting? (Answer: AWS CodeDeploy.)
  5. What tool can a developer use to help write the actual test code logic more efficiently? (Answer: Amazon Q Developer.)
Hands-On Lab920 words

Lab: Automating Deployment Testing with AWS CI/CD and SAM

Automate deployment testing

Read full article

Lab: Automating Deployment Testing with AWS CI/CD and SAM

In this lab, you will learn how to automate the testing of serverless applications. You will use the AWS Serverless Application Model (SAM) to define your infrastructure and AWS CodeBuild to execute automated unit and integration tests as part of a continuous delivery pipeline.

Prerequisites

Before starting this lab, ensure you have the following:

  • An AWS Account with administrative access.
  • AWS CLI installed and configured with your credentials.
  • AWS SAM CLI installed on your local machine.
  • Basic knowledge of Python (for the Lambda function) and YAML (for configuration).
  • Git installed locally.

Learning Objectives

By the end of this lab, you will be able to:

  • Create application test events and JSON payloads for AWS Lambda.
  • Implement and deploy Infrastructure as Code (IaC) templates using AWS SAM.
  • Configure AWS CodeBuild to run automated tests during the build phase.
  • Differentiate between deployment environments (stages) in Amazon API Gateway.

Architecture Overview

The following diagram illustrates the automated testing and deployment workflow you will build:

Loading Diagram...

The Testing Lifecycle

The cost of fixing bugs increases exponentially as they move toward production. This lab focuses on catching bugs in the "Build" and "Staging" phases.

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Step-by-Step Instructions

Step 1: Initialize the SAM Project

We will start with a basic "Hello World" application using the AWS SAM CLI.

bash
sam init --name brainybee-testing-lab --runtime python3.9 --app-template hello-world --package-type Zip cd brainybee-testing-lab

[!TIP] This command creates a directory structure containing a template.yaml file (IaC) and a hello_world folder for your Lambda code.

Step 2: Create an Automated Unit Test

Navigate to the tests/unit folder. We will ensure the Lambda function returns a 200 OK status code.

bash
# Edit tests/unit/test_handler.py to include a basic assertion cat <<EOF > tests/unit/test_handler.py import json from hello_world import app def test_lambda_handler(): event = {"body": "test"} ret = app.lambda_handler(event, "") assert ret["statusCode"] == 200 assert "message" in ret["body"] EOF

Step 3: Configure the Buildspec for Testing

CodeBuild requires a buildspec.yml file to know how to run your tests. Create this file in the root directory.

bash
cat <<EOF > buildspec.yml version: 0.2 phases: install: runtime-versions: python: 3.9 commands: - pip install -r hello_world/requirements.txt - pip install pytest pre_build: commands: - echo Running unit tests... - pytest tests/unit/test_handler.py build: commands: - echo Packaging SAM application... - sam package --output-template-file packaged.yaml --s3-bucket <YOUR_S3_BUCKET_NAME> artifacts: files: - packaged.yaml EOF
Console alternative
  1. Navigate to
CodeBuild

in the AWS Console. 2. Create a

Build Project

. 3. Under

Buildspec

, select "Insert build commands" or point it to the file in your repository.

Step 4: Define Environments in SAM

Update your template.yaml to include a Stage parameter. This allows you to differentiate between dev, test, and prod stages in API Gateway.

yaml
Parameters: Stage: Type: String Default: dev Resources: HelloWorldFunction: Type: AWS::Serverless::Function Properties: CodeUri: hello_world/ Handler: app.lambda_handler Runtime: python3.9 Events: HelloWorld: Type: Api Properties: Path: /hello Method: get RestApiId: !Ref MyApi MyApi: Type: AWS::Serverless::Api Properties: StageName: !Ref Stage

Checkpoints

Checkpoint 1: Local Test Execution

Run your tests locally to ensure the logic is sound before committing to the cloud.

bash
pytest tests/unit/test_handler.py

Expected Result: 1 passed in 0.01s.

Checkpoint 2: Validate SAM Template

bash
sam validate

Expected Result: template.yaml is a valid SAM Template.

Clean-Up / Teardown

[!WARNING] Failure to delete these resources may result in unexpected charges to your AWS account.

  1. Delete the SAM Stack:
    bash
    sam delete --stack-name brainybee-testing-lab
  2. Delete the S3 Bucket (if created for artifacts):
    bash
    aws s3 rb s3://<YOUR_S3_BUCKET_NAME> --force
  3. Delete CodeBuild/CodePipeline projects via the console or CLI if you created them manually.

Troubleshooting

ErrorPossible CauseFix
sam package failsMissing S3 bucket or permissionsEnsure bucket exists and CLI has s3:PutObject permissions
pytest not foundBuildspec install phase failedCheck python version and pip installation steps in buildspec.yml
Deployment failsIAM role for CloudFormation lacks permissionsEnsure the execution role has permissions to create Lambda and API Gateway

Stretch Challenge

Implement a Lambda Alias for Traffic Shifting: Modify your template.yaml to include an AutoPublishAlias: live and a DeploymentPreference type like Canary10Percent5Minutes. This automates the "test in production" phase by slowly shifting traffic and rolling back if CloudWatch Alarms trigger.

Cost Estimate

ServiceEstimated Cost (Free Tier)Estimated Cost (Beyond Free Tier)
AWS LambdaFirst 1M requests free$0.20 per 1M requests
AWS CodeBuild100 build minutes/mo free~$0.005 per minute
Amazon S35GB Standard storage free$0.023 per GB
Total$0.00< $0.10 for this lab

Concept Review

ConceptDescriptionReal-World Example
Unit TestTesting a single function in isolation.Mocking a DB call to see if your Lambda processes the JSON correctly.
Integration TestTesting the interaction between services.Deploying to a staging endpoint and sending a real HTTP request to verify API Gateway + Lambda.
SAM TemplateAn extension of CloudFormation for serverless.Defining your entire backend (API, DB, Auth) in one 100-line YAML file.
BuildspecInstructions for the build server.Compiling code and running npm test before deployment.
Study Guide1,150 words

AWS CloudFront: Caching Content Based on Request Headers

Cache content based on request headers

Read full article

AWS CloudFront: Caching Content Based on Request Headers

Learning Objectives

After studying this guide, you should be able to:

  • Distinguish between a Cache Policy and an Origin Request Policy.
  • Explain how including request headers in a cache key affects the Cache Hit Ratio.
  • Configure CloudFront to forward only necessary headers to the origin to optimize performance.
  • Identify the components that make up a CloudFront Cache Key.
  • Predict whether a request will result in a cache hit or miss based on header configurations.

Key Terms & Glossary

  • Cache Key: The unique identifier CloudFront uses to look up an object in its cache. It typically consists of the object URL but can be expanded to include specific headers, cookies, or query strings.
  • Cache Hit: Occurs when CloudFront finds the requested object in its edge location cache and serves it directly to the user without contacting the origin.
  • Cache Miss: Occurs when the requested object is not in the cache, requiring CloudFront to fetch it from the origin.
  • Origin Request Policy: A set of rules that determines which headers, cookies, and query strings are sent to the origin, regardless of whether they are part of the cache key.
  • Cache Policy: A configuration that defines how long items stay in the cache (TTL) and which request components are included in the cache key.
  • TTL (Time to Live): The duration for which an object remains in the cache before it is considered expired.

The "Big Idea"

The core challenge of content delivery is balancing personalization with performance. If you cache content based on every possible header (like User-Agent), you provide highly specific content but suffer from a low cache hit ratio because every unique browser version creates a new cache entry. Conversely, caching based on no headers provides the best performance (highest hit ratio) but loses the ability to vary content for different users. Mastery of this topic involves using Cache Policies to selectively include only the most critical headers in the cache key.

Formula / Concept Box

ConceptImpact on PerformanceRule of Thumb
Fewer Headers in Cache Key⬆️ Higher Cache Hit RatioInclude only headers that change the content returned.
More Headers in Cache Key⬇️ Lower Cache Hit RatioUse for highly dynamic or localized content only.
Forwarding All Headers❌ Worst PerformanceNever forward all headers unless absolutely required by the origin.
TTL Settings⏱️ Higher TTL = More HitsBalance TTL with how frequently your source content changes.

Hierarchical Outline

  • I. Understanding the Cache Key
    • The URL is the primary identifier.
    • Optional Components: Query strings, Cookies, and HTTP Headers.
    • Logic: If Request Key == Cached Key, then Hit; else Miss.
  • II. Policy Management
    • Cache Policy: Controls the "Key" and "Time" (TTL).
    • Origin Request Policy: Controls "Communication" (What the origin sees).
  • III. Header Forwarding Best Practices
    • Whitelist Approach: Forward only necessary headers (e.g., Accept-Language for translation).
    • Avoid User-Agent: Including this in the cache key creates thousands of variations for the same file.
  • IV. Performance Optimization
    • Cache Hit Ratio: The percentage of requests served from the edge.
    • Goal: Minimize variations in the cache key to maximize hits.

Visual Anchors

Request Flow Logic

Loading Diagram...

The Composition of a Cache Key

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Forwarding Headers: Sending specific HTTP headers from the viewer's request to the origin server.
    • Example: Forwarding the CloudFront-Viewer-Country header so your server can return a country-specific homepage.
  • Whitelist: A list of specific items (headers, cookies) allowed to be part of the cache key or forwarded.
    • Example: Whitelisting the Accept-Encoding header so the origin can provide Gzip or Brotli versions of a file based on browser support.
  • Path Pattern: A URL rule used to apply different cache behaviors to different parts of a site.
    • Example: Setting a path pattern of /api/* to have 0 TTL (no caching) while /images/* has a 1-year TTL.

Worked Examples

Example 1: The Impact of the User-Agent Header

Scenario: You have a website with a styles.css file. You configure CloudFront to include the User-Agent header in the cache key because you want to track browser statistics at the origin.

  • Result: Your Cache Hit Ratio drops to near 0%.
  • Why?: Because User-Agent strings are extremely diverse (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64)...). CloudFront treats a request from Chrome on Windows as a different key than Chrome on Mac, even though the styles.css file is identical for both.
  • Fix: Use an Origin Request Policy to send the User-Agent to the origin for logging, but do not include it in the Cache Policy key.

Example 2: Multilingual Support

Scenario: Your origin serves different versions of index.html based on the user's preferred language.

  • Step 1: Create a Cache Policy.
  • Step 2: Add Accept-Language to the header whitelist in the Cache Policy.
  • Outcome: CloudFront will now store separate versions of index.html for en-US, fr-FR, etc. Users requesting the same language will get a cache hit, while users with new languages will trigger a miss and a fetch from the origin.

Checkpoint Questions

  1. What is the primary difference between a Cache Policy and an Origin Request Policy?
  2. Why does including "All Headers" in a cache key lead to poor performance?
  3. If a request matches a path pattern but the resource is not in the cache, what is the sequence of events?
  4. True or False: Using the URL alone as a cache key provides the highest possible cache hit ratio.
  5. How can you ensure the origin receives a header without reducing the cache hit ratio for that resource?
Click to see answers
  1. Cache Policy defines what is used to create the Cache Key and how long it stays in cache; Origin Request Policy defines what the origin server receives regardless of the cache key.
  2. It creates too many unique versions of the same object, making it unlikely that two users will share the same cache key, thus increasing cache misses.
  3. CloudFront performs a Cache Miss; it forwards the request to the origin (applying Origin Request Policy), receives the object, stores it based on the Cache Policy, and serves it to the user.
  4. True. It minimizes the variations, meaning all users requesting that URL will share the same cached object.
  5. Add the header to the Origin Request Policy but keep it out of the Cache Policy key whitelist.
Study Guide895 words

Study Guide: Committing Code to Invoke Automated CI/CD Pipelines

Commit code to a repository to invoke build, test, and deployment actions

Read full article

Study Guide: Committing Code to Invoke Automated CI/CD Pipelines

This guide covers the technical workflow and AWS services required to automate the build, test, and deployment of applications through repository commits.

Learning Objectives

  • Explain the role of AWS EventBridge in triggering automated pipelines.
  • Identify the key AWS services involved in the CI/CD lifecycle (CodeCommit, CodeBuild, CodePipeline).
  • Describe how artifacts are secured and moved between stages using S3 and KMS.
  • Understand the security implications of cross-account IAM roles in a DevOps architecture.

Key Terms & Glossary

  • Continuous Integration (CI): The practice of merging code changes into a central repository frequently, followed by automated builds and tests.
  • Artifact: A deployable file or package (e.g., a .zip, .jar, or Docker image) generated during the build process.
  • Source Action: The first stage in an AWS CodePipeline that retrieves the code from a repository like CodeCommit or GitHub.
  • Event-Driven Architecture: A software design pattern where the flow of the program is determined by events (e.g., a git push).

The "Big Idea"

The "Big Idea" behind automated deployment is the elimination of human intervention between writing code and testing it. By using a git commit as a trigger, organizations ensure that every change is automatically validated. This reduces the "integration hell" common in large projects and allows for a rapid, reliable release cycle where the repository acts as the single source of truth.

Formula / Concept Box

Pipeline PhaseAWS ServicePrimary Action
SourceAmazon CodeCommitImport code from the repository
TriggerAmazon EventBridgeDetect repository changes and start pipeline
Build & TestAWS CodeBuildCompile code, run unit tests, create artifacts
StoreAmazon S3Securely store build outputs (artifacts)
OrchestrateAWS CodePipelineManage the flow between stages

Hierarchical Outline

  • The Commit Trigger
    • Local Workstation: Developer performs a git push to the remote.
    • AWS CodeCommit: The hosted Git repository receives the new commit.
    • EventBridge Detection: A rule identifies the Reference Created or Updated event.
  • Pipeline Orchestration
    • CodePipeline Start: Triggered by EventBridge, it pulls the source code.
    • IAM Roles: The CodePipeline Service Role assumes permissions to call other services.
  • Build and Artifact Generation
    • AWS CodeBuild: Launches a temporary environment to compile code.
    • Unit Testing: Automated tests run within the CodeBuild environment.
    • S3 Artifact Store: The output (e.g., a compiled binary) is encrypted via KMS and uploaded to S3.
  • Separation of Concerns
    • DevOps Account: Hosts the pipeline and security keys.
    • Target Accounts: (Dev/Staging/Prod) where the code is actually deployed.

Visual Anchors

CI/CD Workflow Flowchart

Loading Diagram...

Artifact Security Model

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Trigger Action: The specific event that initiates a pipeline.
    • Example: Setting an EventBridge rule to monitor the master branch of a CodeCommit repo; the pipeline only runs when code is merged into that specific branch.
  • Cross-Account Access: Using IAM roles to allow a pipeline in a "DevOps" account to deploy resources into a "Production" account.
    • Example: A CodePipeline in Account A uses an IAM Role in Account B to update a Lambda function code after a successful build.
  • Unit Testing: Small-scale tests that validate individual functions of the code.
    • Example: A CodeBuild buildspec.yml file containing a command like npm test to verify logic before packaging a Node.js app.

Worked Examples

Scenario: Deploying a Lambda Function via Commit

Goal: Automate the update of an AWS Lambda function every time the code is pushed to the main branch.

  1. Preparation: Create an AWS CodeCommit repository named lambda-repo.
  2. The Trigger: Configure an Amazon EventBridge rule that listens for CodeCommit Repository State Change. Set the target as your CodePipeline ARN.
  3. The Pipeline:
    • Source Stage: Connect to lambda-repo, branch main.
    • Build Stage: Use AWS CodeBuild. The buildspec.yml will run pip install -r requirements.txt and package the folder into function.zip.
    • Deploy Stage: Use the AWS Lambda provider. Specify the function name. CodePipeline will take the function.zip from the S3 artifact store and update the Lambda code.
  4. Action: Developer runs git commit -m "Fix bug" && git push origin main.
  5. Result: Within minutes, EventBridge detects the push, starts the pipeline, CodeBuild packages the fix, and the Lambda function is updated automatically.

Checkpoint Questions

  1. Which AWS service is primarily responsible for detecting a code commit and signaling the pipeline to start?
  2. Why are artifacts stored in Amazon S3 encrypted with AWS KMS during the pipeline process?
  3. What is the benefit of keeping the CI/CD pipeline in a separate "DevOps" account rather than the production account?
  4. In which file do you typically define the commands for compiling code and running tests in AWS CodeBuild?

[!TIP] Always remember: CodePipeline does not "store" your code; it "orchestrates" its movement. The actual files live in the Source (CodeCommit) and the Artifact Store (S3).

[!WARNING] If your pipeline fails at the Source stage, check the IAM Service Role for CodePipeline. It must have s3:PutObject permissions for the artifact bucket and codecommit:GetBranch for the repository.

More Study Notes (121)

Mastering Application Health Checks and Readiness Probes

Configure application health checks and readiness probes

985 words

AWS Deployment Strategies: Blue/Green, Canary, and Rolling Releases

Configure deployment strategies (for example, blue/green, canary, rolling) for application releases

945 words

AWS Lambda: Configuration, Parameters, and Performance Tuning

Configure Lambda functions by defining environment variables and parameters (for example, memory, concurrency, timeout, runtime, handler, layers, extensions, triggers, destinations)

870 words

AWS Study Guide: Configuring Programmatic Access

Configure programmatic access to AWS

820 words

AWS Environment Management and Versioned Integration Testing

Create application environments that use approved versions for integration testing (for example, Lambda aliases, container image tags, AWS Amplify branches, AWS Copilot environments)

890 words

AWS Certified Developer: Creating Application Test Events and JSON Payloads

Create application test events (for example, JSON payloads for testing AWS Lambda, API Gateway, AWS SAM resources)

915 words

DVA-C02 Study Guide: Creating and Maintaining APIs

Create, extend, and maintain APIs (for example, response/request transformations, enforcing validation rules, overriding status codes)

820 words

Building Resilient and Fault-Tolerant Applications

Create fault-tolerant and resilient applications in a programming language (for example, Java, C#, Python, JavaScript, TypeScript, Go)

885 words

AWS DVA-C02 Study Guide: Debugging and Identifying Defects

Debug code to identify defects

925 words

Mastering Service Integration Debugging

Debug service integration issues in applications

850 words

Amazon DynamoDB: Master Keys and Indexing

Define Amazon DynamoDB keys and indexing

862 words

AWS Lambda Concurrency: Optimization and Scaling Guide

Define concurrency

645 words

Study Guide: Encryption at Rest and In Transit

Define encryption at rest and in transit

925 words

Mastering IAM Permissions for AWS Principals

Define permissions for IAM principals

925 words

AWS Deployment Strategies: Master Guide for DVA-C02

Deploy an application version by using deployment strategies

845 words

Mastering API Deployment and Environment Management

Deploy API resources to various environments

925 words

Deploying Application Stack Updates to AWS Environments

Deploy application stack updates to existing environments (for example, deploying an AWS SAM template to a different staging environment)

820 words

Lab: Automating Application Delivery with AWS CI/CD Pipelines

Deploy code by using AWS Continuous Integration and Continuous Delivery (CI/CD) services

945 words

Mastering AWS CI/CD: Continuous Integration and Continuous Delivery for Developers

Deploy code by using AWS Continuous Integration and Continuous Delivery (CI/CD) services

945 words

AWS API Gateway: Stages, Variables, and Custom Domains

Describe API Gateway stages and custom domains

875 words

Mastering AWS Architectural Patterns: From Monoliths to Event-Driven Design

Describe architectural patterns (for example, event-driven, microservices, monolithic, choreography, orchestration, fanout)

1,350 words

AWS Certificate Management: ACM and Private CA

Describe certificate management (for example, AWS Private CA)

825 words

AWS Database Consistency Models: S3 and DynamoDB

Describe database consistency models (for example, strongly consistent, eventually consistent)

820 words

Data Classification & Sensitive Data Management

Describe data classification (for example, personally identifiable information [PII], protected health information [PHI])

920 words

AWS S3 Encryption: Client-Side vs. Server-Side Comparison Guide

Describe differences between client-side encryption and server-side encryption

890 words

Mastering Observability: Logging, Monitoring, and Tracing

Describe differences between logging, monitoring, and observability

850 words

DynamoDB Data Retrieval: Query vs. Scan

Describe differences between query and scan operations

875 words

AWS Architectural Patterns: Stateful vs. Stateless Concepts

Describe differences between stateful and stateless concepts

1,185 words

Architectural Patterns: Synchronous vs. Asynchronous Communication

Describe differences between synchronous and asynchronous patterns

875 words

Architectural Coupling in AWS: Tightly Coupled vs. Loosely Coupled Systems

Describe differences between tightly coupled and loosely coupled components

925 words

High-Cardinality Partition Keys and Balanced Partition Access in DynamoDB

Describe high-cardinality partition keys for balanced partition access

820 words

AWS Lambda Deployment Packaging Options

Describe Lambda deployment packaging options

850 words

AWS Lambda: Mastering Private VPC Resource Access

Describe the access of private resources in VPCs from Lambda code

925 words

Optimizing Application Resource Allocation

Determine minimum memory and compute power for an application

820 words

Lab: Building a Resilient Order Processor with AWS SDK and SQS

Develop code for applications hosted on AWS

920 words

Mastering Application Development on AWS: DVA-C02 Study Guide

Develop code for applications hosted on AWS

945 words

AWS Certified Developer Associate: Developing Code for AWS Lambda

Develop code for AWS Lambda

875 words

Mastering AWS Lambda: Development, Configuration, and Integration

Develop code for AWS Lambda

925 words

AWS KMS: Enabling and Disabling Key Rotation

Enable and disable key rotation

820 words

DVA-C02 Study Guide: Encrypting Sensitive Environment Variables

Encrypt environment variables that contain sensitive data

820 words

Study Guide: Generating Certificates and SSH Keys for Development

Generate certificates and SSH keys for development purposes

895 words

Cross-Service Authentication in AWS Microservices

Handle cross-service authentication in microservice architectures

850 words

Study Guide: Handling Streaming Data with AWS Services

Handle streaming data using AWS services

945 words

AWS Lambda: Event Lifecycle & Error Handling Guide

Handle the event lifecycle and errors by using code (for example, Lambda Destinations, dead-letter queues)

820 words

Mastering Infrastructure as Code (IaC): AWS CloudFormation & SAM

Implement and deploy infrastructure as code (IaC) templates (for example, AWS SAM templates, AWS CloudFormation templates)

845 words

AWS Observability: Implementing Effective Logging Strategies

Implement an effective logging strategy to record application behavior and state

912 words

Application-Level Authorization and Fine-Grained Access Control

Implement application-level authorization for fine-grained access control

820 words

Mastering Application-Level Caching in AWS

Implement application-level caching to improve performance

845 words

Application-Level Data Masking and Sanitization for AWS Developers

Implement application-level data masking and sanitization

850 words

Mastering Authentication & Authorization in AWS: Developer's Study Guide

Implement authentication and/or authorization for applications and AWS services

1,085 words

Secure User Authentication with Amazon Cognito User Pools

Implement authentication and/or authorization for applications and AWS services

845 words

Implementing Custom Metrics in AWS Applications

Implement code that emits custom metrics

845 words

Implementing Custom Metrics with Amazon CloudWatch Embedded Metric Format (EMF)

Implement custom metrics (for example, Amazon CloudWatch embedded metric format [EMF])

875 words

Data Access Patterns for Multi-Tenant Applications

Implement data access patterns for multi-tenant applications

842 words

AWS Security Lab: Implementing Encryption with KMS and Amazon S3

Implement encryption by using AWS services

1,150 words

Mastering AWS Encryption: KMS and S3 Security Patterns

Implement encryption by using AWS services

845 words

AWS Developer Associate: Implementing Notification Alerts

Implement notification alerts for specific actions (for example, notifications about quota limits or deployment completions)

940 words

Resilient Application Design: Retries, Circuit Breakers, and Error Handling

Implement resilient application code for third-party service integrations (for example, retry logic, circuit breakers, error handling patterns)

880 words

Mastering Structured Logging for AWS Observability

Implement structured logging for application events and user actions

925 words

AWS Certified Developer - Associate: Implementing Tracing & Observability

Implement tracing by using AWS services and tools

1,150 words

AWS DVA-C02: Instrumenting Code for Observability

Instrument code for observability

1,120 words

Lab: Instrumenting Serverless Applications for Full-Stack Observability

Instrument code for observability

920 words

AWS Lambda: Integration and Architectural Patterns

Integrate Lambda functions with AWS services

925 words

AWS Observability: Interpreting Metrics, Logs, and Traces

Interpret application metrics, logs, and traces

1,050 words

Study Guide: Making Authenticated Calls to AWS Services

Make authenticated calls to AWS services

890 words

Study Guide: Managing Application Environments in AWS

Manage application environments by using AWS services

875 words

Mastering Amazon S3 Data Lifecycles

Manage data lifecycles

860 words

AWS Environment Management: API Gateway and Lambda

Manage environments in individual AWS services (for example, differentiating between development, test, and production in API Gateway)

820 words

Mastering Sensitive Data Management in AWS Applications

Manage sensitive data in application code

870 words

Securely Managing Application Secrets with AWS Secrets Manager

Manage sensitive data in application code

875 words

DVA-C02 Study Guide: Managing Code Module Dependencies

Manage the dependencies of the code module (for example, environment variables, configuration files, container images) within the package

845 words

Study Guide: Optimizing Application Resource Usage (AWS DVA-C02)

Optimize application resource usage

1,140 words

Lab: Optimizing Content Delivery with Amazon CloudFront and S3

Optimize applications by using AWS services and features

945 words

Optimizing AWS Applications: Performance, Scalability, and Efficiency

Optimize applications by using AWS services and features

890 words

Study Guide: Organizing Files and Directory Structures for AWS Deployment

Organize files and a directory structure for application deployment

820 words

Mastering Application Rollbacks and Deployment Strategies (AWS DVA-C02)

Perform application rollbacks by using existing deployment strategies

945 words

Lab: Preparing Application Artifacts for AWS Deployment

Prepare application artifacts to be deployed to AWS

845 words

Mastering Artifact Preparation for AWS Deployment

Prepare application artifacts to be deployed to AWS

845 words

Mastering Environment-Specific Application Configurations in AWS

Prepare application configurations for specific environments (for example, by using AWS AppConfig)

820 words

AWS Performance Profiling & Optimization: DVA-C02 Study Guide

Profile application performance

1,054 words

Mastering AWS Log Querying: Insights and Troubleshooting for DVA-C02

Query logs to find relevant data

845 words

AWS Monitoring & Observability: Reviewing Application Health

Review application health by using dashboards and insights

850 words

Mastering Data Sanitization and Masking in AWS Applications

Sanitize sensitive data

865 words

Securing Applications with Bearer Tokens (AWS DVA-C02)

Secure applications by using bearer tokens

845 words

Mastering Data Serialization and Deserialization for AWS Persistence

Serialize and deserialize data to provide persistence to a data store

985 words

Testing Applications with Amazon API Gateway Endpoints

Test applications by using development endpoints (for example, configuring stages in Amazon API Gateway)

915 words

Lab: Testing Serverless Applications in AWS Development Environments

Test applications in development environments

720 words

Testing Applications in AWS Development Environments: A Study Guide

Test applications in development environments

845 words

Study Guide: Testing Deployed Code and Environments in AWS

Test deployed code by using AWS services and tools

875 words

Mastering the Testing of Event-Driven Applications on AWS

Test event-driven applications

875 words

Troubleshooting AWS Deployment Failures via Service Logs

Troubleshoot deployment failures by using service output logs

1,004 words

AWS Lambda Performance Tuning & Optimization Guide

Tune Lambda functions for optimal performance

925 words

Unit 1: Development with AWS Services – Study Guide

Unit 1: Development with AWS Services

875 words

DVA-C02 Unit 2: Comprehensive Security Study Guide

Unit 2: Security

920 words

AWS Certified Developer: Unit 3 - Deployment Strategies and CI/CD

Unit 3: Deployment

925 words

AWS Developer Associate: Troubleshooting and Optimization Study Guide

Unit 4: Troubleshooting and Optimization

945 words

Updating Infrastructure as Code (IaC) Templates: AWS SAM & CloudFormation

Update existing IaC templates (for example, AWS SAM templates, CloudFormation templates)

875 words

Mastering Event-Driven Patterns with Amazon EventBridge

Use Amazon EventBridge to implement event-driven patterns

925 words

Mastering Amazon Q Developer for AWS Development

Use Amazon Q Developer to assist with development

865 words

DVA-C02 Study Guide: Automated Testing with Amazon Q Developer

Use Amazon Q Developer to generate automated tests

820 words

Mastering Identity Federation: Amazon Cognito and IAM

Use an identity provider to implement federated access (for example, Amazon Cognito, IAM)

890 words

Identifying Performance Bottlenecks with Application Logs

Use application logs to identify performance bottlenecks

865 words

Code Repositories and Deployment Environments: A DVA-C02 Study Guide

Use code repositories in deployment environments

820 words

AWS Data Caching Services: ElastiCache and CloudFront

Use data caching services

820 words

DVA-C02 Study Guide: Use Data Stores in Application Development

Use data stores in application development

1,145 words

Lab: Building a Scalable Data Store with Amazon DynamoDB and S3

Use data stores in application development

880 words

AWS KMS: Cross-Account Encryption & Key Management

Use encryption across account boundaries

925 words

AWS KMS and Data Encryption: Mastering Keys and Decryption

Use encryption keys to encrypt or decrypt data

820 words

Dynamic Deployments with API Gateway Stage Variables and Lambda Aliases

Use existing runtime configurations to create dynamic deployments (for example, using staging variables from API Gateway in Lambda functions)

875 words

AWS Version and Release Management: Labels, Branches, and Aliases

Use labels and branches for version and release management

945 words

AWS Lambda: Real-Time Data Processing & Transformation

Use Lambda functions to process and transform data in near real time

890 words

Study Guide: Managing and Maintaining AWS Data Stores

Use, manage, and maintain data stores

875 words

Orchestrating Multi-Environment Deployments with AWS CodePipeline

Use orchestrated workflows to deploy code to different environments

864 words

AWS Secrets Manager: Securing Sensitive Data

Use secret management services to secure sensitive data

945 words

AWS Specialized Data Stores & Access Patterns

Use specialized data stores based on access patterns (for example, Amazon OpenSearch Service)

925 words

Optimizing Messaging with Amazon SNS Subscription Filter Policies

Use subscription filter policies to optimize messaging

850 words

AWS Developer Guide: Writing and Running Test Code

Write and run test code by using AWS services and tools

860 words

Mastering Unit Testing in AWS Development Environments

Write and run unit tests in development environments (for example, using AWS SAM)

945 words

Interacting with AWS Services: APIs and SDKs Study Guide

Write code that interacts with AWS services by using APIs and AWS SDKs

920 words

DVA-C02 Study Guide: Writing Code for Messaging Services

Write code to use messaging services

890 words

DVA-C02 Study Guide: Integration Testing & API Mocking

Write integration tests and mock APIs for external dependencies

865 words

Ready to practice? Jump straight in — no sign-up needed.

Take practice tests, review flashcards, and read study notes right now.

Take a Practice Test

AWS Certified Developer - Associate (DVA-C02) Practice Questions

Try 15 sample questions from a bank of 570. Answers and detailed explanations included.

Q1easy

In the context of modern authentication and authorization, what is the primary purpose of an Access Token?

A.

To provide the client application with information about the authenticated user's profile (e.g., name, email).

B.

To grant the bearer permission to access specific protected resources or APIs.

C.

To serve as a long-lived credential used to obtain new tokens without re-authenticating.

D.

To verify the physical location of the user at the time of the request.

Show answer & explanation

Correct Answer: B

An Access Token is primarily used for authorization. It is a bearer token that informs a resource server (API) that the holder is permitted to access certain resources based on the scopes granted. Option A describes an ID Token, which is used for authentication to provide identity information to the client application. Answer: B

Q2hard

A developer is designing a data access pattern for a DynamoDB table containing 10 million items, where each item is 4 KB. The application frequently needs to retrieve a subset of items (approximately 0.1% of the total table) that match a specific ProductCategory. The developer is evaluating whether to use a Scan operation with a FilterExpression or to create a Global Secondary Index (GSI) with ProductCategory as the partition key to perform Query operations.

Based on the performance characteristics and cost-efficiency at scale, which of the following best analyzes the optimal approach?

A.

A Scan with a FilterExpression is more cost-effective because the filtering happens server-side, which reduces the Read Capacity Units (RCUs) consumed to only the items that match the filter criteria.

B.

A Query on a GSI is more scalable because it targets only the relevant partition, consuming RCUs based on the number of items retrieved. A Scan consumes RCUs for every item in the table, regardless of the FilterExpression, leading to linear cost increases as the table grows.

C.

A Scan is the superior choice for high-throughput applications because it can be parallelized using the Segment and TotalSegments parameters, whereas a Query is restricted by the throughput limits of a single partition key.

D.

The Query approach is only beneficial if the ProductCategory has high cardinality; if the category contains many items, the overhead of index maintenance makes a Scan more efficient for the 0.1% subset.

Show answer & explanation

Correct Answer: B

In DynamoDB, a Scan operation reads every item in the table to find matches. Crucially, a FilterExpression is applied after the data is read from disk but before it is returned to the client. This means RCUs are charged for every item scanned, not just those that pass the filter. For a table with 10 million items, a Scan would consume RCUs for all 10 million items (approx. 10 million RCUs for strongly consistent reads of 4 KB items). Conversely, a Query using a GSI targets only the items with the specific ProductCategory partition key. For a 0.1% subset ($10,000 items), the Query would only consume RCUs for those $10,000 items, making it significantly more scalable and cost-effective as the dataset grows. Answer: B

Q3hard

A DevOps team is analyzing the risk-reward profile of shifting from a Blue/Green (All-at-Once) deployment strategy to a Canary deployment strategy for a high-traffic microservice. The proposed Canary configuration shifts 10% of traffic to the new version for a 30-minute bake period before completing the cutover.

Which of the following represents the most accurate analysis of the trade-off between Blast Radius and Mean Time to Detection (MTTD) when adopting this Canary strategy?

A.

The Canary strategy reduces the blast radius by limiting initial exposure, but it may lead to an increased MTTD if the 10% traffic sample is insufficient to trigger statistically significant error-rate alarms for low-frequency defects.

B.

The Canary strategy reduces the blast radius and decreases the MTTD because the smaller traffic volume allows engineers to manually inspect logs more effectively than in an All-at-Once shift.

C.

The Blue/Green (All-at-Once) strategy maximizes the blast radius and increases the MTTD because the entire fleet must be rolled back simultaneously, which is inherently slower than rolling back a Canary.

D.

The Blue/Green (All-at-Once) strategy minimizes the MTTD by providing the largest possible dataset for monitoring tools, although it accepts a larger blast radius as a necessary trade-off for rapid validation.

Show answer & explanation

Correct Answer: A

In a Canary deployment, the Blast Radius is reduced because only a small percentage of users (10%) are exposed to the new version initially. However, the Mean Time to Detection (MTTD) can actually increase—a significant technical trade-off. This is because a small sample of traffic may not produce enough data to distinguish a subtle bug from normal background noise or 'flicker' in system metrics, especially if the defect only affects a specific subset of requests. In contrast, an All-at-Once shift provides a massive, immediate data signal across the entire production load, making anomalies more obvious to automated monitoring systems and potentially shortening the time to detect a major failure. Answer: A

Q4medium

When a resource server validates a bearer token (such as a JSON Web Token), which validation parameter is specifically designed to ensure that the token was intended for that specific resource server and not a different application?

A.

iss (Issuer)

B.

aud (Audience)

C.

exp (Expiration)

D.

nbf (Not Before)

Show answer & explanation

Correct Answer: B

The aud (Audience) claim identifies the intended recipients of the JWT. During validation, the resource server checks if its own unique identifier is present in the aud field. This prevents a security flaw where a valid token issued for a less secure 'Service A' is replayed to access 'Service B'. iss verifies the identity provider, exp ensures the token is still time-valid, and nbf ensures it is not used before its intended start time. Answer: B

Q5hard

A developer is configuring a cross-account architecture where an AWS Lambda function in Account A (111122223333) must retrieve data from an Amazon DynamoDB table in Account B (444455556666). The following configuration has been applied:

  1. In Account B, an IAM role named CrossAccountDynamoRole was created with a policy granting dynamodb:GetItem on the target table.
  2. The CrossAccountDynamoRole trust policy allows the ARN of the Lambda's execution role in Account A (arn:aws:iam:: 111122223333 :role/LambdaExecRole) to perform the sts:AssumeRole action.
  3. The Lambda function code correctly initializes the AWS STS client and calls the assume_role() method to obtain temporary credentials.

When the function executes, the assume_role() call fails with an AccessDenied error. Analyze the security requirements for cross-account authentication and identify the missing configuration step.

A.

The CrossAccountDynamoRole in Account B must be updated to include the sts:AssumeRole action in its permissions policy in addition to its trust policy.

B.

The LambdaExecRole in Account A must have an identity-based policy that explicitly allows the sts:AssumeRole action on the resource arn:aws:iam:: 444455556666 :role/CrossAccountDynamoRole.

C.

The DynamoDB service-linked role in Account B must be modified to allow cross-account access from the specific LambdaExecRole ARN in Account A.

D.

The developer must enable "Trust relationship inheritance" in the AWS Organizations management account to allow accounts 111122223333 and 444455556666 to exchange credentials.

Show answer & explanation

Correct Answer: B

To make an authenticated call across accounts using IAM roles, both the trust policy and the identity-based policy must grant permission. While the trust policy in Account B specifies who is allowed to assume the role, the identity-based policy in Account A must also grant the principal (the Lambda execution role) permission to perform the sts:AssumeRole action on the target role's ARN in the other account. Without this explicit grant in Account A, the STS service will deny the request even if Account B trusts the principal. Answer: B

Q6medium

A developer is building a distributed session management system that uses Amazon ElastiCache (Redis) as a shared data store. The session data is currently stored in the application's memory as a complex, nested object. To ensure this data can be successfully persisted to the key-value store and later retrieved by different instances of the microservice, which technique must the developer apply before calling the storage command?

A.

Deserialize the session object into a relational schema format.

B.

Serialize the session object into a standardized format such as JSON or a binary stream.

C.

Write the object's local memory address directly to the data store's primary key.

D.

Implement a strongly consistent read pattern to automatically map the object structure.

Show answer & explanation

Correct Answer: B

To achieve persistence for complex in-memory data structures (like objects or dictionaries) in data stores that typically handle strings or blobs, the data must first undergo serialization. This process converts the object's state into a format (like a JSON string or byte array) that can be stored and later deserialized back into a functional object by the same or a different application instance. Memory addresses (Option C) are volatile and local to a process, making them useless for persistence across instances. Answer: B

Q7medium

An IAM user has an identity-based policy that grants AdministratorAccess. An administrator also attaches a permissions boundary to the user that allows only s3:* and cloudwatch:* actions. Which statement correctly explains the user's effective permissions?

A.

The user has full administrative access because identity-based policies always override permissions boundaries.

B.

The user can only perform actions that are allowed by both the identity-based policy and the permissions boundary, effectively limiting them to Amazon S3 and Amazon CloudWatch.

C.

The user has no permissions because a permissions boundary cannot be used in conjunction with the AdministratorAccess managed policy.

D.

The user can perform any action in the account except for those explicitly listed in the permissions boundary.

Show answer & explanation

Correct Answer: B

The effective permissions for an IAM principal are determined by the intersection of the identity-based policy and the permissions boundary. Even if the identity-based policy is highly permissive (such as AdministratorAccess), the permissions boundary acts as a 'ceiling' or maximum limit on what the principal can do. Because only S3 and CloudWatch actions are present in both the identity-based policy and the boundary, those are the only actions the user can perform. Answer: B

Q8medium

Consider the following Python function designed to find the maximum value in a list of integers:

python
def find_max(numbers): """Returns the maximum value in the list.""" max_val = 0 for num in numbers: if num > max_val: max_val = num return max_val

Which of the following input lists represents an edge case that reveals a defect in this implementation?

A.

[1, 5, 3]

B.

[10, 20, 30]

C.

[-5, -2, -10]

D.

[0, 1, 2]

Show answer & explanation

Correct Answer: C

The function initializes max_val to 0, assuming that the maximum value in any list will be at least 0. While this logic holds for lists containing positive integers or zero (options A, B, and D), it fails for the edge case where the input list consists entirely of negative integers. For the input [-5, -2, -10], every num is less than the initial max_val of 0, so the if num > max_val condition is never satisfied. Consequently, the function incorrectly returns the initial value of 0 instead of the actual maximum, -2. A robust fix would be to initialize max_val to numbers[0] or float('-inf'). Answer: C

Q9medium

In a microservices architecture, troubleshooting a performance issue often requires more than just knowing a system is down. Which of the following best describes the fundamental differences between logging, monitoring, and observability?

A.

Monitoring is the process of collecting logs to identify errors, while observability is the specific use of metrics to determine if a server is active.

B.

Logging records discrete events in a text format; Monitoring tracks aggregated metrics over time to assess health; Observability uses logs, metrics, and distributed traces to infer the internal state of the system and explain why an issue occurred.

C.

Observability is a subset of monitoring that specifically handles the visualization of infrastructure resources like CPU and RAM in a single-instance environment.

D.

Logging provides the "why" behind a failure, while monitoring provides the "what" and observability provides the "when" using timestamped data.

Show answer & explanation

Correct Answer: B

The three pillars of observability are distinct but complementary:

  1. Logging: Records specific, discrete events (e.g., error messages, transaction IDs) as they happen.
  2. Monitoring: Involves tracking aggregated metrics (e.g., throughput, error rates, CPU utilization) over time to understand if the system is healthy (the "what").
  3. Observability: A property of the system that allows for understanding the internal state based on external outputs. It integrates logs and metrics with Distributed Tracing to provide context across service boundaries, helping engineers understand the root cause of complex failures (the "why"). Answer: B
Q10easy

In Amazon API Gateway, which of the following best describes the purpose of an API stage?

A.

It acts as a physical server cluster that hosts the API's backend logic.

B.

It is a logical reference to a lifecycle state of an API, providing a unique invoke URL for deployment.

C.

It is a specific HTTP method used to define how a client interacts with a resource.

D.

It is a security group that defines network-level access rules for the API.

Show answer & explanation

Correct Answer: B

An API stage represents a logical snapshot of your API's configuration at a specific point in time. Stages allow developers to manage the API lifecycle by creating distinct environments (such as dev, test, or prod), each with its own unique endpoint URL. Answer: B

Q11easy

In the context of resilient application code for third-party service integrations, which pattern is defined as a mechanism that prevents an application from repeatedly attempting an operation that is likely to fail, thereby avoiding resource exhaustion and allowing the failing service time to recover?

A.

Retry logic

B.

Circuit breaker

C.

Dead-letter queue

D.

Bulkhead

Show answer & explanation

Correct Answer: B

The Circuit breaker pattern monitors for failures. Once a specific failure threshold is reached, the circuit 'trips' (opens), and subsequent calls to the service are blocked for a set period. This protects the calling application's resources (such as threads or memory) and prevents it from overwhelming a struggling downstream service. Retry logic (A) is a strategy of re-attempting a failed request. A dead-letter queue (C) stores messages that could not be processed. The bulkhead pattern (D) isolates system components to prevent cascading failures. Answer: B

Q12easy

In the context of API development and management, what is the primary purpose of a response transformation?

A.

To modify or reformat the data and status codes returned by a backend service before they are sent to the client.

B.

To ensure that the client's request is authorized using an identity provider.

C.

To automatically retry a failed request if the backend service is temporarily unavailable.

D.

To compress the request payload to reduce the amount of data sent over the network.

Show answer & explanation

Correct Answer: A

A response transformation allows an API gateway or middleware to intercept the output from a backend service and modify it—such as changing the data format (e.g., XML to JSON) or overriding the HTTP status code—to meet the specific requirements of the client application. This ensures compatibility between the backend and the client without requiring changes to the backend code itself. Answer: A

Q13medium

When implementing application-level authorization for fine-grained access control, which of the following logic patterns is most characteristic of Attribute-Based Access Control (ABAC)?

A.

Granting access based solely on a predefined mapping of user IDs to static permissions stored in a local configuration file.

B.

Evaluating a set of boolean logic rules that combine attributes of the subject (e.g., job title), the resource (e.g., owner ID), and the environment (e.g., IP address).

C.

Checking if a user belongs to a specific group (e.g., Managers) and allowing access to all resources associated with that group regardless of specific file metadata.

D.

Implementing a recursive check that verifies if a user has a 'parent' relationship with a specific organizational unit to determine heirarchical access.

Show answer & explanation

Correct Answer: B

Fine-grained permissions often require more context than simple roles. ABAC (Attribute-Based Access Control) provides this by evaluating policies against specific attributes of the user, the resource being accessed, and the current environment. For example, a rule might state: Allow EDIT if user.department == resource.department AND resource.status == 'draft'. Option A is a static ACL, Option C is standard RBAC, and Option D is Relationship-Based Access Control (ReBAC). Answer: B

Q14hard

A development team is building a CI/CD pipeline for a multi-tier application that includes an AWS Amplify frontend, an AWS Lambda API, and an Amazon ECS background processor. To perform a final integration test, the team must establish a stable environment that uses specific 'approved versions' of each component to ensure the test results are not invalidated by subsequent code changes. Which strategy best implements this requirement using AWS best practices?

A.

Deploy the frontend to the AWS Amplify main branch, invoke the Lambda function using the $LATEST qualifier, and configure the ECS service to use the latest image tag.

B.

Utilize AWS Copilot to manage a dedicated test environment, point the Amplify frontend to an integration branch, use a Lambda alias that references a specific published version, and update the ECS task definition to use a specific, immutable container image tag.

C.

Create a temporary AWS CloudFormation stack for testing, use API Gateway stage variables to point to the Lambda function's current execution environment, and set the ECS deployment controller to use a rolling update with a stable tag.

D).

Enable Amplify pull request previews for the frontend, configure a Lambda weighted alias to shift 10% of traffic to the new code, and use the latest version of the task definition in a shared development ECS cluster.

Show answer & explanation

Correct Answer: B

To conduct strategic integration testing with 'approved versions', one must use immutable and specific identifiers rather than 'floating' or mutable ones.

  1. AWS Amplify Branches: By using a dedicated integration branch, the frontend environment is isolated from the main or develop branches.
  2. Lambda Aliases: Unlike the $LATEST qualifier (which changes every time code is uploaded), a Lambda alias can be pointed to a specific, immutable version number (e.g., Version 5). This ensures the test is performed against a verified build.
  3. Immutable Container Image Tags: Using a specific tag (like v1.2.3) instead of latest ensures that the ECS service runs the exact code approved for testing.
  4. AWS Copilot Environments: Copilot simplifies the orchestration of these components into defined stages (like test or prod), managing the underlying infrastructure consistently.

Option A is incorrect because $LATEST and latest are mutable. Option C is less stable as stage variables without specific qualifiers often default to $LATEST. Option D describes a production canary deployment, not an isolated integration environment. Answer: B

Q15easy

In Amazon Kinesis Data Streams, what is the primary purpose of a partition key?

A.

To encrypt data records before they are stored in the stream.

B.

To determine which shard a data record is assigned to.

C.

To set the retention period for data within the stream.

D.

To define the total number of shards in a stream.

Show answer & explanation

Correct Answer: B

A partition key is used by Amazon Kinesis Data Streams to distribute data across multiple shards. When a data record is added to a stream, the service applies a hash function to the partition key to determine which shard the record belongs to. This mechanism ensures that records with the same partition key are always sent to the same shard, which is critical for maintaining the order of related events. Answer: B

These are 15 of 570 questions available. Take a practice test →

AWS Certified Developer - Associate (DVA-C02) Flashcards

450 flashcards for spaced-repetition study. Showing 30 sample cards below.

Amazon CloudWatch Embedded Metric Format (EMF)(4 cards shown)

Question

CloudWatch Embedded Metric Format (EMF)

Answer

A JSON specification used to instruct Amazon CloudWatch Logs to automatically extract metric values from log events.

[!TIP] It allows you to generate custom metrics asynchronously without making separate API calls to PutMetricData.

Key Benefits:

  • Reduced Latency: Metrics are emitted as logs, so the application doesn't block on a network request.
  • Cost Efficiency: You pay for log ingestion instead of multiple metric API calls.
  • Combined Data: Logs and metrics reside in the same record.

Question

Why is Amazon CloudWatch EMF preferred over the PutMetricData API for high-throughput AWS Lambda functions?

Answer

The primary reasons are performance and cost management:

  1. Asynchronous Execution: EMF writes metrics directly to stdout (which goes to CloudWatch Logs). The function does not wait for a synchronous response from the CloudWatch Metrics service, reducing execution time.
  2. Batching & Aggregation: CloudWatch Logs handles the extraction and aggregation in the background, minimizing the overhead on the compute resource.
  3. Connectivity: EMF works even if the resource is in a private subnet without a specific CloudWatch Metrics VPC endpoint, as long as it can reach CloudWatch Logs.
FeaturePutMetricDataEMF (via Logs)
SpeedSynchronous (Slower)Asynchronous (Faster)
CostPer API CallIncluded in Log Ingestion
ComplexityHigh (SDK overhead)Low (JSON strings)

Question

To define a custom metric using EMF, the JSON log must include a _aws root node containing a CloudWatchMetrics object, which defines the ___, ___, and ___ for the metric.

Answer

Namespace, Dimensions, and Metrics.

[!NOTE]

  • Namespace: The container for your metrics (e.g., MyCompany/PaymentService).
  • Dimensions: Name-value pairs used to categorize metrics (e.g., [["Region", "InstanceID"]]).
  • Metrics: The actual data points being tracked, including their Name and Unit.

Question

EMF Data Extraction Workflow

Answer

The following diagram illustrates how AWS processes EMF logs to produce CloudWatch Metrics:

Loading Diagram...

Example EMF JSON Structure:

json
{ "_aws": { "Timestamp": 1574109732004, "CloudWatchMetrics": [ { "Namespace": "AppPerformance", "Dimensions": [["Service"]], "Metrics": [{"Name": "Latency", "Unit": "Milliseconds"}] } ] }, "Service": "OrderProcessor", "Latency": 245 }

Amazon DynamoDB Keys and Indexing(4 cards shown)

Question

DynamoDB Partitioning Mechanism

Answer

DynamoDB uses the Partition Key value as input to an internal hash function to determine the physical storage location (partition).

Loading Diagram...

[!NOTE] Items with the same partition key are stored together and ordered by their sort key, enabling efficient queries within that partition.

Question

Composite Primary Key

Answer

A primary key composed of two attributes: a Partition Key (Hash Key) and a Sort Key (Range Key).

  • Partition Key: Determines the physical partition.
  • Sort Key: Groups items within a partition and allows for range-based queries (e.g., begins_with, between).

[!TIP] In a music database, use ArtistName as the Partition Key and SongTitle as the Sort Key to store all songs by an artist in the same partition.

Question

What are the main differences between a Global Secondary Index (GSI) and a Local Secondary Index (LSI)?

Answer

FeatureGlobal Secondary Index (GSI)Local Secondary Index (LSI)
Key StructureSeparate Partition & Sort KeySame Partition Key, Different Sort Key
Creation TimeAnytime (Post-creation)At Table Creation Only
ConsistencyEventually ConsistentStrong or Eventual Consistency
LimitsMax 20 per tableMax 5 per table
Size LimitNo limit10 GB per partition key value

[!WARNING] LSIs share the throughput (RCU/WCU) of the base table, whereas GSIs have their own provisioned throughput.

Question

In Amazon DynamoDB, the maximum size of a single item is ___, and a Local Secondary Index (LSI) is restricted to a maximum of ___ of data per partition key value.

Answer

400 KB and 10 GB

  • The 400 KB limit includes both the attribute names (UTF-8) and the attribute values.
  • The 10 GB limit applies to the "Item Collection," which is the sum of the sizes of all items in the table and its LSIs that have the same partition key.

[!TIP] If you expect to exceed 10 GB for a single partition key value, use a GSI instead of an LSI.

Amazon EventBridge & Event-Driven Patterns(4 cards shown)

Question

Amazon EventBridge Event Bus

Answer

A serverless event bus that acts as a central router for events.

It receives events from various producers (AWS services, custom apps, or SaaS) and directs them to specific targets based on matching rules.

[!NOTE] Every AWS account has a default event bus that receives events from AWS services.

Question

How do Rules and Targets interact within Amazon EventBridge?

Answer

A Rule serves as a filter that matches incoming events based on a specific event pattern. If an event matches the rule, it is routed to the defined Target.

ComponentResponsibility
RuleFilters events and can optionally transform the JSON payload.
TargetThe resource that processes the event (e.g., AWS Lambda, SNS, SQS).

[!TIP] One rule can trigger multiple targets simultaneously, facilitating a fan-out pattern.

Question

Event-driven architectures using Amazon EventBridge promote the development of ___ components, allowing services to scale and fail independently.

Answer

Loosely coupled

In this model, the Event Producer does not need to know about the Event Consumer. This decoupling enhances reliability because the producer continues to function even if a downstream consumer is unavailable.

Question

The Journey of an Event

Explain the end-to-end flow from an Event Producer to a Target using Amazon EventBridge.

Answer

The event flow follows these four primary stages:

  1. Event Producer: An application or AWS service (like S3) generates a signal that 'something happened'.
  2. Event Bus: The central hub that receives the event JSON.
  3. Rule: Evaluates the event against criteria; if matched, it may transform the data.
  4. Target: A computing service (like AWS Lambda) executes business logic in response.
Loading Diagram...

[!WARNING] Ensure that the Lambda function has the necessary resource-based policy permissions to be invoked by the EventBridge service.

Amazon Q Developer for Automated Testing(4 cards shown)

Question

Amazon Q Developer

Answer

An AI-powered conversational assistant designed to help developers throughout the software development life cycle. In the context of testing, it can automatically generate unit tests, explain complex code logic, and suggest bug fixes directly within the IDE or AWS Console.

[!NOTE] Amazon Q Developer has integrated and expanded upon many features previously associated with Amazon CodeGuru Reviewer and Profiler.

Question

How does a developer use Amazon Q to generate unit tests for a specific function within a supported IDE (like VS Code or IntelliJ)?

Answer

  1. Highlight the specific function or code block.
  2. Open the Amazon Q chat panel or use the context menu (right-click).
  3. Prompt the assistant using a command like /tests or a natural language request like "Generate unit tests for this function."
  4. Review the suggested code, iterate if necessary, and insert the test file into the project.
AdvantageDescription
EfficiencyReduces manual boilerplate creation for test suites.
Edge CasesIdentifies boundary conditions the developer might miss.
ConsistencyEnsures tests follow the syntax and style of the existing codebase.

Question

In the AWS development workflow, Amazon Q Developer assists in the "Test" phase of CI/CD by analyzing code logic to produce ___ that cover both success and failure paths.

Answer

automated tests

Amazon Q leverages generative AI to understand the intent of your code, allowing it to create comprehensive test cases including mocks for external dependencies and validation of error handling logic.

Question

Workflow: Amazon Q Test Generation Architecture

Answer

Amazon Q uses Large Language Models (LLMs) and context from your current workspace to provide tailored testing solutions.

Loading Diagram...

[!TIP] To get the best results, ensure your code has clear function signatures and comments, as Amazon Q uses this metadata to infer the expected behavior and valid input ranges for its generated tests.

Amazon Q Developer for AWS Development(4 cards shown)

Question

Amazon Q Developer

Answer

A generative AI-powered assistant designed for software development. It provides real-time code recommendations, explanations, and troubleshooting assistance within Integrated Development Environments (IDEs) and the AWS Management Console.

[!NOTE] It is a core skill (Skill 1.1.11) for the AWS Certified Developer - Associate exam to leverage this tool for development assistance.

Question

How does Amazon Q Developer assist in the software testing phase (Skill 3.3.6)?

Answer

Amazon Q Developer can be used to generate automated tests. By analyzing the existing application code, it can suggest unit tests and integration tests, reducing the manual effort required for test coverage.

BenefitDescription
EfficiencyRapidly creates boilerplate test code.
CoverageIdentifies edge cases the developer might miss.
ConsistencyEnsures tests follow established project patterns.

[!TIP] Use the chat interface to ask Amazon Q to "Write a unit test for this function" while your code file is open.

Question

According to the DVA-C02 curriculum, developers use Amazon Q Developer to assist with ___ and to generate ___ ___.

Answer

Development (or coding) and automated tests.

Amazon Q acts as an end-to-end assistant, from the initial implementation of architectural patterns to the verification of code through automation.

Question

Amazon Q Developer Workflow Integration

Answer

Amazon Q Developer integrates across the development lifecycle to provide context-aware support.

Loading Diagram...

Key Capabilities:

  • Code Explanations: Highlighting complex code blocks and asking for a summary.
  • Refactoring: Asking for more efficient ways to write a specific logic (e.g., changing a synchronous loop to an asynchronous pattern).
  • Documentation: Generating comments and docstrings automatically.

[!WARNING] Always review AI-generated code for security best practices and accuracy before deploying to production.

Analyze application performance issues(4 cards shown)

Question

Amazon CloudWatch

Answer

A monitoring and observability service that collects and analyzes operational data from AWS resources.

  • Metrics: Time-series data (CPU, Memory, custom metrics).
  • Logs: Centralized storage and analysis of application/system logs.
  • Alarms: Automated actions based on predefined thresholds.

[!TIP] Use CloudWatch for basic monitoring and setting up alerts when performance thresholds (like high latency) are breached.

Question

What is the difference between an EC2 System Status Check and an Instance Status Check?

Answer

Check TypeScopeCommon Causes of Failure
System Status CheckAWS Infrastructure/HostNetwork loss, power issues, physical host hardware failure.
Instance Status CheckSoftware/OS ConfigurationCorrupted file system, incorrect boot settings, incompatible kernel, exhausted memory.

[!NOTE] If a System Status Check fails, you usually need to stop and start the instance to move it to a new healthy host.

Question

To identify performance bottlenecks in a distributed microservices architecture, a developer should use ___ to visualize request paths and service latencies.

Answer

AWS X-Ray

AWS X-Ray provides distributed tracing, allowing developers to:

  1. Trace requests across multiple services.
  2. Create a Service Map to visualize dependencies.
  3. Identify which specific component is causing high latency or errors.
Loading Diagram...

Question

How does CloudWatch Embedded Metric Format (EMF) improve application performance analysis compared to standard custom metrics?

Answer

EMF allows applications to ingest complex, high-cardinality metrics by sending them as structured JSON logs.

Key Advantages:

  • Asynchronous Delivery: Metrics are extracted from logs by CloudWatch, reducing application latency compared to blocking API calls like PutMetricData.
  • Cost-Effective: Lowers costs for high-throughput metric ingestion.
  • Contextual Data: Logs contain the full context of the event alongside the metric.
json
{ "_aws": { "Timestamp": 1574109732004, "CloudWatchMetrics": [ { "Namespace": "MyApp", "Dimensions": [["Service"]], "Metrics": [{"Name": "ProcessingTime", "Unit": "Milliseconds"}] } ] }, "Service": "OrderProcessor", "ProcessingTime": 45, "OrderId": "12345" }

API Creation and Maintenance in AWS(4 cards shown)

Question

API Gateway Stage

Answer

A logical reference to a lifecycle state of an API (e.g., dev, prod, v1).

  • It acts as a snapshot of the API's current configuration.
  • Each stage provides a unique Invoke URL.
  • Supports Stage Variables to dynamically route traffic to different backend environments (like different Lambda aliases).

[!TIP] Use stages to implement canary deployments by shifting a percentage of traffic to a new deployment.

Question

What is the primary difference between Lambda Proxy and Lambda Custom integration regarding data transformation?

Answer

FeatureLambda Proxy (AWS_PROXY)Lambda Custom (AWS)
Data FlowPassed as-is to the Lambda function.Transformed via Mapping Templates.
ResponsibilityLambda must parse the full request and return a specific JSON structure.API Gateway handles the mapping between client and backend.
SetupSimple; requires minimal configuration.High; requires defining Method/Integration responses.

[!NOTE] Use Custom Integration when you need to enforce strict validation rules or transform payloads (e.g., XML to JSON) before they reach the backend.

Question

VTL Mapping Templates

Answer

Apache Velocity Template Language (VTL) is used in Integration Requests and Integration Responses to transform data between the client and the backend.

Use Cases:

  • Filtering: Removing sensitive data from a response before it reaches the client.
  • Transformation: Changing data formats (e.g., converting a legacy SOAP XML response to JSON).
  • Status Code Overriding: Mapping a string in the backend error (like "InvalidID") to an HTTP 400 status code.
Loading Diagram...

Question

To override a status code or map a backend error to a specific HTTP status in API Gateway, you must configure the ___.

Answer

Integration Response

In the Integration Response settings, you define a Lambda Error Regex (or selection pattern). When the backend's output matches this pattern, API Gateway maps the response to a pre-defined Method Response (like 404 or 500).

[!WARNING] If using Lambda Proxy Integration, this logic must be handled inside the Lambda code itself, as API Gateway simply passes the function's returned status code directly to the client.

API Gateway Stages and Custom Domains(2 cards shown)

Question

API Gateway Stage

Answer

A Stage is a logical reference to a lifecycle state of your API (e.g., prod, beta, dev). It represents a snapshot of the API configuration that is currently deployed and accessible to users.

[!NOTE] Each stage has its own unique Invoke URL, typically following this pattern: https://{api-id}.execute-api.{region}.amazonaws.com/{stage-name}/

Key Characteristics:

  • Independent settings for throttling and logging.
  • Can be associated with specific deployment histories.
  • Allows for versioning and environment separation.

Question

What is the primary use case for Stage Variables, and what is the syntax to access them?

Answer

Stage variables act like environment variables for API Gateway. They are used to change the behavior of an API deployment without updating the API code itself.

Common Use Cases:

  • Routing traffic to different backend Lambda functions (via Aliases).
  • Setting different HTTP endpoints for development and production.
  • Parameter mapping in templates.

Access Syntax: ${stageVariables.variableName}

[!TIP] If you have a variable named lambdaAlias, you can set your Lambda integration ARN to: arn:aws:lambda:us-east-1:123456789012:function:my-func:${stageVariables.lambdaAlias}

Showing 30 of 450 flashcards. Study all flashcards →

Ready to ace AWS Certified Developer - Associate (DVA-C02)?

Access all 570 practice questions, 9 timed mock exams, study notes, and flashcards — no sign-up required.

Start Studying — Free