☁️ AWS

Free AWS Certified Developer - Associate (DVA-C02) Study Resources

Comprehensive AWS Certified Developer - Associate (DVA-C02) hive provides study notes, question bank with practice tests, flashcards, and hands-on labs, all supported by a personal AI tutor to help you master the AWS Certified Developer - Associate (DVA-C02) certification.

570
Practice Questions
9
Mock Exams
131
Study Notes
450
Flashcard Decks
2
Source Materials

AWS Certified Developer - Associate (DVA-C02) Study Notes & Guides

131 AI-generated study notes covering the full AWS Certified Developer - Associate (DVA-C02) curriculum. Showing 10 complete guides below.

Study Guide864 words

AWS X-Ray: Mastering Annotations and Metadata for Service Tracing

Add annotations for tracing services

Read full article

AWS X-Ray: Mastering Annotations and Metadata for Service Tracing

This guide focuses on Skill 4.2.4 of the AWS Certified Developer - Associate (DVA-C02) exam: adding annotations for tracing services. Effective instrumentation allows developers to move beyond simple logging into the realm of true observability, enabling deep-dive analysis of distributed microservices.


Learning Objectives

By the end of this module, you will be able to:

  • Differentiate between Annotations and Metadata in AWS X-Ray.
  • Implement the AWS X-Ray SDK to record custom trace data.
  • Use Filter Expressions in the X-Ray console to search for specific traces based on indexed annotations.
  • Explain the performance and architectural impact of tracing on application latency.

Key Terms & Glossary

  • Segment: A JSON object that represents a logical unit of work in your application (e.g., a single HTTP request).
  • Subsegment: A more granular breakdown of a segment, representing calls to downstream services (RDS, S3) or specific code blocks.
  • Annotation: A key-value pair that is indexed by AWS X-Ray for use with filter expressions.
  • Metadata: A key-value pair that is not indexed and can contain any data type (including objects/arrays).
  • Sampling: The process of selecting which requests are traced to minimize performance overhead and cost.

The "Big Idea"

In a monolithic application, debugging is often as simple as looking at a stack trace. In a microservices architecture, a single user request might touch ten different services. Annotations act like "tags" or "labels" on a package; without them, you can see the package moved through the warehouse, but you don't know which customer it belongs to or if it was marked "Urgent." Annotations make your traces searchable, turning a mountain of telemetry data into actionable intelligence.


Formula / Concept Box

FeatureAnnotationsMetadata
Searchable?Yes (Indexed)No (Not Indexed)
Data TypesString, Number, BooleanAny (JSON objects, lists, etc.)
Use CaseFiltering traces in the consoleStoring rich debugging context
Limit50 annotations per segmentNo strict count (limited by segment size)
ExampleUserID, Region, IsPremiumRaw_HTTP_Response, Stack_Trace

Hierarchical Outline

  1. Instrumenting the Application
    • Use the AWS X-Ray SDK to wrap your application code.
    • Initialize the X-Ray recorder and start segments/subsegments.
  2. Adding Contextual Data
    • Annotations: Focus on high-value search terms.
    • Metadata: Focus on detailed debug information not needed for filtering.
  3. Querying Traces
    • Using the X-Ray Console Filter Expressions (e.g., annotation.UserID = "12345").
    • Visualizing the Service Map to identify bottlenecks.
  4. Performance Optimization
    • Configuring Sampling Rules to balance visibility vs. cost.
    • Asynchronous reporting via the X-Ray Daemon.

Visual Anchors

Trace Data Flow

Loading Diagram...

Search Latency vs. Trace Density

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Annotation Implementation: Using the SDK to add an indexed field.
    • Example: AWSXRay.addAnnotation("MembershipLevel", "Gold"); allows a developer to run a query like annotation.MembershipLevel = "Gold" to see if premium users are experiencing higher latency.
  • Metadata Storage: Using the SDK to store diagnostic data.
    • Example: AWSXRay.addMetadata("Payload", myLargeJsonObject); stores the exact request data for a failed transaction, allowing the developer to inspect the state without needing a search index for that large object.

Worked Examples

Example 1: Instrumenting a Lambda Function (Node.js)

Scenario: You need to track which specific CustomerType experiences slow DynamoDB queries.

javascript
const AWSXRay = require('aws-xray-sdk-core'); const AWS = AWSXRay.captureAWS(require('aws-sdk')); exports.handler = async (event) => { // Access the current segment const segment = AWSXRay.getSegment(); // 1. Add Annotation for filtering segment.addAnnotation("CustomerType", event.customerType); // 2. Add Metadata for debugging (not indexed) segment.addMetadata("RequestHeader", event.headers); try { const data = await ddb.getItem(params).promise(); return data; } catch (err) { segment.addAnnotation("ErrorType", "DatabaseConnection"); throw err; } };

Example 2: X-Ray Filter Expression

Scenario: Find all traces where the response was slow (over 2 seconds) for a specific user.

  • Filter Expression: responsetime > 2 AND annotation.UserID = "UserA"
  • Outcome: The console displays only the relevant traces, significantly reducing the "noise" in high-traffic environments.

Checkpoint Questions

  1. Question: Can you use a JSON object as a value for an X-Ray Annotation?
    • Answer: No. Annotations only support strings, numbers, and booleans because they are indexed. Use Metadata for objects.
  2. Question: What is the primary advantage of using Annotations over simply logging the data to CloudWatch Logs?
    • Answer: Annotations integrate directly with the X-Ray Service Map and Trace Search, allowing you to filter visual representations of your architecture by specific business data (e.g., specific tenant IDs in a SaaS app).
  3. Question: If you add 100 annotations to a single segment, what happens?
    • Answer: X-Ray has a limit of 50 annotations per segment. Excess annotations will be ignored or cause an error depending on the SDK version.
  4. Question: How do you search for a trace in the X-Ray console that has the annotation Environment set to Production?
    • Answer: Use the filter expression: annotation.Environment = "Production".
Study Guide945 words

Mastering Application Performance Analysis: AWS DVA-C02 Study Guide

Analyze application performance issues

Read full article

Mastering Application Performance Analysis

This study guide focuses on identifying, analyzing, and resolving performance bottlenecks within AWS-hosted applications. It covers the essential tools and strategies required for the AWS Certified Developer - Associate (DVA-C02) exam, specifically within the Troubleshooting and Optimization domain.

Learning Objectives

After studying this guide, you should be able to:

  • Profile application performance to identify compute and memory requirements.
  • Interpret application metrics, logs, and traces using Amazon CloudWatch and AWS X-Ray.
  • Implement application-level caching and optimize resource usage.
  • Perform root cause analysis (RCA) using structured logging and custom metrics.
  • Tune AWS Lambda functions for optimal concurrency and performance.

Key Terms & Glossary

  • Observability: The ability to measure the internal state of a system by examining its outputs (logs, metrics, and traces).
  • Profiling: The process of measuring the space (memory) or time complexity of code, the duration of particular function calls, or the frequency of function calls.
  • Concurrency: In AWS Lambda, this is the number of requests that your function is serving at any given time.
  • Embedded Metric Format (EMF): A JSON specification used to instruct CloudWatch Logs to automatically extract custom metrics from log streams.
  • Throttling: The process of limiting the rate of requests to a service (e.g., API Gateway or Lambda) to protect resources.
  • Cold Start: The latency observed when a Lambda function is triggered for the first time or after being idle, requiring a new execution environment to be provisioned.

The "Big Idea"

Performance analysis is not a one-time event but a continuous lifecycle. In a distributed cloud environment, the "Big Idea" is Observability over Monitoring. While monitoring tells you that a system is failing (e.g., "CPU is at 90%"), observability allows you to understand why it is failing by correlating metrics with distributed traces and granular logs. Optimization then follows by right-sizing resources (compute/memory) and implementing caching layers to reduce latency.

Formula / Concept Box

ConceptFormula / Key RuleImplementation Note
Lambda Execution CostCost=Invocations×Duration×Provisioned Memory\text{Cost} = \text{Invocations} \times \text{Duration} \times \text{Provisioned Memory}Increasing memory also increases CPU power linearly.
Cache Hit RatioCache HitsCache Hits+extCacheMisses\frac{\text{Cache Hits}}{\text{Cache Hits} + ext{Cache Misses}}Aim for high ratios to reduce backend load.
Lambda ConcurrencyRequests per second×Avg. Execution Duration (sec)\text{Requests per second} \times \text{Avg. Execution Duration (sec)}Essential for calculating required concurrency limits.

Hierarchical Outline

  • I. Performance Instrumentation
    • Logging: Implementation of structured logging for automated parsing.
    • Monitoring: Using CloudWatch for standard metrics (CPU, Disk I/O).
    • Tracing: Adding annotations and metadata in AWS X-Ray to track request flow.
  • II. Bottleneck Identification
    • Compute Analysis: Determining minimum memory/compute via profiling.
    • Log Querying: Using CloudWatch Logs Insights to identify error patterns.
    • Integration Issues: Debugging service-to-service communication (e.g., SQS to Lambda).
  • III. Optimization Strategies
    • Caching: Application-level (ElastiCache) vs. Edge-level (CloudFront/API Gateway).
    • Messaging: Using SNS Subscription Filter Policies to reduce unnecessary downstream processing.
    • Resource Tuning: Adjusting Lambda memory and timeout settings.

Visual Anchors

Troubleshooting Flowchart

Loading Diagram...

Performance Saturation Curve

This diagram illustrates the "Knee of the Curve," where response time increases exponentially as load approaches resource capacity.

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Term: Subscription Filter Policy
    • Definition: A feature of Amazon SNS that allows a subscriber to receive only a subset of messages based on attributes.
    • Example: A "Shipping" Lambda function only receives messages where the order_type attribute is set to physical, ignoring digital orders to save compute costs.
  • Term: Application-Level Caching
    • Definition: Storing the results of expensive database queries or API calls in local memory or a dedicated cache (like Redis).
    • Example: An e-commerce app stores the "Product Catalog" in an ElastiCache cluster for 10 minutes instead of querying DynamoDB for every page load.

Worked Examples

Scenario: Troubleshooting a Slow Lambda Function

Problem: A Lambda function triggered by API Gateway is intermittently timing out after 29 seconds.

  1. Step 1: Metric Analysis: Review CloudWatch Metrics for the Duration and Throttles metrics. You notice Duration is consistently hitting the 29s mark, which is the API Gateway integration timeout.
  2. Step 2: Log Investigation: Use CloudWatch Logs Insights to run a query: fields @timestamp, @message | filter @message like /Task timed out/ This confirms the timeouts are occurring.
  3. Step 3: Distributed Tracing: Enable AWS X-Ray and view the service map. You see a specific call to an external 3rd-party API taking 25+ seconds.
  4. Step 4: Resolution:
    • Implement Retry Logic with Exponential Backoff for the 3rd-party call.
    • Implement a Circuit Breaker pattern to fail fast if the 3rd-party service is down.
    • Increase Lambda Memory, which provides more CPU power to handle the overhead of the connection faster.

Checkpoint Questions

  1. What is the primary difference between a System Status Check and an Instance Status Check for EC2?
  2. How does the CloudWatch Embedded Metric Format (EMF) help in high-throughput applications compared to the PutMetricData API?
  3. If a Lambda function is experiencing high latency during initialization, which configuration should you investigate first?
  4. How can Amazon Q Developer assist in the performance analysis lifecycle?
Click to view answers
  1. System Status Checks monitor the AWS infrastructure (hardware/network/power), while Instance Status Checks monitor the software and network configuration of the individual instance.
  2. EMF is more efficient because it sends metrics as part of the log stream (asynchronously), reducing API call overhead and potential throttling encountered with PutMetricData.
  3. Investigate Provisioned Concurrency to eliminate cold starts or increase Memory to speed up the initialization code.
  4. Amazon Q Developer can generate automated test events (JSON payloads) to simulate load and identify bottlenecks, and it can help generate unit tests to verify performance-critical code.
Study Guide1,050 words

Optimizing Application Resource Requirements

Apply application requirements for resources (for example, memory, cores)

Read full article

Optimizing Application Resource Requirements

This study guide focuses on the critical task of determining and applying the correct resource specifications—specifically memory and CPU (cores)—to AWS-hosted applications. Mastering this ensures that your applications are both cost-effective and performant, avoiding the twin pitfalls of over-provisioning and resource starvation.


Learning Objectives

After studying this guide, you should be able to:

  • Profile application performance to determine minimum memory and compute requirements.
  • Configure AWS Lambda resources, understanding the proportional relationship between memory and CPU.
  • Implement ECS Task Placement Strategies to optimize resource utilization across a cluster.
  • Select Scaling Policies (Target Tracking, Step, Simple) based on application demand patterns.
  • Define infrastructure resources using Infrastructure as Code (IaC) templates (SAM/CloudFormation).

Key Terms & Glossary

  • Profiling: The process of analyzing an application's behavior (memory usage, CPU cycles, I/O) during execution to identify bottlenecks.
  • Concurrency: In AWS Lambda, the number of requests that your function is serving at any given time.
  • Binpacking: An ECS placement strategy that minimizes the number of instances used by packing tasks onto the instance with the least available CPU or memory.
  • Target Tracking: A scaling policy that maintains a specific metric (e.g., 70% average CPU utilization) by automatically adjusting capacity.
  • Vertical Scaling: Increasing the capacity of a single resource (e.g., more RAM for a Lambda function).
  • Horizontal Scaling: Increasing the number of resource units (e.g., adding more EC2 instances to an Auto Scaling Group).

The "Big Idea"

[!IMPORTANT] Resource optimization in the cloud is a balancing act. If you under-provision, your application crashes or throttles (Performance Risk). If you over-provision, you pay for idle capacity (Cost Risk). The goal is to use data-driven profiling to find the "Goldilocks" zone where performance meets cost-efficiency.

Formula / Concept Box

ServiceKey Resource ConfigurationBehavior
AWS LambdaMemory (128 MB to 10,240 MB)CPU power scales proportionally with memory. Doubling memory doubles CPU.
Amazon ECSCPU/Memory ReservationTasks will not be placed on instances without sufficient available resources.
Amazon EC2Instance Type (vCPUs/RAM)Fixed hardware profiles (e.g., t3.medium has 2 vCPUs, 4 GiB RAM).
API GatewayThrottling/QuotaLimits requests per second (RPS) to prevent downstream resource exhaustion.

Hierarchical Outline

  1. Performance Profiling & Baseline
    • Application Logs: Identify bottlenecks using CloudWatch Logs and Insights.
    • Metrics: Use CloudWatch metrics (CPUUtilization, MemoryUtilization) to find peak usage.
  2. AWS Lambda Resource Management
    • Memory Configuration: Allocating more memory provides more vCPU and networking bandwidth.
    • Timeouts: Define the maximum execution time to prevent runaway costs from hung processes.
  3. Amazon ECS Resource Optimization
    • Task Placement Strategies:
      • Binpack: Prioritizes cost (minimal instances).
      • Spread: Prioritizes High Availability (across AZs).
      • Random: Distributed randomly.
    • Task Placement Constraints: distinctInstance or memberOf (e.g., only run on t3.micro).
  4. Auto Scaling Mechanisms
    • Target Tracking: Most common; keeps a metric at a setpoint.
    • Step Scaling: Increases capacity in specific "steps" based on alarm severity.
    • Simple Scaling: Single adjustment based on a single alarm.

Visual Anchors

Lambda Resource Relationship

Increasing memory in Lambda isn't just about RAM; it's the primary lever for compute power.

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

ECS Task Placement Flow

Loading Diagram...

Definition-Example Pairs

  • Resource Reservation: Reserving a specific amount of CPU/Memory that a container is guaranteed to have.
    • Example: Setting an ECS task memory reservation to 512MiB ensures it won't be killed unless it exceeds that limit, and it won't be placed on a host with only 256MiB free.
  • Canary Deployment: A deployment strategy that shifts traffic to a new version in small increments.
    • Example: Updating an AWS SAM template to shift 10% of traffic to a new Lambda version with higher memory settings to test performance before a full rollout.
  • Profiling: Using tools to measure resource consumption.
    • Example: Using AWS Lambda Power Tuning to run a function with different memory settings and selecting the one that offers the best price-to-performance ratio.

Worked Examples

Example 1: Configuring Lambda in AWS SAM

You need to deploy a Lambda function that processes large images and requires at least 2 vCPUs to perform efficiently.

Solution: Since 1 vCPU is roughly equivalent to 1,769 MB of memory in Lambda, you should set the memory to at least 3,072 MB to ensure access to multiple cores.

yaml
MyImageProcessor: Type: AWS::Serverless::Function Properties: CodeUri: hello_world/ Handler: app.lambda_handler Runtime: python3.9 MemorySize: 3072 Timeout: 30

Example 2: ECS Binpack Strategy

A startup wants to minimize its EC2 bill by using as few instances as possible for its microservices.

Solution: Implement the binpack strategy in the service definition, focusing on memory to ensure instances are fully utilized before a new one is provisioned by the Auto Scaling Group.

json
"placementStrategy": [ { "field": "memory", "type": "binpack" } ]

Checkpoint Questions

  1. If a Lambda function is timing out while performing heavy mathematical computations, what is the most effective way to increase its CPU power?
  2. Which ECS placement strategy is best suited for High Availability across multiple Availability Zones?
  3. What is the difference between a Task Placement Constraint and a Task Placement Strategy?
  4. Why might you use Target Tracking scaling instead of Simple Scaling for a web application?
Click to see answers
  1. Increase the MemorySize setting (Memory and CPU scale proportionally).
  2. The Spread strategy (specifically field: attribute:ecs.availability-zone).
  3. A Constraint is a hard requirement (e.g., "must run on t2.large"); a Strategy is a preference for how tasks are distributed (e.g., "pack them tightly").
  4. Target Tracking is more "set and forget"; it automatically calculates the scaling adjustments needed to stay at a target, whereas Simple Scaling requires manual threshold tuning and cooldowns.
Study Guide985 words

Mastering Root Cause Analysis: AWS Developer Associate Study Guide

Assist in a root cause analysis

Read full article

Mastering Root Cause Analysis (RCA)

Root Cause Analysis in the context of AWS development is the process of identifying the underlying origin of an application failure, performance degradation, or deployment error. This guide covers the essential tools and methodologies required for the DVA-C02 exam.

Learning Objectives

After studying this guide, you should be able to:

  • Debug code effectively to identify logical and runtime defects.
  • Interpret and correlate application metrics, logs, and traces.
  • Execute complex queries against log data using Amazon CloudWatch Logs Insights.
  • Implement custom metrics using the CloudWatch Embedded Metric Format (EMF).
  • Assess application health through centralized dashboards and service insights.
  • Troubleshoot deployment failures by analyzing service-specific output logs.

Key Terms & Glossary

  • RCA (Root Cause Analysis): A systematic process for identifying the "root" of a problem rather than just addressing its symptoms.
  • CloudWatch Logs Insights: An interactive query service for CloudWatch Logs that allows for high-performance searching and visualization of log data.
  • X-Ray: An AWS service that collects data about requests that your application serves and provides tools to view, filter, and gain insights into that data to identify issues and opportunities for optimization.
  • EMF (Embedded Metric Format): A structured JSON specification used to instruct CloudWatch Logs to automatically extract metric values from log events.
  • Trace: A representation of a single request's journey through multiple services or components in a distributed system.

The "Big Idea"

In a distributed, serverless, or microservices environment, failures are rarely isolated. The "Big Idea" behind modern RCA is Observability. You cannot fix what you cannot see. By correlating Logs (what happened), Metrics (how the system behaved), and Traces (where the request spent time), a developer can move from "something is wrong" to "this specific line of code in Lambda A failed because of a timeout in DynamoDB B" in minutes rather than hours.

Formula / Concept Box

FeatureCore PurposeExample AWS Tool
MetricsQuantitative data (CPU, Latency, Error Count)CloudWatch Metrics
LogsQualitative data (Textual events, Stack traces)CloudWatch Logs
TracesEnd-to-end request flow (Dependency analysis)AWS X-Ray
EMFLog-to-Metric conversionCloudWatch EMF Library

[!TIP] Remember: Metrics tell you that you have a problem; Logs and Traces tell you why you have that problem.

Hierarchical Outline

  1. Debugging Code & Defects
    • Local vs. Remote Debugging: Using SAM CLI for local Lambda emulation vs. X-Ray for production.
    • Defect Identification: Identifying logical errors (wrong output) vs. runtime errors (crashes).
  2. Telemetry Data Interpretation
    • Metrics: Interpreting 4XX (client-side) vs. 5XX (server-side) error spikes.
    • Logs: Analyzing standard output (stdout) and standard error (stderr).
    • Traces: Identifying "cold starts" and high-latency segments in X-Ray service maps.
  3. Log Querying & Insights
    • Syntax: Using filter, stats, sort, and limit keywords.
    • Use Case: Finding the most frequent error messages across a 24-hour window.
  4. Custom Metrics & Dashboards
    • Embedded Metric Format (EMF): Writing logs as JSON to generate high-cardinality metrics asynchronously.
    • CloudWatch Dashboards: Aggregating disparate widgets (Logs, Metrics, Alarms) into a single pane of glass.
  5. Service-Specific Troubleshooting
    • Lambda: Checking Init duration and Memory usage.
    • API Gateway: Reviewing Execution Logs and Access Logs.
    • Deployment: Checking CodeDeploy and CloudFormation event logs for rollbacks.

Visual Anchors

The Troubleshooting Workflow

Loading Diagram...

The Three Pillars of Observability

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Structured Logging: A practice where logs are written as JSON instead of plain text.
    • Example: Instead of logging "User 123 logged in", you log {"event": "Login", "userId": 123, "status": "success"}. This allows for easier machine parsing.
  • X-Ray Annotation: Key-value pairs added to traces to allow for indexing and filtering.
    • Example: Adding segment.putAnnotation("IsPremiumUser", "true") to see if performance issues only affect specific user tiers.
  • Health Check: A mechanism to determine if an application instance is capable of handling traffic.
    • Example: A Route 53 health check hitting a /health endpoint that returns a 200 OK only if the database connection is active.

Worked Examples

Example 1: Finding the "Top 10" Slowest API Requests

Scenario: Your API Gateway is experiencing intermittent slowness. You need to find which specific endpoints are the slowest using CloudWatch Logs Insights.

The Query:

sql
filter @type = "REPORT" | stats max(@duration) as max_duration by @requestId | sort max_duration desc | limit 10

Step-by-Step Breakdown:

  1. filter @type = "REPORT": This focuses on the Lambda report lines that contain execution metadata.
  2. stats max(@duration): Calculates the maximum execution time.
  3. by @requestId: Groups the results so we see duration per unique request.
  4. sort ... desc: Puts the slowest requests at the top.

Example 2: Implementing EMF in Python

Scenario: You want to record the duration of a specific processing step without making a blocking call to the CloudWatch PutMetricData API.

Code Snippet:

python
import json import time def lambda_handler(event, context): start = time.time() # ... perform logic ... duration = (time.time() - start) * 1000 # EMF Format metrics = { "_aws": { "Timestamp": int(time.time() * 1000), "CloudWatchMetrics": [{ "Namespace": "MyApp", "Dimensions": [["FunctionName"]], "Metrics": [{"Name": "ProcessingTime", "Unit": "Milliseconds"}] }] }, "FunctionName": context.function_name, "ProcessingTime": duration } print(json.dumps(metrics))

Checkpoint Questions

  1. What is the primary difference between an X-Ray Annotation and an X-Ray Metadata?
    • Answer: Annotations are indexed for searching/filtering; Metadata is not indexed and is used for storing additional data for debugging only.
  2. You see a spike in Lambda Throttles in CloudWatch. Which metric should you check next to determine if it is due to a regional limit or a function-specific limit?
    • Answer: Check the ConcurrentExecutions metric and compare it against your Reserved Concurrency settings.
  3. Why is CloudWatch EMF preferred over the PutMetricData API for high-throughput applications?
    • Answer: EMF is asynchronous (it writes to logs) and doesn't introduce network latency or API throttling risks during execution.
  4. In a CloudWatch Logs Insights query, what keyword is used to calculate aggregate values like averages or counts?
    • Answer: The stats keyword.

Muddy Points & Cross-Refs

  • Tracing vs. Logging: New developers often confuse these. Remember that a log is a discrete event, while a trace connects those events across multiple services.
  • Deployment Logs: If an Elastic Beanstalk deployment fails, don't just look at the AWS Console status; look at the /var/log/eb-activity.log on the instance for the actual error.
  • Cross-Ref: For more on how these metrics trigger actions, see Unit 4.2: Instrument code for observability regarding Alert Notifications.
Hands-On Lab920 words

Root Cause Analysis Mastery: Debugging Serverless Applications on AWS

Assist in a root cause analysis

Read full article

Root Cause Analysis Mastery: Debugging Serverless Applications on AWS

This lab focuses on the critical DVA-C02 skill of Assisting in a Root Cause Analysis (RCA). You will act as a developer troubleshooting a failing serverless data pipeline. You'll move from identifying a failure in logs to tracing the execution path in X-Ray and eventually fixing the defect.

[!WARNING] Remember to run the teardown commands at the end of this lab to avoid ongoing charges to your AWS account.

Prerequisites

Before starting, ensure you have:

  • An AWS Account with administrative access.
  • AWS CLI configured with credentials (aws configure).
  • Basic familiarity with Python and JSON.
  • IAM permissions to create Lambda, S3, DynamoDB, and CloudWatch resources.

Learning Objectives

By the end of this lab, you will be able to:

  1. Query CloudWatch Logs using Log Insights to find specific application errors.
  2. Analyze X-Ray Traces to identify service integration bottlenecks and failures.
  3. Implement Custom Metrics using the CloudWatch Embedded Metric Format (EMF).
  4. Perform an RCA by correlating logs, traces, and metrics to identify a code defect.

Architecture Overview

We are troubleshooting a "Thumbnail Processor" application. An image is uploaded to S3, triggering a Lambda function that logs metadata to DynamoDB. Currently, the metadata step is failing.

Loading Diagram...

Step-by-Step Instructions

Step 1: Deploy the Faulty Infrastructure

We will deploy a CloudFormation stack that intentionally contains a bug in the Lambda code's integration with DynamoDB.

bash
aws cloudformation deploy \ --stack-name brainybee-rca-lab \ --template-body https://raw.githubusercontent.com/aws-samples/aws-serverless-workshops/master/Observability/template.yaml \ --capabilities CAPABILITY_IAM
Console alternative

Navigate to CloudFormation > Create stack > With new resources. Upload the template URL and follow the wizard to name the stack

brainybee-rca-lab

.

Step 2: Trigger the Failure

Upload a test file to the newly created S3 bucket to trigger the Lambda function.

bash
# Get the bucket name from stack outputs BUCKET_NAME=$(aws cloudformation describe-stacks --stack-name brainybee-rca-lab --query "Stacks[0].Outputs[?OutputKey=='BucketName'].OutputValue" --output text) echo "test data" > test-image.jpg aws s3 cp test-image.jpg s3://$BUCKET_NAME/test-image.jpg

Step 3: Query Logs with CloudWatch Insights

The Lambda failed silently. We need to find the specific error message.

bash
# Start a query for the last 5 minutes QUERY_ID=$(aws logs start-query \ --log-group-name /aws/lambda/ThumbnailFunction \ --start-time $(date +%s -d "5 minutes ago") \ --end-time $(date +%s) \ --query-string 'fields @timestamp, @message | filter @message like /Error/ | sort @timestamp desc' \ --query 'queryId' --output text) # Wait 5 seconds, then get results aws logs get-query-results --query-id $QUERY_ID

[!TIP] In the CloudWatch Console, go to Logs Insights, select the log group, and run: fields @timestamp, @message | filter @message like /Error/

Step 4: Analyze the Trace in X-Ray

Logs show a ResourceNotFoundException. We need to see which service integration is actually failing.

bash
# Get trace summaries for the last minute aws xray get-trace-summaries --start-time $(date +%s -d "1 minute ago") --end-time $(date +%s)
Console alternative

Navigate to CloudWatch > X-Ray traces > Service map. You will see a red circle around the connection between Lambda and DynamoDB, indicating a 400-series error.

Checkpoints

  • S3 Upload: Is the file visible in aws s3 ls s3://$BUCKET_NAME?
  • Logs: Did the Log Insights query return an error string like Requested resource not found (Table: MetadataTable)?
  • Traces: Does the X-Ray Service Map show a failed node for DynamoDB?

Teardown

To avoid costs, delete the resources created during this lab.

bash
# Empty the bucket first aws s3 rm s3://$BUCKET_NAME --recursive # Delete the stack aws cloudformation delete-stack --stack-name brainybee-rca-lab

Troubleshooting

IssuePossible CauseFix
AccessDenied on S3 uploadIAM permissions missingEnsure your CLI user has s3:PutObject for the bucket.
Query returns 0 resultsLambda hasn't logged yetWait 30 seconds for CloudWatch to ingest the logs and retry.
Stack deletion hangsS3 bucket not emptyManually delete files in the S3 bucket before deleting the stack.

Challenge

Goal: Implement an automated monitor.

  1. Create a CloudWatch Metric Filter that looks for the word "Error" in the /aws/lambda/ThumbnailFunction log group.
  2. Assign this filter to a custom metric named ProcessingErrors.
  3. Create a CloudWatch Alarm that sends an SNS notification if ProcessingErrors > 0 for a 1-minute period.

Cost Estimate

  • Lambda: Free tier (first 1M requests/mo).
  • S3: $0.023 per GB (negligible for this lab).
  • CloudWatch Logs: $0.50 per GB ingested.
  • X-Ray: Free tier (first 100,000 traces/mo).
  • Total Estimated Cost: < $0.05 (well within AWS Free Tier).

Concept Review

In this lab, we performed a standard Root Cause Analysis (RCA) flow. This flow typically narrows down from a broad symptom to a specific code or configuration defect.

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Key Comparisons

ToolPrimary PurposeBest Used For...
CloudWatch LogsDiscrete event recordingFinding stack traces and specific error messages.
CloudWatch MetricsNumerical aggregationDetecting trends and triggering automated alarms.
AWS X-RayDistributed request tracingIdentifying high latency or failures in multi-service calls.
Log InsightsLog queryingSifting through thousands of log lines using a SQL-like syntax.
Study Guide865 words

Mastering IAM Role Assumption & AWS STS

Assume an IAM role

Read full article

Mastering IAM Role Assumption & AWS STS

This guide covers the mechanisms, security benefits, and implementation patterns for assuming IAM roles using the AWS Security Token Service (STS), a core competency for the AWS Certified Developer - Associate (DVA-C02) exam.

Learning Objectives

By the end of this study guide, you should be able to:

  • Explain how AWS STS generates and manages temporary security credentials.
  • Differentiate between Trust Policies and Identity-based Policies.
  • Configure EC2 Instance Profiles to eliminate hardcoded credentials.
  • Implement Cross-Account Access using delegation patterns.
  • Understand the limitations and constraints of Role Chaining.

Key Terms & Glossary

  • STS (Security Token Service): A global AWS service that grants limited-privilege, temporary credentials to users/services.
  • AssumeRole: An API operation that returns temporary credentials (Access Key ID, Secret Access Key, and Session Token).
  • Trust Policy: A JSON document attached to a role defining which principals (users, services, or accounts) are allowed to assume it.
  • Instance Profile: A container for an IAM role that allows an EC2 instance to automatically receive temporary credentials.
  • Trusted Account: The account containing the user/identity that needs access.
  • Trusting Account: The account containing the resource (e.g., S3 bucket) and the IAM Role.

The "Big Idea"

In cloud security, long-term credentials are a liability. If a developer hardcodes an Access Key into an application, a single leak compromises the account indefinitely until the key is manually rotated.

IAM Role Assumption flips this script: instead of "having" a key, an entity "requests" a temporary session. This reduces the blast radius of a credential leak because the session automatically expires, and no sensitive secrets are stored in the application source code.

Formula / Concept Box

ComponentDescriptionDefault / Max
Credential OutputAccess Key ID, Secret Access Key, Security TokenN/A
Session DurationDurationSeconds parameter1h (Default) / 12h (Max)
Role Chaining LimitMax session duration when one role assumes another1 hour (Hard Limit)
Global Endpointhttps://sts.amazonaws.comRedirects to us-east-1

Hierarchical Outline

  1. Identity Federation & STS
    • Mechanism: STS generates credentials based on attached policies.
    • Expiration: Credentials last from minutes to hours; once expired, they are invalid.
  2. EC2 Instance Roles
    • Instance Profiles: Acts as the bridge between the EC2 and the IAM Role.
    • Security: Removes the need for ~/.aws/credentials files on servers.
  3. Cross-Account Delegation
    • Step 1: Define the role in the Trusting Account.
    • Step 2: Define the Trust Policy (Allow Account A to assume).
    • Step 3: Grant sts:AssumeRole permissions in the Trusted Account.
  4. Role Chaining
    • Occurs when Role A assumes Role B.
    • Constraint: Session duration is strictly limited to 1 hour.

Visual Anchors

Flow: EC2 Instance Profile Pattern

Loading Diagram...

Cross-Account Access Logic

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Term: Trust Policy

    • Definition: A resource-based policy attached to an IAM role that defines which principals can assume the role.
    • Example: A Lambda function in Account 111122223333 needs to write to DynamoDB in Account 444455556666. The role in Account 444455556666 must have a Trust Policy listing the Lambda's ARN as a trusted principal.
  • Term: Role Chaining

    • Definition: The process of using a set of temporary credentials to assume yet another role.
    • Example: An administrator logs into a "Jump Account" role and then assumes a "Production Manager" role in a different account to perform maintenance.

Worked Examples

Scenario: Configuring S3 Access for an EC2-hosted App

The Problem: A developer needs their web app on EC2 to download images from S3 without putting secret keys in the app.config file.

The Solution:

  1. Create IAM Role: Create a role named S3-ReadOnly-Role.
  2. Attach Permissions: Attach the AmazonS3ReadOnlyAccess managed policy.
  3. Define Trust: Ensure the Trust Policy allows ec2.amazonaws.com to assume the role.
  4. Create Instance Profile: Attach the S3-ReadOnly-Role to an Instance Profile.
  5. Assign to EC2: Go to the EC2 console, select the instance, and choose "Modify IAM Role." Pick the new profile.
  6. Verification: Run aws s3 ls on the EC2 terminal. It works without any aws configure setup because the SDK automatically fetches tokens from the Instance Metadata Service.

Checkpoint Questions

  1. True or False: IAM Roles use long-term credentials like usernames and passwords. (Answer: False. They use temporary credentials managed by STS.)
  2. What is the default duration for a session when calling AssumeRole? (Answer: 1 hour.)
  3. If you are performing "Role Chaining," what is the maximum session duration you can request? (Answer: 1 hour.)
  4. Which policy defines who can assume a role? (Answer: The Trust Policy.)
  5. Why is using Instance Profiles better than hardcoding keys? (Answer: It prevents credential theft from source code and removes the burden of manual key rotation.)

[!IMPORTANT] When configuring cross-account access, remember: permissions are required in both accounts. The trusting account must allow the access, and the trusted account must give the user permission to switch to that role.

Study Guide865 words

Automating Deployment Testing in AWS

Automate deployment testing

Read full article

Automating Deployment Testing in AWS

This guide focuses on Task 3: Automate deployment testing within the AWS Certified Developer - Associate (DVA-C02) curriculum. It covers the mechanisms for environment isolation, test event creation, and the integration of automated tests within CI/CD pipelines.

Learning Objectives

By the end of this module, you will be able to:

  • Generate and use JSON test events for Lambda and API Gateway.
  • Configure environments using Lambda aliases, container tags, and API Gateway stages.
  • Deploy Infrastructure as Code (IaC) templates using AWS SAM and CloudFormation to support automated testing.
  • Utilize Amazon Q Developer to accelerate the creation of unit and integration tests.
  • Differentiate between various deployment strategies like Blue/Green and Canary within an automated context.

Key Terms & Glossary

  • Lambda Alias: A pointer to a specific version of a Lambda function (e.g., PROD pointing to version 5).
  • Stage Variables: Name-value pairs used in API Gateway to change configuration based on the stage (e.g., lambdaAlias = "beta").
  • Infrastructure as Code (IaC): The process of managing and provisioning computer data centers through machine-readable definition files (e.g., CloudFormation).
  • JSON Payload: The data format used to simulate events (like an S3 upload or HTTP request) when testing serverless functions.
  • Amazon Q Developer: An AI-powered assistant that can generate test code and explain complex logic.

The "Big Idea"

[!IMPORTANT] The core goal of automated deployment testing is to shift-left: moving testing earlier in the development lifecycle. Instead of manual verification after a deploy, we use automation to ensure that code satisfies requirements before it ever reaches a production user. In AWS, this is achieved by treating infrastructure as code and using logical environment isolation (aliases and stages) to test in "production-like" settings.

Formula / Concept Box

FeaturePurpose in TestingCommon Practice
Lambda AliasesTraffic ShiftingPoint TEST alias to $LATEST and PROD to a stable version number.
API Gateway StagesEnvironment IsolationCreate v1, v2, dev, and prod stages to isolate traffic.
SAM TemplatesRepeatabilityUse sam deploy with different --parameter-overrides for Dev vs. Test.
Test EventsSimulationStore standard JSON payloads in a tests/ directory for local and cloud testing.

Hierarchical Outline

  1. Environment Isolation Strategies
    • Lambda Versioning: Immutable snapshots of code.
    • Lambda Aliases: Mutable pointers for canary deployments.
    • API Gateway Stages: Distinct URL endpoints for different lifecycle phases.
  2. Infrastructure as Code (IaC)
    • AWS SAM: Extension of CloudFormation for serverless; uses template.yaml.
    • Deployment Actions: Committing code triggers build and test in AWS CodePipeline.
  3. Test Event Generation
    • JSON Payloads: Simulating service-to-service triggers (S3, SNS, SQS).
    • Amazon Q Developer: Using AI to generate unit tests and mock data.

Visual Anchors

Automated CI/CD Pipeline Flow

Loading Diagram...

Lambda Alias Traffic Shifting

This diagram visualizes how an Alias can distribute traffic between two versions (Canary Testing).

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Canary Deployment: A strategy where a small portion of traffic is sent to a new version to test stability.
    • Example: Deploying Lambda Version 2 and setting the "Prod" alias to send only 5% of traffic to Version 2 while monitoring for errors.
  • Integration Testing: Testing how different AWS services interact (e.g., API Gateway -> Lambda -> DynamoDB).
    • Example: Sending a JSON payload to an API Gateway stage that triggers a Lambda, then verifying the record appears in DynamoDB.
  • Mocking: Simulating a service response without calling the actual service.
    • Example: Using a local Mock API to simulate an external payment gateway during the build phase in CodeBuild.

Worked Examples

Example 1: Creating a Lambda Test Event

To test a Lambda function that processes S3 events, you must provide a JSON payload that mimics the structure S3 sends.

The Payload (s3-event.json):

json
{ "Records": [ { "s3": { "bucket": { "name": "my-test-bucket" }, "object": { "key": "test-image.jpg" } } } ] }

The Command (using AWS SAM):

bash
sam local invoke MyFunction -e s3-event.json

This allows developers to debug the function locally before deploying to AWS.

Example 2: API Gateway Stage Variables

Imagine you have two Lambda functions: MyFunc-Dev and MyFunc-Prod.

  1. Create a Stage Variable in API Gateway named lambdaAlias.
  2. Set the value to dev in the dev stage and prod in the prod stage.
  3. In the API Gateway integration request, set the Lambda ARN to: arn:aws:lambda:region:account-id:function:MyFunc:${stageVariables.lambdaAlias}

[!TIP] This allows the same API definition to point to different backends automatically based on the URL used.

Checkpoint Questions

  1. What is the primary difference between a Lambda Version and a Lambda Alias? (Answer: A version is immutable/static; an alias is a pointer that can be updated to point to different versions.)
  2. Which AWS service is best suited for orchestrating the transition of code from a repository through build, test, and deployment phases? (Answer: AWS CodePipeline.)
  3. How can you ensure that an AWS SAM template uses a specific environment's configuration (like a different DB name for testing)? (Answer: Use Template Parameters and Parameter Overrides during the sam deploy process.)
  4. If you want to perform a Blue/Green deployment on ECS, which service handles the traffic shifting? (Answer: AWS CodeDeploy.)
  5. What tool can a developer use to help write the actual test code logic more efficiently? (Answer: Amazon Q Developer.)
Hands-On Lab920 words

Lab: Automating Deployment Testing with AWS CI/CD and SAM

Automate deployment testing

Read full article

Lab: Automating Deployment Testing with AWS CI/CD and SAM

In this lab, you will learn how to automate the testing of serverless applications. You will use the AWS Serverless Application Model (SAM) to define your infrastructure and AWS CodeBuild to execute automated unit and integration tests as part of a continuous delivery pipeline.

Prerequisites

Before starting this lab, ensure you have the following:

  • An AWS Account with administrative access.
  • AWS CLI installed and configured with your credentials.
  • AWS SAM CLI installed on your local machine.
  • Basic knowledge of Python (for the Lambda function) and YAML (for configuration).
  • Git installed locally.

Learning Objectives

By the end of this lab, you will be able to:

  • Create application test events and JSON payloads for AWS Lambda.
  • Implement and deploy Infrastructure as Code (IaC) templates using AWS SAM.
  • Configure AWS CodeBuild to run automated tests during the build phase.
  • Differentiate between deployment environments (stages) in Amazon API Gateway.

Architecture Overview

The following diagram illustrates the automated testing and deployment workflow you will build:

Loading Diagram...

The Testing Lifecycle

The cost of fixing bugs increases exponentially as they move toward production. This lab focuses on catching bugs in the "Build" and "Staging" phases.

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Step-by-Step Instructions

Step 1: Initialize the SAM Project

We will start with a basic "Hello World" application using the AWS SAM CLI.

bash
sam init --name brainybee-testing-lab --runtime python3.9 --app-template hello-world --package-type Zip cd brainybee-testing-lab

[!TIP] This command creates a directory structure containing a template.yaml file (IaC) and a hello_world folder for your Lambda code.

Step 2: Create an Automated Unit Test

Navigate to the tests/unit folder. We will ensure the Lambda function returns a 200 OK status code.

bash
# Edit tests/unit/test_handler.py to include a basic assertion cat <<EOF > tests/unit/test_handler.py import json from hello_world import app def test_lambda_handler(): event = {"body": "test"} ret = app.lambda_handler(event, "") assert ret["statusCode"] == 200 assert "message" in ret["body"] EOF

Step 3: Configure the Buildspec for Testing

CodeBuild requires a buildspec.yml file to know how to run your tests. Create this file in the root directory.

bash
cat <<EOF > buildspec.yml version: 0.2 phases: install: runtime-versions: python: 3.9 commands: - pip install -r hello_world/requirements.txt - pip install pytest pre_build: commands: - echo Running unit tests... - pytest tests/unit/test_handler.py build: commands: - echo Packaging SAM application... - sam package --output-template-file packaged.yaml --s3-bucket <YOUR_S3_BUCKET_NAME> artifacts: files: - packaged.yaml EOF
Console alternative
  1. Navigate to
CodeBuild

in the AWS Console. 2. Create a

Build Project

. 3. Under

Buildspec

, select "Insert build commands" or point it to the file in your repository.

Step 4: Define Environments in SAM

Update your template.yaml to include a Stage parameter. This allows you to differentiate between dev, test, and prod stages in API Gateway.

yaml
Parameters: Stage: Type: String Default: dev Resources: HelloWorldFunction: Type: AWS::Serverless::Function Properties: CodeUri: hello_world/ Handler: app.lambda_handler Runtime: python3.9 Events: HelloWorld: Type: Api Properties: Path: /hello Method: get RestApiId: !Ref MyApi MyApi: Type: AWS::Serverless::Api Properties: StageName: !Ref Stage

Checkpoints

Checkpoint 1: Local Test Execution

Run your tests locally to ensure the logic is sound before committing to the cloud.

bash
pytest tests/unit/test_handler.py

Expected Result: 1 passed in 0.01s.

Checkpoint 2: Validate SAM Template

bash
sam validate

Expected Result: template.yaml is a valid SAM Template.

Clean-Up / Teardown

[!WARNING] Failure to delete these resources may result in unexpected charges to your AWS account.

  1. Delete the SAM Stack:
    bash
    sam delete --stack-name brainybee-testing-lab
  2. Delete the S3 Bucket (if created for artifacts):
    bash
    aws s3 rb s3://<YOUR_S3_BUCKET_NAME> --force
  3. Delete CodeBuild/CodePipeline projects via the console or CLI if you created them manually.

Troubleshooting

ErrorPossible CauseFix
sam package failsMissing S3 bucket or permissionsEnsure bucket exists and CLI has s3:PutObject permissions
pytest not foundBuildspec install phase failedCheck python version and pip installation steps in buildspec.yml
Deployment failsIAM role for CloudFormation lacks permissionsEnsure the execution role has permissions to create Lambda and API Gateway

Stretch Challenge

Implement a Lambda Alias for Traffic Shifting: Modify your template.yaml to include an AutoPublishAlias: live and a DeploymentPreference type like Canary10Percent5Minutes. This automates the "test in production" phase by slowly shifting traffic and rolling back if CloudWatch Alarms trigger.

Cost Estimate

ServiceEstimated Cost (Free Tier)Estimated Cost (Beyond Free Tier)
AWS LambdaFirst 1M requests free$0.20 per 1M requests
AWS CodeBuild100 build minutes/mo free~$0.005 per minute
Amazon S35GB Standard storage free$0.023 per GB
Total$0.00< $0.10 for this lab

Concept Review

ConceptDescriptionReal-World Example
Unit TestTesting a single function in isolation.Mocking a DB call to see if your Lambda processes the JSON correctly.
Integration TestTesting the interaction between services.Deploying to a staging endpoint and sending a real HTTP request to verify API Gateway + Lambda.
SAM TemplateAn extension of CloudFormation for serverless.Defining your entire backend (API, DB, Auth) in one 100-line YAML file.
BuildspecInstructions for the build server.Compiling code and running npm test before deployment.
Study Guide1,150 words

AWS CloudFront: Caching Content Based on Request Headers

Cache content based on request headers

Read full article

AWS CloudFront: Caching Content Based on Request Headers

Learning Objectives

After studying this guide, you should be able to:

  • Distinguish between a Cache Policy and an Origin Request Policy.
  • Explain how including request headers in a cache key affects the Cache Hit Ratio.
  • Configure CloudFront to forward only necessary headers to the origin to optimize performance.
  • Identify the components that make up a CloudFront Cache Key.
  • Predict whether a request will result in a cache hit or miss based on header configurations.

Key Terms & Glossary

  • Cache Key: The unique identifier CloudFront uses to look up an object in its cache. It typically consists of the object URL but can be expanded to include specific headers, cookies, or query strings.
  • Cache Hit: Occurs when CloudFront finds the requested object in its edge location cache and serves it directly to the user without contacting the origin.
  • Cache Miss: Occurs when the requested object is not in the cache, requiring CloudFront to fetch it from the origin.
  • Origin Request Policy: A set of rules that determines which headers, cookies, and query strings are sent to the origin, regardless of whether they are part of the cache key.
  • Cache Policy: A configuration that defines how long items stay in the cache (TTL) and which request components are included in the cache key.
  • TTL (Time to Live): The duration for which an object remains in the cache before it is considered expired.

The "Big Idea"

The core challenge of content delivery is balancing personalization with performance. If you cache content based on every possible header (like User-Agent), you provide highly specific content but suffer from a low cache hit ratio because every unique browser version creates a new cache entry. Conversely, caching based on no headers provides the best performance (highest hit ratio) but loses the ability to vary content for different users. Mastery of this topic involves using Cache Policies to selectively include only the most critical headers in the cache key.

Formula / Concept Box

ConceptImpact on PerformanceRule of Thumb
Fewer Headers in Cache Key⬆️ Higher Cache Hit RatioInclude only headers that change the content returned.
More Headers in Cache Key⬇️ Lower Cache Hit RatioUse for highly dynamic or localized content only.
Forwarding All Headers❌ Worst PerformanceNever forward all headers unless absolutely required by the origin.
TTL Settings⏱️ Higher TTL = More HitsBalance TTL with how frequently your source content changes.

Hierarchical Outline

  • I. Understanding the Cache Key
    • The URL is the primary identifier.
    • Optional Components: Query strings, Cookies, and HTTP Headers.
    • Logic: If Request Key == Cached Key, then Hit; else Miss.
  • II. Policy Management
    • Cache Policy: Controls the "Key" and "Time" (TTL).
    • Origin Request Policy: Controls "Communication" (What the origin sees).
  • III. Header Forwarding Best Practices
    • Whitelist Approach: Forward only necessary headers (e.g., Accept-Language for translation).
    • Avoid User-Agent: Including this in the cache key creates thousands of variations for the same file.
  • IV. Performance Optimization
    • Cache Hit Ratio: The percentage of requests served from the edge.
    • Goal: Minimize variations in the cache key to maximize hits.

Visual Anchors

Request Flow Logic

Loading Diagram...

The Composition of a Cache Key

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Forwarding Headers: Sending specific HTTP headers from the viewer's request to the origin server.
    • Example: Forwarding the CloudFront-Viewer-Country header so your server can return a country-specific homepage.
  • Whitelist: A list of specific items (headers, cookies) allowed to be part of the cache key or forwarded.
    • Example: Whitelisting the Accept-Encoding header so the origin can provide Gzip or Brotli versions of a file based on browser support.
  • Path Pattern: A URL rule used to apply different cache behaviors to different parts of a site.
    • Example: Setting a path pattern of /api/* to have 0 TTL (no caching) while /images/* has a 1-year TTL.

Worked Examples

Example 1: The Impact of the User-Agent Header

Scenario: You have a website with a styles.css file. You configure CloudFront to include the User-Agent header in the cache key because you want to track browser statistics at the origin.

  • Result: Your Cache Hit Ratio drops to near 0%.
  • Why?: Because User-Agent strings are extremely diverse (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64)...). CloudFront treats a request from Chrome on Windows as a different key than Chrome on Mac, even though the styles.css file is identical for both.
  • Fix: Use an Origin Request Policy to send the User-Agent to the origin for logging, but do not include it in the Cache Policy key.

Example 2: Multilingual Support

Scenario: Your origin serves different versions of index.html based on the user's preferred language.

  • Step 1: Create a Cache Policy.
  • Step 2: Add Accept-Language to the header whitelist in the Cache Policy.
  • Outcome: CloudFront will now store separate versions of index.html for en-US, fr-FR, etc. Users requesting the same language will get a cache hit, while users with new languages will trigger a miss and a fetch from the origin.

Checkpoint Questions

  1. What is the primary difference between a Cache Policy and an Origin Request Policy?
  2. Why does including "All Headers" in a cache key lead to poor performance?
  3. If a request matches a path pattern but the resource is not in the cache, what is the sequence of events?
  4. True or False: Using the URL alone as a cache key provides the highest possible cache hit ratio.
  5. How can you ensure the origin receives a header without reducing the cache hit ratio for that resource?
Click to see answers
  1. Cache Policy defines what is used to create the Cache Key and how long it stays in cache; Origin Request Policy defines what the origin server receives regardless of the cache key.
  2. It creates too many unique versions of the same object, making it unlikely that two users will share the same cache key, thus increasing cache misses.
  3. CloudFront performs a Cache Miss; it forwards the request to the origin (applying Origin Request Policy), receives the object, stores it based on the Cache Policy, and serves it to the user.
  4. True. It minimizes the variations, meaning all users requesting that URL will share the same cached object.
  5. Add the header to the Origin Request Policy but keep it out of the Cache Policy key whitelist.
Study Guide895 words

Study Guide: Committing Code to Invoke Automated CI/CD Pipelines

Commit code to a repository to invoke build, test, and deployment actions

Read full article

Study Guide: Committing Code to Invoke Automated CI/CD Pipelines

This guide covers the technical workflow and AWS services required to automate the build, test, and deployment of applications through repository commits.

Learning Objectives

  • Explain the role of AWS EventBridge in triggering automated pipelines.
  • Identify the key AWS services involved in the CI/CD lifecycle (CodeCommit, CodeBuild, CodePipeline).
  • Describe how artifacts are secured and moved between stages using S3 and KMS.
  • Understand the security implications of cross-account IAM roles in a DevOps architecture.

Key Terms & Glossary

  • Continuous Integration (CI): The practice of merging code changes into a central repository frequently, followed by automated builds and tests.
  • Artifact: A deployable file or package (e.g., a .zip, .jar, or Docker image) generated during the build process.
  • Source Action: The first stage in an AWS CodePipeline that retrieves the code from a repository like CodeCommit or GitHub.
  • Event-Driven Architecture: A software design pattern where the flow of the program is determined by events (e.g., a git push).

The "Big Idea"

The "Big Idea" behind automated deployment is the elimination of human intervention between writing code and testing it. By using a git commit as a trigger, organizations ensure that every change is automatically validated. This reduces the "integration hell" common in large projects and allows for a rapid, reliable release cycle where the repository acts as the single source of truth.

Formula / Concept Box

Pipeline PhaseAWS ServicePrimary Action
SourceAmazon CodeCommitImport code from the repository
TriggerAmazon EventBridgeDetect repository changes and start pipeline
Build & TestAWS CodeBuildCompile code, run unit tests, create artifacts
StoreAmazon S3Securely store build outputs (artifacts)
OrchestrateAWS CodePipelineManage the flow between stages

Hierarchical Outline

  • The Commit Trigger
    • Local Workstation: Developer performs a git push to the remote.
    • AWS CodeCommit: The hosted Git repository receives the new commit.
    • EventBridge Detection: A rule identifies the Reference Created or Updated event.
  • Pipeline Orchestration
    • CodePipeline Start: Triggered by EventBridge, it pulls the source code.
    • IAM Roles: The CodePipeline Service Role assumes permissions to call other services.
  • Build and Artifact Generation
    • AWS CodeBuild: Launches a temporary environment to compile code.
    • Unit Testing: Automated tests run within the CodeBuild environment.
    • S3 Artifact Store: The output (e.g., a compiled binary) is encrypted via KMS and uploaded to S3.
  • Separation of Concerns
    • DevOps Account: Hosts the pipeline and security keys.
    • Target Accounts: (Dev/Staging/Prod) where the code is actually deployed.

Visual Anchors

CI/CD Workflow Flowchart

Loading Diagram...

Artifact Security Model

Compiling TikZ diagram…
Running TeX engine…
This may take a few seconds

Definition-Example Pairs

  • Trigger Action: The specific event that initiates a pipeline.
    • Example: Setting an EventBridge rule to monitor the master branch of a CodeCommit repo; the pipeline only runs when code is merged into that specific branch.
  • Cross-Account Access: Using IAM roles to allow a pipeline in a "DevOps" account to deploy resources into a "Production" account.
    • Example: A CodePipeline in Account A uses an IAM Role in Account B to update a Lambda function code after a successful build.
  • Unit Testing: Small-scale tests that validate individual functions of the code.
    • Example: A CodeBuild buildspec.yml file containing a command like npm test to verify logic before packaging a Node.js app.

Worked Examples

Scenario: Deploying a Lambda Function via Commit

Goal: Automate the update of an AWS Lambda function every time the code is pushed to the main branch.

  1. Preparation: Create an AWS CodeCommit repository named lambda-repo.
  2. The Trigger: Configure an Amazon EventBridge rule that listens for CodeCommit Repository State Change. Set the target as your CodePipeline ARN.
  3. The Pipeline:
    • Source Stage: Connect to lambda-repo, branch main.
    • Build Stage: Use AWS CodeBuild. The buildspec.yml will run pip install -r requirements.txt and package the folder into function.zip.
    • Deploy Stage: Use the AWS Lambda provider. Specify the function name. CodePipeline will take the function.zip from the S3 artifact store and update the Lambda code.
  4. Action: Developer runs git commit -m "Fix bug" && git push origin main.
  5. Result: Within minutes, EventBridge detects the push, starts the pipeline, CodeBuild packages the fix, and the Lambda function is updated automatically.

Checkpoint Questions

  1. Which AWS service is primarily responsible for detecting a code commit and signaling the pipeline to start?
  2. Why are artifacts stored in Amazon S3 encrypted with AWS KMS during the pipeline process?
  3. What is the benefit of keeping the CI/CD pipeline in a separate "DevOps" account rather than the production account?
  4. In which file do you typically define the commands for compiling code and running tests in AWS CodeBuild?

[!TIP] Always remember: CodePipeline does not "store" your code; it "orchestrates" its movement. The actual files live in the Source (CodeCommit) and the Artifact Store (S3).

[!WARNING] If your pipeline fails at the Source stage, check the IAM Service Role for CodePipeline. It must have s3:PutObject permissions for the artifact bucket and codecommit:GetBranch for the repository.

More Study Notes (121)

Mastering Application Health Checks and Readiness Probes

Configure application health checks and readiness probes

985 words

AWS Deployment Strategies: Blue/Green, Canary, and Rolling Releases

Configure deployment strategies (for example, blue/green, canary, rolling) for application releases

945 words

AWS Lambda: Configuration, Parameters, and Performance Tuning

Configure Lambda functions by defining environment variables and parameters (for example, memory, concurrency, timeout, runtime, handler, layers, extensions, triggers, destinations)

870 words

AWS Study Guide: Configuring Programmatic Access

Configure programmatic access to AWS

820 words

AWS Environment Management and Versioned Integration Testing

Create application environments that use approved versions for integration testing (for example, Lambda aliases, container image tags, AWS Amplify branches, AWS Copilot environments)

890 words

AWS Certified Developer: Creating Application Test Events and JSON Payloads

Create application test events (for example, JSON payloads for testing AWS Lambda, API Gateway, AWS SAM resources)

915 words

DVA-C02 Study Guide: Creating and Maintaining APIs

Create, extend, and maintain APIs (for example, response/request transformations, enforcing validation rules, overriding status codes)

820 words

Building Resilient and Fault-Tolerant Applications

Create fault-tolerant and resilient applications in a programming language (for example, Java, C#, Python, JavaScript, TypeScript, Go)

885 words

AWS DVA-C02 Study Guide: Debugging and Identifying Defects

Debug code to identify defects

925 words

Mastering Service Integration Debugging

Debug service integration issues in applications

850 words

Amazon DynamoDB: Master Keys and Indexing

Define Amazon DynamoDB keys and indexing

862 words

AWS Lambda Concurrency: Optimization and Scaling Guide

Define concurrency

645 words

Study Guide: Encryption at Rest and In Transit

Define encryption at rest and in transit

925 words

Mastering IAM Permissions for AWS Principals

Define permissions for IAM principals

925 words

AWS Deployment Strategies: Master Guide for DVA-C02

Deploy an application version by using deployment strategies

845 words

Mastering API Deployment and Environment Management

Deploy API resources to various environments

925 words

Deploying Application Stack Updates to AWS Environments

Deploy application stack updates to existing environments (for example, deploying an AWS SAM template to a different staging environment)

820 words

Lab: Automating Application Delivery with AWS CI/CD Pipelines

Deploy code by using AWS Continuous Integration and Continuous Delivery (CI/CD) services

945 words

Mastering AWS CI/CD: Continuous Integration and Continuous Delivery for Developers

Deploy code by using AWS Continuous Integration and Continuous Delivery (CI/CD) services

945 words

AWS API Gateway: Stages, Variables, and Custom Domains

Describe API Gateway stages and custom domains

875 words

Mastering AWS Architectural Patterns: From Monoliths to Event-Driven Design

Describe architectural patterns (for example, event-driven, microservices, monolithic, choreography, orchestration, fanout)

1,350 words

AWS Certificate Management: ACM and Private CA

Describe certificate management (for example, AWS Private CA)

825 words

AWS Database Consistency Models: S3 and DynamoDB

Describe database consistency models (for example, strongly consistent, eventually consistent)

820 words

Data Classification & Sensitive Data Management

Describe data classification (for example, personally identifiable information [PII], protected health information [PHI])

920 words

AWS S3 Encryption: Client-Side vs. Server-Side Comparison Guide

Describe differences between client-side encryption and server-side encryption

890 words

Mastering Observability: Logging, Monitoring, and Tracing

Describe differences between logging, monitoring, and observability

850 words

DynamoDB Data Retrieval: Query vs. Scan

Describe differences between query and scan operations

875 words

AWS Architectural Patterns: Stateful vs. Stateless Concepts

Describe differences between stateful and stateless concepts

1,185 words

Architectural Patterns: Synchronous vs. Asynchronous Communication

Describe differences between synchronous and asynchronous patterns

875 words

Architectural Coupling in AWS: Tightly Coupled vs. Loosely Coupled Systems

Describe differences between tightly coupled and loosely coupled components

925 words

High-Cardinality Partition Keys and Balanced Partition Access in DynamoDB

Describe high-cardinality partition keys for balanced partition access

820 words

AWS Lambda Deployment Packaging Options

Describe Lambda deployment packaging options

850 words

AWS Lambda: Mastering Private VPC Resource Access

Describe the access of private resources in VPCs from Lambda code

925 words

Optimizing Application Resource Allocation

Determine minimum memory and compute power for an application

820 words

Lab: Building a Resilient Order Processor with AWS SDK and SQS

Develop code for applications hosted on AWS

920 words

Mastering Application Development on AWS: DVA-C02 Study Guide

Develop code for applications hosted on AWS

945 words

AWS Certified Developer Associate: Developing Code for AWS Lambda

Develop code for AWS Lambda

875 words

Mastering AWS Lambda: Development, Configuration, and Integration

Develop code for AWS Lambda

925 words

AWS KMS: Enabling and Disabling Key Rotation

Enable and disable key rotation

820 words

DVA-C02 Study Guide: Encrypting Sensitive Environment Variables

Encrypt environment variables that contain sensitive data

820 words

Study Guide: Generating Certificates and SSH Keys for Development

Generate certificates and SSH keys for development purposes

895 words

Cross-Service Authentication in AWS Microservices

Handle cross-service authentication in microservice architectures

850 words

Study Guide: Handling Streaming Data with AWS Services

Handle streaming data using AWS services

945 words

AWS Lambda: Event Lifecycle & Error Handling Guide

Handle the event lifecycle and errors by using code (for example, Lambda Destinations, dead-letter queues)

820 words

Mastering Infrastructure as Code (IaC): AWS CloudFormation & SAM

Implement and deploy infrastructure as code (IaC) templates (for example, AWS SAM templates, AWS CloudFormation templates)

845 words

AWS Observability: Implementing Effective Logging Strategies

Implement an effective logging strategy to record application behavior and state

912 words

Application-Level Authorization and Fine-Grained Access Control

Implement application-level authorization for fine-grained access control

820 words

Mastering Application-Level Caching in AWS

Implement application-level caching to improve performance

845 words

Application-Level Data Masking and Sanitization for AWS Developers

Implement application-level data masking and sanitization

850 words

Mastering Authentication & Authorization in AWS: Developer's Study Guide

Implement authentication and/or authorization for applications and AWS services

1,085 words

Secure User Authentication with Amazon Cognito User Pools

Implement authentication and/or authorization for applications and AWS services

845 words

Implementing Custom Metrics in AWS Applications

Implement code that emits custom metrics

845 words

Implementing Custom Metrics with Amazon CloudWatch Embedded Metric Format (EMF)

Implement custom metrics (for example, Amazon CloudWatch embedded metric format [EMF])

875 words

Data Access Patterns for Multi-Tenant Applications

Implement data access patterns for multi-tenant applications

842 words

AWS Security Lab: Implementing Encryption with KMS and Amazon S3

Implement encryption by using AWS services

1,150 words

Mastering AWS Encryption: KMS and S3 Security Patterns

Implement encryption by using AWS services

845 words

AWS Developer Associate: Implementing Notification Alerts

Implement notification alerts for specific actions (for example, notifications about quota limits or deployment completions)

940 words

Resilient Application Design: Retries, Circuit Breakers, and Error Handling

Implement resilient application code for third-party service integrations (for example, retry logic, circuit breakers, error handling patterns)

880 words

Mastering Structured Logging for AWS Observability

Implement structured logging for application events and user actions

925 words

AWS Certified Developer - Associate: Implementing Tracing & Observability

Implement tracing by using AWS services and tools

1,150 words

AWS DVA-C02: Instrumenting Code for Observability

Instrument code for observability

1,120 words

Lab: Instrumenting Serverless Applications for Full-Stack Observability

Instrument code for observability

920 words

AWS Lambda: Integration and Architectural Patterns

Integrate Lambda functions with AWS services

925 words

AWS Observability: Interpreting Metrics, Logs, and Traces

Interpret application metrics, logs, and traces

1,050 words

Study Guide: Making Authenticated Calls to AWS Services

Make authenticated calls to AWS services

890 words

Study Guide: Managing Application Environments in AWS

Manage application environments by using AWS services

875 words

Mastering Amazon S3 Data Lifecycles

Manage data lifecycles

860 words

AWS Environment Management: API Gateway and Lambda

Manage environments in individual AWS services (for example, differentiating between development, test, and production in API Gateway)

820 words

Mastering Sensitive Data Management in AWS Applications

Manage sensitive data in application code

870 words

Securely Managing Application Secrets with AWS Secrets Manager

Manage sensitive data in application code

875 words

DVA-C02 Study Guide: Managing Code Module Dependencies

Manage the dependencies of the code module (for example, environment variables, configuration files, container images) within the package

845 words

Study Guide: Optimizing Application Resource Usage (AWS DVA-C02)

Optimize application resource usage

1,140 words

Lab: Optimizing Content Delivery with Amazon CloudFront and S3

Optimize applications by using AWS services and features

945 words

Optimizing AWS Applications: Performance, Scalability, and Efficiency

Optimize applications by using AWS services and features

890 words

Study Guide: Organizing Files and Directory Structures for AWS Deployment

Organize files and a directory structure for application deployment

820 words

Mastering Application Rollbacks and Deployment Strategies (AWS DVA-C02)

Perform application rollbacks by using existing deployment strategies

945 words

Lab: Preparing Application Artifacts for AWS Deployment

Prepare application artifacts to be deployed to AWS

845 words

Mastering Artifact Preparation for AWS Deployment

Prepare application artifacts to be deployed to AWS

845 words

Mastering Environment-Specific Application Configurations in AWS

Prepare application configurations for specific environments (for example, by using AWS AppConfig)

820 words

AWS Performance Profiling & Optimization: DVA-C02 Study Guide

Profile application performance

1,054 words

Mastering AWS Log Querying: Insights and Troubleshooting for DVA-C02

Query logs to find relevant data

845 words

AWS Monitoring & Observability: Reviewing Application Health

Review application health by using dashboards and insights

850 words

Mastering Data Sanitization and Masking in AWS Applications

Sanitize sensitive data

865 words

Securing Applications with Bearer Tokens (AWS DVA-C02)

Secure applications by using bearer tokens

845 words

Mastering Data Serialization and Deserialization for AWS Persistence

Serialize and deserialize data to provide persistence to a data store

985 words

Testing Applications with Amazon API Gateway Endpoints

Test applications by using development endpoints (for example, configuring stages in Amazon API Gateway)

915 words

Lab: Testing Serverless Applications in AWS Development Environments

Test applications in development environments

720 words

Testing Applications in AWS Development Environments: A Study Guide

Test applications in development environments

845 words

Study Guide: Testing Deployed Code and Environments in AWS

Test deployed code by using AWS services and tools

875 words

Mastering the Testing of Event-Driven Applications on AWS

Test event-driven applications

875 words

Troubleshooting AWS Deployment Failures via Service Logs

Troubleshoot deployment failures by using service output logs

1,004 words

AWS Lambda Performance Tuning & Optimization Guide

Tune Lambda functions for optimal performance

925 words

Unit 1: Development with AWS Services – Study Guide

Unit 1: Development with AWS Services

875 words

DVA-C02 Unit 2: Comprehensive Security Study Guide

Unit 2: Security

920 words

AWS Certified Developer: Unit 3 - Deployment Strategies and CI/CD

Unit 3: Deployment

925 words

AWS Developer Associate: Troubleshooting and Optimization Study Guide

Unit 4: Troubleshooting and Optimization

945 words

Updating Infrastructure as Code (IaC) Templates: AWS SAM & CloudFormation

Update existing IaC templates (for example, AWS SAM templates, CloudFormation templates)

875 words

Mastering Event-Driven Patterns with Amazon EventBridge

Use Amazon EventBridge to implement event-driven patterns

925 words

Mastering Amazon Q Developer for AWS Development

Use Amazon Q Developer to assist with development

865 words

DVA-C02 Study Guide: Automated Testing with Amazon Q Developer

Use Amazon Q Developer to generate automated tests

820 words

Mastering Identity Federation: Amazon Cognito and IAM

Use an identity provider to implement federated access (for example, Amazon Cognito, IAM)

890 words

Identifying Performance Bottlenecks with Application Logs

Use application logs to identify performance bottlenecks

865 words

Code Repositories and Deployment Environments: A DVA-C02 Study Guide

Use code repositories in deployment environments

820 words

AWS Data Caching Services: ElastiCache and CloudFront

Use data caching services

820 words

DVA-C02 Study Guide: Use Data Stores in Application Development

Use data stores in application development

1,145 words

Lab: Building a Scalable Data Store with Amazon DynamoDB and S3

Use data stores in application development

880 words

AWS KMS: Cross-Account Encryption & Key Management

Use encryption across account boundaries

925 words

AWS KMS and Data Encryption: Mastering Keys and Decryption

Use encryption keys to encrypt or decrypt data

820 words

Dynamic Deployments with API Gateway Stage Variables and Lambda Aliases

Use existing runtime configurations to create dynamic deployments (for example, using staging variables from API Gateway in Lambda functions)

875 words

AWS Version and Release Management: Labels, Branches, and Aliases

Use labels and branches for version and release management

945 words

AWS Lambda: Real-Time Data Processing & Transformation

Use Lambda functions to process and transform data in near real time

890 words

Study Guide: Managing and Maintaining AWS Data Stores

Use, manage, and maintain data stores

875 words

Orchestrating Multi-Environment Deployments with AWS CodePipeline

Use orchestrated workflows to deploy code to different environments

864 words

AWS Secrets Manager: Securing Sensitive Data

Use secret management services to secure sensitive data

945 words

AWS Specialized Data Stores & Access Patterns

Use specialized data stores based on access patterns (for example, Amazon OpenSearch Service)

925 words

Optimizing Messaging with Amazon SNS Subscription Filter Policies

Use subscription filter policies to optimize messaging

850 words

AWS Developer Guide: Writing and Running Test Code

Write and run test code by using AWS services and tools

860 words

Mastering Unit Testing in AWS Development Environments

Write and run unit tests in development environments (for example, using AWS SAM)

945 words

Interacting with AWS Services: APIs and SDKs Study Guide

Write code that interacts with AWS services by using APIs and AWS SDKs

920 words

DVA-C02 Study Guide: Writing Code for Messaging Services

Write code to use messaging services

890 words

DVA-C02 Study Guide: Integration Testing & API Mocking

Write integration tests and mock APIs for external dependencies

865 words

Ready to practice? Jump straight in — no sign-up needed.

Take practice tests, review flashcards, and read study notes right now.

Take a Practice Test

AWS Certified Developer - Associate (DVA-C02) Practice Questions

Try 15 sample questions from a bank of 570. Answers and detailed explanations included.

Q1medium

A developer is using AWS Lambda to process records from an Amazon Kinesis Data Stream in real-time. To improve processing throughput without increasing the number of shards in the stream, the developer considers adjusting the Parallelization Factor. Which of the following best explains how this setting affects the pipeline?

A.

It increases the number of shards in the Kinesis stream to distribute the load across more Lambda functions.

B.

It allows multiple Lambda functions to process different batches of records from the same shard concurrently.

C.

It increases the maximum BatchSize beyond $10,000 records to maximize the work done per invocation.

D.

It ensures that the Lambda function has provisioned capacity to avoid cold starts during peak traffic.

Show answer & explanation

Correct Answer: B

Normally, AWS Lambda processes one Kinesis shard using a single concurrent execution to maintain the order of records. However, if the processing is not limited by the shard's throughput but by the function's execution time, the Parallelization Factor can be increased (up to 10). This allows Lambda to invoke multiple concurrent executions per shard, where each execution handles a different subset of the shard's data. This increases concurrency and throughput without needing to split shards. Answer: B

Q2medium

A developer is building a REST API using Amazon API Gateway with an HTTP custom integration (non-proxy). The backend service currently returns an HTTP 200 OK status code for all requests, even if the response body contains an error message such as {"error": "UserNotFound"}. The developer wants the API to return an HTTP 404 Not Found status code to the client instead.

Which configuration step in API Gateway allows the developer to override the status code based on a value in the response body?

A.

Configure an Integration Response with a Selection Pattern that matches the error string and map it to a 404 Method Response.

B.

Enable Request Validation on the Method Request to inspect the response body and rewrite the status line.

C.

Create an Integration Request mapping template to add a conditional header that the backend service will use to change its output.

D.

Switch the integration to HTTP Proxy and use a Lambda Authorizer to transform the response status code before it is sent to the client.

Show answer & explanation

Correct Answer: A

In an API Gateway non-proxy (custom) integration, the transformation of a backend response into a client-facing response occurs in the Integration Response section. By defining a Selection Pattern (using regex), API Gateway can scan the backend's status code or response body. If the pattern (e.g., .*UserNotFound.*) matches, the response is routed to the specific HTTP status code defined in the Method Response (in this case, 404). Answer: A

Q3hard

A developer is performing a production readiness review for a REST API hosted on Amazon API Gateway. The API currently has a stage named prod with the following configuration:

  • Stage Variable: env_alias is set to $LATEST.
  • Throttling: Uses account-level defaults ($10,000 requests per second and a burst of $5,000).
  • Caching: Disabled.
  • Logging: CloudWatch Logs set to "Errors only"; CloudWatch Metrics disabled.

Which set of modifications should the developer implement to provide the most comprehensive improvement for production-grade resilience, performance, and observability?

A.

Set env_alias to a published Lambda version (e.g., v1); enable API caching with a 300-second TTL; enable Full Request/Response logging and CloudWatch Metrics; and implement stage-level throttling limits based on backend capacity.

B.

Retain env_alias as $LATEST to allow for rapid bug fixes; enable API caching; enable Full Request/Response logging; and request an increase in account-level throttling limits to $20,000 requests per second.

C.

Set env_alias to a stable Lambda alias; enable API caching with a 0-second TTL to ensure data freshness; keep logging set to "Errors only" to minimize CloudWatch costs; and implement a Web Application Firewall (WAF).

D.

Set env_alias to a published Lambda version; enable stage-level throttling limits; and enable CloudWatch Metrics, while keeping Caching disabled to prevent stale data issues during high-traffic events.

Show answer & explanation

Correct Answer: A

To ensure production readiness, several best practices must be applied:

  1. Resilience: Pointing to a stable Lambda version or alias (e.g., v1) instead of $LATEST prevents accidental deployments of breaking changes to production.
  2. Performance: Enabling caching (with a TTL like 300 seconds) reduces the load on backend services and improves latency.
  3. Protection: Implementing stage-level throttling prevents one stage from consuming the entire account's limit and protects the backend from spikes.
  4. Observability: Full access logging and CloudWatch Metrics are essential for root cause analysis and monitoring production health. Answer: A
Q4hard

A developer is utilizing the AWS Lambda Power Tuning state machine to optimize a compute-intensive image processing function. The analysis produces the following data regarding execution time and cost per 1 million invocations across different memory configurations:

Memory (MB)Execution Time (ms)Estimated Cost (per 1M)
512$1,100$9.17
1024550$9.17
1536380$9.50
2048350$11.67

The project requirement specifies a speed-oriented strategy that allows for a maximum cost increase of 15% over the absolute minimum cost observed during tuning. Based on the results, which memory configuration should be selected to achieve the lowest possible latency within this budget?

A.

1024 MB

B.

1536 MB

C.

2048 MB

D.

512 MB

Show answer & explanation

Correct Answer: B

To identify the optimal configuration based on the provided constraints, follow these steps:

  1. Identify the minimum cost: The minimum cost observed is $9.17 (at both 512 MB and 1024 MB).
  2. Calculate the cost threshold: The requirement allows a 15% increase over the minimum cost: $9.$17 \times 1.15 = 10.5455$$. Thus, any configuration costing more than $10.55 per 1 million invocations is disqualified.
  3. Evaluate candidates:
    • 512 MB: Cost is $9.17 (Pass). Execution time is $1,100 ms.
    • 1024 MB: Cost is $9.17 (Pass). Execution time is 550 ms.
    • 1536 MB: Cost is $9.50 (Pass). Execution time is 380 ms.
    • 2048 MB: Cost is $11.67 (Fail - exceeds the $10.55 limit).
  4. Select for Performance: Among the passing configurations (512, 1024, and 1536 MB), the 1536 MB configuration provides the lowest latency at 380 ms.

This configuration represents the best 'Power Tuning' choice for a performance-focused strategy within the specified budget constraint. Answer: B

Q5medium

A developer is building an event-driven application using AWS Lambda that is triggered by events from Amazon EventBridge. To verify that the function correctly parses the event structure and handles specific business logic before deploying to the cloud, which action should the developer take in a local development environment?

A.

Deploy the function to a temporary AWS account and monitor the results in AWS X-Ray.

B.

Generate sample JSON event payloads that mirror the EventBridge schema and use the AWS SAM CLI to invoke the function with these payloads.

C.

Configure the Lambda function to use a hardcoded static event variable within the production code temporarily for testing.

D.

Manually trigger the EventBridge rule in the AWS Management Console and check the function's execution results in the 'Test' tab.

Show answer & explanation

Correct Answer: B

Testing event-driven applications effectively requires the use of sample test events that simulate the payloads sent by triggers like EventBridge. By generating JSON payloads and using tools like the AWS SAM CLI to invoke functions locally, developers can validate event parsing and business logic in isolation before deployment. This approach is more efficient than deploying for every test and more reliable than hardcoding test data. Answer: B

Q6easy

In Amazon API Gateway, what is the primary function of stage variables?

A.

To provide encrypted storage for sensitive database credentials and API keys.

B.

To act as key-value pairs that enable dynamic configuration and routing for different API deployment environments.

C.

To define the throttling limits and quota settings for specific API consumers using usage plans.

D.

To automatically generate documentation and SDKs for the API based on the stage deployment.

Show answer & explanation

Correct Answer: B

Stage variables are key-value pairs associated with a specific deployment stage in API Gateway. They act similarly to environment variables, allowing developers to dynamically change backend settings—such as Lambda function ARNs or HTTP endpoints—without modifying the API definition itself. They are accessed using the syntax ${stageVariables.variableName}. Answer: B

Q7hard

A healthcare data analytics firm maintains two separate databases for its research operations. Database A is classified as "Public" and contains anonymized patient records including ZIP codes, ages, and specific medical diagnoses. Database B is classified as "Confidential" and contains patient names, home addresses, and ZIP codes used for billing purposes.

Analyze the impact of this classification strategy. Which of the following best describes the most significant security and privacy risk associated with the "Public" classification of Database A when considering the combined data environment?

A.

Database A is misclassified because the inclusion of quasi-identifiers like ZIP codes and ages allows for a "linkage attack," which can re-identify individuals when the datasets are combined.

B.

The "Public" classification of Database A is appropriate under HIPAA guidelines because medical diagnoses are only considered Protected Health Information (PHI) when stored with a Social Security Number.

C.

The primary risk is a violation of the "Separation of Duties" principle, as the same database administrator might have access to both the public and confidential datasets.

D.

The classification strategy is sound because the logical separation of databases prevents any cross-contamination of data sensitivity levels, effectively mitigating the risk of PII exposure.

Show answer & explanation

Correct Answer: A

Data sensitivity analysis must account for the risk of re-identification through data aggregation or inference. While Database A might appear anonymous in isolation, quasi-identifiers such as ZIP code and age are often sufficient to link records to a secondary dataset (Database B) that contains direct identifiers like names. This 'linkage attack' results in the unauthorized disclosure of high-sensitivity PII and PHI. Effective classification impact analysis requires evaluating data not just in silos, but in the context of the entire data ecosystem. Answer: A

Q8medium

A developer is organizing a project's directory structure for an application to be built and deployed via an AWS CI/CD pipeline using AWS CodeBuild and AWS CodeDeploy. The source repository contains a src/ directory, a tests/ directory, and a public/ directory for static assets. Which of the following best explains how to manage the build artifacts and project structure to ensure a lean and functional deployment package?

A.

Define an artifacts section in the buildspec.yml file and use the base-directory property to specify the build output folder (e.g., dist/); ensure that the appspec.yml file is also present in that output directory so it resides at the root of the final deployment artifact.

B.

List all directories (src/, tests/, and public/) in the artifacts section and apply a discard-paths: yes directive to flatten the structure, allowing the deployment agent to easily locate configuration files like appspec.yml.

C.

Upload the static assets to an Amazon S3 bucket during the pre_build phase and configure the buildspec.yml to package only the src/ folder, as AWS CodeDeploy automatically merges external S3 content into the deployment root.

D.

Store all production files and configuration scripts in the project root and move unit tests to a hidden folder (e.g., .tests/), because AWS CodeBuild automatically excludes hidden directories from the generated deployment artifact.

Show answer & explanation

Correct Answer: A

To ensure a lean deployment package, it is standard practice to separate source code and tests from the production-ready build output. In AWS CodeBuild, using the base-directory property in the artifacts block of the buildspec.yml file allows the developer to package only the contents of the build folder (e.g., dist/ or build/), effectively stripping the folder prefix from the artifact path. For the deployment to succeed with AWS CodeDeploy, the appspec.yml file must be located at the root of this final artifact, meaning it should be moved or copied into the build output directory during the build process. Answer: A

Q9hard

An image-processing application deployed on Amazon ECS using the Fargate launch type is configured with $0.5 vCPU and 1 GB of memory. During high-load testing, the following behavior is observed: 1) CPUUtilization remains constant at 100%. 2) MemoryUtilization increases steadily from 25% to 98% over a period of 15 minutes. 3) The task terminates with ExitCode: 137 and the service event log indicates an 'OutOfMemory' error. 4) The application uses an internal in-memory buffer to store incoming images before processing them. Based on these observations, which analysis of the resource requirements and subsequent action is most appropriate?

A.

The application is encountering CPU throttling, which prevents it from processing the incoming buffer fast enough, leading to an accumulation of data in memory and a subsequent OOM crash. Increase the cpu allocation in the task definition.

B.

The application has a memory leak in its image processing library that is unrelated to the CPU usage. Increase the memory allocation and implement a scheduled task restart policy to mitigate the impact of the leak.

C.

The ExitCode: 137 indicates that the ECS agent killed the container because it failed the health check for too long. Modify the healthCheck grace period and timeout values in the container definition.

D.

The task is hitting the default Fargate ephemeral storage limit while caching temporary image fragments. Increase the ephemeralStorage size in the task definition to prevent the filesystem from filling up.

Show answer & explanation

Correct Answer: A

In this scenario, the sustained 100% CPU utilization indicates that the application is compute-bound (CPU throttled). Because the application uses an in-memory buffer for incoming images, the inability of the CPU to clear this buffer at the same rate as the input results in a linear increase in memory usage until the 1 GB limit is reached. At this point, the kernel (or the Fargate runtime) sends a SIGKILL (137), resulting in an OOM error. While increasing memory would provide more space for the buffer, it does not address the underlying bottleneck; increasing the CPU allocation is the correct architectural fix to improve throughput and stabilize memory usage. Answer: A

Q10hard

An AWS Lambda function is configured to process high-resolution images uploaded to an Amazon S3 bucket. Currently, the function is assigned 512 MB of memory and takes an average of $1.2 seconds to execute. Monitoring logs indicate the function is CPU-bound. To optimize resource usage for cost-efficiency, you perform profiling and collect the data shown in the associated graph. Evaluate which memory configuration provides the most optimal usage in terms of minimizing the total cost per execution.

A.

256 MB memory with $3.0 seconds execution time

B.

512 MB memory with $1.2 seconds execution time

C.

1024 MB memory with $0.5 seconds execution time

D.

2048 MB memory with $0.4 seconds execution time

Show answer & explanation

Correct Answer: C

AWS Lambda pricing is calculated based on the product of allocated memory and execution duration, measured in GB-seconds. To determine the most cost-effective configuration, evaluate the relative cost (product of memory and time) for each option:

  • Option A: $$256 \times 3.0 = 768$$ units
  • Option B: $512 \times 1.2 = 614.4$ units
  • Option C: $$1024 \times 0.5 = 512$$ units
  • Option D: $2048 \times 0.4 = 819.2$ units \nOption C yields the lowest numerical product (512), meaning it is the most cost-efficient. In Lambda, increasing memory also increases the proportional amount of CPU power and network bandwidth. For CPU-bound tasks, the reduction in execution time often offsets the higher cost of increased memory, leading to a 'sweet spot' for both performance and cost. Answer: C
Q11easy

A performance engineer is profiling a web application and observes that the system successfully completes $1,200 transactions every minute. Which of the following performance metrics is this observation describing?

A.

Latency

B.

Throughput

C.

Resource Utilization

D.

Response Time

Show answer & explanation

Correct Answer: B

Throughput is defined as the number of units of work (such as transactions, requests, or packets) processed by a system in a given period of time. In this case, the rate of $1,200 transactions per minute measures how much work the system is finishing. Latency and Response Time instead measure the duration of a single transaction. Answer: B

Q12easy

What is the primary function of the Amazon CloudWatch Embedded Metric Format (EMF)?

A.

To automatically generate dashboards based on the resource tags of an EC2 instance

B.

To extract custom metrics from structured JSON log events in CloudWatch Logs

C.

To provide real-time tracing of distributed application requests across microservices

D.

To encrypt CloudWatch logs using a customer-managed KMS key

Show answer & explanation

Correct Answer: B

Amazon CloudWatch Embedded Metric Format (EMF) is a structured JSON specification used to instruct CloudWatch to automatically extract custom metrics from log events. This allows developers to emit metrics asynchronously by simply writing to standard output or a log file, which is highly efficient for high-concurrency environments like AWS Lambda as it avoids synchronous API calls. Answer: B

Q13easy

Which of the following best describes the primary purpose of an AWS Software Development Kit (SDK) for a developer?

A.

To provide a web-based graphical user interface (GUI) for manually configuring AWS resources.

B.

To provide language-specific libraries and tools that enable applications to programmatically interact with AWS services.

C.

To act as a physical security device for multi-factor authentication (MFA) when logging into the root account.

D.

To provide a standalone operating system optimized for running high-performance computing (HPC) workloads on-premises.

Show answer & explanation

Correct Answer: B

An AWS SDK (Software Development Kit) is a collection of libraries, code samples, and documentation designed for specific programming languages (such as Python, Java, or JavaScript). Its primary purpose is to allow developers to integrate AWS services directly into their application code, enabling them to programmatically create, manage, and interact with AWS resources like Amazon S3 or Amazon EC2 without using the manual AWS Management Console. Answer: B

Q14medium

A developer is tasked with optimizing a CPU-bound AWS Lambda function to reduce costs. The function currently has 256 MB of memory allocated and takes 60 seconds to complete a batch job. After increasing the memory to 1024 MB (1 GB), the execution time drops to 12 seconds. Assuming the cost per GB-second is constant and ignoring fixed request fees, what is the percentage reduction in the total cost per execution?

A.

15%

B.

20%

C.

25%

D.

80%

Show answer & explanation

Correct Answer: B

To optimize resource usage, we calculate the total GB-seconds consumed per request. For the initial configuration (256 MB): $0.25 GB ×60\times 60 s =15= 15 GB-seconds. For the optimized configuration (1024 MB): $1.0 GB ×12\times 12 s =12= 12 GB-seconds. The absolute reduction is $15 - 12 = 3 GB-seconds. The percentage reduction relative to the original cost is $$(\frac{3}{15}) \times 100 = 20%$. Answer: B

Q15medium

A developer is observing inconsistent latency in an AWS Lambda function that handles infrequent but critical API requests. Upon investigation, the developer identifies that 'cold starts' are the primary cause of the delays. Which of the following best explains how Provisioned Concurrency resolves this performance issue?

A.

It automatically scales the memory and CPU of the function during the initialization phase to minimize start-up time.

B.

It maintains a set number of pre-initialized execution environments, allowing the function to respond to requests immediately with consistent latency.

C.

It extends the idle timeout of the execution environment, preventing AWS from reclaiming the container for up to 12 hours.

D.

It caches the function's dependencies in the local /tmp directory across all available availability zones to speed up the environment setup.

Show answer & explanation

Correct Answer: B

A cold start occurs when AWS Lambda must initialize a new execution environment for a function that has been idle or needs to scale. Provisioned Concurrency mitigates this by keeping a specified number of environments pre-initialized and 'warm.' This ensures that when a request arrives, the function skips the initialization phase and moves directly to the execution phase, providing consistent, low-latency performance. Answer: B

These are 15 of 570 questions available. Take a practice test →

AWS Certified Developer - Associate (DVA-C02) Flashcards

450 flashcards for spaced-repetition study. Showing 30 sample cards below.

Amazon CloudWatch Embedded Metric Format (EMF)(4 cards shown)

Question

CloudWatch Embedded Metric Format (EMF)

Answer

A JSON specification used to instruct Amazon CloudWatch Logs to automatically extract metric values from log events.

[!TIP] It allows you to generate custom metrics asynchronously without making separate API calls to PutMetricData.

Key Benefits:

  • Reduced Latency: Metrics are emitted as logs, so the application doesn't block on a network request.
  • Cost Efficiency: You pay for log ingestion instead of multiple metric API calls.
  • Combined Data: Logs and metrics reside in the same record.

Question

Why is Amazon CloudWatch EMF preferred over the PutMetricData API for high-throughput AWS Lambda functions?

Answer

The primary reasons are performance and cost management:

  1. Asynchronous Execution: EMF writes metrics directly to stdout (which goes to CloudWatch Logs). The function does not wait for a synchronous response from the CloudWatch Metrics service, reducing execution time.
  2. Batching & Aggregation: CloudWatch Logs handles the extraction and aggregation in the background, minimizing the overhead on the compute resource.
  3. Connectivity: EMF works even if the resource is in a private subnet without a specific CloudWatch Metrics VPC endpoint, as long as it can reach CloudWatch Logs.
FeaturePutMetricDataEMF (via Logs)
SpeedSynchronous (Slower)Asynchronous (Faster)
CostPer API CallIncluded in Log Ingestion
ComplexityHigh (SDK overhead)Low (JSON strings)

Question

To define a custom metric using EMF, the JSON log must include a _aws root node containing a CloudWatchMetrics object, which defines the ___, ___, and ___ for the metric.

Answer

Namespace, Dimensions, and Metrics.

[!NOTE]

  • Namespace: The container for your metrics (e.g., MyCompany/PaymentService).
  • Dimensions: Name-value pairs used to categorize metrics (e.g., [["Region", "InstanceID"]]).
  • Metrics: The actual data points being tracked, including their Name and Unit.

Question

EMF Data Extraction Workflow

Answer

The following diagram illustrates how AWS processes EMF logs to produce CloudWatch Metrics:

Loading Diagram...

Example EMF JSON Structure:

json
{ "_aws": { "Timestamp": 1574109732004, "CloudWatchMetrics": [ { "Namespace": "AppPerformance", "Dimensions": [["Service"]], "Metrics": [{"Name": "Latency", "Unit": "Milliseconds"}] } ] }, "Service": "OrderProcessor", "Latency": 245 }

Amazon DynamoDB Keys and Indexing(4 cards shown)

Question

DynamoDB Partitioning Mechanism

Answer

DynamoDB uses the Partition Key value as input to an internal hash function to determine the physical storage location (partition).

Loading Diagram...

[!NOTE] Items with the same partition key are stored together and ordered by their sort key, enabling efficient queries within that partition.

Question

Composite Primary Key

Answer

A primary key composed of two attributes: a Partition Key (Hash Key) and a Sort Key (Range Key).

  • Partition Key: Determines the physical partition.
  • Sort Key: Groups items within a partition and allows for range-based queries (e.g., begins_with, between).

[!TIP] In a music database, use ArtistName as the Partition Key and SongTitle as the Sort Key to store all songs by an artist in the same partition.

Question

What are the main differences between a Global Secondary Index (GSI) and a Local Secondary Index (LSI)?

Answer

FeatureGlobal Secondary Index (GSI)Local Secondary Index (LSI)
Key StructureSeparate Partition & Sort KeySame Partition Key, Different Sort Key
Creation TimeAnytime (Post-creation)At Table Creation Only
ConsistencyEventually ConsistentStrong or Eventual Consistency
LimitsMax 20 per tableMax 5 per table
Size LimitNo limit10 GB per partition key value

[!WARNING] LSIs share the throughput (RCU/WCU) of the base table, whereas GSIs have their own provisioned throughput.

Question

In Amazon DynamoDB, the maximum size of a single item is ___, and a Local Secondary Index (LSI) is restricted to a maximum of ___ of data per partition key value.

Answer

400 KB and 10 GB

  • The 400 KB limit includes both the attribute names (UTF-8) and the attribute values.
  • The 10 GB limit applies to the "Item Collection," which is the sum of the sizes of all items in the table and its LSIs that have the same partition key.

[!TIP] If you expect to exceed 10 GB for a single partition key value, use a GSI instead of an LSI.

Amazon EventBridge & Event-Driven Patterns(4 cards shown)

Question

Amazon EventBridge Event Bus

Answer

A serverless event bus that acts as a central router for events.

It receives events from various producers (AWS services, custom apps, or SaaS) and directs them to specific targets based on matching rules.

[!NOTE] Every AWS account has a default event bus that receives events from AWS services.

Question

How do Rules and Targets interact within Amazon EventBridge?

Answer

A Rule serves as a filter that matches incoming events based on a specific event pattern. If an event matches the rule, it is routed to the defined Target.

ComponentResponsibility
RuleFilters events and can optionally transform the JSON payload.
TargetThe resource that processes the event (e.g., AWS Lambda, SNS, SQS).

[!TIP] One rule can trigger multiple targets simultaneously, facilitating a fan-out pattern.

Question

Event-driven architectures using Amazon EventBridge promote the development of ___ components, allowing services to scale and fail independently.

Answer

Loosely coupled

In this model, the Event Producer does not need to know about the Event Consumer. This decoupling enhances reliability because the producer continues to function even if a downstream consumer is unavailable.

Question

The Journey of an Event

Explain the end-to-end flow from an Event Producer to a Target using Amazon EventBridge.

Answer

The event flow follows these four primary stages:

  1. Event Producer: An application or AWS service (like S3) generates a signal that 'something happened'.
  2. Event Bus: The central hub that receives the event JSON.
  3. Rule: Evaluates the event against criteria; if matched, it may transform the data.
  4. Target: A computing service (like AWS Lambda) executes business logic in response.
Loading Diagram...

[!WARNING] Ensure that the Lambda function has the necessary resource-based policy permissions to be invoked by the EventBridge service.

Amazon Q Developer for Automated Testing(4 cards shown)

Question

Amazon Q Developer

Answer

An AI-powered conversational assistant designed to help developers throughout the software development life cycle. In the context of testing, it can automatically generate unit tests, explain complex code logic, and suggest bug fixes directly within the IDE or AWS Console.

[!NOTE] Amazon Q Developer has integrated and expanded upon many features previously associated with Amazon CodeGuru Reviewer and Profiler.

Question

How does a developer use Amazon Q to generate unit tests for a specific function within a supported IDE (like VS Code or IntelliJ)?

Answer

  1. Highlight the specific function or code block.
  2. Open the Amazon Q chat panel or use the context menu (right-click).
  3. Prompt the assistant using a command like /tests or a natural language request like "Generate unit tests for this function."
  4. Review the suggested code, iterate if necessary, and insert the test file into the project.
AdvantageDescription
EfficiencyReduces manual boilerplate creation for test suites.
Edge CasesIdentifies boundary conditions the developer might miss.
ConsistencyEnsures tests follow the syntax and style of the existing codebase.

Question

In the AWS development workflow, Amazon Q Developer assists in the "Test" phase of CI/CD by analyzing code logic to produce ___ that cover both success and failure paths.

Answer

automated tests

Amazon Q leverages generative AI to understand the intent of your code, allowing it to create comprehensive test cases including mocks for external dependencies and validation of error handling logic.

Question

Workflow: Amazon Q Test Generation Architecture

Answer

Amazon Q uses Large Language Models (LLMs) and context from your current workspace to provide tailored testing solutions.

Loading Diagram...

[!TIP] To get the best results, ensure your code has clear function signatures and comments, as Amazon Q uses this metadata to infer the expected behavior and valid input ranges for its generated tests.

Amazon Q Developer for AWS Development(4 cards shown)

Question

Amazon Q Developer

Answer

A generative AI-powered assistant designed for software development. It provides real-time code recommendations, explanations, and troubleshooting assistance within Integrated Development Environments (IDEs) and the AWS Management Console.

[!NOTE] It is a core skill (Skill 1.1.11) for the AWS Certified Developer - Associate exam to leverage this tool for development assistance.

Question

How does Amazon Q Developer assist in the software testing phase (Skill 3.3.6)?

Answer

Amazon Q Developer can be used to generate automated tests. By analyzing the existing application code, it can suggest unit tests and integration tests, reducing the manual effort required for test coverage.

BenefitDescription
EfficiencyRapidly creates boilerplate test code.
CoverageIdentifies edge cases the developer might miss.
ConsistencyEnsures tests follow established project patterns.

[!TIP] Use the chat interface to ask Amazon Q to "Write a unit test for this function" while your code file is open.

Question

According to the DVA-C02 curriculum, developers use Amazon Q Developer to assist with ___ and to generate ___ ___.

Answer

Development (or coding) and automated tests.

Amazon Q acts as an end-to-end assistant, from the initial implementation of architectural patterns to the verification of code through automation.

Question

Amazon Q Developer Workflow Integration

Answer

Amazon Q Developer integrates across the development lifecycle to provide context-aware support.

Loading Diagram...

Key Capabilities:

  • Code Explanations: Highlighting complex code blocks and asking for a summary.
  • Refactoring: Asking for more efficient ways to write a specific logic (e.g., changing a synchronous loop to an asynchronous pattern).
  • Documentation: Generating comments and docstrings automatically.

[!WARNING] Always review AI-generated code for security best practices and accuracy before deploying to production.

Analyze application performance issues(4 cards shown)

Question

Amazon CloudWatch

Answer

A monitoring and observability service that collects and analyzes operational data from AWS resources.

  • Metrics: Time-series data (CPU, Memory, custom metrics).
  • Logs: Centralized storage and analysis of application/system logs.
  • Alarms: Automated actions based on predefined thresholds.

[!TIP] Use CloudWatch for basic monitoring and setting up alerts when performance thresholds (like high latency) are breached.

Question

What is the difference between an EC2 System Status Check and an Instance Status Check?

Answer

Check TypeScopeCommon Causes of Failure
System Status CheckAWS Infrastructure/HostNetwork loss, power issues, physical host hardware failure.
Instance Status CheckSoftware/OS ConfigurationCorrupted file system, incorrect boot settings, incompatible kernel, exhausted memory.

[!NOTE] If a System Status Check fails, you usually need to stop and start the instance to move it to a new healthy host.

Question

To identify performance bottlenecks in a distributed microservices architecture, a developer should use ___ to visualize request paths and service latencies.

Answer

AWS X-Ray

AWS X-Ray provides distributed tracing, allowing developers to:

  1. Trace requests across multiple services.
  2. Create a Service Map to visualize dependencies.
  3. Identify which specific component is causing high latency or errors.
Loading Diagram...

Question

How does CloudWatch Embedded Metric Format (EMF) improve application performance analysis compared to standard custom metrics?

Answer

EMF allows applications to ingest complex, high-cardinality metrics by sending them as structured JSON logs.

Key Advantages:

  • Asynchronous Delivery: Metrics are extracted from logs by CloudWatch, reducing application latency compared to blocking API calls like PutMetricData.
  • Cost-Effective: Lowers costs for high-throughput metric ingestion.
  • Contextual Data: Logs contain the full context of the event alongside the metric.
json
{ "_aws": { "Timestamp": 1574109732004, "CloudWatchMetrics": [ { "Namespace": "MyApp", "Dimensions": [["Service"]], "Metrics": [{"Name": "ProcessingTime", "Unit": "Milliseconds"}] } ] }, "Service": "OrderProcessor", "ProcessingTime": 45, "OrderId": "12345" }

API Creation and Maintenance in AWS(4 cards shown)

Question

API Gateway Stage

Answer

A logical reference to a lifecycle state of an API (e.g., dev, prod, v1).

  • It acts as a snapshot of the API's current configuration.
  • Each stage provides a unique Invoke URL.
  • Supports Stage Variables to dynamically route traffic to different backend environments (like different Lambda aliases).

[!TIP] Use stages to implement canary deployments by shifting a percentage of traffic to a new deployment.

Question

What is the primary difference between Lambda Proxy and Lambda Custom integration regarding data transformation?

Answer

FeatureLambda Proxy (AWS_PROXY)Lambda Custom (AWS)
Data FlowPassed as-is to the Lambda function.Transformed via Mapping Templates.
ResponsibilityLambda must parse the full request and return a specific JSON structure.API Gateway handles the mapping between client and backend.
SetupSimple; requires minimal configuration.High; requires defining Method/Integration responses.

[!NOTE] Use Custom Integration when you need to enforce strict validation rules or transform payloads (e.g., XML to JSON) before they reach the backend.

Question

VTL Mapping Templates

Answer

Apache Velocity Template Language (VTL) is used in Integration Requests and Integration Responses to transform data between the client and the backend.

Use Cases:

  • Filtering: Removing sensitive data from a response before it reaches the client.
  • Transformation: Changing data formats (e.g., converting a legacy SOAP XML response to JSON).
  • Status Code Overriding: Mapping a string in the backend error (like "InvalidID") to an HTTP 400 status code.
Loading Diagram...

Question

To override a status code or map a backend error to a specific HTTP status in API Gateway, you must configure the ___.

Answer

Integration Response

In the Integration Response settings, you define a Lambda Error Regex (or selection pattern). When the backend's output matches this pattern, API Gateway maps the response to a pre-defined Method Response (like 404 or 500).

[!WARNING] If using Lambda Proxy Integration, this logic must be handled inside the Lambda code itself, as API Gateway simply passes the function's returned status code directly to the client.

API Gateway Stages and Custom Domains(2 cards shown)

Question

API Gateway Stage

Answer

A Stage is a logical reference to a lifecycle state of your API (e.g., prod, beta, dev). It represents a snapshot of the API configuration that is currently deployed and accessible to users.

[!NOTE] Each stage has its own unique Invoke URL, typically following this pattern: https://{api-id}.execute-api.{region}.amazonaws.com/{stage-name}/

Key Characteristics:

  • Independent settings for throttling and logging.
  • Can be associated with specific deployment histories.
  • Allows for versioning and environment separation.

Question

What is the primary use case for Stage Variables, and what is the syntax to access them?

Answer

Stage variables act like environment variables for API Gateway. They are used to change the behavior of an API deployment without updating the API code itself.

Common Use Cases:

  • Routing traffic to different backend Lambda functions (via Aliases).
  • Setting different HTTP endpoints for development and production.
  • Parameter mapping in templates.

Access Syntax: ${stageVariables.variableName}

[!TIP] If you have a variable named lambdaAlias, you can set your Lambda integration ARN to: arn:aws:lambda:us-east-1:123456789012:function:my-func:${stageVariables.lambdaAlias}

Showing 30 of 450 flashcards. Study all flashcards →

Ready to ace AWS Certified Developer - Associate (DVA-C02)?

Access all 570 practice questions, 9 timed mock exams, study notes, and flashcards — no sign-up required.

Start Studying — Free