Amazon DOP-C02: Systems Manager, Patching and Operational Automation — Study Guide

By Laurynas Brazys · 4 August 2026 · #amazon #dop-c02 #certification #exam-prep #study-guide

Part of the AWS DevOps Engineer Professional DOP-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.

Overview

Operational automation on AWS hinges on AWS Systems Manager, which unifies access control, configuration, patching, and remediation across EC2, on-premises servers, and edge. Surrounding services provide golden-image pipelines (EC2 Image Builder), license governance (AWS License Manager), continuous optimization (AWS Trusted Advisor and AWS Compute Optimizer), and cost controls (Savings Plans). The goal is standardized, auditable operations that are event-driven and enforceable across accounts and Regions.

Systems Manager Access, Parameters, Inventory, and Compliance

Systems Manager Session Manager provides interactive, auditable shell access to managed instances without opening inbound ports or managing SSH keys. You connect over the AWS control plane, optionally through VPC interface endpoints for private connectivity. Port forwarding enables secure access to local or remote services behind the instance:

Local port forwarding sessions route a local workstation port to a port on the target instance (for example, forward localhost:8080 to instance:8080).
Remote host port forwarding routes a local port via the instance to another private host reachable from that instance. Session Manager supports centralized audit logging of session transcripts and I/O to both Amazon S3 and Amazon CloudWatch Logs, with optional KMS encryption. API activity (StartSession, TerminateSession) is captured in AWS CloudTrail. Enforce controls via Session Manager preferences: require encryption, restrict port forwarding or clipboard, and log to both destinations.

Systems Manager Parameter Store centralizes configuration and secrets. Use SecureString parameters encrypted with a customer-managed KMS key for application secrets. Organize values into hierarchical paths (for example, /prod/payments/db/password) to enable environment and application scoping, policy scoping, and bulk operations. Parameter versioning maintains an immutable history; labels (such as current) let you point applications to a moving target without changing code. Dynamic references in CloudFormation, CodeBuild, and other services resolve parameters at deploy or runtime, preventing secret sprawl. The Standard tier provides basic throughput and 4 KB max value size; the Advanced tier supports parameter policies (expiration, rotation notifications), larger values (8 KB), and higher throughput. EventBridge rules can notify on parameter changes, and resource policies enable cross-account parameter sharing where needed.

Systems Manager Inventory and Compliance provide fleet-level visibility. Inventory (enabled via a State Manager association) collects metadata such as installed software packages, Windows roles, network adapters, and custom inventory items. Use Resource Data Sync to export to S3 for Athena/Glue analytics, and surface fleet-wide status in Systems Manager Explorer. Compliance aggregates patching and association states: you can see which instances are missing patches or have failed configuration baselines. This creates the operational data foundation required for automated remediation, audits, and license discovery.

Patch Manager and Operational Orchestration

Patch Manager standardizes OS and application patching using patch baselines, patch groups, and maintenance windows.

Patch baselines define what to approve and when. For each OS family, you can start with an AWS-provided default or build a custom baseline with:

Auto-approval rules by product/version, classification (for example, Security, Bugfix), severity, and architecture
An approval delay (for example, auto-approve security patches seven days after release)
Explicit allow lists and block lists
Patch sources/repositories (for example, add a custom yum or apt repo for in-house software) Associate a baseline with a patch group. A patch group is a set of instances identified by the Patch Group tag with a specific value (for example, Patch Group=linux-prod); the association ensures the right baseline targets the right servers. Each instance should belong to a single patch group to avoid ambiguity. Patch operations use the AWS-RunPatchBaseline document with Operation=Scan to compute compliance and Operation=Install to apply approved patches. Control concurrency, error thresholds, and reboot behavior. Use InstallOverrideList for emergency pinning of specific packages. Compliance results flow into Systems Manager Compliance, where you can alert and remediate.

Maintenance windows confine disruptive operations to safe timeframes. Define a schedule (rate/cron), duration, and cutoff to stop new tasks from starting near window end. Register targets by tags or resource groups, then register tasks with priority. Patch Manager integrates natively: register an AWS-RunPatchBaseline task for your patch groups and baselines. Concurrency and error-threshold settings on tasks prevent blast radius during failures.

Systems Manager Automation operationalizes repeatable, auditable remediation. Use built-in and custom runbooks to orchestrate pre- and post-patch activities (for example, drain from load balancer, stop app services, patch, run smoke tests, re-register), and to enforce controls via AWS Config remediation. Automation supports approvals (Change Manager), change calendars (to prevent execution during blackout periods), and cross-account/Region execution via assume-role. Tie everything together with Amazon EventBridge rules reacting to health events, config drift, or alarms to trigger targeted Automation executions for self-healing.

Golden Images with EC2 Image Builder

Immutable images reduce drift and shorten patch windows. EC2 Image Builder codifies AMI creation and distribution using pipelines, recipes, and distribution settings.

Image recipes specify the base image (for example, latest Amazon Linux 2023), components (YAML-defined build/test steps such as installing the SSM Agent, language runtimes, and security hardening), and semantic versioning. Components can be reused across recipes to enforce baseline controls.
Pipelines define the end-to-end workflow: infrastructure configuration (VPC/subnets/instance profile/security groups), build steps, test steps, and schedule (for example, weekly). Image Builder automatically applies OS patches at build time, runs tests, and fails builds that do not pass.
Distribution settings replicate and share images: publish AMIs to selected Regions, add launch permissions for accounts or AWS Organizations OUs, enforce EBS encryption (with a KMS key), and tag outputs. Image Builder can publish the latest AMI ARN into Systems Manager Parameter Store (for example, /prod/images/web/latest) so Auto Scaling groups, CodePipeline, and CloudFormation consume the current blessed image without manual updates.

This pipeline approach pairs with Patch Manager: patch the AMI frequently to minimize instance patch deltas, then use maintenance windows for smaller delta patches on long-lived servers.

Governance, Licensing, and Cost Optimization

AWS License Manager governs bring-your-own-license (BYOL) and Marketplace entitlements. Define license configurations that model vendor rules (cores, sockets, vCPUs, host affinity, and virtualization constraints), choose hard or soft enforcement, and associate configurations with AMIs, launch templates, or instances. License Manager discovers software via Systems Manager Inventory to track consumption and prevent noncompliant launches. For Marketplace products that use License Manager entitlements, you can share grants across accounts and track entitlement usage centrally with a delegated administrator.

AWS Trusted Advisor continuously evaluates your environment against best practices. Categories include cost optimization, security, fault tolerance, service limits, performance, and operational excellence. With Business or Enterprise Support, you can access the full set of checks and the AWS Support API to refresh and retrieve results programmatically. Use EventBridge integration to route check status changes to remediation workflows (for example, trigger an Automation runbook to enable S3 default encryption or remove public access on a bucket), and enable Organizational View to aggregate across accounts with scoped IAM access and notifications to the right teams.

Cost optimization is continuous and data-driven:

Right-sizing: Combine Cost Explorer rightsizing recommendations with AWS Compute Optimizer insights. Compute Optimizer analyzes instance, Auto Scaling group, EBS volume, Lambda function, and ECS on Fargate metrics to recommend optimal configurations with projected savings and performance risk. It can also flag gp2 volumes that should migrate to gp3 with tuned throughput/IOPS. Couple recommendations with maintenance windows and Automation runbooks to execute safe changes.
Savings Plans: Use Compute Savings Plans for broad coverage across EC2, Fargate, and Lambda, or EC2 Instance Savings Plans for the highest discounts in specific families/Regions. Commit $/hour for one or three years with payment options (No/Partial/All Upfront), aggregate across accounts via consolidated billing, and size commitments using historical On-Demand spend. Monitor utilization and coverage and adjust as workloads evolve. Continue to use Reserved Instances for services not covered by Savings Plans (for example, RDS, OpenSearch, Redshift, DynamoDB).
Operational enablers: Use Systems Manager Automation and Change Manager to schedule non-production stop/start, enforce instance schedules, and roll out rightsizing and gp2→gp3 transitions with approvals and guardrails. Reinforce with Trusted Advisor cost checks and budgets/alerts.

Practical Problem Scenario

Company: Airbnb

Challenge: Airbnb operates multi-account, multi-Region EC2 workloads for data processing and web services. Security demands auditable, no-SSH access; compliance mandates timely security patching from both default and custom repositories; the platform team must standardize AMIs and reduce cost without performance risk. Software vendors impose core-based licensing for certain analytics nodes. Operations wants event-driven remediation and executive visibility across accounts.

Step-by-step approach:

Enforce secure access with Systems Manager Session Manager

Configure VPC endpoints for SSM/EC2Messages and enable Session Manager logging to CloudWatch Logs and S3 with KMS encryption. Disable SSH and require Session Manager for shell access. Enable port forwarding to allow engineers to reach internal services securely during troubleshooting.
Why: Removes inbound attack surface, centralizes audit trails, and permits controlled port forwarding without VPN or bastions.

Standardize configuration and visibility with Inventory and Compliance

Create a State Manager association to enable Inventory across all instances. Configure Resource Data Sync to S3 and query with Athena. Enable Compliance for patch and association status and surface fleet health in Systems Manager Explorer.
Why: Inventory enables accurate software/patch posture and powers downstream license discovery and audits.

Define patch baselines and patch groups with custom repositories

Create custom Patch Manager baselines per OS that auto-approve security updates after seven days and add custom yum/apt repos for in-house agents. Tag instances with Patch Group=linux-web, linux-data, and windows-app. Associate baselines to each patch group.
Why: Ensures both default and custom packages are patched consistently with staged approvals across varied workloads.

Schedule patching via Maintenance Windows with Automation pre/post steps

For each patch group, register a maintenance window aligned to non-business hours. Register a high-priority Automation task that drains instances from target groups, runs AWS-RunPatchBaseline (Install) with controlled concurrency and error thresholds, reboots if required, runs smoke tests, and re-registers with the load balancer.
Why: Minimizes customer impact, enforces safe orchestration, and yields auditable execution history.

Build golden images with EC2 Image Builder and publish to Parameter Store

Create recipes that include SSM Agent, security hardening components, and application prerequisites. Pipelines build weekly, run tests, and publish AMIs to us-east-1 and eu-west-1, sharing with selected accounts via Organizations. Output the latest AMI ARNs to /prod/images/web/latest and /prod/images/data/latest in Parameter Store.
Why: Reduces drift and time-to-patch on instances; developers and deployment pipelines pull blessed images via parameters without manual ID distribution.

Govern vendor licenses with AWS License Manager

Define license configurations for analytics software using vCPU counting with hard enforcement. Associate them with the corresponding AMIs and launch templates. Enable delegated admin to track consumption across accounts using Inventory discovery data.
Why: Prevents noncompliant launches and provides provable license usage to vendors and finance.

Implement event-driven remediation and guardrails

Use AWS Config managed rules (for example, required tags, S3 encryption) with automatic remediation actions that invoke Systems Manager Automation runbooks. Add EventBridge rules for AWS Health maintenance events to trigger safe restarts via runbooks.
Why: Closes the loop from detection to correction without manual toil, keeping resources in policy.

Optimize cost with Compute Optimizer and Savings Plans, governed by change control

Enable Compute Optimizer across accounts; weekly, export right-sizing and gp2→gp3 recommendations. Use Change Manager approvals and maintenance windows to apply instance family changes and EBS volume modifications. Purchase a blended Compute Savings Plan in the payer account to cover steady-state compute across Regions; monitor utilization and adjust quarterly. Use Session Manager Automation to enforce start/stop schedules in dev/test.
Why: Data-driven optimization with controlled rollout captures savings while protecting performance and availability.

Monitor with Trusted Advisor organizationally

Enable Trusted Advisor Organizational View and EventBridge integration to notify platform and security teams on high-risk findings (for example, service limits, idle resources, open security groups). For selected checks, trigger Systems Manager Automation runbooks to remediate or open tickets.
Why: Central oversight and automated response maintain operational hygiene and prevent runaway cost or risk.

This integrated design delivers secure access, standardized patching, immutable AMIs, license compliance, automated remediation, and measurable cost optimization, all with auditable controls across Airbnb’s AWS footprint.

← Networking and Content Delivery · All domains

Practice these questions → · Timed practice on ExamRoll.io →