Amazon SAP-C02: Deployment, Automation & DevOps — Study Guide
Part of the AWS Solutions Architect Professional SAP-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.
Infrastructure as Code and Environment Management
Treat infrastructure as code (IaC) as the single source of truth for environments, embedding networks, IAM, and application topology into reusable, versioned artifacts. Choose CloudFormation for strict, declarative control and deep AWS integration, and use the AWS Cloud Development Kit (CDK) when higher-level constructs and language-native abstractions improve developer productivity; always force CI to synthesize CDK into templates and store artifacts in an encrypted, versioned S3 bucket. Use CloudFormation StackSets for consistent cross-account, cross-region stack instantiation and enable drift detection combined with automated remediation via Systems Manager when drift indicates configuration entropy. Bake golden images with EC2 Image Builder or Packer and publish AMIs to accounts and Regions via automated pipelines; this supports immutable deployments and reduces post-launch configuration drift. Be deliberate with CloudFormation change sets, termination protection, and update policies to avoid inadvertent resource replacement that can cause data loss. Common traps include embedding secrets in templates, relying on lazy manual changes that break drift detection, or granting overly broad CloudFormation execution roles—restrict execution roles to least privilege and retain CloudTrail and Config history for auditability. Trade-offs are straightforward: CDK accelerates development but requires disciplined CI/CD to avoid unsynchronized runtime stacks; pure CloudFormation is more rigid but immediately auditable.
CI/CD Pipelines and Deployment Strategies
Design pipelines that separate build, test, and deploy stages and make rollback decisions automatic. AWS CodePipeline, CodeBuild, and CodeDeploy provide a fully managed path for source-to-production flows, while third‑party systems (GitHub Actions, Jenkins, GitLab) integrate with AWS services for artifact storage (S3), container registries (ECR), and deployment hooks. For runtime strategies, prefer immutable or blue/green deployments for stateful or sessionful services to eliminate in-place configuration drift; use canary deployments with traffic shifting for incremental risk reduction. For Lambda, use aliases and weighted traffic shifting with CloudWatch alarms or CodeDeploy for automated rollback. For ECS/EKS, combine deployment controllers (CodeDeploy, AWS App Mesh, or native Kubernetes strategies) with ALB target group draining and lifecycle hooks to ensure graceful shutdown. Watch out for database schema changes: design backward-compatible migrations and use feature flags (AWS AppConfig) or dark launches to decouple code rollout from schema evolution. Cost versus speed considerations are important: canaries slow rollouts but minimize blast radius, while parallel blue/green doubles infrastructure cost during the cutover window. Always bake deployment policies, health checks, and automatic rollbacks into pipelines to avoid manual intervention during incidents.
Automation, Configuration Compliance, and Observability
Operational excellence depends on automated remediation, consistent configuration, and holistic observability. AWS Systems Manager provides Parameter Store for configuration, Automation documents for runbooks, Patch Manager for baseline maintenance, and Session Manager for bastionless troubleshooting. Use EventBridge as the central event bus for decoupled automation—route CloudTrail, Config, or application events to Lambdas or Step Functions for orchestrated remediation. Enforce guardrails with AWS Config rules and a Config Aggregator to audit multiple accounts, and implement automated remediation playbooks via Systems Manager or EventBridge for noncompliant resources. For observability, instrument services with CloudWatch metrics and Logs, enable X-Ray or the AWS Distro for OpenTelemetry for distributed tracing, and centralize logs with CloudWatch Logs subscriptions or Kinesis Firehose into a centralized S3 lake and analytics stack. Common traps include unbounded log retention that balloons cost, high-cardinality custom metrics that explode metric costs, missing correlation IDs making traces useless, and not testing remediation runbooks in nonproduction. Trade-offs revolve around telemetry granularity versus ingest and storage cost; sample traces and short retention reduce costs but can obscure rare, critical failures. Design alerts and dashboards targeted to actionable signals to keep operational overhead manageable.
Performance, Stateful Services, Security and Cross‑Region Concerns
Choose stateful and storage services by access pattern, latency needs, and consistency requirements. In-memory caches provide sub-millisecond reads; ElastiCache (Redis) supports ordered sets ideal for leaderboards and provides replication, persistence, and Global Datastore for cross-region read locality. DynamoDB is excellent for high-scale, durable storage and can be paired with DAX for read acceleration, though DAX is best for cacheable, item-level access and has eventual consistency trade-offs. For file-based legacy apps, consider Amazon FSx for NetApp ONTAP or Amazon EFS with DataSync for lift-and-shift compatibility; for SMB/NFS semantics, FSx is often the lowest-risk option. Encryption and replication carry subtle traps: AWS KMS keys are regional and must be managed per Region for cross‑region S3 replication or use multi‑Region keys to simplify access patterns; be careful with key policies and cross-account grants. Lambda in VPCs suffers cold-starts due to ENI creation—mitigate with VPC endpoints, smaller package sizes, provisioned concurrency, or using Lambdas outside the VPC with RDS Proxy. Weigh cost versus resilience: Global tables and cross-region replication improve RTO/RPO at increased cost; provisioned concurrency reduces latency but increases baseline spend. Consider data durability needs, DR timelines, and per-account resource limits when choosing architectures.
Practical Problem: Use-Case Scenario
Scenario: SkyForge Games operates an existing AWS environment with production and staging accounts across two Regions. The current leaderboard is implemented in DynamoDB and served by Lambda APIs deployed through CodePipeline; players expect microsecond read latency and near-zero downtime during frequent feature releases.
Challenge: Deliver microsecond leaderboard reads while maintaining durability and building a safe, automated CI/CD pipeline that supports rapid, rollback-capable deployments across accounts and Regions.
Recommended Approach:
- Provision an ElastiCache for Redis Cluster Mode Enabled in the primary Region for the leaderboard hot-path, with replicas across AZs and Redis persistence (AOF) enabled; configure Global Datastore for read locality in the secondary Region.
- Keep DynamoDB as the source of truth; use DynamoDB Streams + Lambda (or Kinesis Data Streams) to asynchronously update Redis, ensuring eventual consistency and replayability for recovery.
- Implement a CDK-based pipeline (CDK Pipelines or CodePipeline triggered by Git) that synthesizes templates, builds artifacts into encrypted S3/ECR, and deploys infra via CloudFormation StackSets to target accounts/Regions; include automated smoke tests and approval gates.
- Deploy application changes using a canary/blue-green strategy: use weighted Lambda aliases or ALB target-group shifting with CloudWatch alarms and automatic rollback; instrument with CloudWatch, X-Ray, and synthetic canary checks.
Rationale: Use Redis for true sub-millisecond reads while retaining DynamoDB durability and replayability; CI/CD with CDK and StackSets provides consistent, auditable multi-account deployments, and traffic‑shifting plus observability enables safe iterative releases with rapid rollback.
← Cost Optimization · All domains
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →