CloudOps Notes: operate the signal you can prove

Module 1: Monitoring and logging

Domain 1 starts with the signal. CloudTrail records the API call and the principal. CloudWatch stores metrics, logs you ship, and alarms. A metric filter turns a log pattern into a metric. VPC Flow Logs record accept or reject. They do not name the API. AWS Config records configuration. It is not an audit of who called DeleteTable.

AWS Health Dashboard is the service-event feed. It is not a CPU alarm on your instance. Amazon Bedrock is in scope as a workload you monitor: CloudTrail for the API call, CloudWatch for latency. Training a model is not the operations task.

Module 2: Remediation

An alarm action publishes to SNS or starts a defined response. Systems Manager Automation runs the runbook. EventBridge matches the event and can retry a failed target into a dead-letter queue. Step Functions owns a sequence with a catch. Version 1.1 skill 1.2.1 names Kiro and AWS DevOps Agent beside CloudWatch, Lambda, Systems Manager, and CloudTrail for analyzing metrics and automating remediation. Use the tool the stem names. Do not skip the metric and invent a resize.

Suppress alarm actions during a known maintenance window with a composite alarm, instead of deleting the metric. A dead-letter queue is how you keep an EventBridge failure. Turning the rule off hides it.

Module 3: Performance and the cost lever that moved here

SOA-C02 had a separate cost domain. SOA-C03 moved that operational work into task 1.3. gp2 IOPS depend on size and burst credits. When the burst balance is zero, move to gp3, which sets IOPS apart from size, or raise capacity. io2 is for sustained high IOPS, not for cold data. sc1 and st1 are throughput HDDs and are not boot volumes.

Large distant uploads use multipart upload and S3 Transfer Acceleration. Nightly bulk copies from a file system use AWS DataSync. Lifecycle rules transition storage classes and abort incomplete multipart uploads. Amazon EFS is the shared Linux file system, and a lifecycle policy moves cold files to Infrequent Access. Amazon FSx is the other in-scope shared file family. Version 1.1 lists Amazon S3 Files with EFS and FSx. Extra Amazon FSx for OpenZFS is on the out-of-scope list. Static website hosting was removed from this exam.

RDS Performance Insights shows waits. RDS Proxy pools connections when the application opens one connection per request. A cluster placement group packs instances in one Availability Zone for low latency. It does not speed traffic across zones. AWS Compute Optimizer recommends a smaller size when the metric supports it. Extra Analyzing total cost of ownership and managing invoices are out of scope. Savings Plans and Cost Explorer are in-scope services for a stable fleet, not a billing project.

Module 5: High availability

An Application Load Balancer routes HTTP by path and host and drops targets that fail the health check. A Network Load Balancer is for TCP and UDP. RDS Multi-AZ is a synchronous standby and keeps the endpoint. A read replica scales reads and can lag. Aurora replicas share cluster storage. Aurora Serverless v2 scales capacity. Amazon Application Recovery Controller is the in-scope service for readiness checks and routing controls when a Region fails.

Multi-AZ is not a Regional disaster plan. The standby lives in the same Region.

Module 6: Backup and disaster recovery

RPO is how much data you can lose. RTO is how long restoration may take. A nightly snapshot misses a 15-minute RPO. Point-in-time restore for RDS creates a new instance. DynamoDB point-in-time recovery creates a new table. AWS Backup plans can copy recovery points across Regions. S3 versioning keeps the prior object. Turn it on before the bad overwrite. It cannot invent a version you already lost.

Module 7: Provisioning

EC2 Image Builder rebuilds and tests an AMI or container image. Do not bake a password into the image. Amazon ECR stores the image ECS or EKS pulls. Fargate runs tasks without EC2 instances you manage. CloudFormation deploys a stack. The CDK synthesizes CloudFormation. A change set previews an update. Drift detection catches a console edit. Rollback returns the last successful state. StackSets deploy the same stack to many accounts and Regions. A subnet with no free IPs fails the launch. Fix the CIDR or the address demand, not the programming language.

AWS RAM shares a subnet or a Transit Gateway. The share is not the route. You still need attachments and route tables. Skill 3.1.6 names Terraform and Git. Run a plan and keep the template in Git before you apply. Extra Designing a CI/CD pipeline from scratch is out of scope. Choosing a canary, rolling, or blue/green shift on a deployment you already have is in scope. A failed canary shifts traffic back to the previous version. A failed rolling batch should stop so the old tasks remain.

Module 8: Automation

Run Command is one invocation. State Manager reapplies a file if someone deletes it. Patch Manager uses a maintenance window. Session Manager is a shell through the agent and IAM. It does not need port 22. Access denied on a session is a policy problem, not a missing SSH key.

S3 event notifications start work when an object lands. EventBridge routes operational events. Version 1.1 adds AWS DevOps Agent to that event-driven list, beside Lambda, S3 event notifications, and EventBridge. An instance profile is how EC2 receives a role. A long-term key in user data is the pattern to remove.

Module 9: Identity and compliance

An identity policy can allow. A resource policy can allow. Cross-account access needs both. A service control policy sets a ceiling for member accounts and does not grant. It does not constrain the management account the way it constrains members. A Region deny belongs in an SCP if the call must fail. A Config rule reports drift after the resource exists. IAM Identity Center is workforce sign-in across accounts. The root user is not that path.

IAM Access Analyzer reports external access, such as a role that trusts an unknown account. The IAM policy simulator tests a policy without calling the API. aws:MultiFactorAuthPresent is the MFA condition. Trusted Advisor security findings, such as port 22 open to the world, are remediated by closing the rule and using Session Manager. Config conformance packs deploy a set of rules. Keep the recorder. Deleting it does not fix the bucket.

Extra Defining the compliance requirements is out of scope. Enforcing the requirements you were given is in scope.

Module 10: Data and infrastructure protection

Encrypt an existing EBS volume by copying an encrypted snapshot and creating a new volume. There is no in-place toggle. A KMS key policy must allow the role. An IAM allow is not enough when the key policy is silent. Automatic rotation replaces key material and keeps the key ID. ACM serves the load balancer certificate in the same Region. CloudFront certificates come from us-east-1. You cannot export the private key of a public ACM certificate. Secrets Manager rotates a database password. A SecureString parameter encrypts a value, but it is not the rotation workflow.

GuardDuty raises threat findings, including unusual API activity. Inspector finds vulnerable packages. Macie finds sensitive data in S3. Security Hub aggregates findings. Config catches configuration drift. Version 1.1 adds AWS Security Agent beside those services for reports and remediation. Isolate and patch. Do not delete the detector to make the page go quiet.

Module 11: VPC paths

A public subnet routes 0.0.0.0/0 to an internet gateway. A private subnet uses a NAT gateway for outbound IPv4 and does not give instances public addresses. An egress-only internet gateway is IPv6. Security groups are stateful and allow-only. Network ACLs are stateless, so return ephemeral ports need an allow. The S3 gateway endpoint avoids NAT charges. An interface endpoint is an ENI with a security group and an hourly charge.

Peering needs routes on both sides and non-overlapping CIDRs. It is not transitive. Transit Gateway is the hub for many VPCs. RAM can share it. The share still needs an attachment and routes. Site-to-Site VPN is the in-scope site tunnel. Client VPN is the user tunnel. Extra Direct Connect is not on the SOA-C03 in-scope list. Designing the hybrid network is out of scope. Troubleshooting the route you were given is in scope.

Module 12: DNS and content delivery

Failover routing needs a health check. Latency routing picks the lowest-latency Region. Weights are ratios: two weights of 1 split traffic in half, they are not 1 percent. Multivalue answer can return several healthy records. Resolver outbound endpoints and forwarding rules send a corporate domain to on-premises DNS. Query logging records what the VPC resolved. DNS Firewall blocks malware names.

CloudFront caches HTTP. Origin access control plus a bucket policy reads a private bucket without a public ACL. An invalidation clears a stale object before the TTL. Global Accelerator provides static anycast addresses for TCP and UDP and does not cache objects. WAF rate-limits HTTP. Shield Standard is the always-on DDoS protection at CloudFront and Route 53. Network Firewall inspects VPC traffic. A security group does not filter by domain name.

Module 13: Network troubleshooting

Check the route, then the network ACL including ephemeral ports, then both security groups, then VPC Flow Logs. Flow Logs show accept or reject and the port, not the payload. A REJECT on 443 to an interface endpoint is fixed on the endpoint security group, not by adding a public IP. If the VPN tunnel is up and the instance is still unreachable, look for a missing route to the virtual private gateway or Transit Gateway.

ELB access logs explain a 504 when flow logs already show ACCEPT: the packet arrived, and the timeout is the next question. WAF logs explain a 403 that never reached the application. CloudWatch network monitoring, named in skill 5.3.5, measures the path. It does not replace the route table. VPC Reachability Analyzer checks a configured path before you send traffic.

Frequently asked questions