DevOps Notes: ship the change you can roll back

Module 1: CI/CD pipelines

CodePipeline is the orchestrator. A source stage reads CodeCommit, GitHub, or S3. CodeBuild compiles and tests. CodeDeploy ships the revision. The pipeline role needs permission for each stage, and the build role needs permission for the secret and the artifact bucket. A failed stage stops the pipeline. It does not silently continue into production.

Module 2: Tests in the pipeline

Run the cheapest test at the earliest stage that can fail the build. Unit tests and coverage belong in CodeBuild. Integration tests call the AWS services the change touches. Security scans and acceptance tests run before the production shift. A load test belongs on a stage that can absorb it, not on the only production fleet. CodeBuild reports failure from a non-zero exit code. A green pipeline with a swallowed error is not a passing test.

CloudWatch Synthetics canaries probe a URL after the deploy. They are not a substitute for the unit test you skipped. AWS Fault Injection Simulator is the in-scope way to test a failure you planned. Do not test failover by deleting a production database.

Module 3: Artifacts

CodeArtifact stores language packages and can proxy an upstream. Amazon ECR stores the container image ECS or EKS pulls. S3 stores a generic build output, with versioning and a lifecycle rule. EC2 Image Builder produces a tested AMI or container image. Read a password at boot from Secrets Manager. An image that contains the password is a leaked credential the moment the AMI is shared.

Give the pipeline role access to the repository and no one else. An artifact without a lifecycle grows forever. An image tag that moves, such as latest, makes a rollback point at a moving target. Pin the digest or the immutable tag the pipeline just pushed.

Module 4: Deployment strategies

A mutable deploy changes the instances that are already serving traffic. An immutable deploy starts new instances or a new image and cuts over. Blue/green keeps the old copy until you move traffic, so rollback moves it back. A canary sends a small share first. CodeDeploy on EC2 needs the agent. Lambda uses aliases and weighted traffic: canary, linear, or all at once. ECS blue/green uses two target groups and a listener rule.

Elastic Beanstalk can roll, roll with an extra batch, or replace the fleet immutably. A failed rolling batch should stop and leave the old tasks in service. Application storage follows the platform: EBS for one instance, EFS for a shared Linux file system, S3 for objects the new tasks can read without a disk.

Module 5: Infrastructure as code

CloudFormation deploys a stack. The CDK and SAM synthesize CloudFormation. A change set previews the update. Drift detection catches a console edit. StackSets deploy the same stack to many accounts and Regions. Service Catalog offers an approved product so a team cannot invent a second network. CloudFormation modules and CDK constructs are how you reuse a guardrail instead of copying a template by hand.

AppConfig releases application configuration with a validator and a bake time. It is not the VPC. Systems Manager State Manager reapplies a file. Config records whether the resource still matches the rule. Extra The exam guide still names OpsWorks. Prefer State Manager unless the stem requires the Chef or Puppet product the guide lists, and confirm the current console before a lab.

Module 6: Accounts and guardrails

Organizations groups accounts. Control Tower vends an account with a baseline. An SCP is the maximum permission for a member account. It does not grant, and it does not constrain the management account the way it constrains members. A cross-account call assumes a role. Both the trust policy and the caller's identity policy must allow it.

Security Hub, GuardDuty, Config, and Detective are the findings you aggregate. A landing zone that only creates the account, and never attaches the SCP, is an empty fence. RAM shares a subnet or a Transit Gateway. The share is not the route.

Module 7: Automation at scale

Systems Manager Inventory lists the fleet. Patch Manager uses a maintenance window. State Manager returns a deleted file. Lambda plus Step Functions owns a workflow with retries and a catch. A single Lambda that times out on a thousand accounts is the wrong shape. Fan the work out, and keep a dead-letter queue for the failures.

An instance profile is how EC2 receives a role. A long-term key in user data is the pattern to remove. Config remediation can start a runbook when a rule goes noncompliant. The rule reports the drift. The runbook closes it.

Module 8: High availability

Multi-AZ is a same-Region failover. RDS Multi-AZ keeps a synchronous standby and the same endpoint. A read replica scales reads and can lag. Aurora replicas share cluster storage. DynamoDB global tables, S3 replication, and Route 53 failover are the cross-Region tools the guide names. An Application Load Balancer health check removes a bad target. It does not heal a Region.

Translate the business number first. A single NAT gateway in one Availability Zone is a single point of failure for private egress. A load balancer in one zone is the same kind of gap.

Module 9: Scaling

Scale on the metric that names the bottleneck: CPU, request count, queue depth, or a custom metric. Target tracking holds that metric near a value. ECS capacity providers and EKS autoscalers add container capacity. Fargate removes the instance you would have scaled. API Gateway and Lambda scale the request. DynamoDB on-demand absorbs a spike. RDS storage autoscaling grows the disk. It does not add a reader.

A cache such as ElastiCache or CloudFront removes repeat work. Stickiness pins a user to a bad target. Turn it off when the application is stateless. A queue decouples a slow consumer from the producer so a burst does not fail the request.

Module 10: Recovery

RPO is how much data you can lose. RTO is how long restoration may take. A nightly snapshot misses a 15-minute RPO. AWS Backup plans can copy recovery points across Regions. Elastic Disaster Recovery is the in-scope continuous replication option for servers. Test the failover. A plan you have never run is a document, not a recovery.

Module 11: Metrics and logs

A CloudWatch metric has a namespace, a name, dimensions, and a resolution. A metric filter turns a log pattern into a metric. Metric streams export metrics to Kinesis Data Firehose or S3. The CloudWatch agent publishes memory and disk. Default EC2 metrics omit them. Set log-group retention, or export to S3 and apply a lifecycle rule. A subscription filter sends a stream to Lambda, Kinesis, or OpenSearch. Logs Insights and Athena answer a question. They do not page you.

Encrypt logs with KMS. The writer needs the key. Anomaly detection alarms fit a metric that has a daily shape. A static threshold fits a limit you can name, such as ALB 5xx or an RDS queue depth. X-Ray traces a request across API Gateway, Lambda, and containers. CloudTrail is still the API caller. Config is still the resource configuration.

Module 12: Automated monitoring

EventBridge matches an event and starts a target. S3 event notifications start work when an object lands. An alarm action publishes to SNS, invokes Lambda, or recovers an EC2 instance. Route 53 and load-balancer health checks decide where traffic goes. Install the SSM agent and the CloudWatch agent in the image so the instance is visible on first boot.

Auto Scaling uses the metric you chose. A scale-out on a metric the agent never published will not happen. Config rules can remediate. Turning the rule off hides the finding.

Module 13: Incident and event response

AWS Health events, CloudTrail, and EventBridge are sources. SNS fans a notification out. SQS buffers work so a slow consumer does not drop events. Kinesis keeps an ordered stream you can replay. Step Functions owns the sequence. Systems Manager changes the fleet. Auto Scaling replaces a bad instance. Config detects the noncompliant state, and the remediation action returns it.

OpsCenter is the place you track the operational item. A chat message with no runbook is not a closed incident.

Module 14: Troubleshooting a failed release

Read the failed stage before you change production. CodeBuild logs show the test. CodeDeploy deployment events show the hook that failed. CloudFormation events show the resource that rolled back. A stack that is stuck in UPDATE_ROLLBACK_FAILED needs the cause, not another blind update. CloudWatch Synthetics tells you the URL failed after the shift. X-Ray tells you which hop was slow. ECS and EKS events tell you the task could not pull the image or failed its probe.

Rollback the traffic or the stack to the last known revision. Editing the live instance by hand creates the drift the next pipeline will fight.

Module 15: Identity at scale

Humans use IAM Identity Center or federation. Machines use roles. An instance profile delivers a role to EC2. A task role delivers it to ECS. STS AssumeRole is the cross-account call. A permissions boundary is the maximum for one principal. An SCP is the maximum for member accounts. Resource policies and identity policies both have to allow a cross-account read.

Attribute-based access uses tags, such as a project tag, so you do not create a policy per team. MFA belongs on human access. Secrets Manager rotates a database password. A static key in a repository is the finding, not the design.

Module 16: Security controls and data

Defense in depth stacks controls. A security group is stateful. A network ACL is stateless. Network Firewall and WAF sit on different paths: the firewall on the VPC, WAF on HTTP. Shield is the DDoS response. ACM serves the certificate. KMS is the managed key. CloudHSM is the dedicated module when the stem requires it. Macie finds sensitive data in S3.

Automate the control with Config, Security Hub, and Systems Manager so a new account inherits it. A public bucket or an encryption setting that drifted is a finding to close, not a dashboard decoration.

Module 17: Security monitoring

CloudTrail records the API call. Organization trails cover every account. VPC Flow Logs record accept or reject. CloudFormation drift detection shows a resource that no longer matches the template. GuardDuty finds threats such as an unusual API call. Inspector finds a vulnerable package. IAM Access Analyzer finds a resource shared outside the zone you intended. Config records the configuration timeline.

Alert on the event, then remediate. Disabling the trail hides the next call. It does not undo the one that already happened. Common threats the guide names include insecure web traffic, exposed access keys, and S3 buckets that are public or unencrypted.

Frequently asked questions