🔄 DOP-C02 — AWS Certified DevOps Engineer Professional

Exam Overview

Exam Domains

Advanced CI/CD

CodePipeline Advanced Patterns

• Manual Approval — pause pipeline; require human sign-off before prod deploy
• Cross-Account Pipeline — deploy from one account's pipeline to another account's environment
• Multi-Region Deploy — parallel deploy to multiple regions simultaneously

CodeBuild buildspec.yml

version: 0.2
env:
  parameter-store:
    DB_PASSWORD: /myapp/db-password
  secrets-manager:
    API_KEY: myapp/api-key:apiKey
phases:
  install:
    commands: [pip install -r requirements.txt]
  build:
    commands:
      - docker build -t myapp .
      - docker push $ECR_URI:latest
reports:
  pytest-reports:
    files: [reports/junit.xml]
    file-format: JUNITXML

Infrastructure as Code at Scale

CloudFormation Advanced

• StackSets — deploy to multiple accounts/regions from management account
• Nested Stacks — reusable stack modules
• Custom Resources — extend CFN with Lambda for anything not natively supported
• Hooks — pre/post-provision validation via Lambda
• Drift Detection — compare stack's actual state to expected template state

AWS CDK

from aws_cdk import Stack, aws_s3 as s3, aws_lambda as lambda_
class MyStack(Stack):
    def __init__(self, scope, id, **kwargs):
        super().__init__(scope, id, **kwargs)
        bucket = s3.Bucket(self, "MyBucket", versioned=True)
        fn = lambda_.Function(self, "MyFn",
            runtime=lambda_.Runtime.PYTHON_3_12,
            handler="index.handler",
            code=lambda_.Code.from_asset("lambda"))
        bucket.grant_read(fn)

Containers at Scale

Monitoring & Observability at Scale

Centralized Logging

Account A → CloudWatch Logs → Kinesis Firehose → S3 (Log Archive Account)
Account B → CloudWatch Logs → Kinesis Firehose ↗
Account C → CloudWatch Logs → Kinesis Firehose ↗
                                      ↓
                          OpenSearch (search/visualize)
                          Athena (SQL queries)

AWS Config for Continuous Compliance

• Config Rules — evaluate resource configs (managed or custom Lambda)
• Conformance Packs — bundle of rules for compliance standards (PCI-DSS, HIPAA)
• Remediation — auto-fix non-compliant resources via SSM Automation
• Aggregator — centralize Config data from all accounts/regions