DOP-C02 question patterns

Native, event-driven integrations: EventBridge rules, CodeDeploy alarms, Config remediation, StackSets auto-deployment.

Anything involving an engineer logging in, a cron job on EC2 or a manual approval is less automated.

Organizations-integrated features: service-managed StackSets with auto-deploy, delegated admin with auto-enable, SCPs, Control Tower controls.

Per-account setup doesn't cover accounts created later.

Blue/green or immutable deployments with traffic shifting.

In-place and all-at-once deployments take capacity out of service.

CodeDeploy canary or linear deployment with CloudWatch alarms and automatic rollback.

The alarm halts traffic shifting and returns to the previous version without a person.

Customer managed KMS key for the artifact bucket, key and bucket policies allowing the target accounts, and a deploy role in each target account.

AWS managed keys can't be used across accounts, and the pipeline needs a role to assume in the target.

A script in the ValidateService hook of the AppSpec file.

ValidateService is the last in-place hook, and a non-zero exit fails the deployment.

CodeDeploy ECS blue/green with a test listener and an AfterAllowTestTraffic hook.

The hook runs tests against the replacement task set on the test port.

CodeArtifact with an external connection to the public registry, used by CodeBuild in a VPC.

CodeArtifact proxies and caches approved packages.

Enable caching (S3 cache, or local cache for Docker layers and source).

Cached dependencies and layers are reused between builds.

Reference Secrets Manager or Parameter Store in the buildspec env section.

Secrets aren't stored in the project or source code.

Immutable deployment (or traffic splitting).

New instances go into a temporary group; rollback just terminates them.

Read DEPLOYMENT_GROUP_NAME in a hook script.

CodeDeploy passes the deployment group name to every hook, so one bundle configures dev, staging and prod.

Redeploy with --ignore-application-stop-failures.

ApplicationStop runs the previous revision's script, so a broken old script blocks every new release.

ECS deployment circuit breaker.

It detects failing tasks and rolls the service back automatically.

Rolling with additional batch.

A new batch keeps capacity full without doubling the fleet.

container_commands with leader_only: true.

The command runs on a single instance only.

Create the EventBridge rule for the repository and branch, or finish the PENDING connection handshake.

The console creates the rule; CLI and IaC don't, and new connections need console approval.

Rely on the manual approval action's built-in timeout (up to 7 days).

When it expires the action fails and the pipeline stops.

CloudFormation change set.

Shows additions, modifications and replacements without executing them.

Stack policy denying Update:Replace on that resource (plus DeletionPolicy Retain or Snapshot).

Stack policies block specific update actions on named resources.

CreationPolicy with cfn-signal sent from user data after cfn-init finishes.

CloudFormation waits for the success signal before marking the resource complete.

cfn-hup.

It detects metadata changes and re-runs cfn-init.

CloudFormation StackSets with service-managed permissions and automatic deployment.

New accounts in the target OUs receive the stack automatically.

Fix the underlying resource, then continue update rollback, skipping resources if needed.

CloudFormation can't roll back resources that were changed outside it.

Lambda-backed custom resource.

The function runs your logic on create, update and delete and reports back.

CDK Pipelines.

It's self-mutating: it redeploys the pipeline stack before deploying the app.

Custom resource Lambda that empties the bucket on delete (or Retain the bucket).

CloudFormation can't delete a non-empty bucket.

Delete the stack and recreate it.

A stack that never finished creating can't be updated.

Systems Manager Session Manager with logging to S3 or CloudWatch Logs.

Access runs through the SSM Agent and IAM.

Patch Manager with patch groups (tags), patch baselines and maintenance windows.

Managed scanning and installation, scheduled per group.

Systems Manager State Manager association.

It re-applies the desired state on a schedule.

AWS AppConfig with a deployment strategy and CloudWatch alarm rollback.

Validated, staged configuration changes without redeploying code.

AWS Service Catalog products with a launch constraint role.

Users launch the product; the constraint role holds the permissions.

Instance profile with AmazonSSMManagedInstanceCore plus interface endpoints for ssm, ssmmessages and ec2messages.

A node needs the agent, permissions and network reach to be managed.

S3 gateway VPC endpoint plus an instance profile.

Traffic stays private and costs nothing extra.

Set aft_feature_enterprise_support = true and redeploy AFT.

AFT feature flags apply account-level options automatically.

IAM Identity Center with permission sets (and attributes for ABAC).

Central sign-in with SCIM-synced users and groups.

Auto Scaling lifecycle hook on termination, completed by a script or Lambda.

The instance waits in Terminating:Wait until the hook is completed or times out.

Increase the health check grace period.

ELB health checks started before the application was ready.

Auto Scaling warm pools, or pre-baked AMIs from Image Builder.

Pre-initialised instances join quickly.

Auto Scaling instance refresh with a minimum healthy percentage and auto rollback.

Rolling replacement with health checks and checkpoints.

Aurora Global Database.

Storage-level replication and managed cross-Region failover.

AWS Fault Injection Service experiments with stop conditions.

Controlled failure injection with alarms to stop the test.

Set the health check type to ELB.

EC2 checks only notice dead instances, not failing applications.

Provisioned concurrency scaled by Application Auto Scaling.

Pre-initialised environments, scaled on a schedule or target.

Watch ApproximateAgeOfOldestMessage and raise consumer concurrency or scale on backlog per instance.

Consumers can't keep up with producers.

Raise the auto scaling maximum WCU, or switch to on-demand.

The policy's maximum caps how far it can scale.

Add a reader in another AZ; apps use the cluster and reader endpoints.

A single instance has no failover target.

S3 Batch Replication.

Replication rules only copy new objects.

Health check based on a CloudWatch alarm.

Route 53 checkers on the internet can't reach private endpoints.

CloudWatch agent, configured from Parameter Store.

Memory and disk aren't standard EC2 metrics.

CloudWatch Logs metric filter with an alarm.

Turns matching log lines into a metric.

Subscription filters to a cross-account destination (Kinesis or Firehose) in a central account.

Continuous delivery; export to S3 is batch.

CloudTrail log file integrity validation (and Object Lock on the bucket).

Signed digest files detect changes.

X-Ray annotations.

Annotations are indexed; metadata isn't.

CloudWatch cross-account observability with a monitoring account.

Linked source accounts are visible without copying data.

CloudWatch composite alarms.

Page only when the combined condition is true.

Metric filter with dimensions, plus an alarm.

Metric filters can extract up to three dimensions from log fields.

CloudWatch Synthetics canary.

Scripted checks run on a schedule against endpoints and UI flows.

AWS X-Ray (daemon or ADOT sidecar on ECS).

The service map shows latency per component.

AWS Config rule with automatic remediation using a Systems Manager Automation runbook.

Native detection plus remediation with retries.

EventBridge rules forwarding to an event bus in a central account.

Cross-account event buses collect events in one place.

EventBridge rule on the finding → Lambda or SSM Automation that swaps to an isolation security group and snapshots volumes.

Containment within seconds, with evidence preserved.

AWS Health event in EventBridge → Systems Manager Automation.

Health events are delivered to EventBridge in each account and organizationally.

On-failure destination or dead-letter queue.

Events that fail after retries are kept for inspection and replay.

Permission boundaries required on any role they create.

The boundary caps the role's effective permissions.

Secrets Manager rotation.

Staging labels keep the current secret valid while the new one is set.

AWS Firewall Manager WAF policy.

Applies and keeps policies on existing and new resources across accounts.

Delegated administrator with auto-enable for the organization.

New member accounts are enrolled automatically.

EventBridge rule on the CloudTrail event (default bus) → Lambda or SSM Automation.

CloudTrail API calls are delivered to the default event bus.

AWS Health events → EventBridge.

Health publishes these events, including AWS_RISK_CREDENTIALS_EXPOSED.

Copy with a customer managed key, share the AMI, and let the key policy create a grant for their Auto Scaling service-linked role.

AWS managed keys can't be shared, and Auto Scaling launches through its service-linked role.

ECR enhanced scanning (Amazon Inspector).

Images are re-scanned as new CVEs are published.

Security Hub with a delegated admin and cross-Region aggregation.

It normalises findings from many services and accounts.