AWSDOP-C02
⚡

Exam Reflexes

Cue → answer shortcuts collected from the practice questions. Read the left column as the phrase you spot in a question; the right column is where your mind should jump. Traps and nuances are in the note underneath.

199 reflexes10 categories
Mode:
When you see
Zero-downtime cutover, terminate old fleet after a delay
Reach for
CodeDeploy blue/green + "terminate original instances" wait (0–2880 min)
⚠ The wait window IS your fast-rollback buffer.
CI/CD & Deploy
When you see
ECS or Lambda deployment strategy
Reach for
Always blue/green (agentless)
⚠ CodeDeploy agent is EC2/on-prem only; on-prem is in-place only.
CI/CD & Deploy
When you see
Shift X% traffic, wait, then the rest (serverless)
Reach for
Canary (2 steps). Linear = equal steps every N min
⚠ ECSLinear10PercentEvery1Minute etc.
CI/CD & Deploy
When you see
"10% every minute until 100%" via CloudFormation for ECS blue/green
Reach for
Transform AWS::CodeDeployBlueGreen + AWS::CodeDeploy::BlueGreen hook, TimeBasedLinear
⚠ AppSpec is NOT a template construct.
CI/CD & Deploy
When you see
ECS standard deploy action needs which file
Reach for
imagedefinitions.json
⚠ ECS blue/green (CodeDeployToECS) → appspec.yaml + taskdef.json (+ imageDetail.json).
CI/CD & Deploy
When you see
Custom test/validation step that can fail the pipeline
Reach for
Lambda invoke action → PutJobSuccessResult / PutJobFailureResult
⚠ CloudWatch Synthetics canary is NOT a pipeline action.
CI/CD & Deploy
When you see
Pipeline takes minutes to start after a commit
Reach for
It is polling → switch to EventBridge (AWS sources) / CodeConnections (GitHub)
CI/CD & Deploy
When you see
Connect CodePipeline to GitHub securely
Reach for
CodeConnections (GitHub App) — no OAuth token, no manual webhook
CI/CD & Deploy
When you see
Test each pull request before merge (CodeCommit)
Reach for
EventBridge on pullRequestCreated + pullRequestSourceBranchUpdated → CodeBuild
⚠ Notification rules can only target SNS/Chatbot — they cannot invoke CodeBuild.
CI/CD & Deploy
When you see
Store test reports from CodeBuild
Reach for
CodeBuild report group (JUnit/NUnit/TestNG/Cucumber/TRX)
CI/CD & Deploy
When you see
A SAM template is…
Reach for
A CloudFormation template with Transform: AWS::Serverless-2016-10-31
⚠ "sam deploy" ≈ cloudformation package + deploy.
CI/CD & Deploy
When you see
"No changes to deploy" with a static CodeUri
Reach for
CFN compares templates, not S3 contents → point CodeUri at local folder so packaging makes a new hashed key
CI/CD & Deploy
When you see
Manual approval waited 7+ days
Reach for
Hard 7-day timeout → action fails; approver needs codepipeline:PutApprovalResult
CI/CD & Deploy
When you see
Gate container images on scan results, isolate pre/post scan
Reach for
Separate ECR repos (write pre-scan, read post-scan) + CodePipeline/CodeBuild gate
⚠ ECR access is repo-scoped only — no per-image/tag condition.
CI/CD & Deploy
When you see
Detect / react to CodeDeploy deployment state changes
Reach for
EventBridge rule on CodeDeploy deployment/instance state-change events → Lambda target
⚠ Custom Slack/alert on a CodeDeploy event = Lambda target. CloudTrail is not real-time.
CI/CD & Deploy
When you see
CodeDeploy auto-rollback — which trigger?
Reach for
"Roll back when a deployment fails" (process fails) vs "when alarm thresholds are met" (CloudWatch metric)
⚠ Match to what the stem says fails. Alarm-based rollback only runs DURING the deployment, not forever.
CI/CD & Deploy
When you see
Validate a new version with test traffic before production (ECS blue/green)
Reach for
AfterAllowTestTraffic hook (green task set serves the TEST listener) → fail = rollback
⚠ ECS b/g uses 2 listeners (prod + test). BeforeAllowTraffic runs AFTER validation passed (pre-prod actions only). AfterAllowTraffic = prod already live. Lambda b/g has no test listener → validate at BeforeAllowTraffic.
CI/CD & Deploy
When you see
Incrementally shift Lambda traffic to a new version
Reach for
CodeDeploy predefined Linear/Canary config (e.g. LambdaLinear10PercentEvery3Minutes)
⚠ All-at-once = no gradual shift.
CI/CD & Deploy
When you see
TEST auto-deploys, PROD must be gated
Reach for
One repo + a branch per environment + a CodePipeline MANUAL APPROVAL on the PROD pipeline
⚠ Separate repos per env = anti-pattern. Approval only on the env that must NOT auto-deploy.
CI/CD & Deploy
When you see
Simplest / cheapest human gate before prod
Reach for
CodePipeline native MANUAL APPROVAL action (+ SNS notify)
⚠ Not custom actions/job workers, Jenkins on EC2, or Step Functions.
CI/CD & Deploy
When you see
Need branch/path/tag trigger filters, pipeline variables, or stage rollback
Reach for
CodePipeline V2 pipeline type
⚠ V1 watches ONE branch (BranchName) and fires on push; filtering/variables/rollback are V2-only.
CI/CD & Deploy
When you see
How does a pipeline detect a GitHub push?
Reach for
Webhook via a CodeConnections connection
⚠ EventBridge change-detection is for AWS-native sources (CodeCommit/S3/ECR), not GitHub.
CI/CD & Deploy
When you see
Beanstalk deploy: maintain FULL capacity, no downtime
Reach for
Immutable (full new instance set, then swap) — or Rolling with additional batch
⚠ Rolling = reduced capacity; All-at-once = downtime; Blue/Green = env URL swap.
CI/CD & Deploy
When you see
Hardcoded credentials in a buildspec / code
Reach for
AWS keys → IAM role; secrets → Parameter Store SecureString / Secrets Manager
⚠ Base64 ≠ encryption; deleting temp files ≠ securing a committed secret.
CI/CD & Deploy
When you see
CloudFormation custom resource stuck in CREATE_IN_PROGRESS
Reach for
The Lambda never sent SUCCESS/FAILED to the pre-signed URL (use cfn-response)
⚠ Must also handle the Delete request or stack deletion hangs.
CI/CD & Deploy
When you see
CloudFormation stack won't delete (S3 bucket)
Reach for
Bucket is not empty → a custom resource empties it on the Delete event
⚠ DeletionPolicy = Delete/Retain/RetainExceptOnCreate/Snapshot (no "ForceDelete"; Snapshot not for S3).
CI/CD & Deploy
When you see
RDS MAJOR version upgrade, minimal downtime
Reach for
RDS Blue/Green Deployment (upgrade green, switch over in seconds, no data loss)
⚠ CFN property = EngineVersion (+ AllowMajorVersionUpgrade: true). In-place major upgrade = outage even on Multi-AZ.
CI/CD & Deploy
When you see
Require MFA (block long-term keys too)
Reach for
Deny + BoolIfExists aws:MultiFactorAuthPresent = false
⚠ Missing key evaluates TRUE → the Deny fires. Never use plain Bool for this.
IAM & Access
When you see
Let devs create IAM roles/users without privilege escalation
Reach for
Permissions boundary (ceiling) + identity policy with iam:PermissionsBoundary condition
IAM & Access
When you see
"Everyone except this role"
Reach for
Deny + aws:PrincipalArn condition (ArnNotLike)
IAM & Access
When you see
Restrict a resource policy to "anyone in my org"
Reach for
aws:PrincipalOrgID condition
IAM & Access
When you see
"Only their own team's resources", tags involved
Reach for
ABAC — aws:PrincipalTag matched to aws:ResourceTag
IAM & Access
When you see
IAM Identity Center: define permissions
Reach for
Permission sets (not standalone IAM policies); assign to accounts (not OUs)
⚠ External IdP → map attributes from the SAML assertion.
IAM & Access
When you see
Bind EC2 instance credentials to the instance
Reach for
aws:EC2InstanceSourceVPC = aws:SourceVpc AND aws:EC2InstanceSourcePrivateIPv4 = aws:VpcSourceIp
⚠ Pair by type; needs VPC-endpoint traffic; add IMDSv2.
IAM & Access
When you see
Force TLS on S3
Reach for
Deny + Bool aws:SecureTransport = false
IAM & Access
When you see
Third-party cross-account access (confused deputy)
Reach for
sts:ExternalId in the role trust policy
IAM & Access
When you see
Service acting on your behalf (confused deputy)
Reach for
aws:SourceArn + aws:SourceAccount
⚠ aws:SourceAccount is NOT present in a normal user request context.
IAM & Access
When you see
Region-restriction guardrail
Reach for
SCP with aws:RequestedRegion condition
IAM & Access
When you see
Cross-account access to EC2/DynamoDB (no resource policy historically)
Reach for
AssumeRole
⚠ If the service HAS a resource policy (S3/KMS/SQS/SNS/EFS/Secrets Mgr) → direct grant beats AssumeRole.
IAM & Access
When you see
Cross-account access via resource policy
Reach for
Both sides required: identity policy (caller) AND resource policy (target)
IAM & Access
When you see
Config/non-secret values read at runtime
Reach for
SSM Parameter Store
⚠ Secrets needing rotation → Secrets Manager.
IAM & Access
When you see
Invited (not created) org account — no admin access
Reach for
Create OrganizationAccountAccessRole manually (created accounts get it automatically)
IAM & Access
When you see
Secret needs AUTOMATIC rotation
Reach for
Secrets Manager (rotation Lambda: create → set → test → finish; AWSCURRENT/PENDING/PREVIOUS)
⚠ Parameter Store SecureString = cheap, no native rotation. App must READ the secret at runtime to pick up rotations.
IAM & Access
When you see
Org-wide Region + service restrictions
Reach for
SCP (not permissions boundary, not "group policies")
⚠ SCPs never GRANT; management account is EXEMPT from SCPs.
Org & Governance
When you see
Identical IAM roles/resources across all accounts
Reach for
CloudFormation StackSets (service-managed + auto-deploy)
⚠ Roles are account-scoped; RAM shares resources, NOT roles.
Org & Governance
When you see
Restrict something IN the management account
Reach for
IAM-layer control (explicit Deny in permission set) — SCPs don't apply to mgmt account
Org & Governance
When you see
Auto-deploy custom CFN + SCPs to all new accounts
Reach for
Customizations for Control Tower (CfCT) — push, manifest.yaml
Org & Governance
When you see
Customizations an account can REQUEST (Control Tower)
Reach for
Service Catalog blueprints + AWSControlTowerBlueprintAccess role
⚠ "request/self-service" = pull; "automatically" = CfCT/StackSets.
Org & Governance
When you see
Pre-configure an account at provisioning time
Reach for
Account Factory Customization (AFC) — attach a blueprint
Org & Governance
When you see
Enforce backups across every org account
Reach for
AWS Organizations backup policies (from delegated admin)
Org & Governance
When you see
AD authentication for AWS
Reach for
SAML 2.0 IAM identity provider + role trust policy (or IAM Identity Center)
Org & Governance
When you see
Deploy into another account's VPC
Reach for
VPC Sharing via AWS RAM (share subnets, same org)
Org & Governance
When you see
Report compliance across many accounts / Regions
Reach for
AWS Config AGGREGATOR (single consolidated view)
⚠ Aggregator = the reporting view; StackSets = deploy the Config rule org-wide. Prefer a MANAGED rule over a custom Lambda rule.
Org & Governance
When you see
Who called which API / audit trail
Reach for
CloudTrail (retain via trail → S3; query with Athena)
⚠ Event History = management events only, 90 days.
Monitoring & Logging
When you see
Log API activity across all org accounts
Reach for
CloudTrail organization trail (auto-covers current + future accounts)
Monitoring & Logging
When you see
Capture S3 object-level access
Reach for
Enable data events on a trail (off by default, paid)
⚠ Or S3 native EventBridge notifications.
Monitoring & Logging
When you see
Query CloudTrail logs with SQL
Reach for
Athena (over S3 files)
⚠ CloudWatch Metrics Insights queries METRICS, not logs; Logs Insights queries log groups.
Monitoring & Logging
When you see
React to individual log events in real time
Reach for
CloudWatch Logs subscription filter → Lambda/Firehose/Kinesis
⚠ Metric filter = log pattern → metric; Logs Insights = historical query; Contributor Insights = top-N.
Monitoring & Logging
When you see
Turn a log pattern into an alarm
Reach for
CloudWatch Logs metric filter → CloudWatch alarm → SNS
Monitoring & Logging
When you see
Alert on a specific management API call in real time
Reach for
EventBridge rule on "AWS API Call via CloudTrail" (no trail needed)
Monitoring & Logging
When you see
React to an RDS/Aurora operational event (failure)
Reach for
EventBridge or RDS Event Subscriptions → NOT CloudTrail
⚠ CloudTrail logs API calls, not service events.
Monitoring & Logging
When you see
Log & review stopped ECS tasks
Reach for
EventBridge on ECS Task State Change → CloudWatch Logs → Logs Insights
⚠ Task lifecycle = ECS/EventBridge, not EC2 lifecycle.
Monitoring & Logging
When you see
Anomaly detection on time-series (least effort)
Reach for
CloudWatch anomaly detection (or Lookout for Metrics — now deprecated)
⚠ Don't hand-build in Lambda.
Monitoring & Logging
When you see
Run something on a schedule / weekly
Reach for
EventBridge scheduled rule (rate/cron)
⚠ One-time, time-zone, or huge scale → EventBridge Scheduler.
Monitoring & Logging
When you see
Warn when approaching a service limit
Reach for
Trusted Advisor limit checks (Business+) OR Service Quotas + AWS/Usage alarm
Monitoring & Logging
When you see
Collect telemetry WITHOUT adding latency
Reach for
Async collectors: CloudWatch agent (logs/metrics), X-Ray daemon (traces)
⚠ Never upload inline per request.
Monitoring & Logging
When you see
Distinguish backend bug from LB problem
Reach for
HTTPCode_Target_5XX (app) vs HTTPCode_ELB_5XX (no healthy targets)
Monitoring & Logging
When you see
FASTEST detection of a configuration change
Reach for
AWS Config rule with a CONFIGURATION CHANGE (event-driven) trigger
⚠ A periodic trigger (hourly) is slower. Auto-revert = Config remediation via SSM Automation.
Monitoring & Logging
When you see
Visualize / graph an EVENT on a CloudWatch dashboard
Reach for
EventBridge → Lambda → PutMetricData custom metric → dashboard
⚠ Dashboards graph metrics, not raw events.
Monitoring & Logging
When you see
Auto-detect performance anomalies in traces + notify
Reach for
X-Ray Insights (→ EventBridge)
⚠ X-Ray Insights (traces) ≠ CloudWatch Logs Insights (interactive log queries).
Monitoring & Logging
When you see
Collect EKS cluster/pod metrics AND logs to CloudWatch
Reach for
Container Insights = CloudWatch agent (metrics) + Fluent Bit (logs)
⚠ An alarm can't watch log content → metric filter first (e.g. Autoscaler errors).
Monitoring & Logging
When you see
Detect threats / malicious / anomalous IAM behavior
Reach for
GuardDuty (agentless; CloudTrail/VPC Flow/DNS)
⚠ Detection only → EventBridge → Lambda to respond.
Security Services
When you see
Investigate the root cause of a security finding
Reach for
Amazon Detective
⚠ GuardDuty detects; Detective investigates (behavior graph from CloudTrail + VPC Flow Logs + GuardDuty).
Security Services
When you see
Find CVEs / software vulnerabilities
Reach for
Amazon Inspector (EC2, ECR images, Lambda)
Security Services
When you see
Discover sensitive data / PII in S3
Reach for
Amazon Macie
Security Services
When you see
Aggregate findings across accounts + services
Reach for
AWS Security Hub (aggregator + auto-enroll)
Security Services
When you see
Audit resource configuration / "is it compliant now?"
Reach for
AWS Config (managed rule, or custom rule + Lambda evaluator)
⚠ Config = current state; CloudTrail = API actions.
Security Services
When you see
Ensure config X; if not, remediate
Reach for
Config rule + SSM Automation auto-remediation
⚠ e.g. ec2-imdsv2-check; ec2-managedinstance-applications-blacklisted.
Security Services
When you see
Audit installed software on EC2
Reach for
SSM Inventory + AWS Config rules
Security Services
When you see
Immutable backups / ransomware protection
Reach for
AWS Backup Vault Lock (compliance mode) — even root cannot delete
Security Services
When you see
Is AWS itself affecting my resources?
Reach for
AWS Health (events + scheduled maintenance)
Security Services
When you see
Are my instances right-sized?
Reach for
Compute Optimizer (ML)
Security Services
When you see
Prove CloudTrail logs weren't tampered with (PCI)
Reach for
CloudTrail log file integrity validation → signed, hash-chained digest files (validate-logs)
⚠ Detects tampering. To PREVENT deletion: S3 bucket policy, MFA Delete, Object Lock.
Security Services
When you see
Pod scales to max immediately, before traffic (EKS)
Reach for
Vertical Pod Autoscaler (VPA) right-sizes requests
⚠ HPA = more pods; Cluster Autoscaler = more nodes.
Containers
When you see
Per-pod AWS permissions (EKS)
Reach for
EKS Pod Identity (preferred) or IRSA
⚠ Block pod access to node role: IMDSv2 + hop limit 1.
Containers
When you see
ECS: pull image fails vs app can't reach S3
Reach for
Task execution role (pull/logs) vs task role (app AWS calls)
Containers
When you see
Scan container images: OS + language packages
Reach for
ECR enhanced scanning (Amazon Inspector)
⚠ Basic = OS only; its Clair engine is now deprecated.
Containers
When you see
Prevent overwriting an image tag
Reach for
ECR immutable tags
Containers
When you see
Someone reaches the cluster but kubectl says Unauthorized
Reach for
RBAC mapping (aws-auth / EKS access entries), not IAM
Containers
When you see
Many instances/AZs need the same writable files
Reach for
EFS (ReadWriteMany, POSIX, multi-AZ)
⚠ Fargate persistent storage & EKS RWX → EFS.
Storage
When you see
On-prem NetApp / ONTAP / SnapMirror → AWS
Reach for
FSx for NetApp ONTAP
⚠ Match FSx flavor: ONTAP · Windows(SMB) · Lustre(HPC) · OpenZFS.
Storage
When you see
One writer / one AZ (database volume)
Reach for
EBS
Storage
When you see
Enforce S3 encryption
Reach for
Default bucket encryption (AWS recommends over a bucket policy)
Storage
When you see
Replicate existing S3 objects
Reach for
S3 Batch Operations (replication covers NEW objects only)
Storage
When you see
S3 failover with writes to either Region
Reach for
Two-way (bidirectional) replication (not one-way CRR)
⚠ Versioning required on both buckets.
Storage
When you see
EFS bill high, files rarely read
Reach for
Lifecycle policy → Infrequent Access / Archive
Storage
When you see
On-prem must reach S3 privately (Direct Connect)
Reach for
S3 Interface endpoint (Gateway endpoints are VPC-origin only)
Networking
When you see
Gateway endpoint services
Reach for
S3 and DynamoDB only (route-table based, free)
⚠ Everything else → Interface endpoint (PrivateLink).
Networking
When you see
Redundant API, independent per Region + best performance
Reach for
Regional API Gateway endpoints per Region + Route 53 latency routing
⚠ Edge-optimized = single Region behind CloudFront ≠ multi-Region.
Networking
When you see
Evacuate / test-failover one AZ behind an ELB
Reach for
ARC (Application Recovery Controller) zonal shift (started on the resource)
⚠ ALB cross-zone is disabled at the TARGET-GROUP level.
Networking
When you see
Static IP for the load balancer
Reach for
NLB (Elastic IPs) — ALB has none
Networking
When you see
Block a specific IP/CIDR
Reach for
NACL deny rule (security groups have no deny)
Networking
When you see
"public" vs "private" subnet
Reach for
Decided by the route table (0.0.0.0/0 → IGW = public)
⚠ A VPC-Lambda in a public subnet still has no internet → needs NAT or endpoints.
Networking
When you see
Connect separate VPCs across accounts
Reach for
VPC Peering (1:1) or Transit Gateway (many, transitive)
Networking
When you see
mTLS on API Gateway
Reach for
Custom domain + trust store (CA cert) in S3
⚠ Trust store holds the CA cert, never client certs or private keys.
Networking
When you see
"User: anonymous is not authorized" (API GW)
Reach for
Enable AWS_IAM authorization + clients SigV4-sign
Networking
When you see
Fetch dependencies with NO internet access
Reach for
Mirror to S3 + VPC gateway endpoint + instance profile
⚠ NAT gateway = OUTBOUND internet (wrong for "no internet"). Elastic IP = a public IP (never "no public internet").
Networking
When you see
Geographically isolated DR site
Reach for
A different REGION (an AZ is not geographic isolation)
⚠ Low-RPO cross-Region data = cross-Region read replica; DR routing = Route 53 FAILOVER. Multi-AZ ≠ cross-Region.
Networking
When you see
Notify when an ASG instance fails to launch
Reach for
ASG notifications → SNS (EC2_INSTANCE_LAUNCH_ERROR)
⚠ Health/status checks watch RUNNING instances, not launches.
Compute & Serverless
When you see
Update the app on running instances when CFN template changes
Reach for
cfn-init + cfn-hup (or SSM State Manager)
⚠ User data runs ONCE at launch.
Compute & Serverless
When you see
Keep instances continuously in a desired state
Reach for
SSM State Manager (association)
⚠ Run Command = one-time; State Manager = persistent.
Compute & Serverless
When you see
On-prem shell access, no internet
Reach for
Systems Manager Session Manager
⚠ No bastion/NAT; on-prem needs advanced-instances tier + hybrid activation.
Compute & Serverless
When you see
Automate fleet OS + app patching (least effort)
Reach for
Patch Manager + custom baseline (both repos) + AWS-RunPatchBaseline
⚠ A single baseline can include multiple repos; BaselineOverride at runtime.
Compute & Serverless
When you see
Lambda cold-start latency
Reach for
Provisioned Concurrency
Compute & Serverless
When you see
Lambda exhausts DB connections
Reach for
RDS Proxy (connection pooling)
Compute & Serverless
When you see
Auto-promote a cross-Region read replica on failure
Reach for
EventBridge (DB event) → Lambda promotes + updates SSM Parameter Store
⚠ App reads endpoint from Parameter Store; not CloudFormation stack update.
Compute & Serverless
When you see
Cut ASG launch time
Reach for
Warm Pools
Compute & Serverless
When you see
Instances take too long to boot (download deps)
Reach for
Golden AMI with deps baked in — build/automate with SSM Automation (or EC2 Image Builder)
⚠ Same idea for containers = bake into the image.
Compute & Serverless
When you see
One AMI must work across DEV/TEST/STAGING/PROD
Reach for
Keep the AMI env-agnostic; tag the instance + a User Data bootstrap reads the tag
⚠ Per-env secrets → Parameter Store SecureString.
Compute & Serverless
When you see
Automate AMI creation + share the new AMI ID
Reach for
SSM Automation builds the AMI → store the ID in SSM Parameter Store
⚠ Parameter Store = free, programmatic, CFN/CodePipeline can read it. Not Jenkins/DynamoDB/S3.
Compute & Serverless
When you see
Run / test Amazon Linux 2 on-premises
Reach for
Download the AL2 VM image (.ova/.vdi) + seed.iso and boot it in your hypervisor
⚠ VM Import/Export moves VMs between on-prem and EC2 (OVA/VMDK/VHD, not ISO). There is no plain bootable AL2 ISO.
Compute & Serverless
When you see
Lambda extension: internal vs external
Reach for
Internal = in the runtime process (instrument it); External = separate process (forward telemetry, runs after invoke)
⚠ X-Ray / telemetry collection → external (matches the separate-process daemon).
Compute & Serverless
When you see
Lambda+SQS: don't reprocess successful messages
Reach for
ReportBatchItemFailures in FunctionResponseTypes (+ DLQ)
⚠ Batch size 1 works but kills scalability.
Data & Messaging
When you see
Deliver streaming data to S3/Redshift/OpenSearch (no ops)
Reach for
Kinesis Data Firehose
⚠ Real-time consumers / replay → Kinesis Data Streams.
Data & Messaging
When you see
Fan-out one event to many consumers
Reach for
SNS topic with multiple subscribers
Data & Messaging
When you see
Multi-Region low-latency reads for DynamoDB
Reach for
DynamoDB Global Tables
Data & Messaging
When you see
Aurora Multi-Master
Reach for
Deprecated (5.6-only, EOL) → Aurora Global Database / fast failover
Data & Messaging
When you see
Move sensitive PII before crossing account boundary
Reach for
Macie (discover) + Step Functions/Lambda (redact) THEN copy
⚠ Replication/Object Lambda copy raw data first — too late.
Data & Messaging
When you see
Transform flow logs then land in S3
Reach for
Kinesis Data Firehose (with transform) → S3 → Athena
Data & Messaging
When you see
Many consumers on one DynamoDB Stream → throttling
Reach for
Kinesis Adapter (KCL) fan-out — or enable Kinesis Data Streams for DynamoDB
⚠ ~2 readers per shard max; more Lambda concurrency will not fix a read-side shard limit.
Data & Messaging
When you see
LSI vs GSI creation timing
Reach for
LSI = at table creation only; GSI = any time
⚠ Neither fixes a stream-consumer throttle.
Data & Messaging
When you see
CFN Auto Scaling group update: immediate rollback + keep full capacity
Reach for
UpdatePolicy AutoScalingReplacingUpdate with WillReplace: true (new ASG; keep old on failure)
⚠ CFN analogue of Beanstalk Immutable. AutoScalingRollingUpdate = in-place batch update (can leave partial state).
CI/CD & Deploy
When you see
Spot a fabricated CloudFormation option
Reach for
Fake resource Type, fake top-level section, or a self-canceling combo
⚠ e.g. AWS::AutoScaling::DeploymentUpdates (not real); WillReplace:false + RollingUpdate (contradiction). Real property names get reused in wrong answers.
CI/CD & Deploy
When you see
One CodeDeploy revision must behave differently per environment
Reach for
Read the built-in DEPLOYMENT_GROUP_NAME env var inside a hook script
⚠ Built-ins: DEPLOYMENT_GROUP_NAME/_ID, DEPLOYMENT_ID, APPLICATION_NAME, LIFECYCLE_EVENT. GROUP_NAME (readable) > GROUP_ID (GUID) > tags+describe-tags > custom vars.
CI/CD & Deploy
When you see
Serverless canary rollout with easy rollback
Reach for
Lambda alias weighted routing OR API Gateway canary release (either is native)
⚠ Route 53 %-split = WEIGHTED, not Failover (health-based, no %). ALB has no "canary"; NLB does no %-routing.
CI/CD & Deploy
When you see
Hybrid / on-prem instance registered in SSM shows as…
Reach for
mi- prefix (EC2 = i-)
⚠ Hybrid activation = IAM role assumed via STS AssumeRole (NOT AssumeRoleWithSAML) → managed-instance activation → install agent with activation code+ID → register.
Compute & Serverless
When you see
Aggregate logs from on-prem + EC2 and analyze cheaply
Reach for
Unified CloudWatch agent (runs on-prem too) → Firehose → S3 → Athena
⚠ EMR / self-managed ELK = heavy. Macie = PII discovery, NOT log analytics.
Monitoring & Logging
When you see
React to AWS-initiated events (maintenance, exposed keys, service disruption)
Reach for
AWS Health API / EventBridge (source aws.health) → SNS / Lambda
⚠ Trusted Advisor is NOT an RDS/Health event stream (fabricated distractor).
Monitoring & Logging
When you see
Cache static content for a worldwide audience
Reach for
CloudFront distribution
⚠ Lambda@Edge = edge COMPUTE, not a cache. Elemental MediaStore/MediaPackage = VIDEO, not an image CDN.
Networking
When you see
Distribute/steer traffic ACROSS Regions (DR failover)
Reach for
Route 53 (failover / latency / weighted) or Global Accelerator
⚠ An ALB/NLB is REGIONAL — it cannot distribute traffic across Regions.
Networking
When you see
Duplicate / repeated DynamoDB read requests hurting performance
Reach for
DynamoDB Accelerator (DAX) — managed in-memory cache for DynamoDB
⚠ Offloads read capacity (microsecond reads). ElastiCache is generic and may itself be the bottleneck.
Data & Messaging
When you see
RDS cross-Region DR with LOW RTO + LEAST data loss
Reach for
Cross-Region READ REPLICA + promote on failover (or Aurora Global Database)
⚠ Multi-AZ = single-Region HA only (cannot span Regions). Daily snapshots = backup & restore = worst RTO/RPO tier.
Data & Messaging
When you see
Inventory a VMware estate for migration (least effort)
Reach for
Application Discovery Service — Agentless Discovery Connector (OVA in vCenter) → Migration Hub
⚠ Discovery AGENT for non-vCenter hosts / deeper data. SSM Inventory = agent-per-host (heavier). Service Catalog ≠ discovery.
Org & Governance
When you see
Diagnose a blocked/AccessDenied connection between resources
Reach for
VPC Flow Logs — look for REJECT records (not ACCEPT)
⚠ Security groups are STATEFUL: an outbound call only needs an EGRESS rule (return auto-allowed). "Default network ACL" in a stem = NACL allows all → look at the SG.
Networking
When you see
Static private IP + hostname that survives reboot/termination
Reach for
Pre-created ENI (the IP lives on the ENI) attached to the instance
⚠ Per-node self-healing with fixed identity = single-instance ASG (Min=Max=1) + attach ENI in user data. Replicate N nodes = CloudFormation NESTED STACKS.
Networking
When you see
Distribute/steer traffic ACROSS Regions
Reach for
Route 53 (failover/latency/weighted) or Global Accelerator
⚠ An ALB/NLB is REGIONAL — it cannot distribute traffic across Regions.
Networking
When you see
Daily CVE scan of a GOLDEN AMI with Inspector
Reach for
Step Functions: launch instance from the AMI → install Inspector agent → assess tagged instances
⚠ AMIs aren't runnable targets — launch first. Daily schedule = EventBridge SCHEDULED RULE (not a CloudWatch alarm/event bus). Scope by TAG.
Security Services
When you see
Auto re-enable CloudTrail when it gets turned off
Reach for
Config/EventBridge on the StopLogging event → Lambda calls StartLogging
⚠ Re-enable a STOPPED trail = StartLogging (CreateTrail makes a NEW trail). Config rules do NOT auto-remediate by default → attach SSM Automation.
Security Services
When you see
Alert on a specific string/pattern in CloudWatch Logs
Reach for
Metric filter → custom metric → CloudWatch alarm → SNS
⚠ Inspector = vuln scan; Synthetics = endpoint uptime; Firewall Manager = policy mgmt. None do log-content alerting.
Monitoring & Logging
When you see
FREQUENT notification of Trusted Advisor recommendations
Reach for
EventBridge (check-status change) → SNS; or scheduled Lambda (RefreshTrustedAdvisorCheck) → SNS; or Lambda → Logs metric → alarm → SNS
⚠ Built-in TA email = WEEKLY → fails "frequent". EventBridge email target = SNS, not SES. TA events need Business/Enterprise Support (us-east-1).
Monitoring & Logging
When you see
Serverless deploy to a subset first, then everyone (pipeline)
Reach for
CodeDeploy Lambda CANARY config, e.g. LambdaCanary10Percent5Minutes
⚠ AllAtOnce = no gradual shift; a manual approval is not a canary. CodeDeploy canary/linear drives the alias weights.
CI/CD & Deploy
When you see
Share RESOURCE outputs (VPC/subnet/SG IDs) between stacks
Reach for
Cross-stack reference: Export + Fn::ImportValue
⚠ SSM Parameter Store = CONFIG values (passwords/strings), NOT resource outputs. Real-world caveat: Export/ImportValue is same-region + can't change an export while imported.
CI/CD & Deploy
When you see
Reference the latest AMI in CloudFormation without manual edits
Reach for
Lambda-backed custom resource (deploy-time lookup) OR SSM Parameter Store (AWS::SSM::Parameter::Value / resolve:ssm)
⚠ Mappings are STATIC (don't script-edit them). cfn-init = on-instance bootstrap, not a template lookup.
CI/CD & Deploy
When you see
Integrate an on-prem / third-party / long-running step into CodePipeline
Reach for
Custom action type + job worker (polls via PollForJobs, runs it, returns status)
⚠ Lambda pipeline actions cap at ≤15 min. Never expose internal tools to the public Internet.
CI/CD & Deploy
When you see
Two identical side-by-side envs + swap + A/B (managed, least effort)
Reach for
Elastic Beanstalk (Swap Environment URLs + Traffic Splitting)
⚠ CodeArtifact = package/dependency registry, NEVER app hosting. ASG instance refresh = rolling replacement, not blue/green.
CI/CD & Deploy
When you see
Build/test GitHub source and upload artifact
Reach for
CodeBuild (source: GitHub) + buildspec.yml + webhook trigger
⚠ CodeBuild artifacts config uploads to S3. CodeDeploy = deploy (not build). Self-managed EC2 build = avoidable overhead.
CI/CD & Deploy
When you see
Interruptible + cost-effective compute with checkpoint resume
Reach for
EC2 SPOT + a shared persistent POSIX FS (EFS)
⚠ EBS = single-instance block; S3 = object (not a file system); GlusterFS = self-managed. Watch red herrings (e.g. DMS) that don't affect the choice.
Compute & Serverless
When you see
One file system that speaks BOTH SMB and NFS
Reach for
Amazon FSx for NetApp ONTAP (multi-protocol) — cross-region replicate with SnapMirror
⚠ FSx for Windows = SMB-only; EFS = NFS-only; FSx for Lustre = HPC; S3 = object.
Storage
When you see
Data residency: some data must stay IN its Region
Reach for
A separate REGIONAL database per Region (never a global table / global replication)
⚠ Single read-heavy source across Regions + least app change from Aurora = cross-Region READ REPLICA. "Least change" favors keeping the same engine over SQL→NoSQL.
Data & Messaging
When you see
S3 AccessDenied downloading an object
Reach for
Check BOTH: the IAM identity policy (role) AND the bucket policy
⚠ Storage class (Glacier) → InvalidObjectState (restore first). Object Lock → WORM (write/delete). SSE-S3 → transparent. SSE-KMS → also needs kms:Decrypt. None of these = AccessDenied except the KMS case.
IAM & Access
When you see
SCP evaluation across an OU tree
Reach for
Action must be ALLOWED at EVERY level (root → OU → account) — effective = intersection
⚠ A child OU/account can NEVER widen what a parent restricts. Remove FullAWSAccess = allow-list mode (deny by omission, no explicit Deny needed). Final = IAM ∩ all SCPs, any Deny wins.
IAM & Access
When you see
Do SCPs restrict the management account?
Reach for
No — SCPs (and RCPs) never apply to the management account
⚠ Protect the mgmt account with least-privilege IAM + locked-down root (hardware MFA, no keys, no workloads), not SCPs.
IAM & Access
When you see
Let devs create IAM users but not escalate privilege
Reach for
Permissions boundary (the ceiling) + a policy allowing CreateUser only if iam:PermissionsBoundary = that boundary
⚠ Boundary caps the new user (Admin attached → still capped). "Everyone else" is blocked by default (no grant = can't). SCPs & boundaries CAP, never grant.
IAM & Access
When you see
Permissions boundary vs SCP
Reach for
Boundary = per-PRINCIPAL ceiling; SCP = per-ACCOUNT/OU guardrail. Don't swap them
⚠ Org-wide region/service restriction = SCP (aws:RequestedRegion), NOT a permissions boundary.
IAM & Access
When you see
Apply the same IAM roles/policies to every account
Reach for
Replicate with CloudFormation StackSets — IAM is PER-ACCOUNT
⚠ Policies, users, boundary references never cross account lines. RAM shares RESOURCES, not IAM roles.
IAM & Access
When you see
Perform an action / create a user in another account
Reach for
Assume a role THERE (create role + trust the caller's role ARN + sts:AssumeRole); then act
⚠ iam:CreateUser / organizations:CreateAccount always run in the CREDENTIALS' account. Cross-account role trusts the CALLER'S ROLE ARN — for a Lambda, the EXECUTION role, NOT lambda.amazonaws.com.
IAM & Access
When you see
Identity policy vs resource policy — when is access allowed?
Reach for
Same account: identity OR resource grants it. Cross-account: BOTH required
⚠ Resource policies only ADD access (never subtract without an explicit Deny). Having both is normal — each governs a different caller.
IAM & Access
When you see
ABAC condition shape
Reach for
"<service>:ResourceTag/key": "${aws:PrincipalTag/key}" (resource tag = KEY, principal tag = ${} VALUE)
⚠ The ${} is the requester's attribute. aws:TagKeys = tag KEYS in a tagging request (governs tagging ops), NOT resource tag values.
IAM & Access
When you see
Encrypted Secrets Manager secret → AccessDenied despite secret perms
Reach for
Customer-managed KMS key policy must allow the caller kms:Decrypt
⚠ KMS key policy is the gatekeeper — identity permission alone isn't enough for a CMK. In EKS the caller is the service-account (IRSA) role, not the cluster role.
IAM & Access
When you see
One resource policy that applies to all buckets/functions?
Reach for
No — resource policies are PER-RESOURCE (one bucket policy per bucket, one function policy per function)
⚠ "Broad across many resources" = an IDENTITY policy with a wildcard Resource. Org-wide resource guardrail = RCP (caps, never grants).
IAM & Access
When you see
App (OIDC) needs AWS API access / federate an external IdP
Reach for
OIDC → IAM OIDC provider + role trust "<idp-host>:aud" + sts:AssumeRoleWithWebIdentity
⚠ SAML/AD → IAM SAML IdP + AssumeRoleWithSAML. STS map: AssumeRole (cross-acct/service) · AssumeRoleWithSAML · AssumeRoleWithWebIdentity (OIDC) · GetFederationToken (IAM user).
IAM & Access
When you see
IAM Identity Center prerequisite
Reach for
Requires an AWS Organization (can't enable standalone)
⚠ Multi-account workforce SSO = Identity Center. Single standalone account / no org = plain IAM (or IAM SAML/OIDC federation), not Identity Center.
Org & Governance
When you see
organizations:CreateAccount from a non-management account
Reach for
Not possible directly — it's management-account-only; assume a role in the mgmt account
⚠ Account creation is NOT delegatable. Delegated admin covers many services but not this.
Org & Governance
When you see
StackSets: service-managed vs self-managed permissions
Reach for
Service-managed (Org trusted access, AWS manages roles, target OUs, auto-covers new accounts) vs self-managed (you create AdministrationRole + ExecutionRole per account)
⚠ Service-managed can include the MANAGEMENT account via an option — no separate stack. Trusted access enabled → service-managed = least overhead.
Org & Governance
When you see
Control Tower blueprints hosted in a separate hub account
Reach for
Create AWSControlTowerBlueprintAccess in the hub (trusts mgmt's AWSControlTowerAdmin + AWSServiceCatalogAdminFullAccess)
⚠ Control Tower always runs in the MANAGEMENT account; it assumes into the hub. If blueprints live in the mgmt account, this role isn't needed.
Org & Governance
When you see
How does EventBridge get permission to invoke a target?
Reach for
Most targets: EventBridge ASSUMES the RULE's IAM role (e.g. states:StartExecution for Step Functions). Lambda/SNS/SQS/CloudWatch Logs: the TARGET's resource policy grants events.amazonaws.com
⚠ "Matched but didn't fire" → check the rule's role (or the Lambda resource policy). EC2 built-in targets still need a rule role.
Data & Messaging
When you see
Manage ON-PREM servers with SSM
Reach for
Hybrid activation: IAM service role (AmazonSSMManagedInstanceCore, trusts ssm.amazonaws.com) → create activation (1 reusable code+ID, capped by registration limit) → install agent + register → shows as mi-
⚠ Needs 443 to ssm/ssmmessages/ec2messages. EC2 instead = instance profile w/ AmazonSSMManagedInstanceCore (agent preinstalled, no registration, i- prefix).
Compute & Serverless
When you see
Auto-manage ALL EC2 as SSM-managed, least effort
Reach for
Default Host Management Configuration (DHMC) — one SSM service setting (default-ec2-instance-management-role) + a role trusting ssm.amazonaws.com
⚠ Needs IMDSv2 + SSM Agent. No per-instance profile. Only covers instances with NO existing profile (existing profile takes precedence).
Compute & Serverless
When you see
What is an EC2 instance profile?
Reach for
A container that wraps exactly ONE IAM role — the object EC2 attaches to deliver the role's creds
⚠ The ROLE holds the permissions (+ trust ec2.amazonaws.com). Console auto-creates the profile so "attach a role" hides the wrapper.
Compute & Serverless
When you see
EKS pod → AWS credentials (two methods)
Reach for
IRSA (OIDC provider + SA annotation + AssumeRoleWithWebIdentity) OR Pod Identity (Pod Identity Agent add-on + node role eks-auth:AssumeRoleForPodIdentity + association)
⚠ "Pod Identity" → agent add-on (no OIDC). "OIDC / STS for the service account" → IRSA. EKS access entries (API_AND_CONFIG_MAP) = kubectl access, NOT pod creds.
Containers
When you see
Collect EKS pod memory/CPU metrics
Reach for
Unified CloudWatch agent (per-node, host process or DaemonSet) + Container Insights → CloudWatchAgentServerPolicy on the EC2 INSTANCE PROFILE
⚠ Agent runs per NODE (not per app pod); gets pod metrics via the kubelet. pod_* = workload level; node_* = host/capacity. CloudWatch does NOT collect memory by default.
Containers
When you see
Docker push/pull to ECR fails despite IAM permissions
Reach for
Add docker login: aws ecr get-login-password | docker login --username AWS --password-stdin <acct>.dkr.ecr.<region>.amazonaws.com
⚠ IAM permission ≠ Docker registry auth. Needs ecr:GetAuthorizationToken. Don't re-assume the role or make the repo public.
Containers
When you see
EFS mount fails from EC2/EKS
Reach for
Mount target in the client's SUBNET + SG allows inbound NFS 2049 + (EKS) EFS CSI driver IAM role via IRSA
⚠ EFS = NFS = port 2049. Mount target = an ENI per AZ. DataSync = data movement, not a mount; disabling encryption never fixes mounting.
Storage
When you see
Stack stuck in UPDATE_ROLLBACK_FAILED
Reach for
Fix the root cause, then aws cloudformation continue-update-rollback (--resources-to-skip for un-rollback-able resources)
⚠ cancel-update-stack only works on UPDATE_IN_PROGRESS. Never fix a stuck stack by hand-editing resources (drift). Diagnose via describe-stack-events.
CI/CD & Deploy
When you see
Pipeline must let reviewers see infra changes before applying
Reach for
CloudFormation CHANGE SETS: create (preview) → manual approval → EXECUTE the change set
⚠ A change set is a PREVIEW — creating it applies nothing; you must EXECUTE after approval (forgetting = no change). A direct UpdateStack = no review.
CI/CD & Deploy
When you see
CodeDeploy constructs for EC2
Reach for
CodeDeploy APPLICATION + DEPLOYMENT GROUP + CodeDeploy AGENT on instances
⚠ "Environment" is an Elastic Beanstalk term, NOT CodeDeploy. EC2 registers to a deployment group (by tags/ASG), not an "environment".
CI/CD & Deploy
When you see
CodeDeploy deployment: ALL events show "Skipped"
Reach for
Agent can't reach the CodeDeploy endpoint, OR the instance profile lacks permissions
⚠ The agent executes as the INSTANCE PROFILE (not the user who triggered it). Skipped = agent never got instructions (connectivity/perms), not a revision-content problem.
CI/CD & Deploy
When you see
SAM/CFN "no changes to deploy" after re-uploading a zip to the same S3 key
Reach for
CFN diffs the TEMPLATE (the S3 URI), not S3 contents → point CodeUri at a LOCAL folder + a packaging step
⚠ sam deploy (auto-packages) or `cloudformation package` uploads with a content-hash key. Raw update-stack / create-change-set do NOT package a local CodeUri.
CI/CD & Deploy
When you see
Programmatically create/enroll a Control Tower account
Reach for
servicecatalog:ProvisionProduct on the Account Factory product (Account Factory IS a Service Catalog product)
⚠ aws.controltower events (CreateManagedAccount, SetupLandingZone) are EMITTED by Control Tower — you react to them, not publish them to trigger enrollment. AWSControlTowerExecution is auto-created on enrollment.
Org & Governance
When you see
Deploy/enable something to ALL current + FUTURE accounts (plain Organizations)
Reach for
Service-managed CloudFormation StackSets with AUTOMATIC DEPLOYMENT (OU-targeted)
⚠ Fires on OU membership change (account created in / moved into a target OU). SCPs can't ENABLE services; EventBridge+Lambda/SSM = more overhead. Self-managed StackSets can't auto-deploy.
Org & Governance
When you see
Bake a baseline into a NEW account at creation (Control Tower, least overhead)
Reach for
Account Factory Customization (AFC) blueprint — applied during provisioning
⚠ AFC = per-account, at vend time, CFN resources (no SCPs). CfCT = ongoing org-wide resources + SCPs via manifest + pipeline/StackSets. New accounts must be vended by Account Factory (not org CreateAccount) to get guardrails.
Org & Governance
When you see
Customize a Control Tower-managed resource (e.g. Config recorder) across all accounts
Reach for
Mgmt-account Lambda assumes AWSControlTowerExecution in each account; trigger via EventBridge on OU register/re-register (re-register the ROOT OU to hit all existing)
⚠ Cross-account = both sides: Lambda role granted sts:AssumeRole (caller) + AWSControlTowerExecution trusts it (target). Config delegated admin manages RULES, not each account's recorder.
Org & Governance
When you see
Automate Control Tower guardrails with version control + review + rollback
Reach for
CFN (AWS::ControlTower::EnableControl per OU) in CodeCommit + CodePipeline triggered by EventBridge on repo changes
⚠ EnableControl at the OU level scales to all accounts. CodeBuild can't deploy CFN (use CodePipeline). S3 has no PR/version-control workflow. Per-account EnableControl doesn't scale.
Org & Governance
When you see
Control Tower control (guardrail) taxonomy
Reach for
Proactive = CloudFormation Hooks (block BEFORE the stack op); Detective = AWS Config rules (flag AFTER); Preventive = SCP (broad allow/deny)
⚠ "Enforce BEFORE a CloudFormation stack operation" → Hooks. Config = after the fact. SCP = broad, not CFN-op-specific.
Security Services
When you see
What is a CloudFormation Hook
Reach for
A proactive PASS/FAIL validation gate invoked before create/update/delete — fails the stack op if non-compliant
⚠ Account-level (registered in the CFN registry, per Region) — governs ALL stack ops in that account, NOT embedded in a template. Replicate to accounts via StackSets. (≠ Custom Resource, which DOES perform work.)
Security Services
When you see
Org-wide security service (Security Hub / GuardDuty / Macie / Inspector) setup
Reach for
Enable trusted access + designate a DELEGATED ADMINISTRATOR (dedicated security account, not the management account) + native AUTO-ENABLEMENT for future accounts
⚠ Grant viewers via Identity Center permission sets (SCP can't GRANT). Native auto-enablement > a custom EventBridge+Lambda(CreateMembers) pipeline. Enable standards (CIS) in the delegated admin.
Security Services
When you see
React to an event/alarm by running something on EC2 instances
Reach for
EventBridge → SSM Automation OR SSM Run Command DIRECTLY (both are native targets)
⚠ No Lambda/SNS middleman needed. SNS can't target SSM (its targets = Lambda/SQS/HTTP/email). AWS Health is its OWN event source (not EC2).
Data & Messaging
When you see
Schedule an SSM Automation run at a target time / window
Reach for
Maintenance Windows (governed window) · State Manager association (recurring cron/rate) · EventBridge Scheduler (specific one-time / cron)
⚠ All native, no Lambda. "Restart only in an approved window" → register the automation as a Maintenance Window task.
Compute & Serverless
When you see
Join Windows EC2 (in CloudFormation) to AWS Managed Microsoft AD
Reach for
AWS::SSM::Association with the AWS-JoinDirectoryServiceDomain runbook, matched by launch-template tags
⚠ IAM role needs AmazonSSMManagedInstanceCore + AmazonSSMDirectoryServiceAccess. Don't hand-roll a custom doc or put AD admin creds in user data (security risk). "SSMAssociation" isn't a launch-template property.
Compute & Serverless

Reflexes are pattern shortcuts, not substitutes for understanding. On the real exam many options "work" and the qualifier (MOST/LEAST) decides — use these to narrow fast, then verify against the actual requirement.