AWS CloudOps Engineer (SOA-C03) study guide
AWS CloudOps Engineer (SOA-C03) · Work through your exam, one topic at a time.
The AWS Certified CloudOps Engineer - Associate is a foundational-to-intermediate credential for people who run workloads on AWS day to day: monitoring and remediating issues, keeping systems available, automating deployments, enforcing security controls, managing networking, and controlling cost. It is aimed at cloud operations engineers, systems administrators, DevOps and platform practitioners, and support staff who already have hands-on AWS exposure and want it validated. The AWS CloudOps Engineer (SOA-C03) study guide has 6 sections and about 1,956 words.
01Monitoring, Logging, and Remediation
CloudWatch metrics, alarms, and dashboards; CloudWatch Logs (log groups, streams, metric filters, subscription filters); CloudTrail (management vs data events, trails, EventBridge integration); AWS Config rules and conformance packs; Systems Manager (OpsCenter, Automation, Patch Manager, State Manager); EventBridge rules and targets; SNS/SQS fan-out; X-Ray and ServiceLens. Default vs detailed monitoring : EC2 basic metrics arrive at 5-minute granularity; detailed monitoring is 1 minute and costs extra.
354 words, about 2 min02Reliability and Business Continuity
Multi-AZ vs multi-Region design; RDS Multi-AZ (synchronous standby, automatic failover) vs read replicas (asynchronous, read scaling); Aurora replicas and global database; S3 durability, versioning, Cross-Region Replication, and Object Lock; EBS snapshots and AMIs; Route 53 health checks, failover, and latency routing; Backup plans and vaults; Elastic Disaster Recovery; SQS/SNS decoupling; Auto Scaling health checks. Multi-AZ is for availability, not read scaling.
322 words, about 2 min03Deployment, Provisioning, and Automation
CloudFormation (templates, stacks, nested stacks, change sets, drift detection, StackSets, deletion policies, DependsOn); Elastic Beanstalk deployment policies (all-at-once, rolling, rolling with additional batch, immutable, blue/green); CodePipeline/CodeBuild/CodeDeploy (in-place vs blue/green, deployment configs); Systems Manager Automation and Run Command; OpsWorks (legacy); CDK and SAM; launch templates and Auto Scaling groups; AMI pipelines via EC2 Image Builder. CloudFormation rollback : a failed stack update rolls back to the last stable state by default.
303 words, about 2 min04Security and Compliance
IAM users, roles, policies, permission boundaries, and identity vs resource policies; cross-account access via role assumption; AWS Organizations SCPs; KMS key policies, grants, and envelope encryption; Secrets Manager vs Parameter Store (SecureString); GuardDuty, Security Hub, Inspector, Macie; WAF and Shield; VPC security groups vs NACLs; CloudTrail log integrity; S3 Block Public Access; IAM Access Analyzer; compliance frameworks via Artifact and Audit Manager. SCPs do not grant permissions - they only set the maximum.
348 words, about 2 min05Networking and Content Delivery
VPC design (subnets, route tables, internet/NAT gateways, VPC peering, Transit Gateway, PrivateLink/endpoints); security groups and NACLs; Elastic Load Balancing (ALB vs NLB vs GWLB); Route 53 routing policies; CloudFront distributions, origins, and cache behaviors; Global Accelerator; Direct Connect and Site-to-Site VPN; VPC Flow Logs; Reachability Analyzer. ALB is Layer 7 (HTTP/HTTPS, host/path routing, WebSocket); NLB is Layer 4 (TCP/UDP, ultra-low latency, static IP, preserves source IP).
306 words, about 2 min06Cost and Performance Optimization
Pricing models (On-Demand, Reserved, Savings Plans, Spot); right-sizing and Compute Optimizer; S3 storage classes and lifecycle policies; EBS volume types (gp3, io2, st1, sc1); Auto Scaling policies (target tracking, step, scheduled, predictive); ElastiCache and DAX; RDS performance insights; Cost Explorer, Budgets, and Cost Anomaly Detection; tagging and cost allocation; Graviton instances. Spot instances can be interrupted with a two-minute warning.
323 words, about 2 min