AWS DevOps Engineer Professional case studies
AWS DevOps Engineer Professional · Put your knowledge to work in context.
The AWS Certified DevOps Engineer - Professional is an advanced AWS certification aimed at engineers who build and operate delivery pipelines, automated infrastructure, and production systems on AWS. It suits people who already hold an associate-level AWS certification or have comparable hands-on experience and who now own automation and reliability end to end rather than a single service. The AWS DevOps Engineer Professional case studies are 5 cases and about 2,506 words.
1Blue/Green Deploy with a Schema Migration That Cannot Roll Back
A payments team runs a containerized API on ECS Fargate behind an ALB with two target groups. A CodePipeline deploys a new task definition, shifts 10% of traffic for 5 minutes, then 100%.
525 words, about 3 min2Drift Between Terraform State and a Hotfixed Security Group
A platform team manages 300 resources in Terraform with remote state in S3 and DynamoDB locking. During a Sev-1, an on-call engineer opens the console and adds an inbound rule to a production security group to restore access, then goes to bed.
499 words, about 2 min3Multi-Region Failover Where the Database Is the Real Blocker
A SaaS runs stateless web tiers in us-east-1 and eu-west-1 behind Route 53 failover routing with health checks. The primary database is Aurora MySQL with a cross-region read replica in eu-west-1.
499 words, about 2 min4Alarm Fatigue Hiding the One Signal That Matters
An operations team has 1,400 CloudWatch alarms. Most are static-threshold CPU and memory alarms tuned years ago.
473 words, about 2 min5Cross-Account Pipeline That Can Read Secrets It Should Not
A build account runs CodeBuild projects that deploy into 12 workload accounts via assumed roles. A security review finds: (1) one CodeBuild service role has secretsmanager:GetSecretValue on because a developer widened it to "make the build work"; (2) build logs print environment variables, including a database password injected as a plaintext env var; (3) the deploy roles in workload accounts trust the build account's root, not a specific role; (4) an engineer can edit the pipeline in the console and point it at a different source repo.
510 words, about 3 min