AWS DevOps Engineer Professional cheat sheet

CodePipeline stages run actions in parallel within a stage and sequentially across stages; a stage proceeds only when all actions in the prior stage succeed.

CodeDeploy deployment configs: AllAtOnce, HalfAtTime, OneAtATime, and Linear/Custom variants; Lambda configs use Canary10Percent5Minutes, Linear10PercentEvery1Minute, AllAtOnce.

CodeDeploy lifecycle hooks for EC2/on-premises: BeforeBlockTraffic, BlockTraffic, AfterBlockTraffic, ApplicationStop, DownloadBundle, BeforeInstall, Install, AfterInstall, ApplicationStart, ValidateService; order is fixed.

CodeBuild buildspec phases run in order: install, pre_build, build, post_build; each phase's commands run sequentially and a failing command aborts the build unless on-failure: CONTINUE.

CodePipeline cross-account access requires a customer-managed KMS key shared via key policy plus an IAM role in the target account trusted by the pipeline account.

CodeCommit triggers can invoke Lambda on branch/tag push events; EventBridge rules can target CodePipeline to start on repository state change.

Blue/green with CodeDeploy on EC2 swaps Auto Scaling groups or uses Classic/ALB listener swap; rollback redeploys the last known-good revision.

Manual approval actions in CodePipeline publish an SNS topic; approval must occur before the stage continues or times out per the action configuration.

CloudFormation change sets show resource ADD/MODIFY/REMOVE actions; resources without replacement show 'Modify' while replacement shows 'Modify (Replacement)' with a new physical ID.

Stack policies protect resources from updates; a Deny on Update:Replace blocks replacement, and Update:Modify blocks in-place updates for that resource.

DeletionPolicy values: Delete (default), Retain, RetainExceptOnCreate, Snapshot (for supported resource types such as RDS and EBS).

CloudFormation drift detection compares actual resource configuration to the template's expected state; drifted resources report MODIFIED or DELETED.

Nested stacks isolate reusable templates via AWS::CloudFormation::Stack; changes to a nested stack require updating the parent unless using stack sets or direct nested update.

OpsWorks Stacks use layers, instances, and recipes (Setup, Configure, Deploy, Undeploy, Shutdown); Chef recipes run in that lifecycle order.

SSM Parameter Store vs Secrets Manager: Secrets Manager supports automatic rotation and cross-account access via resource policies; Parameter Store Standard has 4 KB value limit, Advanced 8 KB.

CloudFormation StackSets deploy stacks across accounts/Regions; service-managed permissions use Organizations, self-managed require IAM roles in target accounts.

Route 53 failover routing requires health checks; calculated health checks combine child checks with threshold and can drive failover of composite endpoints.

Multi-AZ RDS provides synchronous standby failover; Read Replicas are asynchronous and can be promoted but are not automatic failover targets.

S3 durability is 11 nines via replication across AZs within a Region; Cross-Region Replication requires versioning on source and destination.

Auto Scaling lifecycle hooks (autoscaling:EC2_INSTANCE_LAUNCHING/TERMINATING) pause instances in Pending:Wait or Terminating:Wait until heartbeat timeout or complete-lifecycle-action.

SQS visibility timeout should exceed consumer processing time; messages reappear after timeout, and max receive count drives the redrive policy to a DLQ.

DynamoDB global tables provide multi-Region active-active replication; last-writer-wins conflict resolution based on timestamps.

ELB cross-zone load balancing distributes traffic evenly across AZs; without it, each AZ node balances only within its own AZ.

AWS Backup supports cross-Region and cross-account copy via vaults and backup policies; vault lock enforces WORM retention.

CloudWatch metric math combines metrics with expressions; SEARCH() returns a metric array and can aggregate across dimensions.

CloudWatch Logs metric filters match patterns and increment metrics; filters apply only to newly ingested log events, not historical data.

CloudWatch alarm states: OK, ALARM, INSUFFICIENT_DATA; treat-missing-data can be set to missing, notBreaching, breaching, or ignore.

CloudWatch agent procstat and statsd plugins collect custom process and application metrics; agent config is JSON pushed via SSM Parameter Store or inline.

CloudTrail management events vs data events: data events (S3 object-level, Lambda invoke) are not logged by default and cost extra.

X-Ray segments contain subsegments; sampling rules control rate and reservoir; annotations are indexed and filterable, metadata is not.

CloudWatch Logs Insights query commands include fields, filter, stats, sort, limit, parse; stats supports count, avg, sum, min, max, pct.

Composite alarms combine multiple alarms with AND/OR and reduce alarm noise; they enter ALARM based on the rule expression over member states.

EventBridge rules match event patterns on source, detail-type, detail fields; targets include Lambda, SNS, SQS, SSM Automation, and Step Functions.

SSM Automation runbooks can remediate incidents triggered by EventBridge, e.g., stopping an instance or applying a security group; Automation has assume-role execution.

CloudWatch alarms can trigger EC2 actions (reboot, stop, terminate, recover) directly without Lambda; recover restores on new hardware for impaired instances.

AWS Health events surface via EventBridge (source aws.health) for scheduled maintenance and operational issues; can route to chat or ticketing.

SNS fan-out to SQS enables durable, retryable processing across multiple subscribers; DLQs capture failed deliveries.

Incident Manager integrates with CloudWatch alarms and contacts, creating incidents and engaging on-call via escalation plans.

Systems Manager OpsCenter aggregates operational issues (OpsItems) from EventBridge and CloudWatch for centralized triage.

Step Functions can orchestrate multi-step remediation with retries and error catching (Catch/Retry) per state.

IAM policy evaluation order: explicit Deny > Organizations SCP > resource policy > identity policy > permissions boundary; default is implicit deny.

KMS key policies are required for key access; cross-account use needs the key policy to grant the principal plus IAM policy in the caller account.

Secrets Manager rotation uses a Lambda rotation function with four steps: createSecret, setSecret, testSecret, finishSecret.

AWS Config rules evaluate resource compliance; conformance packs bundle rules and remediation actions; managed rules vs custom Lambda rules.

GuardDuty findings can route to EventBridge for automated remediation; Security Hub aggregates findings across accounts via Organizations.

S3 Block Public Access at account and bucket level overrides bucket policies that grant public access; four settings include block public ACLs and policies.

VPC Flow Logs capture accepted/rejected traffic metadata to CloudWatch Logs or S3; do not capture packet payloads.

Macie discovers sensitive data (PII) in S3 using managed data identifiers; findings integrate with Security Hub and EventBridge.