AWS DevOps Engineer Professional flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CodeDeploy hook order

EC2 lifecycle: BeforeBlockTraffic, BlockTraffic, AfterBlockTraffic, ApplicationStop, DownloadBundle, BeforeInstall, Install, AfterInstall, ApplicationStart, ValidateService. Failing hooks abort deployment unless configured to continue.

CodePipeline stage parallelism

Actions inside a single stage run in parallel; stages run sequentially. A stage starts only after all actions in the preceding stage complete successfully.

CodeBuild buildspec phases

Phases execute in order: install, pre_build, build, post_build. Commands within a phase run sequentially; a nonzero exit fails the build unless on-failure is CONTINUE.

CodeDeploy Lambda canary config

Canary10Percent5Minutes shifts 10 percent of traffic for 5 minutes then the remainder. Linear10PercentEvery1Minute shifts 10 percent each minute. AllAtOnce shifts everything immediately.

Manual approval action

A CodePipeline approval action publishes to an SNS topic; the pipeline pauses until an IAM principal approves or rejects, or the action times out.

CloudFormation change set

A preview of stack updates showing ADD, MODIFY, and REMOVE actions. Replacement updates display a new physical resource ID and cause downtime or data loss.

Stack policy purpose

Prevents accidental updates to specified resources. Update:Replace denies replacement; Update:Modify denies in-place changes. Default allows all updates unless a policy is set.

DeletionPolicy Retain

Keeps the resource and its data when the stack is deleted or the resource is removed from the template, instead of deleting it. Snapshot captures a backup for supported types.

CloudFormation drift

Compares actual resource configuration to the template's expected state. Drifted resources report MODIFIED or DELETED, indicating out-of-band changes.

Secrets Manager vs Parameter Store

Secrets Manager offers automatic rotation and cross-account resource policies. Parameter Store Standard values max 4 KB, Advanced 8 KB, with optional encryption but no built-in rotation.

StackSets permissions models

Service-managed uses AWS Organizations to deploy across accounts. Self-managed requires IAM roles created in each target account and Region.

Route 53 failover routing

Uses health checks to route to a primary record while healthy and to a secondary record when the primary fails. Requires health checks on the primary endpoint.

RDS Multi-AZ vs Read Replica

Multi-AZ keeps a synchronous standby with automatic failover. Read Replicas are asynchronous copies used for scaling reads and require manual promotion.

SQS visibility timeout

The period a received message is hidden from other consumers. Should exceed processing time; if it expires before deletion, the message becomes visible again.

SQS redrive policy

Moves messages to a dead-letter queue after maxReceiveCount failed receives. Helps isolate poison messages and prevent repeated processing failures.

Auto Scaling lifecycle hook

Pauses instances in Pending:Wait or Terminating:Wait during launch or termination, allowing custom actions before complete-lifecycle-action or heartbeat timeout.

DynamoDB global tables

Multi-Region, multi-active replication where each replica can accept writes. Conflicts resolve last-writer-wins using timestamps; requires DynamoDB Streams enabled.

S3 Cross-Region Replication

Asynchronously replicates objects to a bucket in another Region. Requires versioning on source and destination buckets and an IAM role for replication.

CloudWatch metric math

Expressions combine existing metrics, for example summing errors across dimensions or computing rates. SEARCH returns a metric array for aggregation.

CloudWatch metric filter scope

Metric filters match patterns in log events and increment a metric. They apply only to newly ingested events, not to historical log data already stored.

CloudWatch alarm states

States are OK, ALARM, and INSUFFICIENT_DATA. Treat-missing-data can be set to missing, notBreaching, breaching, or ignore to control behavior.

CloudTrail data events

Object-level S3 operations and Lambda invocations. Not logged by default, require explicit configuration, and incur additional cost beyond management events.

X-Ray annotations vs metadata

Annotations are indexed key-value pairs usable in filter expressions. Metadata is stored but not indexed, so it cannot be used to filter traces.

CloudWatch Logs Insights commands

Query syntax includes fields, filter, stats, sort, limit, and parse. The stats command supports count, avg, sum, min, max, and pct aggregations.

Composite CloudWatch alarm

Combines multiple alarms using an AND/OR rule expression. Enters ALARM based on member alarm states, reducing noise from many individual alarms.

EventBridge event pattern

Matches events on fields such as source, detail-type, and detail. Matching events route to targets like Lambda, SNS, SQS, or SSM Automation.

SSM Automation remediation

Runbooks execute predefined steps with an assume-role execution role. EventBridge can trigger automation to remediate incidents automatically.

CloudWatch alarm EC2 actions

Alarms can directly reboot, stop, terminate, or recover an instance. Recover migrates an impaired instance to new hardware while keeping its ID.

AWS Health events

Scheduled maintenance and operational issues published to EventBridge under source aws.health, enabling automated notification or remediation workflows.

IAM policy evaluation order

Explicit Deny overrides everything. Then Organizations SCPs, resource policies, identity policies, and permissions boundaries apply. Default result is implicit deny.

KMS cross-account access

The key policy must grant the external principal, and the caller's IAM policy must allow the KMS action. Both conditions are required for cross-account use.

Secrets Manager rotation steps

A Lambda rotation function runs createSecret, setSecret, testSecret, and finishSecret in order, updating the secret and the backing resource.