Orchestration and Automation
What the exam tests
Orchestration and Automation tests your ability to chain cloud actions into reliable, event-driven workflows and replace manual runbooks with code. Questions cover idempotency, retries, state, secrets, and least-privilege automation.
Core rules
- Orchestration coordinates multiple systems; automation executes a task. Both need idempotent steps so a retry does not duplicate resources.
- Use exponential backoff with jitter for transient failures; cap retries and route poison messages to a dead-letter queue.
- Store secrets in a managed secret store, never in scripts or environment variables committed to Git.
- Give automation only the permissions it needs; a remediation function should not run as an administrator.
- Version-control automation definitions and review them like application code.
Worked example
A bucket policy is accidentally made public. An EventBridge rule matches the PutBucketPolicy API call and invokes a Lambda. The Lambda reads bucket tags; if Environment is prod, it removes the public statement and posts to a security channel. Reasoning: the event handler is idempotent-re-running the check on an already-private bucket produces no change. The tag check prevents breaking a deliberately public sandbox. A DLQ captures failed invocations for replay.
Traps
Non-idempotent create scripts that fail on retry. Unbounded retry loops that amplify outages. Hard-coded credentials. Automations that run as root or admin to be safe. Missing dead-letter queues and alerting when automation itself fails.