Associate

AWS ML Engineer (MLA-C01) Exam Learning Path

AWS Certified Machine Learning Engineer - Associate (MLA-C01) Certificate
~ Last updated on : ~ jayendrapatil

AWS Certified Machine Learning Engineer – Associate (MLA-C01) Exam Learning Path

🔄 July 2026 Update: Refreshed with Amazon Bedrock AgentCore (GA Oct 2025), SageMaker Lakehouse, SageMaker AI with MLflow 3.0 (serverless), SageMaker HyperPod elastic training, and Amazon Nova models. The AWS Certified Machine Learning – Specialty (MLS-C01) was retired on March 31, 2026, making MLA-C01 the primary AWS certification for ML practitioners.

  • Certified for the last pending AWS Certified Machine Learning Engineer – Associate (MLA-C01) certification, which was newly introduced on October 8, 2024, following its beta period.
  • Machine Learning Engineer – Associate exam validates knowledge to build, operationalize, deploy, and maintain machine learning (ML) solutions and pipelines by using the AWS Cloud.
  • Exam also validates a candidate’s ability to complete the following tasks:
    • Ingest, transform, validate, and prepare data for ML modeling.
    • Select general modeling approaches, train models, tune hyperparameters, analyze model performance, and manage model versions.
    • Choose deployment infrastructure and endpoints, provision compute resources, and configure auto scaling based on requirements.
    • Set up continuous integration and continuous delivery (CI/CD) pipelines to automate orchestration of ML workflows.
    • Monitor models, data, and infrastructure to detect issues.
    • Secure ML systems and resources through access controls, compliance features, and best practices.

Refer AWS Certified Machine Learning Engineer – Associate (MLA-C01) Exam Guide

AWS Certified Machine Learning Engineer – Associate (MLA-C01) Exam Summary

  • MLA-C01 exam consists of 65 questions (50 scored and 15 unscored) in 130 minutes, and the time is more than sufficient if you are well-prepared.
  • MLA-C01 exam covers four domains:
    • Domain 1: Data Preparation for Machine Learning (28%)
    • Domain 2: ML Model Development (26%)
    • Domain 3: Deployment and Orchestration of ML Workflows (22%)
    • Domain 4: ML Solution Monitoring, Maintenance, and Security (24%)
  • In addition to the usual types of multiple-choice and multiple-response questions, the MLA-C01 exam has introduced the following new types
    • Ordering: Has a list of 3-5 responses which you need to select and place in the correct order to complete a specified task.
    • Matching: Has a list of responses to match with a list of 3-7 prompts. You must match all the pairs correctly to receive credit for the question.
    • Case study: A case study presents a single scenario with multiple questions. Each question is evaluated independently, and credit is given for each correct answer.
  • MLA-C01 has a scaled score between 100 and 1,000. The scaled score needed to pass the exam is 720.
  • Associate exams currently cost $150 + tax.
  • You can get an additional 30 minutes if English is your second language by requesting Exam Accommodations. It might not be needed for Associate exams but is helpful for Professional and Specialty ones.
  • AWS exams can be taken either remotely or online, I prefer to take them online as it provides a lot of flexibility. Just make sure you have a proper place to take the exam with no disturbance and nothing around you.
  • Also, if you are taking the AWS Online exam for the first time try to join at least 30 minutes before the actual time as I have had issues with both PSI and Pearson with long wait times.

AWS Certified Machine Learning Engineer – Associate (MLA-C01) Exam Resources

AWS Certified Machine Learning Engineer – Associate (MLA-C01) Exam Topics

  • AWS Certified Machine Learning Engineer – Associate exam covers a lot of Machine Learning concepts in addition to the AWS ML Services.
  • AWS Certified Machine Learning exam covers the Machine Learning lifecycle, data collection, transformation, making it usable and efficient for Machine Learning, pre-processing data for Machine Learning, training and validation, and implementation.
  • With the Q1 2026 refresh, the exam now includes increased coverage of Amazon Bedrock (Knowledge Bases, Agents, Guardrails, AgentCore), Generative AI workflows, and the unified SageMaker AI platform including Lakehouse and MLflow.

Machine Learning Concepts

  • Exploratory Data Analysis
    • Feature selection and Engineering
      • remove features that are not related to training
      • remove features that have the same values, very low correlation, very little variance, or a lot of missing values
      • Apply techniques like Principal Component Analysis (PCA) for dimensionality reduction i.e. reduce the number of features.
      • Apply techniques such as One-hot encoding and label encoding to help convert strings to numeric values, which are easier to process.
      • Apply Normalization i.e. values between 0 and 1 to handle data with large variance.
      • Apply feature engineering for feature reduction e.g. using a single height/weight feature instead of both features.
    • Handle Missing data
      • remove the feature or rows with missing data
      • impute using Mean/Median values – valid only for Numeric values and not categorical features also does not factor correlation between features
      • impute using k-NN, Multivariate Imputation by Chained Equation (MICE), Deep Learning – more accurate and helps factors correlation between features
    • Handle unbalanced data
      • Source more data
      • Oversample minority or Undersample majority
      • Data augmentation using techniques like Synthetic Minority Oversampling Technique (SMOTE).
  • Modeling
    • Know about Algorithms – Supervised, Unsupervised and Reinforcement and which algorithm is best suitable based on the available data either labelled or unlabelled.
      • Supervised learning trains on labeled data e.g. Linear regression. Logistic regression, Decision trees, Random Forests
      • Unsupervised learning trains on unlabelled data e.g. PCA, SVD, K-means
      • Reinforcement learning trained based on actions and rewards e.g. Q-Learning
    • Hyperparameters
      • are parameters exposed by machine learning algorithms that control how the underlying algorithm operates and their values affect the quality of the trained models
      • some of the common hyperparameters are learning rate, batch, epoch (hint: If the learning rate is too large, the minimum slope might be missed and the graph would oscillate. If the learning rate is too small, it requires too many steps which would take the process longer and is less efficient)
  • Evaluation
    • Know difference in evaluating model accuracy
      • Use Area Under the (Receiver Operating Characteristic) Curve (AUC) for Binary classification
      • Use root mean square error (RMSE) metric for regression
    • Understand Confusion matrix
      • A true positive is an outcome where the model correctly predicts the positive class. Similarly, a true negative is an outcome where the model correctly predicts the negative class.
      • A false positive is an outcome where the model incorrectly predicts the positive class. A false negative is an outcome where the model incorrectly predicts the negative class.
      • Recall or Sensitivity or TPR (True Positive Rate): Number of items correctly identified as positive out of total true positives- TP/(TP+FN) (hint: use this for cases like fraud detection, cost of marking non fraud as frauds is lower than marking fraud as non-frauds)
      • Specificity or TNR (True Negative Rate): Number of items correctly identified as negative out of total negatives- TN/(TN+FP) (hint: use this for cases like videos for kids, the cost of dropping few valid videos is lower than showing few bad ones)
    • Handle Overfitting problems
      • Simplify the model, by reducing the number of layers
      • Early Stopping – form of regularization while training a model with an iterative method, such as gradient descent
      • Data Augmentation
      • Regularization – technique to reduce the complexity of the model
      • Dropout is a regularization technique that prevents overfitting
      • Never train on test data

Machine Learning Services

SageMaker AI (formerly SageMaker)

Note: At re:Invent 2024, AWS rebranded Amazon SageMaker to Amazon SageMaker AI as part of the next-generation SageMaker platform that unifies data, analytics, and AI. The next-gen SageMaker umbrella includes SageMaker AI, SageMaker Lakehouse, and SageMaker Unified Studio.

  • supports both File mode, Pipe mode, and Fast File mode
    • File mode loads all of the data from S3 to the training instance volumes VS Pipe mode streams data directly from S3
    • File mode needs disk space to store both the final model artifacts and the full training dataset. VS Pipe mode which helps reduce the required size for EBS volumes.
    • Fast File mode combines the ease of use of the existing File Mode with the performance of Pipe Mode.
  • Using RecordIO format allows algorithms to take advantage of Pipe mode when training the algorithms that support it.
  • supports Model tracking capability to manage up to thousands of machine learning model experiments
  • supports automatic scaling for production variants. Automatic scaling dynamically adjusts the number of instances provisioned for a production variant in response to changes in your workload
  • provides pre-built Docker images for its built-in algorithms and the supported deep learning frameworks used for training & inference
  • SageMaker Automatic Model Tuning
    • is the process of finding a set of hyperparameters for an algorithm that can yield an optimal model.
    • Best practices
      • limit the search to a smaller number as the difficulty of a hyperparameter tuning job depends primarily on the number of hyperparameters that Amazon SageMaker has to search
      • DO NOT specify a very large range to cover every possible value for a hyperparameter as it affects the success of hyperparameter optimization.
      • log-scaled hyperparameter can be converted to improve hyperparameter optimization.
      • running one training job at a time achieves the best results with the least amount of compute time.
      • Design distributed training jobs so that they report the objective metric that you want.
  • know how to take advantage of multiple GPUs (hint: increase learning rate and batch size w.r.t to the increase in GPUs)
  • Elastic Inference (deprecated April 2023, replaced by AWS Inferentia) — previously helped attach low-cost GPU-powered acceleration to EC2 and SageMaker instances for deep learning inference. Use AWS Inferentia (Inf2 instances) or AWS Trainium (Trn1/Trn2 instances) for cost-effective ML acceleration.
  • SageMaker AI Inference options.
    • Real-time inference is ideal for online inferences that have low latency or high throughput requirements.
    • Serverless Inference is ideal for intermittent or unpredictable traffic patterns as it manages all of the underlying infrastructure with no need to manage instances or scaling policies.
    • Batch Transform is suitable for offline processing when large amounts of data are available upfront and you don’t need a persistent endpoint.
    • Asynchronous Inference is ideal when you want to queue requests and have large payloads with long processing times.
  • SageMaker AI Model deployment allows deploying multiple variants of a model to the same SageMaker endpoint to test new models without impacting the user experience
    • Production Variants
      • supports A/B or Canary testing where you can allocate a portion of the inference requests to each variant.
      • helps compare production variants’ performance relative to each other.
    • Shadow Variants
      • replicates a portion of the inference requests that go to the production variant to the shadow variant.
      • logs the responses of the shadow variant for comparison and not returned to the caller.
      • helps test the performance of the shadow variant without exposing the caller to the response produced by the shadow variant.
  • SageMaker Managed Spot training can help use spot instances to save cost and with Checkpointing feature can save the state of ML models during training
  • SageMaker Feature Store
    • helps to create, share, and manage features for ML development.
    • is a centralized store for features and associated metadata so features can be easily discovered and reused.
    • now supports Apache Iceberg table format, streaming ingestion, scalable batch ingestion, and fine-grained access control through AWS Lake Formation.
  • SageMaker Debugger provides tools to debug training jobs and resolve problems such as overfitting, saturated activation functions, and vanishing gradients to improve the model’s performance.
  • SageMaker Model Monitor monitors the quality of SageMaker machine learning models in production and can help set alerts that notify when there are deviations in the model quality.
  • SageMaker Automatic Model Tuning helps find a set of hyperparameters for an algorithm that can yield an optimal model.
  • SageMaker Data Wrangler
    • reduces the time it takes to aggregate and prepare tabular and image data for ML from weeks to minutes.
    • Note: Data Wrangler has been integrated into Amazon SageMaker Canvas. The new Data Wrangler experience in SageMaker Canvas includes a natural language interface in addition to the visual interface for data exploration and transformation.
  • SageMaker Experiments is a capability of SageMaker that lets you create, manage, analyze, and compare machine learning experiments.
  • SageMaker Clarify helps improve the ML models by detecting potential bias and helping to explain the predictions that the models make.
    • Pre-training bias metrics: CI, DPL, KL Divergence, JS Divergence
    • Post-training bias metrics: DI, DPD, DCA, AD, CDDPL
    • SHAP values for feature importance and individual prediction explanations
    • Foundation model evaluation for accuracy, toxicity, and robustness
    • Integrates with Model Monitor for continuous bias drift detection
  • SageMaker Model Governance is a framework that gives systematic visibility into ML model development, validation, and usage.
  • SageMaker Model Cards
    • helps document critical details about the ML models in a single place for streamlined governance and reporting.
    • helps capture key information about the models throughout their lifecycle and implement responsible AI practices.
  • SageMaker Autopilot
    • is an automated machine learning (AutoML) feature set that automates the end-to-end process of building, training, tuning, and deploying machine learning models.
    • Note: Autopilot UI has been migrated to Amazon SageMaker Canvas. Use SageMaker Canvas for no-code/low-code AutoML capabilities.
  • SageMaker Neo enables machine learning models to train once and run anywhere in the cloud and at the edge.
  • SageMaker API and SageMaker Runtime support VPC interface endpoints powered by AWS PrivateLink that helps connect VPC directly to the SageMaker API or SageMaker Runtime using AWS PrivateLink without using an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection.
  • SageMaker managed warm pools retain and reuse provisioned infrastructure after the training job completion to reduce latency for repetitive workloads.
  • SageMaker supports Elastic File System (EFS) and FSx for Lustre file systems as data sources for training machine learning models.
  • SageMaker MLOps
    • ML Lineage Tracking creates and stores tracking information about the steps of a ML workflow from data preparation to model deployment that can help reproduce the workflow steps, track model and dataset lineage, and establish model governance and audit standards.
    • Model Registry provides a model catalog, helps manage model versions, associate metadata, manage model approval status, deploy models to production and share models with other users.

SageMaker AI with MLflow (New – 2024/2025)

  • provides fully managed, serverless MLflow tracking for experiment tracking, model packaging, and model registry — no infrastructure to manage.
  • supports MLflow 3.0 (GA July 2025) with tracing capabilities to record inputs, outputs, and metadata at every step of a generative AI application.
  • helps track multiple training runs as experiments, compare runs with visualizations, evaluate models, and register the best models.
  • models registered in MLflow are automatically registered to SageMaker Model Registry with an associated SageMaker Model Card.
  • supports cross-account sharing, automated version upgrades, and integration with SageMaker Pipelines.
  • integrates with SageMaker HyperPod to track foundation model training experiments at scale.

SageMaker HyperPod (New – 2023/2024/2025)

  • purpose-built infrastructure for training and inference of foundation models at scale, reducing training time by up to 40%.
  • efficiently distributes and parallelizes training workloads across hundreds or thousands of AI accelerators (GPUs/Trainium chips).
  • continuously checks for hardware problems, resolves them automatically, and ensures workloads recover without manual intervention.
  • key features:
    • Checkpointless Training — maintains forward training progress despite failures using peer-to-peer transfer of model and optimizer states from healthy accelerators, enabling 95%+ training goodput and 80-93% reduction in recovery time.
    • Elastic Training (Dec 2025) — automatically adjusts the number of data-parallel replicas based on cluster utilization and priority of workloads.
    • Flexible Training Plans — helps meet training timelines and budgets with automated capacity planning.
    • Amazon EKS Integration — orchestrates HyperPod clusters via Amazon EKS, supporting containerized workloads, PyTorchJob auto-resume, and inference on the same cluster.
    • Interactive IDEs — supports running interactive workloads alongside training jobs with fractional GPU allocations.
  • integrates with Amazon CloudWatch Container Insights, Amazon Managed Prometheus, and Amazon Managed Grafana for observability.

SageMaker Lakehouse (New – re:Invent 2024)

  • a unified, open, and secure data lakehouse architecture built on Apache Iceberg that unifies data across S3 data lakes and Amazon Redshift data warehouses.
  • enables running analytics and ML workloads — including Apache Spark jobs, SQL dashboards, ML models, and generative AI applications — on a single copy of data.
  • key capabilities:
    • Unified access to Amazon S3 data lakes (including S3 Tables), Amazon Redshift data warehouses, and operational databases via zero-ETL integrations.
    • Fine-grained access control through AWS Lake Formation with consistent permissions across all query engines.
    • Compatible with Amazon Athena, Amazon EMR, AWS Glue, and Amazon Redshift for querying and analysis.
    • Fully compatible with Apache Iceberg REST API for open interoperability.
  • relevant to MLA-C01 Domain 1 (Data Preparation) — provides unified data access for ML feature engineering and training data preparation.

SageMaker Unified Studio (New – re:Invent 2024)

  • a unified interface combining data preparation, ML model development, generative AI, and governance.
  • integrates SageMaker AI, Amazon Bedrock, analytics, and data governance into a single platform.
  • supports one-click onboarding with existing IAM roles and permissions.
  • provides collaborative workspace for data engineers, ML engineers, and business analysts.

SageMaker Canvas

  • a visual, no-code/low-code ML service that enables building, evaluating, and deploying production-ready models without writing code.
  • now integrates Data Wrangler and Autopilot capabilities.
  • supports petabyte-scale data preparation and time series forecasting (replacing Amazon Forecast).
  • supports fine-tuning foundation models via Amazon Bedrock integration.

SageMaker Ground Truth

  • provides automated data labeling using machine learning
  • helps build highly accurate training datasets for machine learning quickly using Amazon Mechanical Turk
  • provides annotation consolidation to help improve the accuracy of the data object’s labels. It combines the results of multiple worker’s annotation tasks into one high-fidelity label.
  • automated data labeling uses machine learning to label portions of the data automatically without having to send them to human workers

Amazon Bedrock (Critical for 2026 Exam)

  • Amazon Bedrock is a fully managed service providing access to foundation models (FMs) from Amazon and third-party providers through a unified API.
    • supports models from Amazon (Nova, Titan), Anthropic (Claude), Meta (Llama), Mistral, Cohere, and others.
    • provides serverless experience — no infrastructure to manage.
  • Bedrock Knowledge Bases
    • enables RAG (Retrieval-Augmented Generation) by grounding FM responses in enterprise data.
    • automatically chunks documents, creates embeddings, and stores them in a vector database.
    • supports vector stores including Amazon OpenSearch Serverless, Amazon Aurora, Pinecone, and Redis Enterprise.
    • Managed Knowledge Base (GA June 2026) — fully managed RAG without managing vector databases or data pipelines.
    • integrates with Amazon Kendra GenAI Index for enhanced semantic retrieval.
  • Bedrock Agents
    • orchestrate multi-step generative AI workflows by connecting FMs to APIs and data sources.
    • automatically break down tasks, create orchestration plans, and execute actions.
    • support action groups (Lambda functions) and knowledge base integration.
  • Bedrock AgentCore (Preview Jul 2025, GA Oct 2025)
    • a dedicated platform to build, deploy, and operate AI agents at any scale with enterprise-grade security.
    • framework-agnostic and model-agnostic — works with any open-source agent framework (LangChain, CrewAI, AutoGen) and any model.
    • key components:
      • AgentCore Runtime — serverless, scalable environment to host and run agents without managing infrastructure; supports VPC, PrivateLink, and CloudFormation.
      • AgentCore Tools — pre-built tools including Code Interpreter, browser automation, and MCP (Model Context Protocol) connectors for enterprise data.
      • AgentCore Identity — manages authentication and fine-grained access control for agents connecting to third-party tools and data sources.
      • AgentCore Observability — tracing and monitoring for agent execution in production.
      • AgentCore Harness (GA 2026) — go from idea to production-grade agent in minutes with automated container packaging and deployment.
    • now included in MLA-C01 exam scope per Q1 2026 refresh.
  • Bedrock Guardrails
    • configurable safeguards to filter harmful content, block sensitive data (PII), and ensure compliance.
    • enforces deterministic controls independent of model’s reasoning quality.
    • supports content filters, denied topics, word filters, sensitive information filters, and contextual grounding checks.
    • can be associated with agents, knowledge bases, and direct model invocations.
  • Bedrock Model Evaluation
    • evaluate, compare, and select the best FM for a specific use case.
    • supports automatic evaluation (built-in metrics) and human evaluation.
  • Bedrock Model Customization
    • supports continued pre-training and fine-tuning of FMs with proprietary data.
    • supports Reinforcement Fine-Tuning (RFT) for Amazon Nova and open-source models.
    • Custom Model Import allows bringing SageMaker-trained models into Bedrock for serverless inference.
    • Model Distillation enables creating smaller, faster, cost-effective models from larger teacher models (e.g., Nova Premier → Nova Pro/Lite/Micro).
  • Bedrock Flows
    • visual builder for creating generative AI workflows connecting prompts, models, knowledge bases, and agents.

Amazon Nova Models

  • Amazon’s own family of foundation models available exclusively in Amazon Bedrock, launched at re:Invent 2024.
    • Nova Micro — text-only, fastest and lowest cost; optimized for summarization, translation, classification, and simple reasoning. 128K context.
    • Nova Lite — multimodal (text, image, video input → text output); cost-efficient for simple automation and document processing.
    • Nova Pro — multimodal; balanced capability, accuracy, speed, and cost for a wide range of tasks including agentic workflows.
    • Nova Premier — most capable; excels at complex tasks requiring deep context understanding, multistep planning, and multi-tool execution. Ideal as a teacher model for distillation.
  • All Nova models support fine-tuning and model distillation through Amazon Bedrock.
  • Nova 2 family (2025) offers next-generation improvements in intelligence and cost-efficiency.

Machine Learning & AI Managed Services

  • Comprehend
    • natural language processing (NLP) service to find insights and relationships in text.
    • identifies the language of the text; extracts key phrases, places, people, brands, or events; understands how positive or negative the text is; analyzes text using tokenization and parts of speech; and automatically organizes a collection of text files by topic.
  • Rekognition – analyze images and video to identify objects, people, text, scenes, and activities in images and videos, as well as detect any inappropriate content.
  • Transcribe – automatic speech recognition (ASR) speech-to-text
  • Kendra – an intelligent search service that uses NLP and advanced ML algorithms to return specific answers to search questions from your data.
    • Kendra GenAI Index (New – re:Invent 2024) — delivers highest accuracy for RAG and intelligent search using latest information retrieval technologies and semantic models.
    • integrates with Amazon Q Business and Amazon Bedrock Knowledge Bases.
  • Augmented AI (Amazon A2I) is an ML service that makes it easy to build the workflows required for human review.
  • Amazon Q Developer (formerly CodeWhisperer) — AI-powered coding assistant for building, deploying, and operating applications on AWS.

Generative AI

Refer: AWS AI & Generative AI Services Cheat Sheet

  • MLA-C01 covers Generative AI concepts with increased emphasis post-Q1 2026 refresh, including practical AWS Bedrock integration.
  • Foundation Models:
    • Large, pre-trained models built on diverse data that can be fine-tuned for specific tasks like text, image, and speech generation. for e.g. GPT, BERT, DALL·E, Amazon Nova, Claude, Llama.
  • Large Language Models (LLMs):
    • A subset of foundation models designed to understand and generate human-like text. Capable of answering questions, summarizing, translating, and more.
    • LLM Components
      • Tokens: Basic units of text (words, subwords, or characters) that LLMs process.
      • Vectors: Numerical representations of tokens in high-dimensional space, enabling the model to perform mathematical operations on text.
      • Embeddings: Pre-trained numerical vector representations of tokens that capture their semantic meaning.
      • Attention Mechanism: Allows models to weigh the importance of different tokens in a sequence relative to each other (e.g., self-attention in Transformers).
  • Prompt Engineering:
    • Crafting effective input instructions to guide generative AI toward desired outputs. Key for improving performance without fine-tuning the model.
    • Techniques include zero-shot, few-shot, chain-of-thought (CoT), and ReAct prompting.
  • Retrieval-Augmented Generation (RAG):
    • Combines LLMs with external knowledge bases to retrieve accurate and up-to-date information during text generation.
    • Reduces hallucinations by grounding responses in verified enterprise data.
    • AWS Implementation: Amazon Bedrock Knowledge Bases + vector stores.
  • Fine-Tuning:
    • Adjusting pre-trained models using domain-specific data to optimize performance for specific applications.
    • AWS options: Amazon Bedrock fine-tuning, SageMaker AI fine-tuning (SFT, DPO, RLVR, RLAIF).
  • Responsible AI Features:
    • Incorporates fairness, transparency, and bias mitigation techniques to ensure ethical AI outputs.
    • Amazon Bedrock Guardrails provides managed responsible AI controls.
  • Multi-Modal Capabilities:
    • Models that process and generate outputs across multiple data types, such as text, images, and audio.
    • Amazon Nova models support text, image, and video generation.
  • Controls
    • Temperature: Adjusts randomness in the output; lower values (e.g., 0.2) produce focused and deterministic results, while higher values (e.g., 1.0+) generate creative and diverse outputs.
    • Top P (Nucleus Sampling): Determines the probability threshold for token selection — with Top P = 0.9, the model considers only the smallest set of tokens whose cumulative probability is 90%.
    • Top K: Limits the token selection to the top K most probable tokens — with Top K = 10, the model randomly chooses tokens only from the 10 most likely options.
    • Token Length (Max Tokens): Sets the maximum number of tokens the model can generate in a response.

Analytics

  • Kinesis
  • Glue is a fully managed, ETL (extract, transform, and load) service that automates the time-consuming steps of data preparation for analytics
    • helps setup, orchestrate, and monitor complex data flows.
    • Glue Data Catalog is a central repository to store structural and operational metadata for all the data assets.
    • Glue crawler connects to a data store, extracts the schema of the data, and then populates the Glue Data Catalog with this metadata
    • Glue DataBrew is a visual data preparation tool that enables users to clean and normalize data without writing any code.

Security, Identity & Compliance

  • SageMaker can read data from KMS-encrypted S3. Make sure, the KMS key policies include the role attached with SageMaker
  • Amazon Bedrock supports AWS PrivateLink for private connectivity, encryption at rest and in transit, and IAM-based access control.
  • Bedrock AgentCore supports VPC isolation, PrivateLink, and fine-grained IAM permissions for agent-to-tool authentication.

Management & Governance Tools

  • Understand AWS CloudWatch for Logs and Metrics. (hint: SageMaker is integrated with CloudWatch and logs and metrics are all stored in it)

Deprecated Services to Be Aware Of

  • Amazon Elastic Inference — deprecated April 2023. Use AWS Inferentia (Inf2 instances) or AWS Trainium (Trn1/Trn2 instances) for cost-effective ML inference/training acceleration.
  • SageMaker Edge Manager — discontinued April 26, 2024. Use AWS IoT Greengrass V2 with ONNX format for edge ML deployments.
  • Amazon Forecast — closed to new customers July 29, 2024. Use SageMaker Canvas for time series forecasting.
  • SageMaker Studio Classic — replaced by the updated SageMaker Studio experience and SageMaker Unified Studio.
  • AWS Certified Machine Learning – Specialty (MLS-C01) — retired March 31, 2026. MLA-C01 is now the primary ML certification.

Practice Questions (2025-2026 Updates)

  1. A company is training a large language model with 70 billion parameters across 256 GPUs. During training, individual GPU nodes occasionally fail, causing the entire job to restart from the last checkpoint. This adds days to the training timeline. Which AWS service minimizes the impact of hardware failures on foundation model training?
    1. Amazon SageMaker AI training jobs with managed spot instances
    2. Amazon SageMaker HyperPod with checkpointless training
    3. Amazon EC2 P5 instances with EBS snapshots
    4. AWS Batch with retry strategies
    Show Answer

    Answer: B. – SageMaker HyperPod with checkpointless training automatically detects and replaces faulty nodes, then recovers training using peer-to-peer transfer of model states from healthy accelerators — achieving 95%+ training goodput and 80-93% reduction in recovery time without relying on checkpoint files.

  2. A machine learning team wants to deploy an AI agent that can access company databases, execute code, and call external APIs autonomously. The agent must run in a production environment with enterprise security controls, VPC isolation, and the ability to scale to thousands of concurrent requests. The team uses LangChain as their agent framework. Which AWS service should they use?
    1. Amazon Bedrock Agents
    2. Amazon Bedrock AgentCore
    3. AWS Lambda with Amazon Bedrock API calls
    4. Amazon ECS with a custom agent container
    Show Answer

    Answer: B. – Amazon Bedrock AgentCore provides a framework-agnostic (including LangChain) and model-agnostic platform for deploying production-grade AI agents with serverless scaling, VPC/PrivateLink support, built-in identity management for tool authentication, and observability — all without managing infrastructure.

  3. A data science team needs to track experiments across multiple foundation model fine-tuning runs on SageMaker HyperPod, compare metrics visually, and automatically register the best model for deployment. They want to avoid managing any tracking infrastructure. Which solution meets these requirements with LEAST operational overhead?
    1. Deploy a self-managed MLflow server on Amazon EC2 and configure SageMaker to log metrics
    2. Use Amazon SageMaker AI with serverless MLflow and SageMaker Model Registry integration
    3. Use Amazon CloudWatch custom metrics with CloudWatch dashboards
    4. Use SageMaker Experiments with manual model registration
    Show Answer

    Answer: B. – SageMaker AI with serverless MLflow provides fully managed, infrastructure-free experiment tracking that integrates with HyperPod, automatically scales, and automatically registers models to SageMaker Model Registry with an associated Model Card — the least operational overhead for this workflow.

  4. A company wants to build a RAG-based chatbot that answers questions using internal documents. They need to ensure the chatbot never reveals personally identifiable information (PII) from the documents and does not generate responses about competitors. Which combination of Amazon Bedrock features should they use? (Choose TWO)
    1. Bedrock Knowledge Bases
    2. Bedrock Model Customization with continued pre-training
    3. Bedrock Guardrails with sensitive information filters and denied topics
    4. Bedrock AgentCore Code Interpreter
    5. Amazon Comprehend PII detection
    Show Answer

    Answer: A, C – Bedrock Knowledge Bases provides the RAG capability to ground responses in internal documents. Bedrock Guardrails with sensitive information filters (PII blocking) and denied topics (competitor mentions) enforces deterministic controls to prevent PII leakage and off-topic responses regardless of the model’s reasoning.

  5. An organization is preparing ML training datasets that span data in Amazon S3 data lakes, Amazon Redshift data warehouses, and Amazon DynamoDB operational tables. They want to access all this data through a unified interface with consistent fine-grained access controls for their SageMaker AI training jobs. Which service provides this unified data access?
    1. AWS Glue Data Catalog with Lake Formation permissions
    2. Amazon SageMaker Lakehouse
    3. Amazon Athena federated queries
    4. Amazon Redshift Spectrum
    Show Answer

    Answer: B. – Amazon SageMaker Lakehouse provides a unified, open (Apache Iceberg-based) data lakehouse that unifies access to S3 data lakes (including S3 Tables), Redshift data warehouses, and operational databases via zero-ETL integrations — all with consistent fine-grained access controls through AWS Lake Formation.

Whitepapers and Articles

Related AWS AI/ML Certifications

  • AWS Certified AI Practitioner (AIF-C01) — foundational-level certification for understanding AI/ML concepts and AWS AI services.
  • AWS Certified Generative AI Developer – Professional (AIP-C01) — professional-level certification for building production-ready generative AI solutions using Amazon Bedrock. Launched late 2025 (GA April 2026).
  • AWS Certified Machine Learning – Specialty (MLS-C01) — retired March 31, 2026. Holders retain active certification for 3 years from date earned.

AWS Architecture Patterns for MLA-C01

On the Exam Day

  • Make sure you are relaxed and get some good night’s sleep. The exam is not tough if you are well-prepared.
  • If you are taking the AWS Online exam
    • Try to join at least 30 minutes before the actual time as I have had issues with both PSI and Pearson with long wait times.
    • The online verification process does take some time and usually, there are glitches.
    • Remember, you would not be allowed to take the take if you are late by more than 30 minutes.
    • Make sure you have your desk clear, no hand-watches, or external monitors, keep your phones away, and nobody can enter the room.

Finally, All the Best 🙂

AWS Certified SysOps Administrator – Associate (SOA-C02) Exam Learning Path

AWS SysOps Administor - Associate SOA-C02 Certification
~ Last updated on : ~ jayendrapatil

AWS Certified CloudOps Engineer – Associate (SOA-C03) Exam Learning Path

⚠️ EXAM UPDATED – SOA-C02 RETIRED

The AWS Certified SysOps Administrator – Associate (SOA-C02) was retired on September 29, 2025.

It has been replaced by the AWS Certified CloudOps Engineer – Associate (SOA-C03), which launched on September 30, 2025.

This is not just a rename — SOA-C03 adds containers (ECS, EKS), multi-account architectures, new question types, and updated domain weightings.

Key Changes:

  • Exam duration increased to 180 minutes with 50-65 questions
  • New question types: ordering, matching, and case study questions
  • Containers (ECS, EKS, ECR) are now in-scope
  • Greater emphasis on automation, multi-account, and multi-Region architectures
  • Five domains (previously six) with updated weightings

This learning path has been updated for SOA-C03. If you hold the old SysOps certification, it remains valid until its expiration date.

  • The AWS Certified CloudOps Engineer – Associate (SOA-C03) validates skills for cloud operations professionals who deploy, manage, and operate workloads on AWS.
  • SOA-C03 replaced the SOA-C02 (SysOps Administrator) exam in September 2025, reflecting the industry shift toward modern cloud operations practices.

AWS Certified CloudOps Engineer – Associate (SOA-C03) Exam Content

  • AWS CloudOps Engineer – Associate SOA-C03 is intended for CloudOps engineers responsible for managing production AWS environments.
  • SOA-C03 validates a candidate’s ability to:
    • Deploy, manage, and operate workloads on AWS
    • Support and maintain AWS workloads according to the AWS Well-Architected Framework
    • Perform operations by using the AWS Management Console and the AWS CLI
    • Implement security controls to meet compliance requirements
    • Monitor, log, and troubleshoot systems
    • Apply networking concepts (for example, DNS, TCP/IP, firewalls)
    • Implement architectural requirements (for example, high availability, performance, capacity)
    • Perform business continuity and disaster recovery procedures
    • Identify, classify, and remediate incidents
    • [NEW] Deploy and manage containerized workloads (ECS, EKS)
    • [NEW] Implement multi-account governance and automation

Refer AWS Certified CloudOps Engineer – Associate (SOA-C03) Exam Guide

AWS Certified CloudOps Engineer – Associate (SOA-C03) Exam Domains

Domain Weight Focus Areas
Domain 1: Monitoring, Logging, Analysis, Remediation & Performance Optimization 22% CloudWatch, X-Ray, troubleshooting, cost optimization
Domain 2: Reliability and Business Continuity 22% High availability, Auto Scaling, backup, disaster recovery
Domain 3: Deployment, Provisioning, and Automation 22% CloudFormation, Systems Manager, IaC, CI/CD basics
Domain 4: Networking and Content Delivery 18% VPC, Route 53, CloudFront, load balancing
Domain 5: Security and Compliance 16% IAM, encryption, compliance, Organizations, SCPs

AWS Certified CloudOps Engineer – Associate (SOA-C03) Exam Summary

  • SOA-C03 exam details:
    • Duration: 180 minutes
    • Questions: 50-65 questions
    • Question types: Multiple-choice, multiple-response, ordering, matching, and case study
    • Passing score: Scaled scoring (720 out of 1000)
    • Cost: $150 USD + tax
    • Delivery: Pearson VUE test center or online proctoring
  • SOA-C03 exam does NOT include hands-on exam labs (the labs from SOA-C02 were not brought back).
  • You can get an additional 30 minutes if English is your second language by requesting Exam Accommodations.
  • AWS exams can be taken either at a test center or online. Just make sure you have a proper place to take the exam with no disturbance and nothing around you.
  • If you are taking the AWS Online exam, try to join at least 30 minutes before the actual time as there can be issues with both PSI and Pearson with long wait times.

AWS Certified CloudOps Engineer – Associate (SOA-C03) Exam Resources

AWS Certified CloudOps Engineer – Associate (SOA-C03) Exam Topics

SOA-C03 focuses on cloud operations including monitoring, automation, security, reliability, and networking — with the ability to deploy, manage, operate, and automate workloads on AWS.

Monitoring, Logging, Analysis, Remediation & Performance (Domain 1 – 22%)

  • CloudWatch
    • collects monitoring and operational data in the form of logs, metrics, and events, and visualizes it.
      • EC2 metrics can track (disk, network, CPU, status checks) but do not capture metrics like memory, disk swap, disk storage, etc.
      • CloudWatch unified agent can be used to gather custom metrics like memory, disk swap, disk storage, etc.
      • CloudWatch Alarm actions can be configured to perform actions based on various metrics for e.g. CPU below 5%
      • CloudWatch alarm can monitor StatusCheckFailed_System status on an EC2 instance and automatically recover the instance if it becomes impaired.
      • [NEW] CloudWatch Composite Alarms combine multiple alarms using AND/OR logic to reduce alarm noise.
      • [NEW] CloudWatch Anomaly Detection uses machine learning to detect unusual metric patterns.
      • [NEW] CloudWatch Container Insights provides automatic dashboards for ECS and EKS metrics (CPU, memory, network, storage).
      • [NEW] CloudWatch Cross-account observability enables searching log groups across multiple accounts and running cross-account Logs Insights queries.
      • [NEW] CloudWatch Application Signals provides APM capabilities for distributed applications.
      • Know ELB monitoring
        • Load Balancer metrics SurgeQueueLength and SpilloverCount
        • HealthyHostCount, UnHealthyHostCount determines the number of healthy and unhealthy instances.
        • Reasons for 4XX and 5XX errors
    • CloudWatch logs can be used to monitor, store, and access log files from EC2 instances, CloudTrail, Route 53, and other sources. You can create metric filters over the logs.
    • [NEW] CloudWatch Logs Insights enables interactive searching and analyzing of log data with a purpose-built query language.
    • CloudWatch Subscription Filters can be used to send logs to Kinesis Data Streams, Lambda, or Kinesis Data Firehose.
    • EventBridge is a serverless event bus service that connects applications with data from a variety of sources.
    • EventBridge can be used as a trigger for periodically scheduled events and automated remediation.
    • CloudWatch unified agent helps collect metrics and logs from EC2 instances and on-premises servers.
  • [NEW] AWS X-Ray provides distributed tracing for applications, helping analyze and debug production issues across microservices.
  • CloudTrail for audit and governance
    • With Organizations, the trail can be configured to log CloudTrail from all accounts to a central account.
    • CloudTrail log file integrity validation can be used to check whether a log file was modified or deleted.
  • [NEW] AWS Compute Optimizer provides EC2, Lambda, and EBS right-sizing recommendations based on utilization data.
  • Trusted Advisor provides recommendations covering security, performance, cost, fault tolerance & service limits.
  • [NEW] AWS Budgets with budget actions can automatically enforce cost controls (e.g., stop EC2 instances when budget exceeded).
  • Cost allocation tags can be used to differentiate resource costs and analyzed using Cost Explorer.
  • Understand how to setup Billing Alerts using CloudWatch.

Reliability and Business Continuity (Domain 2 – 22%)

  • Understand Auto Scaling
    • Auto Scaling can be configured with multiple AZs for high availability
    • Auto Scaling attempts to distribute instances evenly between the AZs
    • Auto Scaling supports
      • Dynamic scaling (target tracking, step scaling) in response to changing demand
      • Predictive scaling uses machine learning to forecast demand
      • Schedule scaling for predictable load changes
      • Manual scaling by changing the desired capacity
    • Auto Scaling life cycle hooks can be used to perform activities before instance termination.
    • [NEW] Warm pools help reduce latency by maintaining pre-initialized instances.
  • Understand ELB, ALB, and NLB
    • Understand key differences ELB vs ALB vs NLB
    • ALB provides content and path routing
    • NLB provides the ability to give static IPs to the load balancer
    • LB access logs provide the source IP address
    • Supports Sticky sessions to bind a user’s session to a specific target
    • [NEW] ALB supports weighted target groups for blue/green deployments
  • RDS provides managed relational database
    • Understand RDS Multi-AZ vs Read Replicas
    • Multi-AZ deployment provides high availability and failover support
    • Read replicas enable increased scalability and database availability
    • Automated backups enable point-in-time recovery up to the last five minutes
    • [NEW] RDS Multi-AZ DB Cluster provides two readable standby instances in different AZs with faster failover.
  • Aurora is a fully managed MySQL- and PostgreSQL-compatible database
    • Backtracking “rewinds” the DB cluster to the specified time (in-place restore)
    • Automated Backups that help restore the DB as a new instance
    • [NEW] Aurora Serverless v2 scales instantly to match demand without capacity planning.
  • AWS Backup can be used to automate backup for EC2 instances, EBS, RDS, EFS, and DynamoDB
    • [NEW] AWS Backup Vault Lock prevents backup deletion (compliance mode for immutable backups).
    • [NEW] Cross-Region and cross-account backup copying for disaster recovery.
  • [NEW] AWS Elastic Disaster Recovery (DRS) provides affordable and scalable disaster recovery with continuous block-level replication, fast recovery (minutes), and non-disruptive testing.
  • Data Lifecycle Manager to automate the creation, retention, and deletion of EBS snapshots and EBS-backed AMIs.

Deployment, Provisioning, and Automation (Domain 3 – 22%)

  • CloudFormation
    • provides an easy way to create and manage a collection of related AWS resources.
    • CloudFormation Concepts cover
      • Templates act as a blueprint for provisioning of AWS resources
      • Stacks are collection of resources as a single unit
      • Change Sets present a summary/preview of proposed changes when a stack is updated
      • Nested stacks are stacks created as part of other stacks
    • CloudFormation template anatomy consists of resources, parameters, outputs, and mappings.
    • CloudFormation supports multiple features
      • Drift detection to detect whether a stack’s actual configuration differs from its expected configuration
      • Termination protection prevents accidental stack deletion
      • Stack policy prevents unintentional updates or deletes during a stack update
      • StackSets create, update, or delete stacks across multiple accounts and Regions
      • Helper scripts (cfn-init, cfn-signal, cfn-hup) with creation policies
      • DependsOn attribute controls resource creation order
      • Update policy supports rolling and replacing updates with AutoScaling
      • Deletion policies to retain or backup resources during stack deletion
      • Custom resources for use cases not natively supported
    • Understand CloudFormation Best Practices esp. Nested Stacks and logical grouping
  • Elastic Beanstalk helps quickly deploy and manage applications without worrying about infrastructure.
  • ⚠️ AWS OpsWorks Stacks reached End of Life on May 26, 2024 and has been disabled for both new and existing customers. Migration options include AWS Systems Manager, CloudFormation, or third-party tools like Ansible/Terraform.
  • Systems Manager is the operations hub for AWS
    • Parameter Store provides secure, hierarchical storage for configuration data and secrets. Does not support rotation – use Secrets Manager for rotation.
    • Session Manager provides secure instance management without SSH keys or bastion hosts.
    • Patch Manager automates patching managed instances with security and other updates.
    • [NEW] Systems Manager Automation documents (runbooks) for automated remediation workflows.
    • [NEW] Just-in-time node access removes long-standing permissions while maintaining operational efficiency (launched April 2025).
    • [NEW] Default Host Management Configuration (DHMC) simplifies EC2 instance onboarding to Systems Manager without IAM instance profiles.
  • AWS Config provides resource inventory, configuration history, and change notifications for compliance.
    • supports managed and custom rules evaluated periodically or on events, with automatic remediation
    • Conformance pack is a collection of Config rules and remediation actions deployable across an organization.
  • Understand CloudFormation vs Elastic Beanstalk (note: OpsWorks is now deprecated)

Networking & Content Delivery (Domain 4 – 18%)

  • VPC – Virtual Private Cloud is a virtual network in AWS
  • Route 53 provides a scalable DNS system
    • supports ALIAS record type to map zone apex records to ELB, CloudFront, and S3
    • Understand Routing Policies and their use cases
      • Failover – active-passive failover
      • Geolocation – route based on user location
      • Geoproximity – route based on resource location with traffic shifting
      • Latency – route to the Region with best latency
      • Weighted – route traffic in specified proportions
      • Multivalue answer – DNS-level load balancing with health checks
    • Focus on Weighted, Latency, and Failover routing policies
  • Understand CloudFront and use cases
    • CloudFront can be used with S3 to expose static data and website
    • [NEW] Origin Access Control (OAC) replaces Origin Access Identity (OAI) for S3 origins with better security
  • Know VPN and Direct Connect for AWS to on-premises connectivity.

Security and Compliance (Domain 5 – 16%)

  • IAM provides Identity and Access Management
    • Focus on IAM role and its use case, especially with EC2 instances
    • Understand IAM identity providers and federation
    • Understand cross-account access configuration
    • [NEW] IAM Access Analyzer identifies resources shared externally and validates policies
    • [NEW] Permission boundaries set maximum permissions for IAM entities
  • AWS Organizations
  • Control Tower
    • Setup, govern, and secure a multi-account environment
    • Strongly recommended guardrails cover EBS encryption
    • [NEW] Controls-dedicated experience with 750+ managed controls without full Control Tower deployment (Nov 2025)
    • [NEW] Automatic enrollment of accounts when moved to an OU (Nov 2025)
    • [NEW] Landing Zone v4.0 with modular integrations
  • S3 Encryption supports data at rest and in transit encryption
  • Understand KMS for key management and envelope encryption
    • KMS with imported customer key material does not support automatic rotation
    • [NEW] KMS supports automatic key rotation for customer managed keys (yearly)
  • AWS WAF – Web Application Firewall protects against common web exploits (XSS, SQL Injection, bots)
  • AWS GuardDuty – threat detection service that continuously monitors for malicious activity
    • [NEW] GuardDuty EKS Protection monitors Kubernetes audit logs for threats
  • Secrets Manager securely stores and rotates credentials
    • Integrates with Lambda for credential rotation
  • AWS Shield – managed DDoS protection service
  • Amazon Inspector – automated vulnerability assessment
    • [NEW] Inspector v2 provides continuous scanning of EC2, Lambda, and container images in ECR without manual setup
  • AWS Certificate Manager (ACM) manages SSL/TLS certificates
  • [NEW] AWS Security Hub aggregates security findings across accounts and services with automated compliance checks
  • Service Catalog allows organizations to manage approved IT services with minimal permissions
  • Know AWS Artifact for on-demand access to compliance reports

Compute

  • Understand EC2 in depth
    • Understand EC2 instance types and use cases (including Graviton-based instances for cost optimization).
    • Understand EC2 purchase options esp. spot instances, Savings Plans, and reserved instances.
    • Understand EC2 Metadata & Userdata.
    • Understand EC2 Security
      • Use IAM Role with EC2 instances to access services
      • IAM Role can be attached to stopped and running instances
    • AMIs provide the information required to launch an instance
      • AMIs are regional and can be shared publicly or with other accounts
      • Only AMIs with unencrypted volumes or encrypted with CMK can be shared
      • Use prebaked/golden images to reduce startup time. Leverage EC2 Image Builder.
    • Troubleshooting EC2 issues
      • RequestLimitExceeded
      • InstanceLimitExceeded – request increase in limits
      • InsufficientInstanceCapacity – change AZ or Instance Type
    • Monitoring EC2 instances
      • System status checks failure – Stop and Start
      • Instance status checks failure – Reboot
    • EC2 Instance Recovery – recovered instance is identical (same ID, private IPs, EIPs, metadata)
    • EC2 Image Builder for pre-baked images
  • Understand Placement groups
    • Cluster – low latency, HPC within a Single AZ
    • Spread – each instance on distinct hardware across AZs
    • Partition – group of instances spread across partitions/racks across AZs
  • Understand Lambda and its use cases
    • Lambda can be hosted in VPC with internet access via NAT Gateway
    • RDS Proxy provides connection pooling to reduce database connections

Containers (NEW in SOA-C03)

  • Amazon ECS (Elastic Container Service) – AWS-native container orchestration
    • Understand Task Definitions (blueprint for containers), Services, and Clusters
    • Task Role vs Execution Role – critical distinction:
      • Task Role: IAM permissions for the container application (accessing S3, DynamoDB, etc.)
      • Execution Role: Permissions for ECS agent (pulling images from ECR, writing logs)
    • Launch Types:
      • Fargate: AWS manages infrastructure, less operational overhead
      • EC2: You manage container instances, more control
    • ECS Exec for container troubleshooting (requires SSM agent and IAM permissions)
    • Service Discovery using AWS Cloud Map
    • Container Insights for monitoring (CPU, memory, network metrics)
  • Amazon EKS (Elastic Kubernetes Service) – managed Kubernetes
    • Cluster management: creating, updating, and maintaining clusters
    • Managed and self-managed node groups
    • Fargate profiles for serverless pod execution
    • IAM Roles for Service Accounts (IRSA)
    • Control plane logging to CloudWatch
  • Amazon ECR (Elastic Container Registry) – managed container image registry
    • Image scanning for vulnerabilities
    • Lifecycle policies for image cleanup
    • Cross-region and cross-account replication
  • ECS vs EKS decision:
    • ECS: AWS-native simplicity, tight AWS integration, smaller teams
    • EKS: Kubernetes expertise exists, multi-cloud portability needed, complex scheduling

Storage

  • S3 provides object storage
    • Understand storage classes with lifecycle policies
    • [NEW] S3 Intelligent-Tiering with Archive Access and Deep Archive tiers (no retrieval charges)
    • S3 data protection – encryption at rest (SSE-S3 default since Jan 2023) and in transit
    • Multi-part handling for large file uploads
    • Static website hosting, CORS
    • S3 Versioning for accidental deletes and overwrites recovery
    • Pre-Signed URLs for upload and download
    • S3 Transfer Acceleration for long-distance transfers via CloudFront edge locations
  • Understand Glacier as archival storage (Glacier Instant Retrieval, Flexible Retrieval, Deep Archive)
  • Understand EBS storage
  • Storage Gateway for hybrid cloud storage
    • S3 File Gateway, FSx File Gateway, Volume Gateway, Tape Gateway
  • EFS – serverless, scalable file storage
    • Supports data at rest encryption only during creation
    • General purpose and Max I/O performance modes
    • If hitting PercentIOLimit move to Max I/O performance mode
  • FSx for Windows supports SMB protocol with Multi-AZ high availability
  • AWS DataSync automates moving data between on-premises and S3/EFS

Databases

  • Know ElastiCache for caching performance
    • Understand ElastiCache Redis vs Memcached
    • Redis provides Multi-AZ, persistence, and online resharding
    • ElastiCache can be used as a caching layer for RDS
  • Know DynamoDB basics – not covered in detail

Analytics

  • Amazon Athena for querying S3 data with SQL without data duplication
  • OpenSearch (formerly Elasticsearch) for distributed search and analytics
    • Production setup: 3 AZs, 3 dedicated master nodes, 6 data nodes with two replicas per AZ

Integration Tools

  • Understand SQS as a message queuing service and SNS as pub/sub notification
    • Focus on SQS as a decoupling service
    • Understand SQS FIFO and differences between standard and FIFO
  • Understand CloudWatch integration with SNS for notification

Practice Labs

  • Create IAM users, IAM roles with specific limited policies.
  • Create a private S3 bucket
    • enable versioning
    • enable default encryption
    • enable lifecycle policies to transition and expire the objects
    • enable same region replication
  • Create a public S3 bucket with static website hosting
  • Set up a VPC with public and private subnets with Routes, SGs, NACLs.
  • Set up a VPC with public and private subnets and enable communication from private subnets to the Internet using NAT gateway
  • Create EC2 instance, create a Snapshot and restore it as a new instance.
  • Set up Security Groups for ALB and Target Groups, and create ALB, Launch Template, Auto Scaling Group, and target groups with sample applications.
  • Create Multi-AZ RDS instance and force failover.
  • Set up SNS topic. Use CloudWatch Metrics to create a CloudWatch alarm on specific thresholds and send notifications to the SNS topic.
  • Set up SNS topic. Use CloudWatch Logs to create a CloudWatch alarm on log patterns and send notifications.
  • Update a CloudFormation template and re-run the stack and check the impact.
  • Use AWS Data Lifecycle Manager to define snapshot lifecycle.
  • Use AWS Backup to define EFS backup with hourly and daily backup rules.
  • [NEW] Deploy a containerized application on ECS Fargate with appropriate task roles.
  • [NEW] Set up CloudWatch Container Insights for an ECS cluster.
  • [NEW] Create a Systems Manager Automation runbook for automated remediation.
  • [NEW] Configure AWS Config rules with auto-remediation using SSM Automation.
  • [NEW] Set up EventBridge rules to trigger Lambda functions for operational automation.
  • [NEW] Configure VPC endpoints for S3 and DynamoDB (Gateway endpoints) and for other services (Interface endpoints).

AWS Certified CloudOps Engineer – Associate (SOA-C03) Exam Day

  • Make sure you are relaxed and get some good night’s sleep. The exam is not tough if you are well-prepared.
  • If you are taking the AWS Online exam
    • Try to join at least 30 minutes before the actual time.
    • The online verification process does take some time and usually, there are glitches.
    • Remember, you would not be allowed to take the exam if you are late by more than 30 minutes.
    • Make sure you have your desk clear, no hand-watches or external monitors, keep your phones away, and nobody can enter the room.
  • With 180 minutes for 50-65 questions, you have approximately 2.5 minutes per question — more generous than SOA-C02.
  • New question types (ordering, matching, case study) may require more time — pace yourself accordingly.
  • Use the process of elimination and flag uncertain questions for review.

Finally, All the Best 🙂

AWS Certified Developer – Associate DVA-C02 Exam Learning Path

AWS Certified Developer - Associate Certification
~ Last updated on : ~ jayendrapatil

AWS Certified Developer – Associate DVA-C02 Exam Learning Path

  • AWS Certified Developer – Associate DVA-C02 exam is the latest AWS exam released on 27th February 2023 and has replaced the previous AWS Developer – Associate DVA-C01 certification exam.
  • I passed the AWS Developer – Associate DVA-C02 exam with a score of 835/1000.

AWS Certified Developer – Associate DVA-C02 Exam Content

  • DVA-C02 validates a candidate’s ability to demonstrate proficiency in developing, testing, deploying, and debugging AWS cloud-based applications.
  • DVA-C02 also validates a candidate’s ability to complete the following tasks:
    • Develop and optimize applications on AWS
    • Package and deploy by using continuous integration and continuous delivery (CI/CD) workflows
    • Secure application code and data
    • Identify and resolve application issues

Refer AWS Certified Developer – Associate Exam Blue Print

AWS Certified Developer - Associate Domains

DVA-C02 Exam Guide Version 2.1 Update (December 2024)

  • AWS revised the DVA-C02 exam guide to Version 2.1 on December 12, 2024, adding 18 new skills and updating in-scope services.
  • Key new skills added:
    • Use Amazon Q Developer for development assistance
    • Implement event-driven patterns using Amazon EventBridge
    • Implement resilient application code (retry logic, circuit breakers, error handling patterns)
    • Implement Lambda functions for real-time data processing and transformation
    • Use specialized data stores based on access patterns (e.g., Amazon OpenSearch Service)
    • Implement application-level authorization for fine-grained access control
    • Handle cross-service authentication in microservices architectures
    • Implement application-level data masking and sanitization
    • Implement data access patterns for multi-tenant applications
    • Prepare application configurations for different environments (e.g., AWS AppConfig)
    • Test event-driven applications
    • Use Amazon Q Developer to generate automated tests
    • Debug service integration issues in applications
    • Create application health checks and readiness probes
    • Implement application-level caching for improved performance
    • Implement structured logging for application events and user actions
    • Configure deployment strategies (blue/green, canary, rolling) for application releases
  • Services added to in-scope: Amazon Q Developer
  • Services removed from in-scope: AWS Copilot (EOL June 2026), Amazon CodeGuru (EOL November 2025)
  • Refer DVA-C02 Exam Guide Revisions

AWS Certified Developer – Associate DVA-C02 Summary

  • DVA-C02 exam consists of 65 questions in 130 minutes, and the time is more than sufficient if you are well-prepared.
  • DVA-C02 exam includes two types of questions, multiple-choice and multiple-response.
  • DVA-C02 has a scaled score between 100 and 1,000. The scaled score needed to pass the exam is 720.
  • Associate exams currently cost $ 150 + tax.
  • You can get an additional 30 minutes if English is your second language by requesting Exam Accommodations. It might not be needed for Associate exams but is helpful for Professional and Specialty ones.
  • AWS exams can be taken either remotely or online, I prefer to take them online as it provides a lot of flexibility. Just make sure you have a proper place to take the exam with no disturbance and nothing around you.
  • Also, if you are taking the AWS Online exam for the first time try to join at least 30 minutes before the actual time as I have had issues with both PSI and Pearson with long wait times.

AWS Certified Developer – Associate DVA-C02 Exam Resources

AWS Certified Developer – Associate DVA-C02 Exam Topics

  • AWS DVA-C02 exam concepts cover solutions that fall within AWS Well-Architected framework to cover scalable, highly available, cost-effective, performant, and resilient pillars.
  • AWS Certified Developer – Associate DVA-C02 exam covers a lot of the latest AWS services like Amplify, X-Ray, Amazon Q Developer while focusing majorly on other services like Lambda, DynamoDB, Elastic Beanstalk, S3, EC2
  • The December 2024 exam revision (Version 2.1) added focus on event-driven architectures, resilient coding patterns, multi-tenant data access, and AI-assisted development using Amazon Q Developer.
  • AWS Certified Developer – Associate DVA-C02 exam is similar to DVA-C01 with more focus on the hands-on development and deployment concepts rather than just the architectural concepts.

Compute

  • Elastic Cloud Compute – EC2
  • Auto Scaling and ELB
    • Auto Scaling provides the ability to ensure a correct number of EC2 instances are always running to handle the load of the application
    • Elastic Load Balancer allows the incoming traffic to be distributed automatically across multiple healthy EC2 instances
  • Autoscaling & ELB
    • work together to provide High Availability and Scalability.
    • Span both ELB and Auto Scaling across Multi-AZs to provide High Availability
    • Do not span across regions. Use Route 53 or Global Accelerator to route traffic across regions.
  • Lambda and serverless architecture, its features, and use cases.
    • Lambda integrated with API Gateway to provide a serverless, highly scalable, cost-effective architecture.
    • Lambda execution role needs the required permissions to integrate with other AWS services.
    • Environment variables to keep functions configurable.
    • Lambda Layers provide a convenient way to package libraries and other dependencies that you can use with your Lambda functions.
    • Function versions can be used to manage the deployment of the functions.
    • Function Alias supports creating aliases, which are mutable, for each function version.
    • provides /tmp ephemeral scratch storage.
    • Integrates with X-Ray for distributed tracing.
    • Use RDS proxy for connection pooling.
    • Lambda SnapStart – reduces cold start latency to sub-second for Java (GA 2022), and now also supports Python and .NET functions (GA November 2024). Works by caching and reusing snapshotted memory and disk state.
    • Recursive loop detection – automatically detects and stops recursive invocations between Lambda and supported services (SQS, SNS, S3) after 16 invocations. Function-level configuration APIs added (August 2024) to customize behavior.
    • Advanced logging controls – supports structured JSON logging format, configurable log levels, and choice of log destination. Tiered pricing for CloudWatch Logs introduced (May 2025).
  • Elastic Container Service – ECS with its ability to deploy containers and microservices architecture.
    • ECS role for tasks can be provided through taskRoleArn
    • ALB provides dynamic port mapping to allow multiple same tasks on the same node.
  • Elastic Kubernetes Service – EKS
    • managed Kubernetes service to run Kubernetes in the AWS cloud and on-premises data centers
    • ideal for migration of an existing workload on Kubernetes
  • Elastic Beanstalk
    • at a high level, what it provides, and its ability to get an application running quickly.
    • Deployment types with their advantages and disadvantages

Databases

  • Understand relational and NoSQL data storage options which include RDS, DynamoDB, and Aurora with their use cases
  • Relational Database Service – RDS
    • Read Replicas vs Multi-AZ
      • Read Replicas for scalability, Multi-AZ for High Availability
      • Multi-AZ is regional only
      • Read Replicas can span across regions and can be used for disaster recovery
  • RDS Proxy
    • fully managed, highly available database proxy for RDS that makes applications more secure, scalable, more resilient to database failures.
    • allows apps to pool and share DB connections established with the database
  • DynamoDB
    • provides low latency performance, a key-value store
    • is not a relational database
    • Secondary indexes on a table allow efficient access to data with attributes other than the primary key.
    • Know Local Secondary Indexes vs Global Secondary Indexes
    • DynamoDB DAX provides caching for DynamoDB
    • DynamoDB TTL helps expire data in DynamoDB without any cost or consuming any write throughput.
    • DynamoDB Streams provides a time-ordered sequence of item-level changes made to data in a table and integrates with Lambda.
    • DynamoDB Best Practices around designing partition keys and secondary indexes.
    • DynamoDB Zero-ETL integration with Amazon Redshift (GA October 2024) – enables running analytics on DynamoDB data without managing ETL pipelines.
    • Price reductions (November 2024) – 50% reduction for on-demand throughput and up to 67% for global tables.
    • Global tables cross-account replication (2025) – supports replication across AWS accounts for multi-account architectures.
  • ElastiCache use cases, mainly for caching performance

Storage

  • Simple Storage Service – S3
    • S3 storage classes with lifecycle policies
      • Understand the difference between SA Standard vs SA IA vs SA IA One Zone in terms of cost and durability
    • S3 Data Protection
      • S3 Client-side encryption encrypts data before storing it in S3
      • S3 encryption in transit can be enforced with S3 bucket policies using secureTransport attributes.
      • S3 encryption at rest can be enforced with S3 bucket policies using x-amz-server-side-encryption attribute.
    • S3 features including
      • S3 provides cost-effective static website hosting. However, it does not support HTTPS endpoint. Can be integrated with CloudFront for HTTPS, caching, performance, and low-latency access.
      • S3 versioning provides protection against accidental overwrites and deletions. Used with MFA Delete feature.
      • S3 Pre-Signed URLs for both upload and download provide access without needing AWS credentials.
      • S3 CORS allows cross-domain calls
      • S3 Transfer Acceleration enables fast, easy, and secure transfers of files over long distances between your client and an S3 bucket.
      • S3 Event Notifications to trigger events on various S3 events like objects added or deleted. Supports SQS, SNS, Lambda functions, and Amazon EventBridge.
      • Integrates with Amazon Macie to detect PII data
      • Replication that supports the same and cross-region replication required versioning to be enabled.
      • Integrates with Athena to analyze data in S3 using standard SQL.
  • Instance Store
    • is physically attached to the EC2 instance and provides the lowest latency and highest IOPS
  • Elastic Block Storage – EBS
    • EBS volume types and their use cases in terms of IOPS and throughput. SSD for IOPS and HDD for throughput
  • Elastic File System – EFS
    • simple, fully managed, scalable, serverless, and cost-optimized file storage for use with AWS Cloud and on-premises resources.
    • provides shared volume across multiple EC2 instances, while EBS can be attached to a single instance within the same AZ or EBS Multi-Attach can be attached to multiple instances within the same AZ
    • can be mounted with Lambda functions
    • supports the NFS protocol, and is compatible with Linux-based AMIs
    • supports cross-region replication and storage classes for cost management.
  • Difference between EBS vs S3 vs EFS
  • Difference between EBS vs Instance Store
  • Would recommend referring Storage Options whitepaper, although a bit dated 90% still holds right

Security & Identity

  • Identity Access Management – IAM
    • IAM role
      • provides permissions that are not associated with a particular user, group, or service and are intended to be assumable by anyone who needs it.
      • can be used for EC2 application access and Cross-account access
    • IAM Best Practices
  • Cognito
    • provides authentication, authorization, and user management for the web and mobile apps.
    • User pools are user directories that provide sign-up and sign-in options for the app users.
    • Identity pools enable you to grant the users access to other AWS services.
  • Key Management Services – KMS encryption service
    • for key management and envelope encryption
    • provides encryption at rest and does not handle encryption in transit.
  • Amazon Certificate Manager – ACM
    • helps easily provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services and internally connected resources.
  • AWS Secrets Manager
    • helps protect secrets needed to access applications, services, and IT resources.
    • supports automatic rotations of secrets
  • Secrets Manager vs Systems Manager Parameter Store for secrets management
    • Secrets Manager supports automatic credentials rotation and is integrated with Lambda and other services like RDS, and DynamoDB.
    • Systems Manager Parameter Store provides free standard parameters and is cost-effective as compared to Secrets Manager.

Front-end Web and Mobile

  • API Gateway
    • is a fully managed service that makes it easy for developers to publish, maintain, monitor, and secure APIs at any scale.
    • Powerful, flexible authentication mechanisms, such as AWS IAM policies, Lambda authorizer functions, and Amazon Cognito user pools.
    • supports Canary release deployments for safely rolling out changes.
    • define usage plans to meter, restrict third-party developer access, configure throttling, and quota limits on a per API key basis
    • integrates with AWS X-Ray for understanding and triaging performance latencies.
    • API Gateway CORS allows cross-domain calls
  • Amplify
    • is a complete solution that lets frontend web and mobile developers easily build, ship, and host full-stack applications on AWS, with the flexibility to leverage the breadth of AWS services as use cases evolve.

Management Tools

  • CloudWatch
    • monitoring to provide operational transparency
    • is extendable with custom metrics
    • does not capture memory metrics, by default, and can be done using the CloudWatch agent.
  • EventBridge
    • is a serverless event bus service that makes it easy to connect applications with data from a variety of sources.
    • enables building loosely coupled and distributed event-driven architectures.
    • (New in V2.1) Understand implementing event-driven patterns using EventBridge for decoupled, scalable architectures.
  • CloudTrail
    • helps enable governance, compliance, and operational and risk auditing of the AWS account.
    • helps to get a history of AWS API calls and related events for the AWS account.
  • CloudFormation
    • easy way to create and manage a collection of related AWS resources, and provision and update them in an orderly and predictable fashion.
    • Supports Serverless Application Model – SAM for the deployment of serverless applications including Lambda.
    • CloudFormation StackSets extends the functionality of stacks by enabling you to create, update, or delete stacks across multiple accounts and Regions with a single operation.
  • AWS AppConfig (capability of AWS Systems Manager)
    • (New in V2.1) Used to prepare application configurations for different environments.
    • Helps create, manage, and deploy application configurations including feature flags.
    • Integrates with Lambda via the AppConfig Agent Lambda extension for dynamic configuration without redeployment.
    • Supports gradual deployment with rollback on errors.

Integration Tools

  • Simple Queue Service
    • as message queuing service and SNS as pub/sub notification service
    • as a decoupling service and provide resiliency
    • SQS features like visibility, and long poll vs short poll
    • provide scaling for the Auto Scaling group based on the SQS size.
    • SQS Standard vs SQS FIFO difference
      • FIFO provides exactly-once delivery but with low throughput
  • Simple Notification Service – SNS
    • is a web service that coordinates and manages the delivery or sending of messages to subscribing endpoints or clients
    • Fanout pattern can be used to push messages to multiple subscribers.
  • Understand SQS as a message queuing service and SNS as a pub/sub notification service.
  • Know AWS Developer tools
    • CodeCommit is a secure, scalable, fully-managed source control service that hosts private Git repositories. Note: CodeCommit was briefly deprecated in July 2024 but returned to General Availability in November 2025. However, it remains in feature freeze with no new features planned.
    • CodeBuild is a fully managed build service that compiles source code, runs tests, and produces software packages that are ready to deploy.
    • CodeDeploy helps automate code deployments to any instance, including EC2 instances and instances running on-premises.
    • CodePipeline is a fully managed continuous delivery service that helps automate the release pipelines for fast and reliable application and infrastructure updates.
    • CodeArtifact is a fully managed artifact repository service that makes it easy for organizations of any size to securely store, publish, and share software packages used in their software development process.
  • X-Ray
    • helps developers analyze and debug production, distributed applications for e.g. built using a microservices lambda architecture

AI-Assisted Development (New in V2.1)

  • Amazon Q Developer
    • AI-powered development assistant added to DVA-C02 in-scope services (December 2024 revision).
    • Provides code generation, debugging assistance, code transformation, and security scanning.
    • Can generate automated tests for application code.
    • Supports code optimization and refactoring recommendations.
    • Note: AWS announced end-of-support for Amazon Q Developer IDE plugins (April 30, 2027) with successor being Kiro IDE. The exam currently tests Q Developer concepts.

Resilient Application Patterns (New in V2.1)

  • Implement resilient application code for third-party service integrations:
    • Retry logic – exponential backoff with jitter for transient failures
    • Circuit breakers – prevent cascading failures by stopping requests to failing services
    • Error handling patterns – graceful degradation, fallback responses
    • Health checks and readiness probes – application-level health monitoring
  • Cross-service authentication in microservices architectures
  • Data access patterns for multi-tenant applications
  • Application-level data masking and sanitization

Analytics

  • Redshift as a business intelligence tool
  • Kinesis
    • for real-time data capture and analytics.
    • Integrates with Lambda functions to perform transformations
  • AWS Glue
    • fully-managed, ETL service that automates the time-consuming steps of data preparation for analytics
  • Amazon OpenSearch Service
    • (New in V2.1) Use specialized data stores based on access patterns.
    • Provides search, log analytics, and real-time application monitoring.

Networking

  • Does not cover much networking or designing networks, but be sure you understand VPC, Subnets, Routes, Security Groups, etc.

AWS Cloud Computing Whitepapers

Deprecated/Removed Services (No Longer in DVA-C02 Scope)

  • AWS Copilot CLI – Reached end-of-support on June 12, 2026. Use ECS Express Mode or AWS CDK for containerized deployments instead. Removed from exam scope in December 2024 revision.
  • Amazon CodeGuru – End of support November 20, 2025. Functionality replaced by Amazon Q Developer for code reviews and security scanning. Removed from exam scope in December 2024 revision.

On the Exam Day

  • Make sure you are relaxed and get some good night’s sleep. The exam is not tough if you are well-prepared.
  • If you are taking the AWS Online exam
    • Try to join at least 30 minutes before the actual time as I have had issues with both PSI and Pearson with long wait times.
    • The online verification process does take some time and usually, there are glitches.
    • Remember, you would not be allowed to take the take if you are late by more than 30 minutes.
    • Make sure you have your desk clear, no hand-watches, or external monitors, keep your phones away, and nobody can enter the room.

Finally, All the Best 🙂

HashiCorp Terraform Associate Certification Path

~ Last updated on : ~ jayendrapatil ~ 8 Comments

📢 Exam Update Notice (January 2026)

The Terraform Associate (003) exam was retired on January 7, 2026. The new Terraform Associate (004) exam launched on January 8, 2026, aligned with Terraform v1.12 and HCP Terraform (formerly Terraform Cloud).

Key 004 Changes:

  • Reorganized into 8 objectives (previously 9 in 003)
  • New topics: import blocks, moved/removed blocks, check blocks, custom conditions, ephemeral values & write-only arguments
  • Terraform Cloud renamed to HCP Terraform throughout
  • terraform taint deprecated — replaced by terraform apply -replace
  • Enhanced coverage of HCP Terraform workspaces and projects

Note: IBM acquired HashiCorp (closed February 2025). Terraform’s license changed from MPL 2.0 to BSL 1.1 in August 2023 (v1.6+). OpenTofu is the community open-source fork under Linux Foundation.

If you are working on a multi-cloud environment and focusing on automation, you would surely have been using Terraform or considered it at some point of time. I have been using Terraform for over two years now for provisioning infrastructure on AWS, GCP and AliCloud right through development to production and it has been a wonderful DevOps journey and It was good to validate the Terraform skills through the Terraform Associate certification.

Terraform is for Cloud Engineers specializing in operations, IT, or development who know the basic concepts and skills associated with open source HashiCorp Terraform. As of 2024, Terraform is now licensed under BSL 1.1 and the managed cloud service is branded as HCP Terraform (formerly Terraform Cloud).

HashiCorp Certified Terraform Associate (004) Exam Summary

  • HashiCorp Certified Terraform Associate (004) exam focuses on Terraform Community Edition and HCP Terraform concepts
  • The exam has 57 questions with a time limit of 60 minutes
  • Exam has multiple answer, multiple choice, fill in the blanks and True/False type of questions
  • The exam is aligned with Terraform v1.12 and covers HCP Terraform features
  • Questions and answer options are pretty short and if you have experience on Terraform they are pretty easy and the time is more than sufficient.
  • The 004 exam has 8 objective domains (down from 9 in 003), with restructured and updated content

HashiCorp Certified Terraform Associate (004) Exam Topic Summary

Refer Terraform Cheat Sheet for details

1. Infrastructure as Code (IaC) with Terraform

  • Explain what IaC is
    • Infrastructure is described using a high-level configuration syntax (HCL – HashiCorp Configuration Language)
    • IaC allows Infrastructure to be versioned and treated as you would any other code.
    • Infrastructure can be shared and re-used.
  • Describe advantages of IaC patterns
    • makes Infrastructure more reliable
    • makes Infrastructure more manageable
    • makes Infrastructure more automated and less error prone
    • enables reproducibility and consistency across environments
  • Explain how Terraform manages multi-cloud, hybrid cloud, and service-agnostic workflows
    • using multi-cloud setup increases fault tolerance and reduces dependency on a single Cloud
    • Terraform provides a cloud-agnostic framework and allows a single configuration to be used to manage multiple providers, and to even handle cross-cloud dependencies.
    • Terraform simplifies management and orchestration, helping operators build large-scale multi-cloud infrastructures.

2. Terraform Fundamentals

  • Install and version Terraform providers
    • Providers provide abstraction above the upstream API and is responsible for understanding API interactions and exposing resources.
    • Terraform configurations must declare which providers they require, so that Terraform can install and use them
    • Provider requirements are declared in a required_providers block.
    • Terraform uses a dependency lock file (.terraform.lock.hcl) to track provider versions and ensure consistent installations.
  • Describe how Terraform uses providers (plugin-based architecture)
    • Terraform relies on plugins called “providers” to interact with remote systems.
    • Terraform finds and installs providers when initializing a working directory. It can automatically download providers from a Terraform registry, or load them from a local mirror or cache.
    • Each Terraform module must declare which providers it requires, so that Terraform can install and use them.
  • Write Terraform configuration using multiple providers
    • supports multiple provider instances using alias for e.g. multiple aws providers with different region
  • Explain how Terraform uses and manages state
    • State is a necessary requirement for Terraform to function.
    • Terraform requires some sort of database to map Terraform config to the real world.
    • Terraform uses its own state structure for mapping configuration to resources in the real world
    • Terraform state helps
      • track metadata such as resource dependencies.
      • provides performance as it stores a cache of the attribute values for all resources in the state
      • aids syncing when using in team with multiple users

3. Core Terraform Workflow

  • Describe Terraform workflow ( Write → Plan → Apply )
    • Core Terraform workflow has three steps:
      • Write – Author infrastructure as code.
      • Plan – Preview changes before applying.
      • Apply – Provision reproducible infrastructure.
  • Initialize a Terraform working directory terraform init
    • initializes a working directory containing Terraform configuration files.
    • performs backend initialization, modules and plugins installation.
    • providers are downloaded in the sub-directory of the present working directory at the path of .terraform/providers
    • creates a dependency lock file (.terraform.lock.hcl) to record provider versions
    • does not delete the existing configuration or state
  • Validate a Terraform configuration terraform validate
    • validates the configuration files in a directory, referring only to the configuration and not accessing any remote services such as remote state, provider APIs, etc.
    • verifies whether a configuration is syntactically valid and internally consistent, regardless of any provided variables or existing state.
    • useful for general verification of reusable modules, including the correctness of attribute names and value types.
  • Generate and review an execution plan for Terraform terraform plan
    • terraform plan creates an execution plan as it traverses each vertex and requests each provider using parallelism
    • calculates the difference between the last-known state and the current state and presents this difference as the output of the terraform plan operation to user in their terminal
    • does not modify the infrastructure or state.
    • allows a user to see which actions Terraform will perform prior to making any changes to reach the desired state
    • performs refresh for each resource and might hit rate limiting issues as it calls provider APIs
    • all resources refresh can be disabled or avoided using
      • -refresh=false or
      • -target=xxxx or
      • break resources into different directories.
  • Apply changes to infrastructure with Terraform terraform apply
    • will always ask for confirmation before executing unless passed the -auto-approve flag.
    • if a resource successfully creates but fails during provisioning, Terraform will error and mark the resource as “tainted”. Terraform does not roll back the changes
    • supports -replace=ADDRESS flag to force recreation of a specific resource (replaces the deprecated terraform taint command)
  • Destroy Terraform managed infrastructure terraform destroy
    • will always ask for confirmation before executing unless passed the -auto-approve flag.
    • equivalent to terraform apply -destroy
  • Apply formatting and style adjustments terraform fmt
    • terraform fmt helps format code into a standard format. It usually aligns the spaces and matches the =
    • use -recursive flag to format files in subdirectories

4. Terraform Configuration

  • Use and differentiate resource and data configuration
    • Resources describe one or more infrastructure objects, such as virtual networks, instances, or higher-level components such as DNS records.
    • Data sources allow data to be fetched or computed for use elsewhere in Terraform configuration. Use of data sources allows a Terraform configuration to make use of information defined outside of Terraform, or defined by another separate Terraform configuration.
  • Use resource addressing and resource parameters to connect resources together
  • Use variables and outputs
    • Variables
      • serve as parameters for a Terraform module and
      • act like function arguments
      • count is a reserved word and cannot be used as variable name
      • Variable precedence (highest to lowest): -var and -var-file on CLI → *.auto.tfvars → terraform.tfvars → Environment variables (TF_VAR_)
    • Output
      • are like function return values.
      • can be marked sensitive which prevents showing its value in the list of outputs. However, they are stored in the state as plain text.
  • Understand the use of collection and structural types
    • supports primitive data types of
      • string, number and bool
      • automatically convert number and bool values to string values
    • supports complex data types of
      • list – sequence of values identified by consecutive whole numbers starting with zero.
      • map – collection of values where each is identified by a string label
      • set – collection of unique values that do not have any secondary identifiers or ordering.
    • supports structural data types of
      • object – a collection of named attributes with their own type
      • tuple – a sequence of elements identified by consecutive whole numbers starting with zero, where each element has its own type.
  • Write dynamic configuration using expressions and functions
    • lookup retrieves the value of a single element from a map, given its key. If the given key does not exist, a the given default value is returned instead. lookup(map, key, default)
    • zipmap constructs a map from a list of keys and a corresponding list of values. zipmap(["a", "b"], [1, 2]) results into {"a" = 1, "b" = 2}
    • dynamic blocks act much like a for expression, but produce nested blocks instead of a complex typed value. It iterates over a given complex value, and generates a nested block for each element of that complex value.
    • Overuse of dynamic blocks is not recommended as it makes the code hard to understand and debug
  • Define resource dependencies in configuration
    • Terraform analyses any expressions within a resource block to find references to other objects and treats those references as implicit ordering requirements when creating, updating, or destroying resources.
    • Explicit dependency can be defined using the depends_on attribute where dependencies between resources that are not visible
    • Lifecycle meta-argument create_before_destroy ensures the replacement resource is created before the original is destroyed
  • Validate configuration using custom conditions (New in 004)
    • check blocks define assertions about infrastructure that run during plan and apply
    • Preconditions and postconditions can be added to resources and data sources using lifecycle blocks
    • Variable validation blocks allow custom validation rules for input variables
  • Understand best practices for managing sensitive data (New in 004)
    • Ephemeral values (Terraform 1.10+) are temporary values that are not persisted to state or plan files
    • Write-only arguments allow resource arguments to be set but never read back from state
    • Use HashiCorp Vault provider for dynamic secrets injection
    • Terraform has no mechanism to redact secrets returned via data sources — secrets are persisted into state
    • Protect state with encryption and proper access control using remote backends
  • Supports comments using #, // and /* */

5. Terraform Modules

  • Explain how Terraform sources modules
    • Terraform Module Registry allows you to browse, filter and search for modules
    • Modules can be sourced from: local paths, Terraform Registry, GitHub, Bitbucket, S3 buckets, GCS buckets, and generic git repos
  • Describe variable scope within modules/child modules
    • Modules are called from within other modules using module blocks
    • All modules require a source argument, which is a meta-argument defined by Terraform
    • Input variables serve as parameters for a Terraform module, allowing aspects of the module to be customized without altering the module’s own source code
    • Resources defined in a module are encapsulated, so the calling module cannot access their attributes directly.
    • Child module can declare output values to selectively export certain values to be accessed by the calling module module.module_name.output_value
  • Use modules in configuration
    • To call a module means to include the contents of that module into the configuration with specific values for its input variables.
  • Manage module versions
    • must be on GitHub and must be a public repo, if using public registry.
    • must be named terraform-<PROVIDER>-<NAME>, where <NAME> reflects the type of infrastructure the module manages and <PROVIDER> is the main provider where it creates that infrastructure. for e.g. terraform-google-vault or terraform-aws-ec2-instance.
    • must maintain x.y.z tags for releases to identify module versions. Tags can optionally be prefixed with a v for example, v1.0.4 and 0.9.2. Tags that don’t look like version numbers are ignored.
    • must maintain a Standard module structure, which allows the registry to inspect the module and generate documentation, track resource usage, parse submodules and examples, and more.

6. Terraform State Management

  • Describe the local backend
    • A “backend” in Terraform determines how state is loaded and how an operation such as apply is executed.
    • determines how state is loaded and how an operation such as apply is executed
    • is responsible for storing state and providing an API for optional state locking
    • needs to be initialized
    • helps
      • collaboration and working as a team, with the state maintained remotely and state locking
      • can provide enhanced security for sensitive data
      • support remote operations
    • local (default) backend stores state in a local JSON file on disk
  • Describe state locking
    • happens for all operations that could write state, if supported by backend
    • prevents others from acquiring the lock & potentially corrupting the state
    • use force-unlock command to manually unlock the state if unlocking failed
    • backends which support state locking include:
      • AWS S3 — now supports native S3 state locking (Terraform 1.10+, Nov 2024) without DynamoDB. Legacy DynamoDB-based locking is being deprecated.
      • azurerm
      • Google Cloud Storage (GCS)
      • HashiCorp Consul
      • Kubernetes Secret with locking done using a Lease resource
      • PostgreSQL
      • HCP Terraform / Terraform Enterprise
      • HTTP endpoints
  • Configure remote state using the backend block
    • Backend configuration doesn’t support interpolations.
    • supports partial configuration with remaining configuration arguments provided as part of the initialization process
    • if switching the backend for the first time setup, Terraform provides a migration option
    • remote backend stores state remotely like S3, GCS, Consul and supports features like remote operation, state locking, encryption, versioning etc.
  • Manage resource drift and Terraform state
    • terraform plan -refresh-only (preferred) or terraform refresh (legacy) is used to reconcile the state Terraform knows about with the real-world infrastructure.
    • can be used to detect any drift from the last-known state, and to update the state file.
    • does not modify infrastructure but does modify the state file.
    • moved blocks (Terraform 1.1+) — refactor resources (rename, move to/from modules) without destroying and recreating them
    • removed blocks (Terraform 1.7+) — remove resources from state without destroying the actual infrastructure
    • Use terraform state command for advanced state management:
      • mv – to move/rename modules
      • rm – to safely remove resource from the state
      • pull – to observe current remote state
      • list & show – to view state resources
  • Handle backend authentication methods
    • every remote backend supports different authentication mechanisms and can be configured with the backend configuration

7. Maintain Infrastructure with Terraform

  • Import existing infrastructure into your Terraform workspace
    • terraform import (CLI command) helps import already-existing external resources into Terraform state
    • import blocks (Terraform 1.5+) — declarative import that can generate configuration. Preferred over CLI import.
    • Run terraform plan -generate-config-out=generated.tf to auto-generate configuration for imported resources
  • Use the CLI to inspect state
    • terraform state list — list resources in state
    • terraform state show — show attributes of a single resource
    • recommended not to edit the state manually
  • Describe when and how to use verbose logging
    • debugging can be controlled using TF_LOG, which can be configured for different levels TRACE, DEBUG, INFO, WARN or ERROR, with TRACE being the most verbose.
    • logs path can be controlled using TF_LOG_PATH. TF_LOG needs to be specified.
    • Separate core and provider logs with TF_LOG_CORE and TF_LOG_PROVIDER
  • Given a scenario: choose when to use terraform workspace to create workspaces
    • Terraform workspace helps manage multiple distinct sets of infrastructure resources or environments with the same code.
    • state files for each workspace are stored in the directory terraform.tfstate.d
    • terraform workspace new dev creates a new workspace with name dev and switches to it as well
    • does not provide strong separation as it uses the same backend
  • Understand provisioners (use as last resort)
    • Terraform provides local-exec and remote-exec provisioners
      • local-exec executes code on the machine running terraform
      • remote-exec executes on the resource provisioned and supports ssh and winrm
    • Provisioners should only be used as a last resort — HashiCorp strongly recommends alternatives like cloud-init, user_data, or configuration management tools
    • Vendor-specific provisioners (Chef, Puppet, Habitat, Salt) were removed in Terraform 0.15+
    • are defined within the resource block.
    • support types – Create and Destroy
      • if creation time fails, resource is tainted if provisioning failed, by default. (next apply it will be re-created)
      • behavior can be overridden by setting the on_failure to continue
      • for destroy, if it fails – resources are not removed
  • Force resource recreation (terraform taint deprecated)
    • terraform taint — DEPRECATED since Terraform v0.15.2. Do not use.
    • Use terraform apply -replace="aws_instance.example" instead — this is safer as the replacement is part of the plan and visible before applying

8. HCP Terraform (formerly Terraform Cloud)

  • Use HCP Terraform to create infrastructure
    • HCP Terraform (renamed from Terraform Cloud in April 2024) provides remote state management, remote operations, and team collaboration
    • Supports VCS-driven, CLI-driven, and API-driven workflows
    • Remote operations allow terraform plan and apply to run in HCP Terraform’s managed environment
  • Describe HCP Terraform collaboration and governance features
    • HCP Terraform provides a private module registry for storing modules private to the organization
    • Policy enforcement — supports Sentinel and OPA (Open Policy Agent) for policy-as-code
    • Drift detection — automatically detects when real infrastructure diverges from state
    • Change requests — review and approval workflows for infrastructure changes
    • Teams and permissions — role-based access control for workspaces
    • Run tasks — integrate third-party tools into the run workflow
  • Describe how to organize and use HCP Terraform workspaces and projects (New in 004)
    • Projects — group related workspaces together for easier management and access control
    • Variable sets — share variables across multiple workspaces
    • Run triggers — create dependencies between workspaces so changes propagate
    • Workspaces in HCP Terraform are different from CLI workspaces — each has its own state, variables, and team access
  • Configure and use HCP Terraform integration
    • Use the cloud block in configuration to connect to HCP Terraform (replaces legacy remote backend)
    • terraform login authenticates with HCP Terraform
    • State can be migrated from local/other backends to HCP Terraform
  • Differentiate Terraform editions
    • Terraform Community Edition (open-source, BSL 1.1 licensed) — single-user CLI workflow
    • HCP Terraform (SaaS) — remote operations, collaboration, governance. Free tier available.
    • Terraform Enterprise — self-hosted version of HCP Terraform for air-gapped/on-premises deployments

Key Terraform Features by Version (2023-2026)

Version Release Key Features
1.5 Jun 2023 import blocks, check blocks, config-driven import
1.6 Oct 2023 terraform test framework, BSL 1.1 license change
1.7 Jan 2024 removed blocks, provider-defined functions
1.8 Apr 2024 Provider-defined functions GA, backend improvements
1.9 Jun 2024 Input variable validation improvements, templatestring function
1.10 Nov 2024 Ephemeral values, write-only arguments, S3 native state locking
1.11 Feb 2025 Stability improvements and bug fixes
1.12 2025 Exam 004 target version, enhanced ephemeral resources

HashiCorp Certified Terraform Associate Exam Resources

Terraform Cheat Sheet

~ Last updated on : ~ jayendrapatil ~ 8 Comments

⚠️ Important Updates (June 2026)

License Change: As of Terraform 1.6 (October 2023), Terraform is licensed under the Business Source License (BSL 1.1), replacing the previous MPL 2.0 open-source license. The BSL restricts using Terraform to compete commercially with HashiCorp.

IBM Acquisition: IBM completed its $6.4 billion acquisition of HashiCorp in February 2025. Effective September 1, 2025, all HashiCorp business operations transitioned to IBM.

OpenTofu Fork: OpenTofu, a community fork under the Linux Foundation (CNCF Sandbox), remains under MPL 2.0 and is drop-in compatible with Terraform 1.5 configurations.

Terraform Cloud Rebranded: Effective April 22, 2024, Terraform Cloud is now HCP Terraform.

Certification: The Terraform Associate (003) exam was retired January 8, 2026. The current exam is Terraform Associate (004).

  • A provisioning declarative tool based on Infrastructure as Code paradigm, now licensed under BSL 1.1 (source-available, not open-source since v1.6)
  • Designed on immutable infrastructure principles
  • Written in Golang and uses own syntax – HCL (HashiCorp Configuration Language), but also supports JSON
  • Helps to evolve the infrastructure, safely and predictably
  • Applies Graph Theory to IaC and provides Automation, Versioning and Reusability
  • Terraform is a multipurpose composition tool:
    ○ Composes multiple tiers (SaaS/PaaS/IaaS)
    ○ A plugin-based architecture model
  • Terraform is not a cloud agnostic tool. It embraces all major Cloud Providers and provides common language to orchestrate the infrastructure resources
  • Terraform is not a configuration management tool and other tools like Chef, Ansible exist in the market.
  • Current stable version: Terraform 1.15.x (as of June 2026)

Terraform Architecture

Terraform Architecture

Terraform Providers (Plugins)

  • Provide abstraction above the upstream API and is responsible for understanding API interactions and exposing resources.
  • Invoke only upstream APIs for the basic CRUD operations
  • Providers are unaware of anything related to configuration loading, graph theory, etc.
  • Supports multiple provider instances using alias for e.g. multiple AWS providers with different regions
  • Can be integrated with any API using providers framework
  • Most providers configure a specific infrastructure platform (either cloud or self-hosted).
  • Can also offer local utilities for tasks like generating random numbers for unique resource names.
  • (New in 1.8) Providers can export provider-defined functions accessible via provider::<name>::function() syntax, enabling custom logic without brittle workarounds.

Terraform Provisioners

  • Run code locally or remotely on resource creation
    • local-exec executes code on the machine running Terraform
    • remote-exec
      • runs on the provisioned resource
      • supports ssh and winrm
    • requires inline list of commands
  • Should be used as a last resort — provisioners break Terraform’s declarative model by introducing imperative operations
  • Are defined within the resource block.
  • Support types – Create and Destroy
    • if creation time fails, resource is tainted if provisioning failed, by default. (next apply it will be re-created)
    • behavior can be overridden by setting the on_failure to continue, which means ignore and continue
    • for destroy, if it fails – resources are not removed
  • Note: Chef, Habitat, Puppet, and Salt Masterless provisioners were removed in Terraform v0.15.0. Only local-exec, remote-exec, and file provisioners remain.
  • Prefer alternatives: user_data, cloud-init, or configuration management tools (Ansible, Chef, etc.)

Terraform Workspaces

  • Helps manage multiple distinct sets of infrastructure resources or environments with the same code.
  • Just need to create needed workspace and use them, instead of creating a directory for each environment to manage
  • State files for each workspace are stored in the directory terraform.tfstate.d
  • terraform workspace new dev creates a new workspace and switches to it as well
  • terraform workspace select dev helps select workspace
  • terraform workspace list lists the workspaces and shows the current active one with *
  • Does not provide strong separation as it uses the same backend
  • Note: For stronger environment isolation at scale, consider Terraform Stacks (GA on HCP Terraform since September 2025), which provide explicit cross-environment orchestration with separate state per deployment.

Terraform Workflow

Terraform Workflow

init

  • Initializes a working directory containing Terraform configuration files.
  • Performs
    • Backend initialization, storage for Terraform state file.
    • Modules installation, downloaded from Terraform registry to local path
    • Provider(s) plugins installation, the plugins are downloaded in the sub-directory of the present working directory at the path of .terraform/plugins
  • Supports -upgrade to update all previously installed plugins to the newest version that complies with the configuration’s version constraints
  • Is safe to run multiple times, to bring the working directory up to date with changes in the configuration
  • Does not delete the existing configuration or state

validate

  • Validates syntactically for format and correctness.
  • Is used to validate/check the syntax of the Terraform files.
  • Verifies whether a configuration is syntactically valid and internally consistent, regardless of any provided variables or existing state.
  • A syntax check is done on all the terraform files in the directory, and will display an error if any of the files doesn’t validate.
  • (New in 1.15) terraform validate now also validates the backend block configuration.

plan

  • Creates an execution plan
  • Traverses each vertex and requests each provider using parallelism
  • Calculates the difference between the last-known state and the current state and presents this difference as the output of the terraform plan operation
  • Does not modify the infrastructure or state.
  • Allows a user to see which actions Terraform will perform prior to making any changes to reach the desired state
  • Will scan all *.tf files in the directory and create the plan
  • Will perform refresh for each resource and might hit rate limiting issues as it calls provider APIs
  • All resources refresh can be disabled or avoided using
    • -refresh=false or
    • -target=xxxx or
    • break resources into different directories.
  • Supports -out to save the plan
  • Supports -refresh-only mode to update state without making infrastructure changes (replacement for the deprecated terraform refresh command)

apply

  • Apply changes to reach the desired state.
  • Scans the current directory for the configuration and applies the changes appropriately.
  • Can be provided with an explicit plan, saved as out from terraform plan
  • If no explicit plan file is given on the command line, terraform apply will create a new plan automatically and prompt for approval to apply it
  • Will modify the infrastructure and the state.
  • If a resource successfully creates but fails during provisioning,
    • Terraform will error and mark the resource as “tainted”.
    • A resource that is tainted has been physically created, but can’t be considered safe to use since provisioning failed.
    • Terraform also does not automatically roll back and destroy the resource during the apply when the failure happens, because that would go against the execution plan.
  • Does not import any resource (use import blocks or terraform import CLI instead).
  • Supports -auto-approve to apply the changes without asking for a confirmation
  • Supports -target to apply a specific module
  • Supports -replace=ADDRESS to force recreation of a specific resource (replacement for the deprecated terraform taint command)
⚠️ Deprecated Command: refresh

  • Used to reconcile the state Terraform knows about (via its state file) with the real-world infrastructure
  • Does not modify infrastructure, but does modify the state file
  • Deprecated since Terraform 0.15.4 due to unsafe default behavior with misconfigured credentials
  • Use instead: terraform plan -refresh-only or terraform apply -refresh-only

destroy

  • Destroy the infrastructure and all resources
  • Modifies both state and infrastructure
  • terraform destroy -target can be used to destroy targeted resources
  • terraform plan -destroy allows creation of destroy plan

import

  • Helps import already-existing external resources, not managed by Terraform, into Terraform state and allow it to manage those resources
  • CLI usage: terraform import requires you to first write the resource definition in Terraform and then import the resource
  • (New in 1.6) Declarative import blocks: Import can now be defined directly in configuration files, enabling:
    • Bulk imports in a single plan/apply cycle
    • Version-controlled import definitions in Git
    • Plan preview before actual import
    • Auto-generation of resource configuration with terraform plan -generate-config-out=generated.tf
⚠️ Deprecated Command: taint

  • Previously marked a Terraform-managed resource as tainted, forcing it to be destroyed and recreated on the next apply.
  • Deprecated since Terraform v0.15.2
  • Use instead: terraform apply -replace=RESOURCE_ADDRESS
  • The -replace flag is safer because it integrates with the plan workflow, allowing you to preview the change before applying.

fmt

  • Format to lint the code into a standard format

console

  • Command provides an interactive console for evaluating expressions.

test (New in 1.6)

  • Native testing framework for validating Terraform modules
  • Uses .tftest.hcl files with run blocks containing commands (plan or apply), variables, and assertions
  • Tests run in parallel since Terraform 1.7
  • Eliminates the need for external testing tools like Terratest (Go) for basic module validation
  • (New in 1.15) Supports functions inside mock blocks for more flexible test scenarios

Terraform New Features (1.6 – 1.15)

  • Terraform 1.6 (Oct 2023): Declarative import blocks, native testing framework, first BSL release
  • Terraform 1.7: removed block (removes resource from state without destroying it), parallel test execution
  • Terraform 1.8: Provider-defined functions via provider::<name>::function()
  • Terraform 1.9: Ephemeral values — values that exist during plan/apply but are never written to state (ideal for secrets/tokens), enhanced module input validation with cross-variable references
  • Terraform 1.10: S3 native state locking (experimental), ephemeral resources
  • Terraform 1.11: S3 native state locking GA (use_lockfile = true), DynamoDB locking deprecated
  • Terraform 1.15 (April 2026):
    • Dynamic module sources — use variables (with const = true) in source and version fields
    • deprecated attribute on variable and output blocks for communicating breaking changes
    • convert() function for precise inline type conversion
    • type attribute for output blocks (like variables)
    • S3 backend supports aws login authentication
    • Windows ARM64 builds

Terraform Modules

  • Enables code reuse
  • Supports versioning to maintain compatibility
  • Stores code remotely
  • Enables easier testing (can use native terraform test since 1.6)
  • Enables encapsulation with all the separate resources under one configuration block
  • Modules can be nested inside other modules, allowing you to quickly spin up whole separate environments.
  • Can be referred using source attribute
  • (New in 1.15) Module source and version can reference variables declared with const = true
  • Supports Local and Remote modules
    • Local modules are stored alongside the Terraform configuration (in a separate directory, outside of each environment but in the same repository) with source path ./ or ../
    • Remote modules are stored externally in a separate repository, and supports versioning
  • Supports following backends/sources
    • Local paths
    • Terraform Registry
    • GitHub
    • Bitbucket
    • Generic Git, Mercurial repositories
    • HTTP URLs
    • S3 buckets
    • GCS buckets
  • Module requirements
    • Must be on GitHub and must be a public repo, if using public registry.
    • Must be named terraform-<PROVIDER>-<NAME>, where <NAME> reflects the type of infrastructure the module manages and <PROVIDER> is the main provider where it creates that infrastructure. for e.g. terraform-google-vault or terraform-aws-ec2-instance.
    • Must maintain x.y.z tags for releases to identify module versions. Release tag names must be a semantic version, which can optionally be prefixed with a v for example, v1.0.4 and 0.9.2. Tags that don’t look like version numbers are ignored.
    • Must maintain a Standard module structure, which allows the registry to inspect the module and generate documentation, track resource usage, parse submodules and examples, and more.

Terraform Read and Write Configuration

terraform_sample

  • Resources
    • resource are the most important element in the Terraform language that describes one or more infrastructure objects, such as compute instances etc
    • Resource type and local name together serve as an identifier for a given resource and must be unique within a module for e.g. aws_instance.local_name
  • Data Sources
    • data allow data to be fetched or computed for use elsewhere in Terraform configuration
    • Allows a Terraform configuration to make use of information defined outside of Terraform, or defined by another separate Terraform configuration
  • Variables
    • variable serve as parameters for a Terraform module and act like function arguments
    • Allows aspects of the module to be customized without altering the module’s own source code, and allowing modules to be shared between different configurations
    • Can be defined through multiple ways
      • Command line for e.g. -var="image_id=ami-abc123"
      • Variable definition files .tfvars or .tfvars.json. By default, Terraform automatically loads:
        • Files named exactly terraform.tfvars or terraform.tfvars.json.
        • Any files with names ending in .auto.tfvars or .auto.tfvars.json
        • File can also be passed with -var-file
      • Environment variables can be used to set variables using the format TF_VAR_name
    • Terraform loads variables in the following order, with later sources taking precedence over earlier ones:
      • Environment variables
      • terraform.tfvars file, if present.
      • terraform.tfvars.json file, if present.
      • Any *.auto.tfvars or *.auto.tfvars.json files, processed in lexical order of their filenames.
      • Any -var and -var-file options on the command line, in the order they are provided.
    • (New in 1.15) Variables support const = true attribute for compile-time constants usable in source/version, and deprecated = "message" attribute for communicating planned removals.
  • Local Values
    • locals assigns a name to an expression, allowing it to be used multiple times within a module without repeating it.
    • Are like a function’s temporary local variables.
    • Helps to avoid repeating the same values or expressions multiple times in a configuration.
  • Output
    • Are like function return values.
    • Output can be marked as containing sensitive material using the optional sensitive argument, which prevents Terraform from showing its value in the list of outputs. However, they are still stored in the state as plain text.
    • In a parent module, outputs of child modules are available in expressions as module.<MODULE NAME>.<OUTPUT NAME>.
    • (New in 1.15) Outputs now support a type attribute for type constraints, and deprecated = "message" for signaling breaking changes.
  • Ephemeral Values (New in 1.9)
    • Values that materialize during plan or apply but are never written to the state file
    • Ideal for secrets: dynamically generated passwords, tokens from Vault/AWS Secrets Manager, temporary credentials
    • Prevents sensitive data leakage through state files
  • Named Values
    • Is an expression that references the associated value for e.g. aws_instance.local_name, data.aws_ami.centos, var.instance_type etc.
    • Support Local named values for e.g count.index
  • Dependencies
    • Identifies implicit dependencies as Terraform automatically infers when one resource depends on another by studying the resource attributes used in interpolation expressions for e.g aws_eip on resource aws_instance
    • Explicit dependencies can be defined using depends_on where dependencies between resources are not visible to Terraform
  • Data Types
    • Supports primitive data types of
      • string, number and bool
      • Terraform language will automatically convert number and bool values to string values when needed
    • Supports complex data types of
      • list – a sequence of values identified by consecutive whole numbers starting with zero.
      • map – a collection of values where each is identified by a string label.
      • set – a collection of unique values that do not have any secondary identifiers or ordering.
    • Supports structural data types of
      • object – a collection of named attributes that each have their own type
      • tuple – a sequence of elements identified by consecutive whole numbers starting with zero, where each element has its own type.
  • Built-in Functions
    • Includes a number of built-in functions that can be called from within expressions to transform and combine values for e.g. min, max, file, concat, element, index, lookup etc.
    • Does not support user-defined functions
    • (New in 1.8) Provider-defined functions extend available functions via provider::<name>::function()
    • (New in 1.15) convert() function for precise inline type conversion
  • Dynamic Blocks
    • Acts much like a for expression, but produces nested blocks instead of a complex typed value. It iterates over a given complex value, and generates a nested block for each element of that complex value.
  • Terraform Comments
    • Supports three different syntaxes for comments:
      • #
      • //
      • /* and */

Terraform Backends

  • Determines how state is loaded and how an operation such as apply is executed
  • Are responsible for storing state and providing an API for optional state locking
  • Needs to be initialized
  • If switching the backend for the first time setup, Terraform provides a migration option
  • Helps
    • Collaboration and working as a team, with the state maintained remotely and state locking
    • Can provide enhanced security for sensitive data
    • Support remote operations
  • Supports local vs remote backends
    • Local (default) backend stores state in a local JSON file on disk
    • Remote backend stores state remotely like S3, OSS, GCS, Consul and support features like remote operation, state locking, encryption, versioning etc.
  • Supports partial configuration with remaining configuration arguments provided as part of the initialization process
  • Backend configuration doesn’t support interpolations.
  • GitHub is not a supported backend type in Terraform.

Terraform State Management

  • State helps keep track of the infrastructure Terraform manages
  • Stored locally in the terraform.tfstate
  • Recommended not to edit the state manually
  • Use terraform state command
    • mv – to move/rename modules
    • rm – to safely remove resource from the state. (destroy/retain like)
    • pull – to observe current remote state
    • list & show – to write/debug modules
  • (New in 1.7) The removed block provides a declarative alternative to terraform state rm, removing a resource from state without destroying it.

State Locking

  • Happens for all operations that could write state, if supported by backend
  • Prevents others from acquiring the lock & potentially corrupting the state
  • Backends which support state locking are
    • azurerm
    • HashiCorp Consul
    • Tencent Cloud Object Storage (COS)
    • Google Cloud Storage GCS
    • HTTP endpoints
    • Kubernetes Secret with locking done using a Lease resource
    • AliCloud Object Storage OSS with locking via TableStore
    • PostgreSQL
    • AWS S3 with native S3 locking via use_lockfile = true (GA since Terraform 1.11)
      ⚠️ Note: DynamoDB-based state locking for S3 backend is deprecated as of Terraform 1.11. The dynamodb_table argument and related DynamoDB arguments now emit deprecation warnings. Use use_lockfile = true for native S3 locking instead.
    • HCP Terraform (formerly Terraform Cloud) / Terraform Enterprise
  • Can be disabled for most commands with the -lock flag
  • Use force-unlock command to manually unlock the state if unlocking failed

State Security

  • Can contain sensitive data, depending on the resources in use for e.g passwords and keys
  • Using local state, data is stored in plain-text JSON files
  • Using remote state, state is held in memory when used by Terraform. It may be encrypted at rest, if supported by backend for e.g. S3, OSS
  • (New in 1.9) Ephemeral values are never written to state, providing additional security for secrets
  • Note: OpenTofu (the community fork) offers native state file encryption, which Terraform does not currently provide

Terraform Logging

  • Debugging can be controlled using TF_LOG, which can be configured for different levels TRACE, DEBUG, INFO, WARN or ERROR, with TRACE being the more verbose.
  • Logs path can be controlled with TF_LOG_PATH. TF_LOG needs to be specified.

HCP Terraform and Terraform Enterprise

📝 Rebranding Note: Effective April 22, 2024, Terraform Cloud has been renamed to HCP Terraform. The functionality remains the same. All references below use the current name.
  • HCP Terraform (formerly Terraform Cloud) provides Cloud Infrastructure Automation as a Service. It is offered as a multi-tenant SaaS platform and is designed to suit the needs of smaller teams and organizations. Its smaller plans default to one run at a time, which prevents users from executing multiple runs concurrently.
  • Terraform Enterprise is a private install for organizations who prefer to self-manage. It is designed to suit the needs of organizations with specific requirements for security, compliance and custom operations. Now an IBM product following the acquisition.
  • HCP Terraform provides features
    • Remote Terraform Execution – supports Remote Operations for Remote Terraform execution which helps provide consistency and visibility for critical provisioning operations.
    • Workspaces – organizes infrastructure with workspaces instead of directories. Each workspace contains everything necessary to manage a given collection of infrastructure, and Terraform uses that content whenever it executes in the context of that workspace.
    • Remote State Management – acts as a remote backend for the Terraform state. State storage is tied to workspaces, which helps keep state associated with the configuration that created it.
    • Version Control Integration – is designed to work directly with the version control system (VCS) provider.
    • Private Module Registry – provides a private and central library of versioned & validated modules to be used within the organization
    • Team based Permission System – can define groups of users that match the organization’s real-world teams and assign them only the permissions they need
    • Sentinel Policies – embeds the Sentinel policy-as-code framework, which lets you define and enforce granular policies for how the organization provisions infrastructure. Helps eliminate provisioned resources that don’t follow security, compliance, or operational policies.
    • Cost Estimation – can display an estimate of its total cost, as well as any change in cost caused by the proposed updates
    • Security – encrypts state at rest and protects it with TLS in transit.
    • Terraform Stacks (GA since Sept 2025) – enables deploying a single module across multiple environments with explicit cross-stack dependencies, coordinated orchestration, and per-deployment state management.
    • Drift Detection & Continuous Health Checks – automatically detects infrastructure drift and notifies teams
  • Terraform Enterprise features
    • Includes all the HCP Terraform features with
    • Audit – supports detailed audit logging and tracks the identity of the user requesting state and maintains a history of state changes.
    • SSO/SAML – SAML for SSO provides the ability to govern user access to your applications.
⚠️ Terraform Enterprise Deployment Change:

The Replicated Native Scheduler deployment option for Terraform Enterprise has reached end of life. The final Replicated release was in March 2025, with support ending April 1, 2026. After December 31, 2027, all Replicated installations will cease to function.

New deployment options: Docker (Docker Compose), Kubernetes, and Podman. These provide faster startups, reduced resource requirements, and improved security.

  • HCP Terraform currently supports following VCS Providers
    • GitHub.com
    • GitHub.com (OAuth)
    • GitHub Enterprise
    • GitLab.com
    • GitLab EE and CE
    • Bitbucket Cloud
    • Bitbucket Server
    • Azure DevOps Server
    • Azure DevOps Services
  • HCP Terraform uses a Resources Under Management (RUM) pricing model, calculating costs based on the number of resources connected to Terraform rather than by user count.
  • A Terraform Enterprise install that is provisioned on a network that does not have Internet access is generally known as an air-gapped install. These types of installs require you to pull updates, providers, etc. from external sources vs. being able to download them directly.

OpenTofu – The Community Fork

  • OpenTofu is a community fork of Terraform 1.5.x under the Linux Foundation, now a CNCF Sandbox project (April 2025)
  • Licensed under MPL 2.0 (truly open-source, guaranteed permanently)
  • Drop-in compatible with Terraform for most configurations; state files are interchangeable
  • Providers work identically between Terraform and OpenTofu
  • Key differentiator: Native state file encryption (not available in Terraform)
  • Does not have Stacks or ephemeral values (as of mid-2026)
  • Decision factors:
    • Do you have a contract with HashiCorp/IBM or use HCP?
    • Do you need Stacks or native state encryption?
    • What does internal policy say about BSL vs open-source licensing?

AWS Certified Solutions Architect – Associate SAA-C02 Exam Learning Path

SAA-C02 Certification
~ Last updated on : ~ jayendrapatil ~ 37 Comments

⚠️ EXAM RETIRED – SAA-C02 No Longer Available

AWS Solutions Architect – Associate SAA-C02 exam was retired on August 29, 2022 and has been replaced by the SAA-C03 exam.

This content is maintained for historical reference only. If you are preparing for the AWS Solutions Architect – Associate certification, please refer to the current exam version.

👉 AWS Certified Solutions Architect – Associate SAA-C03 Exam Learning Path

Key differences in SAA-C03:

  • Reorganized into 4 domains: Secure Architectures (30%), Resilient Architectures (26%), High-Performing Architectures (24%), Cost-Optimized Architectures (20%)
  • Increased emphasis on security (now the highest-weighted domain)
  • Added modern services: AWS Transfer Family, AWS DataSync, Amazon EventBridge, AWS Transit Gateway, AWS Network Firewall, Amazon EKS/Fargate
  • Greater focus on serverless, containers, and multi-account architectures
  • Sustainability considerations added

AWS Certified Solutions Architect – Associate SAA-C02 Exam Learning Path

[HISTORICAL REFERENCE – Exam Retired August 29, 2022]

AWS Solutions Architect – Associate SAA-C02 exam was the AWS certification exam that replaced the previous SAA-C01 and was itself replaced by the current SAA-C03 exam on August 30, 2022. It validated the ability to effectively demonstrate knowledge of how to architect and deploy secure and robust applications on AWS technologies.

  • Define a solution using architectural design principles based on customer requirements.
  • Provide implementation guidance based on best practices to the organization throughout the life cycle of the project.

AWS Solutions Architect – Associate SAA-C02 Exam Summary

  • SAA-C02 exam consisted of 65 questions in 130 minutes.
  • SAA-C02 Exam covered the architecture aspects in deep, focusing on how to visualize the architecture and how different services relate.
  • AWS updated the exam concepts from the focus being on individual services to more building of scalable, highly available, cost-effective, performant, resilient architectures.
  • If you had been preparing for the SAA-C01 –
    • SAA-C02 was pretty much similar to SAA-C01 except the operational effective architecture domain was dropped
    • Most of the services and concepts covered by the SAA-C01 were the same. There were few new additions like Aurora Serverless, AWS Global Accelerator, FSx for Windows, FSx for Lustre

AWS Solutions Architect – Associate SAA-C02 Exam Resources

Note: These resources are outdated. For current SAA-C03 preparation resources, visit the SAA-C03 Exam Learning Path.

AWS Solutions Architect – Associate SAA-C02 Exam Topics

Note: These topics are for the retired SAA-C02 exam. For current exam topics, refer to the SAA-C03 Exam Learning Path.

Networking

  • Be sure to create VPC from scratch. This is mandatory.
    • Create VPC and understand whats a CIDR and addressing patterns
    • Create public and private subnets, configure proper routes, security groups, NACLs. (hint: Subnets are public or private depending on whether they can route traffic directly through Internet gateway)
    • Create Bastion for communication with instances
    • Create NAT Gateway or Instances for instances in private subnets to interact with internet
    • Create two tier architecture with application in public and database in private subnets
    • Create three tier architecture with web servers in public, application and database servers in private. (hint: focus on security group configuration with least privilege)
    • Make sure to understand how the communication happens between Internet, Public subnets, Private subnets, NAT, Bastion etc.
  • Understand difference between Security Groups and NACLs (hint: Security Groups are Stateful vs NACLs are stateless. Also only NACLs provide an ability to deny or block IPs)
  • Understand VPC endpoints and what services it can help interact (hint: VPC Endpoints routes traffic internally without Internet)
    • VPC Gateway Endpoints supports S3 and DynamoDB.
    • VPC Interface Endpoints OR Private Links supports others
  • Understand difference between NAT Gateway and NAT Instance (hint: NAT Gateway is AWS managed and is scalable and highly available)
  • Understand how NAT high availability can be achieved (hint: provision NAT in each AZ and route traffic from subnets within that AZ through that NAT Gateway)
  • Understand VPN and Direct Connect for on-premises to AWS connectivity
    • VPN provides quick connectivity, cost-effective, secure channel, however routes through internet and does not provide consistent throughput
    • Direct Connect provides consistent dedicated throughput without Internet, however requires time to setup and is not cost-effective
  • Understand Data Migration techniques
    • Choose Snowball vs Snowmobile vs Direct Connect vs VPN depending on the bandwidth available, data transfer needed, time available, encryption requirement, one-time or continuous requirement
    • Snowball, SnowMobile are for one-time data, cost-effective, quick and ideal for huge data transfer
    • Direct Connect, VPN are ideal for continuous or frequent data transfers
  • Understand CloudFront as CDN and the static and dynamic caching it provides, what can be its origin (hint: CloudFront can point to on-premises sources and its usecases with S3 to reduce load and cost)
  • Understand Route 53 for routing
    • Understand Route 53 health checks and failover routing
    • Understand Route 53 Routing Policies it provides and their use cases mainly for high availability (hint: focus on weighted, latency, geolocation, failover routing)
  • Be sure to cover ELB concepts in deep.
    • SAA-C02 focuses on ALB and NLB and does not cover CLB
    • Understand differences between CLB vs ALB vs NLB
      • ALB is layer 7 while NLB is layer 4
      • ALB provides content based, host based, path based routing
      • ALB provides dynamic port mapping which allows same tasks to be hosted on ECS node
      • NLB provides low latency and ability to scale
      • NLB provides static IP address

Security

  • Understand IAM as a whole
    • Focus on IAM role (hint: can be used for EC2 application access and Cross-account access)
    • Understand IAM identity providers and federation and use cases
    • Understand MFA and how would implement two factor authentication for an application
    • Understand IAM Policies (hint: expect couple of questions with policies defined and you need to select correct statements)
  • Understand encryption services
  • AWS WAF integrates with CloudFront to provide protection against Cross-site scripting (XSS) attacks. It also provides IP blocking and geo-protection.
  • AWS Shield integrates with CloudFront to provide protection against DDoS.
  • Refer Disaster Recovery whitepaper, be sure you know the different recovery types with impact on RTO/RPO.

Storage

  • Understand various storage options S3, EBS, Instance store, EFS, Glacier, FSx and what are the use cases and anti patterns for each
  • Instance Store
    • Understand Instance Store (hint: it is physically attached to the EC2 instance and provides the lowest latency and highest IOPS)
  • Elastic Block Storage – EBS
    • Understand various EBS volume types and their use cases in terms of IOPS and throughput. SSD for IOPS and HDD for throughput
    • Understand Burst performance and I/O credits to handle occasional peaks
    • Understand EBS Snapshots (hint: backups are automated, snapshots are manual)
  • Simple Storage Service – S3
    • Cover S3 in depth
    • Understand S3 storage classes with lifecycle policies
      • Understand the difference between S3 Standard vs S3 IA vs S3 IA One Zone in terms of cost and durability
    • Understand S3 Data Protection (hint: S3 Client side encryption encrypts data before storing it in S3)
    • Understand S3 features including
      • S3 provides a cost effective static website hosting
      • S3 versioning provides protection against accidental overwrites and deletions
      • S3 Pre-Signed URLs for both upload and download provides access without needing AWS credentials
      • S3 CORS allows cross domain calls
      • S3 Transfer Acceleration enables fast, easy, and secure transfers of files over long distances between your client and an S3 bucket.
    • Understand Glacier as an archival storage with various retrieval patterns
    • Glacier Expedited retrieval allows object retrieval within mins
  • Understand Storage gateway and its different types.
    • Cached Volume Gateway provides access to frequently accessed data, while using AWS as the actual storage
    • Stored Volume gateway uses AWS as a backup, while the data is being stored on-premises as well
    • File Gateway supports SMB protocol
  • Understand FSx easy and cost effective to launch and run popular file systems.
  • Understand the difference between EBS vs S3 vs EFS
    • EFS provides shared volume across multiple EC2 instances, while EBS can be attached to a single volume within the same AZ.
  • Understand the difference between EBS vs Instance Store
  • Would recommend referring Storage Options whitepaper, although a bit dated 90% still holds right

Compute

  • Understand Elastic Cloud Compute – EC2
  • Understand Auto Scaling and ELB, how they work together to provide High Available and Scalable solution. (hint: Span both ELB and Auto Scaling across Multi-AZs to provide High Availability)
  • Understand EC2 Instance Purchase Types – Reserved, Scheduled Reserved, On-demand and Spot and their use cases
    • Choose Reserved Instances for continuous persistent load
    • Choose Scheduled Reserved Instances for load with fixed scheduled and time interval
    • Choose Spot instances for fault tolerant and Spiky loads
    • Reserved instances provides cost benefits for long terms requirements over On-demand instances
    • Spot instances provides cost benefits for temporary fault tolerant spiky load
  • Understand EC2 Placement Groups (hint: Cluster placement groups provide low latency and high throughput communication, while Spread placement group provides high availability)
  • Understand Lambda and serverless architecture, its features and use cases. (hint: Lambda integrated with API Gateway to provide a serverless, highly scalable, cost-effective architecture)
  • Understand ECS with its ability to deploy containers and micro services architecture.
    • ECS role for tasks can be provided through taskRoleArn
    • ALB provides dynamic port mapping to allow multiple same tasks on the same node
  • Know Elastic Beanstalk at a high level, what it provides and its ability to get an application running quickly.

Databases

  • Understand relational and NoSQL data storage options which include RDS, DynamoDB, Aurora and their use cases
  • RDS
    • Understand RDS features – Read Replicas vs Multi-AZ
      • Read Replicas for scalability, Multi-AZ for High Availability
      • Multi-AZ are regional only
      • Read Replicas can span across regions and can be used for disaster recovery
    • Understand Automated Backups, underlying volume types
  • Aurora
    • Understand Aurora
      • provides multiple read replicas and replicates 6 copies of data across AZs
    • Understand Aurora Serverless provides a highly scalable cost-effective database solution
  • DynamoDB
    • Understand DynamoDB with its low latency performance, key-value store (hint: DynamoDB is not a relational database)
    • DynamoDB DAX provides caching for DynamoDB
    • Understand DynamoDB provisioned throughput for Read/Writes
  • Know ElastiCache use cases, mainly for caching performance

Integration Tools

  • Understand SQS as message queuing service and SNS as pub/sub notification service
  • Understand SQS features like visibility, long poll vs short poll
  • Focus on SQS as a decoupling service
  • Understand SQS Standard vs SQS FIFO difference (hint: FIFO provides exactly once delivery but low throughput)

Analytics

  • Know Redshift as a business intelligence tool
  • Know Kinesis for real time data capture and analytics
  • Know what AWS Glue does, so you can eliminate the answer

Management Tools

  • Understand CloudWatch monitoring to provide operational transparency
  • Know which EC2 metrics it can track. Remember, it cannot track memory and disk space/swap utilization
  • Understand CloudWatch is extendable with custom metrics
  • Understand CloudTrail for Audit
  • Have a basic understanding of CloudFormation, OpsWorks

AWS Whitepapers & Cheat sheets

AWS Solutions Architect – Associate SAA-C02 Exam Domains

Note: SAA-C03 has reorganized these into 4 domains with different weightings. See the SAA-C03 Exam Learning Path for current domains.

Domain 1: Design Resilient Architectures

  1. Design a multi-tier architecture solution
  2. Design highly available and/or fault-tolerant architectures
  3. Design decoupling mechanisms using AWS services
  4. Choose appropriate resilient storage

Domain 2: Define High-Performing Architectures

  1. Identify elastic and scalable compute solutions for a workload
  2. Select high-performing and scalable storage solutions for a workload
  3. Select high-performing networking solutions for a workload
  4. Choose high-performing database solutions for a workload

Domain 3: Specify Secure Applications and Architectures

  1. Design secure access to AWS resources
  2. Design secure application tiers
  3. Select appropriate data security options

Domain 4: Design Cost-Optimized Architectures

  1. Determine how to design cost-optimized storage.
  2. Determine how to design cost-optimized compute.

GCP Associate Cloud Engineer Certification Path

Google Cloud - Associate Cloud Engineer
~ Last updated on : ~ jayendrapatil ~ 27 Comments

Google Cloud – Associate Cloud Engineer Certification learning path

📋 Last Updated: June 2026 — This guide has been updated to reflect the current ACE exam guide, including Cloud Run, Spot VMs, AlloyDB, Terraform/IaC tools, and the deprecation of Deployment Manager.

Google Cloud – Associate Cloud Engineer certification exam is for individuals who deploy applications, monitor operations, and manage enterprise solutions on Google Cloud. The exam validates production-ready skills including deploying and securing applications, configuring networks and IAM, monitoring systems, and automating routine tasks.

Google Cloud – Associate Cloud Engineer Certification Summary

  • Has 50-60 questions (typically ~50) to be answered in 2 hours.
  • Registration fee: $125 (plus tax where applicable).
  • Available in English, Japanese, Spanish, and Portuguese.
  • Covers wide range of Google Cloud services and what they actually do. It focuses heavily on IAM, Compute (including Cloud Run and Cloud Functions), Storage with networking and monitoring/observability.
  • Hands-on is a must. Covers Cloud SDK, CLI commands and Console operations that you would use for day-to-day work. If you have not worked on GCP before make sure you do lot of labs else you would be absolute clueless for some of the questions and commands.
  • The exam includes multiple-select questions where you must choose 2 or 3 correct answers from 4-5 options.
  • Make sure you understand Infrastructure as Code tools (Terraform, Config Connector) as Deployment Manager has been deprecated.

Google Cloud – Associate Cloud Engineer Certification Topics

General Services

  • Cloud Billing
    • Understand how Cloud Billing works. Monthly vs Threshold and which has priority
    • Budgets can be set to alert for projects
    • How to change a billing account for a project and what roles you need. Hint – Project Owner and Billing Administrator for the billing account
    • Cloud Billing can be exported to BigQuery and Cloud Storage
  • Resource Manager
    • Understand Resource Manager the hierarchy Organization -> Folders -> Projects -> Resources
    • IAM Policy inheritance is transitive and resources inherit the policies of all of their parent resources.
    • Effective policy for a resource is the union of the policy set on that resource and the policies inherited from higher up in the hierarchy.
    • Understand organizational policies and how they constrain resource configurations across the hierarchy.
  • Cloud SDK
    • Understand gcloud commands esp. when dealing with
      • configurations i.e. gcloud config
        • activate profiles – gcloud config configurations activate
        • GKE setting default cluster i.e. gcloud config set container/cluster CLUSTER_NAME
        • set project gcloud config set project mygcp-demo
        • set region gcloud config set compute/region us-west1
        • set zone gcloud config set compute/zone us-west1-a
      • Get project list and ids gcloud projects list
      • Auth i.e gcloud auth
        • Auth login using user gcloud auth login
        • Auth login using service account gcloud auth activate-service-account --key-file=sa_key.json
      • VPC firewalls i.e. gcloud compute firewall-rules

Network Services

  • Virtual Private Cloud
    • Understand Virtual Private Cloud (VPC), subnets and host applications within them. Hint – VPC spans across regions
    • Understand how Firewall rules work and how they are configured. Hint – Focus on Network Tags and Service Accounts for targeting. Also, there are 2 implicit firewall rules – default ingress deny and default egress allow
    • Understand creating ingress and egress firewall rules and policies (IP subnets, network tags, service accounts)
    • Understand VPC Peering and Shared VPC
    • Understand the concept of internal and external IPs and difference between static and ephemeral IPs
    • Primary IP range of an existing subnet can be expanded by modifying its subnet mask, setting the prefix length to a smaller number.
    • Understand Cloud DNS and Cloud NAT configuration and management.
  • Cloud Load Balancing
    • Understand Google Cloud Load Balancing
    • Know load balancer options and differences esp. HTTPS and SSL proxy when handling SSL termination.
    • Understand Network Service Tiers (Premium vs Standard) and their impact on routing and availability.

Identity Services

  • Identity and Access Management – IAM
    • Identity and Access Management – IAM provides administrators the ability to manage cloud resources centrally by controlling who can take what action on specific resources.
    • Understand how IAM works and how rules apply esp. the hierarchy from Organization -> Folder -> Project -> Resources
    • Understand the difference between Basic (formerly Primitive), Predefined and Custom roles and their use cases
    • IAM Policy inheritance is transitive and resources inherit the policies of all of their parent resources.
    • Effective policy for a resource is the union of the policy set on that resource and the policies inherited from higher up in the hierarchy.
    • Basically Permissions -> Roles -> (IAM Policy) -> Members (Principals)
    • Need to know and understand the roles for the following services at least
      • Cloud Storage – Admin vs Creator vs Viewer
      • Compute Engine – Admin vs Instance Admin
      • Spanner – Viewer vs Database User
      • BigQuery – User vs JobUser
    • Know how to copy roles to different projects or organization. Hint – gcloud iam roles copy
    • Know how to use service accounts with applications
    • Understand service account impersonation and creating short-lived credentials
    • Apply principle of least privilege when assigning service accounts to resources
  • Cloud Identity
    • Cloud Identity provides IDaaS (Identity as a Service) and provides single sign-on functionality and federation with external identity providers like Active Directory.
    • Know how to manage users and groups in Cloud Identity (manually and automated)

Compute Services

  • Make sure you know all the compute services: Compute Engine, App Engine, Google Kubernetes Engine, Cloud Run, and Cloud Functions. They are heavily covered in the exam.
  • Google Compute Engine
    • Google Compute Engine is the best IaaS option for compute and provides fine-grained control
    • Know how to create a Compute Engine instance, connect to it using Cloud Shell or SSH keys
    • Difference between backups and images and how to create instances from the same.
    • Instance templates with managed instance groups. Instance template cannot be edited, create a new one and attach.
    • Difference between managed vs unmanaged instance groups and auto-healing feature
    • Spot VMs (replacement for Preemptible VMs) and their use cases. HINT – Spot VMs can be terminated any time when Compute Engine needs resources, but unlike Preemptible VMs they have NO 24-hour maximum lifetime. Same pricing model as Preemptible VMs. Google recommends using Spot VMs instead of Preemptible VMs for new workloads.
    • Understand custom machine types for right-sizing compute resources
    • Upgrade an instance without downtime using Live Migration
    • Managing access using OS Login or project and instance metadata
    • Configure VM Manager for OS patch management and compliance
    • Prevent accidental deletion using deletion protection flag
    • In case of any issues or errors, how to debug the same
  • Google App Engine
    • Google App Engine is mainly the best option for PaaS with platforms supported and features provided.
    • Deploy an application with App Engine and understand how versioning and rolling deployments can be done
    • Understand how to keep auto scaling and traffic splitting and migration.
    • Know App Engine is a regional resource and understand the steps to migrate or deploy application to different region and project.
    • Know the difference between App Engine Flexible vs Standard
  • Google Kubernetes Engine (GKE)
    • Google Kubernetes Engine enables you to run containers on Google Cloud Platform.
    • GKE takes care of provisioning and maintaining the underlying virtual machine cluster, scaling your application, and operational logistics such as logging, monitoring, and cluster health management.
    • Be sure to Create a Kubernetes Cluster and configure it to host an application
    • Understand different cluster configurations: Autopilot (fully managed, recommended for most workloads), Standard, regional clusters, and private clusters
    • Understand GKE Enterprise for multi-cluster management
    • Understand how to make the cluster auto-repairable and upgradable. Hint – Node auto-upgrades and auto-repairing feature
    • Very important to understand where to use gcloud commands (to create a cluster) and kubectl commands (manage the cluster components)
    • Very important to understand how to increase cluster size, enable autoscaling, and manage node pools (add, edit, remove)
    • Know how to manage secrets like database passwords
    • Understand Horizontal and Vertical Pod Autoscaler configurations
    • Know how to configure GKE to access Artifact Registry for container images
  • Cloud Run
    • Cloud Run is a fully managed serverless platform for running containerized applications.
    • Deploy containerized applications without managing infrastructure
    • Understand traffic splitting between revisions for canary deployments
    • Configure scaling parameters (min/max instances, concurrency)
    • Understand event-driven architecture with Eventarc and Pub/Sub triggers
    • Know when to choose Cloud Run vs App Engine vs GKE vs Cloud Functions
  • Cloud Functions
    • Cloud Functions is a serverless execution environment for building and connecting cloud services.
    • Best for event-driven, single-purpose functions (e.g., responding to Cloud Storage events, Pub/Sub messages)
    • Understand triggers: HTTP, Pub/Sub, Cloud Storage, Eventarc
    • Know the difference between Cloud Functions and Cloud Run for serverless workloads

Storage Services

  • Understand each storage service options and their use cases.
  • Cloud Storage
    • Cloud Storage is cost-effective object storage for unstructured data.
    • Very important to know the different storage classes and their use cases:
      • Standard (frequent access — replaces the legacy Regional and Multi-Regional classes)
      • Nearline (access less than once per 30 days)
      • Coldline (access less than once per 90 days)
      • Archive (access less than once per year — coldest tier, ideal for long-term retention and compliance)
    • Understand lifecycle management. HINT – Changes are in accordance to object creation date
    • Understand Signed URL to give temporary access and the users do not need to be GCP users
    • Understand access control and permissions – IAM vs ACLs (fine-grained control). IAM is recommended for uniform bucket-level access.
    • Understand best practices esp. uploading and downloading the data. HINT using parallel composite uploads
  • Relational Databases
    • Cloud SQL
      • Cloud SQL is a fully-managed service that provides MySQL, PostgreSQL, and SQL Server
      • Supports up to 64TB storage and is a regional service.
      • Difference between Failover and Read replicas. Failover provides High Availability and almost zero downtime while Read replicas provide scalability. Cross-region Read Replicas are supported.
      • Perform Point-In-Time recovery. Hint – requires binary logging and backups
    • AlloyDB for PostgreSQL
      • AlloyDB is a fully managed, PostgreSQL-compatible database designed for demanding enterprise workloads.
      • Provides up to 4x faster transactional performance than standard PostgreSQL.
      • Features automatic storage scaling, columnar engine for analytics, and 99.99% availability SLA.
      • Best for enterprise applications needing PostgreSQL compatibility with superior performance and availability.
      • Now included in the ACE exam guide as a data solution option.
    • Cloud Spanner
      • Is a fully managed, mission-critical relational database service.
      • Provides a scalable online transaction processing (OLTP) database with high availability and strong consistency at global scale.
      • Globally distributed and can scale and handle more than 10TB.
      • Not a direct replacement for Cloud SQL and would need migration.
  • NoSQL Databases
    • Firestore
      • Highly scalable and serverless NoSQL document database with MongoDB compatibility.
      • Suitable for mobile, web, and IoT applications requiring real-time sync.
      • Now included in the ACE exam guide as both a deployment and management topic.
    • Bigtable
      • Cloud-native wide-column database for large-scale, low-latency workloads (IoT, analytics, time-series data).
  • Data Warehousing
    • BigQuery
      • Provides scalable, fully managed enterprise data warehouse (EDW) with SQL and fast ad-hoc queries.
      • Remember it is most suitable for historical analysis and analytics.
      • Know how to perform a preview or dry run. Hint – price is determined by bytes read not bytes returned.
      • Supports federated tables or external tables that can support Cloud Storage, Bigtable, Google Drive and Cloud SQL.
      • Understand how to review job status and estimate costs.

Data Services

  • Although there are only a few references to data services in the exam, it is important to know the data analytics stack to understand which service fits the different layers of ingest, store, process, and analytics:
    • Cloud Storage as the medium to store data as a data lake
    • Pub/Sub as the messaging service to capture real-time data esp. IoT. Designed to provide reliable, many-to-many, asynchronous messaging between applications.
    • Dataflow to process, transform, and transfer data — the key service for stream and batch processing pipelines.
    • BigQuery for storage and analytics. Remember BigQuery provides a cost-effective option for storage similar to Cloud Storage.
    • Managed Service for Apache Spark (formerly Cloud Dataproc) for existing Hadoop/Spark jobs. Hint – Use it to replace existing Hadoop infrastructure. Renamed from Dataproc in 2025.

⚠️ Deprecated Data Services:

  • Cloud Datalab — Deprecated since September 2, 2022. Replaced by Vertex AI Workbench for interactive data exploration, analysis, and visualization.
  • Cloud Dataprep — Now “Dataprep by Trifacta” (operated by Alteryx). Consider Cloud Data Fusion for data preparation and integration on Google Cloud.

Monitoring and Observability

  • Google Cloud Operations Suite (formerly Stackdriver)
    • The suite includes Cloud Monitoring, Cloud Logging, Cloud Trace, Cloud Profiler, and Error Reporting.
    • Create Cloud Monitoring alerts based on resource metrics
    • Create and ingest custom metrics (from applications or logs)
    • Export logs to external systems (on-premises, BigQuery)
    • Configure log buckets, log analytics, and log routers
    • View and filter logs in Cloud Logging; view specific log message details
    • Use cloud diagnostics to research application issues
    • Configure and deploy Ops Agent (replaces the legacy Monitoring and Logging agents)
    • Deploy Managed Service for Prometheus for Kubernetes workload monitoring
    • Configure audit logs for security and compliance
    • Remember audits and troubleshooting primarily involve checking Cloud Logging and Cloud Monitoring

DevOps and Infrastructure as Code

  • Infrastructure as Code (IaC)
    • The ACE exam now focuses on modern IaC tooling:
    • Terraform — The recommended IaC tool for Google Cloud. Supports declarative infrastructure provisioning with HCL.
    • Infrastructure Manager — Google Cloud’s managed Terraform service for deploying and managing infrastructure.
    • Config Connector — Kubernetes add-on for managing Google Cloud resources using Kubernetes-style YAML.
    • Cloud Foundation Toolkit — Reference templates and best practices for Terraform deployments.
    • Helm — Package manager for Kubernetes applications.

⚠️ Deployment Manager — DEPRECATED

Google Cloud Deployment Manager support ended December 31, 2025 and reached End of Life on March 31, 2026.

Migration Options:

  • Terraform (recommended) — Multi-cloud support, richer module ecosystem, expressive configuration language
  • Infrastructure Manager — Google Cloud’s managed Terraform service
  • Config Connector — For Kubernetes-native resource management

The ACE exam guide now references Terraform, Config Connector, Cloud Foundation Toolkit, and Helm as IaC tools instead of Deployment Manager.

  • Google Cloud Marketplace (formerly Cloud Launcher)
    • Provides a way to launch common software packages (e.g., Jenkins, WordPress) and stacks on Google Compute Engine with just a few clicks — a prepackaged solution.
    • Can help minimize deployment time and can be used without detailed knowledge about the product.

Google Cloud – Associate Cloud Engineer Certification Exam Domains (2025/2026)

The current exam guide covers five sections:

  • Section 1: Setting up a cloud solution environment (~20%) — Resource hierarchy, organizational policies, IAM roles, Cloud Identity, billing configuration
  • Section 2: Planning and configuring a cloud solution (~17.5%) — Compute choices (Compute Engine, GKE, Cloud Run, Cloud Functions), data storage options, network resources
  • Section 3: Deploying and implementing a cloud solution (~25%) — Compute Engine, GKE (Autopilot, regional, private clusters), Cloud Run & Cloud Functions, data solutions (Cloud SQL, Firestore, BigQuery, Spanner, AlloyDB, Pub/Sub, Dataflow), networking, IaC (Terraform, Config Connector, Helm)
  • Section 4: Ensuring successful operation (~20%) — Managing Compute Engine, GKE, Cloud Run resources; storage/database management; networking; monitoring and logging (Ops Agent, Managed Prometheus)
  • Section 5: Configuring access and security (~17.5%) — IAM policies, role types, service accounts, impersonation, short-lived credentials

Google Cloud – Associate Cloud Engineer Certification Resources

AWS Certified SysOps Administrator – Associate (SOA-C01) Exam Learning Path

~ Last updated on : ~ jayendrapatil ~ 52 Comments

AWS Certified SysOps Administrator – Associate (SOA-C01) Exam Learning Path

⚠️ EXAM RETIRED – SOA-C01 No Longer Available

The AWS Certified SysOps Administrator – Associate (SOA-C01) exam has been retired. It was replaced by the SOA-C02 exam, which itself was retired on September 29, 2025.

The current exam is now the AWS Certified CloudOps Engineer – Associate (SOA-C03), launched on September 30, 2025.

Recommended Next Steps:

This content is maintained for historical reference only. If you are preparing for certification, please use the SOA-C03 exam resources.

AWS Certified SysOps Administrator – Associate (SOA-C01) exam was the AWS associate-level operations exam that validated the ability to:

  • Deploy, manage, and operate scalable, highly available, and fault tolerant systems on AWS
  • Implement and control the flow of data to and from AWS
  • Select the appropriate AWS service based on compute, data, or security requirements
  • Identify appropriate use of AWS operational best practices
  • Estimate AWS usage costs and identify operational cost control mechanisms
  • Migrate on-premises workloads to AWS

Refer AWS Certified SysOps – Associate Exam Guide Sep 18

AWS Certified SysOps Administrator - Associate Content Outline

AWS Certified SysOps Administrator – Associate (SOA-C01) Exam Summary

  • AWS Certified SysOps Administrator – Associate exam was quite different from the previous one with more focus on the error handling, deployment, monitoring.
  • AWS Certified SysOps Administrator – Associate exam covered a lot of AWS services like ALB, Lambda, AWS Config, AWS Inspector, AWS Shield while focusing majorly on other services like CloudWatch, Metrics from various services, CloudTrail.
  • Be sure to cover the following topics
    • Monitoring & Management Tools
      • Understand CloudWatch monitoring to provide operational transparency
        • Know which EC2 metrics it can track (disk, network, CPU, status checks) and which would need custom metrics (memory, disk swap, disk storage etc.)
        • Know ELB monitoring
          • Classic Load Balancer metrics SurgeQueueLength and SpilloverCount
          • Reasons for 4XX and 5XX errors
      • Understand CloudTrail for audit and governance
      • Understand AWS Config and its use cases
      • Understand AWS Systems Manager and its various services like parameter store, patch manager
      • Understand AWS Trusted Advisor and what it provides
      • Very important to understand AWS CloudWatch vs AWS CloudTrail vs AWS Config
      • Very important to understand Trust Advisor vs Systems manager vs Inspector
      • Know Personal Health Dashboard & Service Health Dashboard
      • Deployment tools
        • Know AWS OpsWorks and its ability to support chef & puppet
        • Know Elastic Beanstalk and its advantages
        • Understand AWS CloudFormation
          • Know stacks, templates, nested stacks
          • Know how to wait for resources setup to be completed before proceeding esp. cfn-signal
          • Know how to retain resources (RDS, S3), prevent rollback in case of a failure
    • Networking & Content Delivery
      • Understand VPC in depth
        • Understand the difference between
          • Bastion host – allow access to instances in private subnet
          • NAT – route traffic from private subnets to internet
          • NAT instance vs NAT Gateway
          • Internet Gateway – Access to internet
          • Virtual Private Gateway – Connectivity between on-premises and VPC
          • Egress-Only Internet Gateway – relevant to IPv6 only to allow egress traffic from private subnet to internet, without allowing ingress traffic
        • Understand
        • Understand how VPC Peering works and limitations
        • Understand VPC Endpoints and supported services
        • Ability to debug networking issues like EC2 not accessible, EC2 instances not reachable, Instances in subnets not able to communicate with others or Internet.
      • Understand Route 53 and Routing Policies and their use cases
        • Focus on Weighted, Latency routing policies
      • Understand VPN and Direct Connect and their use cases
      • Understand CloudFront and use cases
      • Understand ELB, ALB and NLB and what features they provide like
        • ALB provides content and path routing
        • NLB provides ability to give static IPs to load balancer.
    • Compute
      • Understand EC2 in depth
        • Understand EC2 instance types
        • Understand EC2 purchase options esp. spot instances and improved reserved instances options.
        • Understand how IO Credits work and T2 burstable performance and T2 unlimited
        • Understand EC2 Metadata & Userdata. Whats the use of each? How to look up instance data after it is launched.
        • Understand EC2 Security.
          • How IAM Role work with EC2 instances
          • IAM Role can now be attached to stopped and runnings instances
        • Understand AMIs and remember they are regional and how can they be shared with others.
        • Troubleshoot issues with launching EC2 esp. RequestLimitExceeded, InstanceLimitExceeded etc.
        • Troubleshoot connectivity, lost ssh keys issues
      • Understand Auto Scaling
      • Understand Lambda and its use cases
      • Understand Lambda with API Gateway
    • Storage
    • Databases
    • Security
      • Understand IAM as a whole
      • Understand KMS for key management and envelope encryption
      • Understand CloudHSM and KMS vs CloudHSM esp. support for symmetric and asymmetric keys
      • Know AWS Inspector and its use cases
      • Know AWS GuardDuty as managed threat detection service. Will help eliminate as the option
      • Know AWS Shield esp. the Shield Advanced option and the features it provides
      • Know WAF as Web Traffic Firewall
      • Know AWS Artifact as on-demand access to compliance reports
    • Integration Tools
      • Understand SQS as message queuing service and SNS as pub/sub notification service
        • Focus on SQS as a decoupling service
        • Understand SQS FIFO, make sure you know the differences between standard and FIFO
      • Understand CloudWatch integration with SNS for notification
    • Cost management

AWS Certified SysOps Administrator – Associate (SOA-C01) Exam Resources

📌 Note: The resources below were relevant for the retired SOA-C01 exam. For current certification preparation, refer to:

AWS Cloud Computing Whitepapers

AWS Certified SysOps Administrator – Associate (SOA-C01) Exam Contents

Domain 1: Monitoring and Reporting

  1. Create and maintain metrics and alarms utilizing AWS monitoring services
  2. Recognize and differentiate performance and availability metrics
  3. Perform the steps necessary to remediate based on performance and availability metrics

Domain 2: High Availability

  1. Implement scalability and elasticity based on use case
  2. Recognize and differentiate highly available and resilient environments on AWS

Domain 3: Deployment and Provisioning

  1. Identify and execute steps required to provision cloud resources
  2. Identify and remediate deployment issues

Domain 4: Storage and Data Management

  1. Create and manage data retention
  2. Identify and implement data protection, encryption, and capacity planning needs

Domain 5: Security and Compliance

  1. Implement and manage security policies on AWS
  2. Implement access controls when using AWS
  3. Differentiate between the roles and responsibility within the shared responsibility model

Domain 6: Networking

  1. Apply AWS networking features
  2. Implement connectivity services of AWS
  3. Gather and interpret relevant information for network troubleshooting

Domain 7: Automation and Optimization

  1. Use AWS services and features to manage and assess resource utilization
  2. Employ cost-optimization strategies for efficient resource utilization
  3. Automate manual or repeatable process to minimize management overhead

Exam Evolution: SOA-C01 → SOA-C02 → SOA-C03 (CloudOps Engineer)

The AWS SysOps Administrator certification has gone through significant evolution:

  • SOA-C01 (2018-2021) – Original version covered in this post. Focused on traditional operations with 7 domains.
  • SOA-C02 (2021-2025) – Added hands-on exam labs, introduced automation focus, reduced to 6 domains. Retired September 29, 2025.
  • SOA-C03 / AWS Certified CloudOps Engineer – Associate (2025-present) – Current exam. Rebranded to reflect modern cloud operations. Added containers (ECS, EKS, ECR), multi-account architectures, and expanded automation coverage. 5 domains with new question types (ordering, matching, case studies).

SOA-C03 Exam Domains (Current)

Domain Weight
Monitoring, Logging, Analysis, Remediation & Performance Optimization 22%
Reliability and Business Continuity 22%
Deployment, Provisioning, and Automation 22%
Networking and Content Delivery 18%
Security and Compliance 16%

Key additions in SOA-C03 compared to SOA-C01:

  • Container Operations – Amazon ECS, EKS, ECR, Fargate
  • Multi-Account Architecture – AWS Organizations, Service Control Policies (SCPs), AWS Control Tower
  • Modern Automation – AWS CDK, EventBridge, expanded Systems Manager capabilities
  • Cost Optimization – Compute Optimizer, AWS Budgets actions, Savings Plans
  • Enhanced Security – Security Hub, AWS Backup, Secrets Manager rotation

For the current exam preparation, refer to the official AWS CloudOps Engineer certification page.

AWS Certified Developer – Associate DVA-C01 Exam Learning Path

~ Last updated on : ~ jayendrapatil ~ 50 Comments

AWS Certified Developer – Associate DVA-C01 Exam Learning Path

⚠️ EXAM RETIRED — DVA-C01 No Longer Available

The AWS Certified Developer – Associate DVA-C01 exam was retired on February 27, 2023.

It has been replaced by the DVA-C02 exam. This content is maintained for historical reference only.

👉 For the current exam, see: AWS Certified Developer – Associate DVA-C02 Exam Learning Path

Key DVA-C02 Changes vs DVA-C01:

  • Domain restructuring — 4 domains: Development with AWS Services (32%), Security (26%), Deployment (24%), Troubleshooting & Optimization (18%)
  • More hands-on focus — Emphasis on writing, testing, deploying, and debugging code
  • New services — Amazon Q Developer, EventBridge, Step Functions, AppSync, CDK
  • AI-assisted development — Amazon Q Developer added in December 2024 revision
  • Removed focus — Less emphasis on architecture design, more on CI/CD workflows

AWS Certified Developer – Associate DVA-C01 exam was the AWS exam version available from June 2018 to February 2023 and has been replaced by the DVA-C02 exam. It validated:

  • Demonstrate an understanding of core AWS services, uses, and basic AWS architecture best practices.
  • Demonstrate proficiency in developing, deploying, and debugging cloud-based applications using AWS.

Refer AWS Certified Developer – Associate (Released June 2018) Exam Blue Print

AWS Certified Developer - Associate June 2018 Domains

AWS Certified Developer – Associate DVA-C01 Summary

  • AWS Certified Developer – Associate DVA-C01 exam was quite different from the previous one with more focus on the hands-on development and deployment concepts rather than just the architectural concepts
  • AWS Certified Developer – Associate DVA-C01 exam covered a lot of AWS services like Lambda, X-Ray while focusing majorly on other services like DynamoDB, Elastic Beanstalk, S3, EC2
  • Note: DVA-C01 was retired on Feb 27, 2023. For current exam preparation, refer to the DVA-C02 Learning Path

AWS Developer – Associate Exam Resources (Updated for DVA-C02)

AWS Developer – Associate DVA-C01 Exam Topics

  • Be sure to cover the following topics
    • Compute
      • Understand what AWS services you can use to build a serverless architecture?
      • Make sure you know and understand Lambda and serverless architecture, its features and use cases.
      • Know Lambda limits for e.g. execution time, deployable zipped and unzipped package limit
      • Be sure to know how to deploy, package using Lambda.
      • Understand tracing of Lambda functions using X-Ray
      • Understand integration of Lambda with CloudWatch.
      • Understand how to handle multiple releases using Alias
      • Know AWS Step Functions to manage Lambda functions flow
      • Understand Lambda with API Gateway
      • Understand API Gateway stages, ability to cater to different environments for e.g. dev, test, prod
      • Understand EC2 as a whole
      • Understand EC2 Metadata & Userdata. Whats the use of each? How to look up instance data after it is launched.
      • Understand EC2 Security. How IAM Role work with EC2 instances.
      • Understand how does EC2 evaluates the order of credentials, when multiple are provided. Remember the order – Environment variables -> Java system properties -> Default credential profiles file -> ECS container credentials -> Instance Profile credentials
      • Know Elastic Beanstalk at a high level, what it provides and its ability to get an application running quickly
      • Understand Elastic Beanstalk configurations and deployment types with their advantages and disadvantages
    • Databases
      • Understand relational and NoSQLs data storage options which include RDS, DynamoDB and their use cases
      • Understand DynamoDB Secondary Indexes
      • Make sure you understand DynamoDB provisioned throughput for Read/Writes and its calculations
      • Make sure you understand DynamoDB Consistency Model – difference between Strongly Consistent and Eventual Consistency
      • Understand DynamoDB with its low latency performance, DAX
      • Know how to configure fine grained security for DynamoDB table, items, attributes
      • Understand DynamoDB Best Practices regarding
        • table design
        • provisioned throughput
        • Query vs Scan operations
        • improving Scan operation performance
      • Understand RDS features – Read Replicas for scalability, Multi-AZ for High Availability
      • Know ElastiCache use cases, mainly for caching performance
      • Understand ElastiCache Redis vs Memcached
    • Storage
      • Understand S3 storage option
      • Understand S3 Best Practices to improve performance for GET/PUT requests
      • Understand S3 features like different storage classes with lifecycle policies, static website hosting, versioning, Pre-Signed URLs for both upload and download, CORS
    • Security
      • Understand IAM as a whole
      • Focus on IAM role and its use case especially with EC2 instance
      • Know how to test and validate IAM policies
      • Understand IAM identity providers and federation and use cases
      • Understand how AWS Cognito works and what features it provides
      • Understand MFA and How would implement two factor authentication for your application
      • Understand KMS for key management and envelope encryption
      • Know what services support KMS
        • Remember SQS, Kinesis now provides SSE support
      • Focus on S3 with SSE, SSE-C, SSE-KMS. How they work and differ?
      • Know how can you enforce only buckets to only accept encrypted objects
      • Know various KMS encryption options encrypt, reencrypt, generateEncryptedDataKey etc
      • Know how KMS impacts the performance of the services
    • Management Tools
      • Understand CloudWatch monitoring to provide operational transparency
      • Know which EC2 metrics it can track.
      • Understand CloudWatch is extendable with custom metrics
      • Understand CloudTrail for Audit
    • Integration Tools
      • Understand SQS as message queuing service and SNS as pub/sub notification service
      • Understand SQS features like visibility, long poll vs short poll
      • Focus on SQS as a decoupling service
      • AWS has released SQS FIFO, make sure you know the differences between standard and FIFO
      • Know the different development and deployment tools like CodeCommit, CodeBuild, CodeDeploy, CodePipeline
    • Networking
      • Does not cover much on networking or designing of networks, but be sure you understand VPC, Subnets, Routes, Security Groups etc.

AWS Cloud Computing Whitepapers

AWS Certified Developer – Associate DVA-C01 Exam Contents

Note: These domains are specific to the retired DVA-C01 exam. The current DVA-C02 exam has different domain structure and weightings. See the DVA-C02 Learning Path for current exam domains.

Domain 1: Deployment

  1. Deploy written code in AWS using existing CI/CD pipelines, processes, and patterns.
  1. Deploy applications using Elastic Beanstalk.
  1. Prepare the application deployment package to be deployed to AWS.
  2. Deploy serverless applications.

Domain 2: Security

  1. Make authenticated calls to AWS services.
  1. Implement encryption using AWS services.
  2. Implement application authentication and authorization.

Domain 3: Development with AWS Services

  1. Write code for serverless applications.
  1. Translate functional requirements into application design.
  1. Implement application design into application code.
  2. Write code that interacts with AWS services by using APIs, SDKs, and AWS CLI.

Domain 4: Refactoring

  1. Optimize application to best use AWS services and features.
  2. Migrate existing application code to run on AWS.

Domain 5: Monitoring and Troubleshooting

  1. Write code that can be monitored.
  2. Perform root cause analysis on faults found in testing or production.

DVA-C01 vs DVA-C02 — Key Differences

If you studied for DVA-C01 and need to understand what changed for DVA-C02:

  • Domain restructuring: DVA-C01 had 5 domains; DVA-C02 has 4 domains with different weightings
  • Refactoring domain removed: Merged into Development and Troubleshooting domains
  • More Lambda focus: Lambda gets its own dedicated task in DVA-C02
  • CI/CD emphasis: Greater focus on CodePipeline, CodeBuild, CodeDeploy, and CDK
  • New services added: EventBridge, AppSync, Step Functions, CDK, Amazon Q Developer
  • Services de-emphasized: Less focus on Elastic Beanstalk, more on containers (ECS/EKS)
  • Security weight increased: Security is now 26% of the exam (was 12% in DVA-C01)
  • AI-assisted development: December 2024 revision added Amazon Q Developer skills

For full DVA-C02 preparation guidance, visit the AWS Certified Developer – Associate DVA-C02 Exam Learning Path.