AWS Certified DevOps Engineer – Professional Cheat Sheet (DOP-C02)
Every CI/CD service, automation pattern, and incident-response decision the DOP-C02 exam actually tests — organised by the six exam domains with decision trees and reference architectures
About This Cheat Sheet
- 19 pages
- Every in-scope DOP-C02 service
- For 2+ years of hands-on AWS operations
- 5 reference CI/CD architectures
- 22 answer-pattern scenarios
- Updated April 2026
Exam domains
Share of the scored DOP-C02 content
- SDLC Automation22%
- Configuration Management and IaC17%
- Resilient Cloud Solutions15%
- Monitoring and Logging15%
- Incident and Event Response14%
- Security and Compliance17%
Services covered
CI/CD toolchain
- CodePipeline
- CodeBuild
- CodeDeploy
- CodeArtifact
- CodeCommit
- CodeGuru
- Amazon Q Developer
Infrastructure as code
- CloudFormation
- SAM
- CDK
- Proton
- Service Catalog
Systems Manager
- Fleet Manager
- Run Command
- State Manager
- Patch Manager
- Automation
- Session Manager
- Change Manager
- Incident Manager
- AppConfig
- Inventory
- OpsCenter
- Parameter Store
Monitoring & logging
- CloudWatch
- CloudWatch Logs
- Evidently
- Managed Prometheus
- Managed Grafana
- X-Ray
- CloudTrail Lake
Security & compliance
- GuardDuty
- Inspector
- Security Hub
- Config
- Macie
- Firewall Manager
- AWS WAF
- Audit Manager
Show 20 more servicesShow fewer
Incident response & resilience
- EventBridge
- FIS
- Resilience Hub
- Application Recovery Controller
- AWS Backup
- Elastic Disaster Recovery
Foundations
- Organizations
- Control Tower
- IAM Identity Center
- KMS
- Secrets Manager
Deployment targets
- Lambda
- ECS
- EKS
Cost management
- Budgets
- Cost Anomaly Detection
- Compute Optimizer
- Savings Plans
Deprecated or end of life
- CodeStar
- OpsWorks
Feature details
- CodePipeline
- CodePipeline V2
- CodeBuild
- Batch + matrix builds
- CodeDeploy
- All lifecycle hooks · Lambda + ECS deployment configurations
- CodeCommit
- Return to GA
- CloudFormation
- Change Sets · Drift Detection · StackSets · Hooks · Modules · Custom Resources
- CloudWatch
- Composite alarms · Anomaly detection · Metric math · Synthetics · Logs subscription filters
- Config
- Conformance Packs
- Incident Manager
- Response plans
- Budgets
- Budgets actions
- Deprecations
- CodeStar deprecation · OpsWorks EOL flagged
Concepts covered
- Deployment strategies
- In-place, rolling, immutable, blue/green, canary, linear
- Incident & resilience
- EventBridge + SSM Automation auto-remediation · FIS chaos engineering · Multi-AZ / Multi-Region patterns
- Reference architectures
- Serverless API · ECS blue/green · Multi-account StackSets · EKS GitOps · Data pipeline
- Deep dives
- Centralised logging across 50 accounts · Automated patching with Change Calendar · Immutable pipelines for regulated workloads · Self-healing microservice platforms
- Exam practice
- 22-scenario Answer Patterns table · Pitfalls & Gotchas · Runbook / observability playbook
Built from the official DOP-C02 exam guide; every service on its in-scope list is audited present.
What's Inside
Organizations, Landing Zone & Governance
How to govern a multi-account estate: guardrails, account vending, shared resources and delegated security services.
- Organizations with OUs + SCPs
- SCP examples: deny region, deny root, deny disabling CloudTrail
- Control Tower managed landing zone with Account Factory / AFT
- Service Catalog portfolios with Launch Constraints and TagOptions
- RAM resource sharing; Config Conformance Packs
- CloudFormation StackSets, service-managed with Organizations auto-propagation
- Delegated administration: GuardDuty / Security Hub / Config / Inspector / Macie / Firewall Manager
Identity, Encryption & Secrets
Keyless identity for pipelines and compute, and the right home for keys, certificates and secrets.
- IAM roles for compute (EC2, Lambda, CodeBuild), no long-lived keys
- STS assume-role chains for cross-account pipelines
- IAM Identity Center Permission Sets + OIDC for GitHub Actions
- Directory Service, Cognito
- KMS customer-managed keys with cross-account policies for pipelines
- CloudHSM for FIPS 140-2 Level 3
- ACM public + Private CA; Secrets Manager with Lambda rotation
- Parameter Store Standard vs. Advanced vs. Secrets Manager decision table
CI/CD Pipeline Services
The full AWS CI/CD toolchain, down to the AppSpec hooks and traffic-shift modes that exam answers hinge on.
- CodePipeline V2: branch filters, file-path triggers, git tags, parallel stages, manual approval
- CodeBuild: buildspec phases, Reports, batch builds, matrix
- CodeBuild local + S3 cache, VPC mode, Lambda compute
- CodeDeploy for EC2/ASG/Lambda/ECS with every AppSpec hook
- Hooks: ApplicationStop, BeforeInstall, AfterInstall, ApplicationStart, ValidateService, BeforeBlockTraffic, BeforeAllowTraffic, AfterAllowTraffic
- Traffic-shift modes: Canary10Percent5Minutes, Linear10PercentEvery1Minute, AllAtOnce
- CodeArtifact for npm / PyPI / Maven / NuGet; CodeGuru + Amazon Q Developer
- CodeStar deprecation (July 2024); CodeCommit return-to-GA (November 2025)
Deployment Strategies
How the deployment strategies compare on downtime, cost and rollback, and how AWS services implement them.
- Decision matrix: In-place, Rolling, Rolling with additional batch, Immutable
- Also Blue-Green, Canary, Linear, All-at-once
- Matrix columns: downtime, cost, rollback, use-case
- Lambda alias traffic shifting with CloudWatch alarm rollback
- ECS blue/green with two ALB target groups and BeforeAllowTraffic / AfterAllowTraffic hooks
- Elastic Beanstalk deployment policies
Infrastructure as Code
CloudFormation in depth, plus SAM, CDK, Proton and Service Catalog for governed, repeatable infrastructure.
- CloudFormation intrinsic functions, pseudo parameters
- Helper scripts: cfn-init, cfn-signal, cfn-hup, cfn-get-metadata
- CreationPolicy, UpdatePolicy, DeletionPolicy
- Change Sets, Drift Detection, Nested Stacks, StackSets
- Custom Resources, Hooks, Modules; rollback configuration on CloudWatch alarm
- SAM with sam local + SAM Pipelines; CDK with Constructs + Aspects
- Proton for platform engineering with environment + service templates
- Service Catalog for governed self-service
Configuration Management & Fleet Ops
The full AWS Systems Manager suite for running fleets, plus AppConfig feature flags and the OpsWorks exit.
- Fleet Manager, Run Command, State Manager Associations, Inventory, OpsCenter
- Patch Manager with baselines + Maintenance Windows
- Automation runbooks, called from EventBridge + Config + Incident Manager
- Session Manager, Parameter Store, Change Manager
- AppConfig for runtime feature flags with validators + CloudWatch alarm rollback
- Incident Manager on-call rotas + response plans
- OpsWorks end-of-life flagged (May 2024) with migration direction
Monitoring, Logging & Observability
Metrics, alarms, logs and traces across CloudWatch and the managed open-source tools, plus the services that analyse log data.
- CloudWatch metrics: standard + high-res 1s custom
- Alarms: standard + composite + anomaly detection + metric math
- Dashboards, Metric Streams, Contributor Insights, Synthetics canaries
- Evidently feature flags and A/B experiments; ServiceLens + X-Ray maps
- CloudWatch Logs subscription filters → Firehose / Kinesis / Lambda / OpenSearch
- Logs Insights, Live Tail, cross-account sharing
- Managed Prometheus + Managed Grafana + X-Ray + CloudTrail Lake
- Kinesis Data Streams + Firehose, OpenSearch Service, Athena on S3, QuickSight, EMR
Incident & Event Response
The event-driven auto-remediation pattern, and the AWS services for incident handling, chaos testing and recovery.
- Sources: GuardDuty / Config / CloudWatch Alarm / CloudTrail → EventBridge
- Targets: SSM Automation / Lambda / Step Functions
- Incident Manager response plans: contact + escalation + chat channel + runbook
- Fault Injection Simulator (FIS) chaos experiments with CloudWatch alarm stop conditions
- Resilience Hub with RTO/RPO scoring
- AWS Health + EventBridge org-wide
- AWS Backup restore testing + vault lock; Elastic Disaster Recovery
Resilient Cloud Solutions
Building for failure: DR patterns, multi-AZ and multi-Region designs, scaling and failure isolation.
- Four DR patterns with RPO/RTO: Backup & Restore, Pilot Light, Warm Standby, Active/Active
- Multi-AZ defaults; chaos testing
- Multi-Region patterns: Aurora Global DB, DynamoDB Global Tables, S3 CRR with RTC
- Route 53 failover, Global Accelerator
- Application Recovery Controller routing controls + readiness checks
- Auto Scaling target tracking + predictive
- Circuit breakers: SQS + DLQ, Step Functions retries with exponential back-off + jitter
Security & Compliance Automation
Securing the pipeline itself, then automating compliance checks and org-wide protections.
- Pipeline security: OIDC roles instead of long-lived creds
- Signer for Lambda + container signing; CodeArtifact + KMS for artefacts
- CodeGuru + Amazon Q + third-party SAST/SCA
- Inspector for ECR + EC2 + Lambda; manual approval gates
- Policy as code: CloudFormation Guard, cfn-lint
- Config + Conformance Packs; CloudTrail Lake + CloudTrail Insights
- Security Hub with FSBP/CIS/PCI standards; Audit Manager
- Firewall Manager for org-wide WAF / Shield / SG / Network Firewall
- GuardDuty, Detective, Macie
Scenario → Answer Patterns
22 DOP-C02 scenarios, each mapped to its AWS default answer.
- Logs: centralised logging, immutable log retention
- Deployments: zero-downtime Lambda, cross-account CodePipeline, feature flags with rollback
- Config: drift detection, config versioning, patch-at-scale
- Security: public S3 remediation, EC2 secret removal, threat detection auto-quarantine
- Access and edge: SSO, central WAF
- Resilience: DR for stateful EC2, Region failover, chaos testing, message durability
- Platform: microservice platform, cold-start mitigation
- The CodeCommit reversal update
Reference Architectures
Five full walkthroughs that combine the services into complete, exam-style pipelines.
- Serverless API pipeline: Lambda + API GW + DynamoDB with SAM
- Its release: CodeDeploy canary, CloudWatch alarm rollback, Synthetics canary
- ECS Fargate blue/green: image scan, two target groups, BeforeAllowTraffic smoke tests
- Multi-account IaC pipeline with StackSets + drift remediation
- EKS GitOps: Argo/Flux + Karpenter + Argo Rollouts canary
- Data pipeline: Kinesis → Firehose → S3 Parquet → Athena / Redshift Spectrum / QuickSight
- Data pipeline glue: Glue + Step Functions + Lake Formation
Why This Cheat Sheet Helps
DOP-C02 is a pattern-recognition exam. Long scenarios describe an operational problem and each wrong answer is plausible. The winning skill is knowing the AWS default answer to recurring questions: 'zero-downtime Lambda deploy with rollback' → alias + CodeDeploy canary + CloudWatch alarm; 'auto-remediate public S3' → Config rule + EventBridge + SSM Automation; 'cross-account CodePipeline' → artefact bucket policy + KMS key policy + cross-account role; 'patch 5000 instances' → Patch Manager + Maintenance Windows + Change Calendar. This cheat sheet puts those patterns side by side with decision trees, so you stop second-guessing.
It assumes you already know how to wire up a pipeline — this is not an intro. Use it in the final weeks to map the exam's surface area, reinforce the event-driven remediation fabric (EventBridge + SSM), and make sure your mental model of observability, deployment, and resilience matches AWS's own prescribed patterns.
How to Use It
Skim the whole sheet once to see how the six domains map to sections. Then take a practice exam — for each wrong answer, find the relevant section and study the tables and decision trees. Pay special attention to section 21 (Scenario → Answer Patterns), section 23 (Decision Trees That Save Exam Points), and section 25 (Pitfalls & Gotchas) — these encode the most frequently-tested rules.
In the final week, walk through the six domain weights against your confidence: SDLC Automation (22%) → sections 11, 12, 20; Configuration Management & IaC (17%) → sections 13, 14, 22; Resilient Cloud (15%) → section 17; Monitoring & Logging (15%) → sections 15, 27; Incident & Event Response (14%) → sections 16, 26; Security & Compliance (17%) → sections 3, 4, 18. Pair with CloudNinja's free DOP-C02 practice exam to surface gaps.
Frequently Asked Questions
Is this AWS DevOps Engineer Professional cheat sheet free?
Yes, completely free with no signup required. Download the PDF directly from CloudNinja and use it as a study reference for the DOP-C02 exam.
How much AWS experience do I need before DOP-C02?
AWS recommends two or more years of hands-on experience provisioning, operating, and managing AWS environments, plus experience with at least one modern programming language and CI/CD. The exam is automation-heavy: you are expected to know the event-driven remediation fabric (EventBridge + SSM), the full Systems Manager suite, CodeDeploy traffic-shifting strategies, CloudFormation change-set/drift/StackSet patterns, and multi-account pipeline security. If you do not already hold Developer Associate or SysOps/CloudOps Associate, consider those first.
How is DOP-C02 different from the Solutions Architect Professional?
SAP-C02 tests which architecture you would choose; DOP-C02 tests how you would operate it day-to-day. DOP-C02 goes deep into CI/CD pipelines (CodePipeline V2, CodeBuild buildspec, every CodeDeploy hook), infrastructure as code (CloudFormation helpers, StackSets, Custom Resources, Hooks), Systems Manager (Fleet Manager, Run Command, State Manager, Patch Manager, Automation, Incident Manager, AppConfig), monitoring with composite / anomaly / metric-math alarms, and event-driven auto-remediation via EventBridge + SSM. Expect scenario questions where the right answer automates an ops task end-to-end.
Is this cheat sheet updated for the current DOP-C02 exam?
Yes, it is built directly from the current DOP-C02 exam guide (devops-engineer-professional) and audited against the full in-scope services list. It reflects current services and recent changes — CodeCommit returned to GA on 2025-11-24, CodeStar deprecated in July 2024, OpsWorks Stacks EOL in May 2024, the AWS Support plan restructure, Amazon Q Developer as the successor to CodeGuru Reviewer, and newer services like CodePipeline V2, Application Recovery Controller, Amazon Managed Service for Prometheus, and AWS Resilience Hub.
Keep Studying
Recommended courses
Affiliate links — if you enrol through them, CloudNinja may earn a commission at no extra cost to you.