AWS Certified DevOps Engineer – Professional Cheat Sheet (DOP-C02)
Every CI/CD service, automation pattern, and incident-response decision the DOP-C02 exam actually tests — organised by the six exam domains with decision trees and reference architectures
About This Cheat Sheet
A 19-page professional-tier reference covering every in-scope service from the official DOP-C02 exam guide, organised around the six exam domains: SDLC Automation (22%), Configuration Management & IaC (17%), Resilient Cloud Solutions (15%), Monitoring & Logging (15%), Incident & Event Response (14%), Security & Compliance (17%). Structured for ≥2 years of hands-on AWS provisioning, operations and automation — sections move from foundations (Organizations, Control Tower, IAM Identity Center, KMS, Secrets Manager, Parameter Store) through the full CI/CD toolchain (CodePipeline V2, CodeBuild with batch + matrix, CodeDeploy with all lifecycle hooks, CodeArtifact, CodeGuru, Amazon Q Developer — plus the CodeStar deprecation and CodeCommit return-to-GA), deployment strategies (in-place, rolling, immutable, blue/green, canary, linear) with the Lambda + ECS CodeDeploy configurations examiners pick from, infrastructure as code (CloudFormation with Change Sets, Drift Detection, StackSets, Hooks, Modules, Custom Resources; SAM; CDK; Proton; Service Catalog), configuration management and fleet ops (the full Systems Manager suite — Fleet Manager, Run Command, State Manager, Patch Manager, Automation, Session Manager, Change Manager, Incident Manager, AppConfig, Inventory, OpsCenter) with the OpsWorks EOL flagged, monitoring and observability (CloudWatch with composite alarms + anomaly detection + metric math + Synthetics + Evidently, CloudWatch Logs with subscription filters, Managed Prometheus, Managed Grafana, X-Ray, CloudTrail Lake), incident response (EventBridge + SSM Automation auto-remediation pattern, FIS chaos engineering, Resilience Hub, Incident Manager response plans), resilience (Multi-AZ / Multi-Region patterns, Application Recovery Controller, AWS Backup, Elastic Disaster Recovery), security and compliance automation (GuardDuty, Inspector, Security Hub, Config Conformance Packs, Macie, Firewall Manager, AWS WAF, Audit Manager), cost management for DevOps (Budgets actions, Cost Anomaly Detection, Compute Optimizer, Savings Plans), plus five reference CI/CD architectures (serverless API, ECS blue/green, multi-account StackSets, EKS GitOps, data pipeline), a 22-scenario Answer Patterns table, a Pitfalls & Gotchas section, four architecture deep dives (centralised logging across 50 accounts, automated patching with Change Calendar, immutable pipelines for regulated workloads, self-healing microservice platforms), and a runbook / observability playbook. Every service on the DOP-C02 in-scope list is audited present.
What's Inside
Organizations, Landing Zone & Governance
AWS Organizations with OUs + SCPs (deny region, deny root, deny disabling CloudTrail), AWS Control Tower managed landing zone with Account Factory / AFT, Service Catalog portfolios with Launch Constraints and TagOptions, RAM resource sharing, CloudFormation StackSets (service-managed with Organizations auto-propagation), Config Conformance Packs, delegated administration for GuardDuty / Security Hub / Config / Inspector / Macie / Firewall Manager.
Identity, Encryption & Secrets
IAM with roles for compute (EC2, Lambda, CodeBuild — no long-lived keys), STS assume-role chains for cross-account pipelines, IAM Identity Center Permission Sets + OIDC for GitHub Actions, Directory Service, Cognito. KMS customer-managed keys with cross-account policies for pipelines, CloudHSM for FIPS 140-2 Level 3, ACM public + AWS Private CA, Secrets Manager with Lambda rotation, Systems Manager Parameter Store Standard vs. Advanced vs. Secrets Manager decision table.
CI/CD Pipeline Services
CodePipeline V2 (branch filters, file-path triggers, git tags, parallel stages, manual approval), CodeBuild (buildspec phases, Reports, batch builds, matrix, local + S3 cache, VPC mode, Lambda compute), CodeDeploy for EC2/ASG/Lambda/ECS with every AppSpec hook (ApplicationStop, BeforeInstall, AfterInstall, ApplicationStart, ValidateService, BeforeBlockTraffic, BeforeAllowTraffic, AfterAllowTraffic) and traffic-shift modes (Canary10Percent5Minutes, Linear10PercentEvery1Minute, AllAtOnce), CodeArtifact for npm / PyPI / Maven / NuGet, CodeStar deprecation (July 2024), CodeCommit return-to-GA (November 2025), CodeGuru + Amazon Q Developer.
Deployment Strategies
Decision matrix across In-place / Rolling / Rolling with additional batch / Immutable / Blue-Green / Canary / Linear / All-at-once with downtime, cost, rollback, and use-case columns. Lambda alias traffic shifting with CloudWatch alarm rollback. ECS blue/green with two ALB target groups and BeforeAllowTraffic / AfterAllowTraffic hooks. Elastic Beanstalk deployment policies.
Infrastructure as Code
CloudFormation intrinsic functions, pseudo parameters, helper scripts (cfn-init, cfn-signal, cfn-hup, cfn-get-metadata), CreationPolicy, UpdatePolicy, DeletionPolicy, Change Sets, Drift Detection, Nested Stacks, StackSets, Custom Resources, Hooks, Modules, rollback configuration on CloudWatch alarm. SAM with sam local + SAM Pipelines. CDK with Constructs + Aspects. AWS Proton for platform engineering with environment + service templates. Service Catalog for governed self-service.
Configuration Management & Fleet Ops
The full AWS Systems Manager suite: Fleet Manager, Run Command, State Manager Associations, Patch Manager with baselines + Maintenance Windows, Automation runbooks (called from EventBridge + Config + Incident Manager), Session Manager, Parameter Store, AppConfig for runtime feature flags with validators + CloudWatch alarm rollback, Change Manager, Incident Manager on-call rotas + response plans, Inventory, OpsCenter. OpsWorks end-of-life flagged (May 2024) with migration direction.
Monitoring, Logging & Observability
CloudWatch metrics (standard + high-res 1s custom), alarms (standard + composite + anomaly detection + metric math), Dashboards, Metric Streams, Contributor Insights, Synthetics canaries, Evidently feature flags and A/B experiments, ServiceLens + X-Ray maps. CloudWatch Logs subscription filters → Firehose / Kinesis / Lambda / OpenSearch, Logs Insights, Live Tail, cross-account sharing. Managed Prometheus + Managed Grafana + X-Ray + CloudTrail Lake. Kinesis Data Streams + Firehose, OpenSearch Service, Athena on S3, QuickSight, EMR.
Incident & Event Response
The event-driven auto-remediation pattern (GuardDuty / Config / CloudWatch Alarm / CloudTrail → EventBridge → SSM Automation / Lambda / Step Functions). Incident Manager response plans with contact + escalation + chat channel + runbook. AWS Fault Injection Simulator (FIS) managed chaos experiments with CloudWatch alarm stop conditions. AWS Resilience Hub with RTO/RPO scoring. AWS Health + EventBridge org-wide. AWS Backup restore testing + vault lock. Elastic Disaster Recovery.
Resilient Cloud Solutions
Four DR patterns with RPO/RTO: Backup & Restore, Pilot Light, Warm Standby, Active/Active. Multi-AZ defaults, Multi-Region patterns (Aurora Global DB, DynamoDB Global Tables, S3 CRR with RTC, Route 53 failover, Global Accelerator), Application Recovery Controller routing controls + readiness checks, Auto Scaling target tracking + predictive, circuit breakers (SQS + DLQ, Step Functions retries with exponential back-off + jitter), chaos testing.
Security & Compliance Automation
Pipeline security: OIDC roles instead of long-lived creds, Signer for Lambda + container signing, CodeArtifact + KMS for artefacts, CodeGuru + Amazon Q + third-party SAST/SCA, Inspector for ECR + EC2 + Lambda, manual approval gates, policy as code (CloudFormation Guard, cfn-lint). AWS Config + Conformance Packs, CloudTrail Lake + CloudTrail Insights, Security Hub with FSBP/CIS/PCI standards, Audit Manager, Firewall Manager for org-wide WAF / Shield / SG / Network Firewall. GuardDuty, Detective, Macie.
Scenario → Answer Patterns
22 DOP-C02 scenarios mapped to their AWS default answer: centralised logging, zero-downtime Lambda, public S3 remediation, EC2 secret removal, patch-at-scale, cross-account CodePipeline, drift detection, DR for stateful EC2, cold-start mitigation, threat detection auto-quarantine, Region failover, feature flags with rollback, microservice platform, chaos testing, immutable log retention, message durability, SSO, central WAF, config versioning, and the CodeCommit reversal update.
Reference Architectures
Five full walkthroughs: serverless API pipeline (Lambda + API GW + DynamoDB with SAM, CodeDeploy canary, CloudWatch alarm rollback, Synthetics canary), ECS Fargate blue/green (image scan, two target groups, BeforeAllowTraffic smoke tests), multi-account IaC pipeline with StackSets + drift remediation, EKS GitOps (Argo/Flux + Karpenter + Argo Rollouts canary), and a data pipeline (Kinesis → Firehose → S3 Parquet → Athena / Redshift Spectrum / QuickSight with Glue + Step Functions + Lake Formation).
Why This Cheat Sheet Helps
DOP-C02 is a pattern-recognition exam. Long scenarios describe an operational problem and each wrong answer is plausible. The winning skill is knowing the AWS default answer to recurring questions: 'zero-downtime Lambda deploy with rollback' → alias + CodeDeploy canary + CloudWatch alarm; 'auto-remediate public S3' → Config rule + EventBridge + SSM Automation; 'cross-account CodePipeline' → artefact bucket policy + KMS key policy + cross-account role; 'patch 5000 instances' → Patch Manager + Maintenance Windows + Change Calendar. This cheat sheet puts those patterns side by side with decision trees, so you stop second-guessing.
It assumes you already know how to wire up a pipeline — this is not an intro. Use it in the final weeks to map the exam's surface area, reinforce the event-driven remediation fabric (EventBridge + SSM), and make sure your mental model of observability, deployment, and resilience matches AWS's own prescribed patterns.
How to Use It
Skim the whole sheet once to see how the six domains map to sections. Then take a practice exam — for each wrong answer, find the relevant section and study the tables and decision trees. Pay special attention to section 21 (Scenario → Answer Patterns), section 23 (Decision Trees That Save Exam Points), and section 25 (Pitfalls & Gotchas) — these encode the most frequently-tested rules.
In the final week, walk through the six domain weights against your confidence: SDLC Automation (22%) → sections 11, 12, 20; Configuration Management & IaC (17%) → sections 13, 14, 22; Resilient Cloud (15%) → section 17; Monitoring & Logging (15%) → sections 15, 27; Incident & Event Response (14%) → sections 16, 26; Security & Compliance (17%) → sections 3, 4, 18. Pair with CloudNinja's free DOP-C02 practice exam to surface gaps.
Frequently Asked Questions
Is this AWS DevOps Engineer Professional cheat sheet free?
Yes, completely free with no signup required. Download the PDF directly from CloudNinja and use it as a study reference for the DOP-C02 exam.
How much AWS experience do I need before DOP-C02?
AWS recommends two or more years of hands-on experience provisioning, operating, and managing AWS environments, plus experience with at least one modern programming language and CI/CD. The exam is automation-heavy: you are expected to know the event-driven remediation fabric (EventBridge + SSM), the full Systems Manager suite, CodeDeploy traffic-shifting strategies, CloudFormation change-set/drift/StackSet patterns, and multi-account pipeline security. If you do not already hold Developer Associate or SysOps/CloudOps Associate, consider those first.
How is DOP-C02 different from the Solutions Architect Professional?
SAP-C02 tests which architecture you would choose; DOP-C02 tests how you would operate it day-to-day. DOP-C02 goes deep into CI/CD pipelines (CodePipeline V2, CodeBuild buildspec, every CodeDeploy hook), infrastructure as code (CloudFormation helpers, StackSets, Custom Resources, Hooks), Systems Manager (Fleet Manager, Run Command, State Manager, Patch Manager, Automation, Incident Manager, AppConfig), monitoring with composite / anomaly / metric-math alarms, and event-driven auto-remediation via EventBridge + SSM. Expect scenario questions where the right answer automates an ops task end-to-end.
Is this cheat sheet updated for the current DOP-C02 exam?
Yes, it is built directly from the current DOP-C02 exam guide (devops-engineer-professional) and audited against the full in-scope services list. It reflects current services and recent changes — CodeCommit returned to GA on 2025-11-24, CodeStar deprecated in July 2024, OpsWorks Stacks EOL in May 2024, the AWS Support plan restructure, Amazon Q Developer as the successor to CodeGuru Reviewer, and newer services like CodePipeline V2, Application Recovery Controller, Amazon Managed Service for Prometheus, and AWS Resilience Hub.