DVA-C02 · CHEAT SHEET

AWS Certified Developer - Associate

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Development with AWS Services

32–32%

Develop code for applications hosted on AWS

An SNS fanout to several SQS queues delivers a copy of each message to every consumer and keeps it until it is processed. In sagas, choreography chains services through events (for example with EventBridge) without a central coordinator, while orchestration uses a coordinator such as Step Functions that runs the steps and the compensations. The strangler fig pattern migrates a monolith piece by piece behind a proxy such as API Gateway.
A stateless component keeps nothing in its memory or local disk that a later request needs, so any instance can serve any request. Web sessions go to a central store such as ElastiCache or DynamoDB; ALB sticky sessions do not remove the state. In Lambda, execution environments are reused (connections outside the handler, cache in /tmp), but durable state always goes to an external service.
In a tightly coupled system, a change or failure in one component forces changes in, or breaks, the components that depend on it. Loose coupling adds an intermediate layer (SQS queues, Kinesis streams, Step Functions, EventBridge events or SNS topics) and makes each component know only a published, versioned interface. Sharing a database between services and direct calls without asynchronous processing are anti-patterns.
In a synchronous call the caller waits for the response; in an asynchronous call it hands off the work and moves on. Lambda is invoked synchronously with RequestResponse and asynchronously with Event, and asynchronous invocations can send failures to destinations such as standard SQS queues. API Gateway invokes Lambda asynchronously with the X-Amz-Invocation-Type 'Event' header. Synchronous Express workflows return the result.
AWS SDKs retry transient and throttling errors with exponential backoff and jitter; errors such as ValidationException are not retried. Standard mode is the recommended one, and adaptive mode adds a client-side rate limiter. Configuration in code takes precedence over environment variables and the shared config file. Because duplicates can happen, writes must be idempotent, for example with DynamoDB conditional writes.

Develop code for AWS Lambda

For Lambda to reach private resources in a VPC (RDS, ElastiCache), the function is attached to the private subnets with an allowed security group, and its role needs EC2 network interface permissions, such as those in AWSLambdaVPCAccessExecutionRole. A VPC-attached function only sees that VPC: it needs a NAT gateway to reach the internet. RDS Proxy pools database connections so the function can scale.
Environment variables are part of each version's configuration, and update-function-configuration replaces the whole Variables structure. Layers share dependencies across .zip functions and are updated separately from the code. Reserved concurrency sets a minimum and maximum for a function; provisioned concurrency keeps pre-initialized environments to avoid cold starts.
For asynchronous invocations, Lambda retries errors and can send a record with the request and response to an on-failure destination; a dead-letter queue only receives the event. With SQS, ReportBatchItemFailures retries only the failed messages. With Kinesis, limit MaximumRetryAttempts and add a destination so a bad record does not block the shard.
The AWS SAM CLI generates events with the real structure (sam local generate-event) and invokes the function in a local container (sam local invoke), but these tests do not validate permissions between resources. For that, test in the cloud, for example with sam remote invoke. The console supports private and shareable test events, stored in the EventBridge schema registry.
Services such as S3 and SNS invoke Lambda asynchronously; API Gateway invokes it synchronously; SQS, Kinesis and DynamoDB Streams use an event source mapping that polls and delivers batches. Services that invoke a function need permission in its resource-based policy. If a function writes to the bucket that triggers it, use another bucket or a prefix to avoid loops.

Use data stores in application development

The partition key determines the partition where each item is stored; the more distinct values are used, the better traffic is spread. A user ID is a good key; a status with few values or a rounded date creates hot partitions. To spread writes, add a random suffix, which requires querying every suffix, or a calculated one, which still allows reading a specific item.
DynamoDB reads are eventually consistent by default; with ConsistentRead set to true, GetItem, Query and Scan return the latest data, but only on tables and local secondary indexes. Global indexes and streams are always eventually consistent. Global tables use MREC (asynchronous replication) or MRSC (synchronous), a mode chosen at creation that cannot be changed.
Query reads only the items of one partition key value, with an optional sort key condition, and returns results in sort key order. Scan reads the whole table or index and gets less efficient as it grows. In both, the filter is applied after reading, so it does not reduce consumed capacity. For large tables, a parallel Scan uses Segment and TotalSegments.
The primary key is simple (partition) or composite (partition and sort). A local secondary index keeps the partition key with another sort key and is created with the table; a global one can have different keys and be added later with UpdateTable. KEYS_ONLY, INCLUDE or ALL projections set which attributes are copied, and a GSI whose key attributes are missing on many items is sparse.
The low-level DynamoDB API uses DynamoDB JSON, with type descriptors such as S or N and numbers sent as strings. In JavaScript v3, DynamoDBDocumentClient avoids manual marshalling and util-dynamodb provides marshall and unmarshall. In Java 2.x, the Enhanced Client maps classes annotated with @DynamoDbBean to tables through TableSchema.fromBean.

2. Security

26–26%

Implement authentication and/or authorization for applications and AWS services

Amazon Cognito identity pools exchange tokens from social, SAML or OIDC providers (or a user pool) for temporary AWS credentials tied to IAM roles. User pools federate SAML or OIDC IdPs and issue their own JWTs to the app. For workloads such as GitHub Actions, create an IAM OIDC provider and a role that allows sts:AssumeRoleWithWebIdentity, restricted with conditions such as :sub.
Cognito user pools issue ID tokens (identity), access tokens (scopes) and refresh tokens. In a REST API, a COGNITO_USER_POOLS authorizer validates the token in the Authorization header; in an HTTP API, the JWT authorizer checks signature, iss, aud or client_id, expiry and the route scopes. Outside API Gateway, verify the signature against the JWKS, for example with aws-jwt-verify.
For programmatic access, AWS recommends temporary credentials: IAM Identity Center profiles in the CLI (aws configure sso and aws sso login), instance profile or task roles on AWS compute, and IAM Roles Anywhere outside AWS. The CLI and SDKs resolve credentials in order: command line options, environment variables, shared files and, last, container or instance credentials.
Requests to AWS APIs are authenticated with Signature Version 4: the SDK or CLI signs with your credentials and AWS recalculates the signature, scoped to a date, Region and service. Lambda function URLs with AWS_IAM require SigV4-signed requests. S3 presigned URLs use their creator's credentials and expire with them when they are temporary; a skewed clock causes signature expired errors.
Assuming a role returns temporary STS credentials. A role has a trust policy (who can assume it) and a permissions policy (what it can do); across accounts the caller also needs sts:AssumeRole permission on the role ARN. Session policies only narrow permissions, sts:ExternalId prevents the confused deputy problem with third parties, and the CLI assumes roles with role_arn plus source_profile or credential_source.

Implement encryption by using AWS services

At rest: S3 encrypts new objects with SSE-S3 by default and supports SSE-KMS; DynamoDB always encrypts tables and lets you switch between AWS owned, AWS managed and customer managed keys; RDS is encrypted only at instance creation, or by copying a snapshot with encryption and restoring it. In transit: a bucket policy that denies requests where aws:SecureTransport is false enforces TLS.
AWS Certificate Manager issues public certificates and renews them automatically when they are DNS validated and the CNAME record stays in place; with email validation the owner must act, and imported certificates are renewed by reimporting them under the same ARN. AWS Private CA builds private root and subordinate CA hierarchies that issue X.509 certificates for internal TLS, with OCSP.
With server-side encryption, the service encrypts data as it writes it and decrypts it transparently for any authorized request (SSE-S3, SSE-KMS, DSSE-KMS or SSE-C in S3, encryption at rest in DynamoDB). With client-side encryption, the application encrypts before sending, using the Amazon S3 Encryption Client or the AWS Database Encryption SDK, and the service stores only ciphertext.
AWS KMS envelope encryption uses GenerateDataKey: the application encrypts locally with the plaintext data key, erases it and stores the encrypted copy with the data; GenerateDataKeyWithoutPlaintext returns only the encrypted copy. Decrypt is called to recover the key, KeyId is optional for symmetric keys, and the encryption context must match exactly because it is bound to the ciphertext as AAD.
For development, Amazon EC2 creates RSA or ED25519 key pairs with create-key-pair and returns the private key once without keeping a copy; you can also generate them with ssh-keygen and import only the public key with import-key-pair. EC2 Instance Connect pushes temporary public keys controlled by IAM. ACM can import self-signed certificates when the private key is unencrypted and PEM-encoded.

Manage sensitive data in application code

Classifying data (PII, PHI, financial) defines the controls each type needs: access, encryption, retention and auditing. AWS recommends tagging resources with their classification, monitoring them with AWS Config and defining allowed keys with tag policies. Amazon Macie finds sensitive data in S3, and Comprehend Medical DetectPHI detects PHI in clinical text.
Lambda always encrypts environment variables at rest with KMS: by default with an AWS managed key, or with a customer managed key (KMSKeyArn) to control rotation. Helpers for encryption in transit encrypt the value client-side, so code must call Decrypt and the role needs kms:Decrypt. Denying kms:Decrypt hides the variables without stopping users from managing the function.
Secrets Manager is the service for credentials, API keys and tokens: it offers automatic rotation and versions with staging labels such as AWSCURRENT; Parameter Store SecureString suits encrypted configuration without rotation. In Lambda, the Parameters and Secrets extension caches secrets over local HTTP. In ECS, injected secrets are read when the task starts, so tasks must be relaunched after rotation.
CloudWatch Logs data protection policies detect and mask data such as card numbers, PII, PHI or credentials at ingestion; they apply to one log group or to the whole account, and only principals with logs:Unmask see the original values. Events ingested before the policy are not masked. In Step Functions, includeExecutionData set to false keeps input and output out of the logs.
Application-level masking can be irreversible or reversible. The Powertools for AWS Lambda data masking utility offers erase, which replaces chosen fields with a placeholder, and encrypt/decrypt with KMS and an encryption context that must match on decrypt. Amazon Comprehend locates PII in real time (DetectPiiEntities) and produces redacted copies through an asynchronous job in ONLY_REDACTION mode.

3. Deployment

24–24%

Prepare application artifacts to be deployed to AWS

Lambda layers package libraries, custom runtimes or configuration files in a .zip that several functions share and that can be updated without touching code; they work only for .zip functions. For container image functions, dependencies go inside the image. Native dependencies must be built for Linux, for example with sam build --use-container.
Each service expects a specific layout: Lambda layers are extracted into /opt and Python ones need a top-level python directory; CodeBuild looks for buildspec.yml at the root unless another path is given (buildspecOverride); CodeDeploy needs appspec.yml at the revision root; and Elastic Beanstalk needs a ZIP with no parent folder and .config files in .ebextensions.
CodePipeline connects to GitHub, GitLab or Bitbucket repositories through AWS CodeConnections (the CodeStarSourceConnection action); by default it passes a shallow ZIP, and with CODEBUILD_CLONE_REF a full clone for CodeBuild. Triggers filter pushes by branch, file path or tag. CodeArtifact stores private packages and fetches public ones on demand.
In Lambda, memory is the only compute setting: CPU is allocated in proportion to it, and /tmp space is configured separately with ephemeral storage. In ECS, the task definition sets cpu and memory at task or container level; memory is a hard limit that kills the container when exceeded, and memoryReservation is a soft limit used for placement.
AWS AppConfig separates configuration from code: an application has environments (for example Beta and Production), configuration profiles with JSON Schema or Lambda validators, and gradual deployment strategies. If a CloudWatch alarm on the environment fires, the configuration rolls back. In Lambda, the AppConfig Agent extension serves cached configuration from localhost:2772.

Test applications in development environments

To test deployed code: sam remote invoke invokes Lambda functions, sends messages to SQS or records to Kinesis and starts state machines in the cloud; the Step Functions TestState API tests one state without creating or changing the state machine, with INFO, DEBUG and TRACE levels; and the API Gateway Test tab (or test-invoke-method) runs real calls with simulated logs.
Integration tests for serverless applications should run against resources deployed in the cloud, because that is how IAM permissions and cross-service configuration get validated. Mocks isolate business logic or external dependencies: API Gateway offers mock integrations that need no backend, and the Step Functions TestState API can mock the result or error of a service integration.
In API Gateway each stage is a named reference to a deployment and is part of the invoke URL, so a dev stage works as a test endpoint. TestInvokeMethod and the console Test tab run a method without deploying it, but the call is real. For HTTP APIs, the $default stage is served at the base URL and automatic deployments release every change.
The samconfig.toml file supports several named environments, and sam deploy --config-env chooses which one to use (stack name, Region, parameter_overrides). Command-line values take precedence over the file, and the file over template defaults. sam sync speeds up testing but is recommended for development only; staging and production are updated with sam deploy or a pipeline.
Testing event-driven flows means checking the effect on the real services: sam remote invoke sends messages to SQS queues, Kinesis streams or state machines in a deployed stack. TestEventPattern reports whether an event matches an EventBridge rule pattern without delivering it, and EventBridge archives let you replay past events to specific rules on the source bus.

Automate deployment testing

A test event is the JSON input to a function. sam local generate-event creates payloads with the same structure as each service's real events and accepts options to change their values. Lambda shareable test events are stored in the EventBridge schema registry, require permissions on that registry, and are managed from the CLI with sam remote test-event.
To take a REST API to another environment you create a deployment and associate it with a stage; changes to methods, integrations, authorizers or resource policies require redeployment, while stage settings and base path mappings do not. Canary releases test a deployment with part of a stage's traffic, and an OpenAPI export with extensions replicates the API elsewhere.
An integration environment should point to stable, approved versions. In Lambda you use an alias that points to a published version and is moved after each approval, because the unqualified ARN invokes $LATEST. In Amazon ECR, tag immutability prevents an approved tag from being reused. In Amplify Hosting each connected branch gets its own deployment and URL.
An AWS SAM template is a CloudFormation template with the required Transform: AWS::Serverless-2016-10-31 declaration. Local artifacts are uploaded to S3 with aws cloudformation package (or sam deploy) before deployment. Creating the stack requires acknowledging capabilities: CAPABILITY_IAM or CAPABILITY_NAMED_IAM for IAM resources and CAPABILITY_AUTO_EXPAND for macros without a change set.
In API Gateway each environment is usually a stage with its own settings: caching, throttling, logging, data tracing and stage variables. Stage variables let dev and prod use different backends, Lambda aliases or tables with the same API, but they must not hold sensitive data, and when they select a Lambda function you must grant invoke permission with add-permission.

Deploy code by using AWS Continuous Integration and Continuous Delivery (CI/CD) services

Lambda supports two package types: a .zip file archive and a container image stored in Amazon ECR, and the type cannot be changed on an existing function. Layers are .zip archives with shared dependencies that are extracted to /opt and work only with .zip functions. Images must implement the runtime API; with a non-AWS base image you must add the runtime interface client.
A stage is a named reference to a deployment and appears in the default execute-api URL. A custom domain name replaces that hostname: it requires an ACM certificate (in the same Region for Regional domains), a DNS record pointing to the API Gateway domain name, and API mappings to stages, which strip the base path. The default endpoint can be disabled to force use of the domain.
Before updating a stack, review a change set, which shows which resources will be added, modified or replaced. Each property has an update behavior; when it causes Replacement, UpdateReplacePolicy decides whether the old resource is retained, snapshotted or deleted. In SAM, AutoPublishAlias and DeploymentPreference turn each code change into a gradual deployment with rollback.
Per-environment configuration is organized in Parameter Store hierarchies (/dev/..., /prod/...) and read with GetParametersByPath. CodePipeline separates environments into stages, and a manual approval action stops the execution until someone with permissions approves it. In Elastic Beanstalk, a blue/green deployment tests the release in another environment and exchanges CNAMEs with Swap environment URLs.
Elastic Beanstalk deploys versions with the All at once, Rolling, Rolling with additional batch (keeps capacity), Immutable and Traffic splitting (canary, needs an ALB) policies. Moving to an incompatible platform version requires a blue/green deployment with a CNAME swap. In Lambda, a weighted alias splits traffic between two published versions.

4. Troubleshooting and Optimization

18–18%

Assist in a root cause analysis

Many Lambda defects come from code: in Node.js, missing await lets the handler return before calls finish; object keys in S3 events arrive URL encoded and must be decoded; and writing to the same bucket or table that triggers the function creates infinite loops. The START log line shows which version was invoked.
In Lambda, Errors counts function errors (timeouts included), Throttles counts rejected requests that appear in neither Invocations nor Errors, and IteratorAge measures how far behind stream records are. In X-Ray, Error means 4xx, Fault means 5xx and Throttle means 429 responses; services without their own segments appear as inferred segments.
CloudWatch Logs Insights queries stored logs with commands chained by |: fields, filter, parse (glob or regex), stats with bin(), sort, limit and dedup. Metric filters, by contrast, are not retroactive: they only publish data after they are created. To limit cost, query only the log groups you need over the narrowest time range.
Embedded metric format (EMF) creates custom metrics asynchronously from JSON logs with an _aws.CloudWatchMetrics node (Namespace, Dimensions, Metrics). It needs only logs:PutLogEvents, not cloudwatch:PutMetricData. Metric values must be numeric root members, and every dimension combination creates a metric, so avoid dimensions such as requestId.
CloudWatch offers automatic and custom dashboards that can combine resources from several Regions and, with cross-account observability, from several accounts in a monitoring account. Lambda Insights collects system metrics and cold starts through an extension, Container Insights does the same for ECS and EKS, and Contributor Insights shows top-N contributors in logs.

Instrument code for observability

Logging records the events an application generates; monitoring continuously assesses its health and performance, often through metrics and alarms derived from those logs. Observability goes further: it combines metrics, logs and traces so signals can be correlated to answer new questions, such as the success rate for a specific group of users.
In Lambda, the JSON log format lets you filter application and system logs by level without code changes, although a level set in the code itself takes precedence. Several functions can write to one custom log group, whose retention setting decides how long events are kept. Data protection policies mask sensitive data at ingestion, and only principals with logs:Unmask can see it unmasked.
Custom metrics are published with the PutMetricData API (namespace, metric name and dimensions) or by writing logs in the embedded metric format (EMF), from which CloudWatch extracts metrics without extra calls. StorageResolution=1 creates high-resolution metrics, and the Values and Counts fields batch many values in one call while keeping percentiles, which statistic sets lose.
In X-Ray, annotations are string, number or Boolean key-value pairs that are indexed, so traces can be searched with filter expressions such as annotation[key]; metadata accepts any type, including objects, but is not indexed. In Lambda the function segment cannot be accessed or changed, so annotations go on subsegments and setUser cannot be used.
CodeDeploy and CodePipeline state changes are emitted as EventBridge events, and a rule that matches the detail type and state can send them to an SNS topic. For quotas, CloudWatch publishes usage metrics in AWS/Usage, and the SERVICE_QUOTA expression lets you alarm as usage approaches the quota. Composite alarms notify only when several conditions are met together, which reduces noise.

Optimize applications by using AWS services and features

In Lambda, concurrency is the number of in-flight requests at the same time and is estimated as requests per second times average duration in seconds. Reserved concurrency sets a maximum and minimum for one function; provisioned concurrency pre-initializes environments on a version or alias, never on $LATEST. For SQS event sources, maximum concurrency limits each queue separately.
CloudWatch Application Signals automatically collects call volume, availability, latency, fault and error metrics for services on EKS, ECS and EC2, and supports SLOs. Lambda Insights, an extension delivered as a layer, adds per-invocation system metrics such as CPU time, memory and network, plus cold starts. Amazon CodeGuru Profiler finds the lines of code that use the most CPU, and X-Ray shows the latency of calls to dependencies.
Lambda allocates CPU in proportion to configured memory, so memory is the main performance lever, including for CPU-bound or network-bound functions. AWS Lambda Power Tuning tests the function at several memory sizes with Step Functions, and Compute Optimizer recommends memory from recent utilization, for x86_64 only. REPORT lines show the maximum memory used by each invocation.
Without a filter policy, every subscriber to an SNS topic receives every message; with one, it receives only the messages that match its conditions. FilterPolicyScope decides whether message attributes (the default) or the JSON message body are evaluated. Several properties combine with AND, several values of one property with OR, and operators such as numeric, anything-but or exists refine matching.
By default, CloudFront does not consider headers when caching; to cache different versions by a header, such as Accept-Language or CloudFront-Is-Mobile-Viewer, the header must be in the cache key through a cache policy. An origin request policy sends data to the origin without adding it to the key. In API Gateway, headers, paths or query strings can be used as cache keys.

Practice this certification