AWS DevOps Engineer Professional Course
A structured AWS DevOps Engineer Professional course covering CI/CD, infrastructure as code, configuration management, monitoring, security, and resilient architecture, with linked practice questions.
Course progress
0 / 5
Back to courses
What you will learn
- Describe CI/CD and release automation.
- Explain infrastructure as code and configuration.
- Describe monitoring, logging and observability.
- Explain security and compliance in DevOps.
- Describe resilient architecture and operations.
Before you start
- Practical AWS experience is recommended.
- Familiarity with code pipelines and Linux is helpful.
- Associate-level AWS certification or equivalent experience is beneficial.
Lesson 1 CI/CD and Release Automation
The AWS Certified DevOps Engineer Professional exam validates automating the software delivery lifecycle on AWS. The first domain is CI/CD and release automation. AWS CodePipeline orchestrates source, build, test, and deploy stages, while AWS CodeBuild compiles and tests code in managed environments. AWS CodeDeploy rolls out application revisions to EC2, Lambda, or on-premises servers, and AWS CodeCommit hosts Git repositories. Pipelines can include manual approval gates, cross-region actions, and artifact storage. Deployment strategies include rolling updates, blue/green environments, and canary releases that send a small share of traffic to a new version. Release engineers define build specifications, test rollback procedures, and monitor every stage with alarms.
Example
Example: A team uses CodePipeline with a manual approval stage, CodeBuild for tests, and a blue/green CodeDeploy rollout that shifts traffic after health checks pass.Lesson 2 Infrastructure as Code and Configuration
Infrastructure as code and configuration management make environments repeatable and auditable. AWS CloudFormation provisions resources from declarative templates, change sets preview updates, and drift detection finds manual changes. StackSets deploy templates across accounts and Regions, and the AWS CDK defines infrastructure in programming languages. Terraform manages infrastructure across providers. AWS Systems Manager applies configuration baselines with State Manager, runs scripts with Run Command, automates patching with Patch Manager, and executes runbooks with Automation. AWS Config records and evaluates resource configuration, and AWS OpsWorks uses Chef or Puppet. Secrets and parameters should live in AWS Secrets Manager or Parameter Store rather than code.
Example
Example: A team defines a stack in CloudFormation, reviews a change set, deploys with StackSets, and uses Systems Manager Patch Manager to keep instances updated.Lesson 3 Monitoring, Logging, and Observability
Monitoring, logging, and observability reveal how systems behave in production. Amazon CloudWatch collects metrics, alarms, and dashboards; Logs Insights queries log groups; Contributor Insights identifies top contributors; and Synthetics runs canary checks against endpoints. AWS X-Ray traces requests through distributed applications, and Container Insights monitors ECS and EKS. AWS Distro for OpenTelemetry helps instrument applications for traces and metrics. Log subscriptions stream events to Lambda, Kinesis, or OpenSearch for processing. A mature observability practice defines SLIs and SLOs, correlates metrics, logs, and traces, and turns signals into automated responses.
Example
Example: A production team uses CloudWatch alarms, Logs Insights for triage, X-Ray for trace analysis, and a Synthetics canary that verifies the checkout flow.Lesson 4 Security and Compliance in DevOps
Security and compliance must be built into pipelines and infrastructure. The principle of least privilege limits permissions, IAM permission boundaries cap role permissions, and service control policies restrict organization accounts. AWS KMS manages encryption keys, AWS Secrets Manager stores and rotates secrets, and Amazon GuardDuty detects threats. Amazon Inspector assesses workload vulnerabilities, ECR image scanning finds issues in container images, and AWS Security Hub aggregates findings. AWS CloudTrail records API activity, and AWS Config evaluates resource configuration. DevOps teams use automated checks, vulnerability gates, encrypted artifacts, and audit trails to deliver securely without slowing releases.
Example
Example: A pipeline scans container images with ECR, evaluates IAM policies with automated checks, stores secrets in Secrets Manager, and sends findings to Security Hub.Lesson 5 Resilient Architecture and Operations
Resilient architecture and operations keep systems available during failures and scale. Auto Scaling groups maintain capacity across Availability Zones, and load balancers route traffic to healthy targets. RDS Multi-AZ provides synchronous database failover, DynamoDB on-demand scales automatically, and Route 53 health checks with failover routing shift traffic across Regions. Event-driven designs use Lambda, SNS, and SQS to decouple components. Lambda reserved concurrency protects functions from overload, and queues smooth traffic spikes. Multi-Region disaster recovery replicates data and provides failover paths. Operations teams test failure scenarios, automate recovery runbooks, and continuously review capacity and cost.