AWS Certified DevOps Engineer – Professional Book Curriculum

As of July 2026, the current exam remains AWS Certified DevOps Engineer – Professional, DOP-C02. It has 75 multiple-choice or multiple-response questions, lasts 180 minutes, costs USD 300, and is offered through Pearson VUE. The exam guide explains that 65 questions are scored and 10 are unscored; the minimum passing score is 750 on a 100–1,000 scale. (AWS Documentation)

1. Official exam domains

Domain	Weight
SDLC Automation	22%
Configuration Management and Infrastructure as Code	17%
Resilient Cloud Solutions	15%
Monitoring and Logging	15%
Incident and Event Response	14%
Security and Compliance	17%

These percentages should directly control the book’s length, number of labs, and number of practice questions. (AWS Documentation)

2. Recommended book structure

I recommend eight parts, 64 chapters, approximately 900–1,200 pages, plus a separate practice-exam book.

Part 0 — Professional DevOps Foundations

This section closes gaps without repeating an Associate-level AWS course.

Chapter	Topic
1	Understanding the DOP-C02 exam
2	DevOps principles and the AWS operating model
3	Software delivery lifecycle and feedback loops
4	AWS accounts, Regions and Availability Zones
5	Multi-account architecture with AWS Organizations
6	IAM foundations for DevOps engineers
7	Networking knowledge required for DevOps
8	EC2, containers and serverless deployment models
9	Git workflows, trunk-based development and pull requests
10	Automation with AWS CLI, SDKs and shell scripts

AWS explicitly places advanced networking algorithms, deep database optimization and full-stack application development outside the target candidate’s expected tasks. The foundation should therefore teach enough networking and databases for operational decisions without turning into an Advanced Networking or Database Specialty book. (AWS Documentation)

Foundation project

Build a small application with:

• Git repository
• development and production environments
• IAM deployment role
• AWS CLI deployment script
• tagging strategy
• budget alerts
• automated cleanup

---

Part 1 — SDLC Automation

Exam weight: 22%

This must be the largest part of the book. The official domain covers CI/CD pipelines, automated testing, artifact management and deployment strategies for EC2, containers and serverless applications. (AWS Documentation)

Chapter	Topic
11	Designing a modern delivery pipeline
12	Source control and repository strategies
13	AWS CodePipeline architecture
14	CodeBuild and buildspec.yml
15	Build environments, caching and reports
16	Unit, integration, acceptance and security tests
17	Testing pull requests and code merges
18	Test reports, coverage and quality gates
19	Artifact management with S3
20	Package management with CodeArtifact
21	Container artifacts with Amazon ECR
22	Building golden images with EC2 Image Builder
23	Secrets in build and deployment pipelines
24	Cross-account pipelines
25	Cross-Region pipelines
26	EC2 deployments with CodeDeploy
27	In-place versus immutable deployment
28	Blue/green deployment
29	Canary and linear traffic shifting
30	ECS deployment strategies
31	EKS deployment concepts
32	Lambda versions, aliases and weighted traffic
33	SAM and serverless deployment pipelines
34	Rollback, approval gates and deployment troubleshooting

Essential labs

1. EC2 delivery pipeline Repository → CodeBuild → CodePipeline → CodeDeploy → Auto Scaling group

2. Container delivery pipeline Build container → scan → push to ECR → deploy to ECS

3. Serverless pipeline SAM application → tests → package → deploy → canary release

4. Cross-account promotion Development → staging → production with assumed IAM roles

Decision tables

The book should compare:

• CodeDeploy in-place vs blue/green
• ECS rolling vs blue/green
• Lambda all-at-once vs linear vs canary
• mutable vs immutable infrastructure
• S3 vs CodeArtifact vs ECR
• manual approvals vs automated quality gates
• CodePipeline-native actions vs third-party integrations

---

Part 2 — Configuration Management and Infrastructure as Code

Exam weight: 17%

The official blueprint includes CloudFormation, CDK, SAM, StackSets, Systems Manager, Config, AppConfig, Organizations, Control Tower, Service Catalog and automation at organizational scale. (AWS Documentation)

Chapter	Topic
35	Infrastructure as Code principles
36	CloudFormation template structure
37	Parameters, mappings, conditions and outputs
38	Dependencies and intrinsic functions
39	Change sets and safe infrastructure changes
40	Rollback behaviour and troubleshooting
41	Drift detection and reconciliation
42	Nested stacks and reusable modules
43	CloudFormation StackSets
44	AWS CDK constructs and stacks
45	CDK synthesis, deployment and testing
46	AWS SAM for serverless infrastructure
47	Systems Manager Inventory and State Manager
48	Patch Manager and Maintenance Windows
49	Systems Manager Automation runbooks
50	Parameter Store and Secrets Manager
51	AWS AppConfig deployment strategies
52	AWS Config rules and remediation
53	Service Catalog and approved products
54	AWS Organizations and organizational units
55	Control Tower and account vending
56	Service control policies
57	Multi-account role assumption
58	Lambda and Step Functions for infrastructure automation

Essential labs

• Build reusable CloudFormation components.
• Deploy StackSets across accounts and Regions.
• Create a CDK application with automated tests.
• Patch EC2 fleets with Systems Manager.
• Automatically remediate a noncompliant resource.
• Create a simplified account-vending workflow.
• Deploy application configuration gradually with AppConfig.

Critical comparisons

• CloudFormation vs CDK vs SAM
• Parameter Store vs Secrets Manager
• CloudFormation drift vs AWS Config compliance
• StackSets vs independent stacks
• SCP vs IAM permissions boundary vs IAM policy
• State Manager vs Automation vs Run Command
• infrastructure configuration vs application configuration

---

Part 3 — Resilient Cloud Solutions

Exam weight: 15%

This domain tests high availability, scalability, Multi-AZ and multi-Region design, loosely coupled architectures, backup, disaster recovery, RTO and RPO. (AWS Documentation)

Chapter	Topic
59	Availability, durability and resilience
60	SLA, RTO and RPO
61	Finding single points of failure
62	Multi-AZ compute architecture
63	Load balancing and health checks
64	Auto Scaling policies and metrics
65	Stateless and stateful application design
66	SQS for workload decoupling
67	SNS and fan-out architectures
68	EventBridge-based integration
69	Serverless resilience
70	ECS and EKS scaling concepts
71	DynamoDB scaling and global tables
72	RDS and Aurora availability patterns
73	S3 replication and data protection
74	Route 53 failover and routing policies
75	CloudFront for global applications
76	Backup and restore
77	Pilot light
78	Warm standby
79	Multi-site active/active
80	Automated recovery and failover testing
81	AWS Backup and cross-Region recovery
82	Resilience testing with AWS Fault Injection Service

Major lab

Build and test a highly available workload:

• multi-AZ application
• load balancer
• Auto Scaling
• replicated data layer
• health checks
• automated backup
• recovery runbook
• controlled failure injection

Required decision matrices

• Multi-AZ vs multi-Region
• backup and restore vs pilot light vs warm standby vs active/active
• target tracking vs step scaling vs scheduled scaling
• SQS vs SNS vs EventBridge
• RDS Multi-AZ vs read replicas
• DynamoDB global tables vs regional tables
• Route 53 failover vs latency vs weighted routing

---

Part 4 — Monitoring, Logging and Observability

Exam weight: 15%

The official domain includes metrics, logs, traces, CloudWatch agents, metric filters, log subscriptions, dashboards, anomaly detection, CloudTrail, Config, X-Ray, Athena, OpenSearch and event-based automation. (AWS Documentation)

Chapter	Topic
83	Monitoring versus observability
84	Metrics, logs and traces
85	CloudWatch namespaces, dimensions and resolution
86	Standard and custom metrics
87	CloudWatch Agent
88	Log groups, streams and retention
89	Encrypting logs with KMS
90	Metric filters
91	Subscription filters
92	Logs Insights
93	Centralized multi-account logging
94	CloudWatch dashboards
95	Static and anomaly detection alarms
96	Composite alarms
97	CloudWatch metric streams
98	X-Ray tracing
99	Monitoring Lambda, ECS and EKS
100	CloudTrail event history and trails
101	Organization trails
102	AWS Config monitoring
103	Log analytics with Athena and OpenSearch
104	Health checks and synthetic monitoring
105	Alarm actions and automated remediation

Essential labs

• Install and configure CloudWatch Agent.
• Create a metric from application logs.
• Build an alarm and SNS notification.
• Centralize logs into a security account.
• Trace a distributed application with X-Ray.
• Query CloudTrail and application logs.
• Build an executive and operational dashboard.

Observability model

Every service chapter should answer:

1. Which metrics matter?
2. Which logs exist?
3. Which events are generated?
4. How is tracing enabled?
5. What should trigger an alarm?
6. What automated action should follow?

---

Part 5 — Incident and Event Response

Exam weight: 14%

The official tasks cover event sources, event-processing workflows, automatic configuration changes, remediation and troubleshooting failed deployments and workloads. (AWS Documentation)

Chapter	Topic
106	Incident response lifecycle
107	Events versus metrics versus logs
108	EventBridge events and patterns
109	AWS Health events
110	CloudTrail events
111	SNS, SQS and Lambda event workflows
112	Step Functions remediation workflows
113	Systems Manager OpsCenter
114	Automation runbooks
115	AWS Config automatic remediation
116	EC2 automatic recovery
117	Failed CodeBuild troubleshooting
118	Failed CodePipeline troubleshooting
119	Failed CodeDeploy troubleshooting
120	CloudFormation failure analysis
121	ECS task troubleshooting
122	EKS workload troubleshooting
123	Lambda failure and retry behaviour
124	Root cause analysis
125	Runbooks, playbooks and post-incident reviews

Incident game days

Each game day should provide:

• symptoms
• incomplete monitoring information
• misleading distractors
• architecture diagram
• logs and metrics
• expected investigation path
• remediation
• prevention
• exam-style questions

Example scenarios:

• pipeline succeeds but application is unhealthy
• deployment causes increasing ALB 5xx responses
• ECS service cannot pull from ECR
• Lambda retry causes duplicate processing
• CloudFormation update rolls back
• Auto Scaling continuously replaces instances
• cross-account deployment receives AccessDenied

---

Part 6 — Security and Compliance

Exam weight: 17%

The blueprint covers IAM at scale, federation, IAM Identity Center, permissions boundaries, SCPs, RBAC and ABAC, credential rotation, KMS, ACM, network controls, Security Hub, GuardDuty, Inspector, Macie, Detective, Config and security auditing. (AWS Documentation)

Chapter	Topic
126	The AWS shared responsibility model for DevOps
127	IAM policy evaluation
128	Identity-based and resource-based policies
129	Human identities and IAM Identity Center
130	Machine identities and IAM roles
131	AWS STS and temporary credentials
132	Cross-account access
133	Permissions boundaries
134	Service control policies
135	Role-based access control
136	Attribute-based access control
137	Least-privilege pipeline roles
138	Secrets Manager and automatic rotation
139	Parameter Store secure strings
140	KMS keys, policies and grants
141	Encryption at rest and in transit
142	ACM and certificate automation
143	Security groups and network ACLs
144	AWS WAF, Shield and Network Firewall
145	GuardDuty
146	Inspector
147	Macie
148	Security Hub
149	Detective
150	IAM Access Analyzer
151	CloudTrail security auditing
152	VPC Flow Logs
153	CloudFormation drift and security compliance
154	Security automation across Organizations
155	Security controls inside CI/CD
156	Software supply-chain security
157	Automated security response

Essential labs

• Cross-account deployment role with least privilege.
• IAM policy troubleshooting.
• SCP and permissions-boundary comparison.
• Secrets rotation workflow.
• KMS-encrypted pipeline artifacts.
• Organization-wide CloudTrail.
• GuardDuty finding routed through EventBridge.
• Security Hub aggregation across accounts.
• Config remediation for unencrypted or public resources.
• Pipeline security scanning and approval gate.

---

Part 7 — Cross-Domain Architecture Cases

Professional exam questions rarely remain inside one isolated service. This part should combine all six domains.

Case study 1: Multi-account delivery platform

Build:

• Organizations structure
• shared-services account
• security account
• development and production accounts
• cross-account CodePipeline
• reusable IaC
• centralized logging
• guardrails
• automated deployment and rollback

Case study 2: Container platform

Build and reason about:

• ECR
• ECS or EKS
• deployment strategy
• service discovery
• Auto Scaling
• observability
• secrets
• failure recovery
• cross-account promotion

Case study 3: Serverless event platform

Use:

• API Gateway
• Lambda
• DynamoDB
• SQS
• SNS
• EventBridge
• Step Functions
• SAM
• X-Ray
• CloudWatch
• DLQs and retry controls

Case study 4: Regulated workload

Design:

• centralized audit logs
• KMS
• least privilege
• Config rules
• Security Hub
• GuardDuty
• immutable artifacts
• approval stages
• automated evidence collection
• backup and recovery testing

Case study 5: Production incident

The learner receives:

• architecture
• pipeline history
• CloudWatch graphs
• CloudTrail events
• application logs
• security finding

The task is to identify the root cause, restore service and prevent recurrence.

---

Part 8 — Exam Preparation

Chapter	Topic
158	How professional-level AWS questions are constructed
159	Identifying business and technical requirements
160	Eliminating plausible distractors
161	Choosing the least operationally complex solution
162	Recognizing multi-account requirements
163	Recognizing high-availability requirements
164	Recognizing security and compliance requirements
165	Deployment strategy decision drills
166	Monitoring and incident decision drills
167	Time management for 180 minutes
168	Multiple-response question strategy
169	Final readiness assessment

The official exam consists of multiple-choice and multiple-response questions. Unanswered questions are incorrect, and there is no penalty for guessing. (AWS Documentation)

Final assessment package

• Six domain tests
• 100 deployment decision questions
• 100 troubleshooting questions
• 100 service-comparison questions
• Three complete 75-question mock exams
• One final practical capstone
• Personal weakness tracker
• Last-seven-days review plan

3. Standard chapter structure

Every chapter should follow the same format:

1. Exam objective
2. Business scenario
3. Architecture problem
4. Core concept
5. Relevant AWS services
6. Implementation walkthrough
7. Decision matrix
8. Failure modes
9. Troubleshooting process
10. Security considerations
11. Cost and operational considerations
12. Hands-on lab
13. Cleanup instructions
14. Exam traps
15. Ten practice questions
16. Detailed answers
17. Chapter checklist

Important difference from the Python book

The learner should not merely memorize:

CodeDeploy supports blue/green deployment.

The learner must understand:

When is blue/green preferable, what resources are duplicated, how traffic moves, how alarms stop a deployment, how rollback works, and how the answer changes for EC2, ECS and Lambda?

4. Service prioritization

The official in-scope list is broad and explicitly described as non-exhaustive and subject to change. It covers services across analytics, integration, compute, containers, databases, developer tools, management, networking, security, serverless and storage. (AWS Documentation)

The book should therefore classify services.

Tier 1 — Must master

• IAM, STS and IAM Identity Center
• Organizations and Control Tower
• CloudFormation, CDK and SAM
• CodePipeline, CodeBuild and CodeDeploy
• CodeArtifact, ECR and S3
• Systems Manager
• CloudWatch and CloudWatch Logs
• CloudTrail and AWS Config
• EventBridge, SNS and SQS
• Lambda and Step Functions
• EC2, Auto Scaling and Elastic Load Balancing
• ECS and container deployment concepts
• Route 53
• KMS and Secrets Manager
• GuardDuty, Security Hub and Inspector
• AWS Backup

Tier 2 — Strong working knowledge

• EKS
• X-Ray
• AppConfig
• Service Catalog
• Resilience Hub
• Fault Injection Service
• RDS and Aurora
• DynamoDB
• CloudFront
• API Gateway
• Athena
• OpenSearch
• Macie
• Detective
• WAF and Shield

Tier 3 — Recognition and use-case knowledge

• App Runner
• Elastic Beanstalk
• Proton
• OpsWorks
• Managed Grafana
• Managed Prometheus
• App2Container
• DMS
• Storage Gateway
• FSx variants
• QuickSight
• EMR

5. Hands-on strategy

A solid certification book should contain approximately:

• 40 guided labs
• 12 troubleshooting labs
• 6 incident game days
• 6 domain projects
• 5 cross-domain case studies
• 1 complete multi-account capstone

To control AWS costs:

• use short-lived CloudFormation stacks
• provide cleanup scripts
• add cost warnings before every lab
• avoid leaving NAT gateways, EKS clusters and large log-ingestion pipelines running
• provide simulated alternatives for expensive multi-account or multi-Region exercises
• use local policy and template validation where possible

6. Recommended learning timeline

Intensive route — 16 weeks

Weeks	Focus
1–2	Professional foundations
3–5	SDLC automation
6–7	IaC and configuration management
8–9	Resilience
10–11	Monitoring and logging
12	Incident response
13–14	Security and compliance
15	Cross-domain capstones
16	Mock exams and final review

Recommended weekly workload:

• 5 hours reading
• 5 hours hands-on practice
• 2 hours practice questions
• 1 hour reviewing mistakes

Total: approximately 200 hours.

7. Final recommendation

This should become a seven-volume series, not one enormous document:

1. AWS DevOps Foundations and SDLC Automation
2. Infrastructure as Code and Multi-Account Governance
3. Resilience, Scalability and Disaster Recovery
4. Observability, Monitoring and Logging
5. Incident and Event Response
6. Security and Compliance Automation
7. Architecture Cases, Labs and Practice Exams

AWS itself recommends a combination of exam-guide review, targeted learning, hands-on Builder Labs or similar practice, exam-style questions and a final official practice exam. Our book should follow the same progression but provide much deeper explanations, decision reasoning and project continuity. (Amazon Web Services, Inc.)

The next logical deliverable is Volume 1: AWS DevOps Foundations and SDLC Automation, created as Markdown-only chapters in the same downloadable ZIP format as the Python series.