AWS Certified CloudOps Engineer Associate SOA-C03 2026

Explore the AWS console user interface update, highlighting the new white interface with rounded blue buttons while confirming that usability remains the same as the old gray, square-button design.

Launch an Amazon Linux EC2 instance (t2 micro) named MyFirstInstance, create a DemoKeyPair, and open SSH from anywhere, connecting via SSH or EC2 Instance Connect as ec2-user.

Learn how to change an EC2 instance type on an EBS-backed instance by stopping, selecting a new type (e.g., from t2.micro to t2.small), and starting again, with data preserved.

Explore placement groups to control EC2 instance placement across availability zones, featuring cluster, spread, and partition strategies for high performance and fault isolation, including seven instances per AZ.

Create and configure EC2 placement groups to optimize network performance with cluster groups, distribute instances with spread groups, and manage partition type options, then launch instances in your chosen group.

Troubleshoot EC2 ssh issues by fixing pem permissions, using the correct username, addressing host key errors, and understanding EC2 Instance Connect's one-time key and region IP prefixes.

Enable secure ssh to private ec2 instances with an ec2 instance connect endpoint and security groups that allow outbound and inbound ssh from the endpoint; internet gateway not required.

Explore how CloudWatch metrics relate to EC2, from basic five-minute to detailed one-minute monitoring, covering CPU, network, disk, status checks, RAM not included, and custom metrics with an IAM role.

Discover how the unified cloudwatch agent collects memory, disk, and process metrics and sends logs from EC2 or on-prem servers to CloudWatch, configurable via SSM parameter store or config file.

Configure the CloudWatch unified agent on EC2 to collect metrics and logs with an IAM role, store the config in SSM parameter store, and monitor memory, CPU, and httpd logs.

Explore how EC2 status checks detect hardware and software issues with system, instance, and attached EBS checks, and how to recover using CloudWatch alarms or an auto scaling group.

Explore EC2 status checks, including system and instance checks, create a CloudWatch alarm with recover or reboot actions, and simulate a failure to trigger recovery after five minutes.

Explore EC2 hibernate, a feature that dumps RAM to an encrypted root EBS volume to resume instantly, enabling fast reboot for long-running processes and RAM state preservation.

Practice enabling EC2 hibernation on an Amazon Linux 2 t2.micro instance, encrypting the root EBS volume, and verifying uptime to show RAM data preserved during hibernation.

Deploy the AWS instance scheduler via CloudFormation to automatically start and stop EC2, EC2 auto scaling groups, and RDS instances, with schedules stored in DynamoDB and actions triggered by Lambda.

Terminate your EC2 instance after completing the section to ensure it is shut down, following best practices for deleting resources and keeping everything offline.

Customize and manage Amazon machine images to speed EC2 boot and configuration, then launch instances from public, AWS Marketplace, or your own AMIs across regions.

Learn to create a custom AMI by configuring an EC2 instance with Apache HTTPD and a user data script, then launch from that AMI to speed boot times.

Describe the no-reboot option for creating AMIs from running EC2 instances, noting file system integrity risks, and contrast with rebooted AMIs via AWS backup or scheduled Lambda workflows.

Migrate an EC2 instance between availability zones by creating an AMI and launching from it, then securely share and copy AMIs with other accounts using KMS keys.

Automate the creation, customization, testing, and distribution of EC2 AMIs with EC2 Image Builder. Schedule builds, validate AMIs with tests you define, and pay only for the underlying resources.

Create and customize AMIs with EC2 Image Builder by building a demo pipeline, recipes, and components, including Amazon Linux 2, Corretto 11, and AWS CLI 2.

Learn to enforce production-ready AMIs by tagging and IAM policies, ensuring only approved AMIs can launch, and using AWS Config to flag non-compliant EC2 instances.

Terminate the instance, deregister the AMI to remove the demo image, and delete the backing snapshots in the backend to complete the AMI cleanup.

Explore AWS Systems Manager, a free suite to manage a fleet of EC2 and on-premises servers at scale, with patching automation, compliance, inventory, and integration with CloudWatch and Config.

Launch three Amazon Linux 2 EC2 instances, attach the SSM managed instance role, and register them in Fleet Manager to run the SSM agent with no inbound rules.

Discover tagging basics and resource groups to organize AWS resources by environment and team, enabling automated actions with SSM across EC2, S3, DynamoDB, and Lambda.

Explore SSM documents in JSON or YAML that define parameters and actions, enable run command across EC2 fleets, and integrate with state manager, patch manager, automation, and parameter store.

Explore how SSM automations use runbooks to perform tasks like restarting EC2 instances, creating AMIs, and EBS snapshots across AWS resources, triggered by console, CLI, EventBridge, or Config Remediation.

Learn how to use ssm automation to patch an ami, update an auto-scaling group launch template, and refresh ec2 instances with a patched ami using ec2 instance refresh.

Learn how the SSM Parameter Store securely stores configuration and secrets, supports KMS encryption, versioning, hierarchy, IAM access, EventBridge notifications, and CloudFormation integration.

Practice using AWS Systems Manager Parameter Store to create hierarchical parameters, such as /my-app/dev/db-url, and query them with the CLI, including decryption and recursion.

Centralize remote management of EC2, on-prem servers, edge devices, and IoT with SSM Fleet Manager using the SSM agent, enabling status tracking and session access at scale.

Enable Systems Manager to manage EC2 instances without an instance profile via DHMC, using an identity role and IMDSv2, unlocking Session Manager, Patch Manager, and inventory per region.

Enable the default host management in AWS Systems Manager Fleet Manager, create the IAM role, and verify by launching an EC2 instance with an updated SSM agent.

Enable SSM inventory to collect metadata from EC2 and on-premises instances, including installed software and configurations. Store or query this data in the AWS console, S3, and Athena.

Automate patching of EC2 and on-premises servers with SSM Patch Manager for Windows, Linux, and MacOS updates, and manage baselines, groups, maintenance windows, and compliance reports to S3.

Explore patch manager setup to create patch policies, configure scan or scan-and-install schedules, define patch baselines, targets, and deployment rates, and integrate maintenance windows for patching EC2 and on-premises instances.

Discover how SSM session manager provides a secure shell to EC2 and on-prem servers via console, CLI, or SDK, without SSH keys or bastions, with logging to S3 or CloudWatch.

Use SSM session manager to SSH into EC2 instances without inbound SSH rules, view commands, and enable CloudWatch and S3 logging for secure, auditable sessions.

Deploy software to EC2 instances using an SSM distributor package stored in S3. Includes per-OS install and uninstall scripts, a manifest, and options to use Run Command or State Manager.

Learn how opscenter centralizes security, performance, and event issues into one view, enabling rapid investigation and automated remediation with opsitems and runbooks for EC2 and on-prem.

Terminate the three managed instances in Fleet Manager to avoid running cost and complete this cleanup module.

Understand scalability and high availability, including vertical scalability, horizontal scalability (elasticity), and multi-AZ deployments across data centers for failover and resilience.

Explore elastic load balancing on AWS, distributing traffic across EC2 instances with health checks, SSL termination, and stickiness with cookies, while comparing application, network, and gateway load balancers.

Master the application load balancer (alb), a layer seven http router. Route to multiple applications via target groups with path, host, query string rules and http/2.

Learn to launch two EC2 instances, configure an application load balancer with a target group, and verify traffic distribution and instance health via HTTP health checks.

Implement network security by restricting EC2 access to traffic from the load balancer's security group, then configure ALB listener rules to route or return a 404 for /error.

Explore the network load balancer, a layer 4 TCP/UDP option with ultra-low latency and static IPs per AZ. Use target groups with EC2 or private IPs and TCP/HTTP/HTTPS health checks.

Create a network load balancer with a security group and TCP port 80, using HTTP health checks to balance traffic across EC2 instances in a target group.

Discover how the gateway load balancer funnels all network traffic through third-party appliances, routing via route tables to EC2 instances or private IPs for inspection and possible drop.

Enable sticky sessions on elastic load balancer to keep a user connected to the same backend instance. Learn about application-based and duration-based cookies and how the load balancer generates them.

Cross zone load balancing distributes traffic evenly across all registered EC2 instances in all availability zones, with ALB enabled by default and NLB and gateway load balancers off by default.

Understand how SSL/TLS certificates encrypt traffic between clients and load balancers and how SNI and ACM let ALB/NLB serve multiple domains.

Enable SSL certificates on ALB and NLB, configure HTTPS listeners on port 443, and forward to a target group.

Explore connection draining or deregistration delay in ELB, allowing inflight requests to finish as an EC2 instance drains, with 1–3600 seconds (default 300) across classic, application, and network load balancers.

Understand how the Elastic Load Balancer performs HTTP health checks on a target group, with port, check path, timeout, interval, and healthy and unhealthy thresholds guiding routing.

Monitor elastic load balancer metrics with CloudWatch, including healthy/unhealthy hosts, request counts, latency, and surge queue; troubleshoot 4xx/5xx errors, enable S3 access logs, and use X-Amzn-Trace-Id for request tracing.

Explore target group attributes, including deregistration delay, slow start, and routing algorithms. Compare round robin, least outstanding request, and flow hash, plus stickiness settings and cookie durations.

Learn how alb rules are processed in order, with a default rule and weighted target groups enabling blue green deployments and precise routing to targets.

Automate capacity with an auto scaling group that scales out or in to match load, bounded by minimum, maximum, and desired capacity, with a load balancer and health checks.

Create an auto scaling group with a launch template using Amazon Linux 2 and t2 micro, attach to a load balancer target group, and configure health checks.

Explore auto scaling group scaling policies, including dynamic, target tracking, step, scheduled, and predictive scaling, with metrics like cpu utilization, request per target, and custom metrics.

Explore automatic scaling for auto scaling groups with dynamic, predictive, and scheduled actions, and configure target tracking, simple and step scaling using CloudWatch alarms for CPU utilization.

Learn how auto scaling groups use instance refresh to update EC2 instances with a new launch template, setting a minimum healthy percentage and warm-up time.

Discover how warm pools in auto-scaling groups speed scale-out with pre-initialized instances. Set warm pool size and prepared capacity to optimize readiness while keeping metrics unaffected.

Explain lifecycle hooks in auto scaling groups and their pending, pending wait, and terminating wait states, with script actions. Compare launch templates with launch configurations, SQS-based scaling, and health checks.

Learn to monitor your auto scaling group with CloudWatch by enabling ASG metrics—GroupMinSize, GroupMaxSize, GroupDesiredCapacity, GroupInServiceInstances, PendingInstances, StandbyInstances, TerminatingInstances, and TotalInstances—and EC2 metrics like CPU utilization and network in/out.

Explore the AWS Auto Scaling service, which manages scalable resources like EC2, Spot Fleet, ECS, DynamoDB WCU/RCU, and Aurora read replicas, using dynamic scaling and predictive scaling to optimize availability.

Demonstrates creating an AWS Auto Scaling plan for an Auto Scaling group, targeting cpu utilization at 40% to optimize availability while enabling predictive and dynamic scaling.

Remove the auto scaling group and associated resources, delete the DemoALB in the load balancer section, and remove the target group to complete the section cleanup.

Discover how CloudFormation enables infrastructure as code by declaring resources in declarative templates that automatically provision and link EC2, S3, and load balancers.

Learn to create a CloudFormation stack from a yaml template in us-east-1, inspect resources and events, and verify an ec2 instance created by the stack.

Update a CloudFormation stack by replacing the template and previewing change sets to apply resource updates. Delete the stack to remove all resources while CloudFormation manages the order.

Learn to read YAML and leverage CloudFormation templates with nested objects, arrays, multi-line strings, and comments, improving readability and unleashing the power of CloudFormation.

Explore how CloudFormation resources form the core of templates, declare AWS components, and manage properties like EC2 instance details, security groups, and Elastic IP, plus custom resources for unsupported services.

Learn how CloudFormation parameters enable configurable templates, with types, constraints, allowed values, and NoEcho for secrets; use !Ref to reference parameters and resources, and explore pseudo parameters.

Learn how CloudFormation mappings define region- and architecture-specific values, such as AMI IDs, using the RegionMap and FindInMap function.

Learn how CloudFormation outputs and exports enable cross-stack referencing by exporting values like VPC IDs and subnet IDs, and importing them into other stacks to drive collaborative deployments.

Learn how CloudFormation conditions control resource creation or outputs based on environments or parameter values, using and, equals, if, not, and or.

Explain intrinsic functions in CloudFormation, including ref, getAttribute, findInMap, importValue, base64, and condition helpers such as if, not, equals, with examples like retrieving instance attributes for dns records.

Learn how CloudFormation rollbacks apply to stack creation and updates, including default deletions, preserving successfully provisioned resources, and using ContinueUpdateRollback via console, API, or CLI to recover from failures.

Discover how CloudFormation uses dedicated service roles to manage stack resources with least privilege, and how to pass that role via iam passrole for secure stack operations, including s3 permissions.

Learn how CloudFormation capabilities govern IAM resource creation, using CAPABILITY_NAMED_IAM for named resources or CAPABILITY_IAM otherwise, and CAPABILITY_AUTO_EXPAND for macros and nested stacks, and re-upload if necessary.

Explore CloudFormation deletion policy and how it controls resource fate on stack deletion. Learn delete, retain, and snapshot options, including S3 bucket caveats and snapshots for backups.

Explore CloudFormation UpdateReplacePolicy, deciding between retain, snapshot, or delete and create when updates replace resources, and compare it to DeletionPolicy for resources like RDS, EBS, and ElastiCache.

Learn how stack policies in CloudFormation use JSON to restrict updates, protecting resources like the production database, while explicitly allowing updates where needed.

Enable termination protection in CloudFormation to prevent accidental deletes of stacks, and learn how to enable it in the console and delete only after disabling it.

Explore CloudFormation custom resources to provision non-supported or custom resources using a Lambda-backed Custom::MyCustomResourceTypeName, with a service token and input data guiding create, update, and delete.

Master dynamic references in CloudFormation by sourcing values from Systems Manager Parameter Store and Secrets Manager, enabling rotation and secure password handling for RDS and Aurora databases.

Pass user data to EC2 instances through a CloudFormation template, base64-encode the script, and verify cloud-init output in /var/log/cloud-init-output.log after launching and testing the stack.

Explore how CloudFormation cfn-init retrieves init data from the stack, installs packages, creates files, and starts services on EC2, with readable init blocks and debug logs at /var/log/cfn-init.log and /var/log/cfn-init-cmd.log.

Learn how CloudFormation uses cfn-signal and a WaitCondition to confirm EC2 initialization, signaling success or failure back to the stack via a creation policy with timeout and count.

Diagnose CloudFormation wait condition failures by verifying cfn-init and cfn-signal outputs, installing helper scripts, ensuring EC2 can reach the service, and adopting rollback options for debugging.

Explore CloudFormation nested stacks that reuse components via the parent template, update parent to refresh nested stacks, differentiate them from cross stacks, and leverage parameters, outputs like WebsiteURL, and CAPABILITY_AUTO_EXPAND.

DependsOn enforces a specific creation order for resources, such as creating a DBInstance before an EC2 instance or a bucket after the EC2, and applies to deletes.

Deploy CloudFormation stacks across multiple accounts and regions using StackSets. Manage administrator and target accounts with AWS Organization, trusted access, and automated updates for new accounts.

Deploy stacksets across multiple regions with CloudFormation to enable AWS config, create admin and execution IAM roles, and manage config resources and drift across accounts.

Add stacks to a stack set by selecting action, specify more regions and accounts, override parameters if needed, and submit to create new stack instances and keep deployments current.

Detach a stack from a stack set, delete remaining stack instances, then delete the stack set and its execution roles and admin role for a full CloudFormation cleanup.

Discover how to detect drift in CloudFormation by comparing stack resources to templates, view drift details on stacks and stacksets, and decide when to update templates or revert changes.

Learn to troubleshoot CloudFormation, handle delete failures by emptying S3 buckets or using lambda-backed custom resources, apply DeletionPolicy=Retain, continue update rollback after fixes, and resolve StackSets and region-related permissions.

CloudFormation uses an on failure policy for stack creation, with rollback as the default; you can also choose do nothing to troubleshoot or delete to remove the stack.

Learn how stack-level tags in CloudFormation propagate to all resources, using the console or AWS CLI to tag templates and enable tag-based searches across the stack.

CloudFormation enables rolling updates of auto scaling groups and a replacing update option, using policies that define min in service, max batch size, and wait times for in place updates.

Discover how AWS Lambda enables on-demand, serverless code execution with automated scaling, no server management, and the generous free tier, plus broad integrations with API Gateway, S3, and DynamoDB.

Learn to build and test Lambda functions, watch automatic scaling, and trigger them from streaming analytics, mobile, and S3 events, while monitoring with CloudWatch logs.

Integrate CloudWatch Events or EventBridge with Lambda by creating EventBridge rules for a serverless cron or for CodePipeline state changes, triggering Lambda tasks in a hands-on setup.

Learn to integrate Lambda with EventBridge by creating a Python 3.9 function, wiring it to a one-minute schedule rule, and verifying permissions and logs in CloudWatch.

Learn to integrate S3 event notifications with Lambda to trigger thumbnail generation, using SNS or SQS fan-out or asynchronous direct Lambda invocation, with versioning and dead-letter queues.

Configure a python 3.8 lambda to be invoked by S3 object create events in the Ireland region. Verify by uploading coffee.jpeg and checking CloudWatch logs for the event.

Learn about elastic block store (EBS) volumes as network drives that persist data after EC2 termination. Understand AZ binding, detachment and attachment, provisioning of capacity and IOPS, and delete-on-termination settings.

Create and attach multiple EBS volumes to an EC2 instance, choosing GP2 and GP3 options in eu-west-1b, then observe delete on termination behavior when terminating the instance.

Explore ebs volume types gp2, gp3, io1, io2, st1, and sc1, including boot volume support, provisioned iops, and multi-attach features.

Create ebs snapshots anytime, even when attached, and copy them across availability zones or regions. Automate backups with data lifecycle manager and explore fast snapshot restore, archive, and recycle bin.

Explore EBS snapshots in depth: create, copy, and encrypt snapshots; manage storage tiers, lifecycle policies, cross-region copy, cross-account sharing, and recycle bin retention for recovery.

Explore Amazon EFS, a managed NFS that can be mounted on multiple EC2 instances across availability zones, offering scalable, pay-per-use storage with security groups, encryption, and performance and storage classes.

Demonstrates creating a regional Amazon Elastic File System with backups and lifecycle management, then mounting it to two EC2 instances across AZs for shared access.

Contrast ebs volumes with efs file systems: ebs attaches to a single instance per az and uses snapshots for cross-az migration. Efs is a network file system across azs.

Terminate active instances to release attached EBS volumes, then delete snapshots and volumes, detaching as needed, and finally remove the EFS file system by its ID.

Explore how Amazon S3 provides infinitely scalable storage for backup, archival, data lake analytics, hosting static assets, and Glacier archival. Learn about buckets, region scope, keys, and multi-part uploads.

Create an Amazon S3 bucket in a region, select general purpose storage with account regional namespace, and upload and view objects using pre-signed URLs.

Explore S3 security with user-based IAM policies and resource-based bucket policies, enabling cross-account and public access, ACLs, and encryption.

Enable public access on the bucket, use the policy generator to create a public S3 bucket policy for getObject, and verify coffee.jpg is reachable via the public URL.

Explore advanced S3 bucket policies to grant cross-account and AWS organization access, enforce encryption at upload, restrict IP ranges, and require MFA, using VPC endpoints and CloudFront origin identity.

Learn how Amazon S3 versioning, enabled at the bucket level, creates file versions on each upload, uses delete markers to mark deletions, and enables restore, rollback, and safe suspension.

Enable S3 bucket versioning to create, view, and roll back file versions, manage version IDs and delete markers, and restore previous objects through permanent deletes or delete markers.

Enabling S3 Versioning on a bucket requires 15 minutes for propagation; during this period, write requests may yield a 404 NoSuchKey error, so consult the how S3 Versioning works documentation.

Enable versioning and configure asynchronous S3 replication, choosing cross-region (CRR) or same-region (SRR) between buckets with cross-account IAM permissions for compliance, latency, log aggregation, and production and test synchronization.

Enable S3 replication to copy only new objects after activation. Use S3 batch replication to capture existing objects and failed replication, and optionally replicate delete markers, with no replication chaining.

Practice setting up Amazon S3 replication by creating origin and replica buckets, enabling versioning, configuring a replication rule, and testing cross-region replication with file uploads and delete markers.

Implement cross-account S3 replication by configuring Account A's IAM role and destination bucket policy, enable versioning, and apply owner override to grant destination ownership of replicated objects.

Explore Amazon S3 replication time control (RTC), guaranteeing 99.99% replication within 15 minutes, with CloudWatch metrics and alerts. Replicate to same or different regions to meet compliance, at per-gb cost.