AWS Certified CloudOps Engineer Associate SOA-C03 [2026]

Learn how to create AWS accounts with a credit card and unique email, avoid using the root user by creating IAM users, and access EC2, RDS, S3 across regions.

Compare the free plan and paid plan for AWS accounts, including $200 in credits. Follow along to sign up and create your own account.

Configure your AWS account by setting an account alias, enable billing access for IAM users, create a $5 budget with 85% and 100% alerts, and use Cost Explorer.

Discover how AWS identity and access management enables authentication and authorization for users, roles, federated users, and applications through identity-based and resource-based policies.

Create an IAM user and admin group, attach administrator access, log in as the user, and explore IAM Identity Center for single sign-on and console access.

Install Visual Studio Code and the AWS CLI, download or sync the course code from GitHub, and set up CloudShell or local IAM credentials for AWS commands.

Learn how Amazon VPC creates a logically isolated cloud within an AWS region, uses subnets in availability zones, and routes traffic via route tables and an internet gateway.

Learn to create a custom AWS VPC with public and private subnets across two AZs, attach an internet gateway, configure route tables, and test connectivity.

Explore security groups and network ACLs, detailing stateful versus stateless firewalls. Apply instance-level rules with security groups and subnet-level rules with network ACLs, including inbound, outbound, and return traffic.

Configure security groups and network ACLs in AWS EC2, implement inbound and outbound rules for SSH and HTTP, and explore security group chaining and NACL rule ordering.

Explore how IPv6 expands address space in a virtual private cloud, including slash 56 allocations, /64 subnets, public routing, no network address translation, and an egress-only internet gateway.

Configure vpc flow logs to capture ip traffic, store data in CloudWatch or s3, and inspect source and destination ip addresses, ports, and traffic across vpc interfaces.

Launch Amazon EC2 instances within a VPC, setting subnets, ENIs, and private or public connectivity. Choose instance types and elastic block store (EBS) options like GP3, IO2, multi-attach capabilities.

Launch and manage EC2 instances and EBS volumes, selecting instance types and AMI to balance hardware, software, and cost, then attach, format, and mount storage while preserving data with snapshots.

Navigate the EC2 instance life cycle from launch to termination, covering pending, running, booting, stopping, hibernating, and terminated states. Learn how IP addresses and EBS volumes behave during these transitions.

Discover how AWS Nitro delivers near bare-metal performance for virtualized and bare metal EC2 instances through Nitro cards, a Nitro security chip, and Nitro enclaves for encrypted computing with KMS.

Explore serverless services and event-driven architecture using AWS components like S3, Lambda, SQS, SNS, and DynamoDB to enable decoupled, scalable, real-time data processing.

Compare object storage with S3 buckets and keys accessed via REST API to file storage with EFS. Explore FSx options for Windows file server and Lustre.

Create and mount an AWS EFS file system with two AZ mount targets, configure security group rules for NFS port 2049, and enforce encryption in transit with EFS mount helper.

Practice managing S3 objects by creating buckets, uploading and downloading files, listing and deleting objects with the CLI, and using a Python boto3 script to upload via the SDK.

Explore AWS databases focusing on RDS, Aurora, and ElastiCache, including engines, encryption, and scaling. Compare Redis and Memcached options in ElastiCache and use cases like caching and session storage.

Secure amazon rds databases by configuring vpc, security groups. Enforce aes-256 encryption at rest with kms, enable in transit, and note that read replicas inherit the primary's encryption status.

Create and manage an RDS MySQL database on the free tier, configure endpoint and security groups, monitor with metrics and logs, and perform backups, snapshots, and read replicas.

Explore Amazon CloudWatch, the performance monitoring service with metrics, alarms, logs, and automated actions for AWS resources and on-prem systems, enabling actionable insights, operational visibility, and resource optimization.

Discover cloudwatch metrics, namespaces, and dimensions, publish custom metrics with proper permissions, and use API calls to retrieve statistics like min, max, and average for AWS operations.

Learn to use the unified CloudWatch agent to collect metrics and logs from EC2 and on premises servers, configure metrics, and start the agent via CLI, Systems Manager, or CloudFormation.

Learn how to collect and centralize logs with CloudWatch Logs, including from apps, systems, AWS services, and on-prem, with encryption, retention, export options, and real-time insights.

Launch an EC2 instance, install the CloudWatch agent and syslog, configure it to send Apache httpd logs to CloudWatch, and create metric filters and alarms for 404 errors.

Create custom CloudWatch dashboards to monitor tagged EC2 instances using Explorer widgets, metrics, and Logs Insights. Filter by department operations and instance family like T2, then add httpd access logs.

Learn how Amazon SNS enables decoupled, push-based messaging with topics and endpoints. Explore SNS to SQS fan-out, delivering identical messages to multiple subscribed queues for parallel processing.

Practice configuring SNS topics and SQS subscriptions to enable SMS notifications, publish messages, and test fan-out delivery to multiple queues.

Explore how AWS CloudTrail audits API activity by logging who did what and when, with management and data events, 90-day default retention, and indefinite retention in S3.

Learn how Amazon Event Bridge routes events from sources like EC2 and CloudTrail to an event bus, using rules to trigger SNS notifications or Lambda and DynamoDB actions.

Explore Amazon EventBridge, the modern service for routing events from AWS services or custom sources through an event bus to targets like SNS, Lambda, or DynamoDB, with practical examples.

Demonstrate an event-driven workflow with Amazon EventBridge that triggers a Lambda from a CloudTrail api call when stopping an EC2 instance, logging to CloudWatch.

Explore AWS Config, the configuration management service that evaluates resource configurations against desired settings, detects drift, and provides current and historical snapshots with change notifications and remediation options.

Systems Manager is an end-to-end management hub for AWS, on-premises, and other clouds, enabling automation, inventory, patch management, compliance, session management, and parameter store.

Create and enforce an AWS config rule to detect security groups that allow unrestricted access to ports other than 80, then remediate non-compliant resources using SSM automation.

Explore the AWS health API and compare the personal health dashboard with the service health dashboard to understand personalized alerts, remediation guidance, and planning for events versus general status updates.

Explore metric analysis and tracing with Grafina, Prometheus, and AWS X-Ray to visualize app components, identify bottlenecks, and monitor traces across microservices.

Learn to run SQL queries on data in S3 with Amazon Athena, using AWS Glue as a data catalog and Lambda connections to sources, supporting CSV, JSON, Parquet, and ORC.

Launch an application load balancer via CloudFormation with access logs, store logs in S3, then use Athena to run SQL queries against the ALB access logs.

Explore Amazon Kinesis for ingesting and processing streaming data from producers to shards and consumers. Learn how to route data to destinations like S3, DynamoDB, Athena, Redshift, and QuickSight.

Explore the difference between scaling up and scaling out, and how elasticity enables automatic resource adjustment in the cloud with vertical vs horizontal scaling.

Discover how AWS auto scaling automatically scales EC2, ECS, DynamoDB, and Aurora resources using CloudWatch metrics and health checks, with launch templates and policies for dynamic, predictive, and scheduled scaling.

Learn how Amazon elastic load balancing distributes traffic across auto scaling groups using health checks, with application and network load balancers for routing and TLS offloading.

Create an auto scaling group and ALB using the CLI, wire security groups, launch templates and target groups, configure the listener, and validate the setup with a browser.

Learn to automate EC2 lifecycle actions with a CLI lifecycle hook in an auto scaling group, sending notifications to SNS and triggering Lambda to snapshot root EBS volumes on termination.

Explore session state and session stickiness in load-balanced apps, comparing sticky sessions with offloading state to DynamoDB or ElastiCache to improve authentication continuity.

Explore automated and manual backups in Amazon RDS, including backup windows, transaction logs every five minutes, point-in-time restore, retention, and cross-region resiliency with Aurora.

Explore RDS and Aurora for fault-tolerant disaster recovery, multi-AZ, and read scaling with replicas. Discover cross-region replication, global database, multi-master options, and Aurora Serverless for on-demand capacity.

Configure and optimize Amazon RDS Proxy to pool connections between serverless Lambda functions and Aurora databases, boosting scalability, fault tolerance, security, and efficiency.

Discover how Amazon Route 53 registers domains, creates hosted zones (public and private), manages DNS records, runs health checks, and applies routing policies to direct traffic.

Deploy multi-region Route 53 routing policies and health checks using CloudFormation, configure latency-based routing between two regions, and validate health checks and failover to healthy endpoints.

Explain RPO and RTO and outline DR strategies, including backup and restore, pilot lite, warm standby, and multi site active active replication across regions.

Discover how AWS Backup centralizes data protection for EC2, EBS, S3, and more. Explore policy-based, encrypted backups with ransomware protection and how Data Lifecycle Manager automates EBS snapshots and AMIs.

Configure AWS data lifecycle manager to automate EBS snapshots with a tag-based policy, schedule daily retention of 7 days, and delete snapshots and the policy when finished.

Explore Amazon S3 durability and availability and how lifecycle management and storage classes optimize cost and access, from standard to Glacier, including replication and encryption.

Set up two S3 buckets with versioning, configure a same-region or cross-region replication rule, and create an IAM role for replication permissions. Test by uploading files and reviewing lifecycle rules.

See how AWS DataSync migrates on-prem data to AWS with a data sync agent. Move to S3, EFS, FSx, Snowcone, and Outposts using encrypted, scheduled transfers.

Learn how AWS CloudFormation uses JSON or YAML templates to define and provision AWS infrastructure, including VPCs, subnets, auto scaling, load balancers, and stacks, with versioning, rollback, and multi-account deployment.

Explore CloudFormation stacks, stack sets, and nested stacks to deploy reusable templates across accounts and regions, with automatic rollback on errors and charges for resources used.

Create a nested stack with the AWS CLI and CloudFormation, linking a top-level template to VPC and subnet templates and retrieving VPC and subnet IDs.

Explore CloudFormation templates in YAML or JSON to describe infrastructure state and create stacks, using intrinsic functions like ref, get at, and find in map across resources.

Explore cfn-init and cfn-signal, cloud formation helper scripts that install packages, write files, and manage services on EC2 instances via template metadata, and signal readiness to CloudFormation.

Explore creation and deletion policies, dependsOn, and wait conditions in cloud formation, including signals, resource retention and backups, and update policies for autoscaling, elasticache, and lambda aliases.

Explore rollbacks and stack creation failures in cloud formation, including OnFailure options such as do nothing, rollback, or delete, and how update failures trigger rollback.

Deploy cloud formation stacks and use change sets to preview and apply updates, including region-specific ami IDs, mappings, parameters, security groups, and user data for web servers.

Explore AWS RAM, the resource access manager, to share resources across accounts and OUs via console, APIs, CLI, or SDK, including subnets, databases, and transit gateways.

Create a scheduled EventBridge workflow that triggers a Lambda function, writes a message to CloudWatch Logs, and verifies execution via the Python script.

Create and manage AMIs by bootstrapping an EC2 instance with user data to install Apache, copy index.html from an S3 bucket, then deregister and clean up snapshots.

Connect on-premises storage to AWS with storage gateway, deploying file, volume, or tape gateways as virtual appliances that access S3, Glacier, or Deep Archive, encrypted in transit.

Explore Amazon DynamoDB, a fully managed, serverless NoSQL database with key-value and document types, enabling horizontal scaling, DAX microsecond latency, and global multi-region tables.

Create a DynamoDB table named product catalog, load data with batch write items, and retrieve records via a Python lambda function using test events, demonstrating a serverless NoSQL workflow.

Explore how Amazon ECS runs Docker containers using images built from Dockerfiles, stored in Docker Hub or private ECR, and orchestrates tasks via clusters, services, Fargate or EC2 launch types.

Compare Amazon ECS launch types, including EC2, Fargate, and external launch type, and cover pricing models (per instance vs per task), infrastructure control, and integrations with EFS, EBS, and registries.

Create an ECS cluster with the EC2 launch type, set up an auto scaling group, and deploy EC2 instances with the ECS agent, verifying via CloudFormation.

Create a task definition for an Engine X container on an EC2 ECS cluster, then run the task and set up a service with application load balancer exposing port 80.

Explore Amazon Elastic Container Registry (ECR) as a fully managed, docker-compatible registry integrated with ECS and EKS, covering repositories, IAM access control, image scanning, and push-pull workflows.

Explore Amazon Elastic Kubernetes Service (EKS), a managed Kubernetes platform for hybrid deployments across AWS and on-premises, with scalable pods, jobs, and load balancing.

Install kubectl and eksctl, create an EKS cluster, deploy a Kubernetes deployment, expose it with a load balancer, and configure an autoscaler plus IAM permissions and config maps.

Learn how AWS Step Functions orchestrates distributed applications by linking Lambda functions into a visual, JSON-based Amazon States Language state machine and testing it in the console.

Create a state machine with AWS Step Functions and AWS Lambda functions, using a choice state to route financial, HR, or generic data and test executions.

Learn how AWS service catalog centralizes approved IT services into products and portfolios, with CloudFormation templates, launch constraints, template constraints, and cross-account deployment.

Explore RBAC and ABAC in AWS IAM, using groups, tags, and policies to assign permissions, with policy conditions and environment production versus development examples.

Learn IAM policy evaluation and the evaluation logic for access decisions, including explicit denials, allows, resource and identity based policies, SCPs, and permissions boundaries.

Demonstrate cross-account access by assuming a role with an external ID to access a private S3 bucket across two accounts. Configure CLI credentials and a profile to access the bucket.

Enable multi-factor authentication for the aws cli, obtain temporary credentials with aws sts get-session-token using a virtual mfa device, and set them as environment variables.

Explore access evaluation tools in the iam console, including access analyzer, credential reports, and policy simulator, to identify public access risks and tailor role permissions.

Learn to centralize AWS accounts with AWS Organizations and Control Tower, implement service control policies and consolidated billing, and use account factory, landing zones, and guardrails for governance.

Create an AWS organization and a management account, then add production accounts. Enable service control policies and switch roles with the organization account access role to administer production accounts.

Apply service control policies within AWS Organizations to implement a deny list, limiting IAM role modifications in production accounts and demonstrating policy attachment and detachment to an OU.

Understand directory services and federation in AWS, including AWS managed Microsoft AD, AD Connector, and single sign-on with SAML 2.0, web identity federation, and IAM Identity Center.

Enable IAM Identity Center in an AWS Organization, configure identity source and MFA, create permission sets, add groups and users, assign accounts, and sign in via the access portal.

Amazon Inspector conducts network and host assessments to detect exposed ports and vulnerabilities, using agent-based or agentless options. Trusted Advisor provides real-time guidance on cost, performance, security, and service limits.

Understand encryption in transit versus at rest and symmetric versus asymmetric cryptography, including public/private keys, SSL/TLS, and how AWS services use encryption keys and certificates.

Explore AWS KMS concepts, including KMS keys, customer managed keys, AWS managed keys, hardware security module backed storage, external and custom key stores, data encryption keys, and key rotation.

Create and configure customer managed KMS keys in AWS, set key usage for encryption and decryption, assign aliases, and tailor key policies to restrict usage to EC2 and RDS.

Explore common AWS KMS API and CLI commands such as encrypt, decrypt, re-encrypt, and generate data keys, and learn throttling, quotas, and data key caching to optimize performance.

Learn how AWS CloudHSM provides a cloud-based, single-tenant hardware security module that runs in your VPC, retaining control of encryption keys and enabling a custom key store for KMS.

Explore AWS Certificate Manager (ACM) for issuing, storing, and renewing SSL/TLS certificates for encryption in transit, supporting single, multi, and wildcard domains with integration to load balancers, CloudFront, and CloudFormation.

Create an S3 bucket with index.html, style.css, and images, request an ACM SSL/TLS certificate via DNS validation, and bind it to a CloudFront distribution for HTTPS with a custom domain.

Discover how AWS Secrets Manager securely stores and rotates credentials. Compare it with SSM parameter store’s secure hierarchical storage for plain and encrypted values.

Learn to configure Secrets Manager with an RDS MySQL database and a Lambda function that retrieves credentials, connects to the database, and inserts and retrieves records.

Explore AWS Security Hub and GuardDuty to monitor security posture, detect threats, and orchestrate automated remediation across accounts, with standards like CIS AWS foundational security best practices and PCI DSS.

Amazon Macie uses machine learning to detect sensitive data in S3, including PII, PHI, API keys, and secret access keys, and sends findings to Security Hub or EventBridge.

Learn to design private and public subnets in a VPC, enable internet access with NAT gateways and elastic IPs, and secure access via bastion hosts.

Configure a NAT gateway in a public subnet to give a private subnet instance internet access by routing 0.0.0.0/0 through the NAT gateway, then test connectivity and clean up resources.

Explore AWS VPC connectivity options—VPN, direct connect, transit gateway, VPC peering, and private link—and learn when to use each for on-premises to VPC and cross-region networks.

Configure VPC peering across us-east-1 and us-west-1 using cloudformation to deploy two VPCs with security groups, test private connectivity, and clean up resources.

Learn how VPC endpoints enable private connectivity to AWS services using private IP addresses, via interface endpoints and gateway endpoints. Understand private link, endpoint services, and how policies control access.

Learn to deploy S3 gateway and interface endpoints in a VPC, route S3 traffic through a private endpoint, and test access with session manager and policy changes.

Learn how AWS client VPN uses OpenVPN and TLS to connect devices to a VPC. Configure Active Directory, certs, or SAML authentication and assign access to groups in subnets.

Master AWS site-to-site VPN by configuring a VGW and CGW, establishing two encrypted tunnels, and using static or BGP routing with route propagation and longest-prefix matching.

Discover how AWS Transit Gateway centralizes VPC and on-premises connectivity, replacing complex VPC peering with a scalable cloud router. Understand attachments, associations, and transitive routing across VPNs and Direct Connect.

Learn how the Route 53 resolver links on-premises DNS with Route 53 hosted zones using outbound and inbound endpoints for internal and internet domain resolution.

Learn how Amazon CloudFront speeds content delivery worldwide by using origins such as S3, EC2, or EFS, and deploying edge locations and distributions with caching policies and path patterns.

Explore CloudFront signed URLs to control content access by time windows and IP ranges, and learn how origin access identity and origin access control enforce access through CloudFront.

Create an Amazon S3 static website by configuring a bucket, enabling static website hosting, uploading index.html and images, setting a public bucket policy, and using the website endpoint.

Configure a protected origin with CloudFront and an S3 bucket; create a distribution, provision a wildcard certificate, and map a custom domain with Route 53, enabling https.

Enable and interpret S3 server access logging, VPC flow logs, ELB access logs, CloudFront logs. Configure a destination bucket, grant permissions, and read details like requester, latency, and request paths.

Explore how AWS WAF uses web ACLs, rules, and IP sets to filter traffic, block SQL injection and cross-site scripting, and protect CloudFront, ALB, API gateway, or AppSync.

Protect resources from DDoS attacks with AWS Shield, a managed service with always-on detection and automatic inline mitigations, with standard via CloudFront and optional Shield Advanced for extra features.

Configure a web application firewall web acl for CloudFront distribution backed by s3 origin, creating a rate-based rule to block 100 requests from a single ip in 5 minutes.

Learn how AWS network firewall and DNS firewall protect VPCs, configure protected and firewall subnets, endpoints, and routing, and centrally manage policies with Firewall Manager and Route 53 Resolver.

Learn how the AWS Compute Optimizer uses machine learning on CloudWatch metrics to recommend cost-saving resource configurations for EC2, EBS, and Lambda, with actionable guidance and dashboards.

Discover how to enable cost allocation tags in AWS, tag resources by department or created by, and view itemized costs in Cost Explorer.

Learn to use AWS cost management tools, including Cost Explorer and Cost and Usage Report, with price alerts via SMS and JSON or HTML price queries.

Explore AWS cost management tools in the management console, using Cost Explorer to analyze monthly, daily, or hourly spend by service, account, region, and usage type, and generate cost reports.

Amazon EC2 pricing options, including on-demand, reserved, spot, dedicated instances and hosts, and savings plans, plus billing, capacity reservations, and reserved instance attributes.

Explore EC2 placement groups to control instance placement across availability zones for inter-instance traffic, including cluster for latency HPC, partition across seven partitions per AZ, and spread for hardware isolation.

Explore multipart uploads in S3 for parallel, out-of-order parts, and evaluate transfer acceleration with CloudFront edge locations to speed up long-distance transfers, via CLI or SDK.

Navigate EC2 and Lambda exam scenarios, from maintenance and capacity issues to scaling and monitoring. Explore the pricing model and automated invocations with CloudWatch events.

Explore elastic load balancing and auto scaling on EC2 with an ALB across availability zones to ensure high availability, backed by CloudWatch monitoring.

Explore practical scenarios for Amazon EBS, EFS, and AWS Storage Gateway, including data recovery from snapshots, monitoring with CloudWatch, cold storage, and tape gateway archiving.

Explore AWS Systems Manager; OpsWorks manage credentials with SSM parameter store, assign IAM roles for EC2, patch with Patch Manager, and use automation and Chef integrations in stacks and layers.

Explore AWS CloudFormation, using JSON or YAML templates to define VPCs, subnets, and resources, and manage infrastructure with stacks, stack sets, and change sets for safe updates.

Explore Amazon VPC scenarios, including NAT gateway traffic analysis with VPC flow logs and CloudWatch insights, VPC endpoints for S3, subnets, VPN encryption, inter region VPC peering, and security groups.

Learn Amazon Route 53 health checks with A records for primary and secondary servers, http health checks, 5120-byte string matching, geolocation routing, and alias to apex domain for an ALB.

Learn how to deploy secure static sites with S3 and CloudFront, configure custom domains via Route 53, and manage access with IAM roles, S3 policies, and pre-signed URLs.

Explore scenarios for Amazon RDS and ElastiCache, including multi-AZ failover, encryption via snapshot restore, cross-account snapshot sharing with KMS, backups, read replicas, and scaling strategies to improve availability and performance.

Master management, governance, and billing in AWS Organizations by auditing with CloudTrail, applying service control policies, inviting federated users, and using cost allocation tags to track costs.

Explore security and compliance scenarios in AWS, including IAM policies, KMS key rotation, ACM certificates, inspector assessments, WAF and Shield protections, and LDAP SAML federation for on-prem AD integration.