Deployment, Provisioning, and Automation
Build and change infrastructure without manual clicking: golden AMIs and container images, CloudFormation and the AWS CDK, Terraform, multi-account provisioning with StackSets and AWS RAM, deployment strategies, and fleet automation with Systems Manager.
An engineer fixes a production problem by clicking through the console. Six weeks later the same stack has to exist in a second account, and half those clicks are missing because nobody wrote them down. This domain is the answer to that problem: describe the infrastructure in a file, let a service apply it, and get the same result every time in every account and Region.
It carries 22% of SOA-C03, and it changes what the earlier domains buy you. Monitoring tells you something is wrong, and reliability keeps the workload up. Provisioning decides whether the fix ships as a reviewed template change or as an undocumented console edit that nobody can reproduce.
What This Domain Covers
- Golden AMIs with EC2 Image Builder, and container images with ECR repositories, image scanning, and lifecycle policies
- CloudFormation template authoring: parameters, conditions, intrinsic functions, and outputs
- Safe stack operations with change sets, drift detection, and stack policies, plus diagnosing a deployment that failed or rolled back
- The AWS CDK, and where Terraform and Git fit into a CloudOps workflow
- Multi-account and multi-Region provisioning with StackSets, resource sharing through AWS RAM, and governed catalogs with Service Catalog and Control Tower
- Rolling, blue/green, canary, and in-place deployments, and how each maps onto Auto Scaling groups, ECS, and Lambda
- Day-2 automation with Systems Manager: fleet management without SSH, Patch Manager and State Manager, Parameter Store, and event-driven operations
Why It Matters
Exam questions here rarely ask what CloudFormation is. They hand you a stack stuck in UPDATE_ROLLBACK_FAILED, a StackSet that reached four accounts out of five, or an update that must ship without dropping a single request, and ask what to do next. Answering means knowing how each mechanism behaves when something goes wrong, not just the path where everything works.
The job pressure is the same. Infrastructure you can rebuild from a template survives an account migration, a Region outage, and the departure of the person who built it. Infrastructure that exists only as console state survives none of those.