SOA-C03 cheat sheet — every exam topic on one page

Monitoring, Logging, Analysis, Remediation, and Performance Optimization

CloudWatch Metrics, Alarms, and Log Filters for SOA-C03

• Default EC2 metrics never include memory or disk-space utilization — collecting those (and process counts via procstat) requires the CloudWatch agent.
• Run the agent at fleet scale with one Parameter Store configuration (AmazonCloudWatch-*), AWS-ConfigureAWSPackage to install, and AmazonCloudWatch-ManageAgent to apply; instances need CloudWatchAgentServerPolicy.
• Container Insights: the cluster setting on ECS (Fargate needs nothing else; the ECS account setting only defaults new clusters), the CloudWatch Observability add-on on EKS; it does not ship application logs.
• Lambda Throttles are rejected requests that never ran; Lambda Insights adds memory and CPU; Bedrock token metrics feed alarms, while prompts and responses need model invocation logging (off by default).
• Only a high-resolution metric (StorageResolution 1) can back a 10- or 30-second alarm; detailed monitoring adds frequency, not new metrics.
• Metric filters count new log events only — alarm on their Sum, with a default value of 0; subscription filters stream events, cross-account through a Logs destination.
• Logs Insights queries history; Live Tail watches events as they arrive; log class is fixed at creation; long-term retention means exporting to S3.
• M-out-of-N need not be consecutive; treat missing data "ignore" freezes the current state; disabling actions does not stop evaluation.
• Metric alarms act directly via SNS, Lambda, EC2 actions, Auto Scaling, OpsItems (and, for existing Incident Manager users, incidents) and investigations; composites cannot take EC2 or Auto Scaling actions; runbooks go through EventBridge.
• Lambda alarm actions need the function policy to allow lambda.alarms.cloudwatch.amazonaws.com; encrypted SNS topics need a customer managed key that allows the publishing service.
• CloudTrail event history keeps 90 days of management events per Region and cannot be extended; longer retention needs a trail to S3.
• Cross-account observability links are Regional; dashboard email sharing covers one dashboard for up to five people, SSO sharing covers all dashboards.

Automated Remediation: EventBridge, Runbooks, and EC2 Recovery (SOA-C03)

• The recover action attaches only to a StatusCheckFailed_System alarm: it keeps instance ID, IP addresses and EBS volumes, loses RAM, instance store data and uptime, and is not supported for Auto Scaling group members or Dedicated Hosts.
• StatusCheckFailed_Instance means an OS-level problem — a system-check alarm never fires for it; use the reboot action, and repair an unbootable OS offline with AWSSupport-ExecuteEC2Rescue or a helper instance.
• EC2 alarm actions need a per-instance metric (InstanceId dimension); Auto Scaling replaces unhealthy fleet instances, ELB health checks catch application hangs, and the grace period must exceed warm-up time.
• Gate multi-condition alerts with a metric math IF expression or a composite AND alarm; exclude abnormal periods from anomaly detection training, and remember a higher band threshold widens the band.
• An EventBridge rule invokes all its targets immediately; target input can be the whole event, an input path, constant JSON, or an input transformer template.
• Rule cron is six fields in UTC with ? in one day field; rate units are singular only for 1; EventBridge Scheduler adds IANA time zones with daylight saving adjustment.
• Cross-account bus targets need a receiving bus policy (aws:PrincipalOrgID for an organization) and a sender-side IAM role; events are never forwarded on to a third account.
• Without an AutomationAssumeRole a runbook runs with the starter’s permissions; State Manager enforces configuration continuously, maintenance windows run only in their window, and OpsCenter dedup strings stop duplicate OpsItems.
• AWS Health events reach EventBridge per Region (global events in us-east-1, backups in us-west-2); a single us-west-2 rule (simplified integration) collects account-specific events from all Regions.

EC2, EBS, S3 and RDS Performance Optimization for SOA-C03

• Trusted Advisor only flags idle or low-utilization instances; Compute Optimizer turns CloudWatch history into specific EC2, EBS and Lambda recommendations; use a 32-day lookback (free) for monthly peaks, and publish memory with the CloudWatch agent or it is ignored.
• Tags make findings and spend attributable, but a tag reaches Cost Explorer only after it is activated as a cost allocation tag; grouping starts at activation unless you request a backfill (up to 12 months).
• T2 defaults to standard mode and throttles at zero CPUCreditBalance; T3/T3a/T4g default to unlimited and charge surplus credits instead — constant load belongs on M or C.
• gp3 includes 3,000 IOPS and 125 MiB/s at any size and scales to 80,000 IOPS and 2,000 MiB/s independently of capacity; Elastic Volumes migrates gp2 to gp3 live.
• io2 Block Express is the choice beyond gp3's ceiling or when sub-millisecond latency or 99.999% durability is required; size st1/sc1 on baseline throughput for continuous scans.
• Volume checks at 0 with InstanceEBSIOPSExceededCheck at 1 (or EBSIOBalance% draining) means the instance, not the volume, is the EBS bottleneck.
• Multipart for large objects, Transfer Acceleration for distance, DataSync for scheduled verified copies, more prefixes plus backoff for 503 Slow Down, Lifecycle for cost.
• EFS = Linux NFS, FSx for Windows = SMB with AD, FSx for Lustre = parallel HPC/ML, ONTAP = multiprotocol, OpenZFS = NFS only, S3 Files = NFS access to a bucket with two-way sync.
• Database Insights (formerly Performance Insights) names the SQL and waits behind DB load; RDS Proxy absorbs connection storms unless sessions pin; read replicas offload reads.

Reliability and Business Continuity

Auto Scaling and Elasticity: EC2, Caching, and Database Scaling

• "Keep a metric near a value" → target tracking, on a metric that falls as capacity is added: average CPU, ALBRequestCountPerTarget (not total RequestCount), or SQS backlog per instance.
• Backlog per instance target = acceptable wait ÷ processing time per message, a number of messages (120 s ÷ 4 s = 30).
• The default cooldown applies only to simple scaling; target tracking and step scaling use instance warmup, which keeps booting instances out of the aggregated metric.
• To pre-warm for a known peak, have the scheduled action raise min capacity (and lower it later); raising only desired is undone by target tracking.
• Predictive scaling needs recurring history; start in forecast only mode, and use a scheduling buffer for slow-booting instances.
• Scale-in protection keeps an instance from being selected; a termination hook only delays an instance already selected; OldestLaunchTemplate removes instances on an old template version first.
• Alarm in ALARM with no activities → check suspended processes (AlarmNotification); InsufficientInstanceCapacity → more Availability Zones and a mixed instances policy, not a quota increase.
• ECS on EC2 needs both service auto scaling (tasks) and an ASG capacity provider with managed scaling (instances); Lambda cold starts → provisioned concurrency, not reserved.
• CloudFront: keep the cache key to what changes the response; Origin Shield centralizes origin requests. ElastiCache: Evictions = memory pressure, Reclaimed = expired TTLs; replicas add reads, shards add writes and memory.
• Multi-AZ RDS resizes with a brief failover on the same endpoint; Aurora Replica auto scaling only helps clients on the reader endpoint; DynamoDB on-demand absorbs up to double the previous peak, and DAX adds microsecond reads without caching code.

High Availability: ELB and Route 53 Health Checks, Multi-AZ Design

• UDP, a static IP per AZ or PrivateLink → NLB; path, host or header routing → ALB; transparent appliance insertion → Gateway Load Balancer. An NLB can front an ALB through an ALB-type target group.
• ALB listener rules run from the lowest priority number, first match wins; one HTTPS listener serves many domains with SNI certificates and host-header rules.
• Use traffic-port for the health-check port; an explicit port keeps probing the old port after the application moves. Health checks don't follow redirects — widen the matcher (e.g. 200-399) if needed.
• When every target is unhealthy, the ALB fails open to all of them; once targets recover, only the healthy ones get traffic, as set by the unhealthy state routing threshold.
• 502 = bad response or closed connection (check keep-alive vs idle timeout); 503 = no registered targets; 504 = target exceeded the idle timeout (60 s default); 403 = AWS WAF block.
• Route 53 health checkers live outside your VPC — use CloudWatch alarm health checks for private resources; Evaluate Target Health works only on alias records, which also serve the zone apex.
• Shallow health checks for the load balancer, deep dependency-aware checks for Route 53 Regional failover; ARC zonal shift handles gray failures in one AZ.
• RDS Multi-AZ standby: synchronous, never readable, automatic failover; Multi-AZ DB cluster: two readable standbys and a reader endpoint; read replicas: asynchronous, promoted manually.
• Connect to databases and caches by endpoint name and keep DNS caching short; write to the ElastiCache primary endpoint, read from the reader endpoint.
• Static stability: peak ÷ (N − 1) instances per AZ, and no single zonal NAT gateway — use one per AZ or a regional NAT gateway.

Backup, Restore, and Disaster Recovery Strategies on AWS

• RPO = maximum acceptable data loss, RTO = maximum acceptable downtime; worst-case RPO equals the backup interval, and copying a recovery point never makes it fresher.
• AWS Backup centralizes schedules (hourly at most frequent), retention, copies and lifecycle; tag-based assignment and organization backup policies (with the IAM role pre-created in every account) are the at-scale answers.
• Continuous backup gives PITR for RDS, Aurora, S3 and SAP HANA on EC2 only; cross-Region or cross-account copies of it become snapshots.
• Cold storage is not available for every resource type (not RDS or Aurora) and needs at least 90 days in the cold tier.
• Vault Lock compliance mode is immutable after its grace time; governance mode and vault access policies can be changed by privileged users. Cross-account copies of RDS or EBS need a customer managed KMS key.
• RDS automated backups (up to 35 days, 0 disables PITR) and their cross-Region replication expire; manual and final snapshots persist until deleted. DLM targets instances for multi-volume crash-consistent snapshots.
• Every restore creates a new resource, and a DynamoDB restore drops auto scaling, TTL, streams, tags, alarms, IAM policies and PITR; prove RTO with AWS Backup restore testing plus custom validation.
• S3: delete the delete marker to undelete; expire noncurrent versions to cut cost; suspending versioning keeps old versions and uses null version IDs; RTC adds a 15-minute SLA and SSE-KMS replication must be opted in.
• DR patterns by rising cost and falling RTO/RPO: backup and restore → pilot light → warm standby → multi-site active/active; pick the cheapest that meets the objectives, and fail back with a new replica, not an undo.

Deployment, Provisioning, and Automation

CloudFormation, StackSets, and golden images: provisioning for SOA-C03

• AMIs are Regional: copy them ahead of need; a copy is re-encrypted with a destination-Region key and must be shared again.
• Share encrypted AMIs only under a customer managed key that target accounts can use — never aws/ebs; share with an OU ARN to cover future accounts.
• Deregister an AMI before deleting its snapshots (a disabled AMI still blocks deletion); deprecate only hides, disable blocks launches reversibly.
• Image Builder: schedules can wait for dependency updates, test components gate distribution, container recipes output to ECR.
• Replacement creates a new physical resource (new ID and IP) and deletes the old one at cleanup; custom-named resources can't be replaced.
• Termination protection stops stack deletes, stack policies stop updates, UpdateReplacePolicy covers replacement and DeletionPolicy covers deletion.
• Drift detection checks only properties the template sets and never reverts; ROLLBACK_COMPLETE means delete and recreate.
• Every subnet loses 5 addresses and can't be resized — add CIDR space and subnets; IAM names are account-global, and a service role needs iam:PassRole.

Systems Manager and event-driven automation: managing resources for SOA-C03

• A managed node needs a running (recent enough) SSM Agent, credentials from an instance profile or Default Host Management Configuration (IMDSv2, agent 3.2.582.0+), and a path to the ssm, ssmmessages and ec2messages endpoints.
• Interface endpoints only work with private DNS enabled and a security group allowing HTTPS 443 from the nodes; S3, KMS and Logs endpoints serve patching, encryption and logging, not registration.
• Session Manager needs no inbound ports; session logging does not cover SSH or port-forwarding sessions, and CloudTrail records StartSession but not the commands.
• Run Command max concurrency limits parallelism; max errors stops sending once failures exceed the value. Send full output to S3 or CloudWatch Logs.
• Runbooks: aws:approve gates on named approvers with a recorded decision; aws:pause just waits for a resume. AutomationAssumeRole plus iam:PassRole enables delegated execution.
• Configuration that must stay enforced over time belongs in a State Manager association; OS patching with approval rules is Patch Manager running AWS-RunPatchBaseline (Scan or Install).
• An auto-approval delay approves different patch sets on different run dates; an approval cutoff date gives every environment the identical set. Rate controls live on the task, not the baseline.
• NoReboot leaves patches InstalledPendingReboot and the node non-compliant until a reboot and a new scan.
• EventBridge rules are Regional and their schedules are UTC; EventBridge Scheduler adds time zones, one-time schedules and delete-after-completion.
• S3 Event Notifications go to Lambda, SQS or SNS and reject overlapping filters; turn on EventBridge for the bucket for content filtering and any target.
• AWS DevOps Agent investigates alerts and recommends mitigations; it changes resources only through opt-in directed actions that an operator approves.
• Prefer a managed, declarative feature or predefined runbook over custom Lambda code when the requirement is the least operational overhead.

Security and Compliance

IAM, AWS Organizations, and Compliance Tools for CloudOps (SOA-C03)

• Only identity and resource policies grant access — SCPs, RCPs, permissions boundaries and session policies can only cap it, and an explicit deny anywhere always wins.
• Enforce MFA with a Deny using BoolIfExists on aws:MultiFactorAuthPresent; plain Bool or MultiFactorAuthAge fail open for access-key requests, and CLI users get MFA-backed credentials from sts get-session-token.
• Workloads never need stored keys: instance profiles on EC2, the ECS task role (not the execution role) for app calls, IAM Roles Anywhere on premises, and OIDC federation conditioned on the sub claim for CI.
• Cross-account access needs an allow on both sides; with SSE-KMS the key policy and the caller's identity policy must also allow the KMS actions.
• aws:SourceIp sees the public (NAT) address; VPC keys exist only through VPC endpoints; negated operators match when a key is missing.
• Who did it → CloudTrail (event history: 90 days of management events; data events need a trail). Would this policy allow it → IAM policy simulator. What is exposed, reachable internally or unused → IAM Access Analyzer (external, internal and unused access analyzers).
• An action must be allowed by SCPs at every level from root to account; SCPs never affect the management account or service-linked roles.
• Trusted Advisor events reach EventBridge only in us-east-1; AWS Config remediates through SSM Automation runbooks, and organization conformance packs deploy from a delegated administrator.

Data Protection on AWS: KMS, ACM, Secrets, and Security Services (SOA-C03)

• Classification is a tag: tag policies standardize it, tag-scoped (organization) Config rules enforce and report on it, and Macie checks that S3 data matches its label.
• Macie automated discovery samples daily for broad coverage; a discovery job with 100% sampling depth inspects every object in the buckets you choose. Customer managed keys must let the Macie role decrypt.
• Default EBS encryption is per account and Region; a customer managed default key must allow the Auto Scaling service-linked role, including kms:CreateGrant.
• The KMS key policy is the primary authority; cross-account use needs the key policy and the caller's IAM policy on the key ARN, so AWS managed keys never work cross-account.
• Automatic rotation runs every 90–2,560 days; imported material rotates on demand after importing new material into the same key; AWS managed keys rotate yearly on AWS's schedule.
• You cannot encrypt an existing EBS volume or RDS instance in place, restore an unencrypted RDS snapshot to an encrypted instance, or create an encrypted replica of an unencrypted instance.
• ACM renews issued and Private CA certificates under the same ARN; imported and IAM-stored certificates never renew — monitor DaysToExpiry or the Approaching Expiration event.
• Enforce TLS with aws:SecureTransport on S3, an HTTP-to-HTTPS redirect on an ALB, and require_secure_transport or rds.force_ssl on RDS.
• Secrets Manager for rotation (or RDS-managed master passwords); a standard-tier SecureString for static secrets. Parameter policies notify or expire, they never rotate.
• Findings → EventBridge → SNS plus runbook; Config remediation runs only from Config rules. Security groups don't cut tracked connections — use a NACL deny, and never stop the instance before capturing evidence.

Networking and Content Delivery

VPC Networking and Private Connectivity for SOA-C03

• A subnet is public only if its route table sends 0.0.0.0/0 to an internet gateway and its instances have public IPs.
• Every subnet loses five IPs; subnet and primary VPC CIDRs are fixed, so add a secondary VPC CIDR and new subnets when addresses run out.
• Zonal NAT gateways need one per AZ with same-AZ routes for resilience; a regional NAT gateway spans AZs automatically and needs no public subnet, but private NAT stays zonal.
• IPv6 outbound-only is an egress-only internet gateway; IPv6-only workloads reaching IPv4 need NAT64 (DNS64 plus 64:ff9b::/96 to a NAT gateway).
• NACLs are stateless and stop at the lowest-numbered matching rule — a deny must be numbered below the allow it overrides.
• Gateway endpoints are free and have no security groups; interface endpoints need inbound 443 in their security group; bucket policies restrict paths with aws:SourceVpce.
• PrivateLink endpoint services control consumers with allowed principals and acceptance required, and tolerate overlapping CIDRs.
• Peering is never transitive and has no edge-to-edge routing; Transit Gateway segments with route table association and propagation — turn the defaults off to isolate new attachments.
• Site-to-Site VPN has two tunnels; BGP plus VGW route propagation keeps new on-premises networks flowing without manual routes.
• WAF scope is fixed at creation (CloudFront in us-east-1 vs regional); Shield Advanced protects only added resources; Network Firewall inspects only routed traffic; DNS Firewall associates with VPCs.

Route 53 DNS and CloudFront Content Delivery for SOA-C03

• Alias records work at the zone apex, track their AWS target automatically, and are free to query when targeting AWS resources; CNAMEs cannot sit at the apex.
• Lower a record's TTL at least one old-TTL period before a cutover; lowering it at the moment of change leaves resolvers on the old answer.
• On-prem must resolve VPC names: inbound Resolver endpoint. VPCs must resolve on-prem domains: outbound endpoint plus forwarding rules.
• Cross-account private zones: owner authorizes, VPC owner associates (CLI/API). Resolver rules and Route 53 Profiles are shared through AWS RAM; endpoints are not.
• Simple routing cannot use health checks; weighted returns one record per response; multivalue returns up to eight healthy records.
• Private resources need a health check that monitors a CloudWatch alarm; Evaluate Target Health works only on alias records.
• Public DNS query logs go to CloudWatch Logs in us-east-1 under a resource policy; Resolver query logs cover queries from your VPCs and can go to S3 or Firehose.
• OAC plus a bucket policy scoped to the distribution ARN keeps S3 private; SSE-KMS also needs kms:Decrypt for CloudFront in the key policy.
• Cache behaviors match in precedence order; the cache policy sets key and TTLs, the origin request policy adds forwarded values, neither picks an origin.
• Prefer versioned object names over invalidations; origin groups fail over only GET, HEAD and OPTIONS requests.
• Custom-domain HTTPS on CloudFront: us-east-1 ACM certificate, alternate domain name, and an alias record to the distribution.
• Two static anycast IPs for any TCP/UDP app, or instant regional failover, means Global Accelerator; caching HTTP content means CloudFront (whose opt-in Anycast Static IPs are HTTP-only).

AWS Network Troubleshooting: VPC Flow Logs and the Layered Diagnosis Method

• Security groups are stateful; network ACLs are stateless — a rejected reply to an accepted request is always a NACL problem.
• Network ACLs never filter Route 53 Resolver (VPC+2), instance metadata, DHCP or Amazon Time Sync traffic.
• A zonal NAT gateway must sit in a public subnet with an IGW route; a regional NAT gateway needs no public subnet and has its own route table.
• NAT port exhaustion (ErrorPortAllocation): add secondary IPs (55,000 connections per destination per IP) or spread clients across more NAT gateways; idle connections drop after 350 seconds.
• ACCEPT in a flow log means only that the SG and NACL allowed the packet — an OS-firewall drop or a reset from a closed port is still ACCEPT.
• Behind a NAT gateway, the original destination is in pkt-dstaddr on the instance-to-NAT leg; the translated leg never shows the instance.
• Peering is non-transitive, needs static routes on both sides and has no propagation; transit gateway replies use the destination attachment's route table.
• Reachability Analyzer traces one path and names the blocker; Network Access Analyzer audits for unintended access.
• WAF rule-group blocks: terminatingRuleId names the group, ruleGroupList names the rule; ALB 502 with target status '-' means the target's keep-alive timeout is shorter than the LB idle timeout.
• Low CloudFront hit ratio: move non-varying values to an origin request policy, align TTLs, version object names; Origin Shield and longer max TTLs don't fix a fragmented key.
• Hybrid probes: Network Synthetic Monitor; in-AWS workload flows: Network Flow Monitor; end users' ISPs and cities: Internet Monitor.
• VPN tunnel up but no traffic: check routes (static routes or BGP propagation on the route table) first, then security groups allowing the on-premises CIDR.