DVA-C03 cheat sheet — every exam topic on one page

Development with AWS Services

DVA-C03 Application Development: Decoupling, APIs, SDKs, Events, Streams and AI

• SQS buffers work for competing consumers; SNS fans one message out to every subscriber; one SQS queue per consumer behind an SNS topic gives independent, buffered fan-out.
• Keep only what the caller needs right now synchronous; API Gateway's integration timeout is 29 seconds by default, so long work goes to a queue, an event or an async Lambda invocation (X-Amz-Invocation-Type: 'Event' in a non-proxy integration).
• Backoff needs jitter to break synchronized retries; adaptive retry mode adds client-side rate limiting on top of standard retries.
• AWS messaging is at-least-once: make consumers idempotent with a stable key (business ID or EventBridge event id) recorded by a conditional write.
• REST APIs validate bodies with JSON Schema models and transform with VTL mapping templates in non-proxy integrations; HTTP APIs support neither.
• Use paginators for list calls, waiters for resource readiness, and catch only the specific error code you can handle.
• EventBridge: filter in the event pattern (numeric ranges included), DLQ for failed deliveries, archive and replay (optionally to specific rules) for reprocessing.
• S3 notifications go to SNS standard, SQS standard, Lambda or EventBridge; keys arrive URL-encoded; use EventBridge to reach FIFO queues and prefix/suffix filters to avoid loops.
• Kinesis ordering is per shard via the partition key; high-cardinality keys avoid hot shards; enhanced fan-out gives each app its own read throughput; Firehose buffers and delivers without consumer code.
• Kiro specs plan before code, steering holds conventions, hooks automate checks; Bedrock Converse is model-agnostic, ConverseStream needs bedrock:InvokeModelWithResponseStream, and batch inference suits offline jobs.

DVA-C03 Lambda Development: Configuration, VPC Access, Error Handling and Event Sources

• Code outside the handler runs once per execution environment; reuse SDK clients and connections there, but keep per-request state inside the handler.
• Memory also sets CPU; ephemeral storage sizes /tmp; the 15-minute timeout is a hard ceiling, so longer jobs move to Step Functions or containers.
• Environment variables are limited to 4 KB in total and are frozen into each published version; promote changes by publishing a version and moving the alias.
• Reserved concurrency caps and guarantees (0 stops the function); provisioned concurrency pre-initialises environments on a version or alias.
• Layers extract to /opt in runtime-specific folders (python/, nodejs/node_modules/); container-image functions take no layers.
• A VPC-attached function needs AWSLambdaVPCAccessExecutionRole, security-group references, NAT for the internet and VPC endpoints for AWS services; it never gets a public IP.
• RDS Proxy pools connections for highly concurrent functions and lets them authenticate with IAM tokens instead of passwords.
• Destinations and DLQs apply only to asynchronous invocations and are written with the execution role; destinations send a richer record to more targets.
• SQS, Kinesis and DynamoDB Streams failures are handled on the event source mapping: partial batch responses, the queue's redrive policy, bisect, retry limits and on-failure destinations.
• With proxy integration the function returns statusCode, headers and a string body, and API Gateway needs a resource-based policy statement to invoke it.

DVA-C03 Data Stores: DynamoDB Design, Caching and Data Lifecycles

• DynamoDB fits key-based lookups at any scale; RDS and Aurora fit ad hoc joins and multi-table transactions; S3 holds large objects; ElastiCache serves hot data in memory. Items over 400 KB go to S3 with the key stored in DynamoDB.
• In a versioned bucket, expiring current versions only adds delete markers; NoncurrentVersionExpiration, ExpiredObjectDeleteMarker and AbortIncompleteMultipartUpload free the storage.
• DynamoDB TTL needs a Number in epoch seconds, deletes in the background within days without using write capacity, and marks its stream records with principalId dynamodb.amazonaws.com.
• Object Lock compliance mode cannot be overridden by anyone; governance mode can be bypassed with s3:BypassGovernanceRetention; a legal hold has no end date until removed.
• Valkey or Redis OSS adds sorted sets, pub/sub, replication, failover and snapshots; Memcached is a simple multithreaded cache. Cluster mode enabled shards writes and memory.
• Lazy loading caches only what is read but can serve stale data; write-through stays fresh but churns; a TTL bounds staleness with either.
• DAX is API-compatible, caches only eventually consistent reads, updates its item cache on writes, and refreshes its query cache only when the TTL ends.
• Each partition handles at most 3,000 read and 1,000 write units per second; use high-cardinality, composite or sharded keys, on the table and on GSIs.
• Filters run after the read, Limit counts items before filtering, and only a missing LastEvaluatedKey ends pagination; GSIs are eventually consistent only.
• Condition expressions make check-and-write atomic; TransactWriteItems makes several conditional writes all-or-nothing, and BatchWriteItem does neither.

Security

DVA-C03 Authentication and Authorization: IAM, Cognito, STS and Signed URLs

• User pools authenticate people and issue JWTs; identity pools exchange tokens (or guest access) for temporary AWS credentials. AWS services accept only SigV4-signed requests, never JWTs.
• ${cognito-identity.amazonaws.com:sub} is the identity pool identity ID, not the user pool sub claim; use it with dynamodb:LeadingKeys or S3 prefixes for per-user access.
• Federate CI/CD with an IAM OIDC provider and AssumeRoleWithWebIdentity, and pin the token's sub claim in the trust policy; an aud condition alone admits every workflow on the platform.
• Cognito authorizer for user pool tokens on REST APIs, JWT authorizer for OIDC tokens on HTTP APIs, Lambda authorizer for custom logic, IAM authorization for AWS principals; API keys are not authentication.
• Lambda authorizer policies are cached per key across methods: return a policy for everything the caller may access, and remember a missing REQUEST identity source yields 401 without an invocation.
• SDKs use the first credentials in the provider chain, so environment variables or files override instance and task roles; ECS application calls use the task role, not the task execution role.
• AssumeRole needs the role's trust policy and the caller's permission; chained role sessions are capped at one hour and longer requests fail.
• Across accounts both the identity policy and the resource policy (bucket, key, queue, API) must allow the call; services invoking your resources need resource-based policies scoped with aws:SourceArn.
• S3 presigned URLs act with the signer's permissions and die with the signer's temporary credentials; CloudFront signed URLs or cookies with a trusted key group plus origin access control protect content served through CloudFront.
• Use BoolIfExists on aws:MultiFactorAuthPresent in MFA deny statements, and get MFA-backed temporary credentials with GetSessionToken or AssumeRole plus SerialNumber and TokenCode.

DVA-C03 Encryption and Sensitive Data: KMS, S3 Encryption, Certificates and Secrets

• Customer managed KMS keys are the only keys whose policy you edit, share across accounts and can disable in an emergency; AWS managed keys such as aws/s3 cannot be shared.
• SSE-KMS reads need kms:Decrypt and writes need kms:GenerateDataKey; cross-account use needs the key policy and the caller's IAM policy, on the key ARN.
• S3 Bucket Keys cut SSE-KMS request volume and cost without changing the key; new general purpose buckets block SSE-C until default encryption stops blocking it.
• KMS Encrypt handles at most 4 KB: use GenerateDataKey, encrypt locally and store only the CiphertextBlob, never the plaintext data key.
• Decrypt must repeat the exact encryption context; kms:EncryptionContext:<key> conditions isolate tenants on one key.
• Automatic rotation keeps the key ID and old material; imported material rotates by importing into the same key and calling RotateKeyOnDemand.
• RDS encryption is set at creation (snapshot, encrypted copy, restore); DynamoDB switches keys in place; EBS encryption by default covers every new volume.
• CloudFront certificates must be in ACM us-east-1; only DNS-validated ACM certificates renew on their own; internal names and mutual TLS need AWS Private CA.
• Macie finds PII in S3 and reports to EventBridge; CloudWatch Logs data protection masks new events and logs:Unmask reveals them to chosen principals.
• Rotating credentials belong in Secrets Manager; use RDS-managed passwords, alternating users for connection pools, and a VPC endpoint plus database access for rotation functions.

DVA-C03 AI Service Security: Bedrock Access, Guardrails, Agents and Logs

• Bedrock model access is enabled on first invocation; models sold through AWS Marketplace need Marketplace permissions for that first call only, and Anthropic models also need the first-time use case form (again in opt-in Regions).
• To keep a model blocked, deny bedrock:InvokeModel* on its ARN; denying aws-marketplace:Subscribe or deleting the model agreement does not hold.
• Converse needs bedrock:InvokeModel and ConverseStream needs bedrock:InvokeModelWithResponseStream; a guardrail adds bedrock:ApplyGuardrail on the guardrail ARN; a cross-Region inference profile needs the model allowed in every destination Region.
• Model inference over PrivateLink uses an interface endpoint for bedrock-runtime; without private DNS the SDK needs the vpce endpoint URL, and behind an endpoint scope with aws:SourceVpce because aws:SourceIp is absent.
• Bedrock never uses your prompts or responses to train base models or shares them with providers; fine-tuning trains a private copy.
• Guardrails: content filters for harmful categories, denied topics for subjects, word filters for exact strings, sensitive information filters (Block, Mask or None, per direction) for PII and regex patterns, the prompt attack filter for injection.
• With InvokeModel, user input must be in guardrail input tags or prompt attacks are not filtered; tool results are never assessed, so screen them with ApplyGuardrail.
• Converse reports an intervention with stopReason guardrail_intervened; ApplyGuardrail returns action NONE with empty outputs when nothing matched, and its source (INPUT or OUTPUT) picks which settings apply.
• Human approval before an agent action is user confirmation (CONFIRM or DENY in the same session); running the action in your own app is return of control; tool authorization outside agent code is AgentCore Gateway inbound auth plus Cedar policies.
• AgentCore Runtime isolates each runtimeSessionId in a microVM but does not map users to sessions; invocation logs and guardrail traces keep original PII, so mask logs with a data protection policy and grant logs:Unmask narrowly.

Testing and Deployment

DVA-C03 Deployment Artifacts: Dependencies, ECR Images, AppConfig and API Gateway Stages

• Build once, deploy many: keep environment values out of the artifact and supply them per environment, so the tested package is the released one.
• Commit a lock file and install with a lock-honouring command such as npm ci; build native dependencies for the target runtime with sam build --use-container.
• Multi-stage builds shrink images, copying the dependency manifest before the source keeps the dependency layer cached, and docker buildx can publish one multi-architecture tag.
• ECR logins use get-login-password piped to docker login (12-hour token); ecr:GetAuthorizationToken needs Resource "*" while push and pull actions stay scoped to the repository.
• Tag images with the commit ID for traceability, pin approved images by digest, and use IMMUTABLE or IMMUTABLE_WITH_EXCLUSION to stop tags being reused.
• In lifecycle policies, lower priority numbers apply first, an image matched by a higher-priority rule is protected from lower ones, tagStatus any goes last, and expiry happens within about 24 hours.
• Replication copies images to other Regions or accounts after each push; pull through cache copies from an upstream registry on first pull.
• CodeConnections connections created by CLI or CloudFormation stay PENDING until completed in the console; CodeArtifact tokens need sts:GetServiceBearerToken in the identity policy.
• AppConfig validators reject bad data at StartDeployment, alarms plus a gradual strategy with bake time roll back harmful values, and the AppConfig Agent caches data at localhost:2772.
• API Gateway REST API changes need a deployment to reach a stage; stage variables pointing at Lambda aliases need a resource-based permission per alias, or calls return 500.

DVA-C03 Application Testing: SAM, CDK, Mocks, Test Events and Environments

• CDK unit tests: Template.fromStack plus assertions, in memory, no deployment; hasResourceProperties means at least one match, allResourcesProperties means every resource.
• validate-template checks syntax, cfn-lint checks resource schemas, CloudFormation Guard checks your own policy rules; AWS Config and drift detection only see deployed resources.
• sam local invoke runs one event, start-api serves HTTP routes, start-lambda emulates the Invoke API for SDK-driven tests; local runs use your profile credentials, not the execution role.
• Shareable Lambda test events live in the lambda-testevent-schemas EventBridge schema registry and need EventBridge Schemas permissions; sam remote invoke runs them against the deployed function.
• Proxy integration bodies and SQS record bodies are strings; HTTP APIs default to payload format 2.0 (requestContext.http.method, rawPath).
• A REST API mock integration needs a request template that emits the status, a matching integration response and a method response for each status; HTTP APIs have no mock integration.
• TestState runs one state with a mocked result or error and needs no role with a mock; callback, .sync, Map and Parallel states require a mock.
• Versions freeze configuration and aliases carry none; each alias used through a stage variable needs its own invoke permission.
• Pin environments to unique immutable image tags or to digests, never to latest.
• Kiro file hooks fire only on the agent's edits; headless CI needs KIRO_API_KEY, --no-interactive and the narrowest --trust-tools list.

DVA-C03 CI/CD: CodePipeline, CodeDeploy, ECS/EKS Deployments, Strategies and Rollback

• .zip direct upload is limited to 50 MB zipped; through S3 the limit is 250 MB unzipped including layers; beyond that use a container image (up to 10 GB). These quotas cannot be raised.
• A rebuilt image under the same tag reaches neither Lambda nor running ECS tasks on its own: update the Lambda function code, or force a new ECS deployment (or register a new revision).
• Package type is fixed at creation, and functions keep the layer version they reference until you update them, even after that version is deleted.
• Fargate needs awsvpc, task-level CPU/memory, a task execution role to pull images and a network path to ECR (NAT or ecr.api, ecr.dkr and S3 endpoints).
• ECS circuit breaker = tasks that cannot start; deployment alarms = healthy tasks with bad metrics. ECS BLUE_GREEN uses lifecycle hooks and a bake time without CodeDeploy.
• EKS zero-downtime rollout: maxUnavailable 0, maxSurge above 0 and a readinessProbe; kubectl rollout undo goes back a revision.
• CodeDeploy ApplicationStop runs the previous revision's script; ECS validation through the test listener runs in AfterAllowTestTraffic; a rollback is a new deployment with a new ID.
• SAM gradual deploys: AutoPublishAlias + DeploymentPreference Type (Canary/Linear/AllAtOnce) + Alarms + PreTraffic/PostTraffic hooks.
• CodePipeline V2: tag-filtered push triggers for releases, QUEUED for every commit in order, PARALLEL for per-branch runs (no rollback), rollback-stage to restore an earlier execution.
• CloudFormation: change sets preview replacements; rollback triggers watch alarms for up to 180 minutes; preserve successfully provisioned resources to fix and retry.

Troubleshooting and Optimization

DVA-C03 Root Cause Analysis: Lambda and API Errors, Logs Insights, X-Ray, Deployment Logs and AI Troubleshooting

• Work in order: metrics locate the symptom, traces locate the hop, logs explain the request, CloudTrail and deployment logs reveal the change.
• 'Task timed out after N seconds' is a timeout; a killed runtime well before the timeout on large inputs is out of memory; a throttled invocation writes no logs at all.
• In an AccessDenied message, the principal tells you whose policy to fix; cross-account KMS needs both the key policy and the caller's IAM policy.
• API Gateway 502 with a successful Lambda means a malformed proxy response; 504 at about 29 seconds is the integration timeout; Latency far above IntegrationLatency points at the authorizer.
• Use p99 for latency tails; flat ConcurrentExecutions plus rising Throttles and no Errors means a concurrency ceiling.
• X-Ray Error = 4xx, Fault = 5xx, Throttle = 429; of your custom fields only annotations are searchable, and OpenTelemetry attributes need aws.xray.annotations to become annotations.
• Logs Insights runs left to right: parse before filter, filter before stats; Lambda REPORT fields include @maxMemoryUsed and @initDuration.
• CloudTrail event history covers 90 days of management events without setup, never data events; S3 Lifecycle expirations are not API calls.
• Read the first real failure: earliest non-cancelled CREATE_FAILED, the failing CodeBuild phase, ScriptFailed in scripts.log, or the ECS stopped reason.
• CloudWatch investigations, Logs Insights Generate query (cloudwatch:GenerateQuery) and Kiro #terminal/#problems/#git diff speed up analysis, but their output must be reviewed.

DVA-C03 Logging, Monitoring and Observability: CloudWatch, EMF, Alarms, X-Ray and Health Checks

• Lambda's JSON log format plus an application log level gives structured, level-filtered logs with no code change (level filtering applies only with JSON format), but a level set in code takes precedence; the system log level filters only Lambda's platform records.
• Lambda's requestId is per invocation; link a request across components with a shared correlation ID or business key logged as a top-level JSON field.
• Lambda log groups never expire by default: set retention. Send logs to S3 for cheap long-term storage, CloudWatch Logs for real-time use, Firehose for streaming on.
• Data protection policies mask sensitive values on view and logs:Unmask reveals them; KMS encryption controls access to the whole log group, and filters never redact.
• Embedded metric format emits custom metrics from logs with no API calls; every unique dimension combination is a separate metric, CloudWatch does not aggregate across dimensions, and IDs belong in fields, not dimensions.
• Sub-minute alerting needs StorageResolution 1 and a 10, 20 or 30-second alarm period; metric filters only count new events and need a default value of 0 for sparse matches.
• Use notBreaching for metrics published only on failure, composite alarms to page on combined conditions, and a customer managed key for SNS topics that alarms or EventBridge publish to.
• Quota alerts: Service Quotas console alarms or usage / SERVICE_QUOTA() metric math. Deployment alerts: EventBridge state-change rules for CodeDeploy, CodePipeline and ECS (SERVICE_DEPLOYMENT_FAILED needs the circuit breaker).
• X-Ray tracing works on API Gateway REST stages and Lambda active tracing (TracingConfig Mode: Active plus PutTraceSegments and PutTelemetryRecords on the execution role); HTTP APIs have no X-Ray support. Annotations are indexed, metadata is not.
• Instrument new code with OpenTelemetry or ADOT and the CloudWatch agent or a collector (X-Ray SDKs and daemon are in maintenance mode); keep liveness checks shallow, use readiness for temporary unavailability and startup probes for slow starts.

DVA-C03 Optimization: Lambda Concurrency, Memory, Messaging, Caching and Bottlenecks

• Lambda throttles (429) when the account quota or the per-function scaling rate of 1,000 environments every 10 seconds is exceeded; schedule provisioned concurrency for known bursts.
• Reserved concurrency guarantees and caps a function's concurrency at no charge; provisioned concurrency pre-initializes environments on a version or alias and is billed while configured.
• Scale provisioned concurrency with Application Auto Scaling target tracking on utilization plus scheduled actions; SnapStart restores from a snapshot instead of keeping environments running, cannot be combined with provisioned concurrency, and priming belongs in beforeCheckpoint.
• Lambda CPU scales with memory (one vCPU at 1,769 MB, up to 6 at 10,240 MB); measure the cost–speed balance with Lambda Power Tuning and rebuild native dependencies for arm64.
• Compute Optimizer rightsizes EC2, Lambda and ECS on Fargate from history; EC2 memory needs the CloudWatch agent, and the look-back can be extended to 32 or 93 days.
• Use long polling, 10-entry batch APIs, larger event source mapping batches with a batching window, SNS-to-SQS buffering with maximum concurrency, and event source mapping filters to cut requests and invocations.
• Keep the CloudFront cache key minimal and forward extras with an origin request policy; only a minimum TTL above 0 overrides an origin's no-cache; use hashed file names instead of invalidations.
• Rising Evictions with memory near 100% means scale ElastiCache up or out with shards; DAX does not cache strongly consistent or transactional reads.
• Graph p99 rather than averages, watch ApproximateAgeOfOldestMessage for queue lag, and use Contributor Insights to find DynamoDB hot keys.
• Give Kiro live data through the AWS CloudWatch MCP server, and accept AI suggestions only when they preserve behaviour, such as retrying BatchGetItem UnprocessedKeys.