Cloud Operations on AWS
Please note that this is not a prep course for the “AWS Certified CloudOps Engineer - Associate” certification!
This document contains links mentioned in the “Cloud Operations on AWS” course, and additional material on the same topics.
Module 0: Course Introduction
Full name: Cloud Operations on AWS (formerly Systems Operations on AWS)
Product code: 200-SYSOPS-60
These links are based on the course version 6.0.1.
Online and classroom course options: Cloud Operations on AWS on AWS Skill Builder, also offered as Cloud Operations on AWS with AWS Jam
The official course outline: Cloud Operations on AWS (PDF). At the time of writing it still describes version 5.
The official course material: eVantage Bookshelf (VitalSource)
Lab environment: AWS Training classrooms
Labs in this version:
- Auditing AWS Resources with AWS Systems Manager and AWS Config
- Monitor applications and infrastructure
- Troubleshoot and Prove Network Resilience
- Automating with AWS Backup for Archiving and Recovery
- Deploy and Reconcile Infrastructure with AWS CDK
- Operations as code
- Capstone lab for CloudOps
Recommended prerequisite course: AWS Technical Essentials
Related certification: AWS Certified CloudOps Engineer - Associate
Additional material on AWS Skill Builder related to this course. Digital courses are free with a Skill Builder account; the CloudOps Engineer learning plan, labs, SimuLearn and Cloud Quest need a Skill Builder subscription; AWS Jams are classroom events.
Skill Builder: Digital courses (free)
Skill Builder: Learning plans and exam prep
- AWS CloudOps Engineer Learning Plan (includes labs) (free to enroll; the labs and most courses in it need a subscription)
- Exam Prep Plan: AWS Certified CloudOps Engineer - Associate (SOA-C03 - English) (free)
- Official Practice Question Set: AWS Certified CloudOps Engineer - Associate (SOA-C03 - English) (free)
- Official Pretest: AWS Certified CloudOps Engineer - Associate (SOA-C03 - English) (subscription)
- Official Practice Exam: AWS Certified CloudOps Engineer - Associate (SOA-C03 - English) (subscription)
Skill Builder: CloudOps Engineer digital courses (subscription required)
- AWS CloudOps Engineer - Managing Access
- AWS CloudOps Engineer - Monitoring
- AWS CloudOps Engineer - Operating Secure and Resilient Networks
- AWS CloudOps Engineer - Operating DNS on AWS
- AWS CloudOps Engineer - Deploying and Configuring Compute Resources
- AWS CloudOps Engineer - Managing and Optimizing Mountable Storage
- AWS CloudOps Engineer - Managing and Optimizing Object Storage
- AWS CloudOps Engineer - Managing and Optimizing AWS Databases
- AWS CloudOps Engineer - Data Protection
- AWS CloudOps Engineer - Configuring Highly Available Systems
- AWS CloudOps Engineer - Operating Globally High Performing Networks
- AWS CloudOps Engineer - Automating Resource Deployment
- AWS CloudOps Engineer - Configuring Fault-Tolerant Systems
- AWS CloudOps Engineer - Auditing and Ongoing Detection
- AWS CloudOps Engineer - Automating Resource Management and Remediation
Skill Builder: Self-paced labs (subscription required)
- Lab - Deploying and managing Infrastructure as Code
- Lab - Automate Infrastructure Compliance with AWS Config
- Lab - Configuring IAM Identity and resource-based policies
- Lab - Monitoring Applications and Infrastructure
- Lab - DevOps and AI on AWS: CloudWatch Anomaly Detection
- Lab - Automate Patch Operations using AWS Systems Manager Patch Manager
- Lab - VPC Logging and Troubleshooting
- Lab - Configuring High Availability for Your Application
- Lab - Managing EBS Volumes: Capacity, Performance, and Data Protection
- Lab - Multi-part Uploads, Batch Operations, and Cross-Region Replication with S3
- Lab - Automating Operations as Code
- Lab - Security posture assessment and remediation using the Kiro CLI
Skill Builder: SimuLearn (subscription required)
- Domain 1 Practice: AWS SimuLearn - AWS Certified CloudOps Engineer - Associate (SOA-C03 - English)
- Domain 2 Practice: AWS SimuLearn - AWS Certified CloudOps Engineer - Associate (SOA-C03 - English)
- Domain 4 Practice: AWS SimuLearn - AWS Certified CloudOps Engineer - Associate (SOA-C03 - English)
- Domain 5 Practice: AWS SimuLearn - AWS Certified CloudOps Engineer - Associate (SOA-C03 - English)
Module 1: Introduction to Cloud Operations
Websites
- AWS Well-Architected Framework
- AWS Well-Architected - Build secure, efficient cloud applications
- Operational Excellence Pillar
- Security Pillar
- Reliability Pillar
- Performance Efficiency Pillar
- Cost Optimization Pillar
- Sustainability Pillar
- AWS Well-Architected Tool Overview
- AWS Well-Architected Tool Documentation
- Design principles - AWS Well-Architected Framework
- What is AWS Well-Architected Tool?
- What is AWS Well-Architected Agent (preview)?
Blog posts
- Why a Cloud Operating Model?
- Streamline change processes and improve governance with AWS Well-Architected
- Ten Ways to Improve Your AWS Operations
- Learn from AWS Fault Injection Service team’s approach to Game Days
- Streamlining the Correction of Errors process using Amazon Bedrock
- Let’s Architect! Designing Well-Architected systems
- Track your workload’s risks with the new AWS Well-Architected Tool Connector for Jira
Videos
- AWS re:Invent 2025 - From ideas to impact: Architecting with cloud best practices (ARC204)
- AWS re:Invent 2025 - Behind the scenes: How AWS drives operational excellence & reliability (COP415)
- AWS re:Invent 2024 - Architectural best practices throughout the lifecycle (ARC206)
- AWS re:Invent 2024 - Supercharge your innovation: Automate for operational excellence (SUP307)
- AWS re:Invent 2024 - Are you well-architected? (TNC206)
Module 2: Access Management
Websites
- What is IAM? - AWS Identity and Access Management
- How IAM works - AWS Identity and Access Management
- AWS account root user - AWS Identity and Access Management
- Compare IAM identities and credentials - AWS Identity and Access Management
- Enabling SAML for your AWS resources
- IAM user groups - AWS Identity and Access Management
- Policies and permissions in AWS Identity and Access Management - AWS Identity and Access Management
- Grant a user permissions to pass a role to an AWS service - AWS Identity and Access Management
- AWS: Denies access to AWS based on the source IP - AWS Identity and Access Management
- IAM: Pass an IAM role to a specific AWS service - AWS Identity and Access Management
- Policy evaluation logic - AWS Identity and Access Management
- Security best practices in IAM - AWS Identity and Access Management
- IAM - Multi-Factor Authentication
- access-keys-rotated - AWS Config
- Generate credential reports for your AWS account - AWS Identity and Access Management
- IAM policy testing with the IAM policy simulator - AWS Identity and Access Management
- AWS Policy Generator
- Generate Policies Using Access Analyzer
- AWS Identity and Access Management (IAM) Overview
- AWS Config Overview
- AWS Config
- AWS Organizations Overview
- What is AWS Organizations?
- Service control policies (SCPs) - AWS Organizations
- What is IAM Identity Center?
- What Is AWS Control Tower?
- Introduction: AWS Control Tower Controls Reference Guide
Blog posts
- How AWS uses automated reasoning to help you achieve security at scale - AWS Security Blog
- Beyond IAM access keys: Modern authentication approaches for AWS
- Strategies for achieving least privilege at scale – Part 1
- Refine unused access using IAM Access Analyzer recommendations
- Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline
- Enhanced access denied error messages with policy ARNs
- Unlock new possibilities: AWS Organizations service control policy now supports full IAM language
- Secure root user access for member accounts in AWS Organizations
- Search and discover governance controls with Control Catalog in AWS Control Tower
Videos
- AWS re:Inforce 2024 - IAM policy power hour (IAM304)
- AWS re:Inforce 2025 - Empowering developers to implement least-privilege IAM permissions (IAM304)
- AWS re:Inforce 2025 - Understand who in your organization can access your AWS resources (IAM307-NEW)
- AWS re:Invent 2025 - IAM Access Analyzer Deep Dive: From Configuration to Remediation (SEC340)
- Multi Account Structure in AWS with AWS Organizations
- AWS re:Invent 2025 - Governance that Enables Innovation at Scale feat. Eli Lilly and Company (COP346)
Module 3: System Discovery
Websites
- Installing or updating to the latest version of the AWS CLI - AWS Command Line Interface
- AWS CLI Command Reference
- AWS Systems Manager Session Manager - AWS Systems Manager
- Step 7: (Optional) Turn on or turn off ssm-user account administrative permissions - AWS Systems Manager
- Best Practices for Tagging AWS Resources
- AWS Resource Groups
- Controlling access to and for IAM users and roles using tags - AWS Identity and Access Management
- Tag policies - AWS Organizations
- AWS Systems Manager Documents - AWS Systems Manager
- Working with parameter hierarchies in Parameter Store - AWS Systems Manager
- AWS Config Managed Rules - AWS Config
- Setting Up AWS Config with the Console - AWS Config
- AWS Systems Manager Overview
- AWS Systems Manager Documentation
- Tagging AWS Resources
- AWS CloudFormation Resource Tags
- Managing Tags in AWS Service Catalog
- What is AWS CloudShell?
- Organizing and tracking costs using AWS cost allocation tags
- AWS Systems Manager Inventory
- AWS Systems Manager Parameter Store
Blog posts
- Toward a bastion-less world - Integration & Automation
- Simplified developer access to AWS with ‘aws login’
- Introducing Just-in-time node access using AWS Systems Manager
- Use tags to divide your bill by cost center or project (AWS re:Post Knowledge Center)
- Leveraging existing tagging strategies for Application Operations
- Enforce consistent tagging across IaC deployments with AWS Organizations Tag Policies
- Share Systems Manager documents across your AWS Organization with AWS RAM
- How to choose the right AWS service for managing secrets and configurations
- Unlock the Power of AWS Config: Centralized Compliance and Resource Management
Videos
- AWS re:Invent 2025 - Programmatically access AWS with your console credentials (SEC354)
- How can I tag my AWS resources to divide up my bill by cost center or project?
- Search resources across accounts with AWS Resource Explorer AWS - OnAir S5 - AWS OnAir S05 (AWS Events)
- AWS re:Invent 2024 - Unlocking business insights with AWS Config, featuring Itaú Unibanco (COP326)
Module 4: Monitor and Maintain System Health
Websites
- Amazon Monitoring and Observability-Amazon CloudWatch - AWS
- Metrics concepts - Amazon CloudWatch
- About the Add-on - Splunk Add-on for Amazon Web Services
- AWS services that publish CloudWatch metrics - Amazon CloudWatch
- Amazon CloudWatch Pricing - Free Tier Available
- Monitor your instances using CloudWatch - Amazon Elastic Compute Cloud
- Basic monitoring and detailed monitoring in CloudWatch - Amazon CloudWatch
- PutMetricData - Amazon CloudWatch
- Publish custom metrics (PutMetricData / EMF) - Amazon CloudWatch
- CloudWatch: Write-CWMetricData Cmdlet - AWS Tools for PowerShell
- Using CloudWatch anomaly detection - Amazon CloudWatch
- Using Amazon CloudWatch dashboards - Amazon CloudWatch
- Creating a CloudWatch cross-account cross-Region dashboard with the AWS Management Console - Amazon CloudWatch
- Log anomaly detection - Amazon CloudWatch Logs
- Creating metrics from log events using filters - Amazon CloudWatch Logs
- Working with log groups and log streams - Amazon CloudWatch Logs
- Understanding data protection policies - Amazon CloudWatch Logs
- Collect metrics, logs, and traces using the CloudWatch agent - Amazon CloudWatch
- Analyzing log data with CloudWatch Log Analytics - Amazon CloudWatch Logs
- Analyzing log data with CloudWatch Logs Insights - Amazon CloudWatch Logs
- Cross-account cross-Region log centralization - Amazon CloudWatch Logs
- Migrating from X-Ray instrumentation to OpenTelemetry instrumentation - AWS X-Ray
- Container Insights - Amazon CloudWatch
- Grafana Dashboards - Amazon Managed Service for Grafana - AWS
- Container Environment Monitoring Service - Amazon Managed Service for Prometheus – Amazon Web Services
- Troubleshooting the CloudWatch agent - Amazon CloudWatch
- What Is Amazon CloudWatch?
- What Is Amazon EventBridge?
- What Is CloudWatch Logs?
- GetMetricStatistics
- CloudWatch Logs Insights Query Syntax
- Monitoring AWS Health Events with CloudWatch Events
- Using the X-Ray trace map (formerly CloudWatch ServiceLens)
- Why Are My CloudWatch Alarms in INSUFFICIENT_DATA State?
- Amazon CloudWatch Overview
- Amazon EventBridge Overview
- AWS Health Documentation
- AWS X-Ray Overview
- Application Signals - Amazon CloudWatch
- Using the resource health view in the CloudWatch console - Amazon CloudWatch
- CloudWatch Database Insights - Amazon CloudWatch
- Generative AI observability - Amazon CloudWatch
- Use natural language to generate and update CloudWatch Logs Insights queries - Amazon CloudWatch Logs
- CloudWatch cross-account observability - Amazon CloudWatch
Blog posts
- Visualize and Monitor Highly Distributed Applications with Amazon CloudWatch ServiceLens
- Amazon CloudWatch Application Signals new enhancements for application monitoring
- Advanced analytics using Amazon CloudWatch Logs Insights
- Amazon CloudWatch introduces unified data management and analytics for operations, security, and compliance
- Container Insights with enhanced observability now available in Amazon ECS
- New Amazon CloudWatch Database Insights: Comprehensive database observability from fleets to instances
- Amazon CloudWatch Database Insights applied in real scenarios
- Introducing Amazon CloudWatch Omni: Observability for the AI Era
- Introducing Amazon CloudWatch Omni: AI-powered observability for generative AI and agentic workloads
Videos
- AWS re:Invent 2025 - [NEW LAUNCH] What’s new with Amazon CloudWatch (COP363)
- AWS re:Invent 2025 - Elevate application and generative AI observability (COP326)
- AWS re:Invent 2025 - Implementing observability at scale: A blueprint for success (COP328)
- AWS re:Invent 2025 - Observability & Security unite: Unify your data in Amazon CloudWatch (COP361)
- AWS re:Invent 2025 - Troubleshooting database performance issues at scale (COP331)
- AWS re:Invent 2025 - Scaling open source observability stack feat. Warner Bros Discovery (COP333)
Module 5: Alerts, Events, and Responses
Websites
- Using Amazon CloudWatch alarms - Amazon CloudWatch
- Serverless Event Router – Amazon EventBridge – AWS
- Event bus targets in Amazon EventBridge - Amazon EventBridge
- Getting started with your AWS Health Dashboard - AWS Health
- Setting up your AWS account - AWS Identity and Access Management
- Analyzing your costs and usage with AWS Cost Explorer - AWS Cost Management
- Creating Cost and Usage Reports - AWS Data Exports
- Querying Cost and Usage Reports using Amazon Athena - AWS Data Exports
- Receiving budget alerts in chat applications - AWS Cost Management
- Create a billing alarm to monitor your estimated AWS charges - Amazon CloudWatch
- Identifying opportunities with Cost Optimization Hub - AWS Cost Management
- Understanding cost optimization strategies - AWS Cost Management
- Getting and Viewing Your AWS Bill
- Modifying Cost Explorer Preferences
- Forecasting Costs with Cost Explorer
- Cost and Usage Report Data Dictionary
- Creating a Cost Budget
- Creating a Reservation Budget
- Creating a Savings Plans Budget
- Creating Budget Filters
- Composite alarms - Amazon CloudWatch
- Amazon EventBridge event patterns - Amazon EventBridge
- Amazon SNS message filtering - Amazon Simple Notification Service
- Aggregating AWS Health events using organizational view and delegated administrator access - AWS Health
- Managing your costs with AWS Budgets - AWS Cost Management
- Configuring budget actions - AWS Cost Management
Blog posts
- Turn Your Amazon CloudWatch Alarms into Actionable Signals
- Getting per-resource alarm notifications with Amazon CloudWatch
- Improve monitoring efficiency using Amazon CloudWatch Composite Alarms
- Use EventBridge to create CloudWatch alarm with custom responses
- Introducing payload-based message filtering for Amazon SNS
- New Cost Optimization Hub centralizes recommended actions to save you money
- Measuring Cloud Cost Efficiency with the New Cost efficiency metric by AWS
- re:Invent 2025 hidden CFM announcements guide
Videos
- AWS re:Invent 2025 - What’s New with AWS Cost Management (COP203)
- AWS re:Invent 2025 - What’s new in AWS cost Optimization (COP202)
- Getting Started with AWS Cost Optimization Hub
- AWS re:Invent 2025 - Advanced analytics with AWS Cost and Usage Reports (COP401)
- AWS re:Invent 2025 - Version lifecycle management at scale with AWS Health (SPS326)
- AWS re:Invent 2024 - Event-driven architectures at scale: Manage millions of events (API307)
Module 6: Operating Secure and Resilient Networks
Websites
- Control subnet traffic with network access control lists - Amazon Virtual Private Cloud
- Amazon VPC quotas - Amazon Virtual Private Cloud
- Security group rules for different use cases - Amazon Elastic Compute Cloud
- Announcing Support for Inter-Region VPC Peering - AWS
- AWS Site-to-Site VPN
- Network Gateway – AWS Transit Gateway – Amazon Web Services
- AWS PrivateLink concepts - Amazon Virtual Private Cloud
- What is Route 53 VPC Resolver? - Amazon Route 53
- Logging IP traffic using VPC Flow Logs - Amazon Virtual Private Cloud
- How Reachability Analyzer works - Amazon Virtual Private Cloud
- What is Amazon CloudFront? - Amazon CloudFront
- How CloudFront delivers content - Amazon CloudFront
- Manage how long content stays in the cache (expiration) - Amazon CloudFront
- Invalidate files to remove content - Amazon CloudFront
- Use file versioning to update or remove content with a CloudFront distribution - Amazon CloudFront
- Resources that you can protect with AWS WAF - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network
- How AWS WAF works - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director
- AWS Managed Rules rule groups list - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security
- Specifying Origin Values
- AWS WAF Rules
- Planning to Use AWS Certificate Manager Private Certificate Authority
- Amazon VPC Overview
- Amazon CloudFront Overview
- AWS WAF Overview
- AWS Certificate Manager Overview
- What is AWS Global Accelerator?
- What is AWS Network Firewall?
- Using DNS Firewall to filter outbound DNS traffic
- Working with the updated console experience - AWS WAF
- AWS Shield
- What is AWS Certificate Manager?
- What is AWS Private CA?
- What is VPC peering?
Blog posts
- Introducing the new console experience for AWS WAF
- Protect against advanced DNS threats with Amazon Route 53 Resolver DNS Firewall
- Choosing the right inspection architecture for AWS Network Firewall
- Introducing Route 53 Resolved IP Validation for AWS Network Firewall
- Prevent data exfiltration: AWS egress controls for cloud workloads
- Using VPC Reachability Analyzer to discover network paths across multiple AWS Regions
- Simplify VPC Flow Logs with EC2 resource tags and next-hop metadata
- Maximising application resiliency with AWS Global Accelerator
Videos
- AWS re:Invent 2025 - AWS Networking Fundamentals: Connect, secure and scale (NET208)
- AWS re:Invent 2025 - Advanced VPC design and new capabilities (NET340)
- AWS re:Invent 2025 - Innovations in Infrastructure Protection to strengthen your network (SEC310)
- AWS re:Invent 2025 - Robust network security with perimeter protection and zero trust (NET326)
- AWS re:Invent 2025 - A day in the life of an AWS WAF administrator (NET317)
- AWS re:Inforce 2025-Simplify AWS WAF and Amazon CloudFront Security for Faster Deployment-NIS203-NEW (AWS Events)
Module 7: Configure Highly Available Systems
Websites
- Network Traffic Distribution – Elastic Load Balancing – Amazon Web Services
- What is an Application Load Balancer? - Elastic Load Balancing
- Health checks for Application Load Balancer target groups - Elastic Load Balancing
- Health checks for the instances for your Classic Load Balancer - Elastic Load Balancing
- Health checks for Gateway Load Balancer target groups - Elastic Load Balancing
- Health checks for Network Load Balancer target groups - Elastic Load Balancing
- CloudWatch metrics for your Application Load Balancer - Elastic Load Balancing
- CloudWatch metrics for your Gateway Load Balancer - Elastic Load Balancing
- CloudWatch metrics for your Network Load Balancer - Elastic Load Balancing
- Access logs for your Application Load Balancer - Elastic Load Balancing
- Routing traffic to an ELB load balancer - Amazon Route 53
- Values that you specify when you create or update health checks - Amazon Route 53
- Public DNS query logging - Amazon Route 53
- Resolver query logging - Amazon Route 53
- Plan for Disaster Recovery (DR) - Reliability Pillar
- Troubleshoot your Application Load Balancers - Elastic Load Balancing
- Amazon Elastic Load Balancing (ELB) Overview
- Amazon Route 53 Overview
- Disaster Recovery of Workloads on AWS: Recovery in the Cloud
- What is AWS Resilience Hub?
- What is AWS Fault Injection Service?
- Choosing a routing policy - Amazon Route 53
- Best practices for Amazon Route 53 health checks
- What is ARC? - Amazon Application Recovery Controller (ARC)
Blog posts
- Disaster Recovery (DR) Architecture on AWS, Part I: Strategies for Recovery in the Cloud
- Disaster Recovery (DR) Architecture on AWS, Part III: Pilot Light and Warm Standby
- Introducing the next generation of AWS Resilience Hub for generative AI-based SRE resilience journey
- Recommended resilience testing in the next generation of AWS Resilience Hub
- Using load balancer target group health thresholds to improve availability
- Choosing the right health check with Elastic Load Balancing and EC2 Auto Scaling
- Announcing Amazon Route 53 Accelerated Recovery for managing public DNS records
- Analyze Application Load Balancer Logs with Amazon CloudWatch Logs
Videos
- AWS re:Invent 2025 - Global Resilient Apps: Guide to Multi-AZ/Region Architecture with ELB (NET311)
- AWS re:Invent 2025 - Deep dive: The evolution of AWS load balancing and new capabilities (NET334)
- AWS re:Invent 2025 - Resilience of AWS Cloud: Design patterns for availability (ARC310)
- AWS re:Invent 2025 - AI-powered resilience testing and disaster recovery (COP420)
- AWS re:Invent 2025 - Building resilient multi-Region applications with Capital One (ARC404)
Module 8: Deploying and Scaling Compute Resources
Websites
- Amazon Machine Images in Amazon EC2 - Amazon Elastic Compute Cloud
- Run user data after the initial launch of an EC2 instance - AWS re:Post
- Use the EC2Launch v1 agent to perform tasks during EC2 Windows instance launch - Amazon Elastic Compute Cloud
- Create an Amazon EBS-backed AMI - Amazon Elastic Compute Cloud
- VM Import/Export
- Image Builder Tool - EC2 Image Builder - AWS
- What is Amazon EC2 Auto Scaling? - Amazon EC2 Auto Scaling
- Get started with Amazon EC2 Auto Scaling - Amazon EC2 Auto Scaling
- Store instance launch parameters in Amazon EC2 launch templates - Amazon Elastic Compute Cloud
- Auto Scaling launch templates - Amazon EC2 Auto Scaling
- Auto Scaling groups - Amazon EC2 Auto Scaling
- Use Elastic Load Balancing to distribute incoming application traffic in your Auto Scaling group - Amazon EC2 Auto Scali
- Status checks for Amazon EC2 instances - Amazon Elastic Compute Cloud
- Health checks for instances in an Auto Scaling group - Amazon EC2 Auto Scaling
- Step and simple scaling policies for Amazon EC2 Auto Scaling - Amazon EC2 Auto Scaling
- Target tracking scaling policies for Amazon EC2 Auto Scaling - Amazon EC2 Auto Scaling
- Control which Auto Scaling instances terminate during scale in - Amazon EC2 Auto Scaling
- Scaling cooldowns for Amazon EC2 Auto Scaling - Amazon EC2 Auto Scaling
- Troubleshoot Amazon EC2 Auto Scaling: AMI issues - Amazon EC2 Auto Scaling
- Copying an AMI
- Retrieving Instance Metadata
- Amazon EC2 Overview
- Apache JMeter
- Spot Fleet
- Launching Spot Instances in an Auto Scaling Group
- Purchase Options for Auto Scaling Groups
- Mapping Licenses to Rules
- Amazon EC2 Auto Scaling Overview
- AWS License Manager Overview
- Predictive scaling for Amazon EC2 Auto Scaling
- Scheduled scaling for Amazon EC2 Auto Scaling
- What is Image Builder?
- Automatically scale your Amazon ECS service
- Monitor Amazon ECS containers using Container Insights with enhanced observability
- Troubleshoot unhealthy instances in Amazon EC2 Auto Scaling
Blog posts
- Streamlining AMI creation with EC2 Image Builder components in AWS Marketplace
- Faster scaling with Amazon EC2 Auto Scaling Target Tracking
- Adopt Recommendations and Monitor Predictive Scaling for Optimal Compute Capacity
- Introducing instance maintenance policy for Amazon EC2 Auto Scaling
- Optimize compute resources on Amazon ECS with Predictive Scaling
- Amazon ECS introduces new high-resolution metrics for faster service auto scaling
- Choosing between Amazon ECS Blue/Green Native or AWS CodeDeploy in AWS CDK
Videos
- AWS re:Invent 2025 - Managing Amazon EC2 capacity and availability (CMP331)
- AWS re:Invent 2025 - Navigate cloud compute with Fargate and ECS Managed Instances (CNS342)
- AWS re:Invent 2025 - Deep Dive: ECS Managed Instances & Blue/Green for Resilient Services (CNS416)
- AWS re:Invent 2024 - Deployment best practices for reliable rollouts using Amazon ECS (SVS340)
- AWS re:Invent 2024 - Enhancing observability in Amazon ECS to gain actionable insights (SVS328)
- Amazon CloudWatch Container Insights - Enhanced observability on ECS
Module 9: Optimizing Compute for Performance and Cost
Websites
- What is AWS Compute Optimizer? - AWS Compute Optimizer
- Viewing resource recommendations - AWS Compute Optimizer
- Optimizing your cost with rightsizing recommendations - AWS Cost Management
- Cost optimization - AWS Support
- Spot Instances - Amazon Elastic Compute Cloud
- Accessing reservation recommendations - AWS Cost Management
- Understanding Savings Plans recommendations - Savings Plans
- Self-managed licenses in License Manager - AWS License Manager
- Trusted Advisor Check Reference
- Viewing the Compute Optimizer Dashboard
- AWS Trusted Advisor Overview
- AWS Compute Optimizer Overview
- Best practices for Amazon EC2 Spot
- Spot Instance interruptions
- Deciding which Savings Plans to purchase
- What is AWS License Manager?
Blog posts
- Discover and Compare EC2 Instance Types
- Optimize EC2 costs with AWS Compute Optimizer right sizing
- Optimize Your AWS Spend with New Cost Savings Features in AWS Trusted Advisor
- Best practices for handling EC2 Spot Instance interruptions
- Announcing Savings Plans Purchase Analyzer
- Introducing Target Coverage in Savings Plans Purchase Analyzer
- End Manual License Tracking with AWS License Manager
- Gain organization-wide visibility into software licensing with AWS License Manager license asset groups
Videos
- AWS re:Invent 2025 - How well do you know EC2? (CMP356)
- AWS re:Invent 2024 - Win-win: Maximize Amazon EC2 savings while improving performance (CMP214)
- AWS re:Invent 2025 - Enterprise software licensing and optimization on AWS (MAM315)
- New Cost Trusted Advisor Checks - The Keys to AWS Optimization - S13 E7 (AWS Events)
Module 10: Managing Storage Resources
Websites
- Instance store temporary block storage for EC2 instances - Amazon Elastic Compute Cloud
- Understand the difference between instance store and EBS volume - AWS re:Post
- Attach an EBS volume to multiple EC2 instances using Multi-Attach - Amazon EBS
- Amazon EBS volume types - Amazon EBS
- Create an Amazon EBS volume - Amazon EBS
- Amazon EBS volume status checks - Amazon EBS
- Amazon CloudWatch metrics for Amazon EBS - Amazon EBS
- Automate backups with Amazon Data Lifecycle Manager - Amazon EBS
- Replicating objects within and across Regions - Amazon Simple Storage Service
- Blocking public access to your Amazon S3 storage - Amazon Simple Storage Service
- Reviewing bucket access using IAM Access Analyzer for S3 - Amazon Simple Storage Service
- Amazon S3 Event Notifications - Amazon Simple Storage Service
- Object Storage Classes – Amazon S3
- Transitioning objects using Amazon S3 Lifecycle - Amazon Simple Storage Service
- Using Network File System to mount EFS file systems - Amazon Elastic File System
- Help Me Choose An Amazon FSx File System - Amazon Web Services
- What is Amazon FSx for Lustre? - FSx for Lustre
- What is Amazon FSx for NetApp ONTAP? - FSx for ONTAP
- What is Amazon FSx for OpenZFS? - FSx for OpenZFS
- What is FSx for Windows File Server? - Amazon FSx for Windows File Server
- Hybrid data protection for VMware – AWS Backup – Amazon Web Services
- Create a backup plan - AWS Backup
- Storage-Optimized Instances
- General Purpose SSD Volumes
- Using EBS Volumes
- Requesting EBS Volume Modifications
- Recognizing Expanded Volumes on Linux
- Configuring RAID
- EBS Multi-Attach Now Available
- Copying an EBS Snapshot
- Archiving EBS Snapshots
- AWS Backup Overview
- Amazon Elastic File System (EFS) Overview
- Amazon FSx
- Amazon FSx for Lustre
- S3 Server Access Log Format
- S3 Express One Zone
- Managing Object Lifecycles
- Restoring Objects: Retrieval Options
- Amazon S3 Overview
- Working with Amazon S3 Files
- Configuring fast, secure file transfers using Amazon S3 Transfer Acceleration
- Uploading and copying objects using multipart upload in Amazon S3
- Retaining multiple versions of objects with S3 Versioning
- Managing storage lifecycle - Amazon Elastic File System
- Backup vaults - AWS Backup
Blog posts
- New Amazon S3 Express One Zone Storage Class
- Launching S3 Files, making S3 buckets accessible as file systems
- Uploading large objects to Amazon S3 using multipart upload and transfer acceleration
- Applying Amazon S3 Object Lock at scale for petabytes of existing data
- Troubleshoot Amazon EBS performance issues on EC2
- Simple and comprehensive data protection with Amazon Data Lifecycle Manager
- Optimize your storage costs for rarely-accessed files with Amazon EFS Archive
- AWS Backup 2025 year in review: advancing recovery resilience
Videos
- Amazon S3 Files - Access your S3 buckets as file systems
- AWS re:Invent 2025 - What’s new with Amazon S3 (STG206)
- AWS re:Invent 2025 - Amazon S3 performance: Architecture, design, and optimization (STG335)
- AWS re:Invent 2025 - What’s new with Amazon EBS (STG202)
- AWS re:Invent 2025 - What’s new with AWS File Storage (STG203)
- AWS re:Invent 2025 - Protect your data with AWS Backup: overview, use cases and what’s new (STG207)
Module 11: Operating Resilient Databases
Websites
- What is a NoSQL Database? - Nonrelational Databases Explained - AWS
- What is a Relational Database? – Amazon Web Services (AWS)
- Multi-AZ DB instance deployments for Amazon RDS
- Multi-AZ DB cluster deployments for Amazon RDS
- Working with DB instance read replicas
- Amazon RDS Proxy
- Restoring a DB instance to a specified time for Amazon RDS
- Backup and restore for DynamoDB
- ElastiCache best practices and caching strategies
- Caching Best Practices
Blog posts
- Choose the right Amazon RDS deployment option: Single-AZ instance, Multi-AZ instance, or Multi-AZ database cluster
- Amazon RDS Multi-AZ with two readable standbys: Under the hood
- Using RDS Proxy with Amazon RDS Multi-AZ DB instance deployment to improve planned failover time
- Understanding the differences between PgBouncer and Amazon RDS Proxy for PostgreSQL connection pooling
- Get started with Amazon ElastiCache for Valkey
- Backup strategies for Amazon DynamoDB
- Announcing configurable point-in-time recovery periods for Amazon DynamoDB
- AWS purpose-built database recovery: A guide to business continuity and disaster recovery strategies
Videos
- AWS re:Invent 2025 - Boost performance and reduce costs in Amazon Aurora and Amazon RDS (DAT312)
- AWS re:Invent 2025 - Advanced data modeling for Amazon ElastiCache (DAT438)
- AWS re:Invent 2025 - Scaling MONOPOLY GO! to millions with DynamoDB & ElastiCache (DAT324)
- AWS re:Invent 2025 - DynamoDB: Resilience & lessons from the Oct 2025 service disruption (DAT453)
Module 12: Automate Resource Deployment
Websites
- RollbackConfiguration - AWS CloudFormation
- Continue rolling back an update - AWS CloudFormation
- CloudFormation template Resources syntax - AWS CloudFormation
- AWS resource and property types reference - AWS CloudFormation
- Fn::GetAtt - AWS CloudFormation
- Ref - AWS CloudFormation
- Intrinsic function reference - AWS CloudFormation
- CloudFormation template Parameters syntax - AWS CloudFormation
- Get AWS values using pseudo parameters - AWS CloudFormation
- CloudFormation template Mappings syntax - AWS CloudFormation
- cfn-init - AWS CloudFormation
- Bootstrapping Windows-based CloudFormation stacks - AWS CloudFormation
- Deploy applications on Amazon EC2 - AWS CloudFormation
- What is AWS CloudFormation Guard? - AWS CloudFormation Guard
- Writing AWS CloudFormation Guard rules - AWS CloudFormation Guard
- Guard Hooks - CloudFormation
- GitHub - aws-cloudformation/cfn-lint: CloudFormation Linter · GitHub
- What Is Service Catalog? - AWS Service Catalog
- Troubleshooting CloudFormation - AWS CloudFormation
- create-stack - AWS CLI Command Reference
- continue-update-rollback - AWS CLI Command Reference
- What is the AWS CDK? - AWS Cloud Development Kit (AWS CDK) v2
- AWS Construct Library - AWS CDK Reference
- AWS Solutions Constructs
- CloudFormation best practices - AWS CloudFormation
- Get exported outputs from a deployed CloudFormation stack - AWS CloudFormation
- Managing stacks across accounts and Regions with StackSets - AWS CloudFormation
- Logging CloudFormation API calls with AWS CloudTrail - AWS CloudFormation
- Prevent updates to stack resources - AWS CloudFormation
- Update a CloudFormation stack - AWS CloudFormation
- Update CloudFormation stacks using change sets - AWS CloudFormation
- AWS CloudFormation Overview
- Using the AWS CloudFormation Editor
- Detecting Unmanaged Configuration Changes to Stacks and Resources
- AWS CloudFormation Helper Scripts Reference
- cfn-signal
- SignalResource
- CreationPolicy Attribute
- AWS Service Catalog
- AWS CDK Constructs
- Deploying AWS CDK applications
- Best practices for developing and deploying cloud infrastructure with the AWS CDK
- Detect unmanaged configuration changes to stacks and resources with drift detection
- Using drift-aware change sets
Blog posts
- AWS CloudFormation 2025 Year In Review
- Safely Handle Configuration Drift with CloudFormation Drift-Aware Change Sets
- Accelerate infrastructure development with CloudFormation pre-deployment validation and simplified troubleshooting
- How CloudFormation express mode accelerates your development cycle
- Moeve: Controlling resource deployment at scale with AWS CloudFormation Guard Hooks
- Accelerating development with AWS CDK plugin – CfnGuardValidator
- Announcing AWS CDK Mixins: Composable Abstractions for AWS Resources
Videos
- AWS re:Invent 2025 - AWS infrastructure as code: A year in review (DVT203)
- AWS re:Invent 2025 - From Reactive to Proactive: Infrastructure governance by design (COP352)
- AWS re:Invent 2024 - Governance and security with infrastructure as code (DOP203)
- AWS re:Invent 2024 - How to choose between AWS CloudFormation, Terraform, and AWS CDK (DEV309)
- AWS re:Inforce 2025 - Coding for proactive controls with AWS CloudFormation (GRC441) (AWS Events)
- Infrastructure as Code for Beginners (AWS CDK) (AWS Developers)
Module 13: Manage Resources
Websites
- Managing EC2 instances automatically with Default Host Management Configuration - AWS Systems Manager
- Improve the security of EC2 instances by using VPC endpoints for Systems Manager - AWS Systems Manager
- Create the IAM service role required for Systems Manager in hybrid and multicloud environments - AWS Systems Manager
- Managing EC2 instances with Systems Manager - AWS Systems Manager
- AWS Systems Manager Explorer - AWS Systems Manager
- AWS Systems Manager OpsCenter - AWS Systems Manager
- What is AWS AppConfig? - AWS AppConfig
- AWS KMS encryption for AWS Systems Manager Parameter Store SecureString parameters - AWS Systems Manager
- Run an automation that requires approvals - AWS Systems Manager
- Systems Manager Automation Runbook Reference - AWS Systems Manager Automation Runbook Reference
- Systems Manager Automation actions reference - AWS Systems Manager
- AWS Systems Manager Maintenance Windows - AWS Systems Manager
- AWS Systems Manager Run Command - AWS Systems Manager
- AWS Systems Manager State Manager - AWS Systems Manager
- AWS Systems Manager Patch Manager - AWS Systems Manager
- How patches are installed - AWS Systems Manager
- AWS Systems Manager Compliance - AWS Systems Manager
- Troubleshooting Systems Manager Automation - AWS Systems Manager
- What Is AWS Systems Manager Incident Manager?
- Application Manager
- Public Parameters
- Systems Manager Documents
- AWS Key Management Service (KMS) Overview
- What is the unified console? - AWS Systems Manager
- AWS Systems Manager Fleet Manager
- Patch policy configurations in Quick Setup
- Working with patch compliance reports
- Get a plaintext value from Systems Manager Parameter Store - AWS CloudFormation
- Troubleshooting managed node availability
Blog posts
- Introducing a new experience for AWS Systems Manager
- Build a Multi Account Patch Compliance Dashboard with Kiro Specs
- Automate Systems Manager patching reports via email and Slack notifications in an AWS Organization
- Autonomous Root Cause Analysis for AWS Systems Manager Patch Failures Using AWS DevOps Agent
- AWS Systems Manager Run Command now supports interpolating parameters into environment variables
- Use AWS Systems Manager Automation runbooks to resolve Elastic Block Store related operational tasks
- Automate installing AWS Systems Manager agent on unmanaged Amazon EC2 nodes
- Centralized monitoring and alerting for AWS Systems Manager Agent status on managed nodes across AWS Organization
Videos
- AWS re:Invent 2024- Scaling IT with the next generation of AWS Systems Manager (COP380-NEW)
- AWS re:Invent 2025 - Centralize Multicloud Management using AWS (COP342)
- AWS re:Invent 2025 - Building custom agents for intelligent AWS patch automation (COP407)
- AWS re:Invent 2025 - Advanced feature flags: Faster releases and rapid recovery (DEV320)
- Create Automation Runbooks with AWS Systems Manager
- Automate Patching with AWS Systems Manager Quick Setup Patch Policy
Module 14: Security and System Auditing
Websites
- Using AWS KMS encryption with AWS services - AWS Key Management Service
- Key management best practices for AWS KMS - AWS Prescriptive Guidance
- Default key policy - AWS Key Management Service
- Using AWS Identity and Access Management Access Analyzer - AWS Identity and Access Management
- Creating a trail with the CloudTrail console - AWS CloudTrail
- Create a table for CloudTrail logs in Athena using manual partitioning - Amazon Athena
- Supported Resource Types for AWS Config - AWS Config
- Multi-Account Multi-Region Data Aggregation for AWS Config - AWS Config
- AWS Config Managed Rules - AWS Config
- What are Security Hub and Security Hub CSPM? - AWS Security Hub
- Automations in Security Hub - AWS Security Hub
- Detection and Response on AWS - Amazon Web Services
- Understanding Amazon Inspector findings - Amazon Inspector
- Troubleshoot failed remediation actions in AWS Config - AWS re:Post
- IAM Access Analyzer Findings
- Supported SerDe Libraries in Amazon Athena
- AWS CloudTrail Overview
- Amazon Athena Overview
- Amazon GuardDuty Overview
- AWS KMS cryptography essentials
- Rotate AWS KMS keys
- Rotate AWS Secrets Manager secrets
- Referencing AWS Secrets Manager secrets from Parameter Store parameters
- Conformance Packs for AWS Config
- Introduction - AWS Security Agent (now part of AWS Continuum)
Blog posts
- How to securely provide database credentials to Lambda functions by using AWS Secrets Manager - AWS Security Blog
- Analyzing Data in S3 using Amazon Athena - AWS Big Data Blog
- How to use on-demand rotation for AWS KMS imported keys
- AWS Secrets Manager launches Managed External Secrets for Third-Party Credentials
- Verify internal access to critical AWS resources with new IAM Access Analyzer capabilities
- Streamline compliance management with AWS Config custom rules and conformance packs
- AWS Security Hub now generally available with near real-time analytics and risk prioritization
- Streamline security response at scale with AWS Security Hub automation
- AWS Security Agent on-demand penetration testing now generally available
- Introducing AWS Continuum: Security at machine speed
Videos
- AWS re:Invent 2025 - KMS over the decade: How architecture evolved to earn customer trust-SEC218
- AWS re:Invent 2025 - Modern Secrets: A Journey from Legacy Systems to AI-Ready Security (SEC213)
- Back to Basics: Using AWS Config and Conformance Packs to Optimize Your AWS Resources
- AWS re:Invent 2025 - AWS Security Hub: Unifying & simplifying security operations at scale (SEC228)
- AWS re:Invent 2025 - Detect and stop malware threats using Amazon GuardDuty (SEC350)
- AWS re:Invent 2025 - AWS Security Agent: Proactive AppSec from Design to Deployment (SEC348)
Module 15: Incident Response and Automated Remediation
Websites
- Incident response - Security Pillar
- Remediating Noncompliant Resources with AWS Config - AWS Config
- About AWS DevOps Agent - AWS DevOps Agent
- Autonomous incident response - AWS DevOps Agent
- Remediating Amazon GuardDuty Findings
- Frontier agent – AWS DevOps Agent – AWS
- Getting started with AWS DevOps Agent - AWS DevOps Agent
- Invoking DevOps Agent through Webhook - AWS DevOps Agent
- Integrating AWS DevOps Agent with Amazon EventBridge - AWS DevOps Agent
- Reviewing investigations - AWS DevOps Agent
- AWS Systems Manager Automation - AWS Systems Manager
Blog posts
- Announcing General Availability of AWS DevOps Agent
- Leverage Agentic AI for Autonomous Incident Response with AWS DevOps Agent
- How AWS DevOps Agent uses multi-agent reasoning to find root causes
- How do I automatically trigger AWS DevOps Agent investigations from CloudWatch Alarms and EventBridge rules for ECS tasks?
- Integrate AWS DevOps Agent with third-party tools using Amazon EventBridge
- Manage Custom AWS Config Rules with Remediation Using AWS Config Conformance Pack
- Remediate noncompliant AWS Config rules with AWS Systems Manager Automation runbooks
- How to perform automated incident response in a multi-account environment
Videos
- AWS re:Invent 2025 - Move beyond reactive: Transform cloud ops with AWS DevOps Agent (COP362)
- Introducing AWS DevOps Agent
- Incident Investigation with AWS DevOps Agent - AWS Tech Tales (AWS Events)
- AWS re:Invent 2025 - Accelerating incident response through AIOps (COP334)
- AWS re:Invent 2025 - The incident is over: Now what? (COP216)
Module 16: Course Wrap-up
Websites
- AWS Skill Builder
- AWS Classroom training
- AWS Certification
- AWS Certified CloudOps Engineer - Associate
- AWS Certification exam preparation
- AWS Certification exams
- AWS Recertification
- Schedule an Exam
- AWS Ramp-Up Guides
- AWS Workshops
- AWS Training and Certification contact form
Courses
- AWS Technical Essentials
- Architecting on AWS
- DevOps Engineering on AWS
- Security Engineering on AWS
- Networking Essentials for Cloud Applications on AWS
- Designing and Implementing Storage on AWS
- AWS Well-Architected Best Practices
- AWS Skill Builder courses
- AWS Builder Labs