AWS Developer Associate (DVA-C02)

This deck is designed to help you prepare for the AWS Developer Associate certification by drilling down on the core services and concepts that show up most often on the exam. The cards walk you through foundational topics like the shared responsibility model, IAM users and roles, policies, and STS temporary credentials, then move into monitoring and observability with CloudWatch and CloudTrail. You'll also revisit practical developer scenarios such as granting an EC2 instance or Lambda function permission to call AWS APIs without hard-coding keys.

It's a great fit if you're a developer or cloud practitioner who already has some hands-on experience with AWS and wants a focused way to check your knowledge before sitting the exam. The questions are phrased in an exam-style format, so you'll get used to recognizing the kinds of prompts and distractor answers you'll face on test day. Even if you're not pursuing certification, anyone building applications on AWS will benefit from a sharper understanding of identity, permissions, and monitoring.

To get the most out of these flashcards, try to explain each answer to yourself in your own words before moving to the next card, rather than just reading and flipping. Spacing your review sessions across several days, instead of cramming, will help the distinctions between similar services, such as the difference between managed and inline policies or between CloudTrail and CloudWatch, really stick. Pay extra attention to the "why" behind each recommendation, since the exam often rewards understanding AWS best practices over rote memorization.

The AWS shared responsibility model defines the division of security responsibilities between AWS and the customer. AWS is responsible for the security OF the cloud, covering physical infrastructure, hardware, regions, and the services themselves. The customer is responsible for security IN the cloud, which includes protecting data, configuring IAM, patching operating systems on EC2, configuring network firewalls, and managing encryption. The exact division depends on the service: with EC2 the customer patches the guest OS, but with fully managed services such as S3 or DynamoDB, AWS handles the operating system and infrastructure while the customer still owns data, access policies, and encryption settings.

To evaluate whether architectures follow best practices, AWS provides the Well-Architected Framework. It is built on five pillars: Operational Excellence, Security, Reliability, Performance Efficiency, and Cost Optimization, with Sustainability later added as a sixth. Workloads reviewed against this framework identify risks and improvements.

The AWS Well-Architected Tool is a free console service that helps apply the framework to your own workloads, track identified risks, and benchmark against industry standards. Combined with awareness of the shared responsibility model, these two resources form the baseline for any developer working on AWS, ensuring that operational and security responsibilities are correctly assigned regardless of which services are used.

Identity in AWS is managed primarily through IAM, which supports two principal identity types. An IAM user is a permanent identity with long-lived credentials, while an IAM role is an identity with no long-lived credentials that is assumed temporarily by users, services, or external identities to obtain short-lived STS tokens. AWS STS, the Security Token Service, issues those temporary credentials (access key, secret key, session token) for federated identities, assumed roles, or cross-account access. STS credentials can last from 15 minutes up to 12 hours, the absolute session duration hard cap, governed by the role's MaxSessionDuration.

Permissions in IAM are expressed through policies. A managed policy is a standalone, reusable policy that can be attached to many identities, while an inline policy is embedded in a single identity and removed when that identity is deleted. Managed policies attached to users and groups can be up to 5,120 characters, inline user policies up to 2,048 characters, and inline role policies up to 10,240 characters, with service-specific quotas also applying.

For workloads running on AWS you avoid embedding long-lived keys in code. An EC2 instance gets AWS API permissions by attaching an IAM instance profile, a container for an IAM role, so the SDK or CLI can automatically retrieve credentials from IMDS on the instance. Lambda functions obtain permissions via an attached IAM execution role, and Lambda automatically populates environment variables such as AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN.

Beyond IAM identities, applications that need user sign-in and federation use Amazon Cognito. User Pools are user directories that handle sign-up, sign-in, MFA, and social identity providers and return JWT tokens. Identity Pools exchange those tokens, or tokens from other IdPs, for AWS STS temporary credentials so that applications can access AWS resources directly. Access to S3 can also be granted through resource-based S3 bucket policies, which, unlike identity-based IAM policies, can be used for cross-account access and for public or anonymous principals.

The foundational compute service is EC2, whose instance types are grouped by workload into families such as General Purpose (M, T), Compute Optimized (C), Memory Optimized (R, X), Storage Optimized (I, D), Accelerated Computing (P, G, F), and HPC Optimized (H). To launch an EC2 instance you need an AMI, an instance type, a VPC with a subnet, a security group, an IAM role or credentials, and optionally a key pair and an EBS volume. Where instances are placed is controlled by placement groups: cluster placement groups give the lowest latency in a single AZ, spread groups place instances on distinct hardware (up to 7 per AZ), and partition groups separate instances by rack (up to 7 partitions per AZ), useful for Hadoop and Kafka workloads.

A few lifecycle features help with EC2 operations. EC2 user data lets you pass a bootstrap script that runs on first boot (limited to 16 KB), and is useful for installing software and registering with services. Instance metadata, accessible at the IMDS endpoint 169.254.169.254, exposes instance-specific data including IAM role credentials, and IMDSv2 tightens security by requiring a session-token PUT before any metadata request, mitigating SSRF attacks. Hibernation persists RAM contents to the EBS root volume and lets you skip cold starts when re-launching.

EC2 instances are auto-managed through Auto Scaling groups that define min, max, and desired capacity. Target tracking scaling, the recommended policy type, adjusts capacity to keep a chosen CloudWatch metric such as CPUUtilization near a target value. Configuration is captured in an EC2 launch template, which holds AMI, instance type, key pair, security groups, IAM instance profile, user data, tags, and market options, can have multiple versions, and is the source of truth for Auto Scaling groups and Spot Fleets.

For containers, AWS provides ECS, EKS, and Fargate. ECS is a fully managed Docker orchestrator with EC2 (you manage the instances) and Fargate (serverless) launch types. EKS is managed Kubernetes where AWS runs the control plane across AZs and you supply EC2 or Fargate worker nodes. Fargate itself is the serverless compute engine for both ECS and EKS, charging per vCPU and GB-hour and removing infrastructure management entirely. A typical CI/CD pipeline on AWS is built from CodeCommit for source control, CodeBuild for build and test, CodeDeploy for release, and CodePipeline for orchestration, each swappable with third-party tools like GitHub, Jenkins, GitLab, or Spinnaker. CodeDeploy automates application deployments to EC2, ECS, Lambda, and on-premises servers via an appspec.yml file, supporting both in-place and blue/green deployments. A blue/green strategy runs two identical environments side by side, with blue holding the current version and green holding the new, then shifts traffic from blue to green via the ALB, Route 53 weighted records, or DNS, allowing instant rollback. CodePipeline models the release itself: each stage contains actions such as source, build, test, or deploy, can include manual approval steps, and triggers Lambda functions on state changes.

AWS Lambda is the serverless compute layer at the heart of many event-driven workloads. Each invocation runs inside an execution context, a runtime environment that hosts the function code, runtime, environment variables, and any initialized state. When Lambda reuses an execution context across invocations, initialization cost is amortized, but the first invocation against a new context pays a cold start penalty from downloading the code, starting the runtime, and running init code. Provisioned Concurrency, or simply minimizing package size and init logic, mitigates that latency.

Lambda has several hard limits to keep in mind. The deployment package can be up to 50 MB zipped or 250 MB unzipped for direct upload, and up to 4 GB when uploaded into /tmp via an EFS mount, which is how large files are handled. The default and maximum timeout is 900 seconds (15 minutes), so longer workflows should be decomposed, for example using Step Functions. Memory can be configured from 128 MB to 10,240 MB in 1 MB increments, with CPU and network bandwidth scaling linearly with memory. The default account-wide concurrency limit is 1,000 concurrent executions, which can be tuned via reserved concurrency or warmed up on demand via Provisioned Concurrency.

To define and deploy serverless applications, AWS SAM (Serverless Application Model) provides an open-source CloudFormation extension with simplified YAML and JSON syntax for Lambda, API Gateway, DynamoDB, SQS, and similar resources. With sam build and sam deploy, the SAM template is transformed into a standard CloudFormation stack at deploy time. SAM is the typical companion to hand-written CloudFormation for serverless workloads and lets developers express function URLs, event sources, and IAM permissions concisely.

Amazon S3 is the object storage workhorse of AWS. It provides strong read-after-write consistency for all GET, PUT, LIST, and DELETE operations, so applications no longer need to handle eventual consistency for object listings or updates. Files larger than 100 MB should use multipart upload, which splits the object into parts of 5 MB to 5 GB, up to 10,000 parts, enabling parallel uploads, resumability, and objects up to 5 TB. Pre-signed URLs, generated with IAM credentials, grant temporary access to download or upload specific objects and inherit the permissions of the creating principal, with a configurable expiration.

For lifecycle and compliance, S3 versioning keeps multiple variants of objects in the same bucket and cannot be disabled once enabled, only suspended, at which point deletes become reversible delete markers. Lifecycle rules automatically transition objects to other storage classes or expire them based on age, prefix, or tag. Available storage classes include STANDARD, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, GLACIER_INSTANT_RETRIEVAL, GLACIER_FLEXIBLE_RETRIEVAL, GLACIER_DEEP_ARCHIVE, and EXPRESS_ONEZONE, each balancing cost, durability, and retrieval latency. Object Lock enforces WORM semantics through retention periods or legal holds, must be enabled at bucket creation, and complies with SEC 17a-4. Cross-Region Replication (CRR) or Same-Region Replication (SRR) copies new and optionally existing objects to a destination bucket and requires versioning plus an IAM role with s3:Replicate permissions. S3 Transfer Acceleration speeds long-distance uploads and downloads by routing data through CloudFront edge locations onto the AWS backbone.

For cold archives, Amazon S3 Glacier offers retrieval options from minutes (Expedited) to many hours (Bulk), with Glacier Deep Archive providing the lowest cost at the price of 12–48 hour retrieval. Glacier Instant Retrieval is the archive class to reach for when millisecond retrieval is required.

Block and shared file storage are covered by EBS, EFS, and FSx. An EBS volume is durable block storage that attaches to a single EC2 instance in one AZ; snapshots are stored incrementally in S3 and are AZ-independent. For general SSD workloads, gp3 offers a baseline of 3,000 IOPS and 125 MB/s, scalable to 16,000 IOPS and 1,000 MB/s, while io1/io2 provisioned-IOPS volumes are tuned for high-I/O databases and io2 Block Express reaches 256,000 IOPS per volume on Nitro instances. Throughput-optimized st1 and cold sc1 volumes serve throughput and cold HDD needs. Amazon EFS provides a fully managed elastic NFS file system for Linux that scales automatically, while FSx offers managed file systems with options for Windows File Server (SMB), Lustre (HPC), NetApp ONTAP, and OpenZFS.

Every AWS workload runs inside an Amazon VPC, a logically isolated virtual network with a CIDR-defined IP range, subnets, route tables, gateways, and security rules you control. A subnet becomes public by having a route to an Internet Gateway, giving instances public IPs and reachability from the internet. A private subnet has no IGW route, so instances need a NAT Gateway, a managed service in a public subnet, to initiate outbound internet traffic such as updates while preventing unsolicited inbound connections. NAT Gateways are billed per hour plus per GB processed.

Traffic control happens at two layers. Security groups are stateful firewalls attached at the ENI/instance level: default security groups allow all outbound and no inbound traffic, rules can reference other security groups or CIDRs, and return traffic is automatically permitted because of statefulness. Network ACLs (NACLs) sit at the subnet level and are stateless; rules are evaluated by rule number, default NACLs allow all, and return traffic requires explicit rules. Each subnet can belong to only one NACL.

VPC endpoints let you connect privately to AWS services without traversing the public internet. Interface endpoints, powered by AWS PrivateLink, attach elastic network interfaces with private IPs in your VPC and forward traffic to AWS services, other VPCs, or on-premises networks over private connectivity. Gateway endpoints are free and available for S3 and DynamoDB, using a simple route table entry. VPC Flow Logs capture information about IP traffic to and from ENIs in the VPC and are stored in CloudWatch Logs or S3 for troubleshooting, security analysis, and anomaly detection.

In front of compute, AWS provides three load balancers. The Application Load Balancer (ALB) is a Layer 7 balancer that routes HTTP/HTTPS/gRPC traffic by path, host, query string, or header, supports WebSockets, sticky sessions, AWS WAF, OIDC auth, and target groups of EC2, IP, or Lambda. The Network Load Balancer (NLB) is a Layer 4 balancer for TCP/UDP/TLS with ultra-low latency, preserved source IPs, static IPs, and PrivateLink service provider integration. The Classic Load Balancer (CLB) is the legacy generation, and AWS recommends migrating to ALB or NLB. ALB and NLB route requests to target groups, sets of EC2 instances, IPs, Lambdas, or containers that share health checks; sticky sessions bind a user session to a specific target using an application-, duration-, or load-balancer-generated cookie.

At the application edge, Amazon API Gateway creates, publishes, and secures REST, HTTP, and WebSocket APIs. HTTP API is roughly 70% cheaper than REST API, with lower latency and OIDC/OAuth2/JWT/CORS support but fewer features. REST API offers API keys, usage plans, request validation, AWS WAF integration, and request/response transformations. API Gateway throttles requests to protect backends: the default account limit is 10,000 RPS steady-state with 5,000 burst, and per-method or per-stage limits can be set lower, returning HTTP 429 when exceeded. A Lambda authorizer is a function that authenticates and authorizes requests before they reach the backend and caches its policy result for a configurable TTL (default 300 s). Usage plans tie throttling and quota limits to client API keys, tracking usage per key. For GraphQL APIs, AWS AppSync provides a managed service with real-time subscriptions, offline caching, and fine-grained auth via OIDC, Cognito, API keys, or IAM.

For managed NoSQL, DynamoDB offers single-digit millisecond performance with built-in security, backup, and multi-region replication. Its primary keys come in two flavors: a partition key (hash) only, which distributes items across partitions, or a composite primary key combining a partition key with a sort key so items in the same partition are ordered for range queries. A partition holds up to 10 GB and serves up to 3,000 RCUs and 1,000 WCUs; a hot partition occurs when one partition receives disproportionate traffic, often from a skewed key, leading to throttling.

Capacity is metered in RCUs and WCUs. Read capacity units bill as one RCU per strongly consistent read of up to 4 KB, 0.5 RCU for an eventually consistent read of the same size, and 2 RCU for a transactional read, all rounded up to 4 KB. Write capacity units bill as one WCU per standard write of up to 1 KB and 2 WCUs per transactional write of the same size, rounded up to 1 KB. On-demand mode charges per request for unpredictable workloads, while auto scaling adjusts provisioned RCU/WCU within a min/max band to keep a target utilization (default 70%) using Application Auto Scaling.

Indexes extend the table: a Local Secondary Index uses the same partition key as the base table with a different sort key, shares throughput and storage, and must be defined at table creation (10 GB per partition limit). A Global Secondary Index uses its own partition key and optional sort key, has its own provisioned or on-demand throughput, can be added or modified after table creation, and is not constrained to 10 GB per partition. DynamoDB transactions provide ACID guarantees across up to 100 items in one or more tables in a single account and region through TransactGetItems and TransactWriteItems, doubling WCU/RCU. DynamoDB Streams retain item-level changes for 24 hours and trigger Lambda, replication, or materialized views. DynamoDB TTL deletes items whose timestamp attribute has passed at no cost, generally within 48 hours. DynamoDB DAX is a fully managed in-memory cache, API-compatible with DynamoDB, that delivers up to 10x read performance and runs inside a single VPC. DynamoDB Global Tables provide multi-region, multi-active replication with synchronous writes and last-writer-wins conflict resolution.

For messaging, Amazon SNS provides pub/sub fan-out to SQS queues, Lambda functions, HTTP/S endpoints, email, SMS, and mobile push, with no message retention. Amazon SQS provides durable message queues with retention up to 14 days (default 4 days), consumers that poll for messages, and both standard queues (best-effort ordering, at-least-once delivery, unlimited throughput) and FIFO queues (exactly-once processing, first-in-first-out, 300 messages per second without batching or 3,000 with batching, names must end with .fifo). The visibility timeout (default 30 s, max 12 h) hides a message from other consumers after it is received; if the consumer does not delete the message before expiry, it becomes visible again. The maximum SQS message size is 256 KB, so larger payloads go in S3 and only an S3 reference is sent, following the Amazon SQS Extended Client for Java pattern. A dead-letter queue receives messages that failed processing after the redrive policy's maxReceiveCount is exceeded, and one DLQ can be shared by up to 100 source queues. Long polling, the recommended default, waits up to 20 seconds for messages to arrive, reducing empty ReceiveMessage responses and cost compared to short polling.

Amazon EventBridge is the serverless event bus that ingests events from AWS services, SaaS apps, and custom sources and routes them to targets such as Lambda, SQS, SNS, and Step Functions via rules with event patterns or schedules. It is the evolution of CloudWatch Events, adding a schema registry, archive and replay, cross-account event buses, and third-party SaaS integrations; existing CloudWatch Events accounts continue to work via the default EventBridge bus. AWS Step Functions coordinates multiple AWS services into workflows using state machines defined in Amazon States Language (JSON), with standard workflows for long-running, exactly-once workloads and express workflows for high-volume, at-least-once processing.

For operations and auditing, AWS CloudTrail records every API call in the account, including identity, time, source IP, and request and response details, and stores the events in S3, with optional integration into CloudWatch Logs. CloudWatch, by contrast, focuses on operational telemetry: it collects metrics, logs, and events, ingests log files from EC2, Lambda, VPC Flow Logs, CloudTrail, Route 53, and custom sources, and supports configurable log retention from 1 day to indefinitely. CloudWatch metrics are uniquely identified by namespace, metric name, and dimensions; standard resolution is 1 minute, detailed resolution is 1 second. Standard-resolution metrics are kept for 15 months, with 1-minute data available for the first 15 days and aggregated to 5-minute and 1-hour granularity afterwards, while 1-second detailed metrics expire after 3 hours. A CloudWatch alarm watches a single metric over a period and triggers one or more actions (SNS notification, Auto Scaling, EC2 stop or terminate) when the threshold is crossed for a configured number of evaluation periods. For containerized workloads, CloudWatch Container Insights collects and summarizes metrics and logs from ECS, EKS, Fargate, and Kubernetes. AWS X-Ray adds distributed tracing, capturing traces, segments, and errors with a service map and SDKs for the most common languages.

On the security side, AWS KMS creates and controls customer master keys used to encrypt data across most AWS services, supporting symmetric and asymmetric keys, key policies, aliases, rotation, and cross-account access. The distinction between AWS managed and customer managed CMKs is important: AWS managed CMKs are created and managed by AWS services on your behalf and cannot be manually rotated or shared, while customer managed CMKs are created and managed by you and can be rotated, aliased, and shared across accounts. Envelope encryption, where a data key encrypts the data and a KMS CMK encrypts the data key, reduces KMS API calls and lets you encrypt large payloads efficiently.

Secrets handling is split between AWS Secrets Manager and SSM Parameter Store. Parameter Store, free in its standard tier, holds configuration and secrets, with optional KMS-encrypted SecureString values and versioning. Secrets Manager is paid, designed specifically for secrets, integrates with RDS, Redshift, and DocumentDB, and adds automatic rotation via Lambda and cross-region replication. In front of APIs and web apps, AWS WAF inspects HTTP/S requests for common exploits such as SQL injection, XSS, bad bots, and IP-based rate limiting and attaches to CloudFront, ALB, API Gateway, AppSync, and Cognito User Pools. AWS Shield protects against DDoS attacks: Shield Standard is free for all customers and defends against common network and transport layer attacks, while Shield Advanced adds detection, mitigation, cost protection, and 24/7 access to the DDoS Response Team.

Finally, infrastructure and deployment on AWS are modeled declaratively. AWS CloudFormation provisions resources from JSON or YAML templates and extends to multiple accounts and regions via StackSets, with drift detection, change sets, and nested stacks. SAM is a CloudFormation extension with simplified syntax for serverless resources, transformed into standard CloudFormation at deploy time, while the AWS CDK lets developers define cloud resources in TypeScript, Python, Java, Go, or .NET and synthesize them into CloudFormation templates. With application code, the AWS SDK applies exponential backoff with jitter for retryable errors such as throttling and 5xx responses with a default of 3 retries, and supports automatic pagination via continuation tokens like NextToken, Marker, and NextContinuationToken, exposed as paginators and async iterators. Together, these observability, security, and DevOps tools complete the picture of building, deploying, and operating production applications on AWS.