AWS Architecture Patterns for Deployment and Management – SAP-C02 Study Guide

Purpose of This Lesson

AWS architecture questions often describe an operational requirement and expect you to select the managed service or deployment pattern that best satisfies it. The key is to match each requirement to the service’s native capabilities while minimizing custom automation and operational overhead.

This lesson focuses on six common patterns:

• Secure database credential storage and rotation
• Migrating existing Chef-based infrastructure management
• Running web applications with long-running background tasks
• Standardizing VPC deployments
• Previewing infrastructure changes before execution
• Monitoring and remediating resource configuration compliance

Key Concepts

Secrets Manager for database credentials

Use AWS Secrets Manager when an application needs to retrieve database credentials securely and the credentials must be rotated automatically. Secrets Manager integrates with supported databases, including Amazon Aurora, and can use rotation workflows—typically implemented with AWS Lambda—to change credentials without requiring the application to store them in code or configuration files.

A typical pattern is:

1. Store the database secret in Secrets Manager.
2. Grant the application an IAM role that can retrieve the secret.
3. Configure the application to retrieve the secret at runtime.
4. Enable a rotation schedule, such as monthly rotation.
5. Ensure the application and connection pool handle credential changes correctly.

AWS Systems Manager Parameter Store can securely store parameters and encrypted values, but it does not provide the same native database credential rotation experience as Secrets Manager. With Parameter Store, an organization generally needs to build and operate its own rotation workflow.

Use IAM permissions, resource policies where appropriate, and encryption with AWS Key Management Service (AWS KMS) to protect access to secrets.

AWS OpsWorks for Chef Automate and existing Chef cookbooks

When an organization already uses Chef and wants to reduce migration effort, an OpsWorks for Chef Automate environment historically provided a managed Chef server while allowing teams to continue using existing Chef cookbooks and practices.

This approach can reduce:

• Rewriting of configuration-management code
• Training requirements
• Migration risk
• The effort required to operate the Chef server infrastructure

However, service availability should be verified before selecting this design. AWS has retired or changed availability for some OpsWorks offerings over time, so current implementations may need alternatives such as self-managed Chef, AWS Systems Manager, or another configuration-management platform.

The exam decision point remains: if the requirement explicitly prioritizes reuse of existing Chef cookbooks and a managed Chef control plane, evaluate the relevant OpsWorks for Chef Automate capability or its current replacement.

Elastic Beanstalk web and worker tiers

AWS Elastic Beanstalk can deploy and manage application environments without requiring the team to manually assemble all underlying compute, load balancing, and scaling resources.

For a web application that performs tasks lasting several minutes, separate the synchronous web tier from the asynchronous processing tier:

• Web tier: Receives HTTP requests and returns responses quickly.
• Worker tier: Retrieves queued tasks and performs long-running processing independently.
• Queue: Decouples request handling from background work, commonly using Amazon Simple Queue Service (Amazon SQS).

This design prevents long-running work from consuming web-server connections and improves scalability. The application can accept a request, place a message on the queue, and return an acknowledgement. Worker instances then process the task independently.

A worker tier is preferable to making the web request wait for a multi-minute operation. It also allows the web and worker tiers to scale independently.

CloudFormation for standardized VPC deployments

AWS CloudFormation is appropriate when a systems integrator or platform team must deploy repeatable, standardized infrastructure for many customers.

A CloudFormation template can define resources such as:

• VPCs and subnets
• Route tables and gateways
• Security groups and network ACLs
• IAM roles
• Load balancers and supporting services

Templates reduce configuration drift, manual errors, and inconsistent customer environments. Parameters, mappings, conditions, nested stacks, and stack sets can make a template reusable across accounts, Regions, and customer-specific configurations.

Infrastructure as code also provides a reviewable and auditable representation of the intended environment.

CloudFormation change sets

A CloudFormation change set previews the changes that would result from updating an existing stack. It helps operators review additions, modifications, and deletions before executing the update.

The normal workflow is:

1. Modify the template or stack parameters.
2. Create a change set.
3. Review the proposed resource changes.
4. Reject or revise the change set if necessary.
5. Execute the approved change set.

Creating a change set does not apply the changes. It is a planning and review mechanism, not a transaction simulation. Some effects—such as application behavior, data changes, or impacts outside CloudFormation’s resource model—may not be fully visible in the preview.

AWS Config for compliance monitoring and remediation

AWS Config records resource configuration and evaluates resources against compliance rules. It can assess resources such as S3 buckets, security groups, IAM-related configurations, and many other supported resource types.

A compliance architecture commonly includes:

• AWS Config recording configuration changes
• Config rules evaluating desired state
• Notifications or workflows for noncompliant resources
• Automatic remediation using Systems Manager Automation documents or other approved actions
• IAM permissions that restrict remediation to safe, authorized operations

For example, a rule could identify an overly permissive security group or an S3 bucket that violates an organizational requirement. Automatic remediation can then remove the offending configuration or invoke a controlled repair workflow.

AWS Config is primarily a governance and compliance service. It should be combined with preventive controls—such as service control policies, IAM policies, or infrastructure guardrails—when an organization must prevent a configuration from being created in the first place.

Exam-Relevant Takeaways

• Choose Secrets Manager for managed secret storage and native rotation workflows for supported databases such as Aurora.
• Parameter Store can store secure values but generally requires custom automation for database credential rotation.
• Existing Chef expertise and cookbooks are strong signals to evaluate OpsWorks for Chef Automate, while checking current service availability.
• Use an Elastic Beanstalk worker tier for background tasks that take minutes or otherwise should not block web requests.
• Use CloudFormation to standardize repeatable infrastructure deployments and reduce manual configuration errors.
• Use a CloudFormation change set to preview stack changes before execution.
• Use AWS Config rules to evaluate resource compliance and pair them with automatic remediation when the requirement includes enforcement.
• AWS Config detects and evaluates configuration state; preventive controls may be needed to stop noncompliant changes before they occur.

Architecture Decision Guide

Requirement	Recommended capability	Why
Store Aurora credentials securely and rotate them monthly	AWS Secrets Manager	Purpose-built secret storage with supported rotation workflows
Store encrypted application configuration values	Systems Manager Parameter Store or Secrets Manager	Parameter Store is often sufficient for parameters; Secrets Manager is better for secrets requiring rotation or lifecycle management
Reuse existing Chef cookbooks while moving to AWS	OpsWorks for Chef Automate, subject to current availability	Reduces migration changes and preserves Chef operating practices
Run a web application with multi-minute background jobs	Elastic Beanstalk web and worker tiers, commonly with SQS	Decouples HTTP handling from long-running processing
Deploy the same VPC design for many customers	AWS CloudFormation	Provides repeatable infrastructure as code
Review an update before changing a live stack	CloudFormation change set	Shows the proposed resource-level changes before execution
Monitor resource configuration compliance	AWS Config rules	Continuously evaluates recorded resource configuration
Correct known noncompliant resources automatically	AWS Config remediation with Systems Manager Automation or an approved workflow	Adds an enforcement action after a rule identifies noncompliance

Common Exam Traps

• Confusing Secrets Manager with Parameter Store: Both can hold protected values, but Secrets Manager is the stronger answer when automatic secret rotation is explicitly required.
• Using a web tier for long-running work: A request that takes several minutes should normally be queued and handled asynchronously by workers.
• Assuming CloudFormation change sets execute automatically: A change set only previews the update. It must be explicitly executed.
• Treating CloudFormation as a compliance engine: CloudFormation deploys infrastructure; AWS Config evaluates resource state after deployment and during subsequent changes.
• Assuming AWS Config alone prevents drift: Config can detect noncompliance and trigger remediation, but preventive controls may be required to block changes.
• Ignoring service lifecycle status: Older exam or training material may reference OpsWorks offerings whose current availability has changed. Validate the service before using it in a real architecture.
• Rotating credentials without considering connection pools: Applications may retain old database connections. Rotation design must account for connection refresh and retry behavior.

Real-World Engineer Notes

• Grant applications permission to read only the specific secret they need. Avoid broad permissions such as access to all secrets in an account.
• Use secret version stages and test rotation in a nonproduction environment before enabling it broadly.
• For worker processing, design jobs to be idempotent. A queue message may be delivered more than once, and a worker can fail after partially completing a task.
• Configure dead-letter queues, visibility timeouts, retry behavior, and operational alarms for asynchronous workloads.
• Use CloudFormation parameters and reusable modules carefully. Excessive template complexity can make deployments difficult to review and maintain.
• Treat change-set review as part of a deployment approval process, especially when the change includes resource replacement or deletion.
• Automatic Config remediation should be narrowly scoped and tested. A remediation action that is too aggressive can disrupt production workloads.
• Combine AWS Config with AWS CloudTrail, EventBridge, Security Hub, or centralized governance services when investigation and organization-wide response are required.

Quick Reference Summary

• Secrets Manager: Secrets, database credential retrieval, and automatic rotation.
• Parameter Store: Configuration parameters and encrypted values; custom rotation logic may be required.
• OpsWorks for Chef Automate: Managed Chef experience for organizations using Chef practices; verify current availability.
• Elastic Beanstalk worker tier: Asynchronous processing for long-running application tasks.
• CloudFormation: Repeatable infrastructure deployment through templates.
• CloudFormation change set: Preview stack changes before applying them.
• AWS Config: Configuration history, compliance evaluation, and remediation workflows.

Flashcards

1. Q: Which AWS service is generally preferred for Aurora credentials requiring automatic rotation?

A: AWS Secrets Manager.

1. Q: What is the main limitation of using Parameter Store for database credential rotation?

A: Database credential rotation is not provided in the same native, integrated manner, so custom automation is typically required.

1. Q: Why separate an Elastic Beanstalk web tier from a worker tier?

A: To keep web requests responsive while workers process long-running tasks asynchronously.

1. Q: What service commonly provides the queue between a web tier and worker tier?

A: Amazon SQS.

1. Q: Which service is used to deploy standardized VPC configurations repeatedly?

A: AWS CloudFormation.

1. Q: What does a CloudFormation change set do?

A: It previews the resource changes an update would make before the update is executed.

1. Q: Does creating a change set modify the live stack?

A: No. The change set must be explicitly executed.

1. Q: Which service evaluates AWS resource configuration against compliance rules?

A: AWS Config.

1. Q: How can AWS Config support automatic enforcement?

A: A Config rule can trigger a remediation workflow, commonly using Systems Manager Automation.

1. Q: What additional control may be needed when noncompliant resources must never be created?

A: A preventive control such as an IAM policy, service control policy, or deployment guardrail.

Practice Questions

Question 1

An application connects to Amazon Aurora. Security policy requires that its database password be stored outside the application and rotated automatically every 30 days. Which solution best meets the requirement with the least custom development?

A. Store the password in an encrypted Systems Manager Parameter Store parameter and rotate it with a scheduled Lambda function.

B. Store the password in an Amazon S3 object encrypted with AWS KMS and update it monthly with EventBridge.

C. Store the password in AWS Secrets Manager, grant the application permission to retrieve it, and configure supported rotation.

D. Store the password in an environment variable on the Elastic Beanstalk instances and restart the instances monthly.

Correct answer: C

Explanation: Secrets Manager is designed for secret lifecycle management and supports database credential rotation workflows. The other options require more custom code or expose the credential through less appropriate mechanisms.

Question 2

A web application receives requests that initiate video-processing jobs. Each job can take five minutes. The application must remain responsive while processing capacity scales independently from the web servers. Which architecture is most appropriate?

A. Process each video synchronously on the web instance that receives the request.

B. Use an Elastic Beanstalk web tier to submit jobs to a queue and an Elastic Beanstalk worker tier to process them.

C. Increase the web-tier request timeout to ten minutes and use larger instances.

D. Store jobs in an S3 bucket and require users to poll the bucket directly without worker processes.

Correct answer: B

Explanation: A web and worker-tier design decouples request handling from long-running processing. A queue such as SQS allows the worker tier to scale independently and prevents lengthy jobs from blocking web requests.

Question 3

A systems integrator must deploy the same three-tier VPC architecture for dozens of customers while reducing manual errors. What should the integrator use?

A. Manually documented deployment procedures.

B. A CloudFormation template with parameters for customer-specific values.

C. A CloudFormation change set without a template.

D. AWS Config remediation rules to create all VPC resources.

Correct answer: B

Explanation: CloudFormation templates provide repeatable infrastructure as code. Parameters and conditions can accommodate customer-specific values while preserving a standardized design.

Question 4

An administrator has modified a CloudFormation template and wants to determine whether the update will replace an existing database before applying it. What should the administrator create?

A. An AWS Config conformance pack.

B. A CloudFormation change set.

C. An AWS CloudTrail lookup event.

D. An Elastic Beanstalk application version.

Correct answer: B

Explanation: A CloudFormation change set previews the resource-level effects of an update, including changes that may cause replacement. It does not apply the update until executed.

Question 5

A security team requires that all security groups avoid unrestricted inbound access. The organization wants to identify violations and automatically correct them. Which solution is most appropriate?

A. Use AWS Config rules to evaluate security groups and configure an approved remediation action.

B. Use CloudFormation change sets to monitor all security groups after deployment.

C. Store security group definitions in Secrets Manager and rotate them monthly.

D. Use an Elastic Beanstalk worker tier to inspect security groups without a compliance rule.

Correct answer: A

Explanation: AWS Config can evaluate security group configuration against a rule and trigger remediation for noncompliant resources. Preventive IAM or organization-level controls may also be added if violations must be blocked at creation time.