AWS Deployment and Management Services: CloudFormation, Beanstalk, Config, Secrets, and RAM – SAP-C02 Study Guide

Purpose of This Lesson

AWS deployment and management services address different layers of infrastructure automation, application deployment, configuration governance, secret storage, and cross-account resource sharing. Selecting the correct service depends on whether you need infrastructure as code, a managed application platform, compliance monitoring, secure secret handling, or centralized resource sharing.

This lesson introduces:

• AWS CloudFormation for deploying infrastructure as code.
• AWS Elastic Beanstalk for deploying applications while AWS manages much of the underlying platform.
• AWS Config for recording resource configuration and evaluating compliance.
• AWS Systems Manager Parameter Store and AWS Secrets Manager for storing sensitive or configuration data.
• AWS Resource Access Manager (AWS RAM) for sharing supported resources across AWS accounts.

Key Concepts

AWS CloudFormation: Infrastructure as Code

AWS CloudFormation models AWS resources in templates. A template can define networking, compute, storage, IAM resources, monitoring, and dependencies in a repeatable way.

Key characteristics:

• Creates and updates resources as a coordinated stack.
• Supports repeatable deployments across accounts, Regions, and environments.
• Enables version-controlled infrastructure definitions.
• Tracks resources and their relationships through stack management.
• Supports parameters, mappings, conditions, outputs, and intrinsic functions.
• Can use nested stacks and CloudFormation StackSets for larger or multi-account deployments.

CloudFormation is the appropriate choice when the requirement is to provision or manage AWS infrastructure consistently through code. It does not, by itself, represent a complete application deployment platform for every runtime or deployment workflow.

AWS Elastic Beanstalk: Managed Application Platform

Elastic Beanstalk is a platform-as-a-service style deployment service. You upload application code, and Beanstalk provisions and manages the supporting environment, such as compute instances, load balancing, scaling, and platform configuration.

It is useful when developers need to deploy a web application without manually managing every infrastructure component. AWS still exposes configuration options, but the service abstracts much of the operational work.

A key distinction is that Elastic Beanstalk is application-centric, while CloudFormation is infrastructure-centric:

• Use Elastic Beanstalk to deploy supported application code into a managed environment.
• Use CloudFormation to define and provision AWS resources and their relationships.
• The two services can be used together when an application platform must be incorporated into a broader infrastructure deployment.

AWS Config: Configuration and Compliance Management

AWS Config records resource configurations and configuration changes. It can evaluate resources against policies using AWS Config rules and can aggregate configuration data across accounts and Regions with the appropriate configuration and permissions.

Typical uses include:

• Determining whether resources comply with organizational requirements.
• Tracking configuration history.
• Identifying when a resource changed and what its previous state was.
• Detecting resources that violate policies.
• Triggering remediation workflows, often through automation services such as Systems Manager Automation or Lambda.

AWS Config is primarily a configuration and compliance service. It is not the same as CloudFormation:

• CloudFormation defines the desired infrastructure deployment.
• AWS Config observes resource configuration and evaluates compliance after or during resource operation.

Systems Manager Parameter Store

AWS Systems Manager Parameter Store stores configuration values and parameters. Parameters can be stored as plain strings, string lists, or encrypted values using AWS Key Management Service (AWS KMS) keys.

Common uses include:

• Application configuration.
• Environment-specific values.
• Database endpoints and ports.
• Encrypted passwords or connection values.
• Centralized configuration consumed by EC2 instances, containers, Lambda functions, or deployment tools.

Parameter Store is often a good fit for straightforward configuration management and encrypted parameter retrieval. Access is controlled using IAM, and encrypted parameters require appropriate KMS permissions.

AWS Secrets Manager

AWS Secrets Manager is designed specifically for managing secrets such as database credentials, API keys, and other sensitive values.

Important capabilities include:

• Secure secret storage and retrieval.
• Fine-grained access through IAM and resource policies where applicable.
• Encryption using AWS KMS.
• Secret versioning.
• Automated rotation for supported integrations and custom rotation workflows.
• Cross-account access patterns using resource-based policies and KMS permissions when supported by the design.

The exam distinction is usually based on the requirement:

• Choose Parameter Store for general configuration and encrypted parameters.
• Choose Secrets Manager when dedicated secret lifecycle management or automatic credential rotation is required.

Neither service should be treated as a substitute for IAM. Applications should receive only the permissions needed to retrieve the specific parameters or secrets they require.

AWS Resource Access Manager

AWS RAM allows supported AWS resources to be shared across accounts, organizational units, or an AWS Organization. This reduces duplication and supports centralized networking and governance models.

Typical examples include sharing:

• VPC subnets through a centrally managed networking account.
• Transit gateways.
• Route 53 Resolver rules.
• Certain other supported regional or global resources.

Resource sharing does not mean that every AWS resource becomes universally accessible. The resource must be supported by AWS RAM, and participants still require appropriate IAM permissions. Organizations-based sharing may simplify acceptance and governance, but it does not remove the need to understand resource ownership and access controls.

Architecture Decision Guide

Requirement	Recommended service	Why
Define repeatable AWS infrastructure in version-controlled templates	AWS CloudFormation	Provisions and manages infrastructure as code
Deploy application code while AWS manages much of the platform	Elastic Beanstalk	Provides a managed application environment
Track resource configuration history and evaluate compliance	AWS Config	Records configuration and applies compliance rules
Store application settings or encrypted parameters	Systems Manager Parameter Store	Centralizes configuration with optional KMS encryption
Store credentials and rotate them automatically	AWS Secrets Manager	Provides secret lifecycle and rotation capabilities
Share supported networking or other resources across accounts	AWS RAM	Enables controlled multi-account resource sharing

Exam-Relevant Takeaways

• CloudFormation is the primary AWS service for infrastructure as code.
• Elastic Beanstalk abstracts infrastructure management for application deployment; it does not eliminate the underlying AWS resources.
• AWS Config answers questions about resource configuration, configuration history, and compliance.
• Parameter Store is commonly selected for centralized configuration and encrypted parameters.
• Secrets Manager is the stronger choice when automatic secret rotation is a stated requirement.
• AWS RAM supports controlled sharing of eligible resources across AWS accounts.
• Configuration monitoring and infrastructure deployment are separate concerns: CloudFormation creates and updates resources, while AWS Config evaluates their observed state.
• Secure secret retrieval requires both service configuration and correct IAM permissions; encryption also introduces KMS key policy and grant considerations.

Common Exam Traps

• Confusing CloudFormation with AWS Config: CloudFormation deploys infrastructure; Config records and evaluates resource configuration.
• Choosing Beanstalk for arbitrary infrastructure provisioning: Beanstalk is designed around application environments, not as a general replacement for infrastructure-as-code templates.
• Using Parameter Store when rotation is required: Secrets Manager is generally the intended answer when the scenario explicitly requires automated credential rotation.
• Assuming all AWS resources can be shared with RAM: Only supported resource types can be shared.
• Assuming encryption alone grants access: An encrypted parameter or secret still requires IAM authorization and, where applicable, KMS permissions.
• Treating compliance detection as automatic remediation: Config can identify noncompliant resources, but remediation generally requires a configured automation workflow.

Real-World Engineer Notes

• Use CloudFormation templates or related infrastructure-as-code workflows to make environment creation repeatable and reviewable.
• Separate application deployment from foundational infrastructure when that improves ownership and release velocity.
• Establish naming, tagging, and configuration standards so AWS Config rules can evaluate resources consistently.
• Store references to secrets in deployment configuration rather than embedding credentials in templates, source code, container images, or user data.
• Design cross-account sharing around clear ownership: a central networking account may own shared subnets or transit gateways while workload accounts consume them.
• Treat service selection as a lifecycle decision. A value that is sufficient for static configuration may become a secret-management problem once rotation, auditing, or credential expiration is required.

Quick Reference Summary

• CloudFormation: Infrastructure as code and stack lifecycle management.
• Elastic Beanstalk: Managed deployment platform for supported applications.
• AWS Config: Resource configuration history, compliance evaluation, and detection.
• Parameter Store: Centralized application configuration and encrypted parameters.
• Secrets Manager: Dedicated secret storage, versioning, and rotation.
• AWS RAM: Controlled sharing of supported resources across AWS accounts.

Flashcards

1. Q: Which AWS service is used to define and deploy infrastructure as code?

A: AWS CloudFormation.

1. Q: Which service provides a managed platform for deploying web applications without manually managing every underlying layer?

A: AWS Elastic Beanstalk.

1. Q: Which service records AWS resource configurations and evaluates compliance?

A: AWS Config.

1. Q: What is the primary difference between CloudFormation and AWS Config?

A: CloudFormation provisions and updates resources; AWS Config observes and evaluates their configuration.

1. Q: Which service is commonly used for centralized application configuration values?

A: Systems Manager Parameter Store.

1. Q: Which service is preferred when automatic database credential rotation is required?

A: AWS Secrets Manager.

1. Q: What does AWS RAM enable?

A: Sharing supported AWS resources across accounts, organizational units, or an AWS Organization.

1. Q: What additional authorization may be needed to read a SecureString encrypted with a customer managed KMS key?

A: IAM permission to read the parameter and permission to use the KMS key.

1. Q: Is every AWS resource shareable through AWS RAM?

A: No. Only supported resource types can be shared.

1. Q: Does AWS Config automatically remediate every noncompliant resource?

A: No. Remediation requires an explicitly configured automation workflow.

Practice Questions

Question 1

A company wants to deploy the same VPC, IAM roles, security groups, and compute resources consistently into development, testing, and production accounts. The infrastructure definitions must be reviewed in source control and deployed repeatedly. Which solution best meets the requirement?

A. AWS Config rules
B. AWS CloudFormation templates
C. AWS Secrets Manager
D. AWS Elastic Beanstalk environment configuration

Correct answer: B. AWS CloudFormation templates

Explanation: CloudFormation is designed to define and deploy AWS infrastructure as code. AWS Config can assess the resulting resources but is not the primary infrastructure deployment mechanism.

Question 2

An organization stores database credentials for an application. Security policy requires credentials to be rotated automatically without embedding them in application code. Which service should be selected?

A. Amazon S3
B. Systems Manager Parameter Store only
C. AWS Secrets Manager
D. AWS Config

Correct answer: C. AWS Secrets Manager

Explanation: Secrets Manager is purpose-built for secret lifecycle management and supports automated rotation workflows for supported databases and custom integrations.

Question 3

A security team needs to identify whether Amazon EC2 security groups comply with a corporate rule and review configuration changes over time. Which AWS service should it use?

A. AWS Config
B. AWS RAM
C. Elastic Beanstalk
D. CloudFormation

Correct answer: A. AWS Config

Explanation: AWS Config records resource configuration history and evaluates resources against Config rules. It can also support remediation workflows when those are configured separately.

Question 4

A company has a centralized networking account that owns a transit gateway and wants workload accounts in the same AWS Organization to attach to and use it. Which service is most appropriate for sharing the supported resource?

A. AWS Resource Access Manager
B. AWS Secrets Manager
C. AWS Config aggregator
D. Elastic Beanstalk

Correct answer: A. AWS Resource Access Manager

Explanation: AWS RAM provides controlled cross-account sharing for supported resources, including several centralized networking resources. IAM permissions and resource-specific requirements still apply.