Study guide
Technical reference and lesson notes
Purpose of This Lesson
Deployment and management services help teams provision infrastructure consistently, deploy applications, store configuration and secrets, assess resource compliance, manage configuration, and share resources across AWS accounts.
For exam scenarios, focus on selecting the service that matches the required level of control, automation, secret rotation, governance, and multi-account access.
Key Concepts
AWS CloudFormation
AWS CloudFormation provisions infrastructure from declarative templates written in YAML or JSON. A template describes resources, properties, dependencies, and configuration. CloudFormation then creates and manages those resources as a stack.
Key benefits include:
- Repeatable and consistent infrastructure deployments
- Reduced manual configuration errors
- Version control and peer review for infrastructure changes
- Dependency management between resources
- Stack-wide updates, rollback, and deletion
- No separate charge for CloudFormation itself; AWS charges for the resources it provisions
Important CloudFormation capabilities:
- Templates: YAML or JSON files that define the desired environment
- Stacks: Deployed collections of resources managed as a unit
- Change sets: A preview of proposed stack changes before execution
- StackSets: Deployment of CloudFormation stacks across multiple AWS accounts and Regions
A change set helps identify whether an update will add, modify, or remove resources. It is a planning and review mechanism, not an automatic safety guarantee; the change still must be executed.
AWS Elastic Beanstalk
AWS Elastic Beanstalk is a platform-as-a-service deployment option for web applications. You provide application code, and Beanstalk provisions and manages the supporting environment, including resources such as compute capacity, load balancing, scaling, and health monitoring.
The main Beanstalk hierarchy is:
- Application: Logical container for versions, environments, and configuration
- Application version: A specific deployable code package, commonly stored in Amazon S3
- Environment: A running deployment of a particular application version on AWS resources
- Environment configuration: Settings that control the environment and its managed resources
An environment represents more than an EC2 instance. It can include load balancers, Auto Scaling resources, security groups, monitoring, and other infrastructure managed through Beanstalk.
Beanstalk environments generally fall into two workload patterns:
- Web server environment: Processes incoming HTTP requests
- Worker environment: Processes asynchronous, long-running tasks from an Amazon SQS queue
Worker environments are useful when background work should not block the user-facing web tier. Examples include document processing, report generation, media conversion, and other jobs that may take longer than a normal HTTP request.
AWS Systems Manager Parameter Store
Parameter Store provides hierarchical storage for configuration values and secrets. Parameters can be referenced by name and organized using paths such as /application/production/database/endpoint.
Parameter types include:
- Plain string values
- String lists
- Secure strings encrypted with AWS Key Management Service (AWS KMS)
Typical uses include storing database connection information, passwords, license codes, feature flags, and environment-specific configuration. IAM policies control which principals can read or modify parameters, and KMS permissions are also relevant for encrypted values.
Parameter Store is a good fit when applications need centralized, path-based configuration and secret retrieval. It does not provide native secret rotation. Rotation can be implemented with custom automation, commonly using AWS Lambda, but that creates additional operational responsibility.
AWS Config
AWS Config records and evaluates the configuration of AWS resources. It supports governance, auditing, compliance, and troubleshooting by providing:
- Current resource configuration details
- Historical configuration data
- Notifications when resources are created, changed, or deleted
- Relationships between resources
- Evaluation against desired configuration rules
AWS Config answers questions such as:
- Which security groups allow unrestricted access?
- When did a resource configuration change?
- Which resources are associated with a particular VPC?
- Are resources compliant with organizational requirements?
AWS Config is primarily a configuration and compliance service. It does not replace CloudFormation, which is used to provision and manage infrastructure as code.
AWS Secrets Manager
AWS Secrets Manager stores sensitive values such as database credentials, API keys, and other secrets. It supports encrypted secret values and is designed for applications that need secure retrieval and, in supported cases, automated rotation.
Built-in rotation integrations include supported configurations for services such as:
- Amazon RDS for MySQL and PostgreSQL
- Amazon Aurora
- Amazon Redshift
- Amazon DocumentDB
For other secret types, rotation generally requires a customer-provided AWS Lambda function and an appropriate rotation workflow.
Secrets Manager is usually preferable to Parameter Store when native secret rotation, dedicated secret lifecycle management, or a purpose-built secrets service is required.
AWS OpsWorks
AWS OpsWorks is a configuration management service that provides managed instances of Chef and Puppet. It can help automate operational tasks such as:
- Patching and software updates
- Backup configuration
- Instance configuration
- Compliance-related management
The key exam distinction is that OpsWorks is associated with Chef and Puppet-based configuration management, whereas AWS Config evaluates resource configuration and compliance.
AWS Resource Access Manager
AWS Resource Access Manager (AWS RAM) allows supported resources to be shared across AWS accounts. Sharing can be organized through AWS Organizations, organizational units, or specific accounts and principals, depending on the resource and sharing configuration.
A notable use case is sharing a VPC and supported VPC components across accounts. This can support centralized networking models in which a network account owns shared infrastructure while application accounts consume it.
Resource shares can be created and managed through the AWS Management Console, APIs, AWS CLI, or SDKs. The exact resources that can be shared depends on AWS RAM service support and the resource’s sharing semantics.
Exam-Relevant Takeaways
- Use CloudFormation for repeatable infrastructure provisioning through YAML or JSON templates.
- Use Change Sets to preview the impact of a CloudFormation update before applying it.
- Use StackSets to deploy standardized CloudFormation stacks across accounts and Regions.
- Use Elastic Beanstalk when the team wants to deploy application code while AWS manages much of the underlying environment.
- Use a Beanstalk worker environment for asynchronous, long-running jobs that consume messages from Amazon SQS.
- Use Parameter Store for hierarchical configuration and secure strings when native secret rotation is not required.
- Use Secrets Manager when automatic or custom secret rotation is a key requirement.
- Use AWS Config to record resource configuration, track configuration history, and evaluate compliance.
- Use OpsWorks for Chef- or Puppet-based configuration management.
- Use AWS RAM to share supported resources, including supported VPC resources, across accounts.
- CloudFormation is not itself a paid infrastructure resource; charges apply to the resources created by the stack.
Architecture Decision Guide
| Requirement | Recommended service | Reason |
|---|---|---|
| Provision a complete environment repeatedly from code | AWS CloudFormation | Declarative templates, dependencies, updates, and rollback support |
| Review infrastructure changes before deployment | CloudFormation change set | Shows proposed stack modifications before execution |
| Deploy the same infrastructure pattern across many accounts and Regions | CloudFormation StackSets | Centralized multi-account and multi-Region stack deployment |
| Deploy a supported web application without managing every infrastructure detail | Elastic Beanstalk | Handles environment provisioning, scaling, load balancing, and health monitoring |
| Run long background jobs outside the request path | Elastic Beanstalk worker environment with Amazon SQS | Decouples asynchronous processing from web requests |
| Store hierarchical application configuration | Systems Manager Parameter Store | Supports named paths and centralized retrieval |
| Rotate database credentials automatically where supported | AWS Secrets Manager | Provides managed rotation integrations for selected services |
| Audit resource configuration and configuration history | AWS Config | Records state changes, relationships, and compliance evaluations |
| Apply Chef or Puppet configuration management | AWS OpsWorks | Managed Chef and Puppet-based operations |
| Share supported resources across AWS accounts | AWS RAM | Provides controlled cross-account resource sharing |
Common Exam Traps
- Confusing CloudFormation change sets with automatic deployment: A change set previews a change. It does not apply the change until it is executed.
- Treating a CloudFormation template as a deployed environment: The template is the definition; the stack is the deployed collection of resources.
- Using Elastic Beanstalk for arbitrary infrastructure orchestration: Beanstalk is optimized for supported application deployment patterns. CloudFormation is the broader infrastructure-as-code choice.
- Using a web tier for long-running processing: Long jobs can cause request timeouts and poor user experience. Use a worker environment or another asynchronous architecture with SQS.
- Assuming Parameter Store rotates secrets: Parameter Store does not provide native secret rotation. Custom Lambda automation is required.
- Assuming Secrets Manager automatically rotates every secret: Built-in rotation applies to supported integrations. Other secret types require custom Lambda-based rotation.
- Confusing AWS Config with CloudFormation: Config evaluates and records resource state; CloudFormation provisions and manages declared infrastructure.
- Assuming AWS RAM grants unrestricted access: Sharing a resource does not eliminate IAM permissions or resource-specific authorization requirements.
- Forgetting account and Region scope: StackSets and RAM address cross-account use cases, but supported resource types and sharing behavior must be considered.
Real-World Engineer Notes
- Store CloudFormation templates in version control and require peer review for production changes.
- Use change sets in deployment pipelines to make destructive or replacement operations visible before execution.
- Separate application code deployment from infrastructure ownership when that improves team autonomy. Beanstalk can simplify application delivery, while CloudFormation can manage surrounding shared infrastructure.
- Use separate Parameter Store paths for environments and applications, and apply least-privilege IAM policies to those paths.
- Prefer Secrets Manager when credential rotation is part of the security requirement rather than treating rotation as a later enhancement.
- Encrypt sensitive Parameter Store values with KMS and ensure the application role can both read the parameter and decrypt the value when required.
- Use AWS Config history and relationships during incident investigation to identify what changed and which resources were affected.
- In multi-account designs, use AWS RAM to centralize supported networking resources while keeping application permissions scoped to each account.
Quick Reference Summary
- CloudFormation: Infrastructure as code using YAML or JSON.
- Stack: A deployed group of CloudFormation resources.
- Change set: Preview of a proposed stack update.
- StackSets: Multi-account and multi-Region CloudFormation deployment.
- Elastic Beanstalk: Managed application deployment platform.
- Web environment: Handles HTTP requests.
- Worker environment: Consumes SQS messages for background processing.
- Parameter Store: Hierarchical configuration and secure-string storage.
- Secrets Manager: Secret storage with managed or custom rotation.
- AWS Config: Configuration history, relationships, and compliance evaluation.
- OpsWorks: Managed Chef and Puppet configuration management.
- AWS RAM: Cross-account sharing of supported AWS resources.
Flashcards
- Q: What format can CloudFormation templates use?
A: YAML or JSON.
- Q: What is a CloudFormation stack?
A: A deployed collection of AWS resources managed together according to a template.
- Q: What is the purpose of a CloudFormation change set?
A: To preview proposed stack changes before they are executed.
- Q: What problem do CloudFormation StackSets solve?
A: They deploy CloudFormation stacks across multiple AWS accounts and Regions.
- Q: What does Elastic Beanstalk manage for an application deployment?
A: It can manage capacity provisioning, load balancing, scaling, health monitoring, and the application environment.
- Q: When should a Beanstalk worker environment be used?
A: For long-running asynchronous tasks processed from an Amazon SQS queue.
- Q: What is a major advantage of Parameter Store?
A: It provides centralized, hierarchical storage for configuration and secure string values.
- Q: Does Parameter Store natively rotate secrets?
A: No. Rotation requires custom automation, such as an AWS Lambda function.
- Q: When is Secrets Manager a stronger choice than Parameter Store?
A: When managed or custom secret rotation and dedicated secret lifecycle management are required.
- Q: What does AWS Config record?
A: Current and historical resource configurations, relationships, and configuration changes.
- Q: Which service provides managed Chef and Puppet capabilities?
A: AWS OpsWorks.
- Q: What is the purpose of AWS RAM?
A: To share supported AWS resources across accounts and organizational structures.
Practice Questions
Question 1
A company needs to deploy the same baseline IAM, logging, and networking resources into 40 AWS accounts across three Regions. The company wants centralized versioning and the ability to update the baseline consistently. Which solution best meets the requirement?
A. Create the resources manually in each account
B. Use Elastic Beanstalk environments in each account
C. Use CloudFormation StackSets
D. Use AWS Config conformance checks only
Correct answer: C. Use CloudFormation StackSets.
StackSets are designed to deploy and manage CloudFormation stacks across multiple accounts and Regions. AWS Config can assess compliance but does not provision the baseline resources.
Question 2
A web application allows users to upload videos. Video transcoding can take several minutes, and the company wants the HTTP request to return quickly. Which Elastic Beanstalk design is most appropriate?
A. Process transcoding synchronously in the web server environment
B. Place transcoding jobs on a Beanstalk worker environment consuming Amazon SQS messages
C. Store the jobs in Parameter Store
D. Use AWS Config to trigger transcoding
Correct answer: B. Place transcoding jobs on a Beanstalk worker environment consuming Amazon SQS messages.
A worker environment is intended for long-running background tasks. SQS decouples the web request from the processing workload and allows the worker tier to process jobs asynchronously.
Question 3
An application stores database credentials in Systems Manager Parameter Store. A security requirement now mandates automatic rotation of supported Amazon RDS credentials without maintaining custom rotation code. Which change should the architect recommend?
A. Move the credentials to AWS Secrets Manager
B. Store the credentials as a plain String parameter
C. Use AWS Config to rotate the credentials
D. Store the credentials in a CloudFormation template
Correct answer: A. Move the credentials to AWS Secrets Manager.
Secrets Manager provides built-in rotation integrations for supported services, including supported Amazon RDS configurations. Parameter Store does not provide native secret rotation.
Question 4
A compliance team needs to determine when security group configurations changed, inspect historical resource state, and identify relationships between resources. Which AWS service should be enabled?
A. AWS Config
B. AWS RAM
C. AWS OpsWorks
D. Elastic Beanstalk
Correct answer: A. AWS Config.
AWS Config records resource configurations and history, reports configuration changes, and provides resource relationship information. OpsWorks manages Chef and Puppet configurations but is not the primary service for account-wide resource configuration history.
Question 5
A networking account owns a VPC and wants application accounts in the same organization to consume supported shared VPC resources without duplicating the networking infrastructure. Which service should be used?
A. AWS Resource Access Manager
B. AWS Secrets Manager
C. CloudFormation change sets
D. AWS OpsWorks
Correct answer: A. AWS Resource Access Manager.
AWS RAM supports sharing eligible resources across AWS accounts, including supported VPC-related resources. IAM permissions and resource-specific access controls still apply after the resource is shared.