AWS CloudOps Engineer Associate Course Notes

SOA-C03 operations start with knowing which signal answers the incident question. CloudWatch metrics provide numeric time-series data, alarms evaluate thresholds, dashboards combine service health views, and CloudWatch Logs stores application and system events. Metric filters turn log patterns into metrics, while subscription filters stream matching log events to destinations for near real-time processing.

• Using CloudWatch Logs as if it automatically creates alarms; metric filters or metrics are needed before an alarm can evaluate log patterns.

• Metrics and alarms answer threshold questions; Logs and filters answer event-content questions.

Troubleshooting on SOA-C03 starts by proving which layer failed. DNS failover questions point to Route 53 health checks and active-active or active-passive failover records. Load balancer health check failures point to target group settings, target response codes, security groups, NACLs, or application listener behavior before changing compute capacity.

• Changing Auto Scaling desired capacity when the real issue is cooldown, warm-up, or health check grace period timing.

• Route 53 failover requires health checks; load balancer target health requires target group health checks.

Operational security scenarios usually ask which control enforces the requirement without breaking routine access. IAM policies and conditions can require MFA for sensitive self-service actions, while least privilege keeps permissions limited to the exact actions and resources needed. If the scenario describes an identity decision, start with IAM before reaching for detection or encryption services.

• Using Parameter Store for a requirement that specifically needs managed secret rotation, which points to Secrets Manager.

• IAM MFA conditions enforce identity context; SCPs enforce maximum permissions across accounts.

VPC troubleshooting is about proving the path. A workload needs the correct subnet route table, security group rules, NACL rules, DNS behavior, and target service path before traffic can flow. A NAT Gateway must be in a public subnet with a route to an internet gateway, while private subnets route outbound internet traffic to that NAT Gateway.

• Placing a NAT Gateway in a private subnet instead of a public subnet with a route to an internet gateway.

• Start VPC troubleshooting with route tables, then security groups, NACLs, DNS, endpoint policies, and service health.

SOA-C03 cost governance is about choosing the control that changes behavior. Compute Optimizer recommends right-sizing based on utilization, while cost allocation tags make spend visible by application, owner, environment, or project. Cost visibility comes before cost action; without tags or reports, the right-sizing discussion often lacks ownership.

• Using cost allocation tags as if they reduce spend directly instead of treating them as visibility and ownership labels.

• Compute Optimizer means right-sizing recommendations from utilization data.