SOA-C03 · Domain 3 of 5

SOA-C03 Domain 3: Deployment, Provisioning, and Automation

This domain covers provisioning and maintaining AWS resources and automating their management: infrastructure as code with CloudFormation and the CDK, AMIs and launch templates, and Systems Manager automation.

Exam weight
22%
Official task statements
2
Estimated questions estimate
~11
Suggested study time estimate
20–30 hrs

About 9 min read Reviewed October 2026

Overview

Deployment, Provisioning, and Automation covers creating and maintaining resources repeatably and automating operational tasks. It has two task statements. Provisioning and maintaining resources covers infrastructure as code with CloudFormation and the AWS Cloud Development Kit, change sets, drift detection, StackSets for multiple accounts and Regions, AMIs and launch templates, and container provisioning. Automating management covers Systems Manager capabilities such as Patch Manager, Run Command, Session Manager, State Manager and Parameter Store, plus automation runbooks for routine operations.

At 22%, this is a top-weighted domain. It is about doing operations repeatably: defining infrastructure as code so deployments are consistent, detecting and correcting drift, and automating patching and configuration. Containers are newly in scope for SOA-C03. These skills build on the monitoring and reliability of the earlier domains.

How it's tested

SOA-C03 questions describe a provisioning or operational task and ask how to do it repeatably or automatically. This domain rewards infrastructure as code and Systems Manager automation over manual steps, and knowing which tool fits the task. Read the task before choosing the tool.

  • Provision as code

    A deployment need is described, and you choose CloudFormation, the CDK or StackSets to provision it repeatably.

  • Detect and fix drift

    A configuration-consistency concern is described, and you choose change sets or drift detection.

  • Automate the task

    A routine operation is described, and you choose the Systems Manager capability, such as Patch Manager or Run Command.

Reasoning it through

An operator must apply operating-system patches to a fleet of EC2 instances on a schedule, across accounts, without manual logins. Logging into each instance is unscalable. Systems Manager Patch Manager defines patch baselines and maintenance windows to patch the fleet automatically, and it works without opening inbound access, which is the repeatable, automated answer the exam expects.

Task statements 2

Official task statements from the Amazon Web Services outline, in outline order.

3.1 Provision and maintain cloud resourcesCloudFormation, the CDK, change sets, drift, StackSets, AMIs and launch templates.
What it means
This covers infrastructure as code with CloudFormation and the AWS Cloud Development Kit (CDK), templates and stacks, change sets to preview changes, drift detection, StackSets for deploying across accounts and Regions, intrinsic functions and parameters, AMIs and launch templates, and provisioning of container resources.
What to understand
CloudFormation provisions resources from templates so deployments are repeatable and version-controlled. Change sets preview what a change will do before applying it. Drift detection finds resources changed outside the template. StackSets deploy the same stack across many accounts and Regions. AMIs and launch templates standardize instance provisioning.
How it shows up
A repeatable-provisioning need is described, and you must choose CloudFormation, the CDK, change sets, drift detection or StackSets.
Common confusion
Confusing a change set with drift detection; a change set previews a proposed change, while drift detection finds out-of-band changes already made.
3.2 Automate the management of existing resourcesSystems Manager Patch Manager, Run Command, Session Manager, State Manager and Parameter Store.
What it means
This covers automating operations with AWS Systems Manager: Patch Manager for patching, Run Command for running commands at scale, Session Manager for secure shell access without open ports, State Manager for maintaining configuration, Automation runbooks for routine tasks, and Parameter Store for configuration and secrets.
What to understand
Systems Manager automates fleet operations without logging into instances. Patch Manager applies patch baselines on schedules. Run Command executes commands across instances. Session Manager gives auditable shell access without inbound ports or bastion hosts. Parameter Store centralizes configuration values.
How it shows up
A routine operational task is described, and you must choose the Systems Manager capability that automates it.
Common confusion
Confusing Run Command with Session Manager; Run Command runs defined commands at scale, while Session Manager opens an interactive shell.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • CloudFormation

    Infrastructure as code that provisions resources from templates.

    Remember
    Repeatable, version-controlled deployments.
    Tested as
    IaC questions.
    Trap
    Making changes manually instead.

  • AWS CDK

    Defines infrastructure in a programming language that synthesizes to CloudFormation.

    Remember
    It generates CloudFormation under the hood.
    Tested as
    IaC questions.
    Trap
    Treating it as separate from CloudFormation.

  • Change sets

    Preview the effect of a CloudFormation change before applying it.

    Remember
    They show what will change.
    Tested as
    Deployment-safety questions.
    Trap
    Confusing them with drift detection.

  • Drift detection

    Finds resources changed outside the template.

    Remember
    It restores configuration consistency.
    Tested as
    Consistency questions.
    Trap
    Confusing it with a change set.

  • StackSets

    Deploy the same stack across accounts and Regions.

    Remember
    For multi-account, multi-Region provisioning.
    Tested as
    Scale provisioning questions.
    Trap
    Confusing with a single stack.

  • AMIs and launch templates

    Standardized instance images and launch configurations.

    Remember
    They make instance provisioning consistent.
    Tested as
    Provisioning questions.
    Trap
    Hand-configuring each instance.

  • Patch Manager

    Applies patch baselines on schedules across a fleet.

    Remember
    Automated, scalable patching.
    Tested as
    Automation questions.
    Trap
    Patching instances manually.

  • Run Command

    Runs defined commands across many instances.

    Remember
    No login or open ports needed.
    Tested as
    Automation questions.
    Trap
    Confusing it with Session Manager.

  • Session Manager

    Secure, auditable shell access without open ports or bastions.

    Remember
    It replaces SSH bastions.
    Tested as
    Access questions.
    Trap
    Opening inbound SSH instead.

  • Parameter Store

    Centralized storage for configuration and secrets.

    Remember
    It removes hard-coded values.
    Tested as
    Configuration questions.
    Trap
    Hard-coding configuration.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Change set vs. drift detection

ConceptMeaningKey differenceCommon trap
Change set Preview a proposed change Before applying Confusing it with drift
Drift detection Find out-of-band changes After the fact Confusing it with a change set

Single stack vs. StackSets

ConceptMeaningKey differenceCommon trap
Single stack Resources in one account and Region Local scope Using it for many accounts
StackSets Same stack across accounts and Regions Centralized multi-target deploy Confusing with a single stack

Run Command vs. Session Manager vs. Patch Manager

ConceptMeaningKey differenceCommon trap
Run Command Run defined commands at scale Non-interactive, scalable Confusing with Session Manager
Session Manager Interactive shell, no open ports Auditable access Opening SSH instead
Patch Manager Scheduled patch baselines Automated patching Patching manually

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Patch by hand

    What candidates pick
    Log into each instance to apply OS patches.
    Why it looks right
    It is familiar.
    Why it's wrong
    Systems Manager Patch Manager applies baselines on schedules across the fleet without logins.

    Clue to watch for Patching must be repeatable and scalable across many instances.

  2. Change set is drift

    What candidates pick
    Use a change set to find changes made outside the template.
    Why it looks right
    Both involve changes.
    Why it's wrong
    A change set previews a proposed change; drift detection finds out-of-band changes already made.

    Clue to watch for The need is to find unexpected manual changes.

  3. Single stack everywhere

    What candidates pick
    Deploy a stack separately in each of many accounts by hand.
    Why it looks right
    It reuses the same template.
    Why it's wrong
    StackSets deploy the same stack across accounts and Regions centrally.

    Clue to watch for The same stack must go to many accounts or Regions.

  4. Open SSH for access

    What candidates pick
    Open inbound SSH and use a bastion for instance access.
    Why it looks right
    It is the traditional method.
    Why it's wrong
    Session Manager gives auditable shell access without open ports or bastions.

    Clue to watch for The requirement is secure access without inbound ports.

  5. Run Command for a shell

    What candidates pick
    Use Run Command to open an interactive session on an instance.
    Why it looks right
    Both reach the instance.
    Why it's wrong
    Run Command runs defined commands; Session Manager provides the interactive shell.

    Clue to watch for The need is an interactive session versus a scripted command.

Answer framework

For any Domain 3 scenario, use these steps to find the answer SOA-C03 expects.

  1. Decide whether the task is provisioning resources or automating operations on existing ones.
  2. For provisioning, use CloudFormation or the CDK, preview changes with change sets, find out-of-band changes with drift detection, and use StackSets for multiple accounts and Regions.
  3. Standardize instances with AMIs and launch templates rather than hand-configuring them.
  4. For operations, choose the Systems Manager capability that fits: Patch Manager for patching, Run Command for commands, Session Manager for access, Parameter Store for configuration.
  5. Prefer automated, repeatable approaches over manual steps, and document the automation, record the change and the reasoning so the operational action is auditable and repeatable.

Practice question

A CloudOps engineer must apply operating-system patches on a defined schedule to hundreds of EC2 instances across several accounts, without opening inbound access or logging in manually. Which approach is MOST appropriate?

Want more like this? The SOA-C03 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This domain rewards an infrastructure-as-code and automation mindset, so study by replacing manual actions with repeatable ones. Start with CloudFormation: templates, stacks, change sets to preview changes, drift detection to catch out-of-band changes, and StackSets for multi-account deployment. Understand that the CDK synthesizes to CloudFormation.

Next, learn the Systems Manager suite thoroughly, since the exam leans on it: Patch Manager for patching, Run Command versus Session Manager (scripted commands versus interactive shell), State Manager for configuration, and Parameter Store for values. Note that containers are newly in scope, so understand provisioning container resources too.

Hands-on practice writing a small CloudFormation template and running a Systems Manager command cements these far better than reading. Afterwards, move to Domain 4, security and compliance. Deploy and deliberately break a CloudFormation stack to watch the rollback, then review missed practice questions by provisioning tool. Treat every manual action as a candidate for automation, since that mindset is exactly what the exam rewards.

FAQ

How much of SOA-C03 is Domain 3?

Deployment, Provisioning, and Automation is 22% of the scored content, tied for the largest domain, and increased in weight from the previous version.

What is the difference between a change set and drift detection?

A change set previews what a proposed CloudFormation change will do before you apply it. Drift detection finds resources that were changed outside the template after deployment.

When should I use StackSets?

When you need to deploy the same CloudFormation stack across multiple accounts and Regions from a central place, rather than deploying a single stack repeatedly by hand.

What is the difference between Run Command and Session Manager?

Run Command runs defined commands across instances non-interactively. Session Manager opens a secure, auditable interactive shell without open inbound ports or a bastion host.

How should I patch a fleet of instances?

Use Systems Manager Patch Manager with patch baselines and maintenance windows, which patches at scale on a schedule without manual logins or open ports.

Is the CDK different from CloudFormation?

The CDK lets you define infrastructure in a programming language, but it synthesizes to CloudFormation templates, so it uses the same provisioning engine.

How does Domain 3 connect to the rest of the exam?

It provisions and maintains the resources the other domains monitor, keep reliable, secure and network, doing so repeatably and automatically.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered provisioning with infrastructure as code and automating operations with Systems Manager. Test whether you can choose the repeatable, automated approach under exam conditions.

Take the SOA-C03 practice test Check your SOA-C03 readiness

Keep going