Overview
Configuration Management and IaC has three task statements. The first covers composing and deploying templates with AWS CloudFormation, AWS SAM and the AWS CDK, pushing them to many accounts and Regions with StackSets, packaging approved patterns through AWS Service Catalog and CloudFormation modules, and picking among configuration services such as Systems Manager, AWS Config and AWS AppConfig. The second covers multi-account setup with AWS Organizations and AWS Control Tower, SCPs, cross-account roles and governance tools applied at scale.
The third task statement moves into large-scale automation: inventory, patching and desired-state configuration with Systems Manager, Lambda and Step Functions workflows built on the AWS SDKs, and ongoing software compliance. The exam guide still lists AWS OpsWorks, which AWS shut down in May 2024, so treat Systems Manager State Manager as the practical answer for desired-state configuration.
How it's tested
Domain 2 questions describe an organization with many accounts, Regions or servers and a need to provision, standardize or keep something compliant. Correct answers scale automatically to new accounts and resources, use native AWS governance features, and avoid long-lived credentials or one-off scripts.
-
Scale the template
Infrastructure must reach many accounts or Regions, and you choose StackSets, Service Catalog or CDK constructs with the right permission model.
-
Govern new accounts
Accounts are created often, and you choose Control Tower, Account Factory, SCPs or delegated administrators to apply a baseline.
-
Keep fleets in shape
Servers drift or miss patches, and you choose Patch Manager, State Manager, Automation runbooks or Config rules.
An organization adds new accounts weekly and wants an AWS Config recorder and a logging role in each one automatically. A StackSet with service-managed permissions targeting the organizational unit, with automatic deployment enabled, deploys the stack whenever an account joins that OU. Self-managed permissions would need manual role setup in each new account, so the service-managed option is correct.
Task statements 3
Official task statements from the Amazon Web Services outline, in outline order.
2.1 Define cloud infrastructure and reusable components to provision and manage systems throughout their lifecycleIaC templates, StackSets, configuration services and reusable governed patterns.
- What it means
- This task covers composing and deploying IaC with CloudFormation, AWS SAM and the AWS CDK, deploying StackSets across accounts and Regions, choosing the right configuration management service (Systems Manager, AWS Config, AWS AppConfig, and OpsWorks in the guide), and embedding governance and security standards in reusable templates through Service Catalog, CloudFormation modules and CDK constructs.
- What to understand
- Change sets preview updates before execution, and stack policies or deletion policies protect critical resources. Drift detection finds manual changes. The CDK synthesizes CloudFormation, so its deployments behave like stacks. AppConfig handles feature flags and runtime configuration with validators and gradual rollout, which differs from AWS Config auditing resource settings. Service Catalog lets users launch approved products without broad IAM rights.
- How it shows up
- Teams need consistent, governed infrastructure, and you choose the template format, sharing method or configuration service.
- Common confusion
- Mixing up AWS AppConfig, which deploys application settings, with AWS Config, which records and evaluates resource configuration.
2.2 Deploy automation to create, onboard, and secure AWS accounts in a multi-account or multi-Region environmentAccount provisioning, Organizations, Control Tower, SCPs, roles and governance at scale.
- What it means
- This task covers standardizing and automating new account creation, consolidating and centrally managing accounts with AWS Organizations and AWS Control Tower, applying IAM for complex structures with SCPs and cross-account role assumption, and enforcing governance at scale with AWS Config, Security Hub, Amazon Detective, GuardDuty and Service Catalog.
- What to understand
- Control Tower sets up a landing zone with log archive and audit accounts and offers Account Factory, plus Account Factory Customization for baselines. SCPs set maximum permissions for member accounts but never grant access by themselves, and they do not affect the management account. Delegated administrator accounts let security services be managed outside the management account.
- How it shows up
- Account growth or governance gaps are described, and you choose the Organizations, Control Tower or SCP setup.
- Common confusion
- Believing an SCP grants permissions; it only limits what identity policies in member accounts can allow.
2.3 Design and build automated solutions for complex tasks and large-scale environmentsInventory, patching, desired state, Lambda and Step Functions automation and compliance.
- What it means
- This task covers automating inventory, configuration and patching with Systems Manager and AWS Config, writing Lambda and Step Functions automations with the AWS SDKs for multi-step jobs, applying desired-state configuration with State Manager (OpsWorks appears in the guide), and keeping installed software compliant.
- What to understand
- Patch Manager applies patch baselines through maintenance windows or patch policies set up with Quick Setup across an organization. State Manager associations reapply a document on a schedule to hold a configuration. Automation runbooks script multi-step operational tasks. Step Functions coordinates long or branching workflows with retries, where a single Lambda function would hit its 15-minute limit.
- How it shows up
- A large fleet needs repeatable operations, and you choose the Systems Manager capability or orchestration service.
- Common confusion
- Using one long Lambda function for a multi-hour workflow instead of Step Functions orchestration.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
CloudFormation StackSets
Deploys one template to many accounts and Regions.
- Remember
- Service-managed permissions integrate with Organizations and auto-deploy to new accounts.
- Tested as
- Multi-account rollout questions.
- Trap
- Choosing self-managed permissions when OUs and automatic deployment are needed.
-
Change sets
Preview of what a stack update will modify.
- Remember
- Shows replacements before they happen.
- Tested as
- Safe update scenarios.
- Trap
- Updating directly and discovering a resource replacement afterwards.
-
Drift detection
Compares live resources with the template.
- Remember
- Detects but does not fix manual edits.
- Tested as
- Configuration consistency questions.
- Trap
- Expecting drift detection to revert changes.
-
AWS CDK
Defines infrastructure in general-purpose languages and synthesizes CloudFormation.
- Remember
- Constructs package reusable patterns.
- Tested as
- Reusable component scenarios.
- Trap
- Thinking CDK bypasses CloudFormation.
-
AWS Service Catalog
Portfolio of approved products launched by users.
- Remember
- Launch constraints use a role, so users need few permissions.
- Tested as
- Self-service with governance.
- Trap
- Granting broad IAM rights instead.
-
AWS Control Tower
Managed landing zone with guardrails and Account Factory.
- Remember
- Controls are preventive, detective or proactive.
- Tested as
- Account vending and baseline questions.
- Trap
- Building a custom landing zone script when Control Tower fits.
-
Service control policies
Organization policies that cap member account permissions.
- Remember
- Do not apply to the management account.
- Tested as
- Restricting Regions or services.
- Trap
- Treating an SCP as a permission grant.
-
Systems Manager Patch Manager
Applies patch baselines to managed nodes.
- Remember
- Patch policies via Quick Setup span accounts and Regions.
- Tested as
- Patching at scale.
- Trap
- Patching through ad hoc SSH scripts.
-
State Manager
Associations that keep nodes in a defined state.
- Remember
- Reapplies on a schedule.
- Tested as
- Desired-state questions.
- Trap
- Using one-time Run Command for ongoing compliance.
-
AWS AppConfig
Deploys application configuration and feature flags.
- Remember
- Validators and deployment strategies with rollback on alarms.
- Tested as
- Runtime configuration changes.
- Trap
- Confusing it with AWS Config.
-
Step Functions
Serverless workflow orchestration.
- Remember
- Handles retries, branching and long waits.
- Tested as
- Complex automation questions.
- Trap
- Chaining Lambda functions by direct invocation.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
StackSets permission models
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Service-managed | Uses Organizations trusted access | Auto-deploys to accounts joining an OU | Not enabling trusted access first |
| Self-managed | Uses roles you create in each account | Works without Organizations | Forgetting the execution role in new accounts |
Configuration services
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| AWS Config | Records resource configuration and evaluates rules | Audit and compliance | Using it to push application settings |
| AWS AppConfig | Deploys app configuration and flags | Gradual rollout with rollback | Using it to audit resources |
| Systems Manager State Manager | Keeps OS and software state | Scheduled associations | Using it for feature flags |
Account governance tools
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| AWS Organizations | Groups accounts into OUs with policies | Foundation layer | Expecting a landing zone by itself |
| AWS Control Tower | Landing zone and controls on top of Organizations | Account Factory and dashboards | Thinking it replaces Organizations |
| SCPs | Permission ceilings for accounts | Preventive guardrail | Expecting them to grant access |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
SCP as an allow
- What candidates pick
- Attach an SCP allowing S3 access so developers can use buckets.
- Why it looks right
- The policy syntax looks like IAM.
- Why it's wrong
- SCPs only filter permissions; developers still need identity policies that grant the access.
Clue to watch for Users lack access despite an allow SCP.
-
Self-managed for growing orgs
- What candidates pick
- Use self-managed StackSets and add roles later.
- Why it looks right
- It is the older, familiar model.
- Why it's wrong
- New accounts would need manual role creation, which breaks the automatic onboarding requirement.
Clue to watch for Accounts are added frequently and must be configured automatically.
-
Drift detection fixes drift
- What candidates pick
- Turn on drift detection to restore settings.
- Why it looks right
- The name suggests correction.
- Why it's wrong
- It only reports differences; remediation needs a stack update, Config remediation or automation.
Clue to watch for Requirement to correct, not just detect.
-
Config for feature flags
- What candidates pick
- Store feature flags in AWS Config.
- Why it looks right
- The names are similar.
- Why it's wrong
- AWS Config audits resources; AppConfig deploys runtime configuration with validation and rollback.
Clue to watch for Application behavior toggled without redeploying.
-
OpsWorks for new desired state
- What candidates pick
- Choose OpsWorks Stacks to manage Chef recipes.
- Why it looks right
- The exam guide still lists it.
- Why it's wrong
- OpsWorks is no longer available, so Systems Manager State Manager is the realistic managed choice.
Clue to watch for Desired-state configuration across a fleet.
-
Lambda for long jobs
- What candidates pick
- Run a multi-hour patch workflow in one Lambda function.
- Why it looks right
- Lambda is serverless and simple.
- Why it's wrong
- Lambda stops at 15 minutes; Step Functions or Systems Manager Automation handle long, multi-step work.
Clue to watch for Workflow runs longer than minutes or needs waits.
Answer framework
Apply these steps when a question asks how to provision or govern infrastructure across many accounts or servers.
- Count the scope: one stack, many accounts, many Regions or a whole organization, since scope selects plain stacks, StackSets or Control Tower.
- Decide whether users need self-service; if so, publish approved templates through Service Catalog with launch constraints rather than wide permissions.
- Separate preventive guardrails such as SCPs from detective ones such as Config rules, and note which the requirement actually asks for.
- For servers, map the need to a Systems Manager feature: Patch Manager, State Manager, Automation, Inventory or Run Command.
- Choose options that apply automatically to new accounts or instances, avoid long-lived keys, and keep every change in versioned code.
Practice question
Want more like this? The DOP-C02 practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin in a sandbox organization with a few member accounts. Enable trusted access for CloudFormation, then deploy a StackSet with service-managed permissions to an OU and watch it reach a newly created account. Repeat with a self-managed StackSet so the difference in setup effort is obvious.
Next, set up Control Tower or read its landing zone documentation closely, and write two or three SCPs, such as a Region deny and a rule that protects CloudTrail. Test that an administrator in a member account is still blocked. Build one CDK app and one Service Catalog product so you can compare self-service and code-first approaches.
Finish with Systems Manager. Register instances as managed nodes, run a patch baseline through a maintenance window, create a State Manager association and run an Automation runbook. Keep a one-page table that maps each requirement phrase to the service that answers it, and review it before practice exams.
FAQ
What share of DOP-C02 is Configuration Management and IaC?
Configuration Management and IaC is 17% of scored content, roughly 11 of the 65 scored questions, tied with Security and Compliance.
Is AWS OpsWorks still tested?
The current exam guide still names OpsWorks, but AWS shut the service down in May 2024. Know what it did, and expect Systems Manager to be the better answer for desired-state configuration.
Do I need to write CDK code on the exam?
No code is written. You need to know what the CDK does, that it synthesizes CloudFormation, and when constructs make reuse easier.
How deep does Control Tower go?
Know the landing zone accounts, Account Factory, control types, and how Control Tower relates to Organizations and SCPs. Day-to-day console steps are less important.
Which Systems Manager features matter most here?
Patch Manager, State Manager, Automation, Inventory, Run Command and Parameter Store appear often. Learn which requirement wording points to each one.
Are Terraform or other third-party IaC tools covered?
The exam focuses on AWS-native tooling such as CloudFormation, AWS SAM and the CDK. Third-party tools are not the subject of questions in the guide.
Other DevOps & Containers certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 2 knowledge
You have covered IaC templates, StackSets, account governance and fleet automation. See whether you can pick the scalable option in timed scenarios.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the DOP-C02 AI tutor Get any concept explained your way