Overview
SDLC Automation is the first and largest of the six DOP-C02 domains, with four task statements. You implement CI/CD pipelines with AWS CodePipeline, CodeBuild and CodeDeploy, connect them to source repositories, and handle build and deployment secrets through Secrets Manager or Parameter Store. You add automated unit, integration and load tests, then build and store artifacts in CodeArtifact, Amazon S3 or Amazon ECR, including AMIs and container images from EC2 Image Builder. The final task covers deployment agents, troubleshooting and release methods such as in-place, rolling, blue/green, canary and linear.
DOP-C02 is still the current version. As of 31 October 2026, AWS has announced replacements for SAP-C02, DVA-C02 and MLA-C01 but no DOP-C03, and the published format stays at 75 questions (65 scored) in 180 minutes with a scaled pass mark of 750. AWS lists the Korean-language delivery as retiring after 31 December 2026.
How it's tested
Domain 1 scenarios describe a release process with a defect, such as slow feedback, risky cutovers, leaked credentials or failing deployments. You choose the pipeline stage, build setting, artifact store or deployment configuration that fixes the defect while meeting stated constraints on downtime, cost and effort.
-
Pick the deployment method
Downtime, rollback speed and compute platform are stated, and you choose in-place, rolling, blue/green, canary or linear deployment.
-
Place the test or gate
A quality problem slips into production, and you decide which pipeline stage should run unit, integration, load or approval steps.
-
Fix the pipeline plumbing
A build or deployment fails or leaks secrets, and you identify the IAM, agent, artifact or secret configuration at fault.
A team runs a Lambda API and wants new versions to receive 10% of traffic for five minutes before full rollout, with automatic rollback on errors. CodeDeploy for Lambda supports a canary configuration that shifts traffic between alias versions, and a CloudWatch alarm on error rate can trigger rollback. Rolling EC2 options and manual approvals do not shift alias traffic, so the canary configuration is the answer.
Task statements 4
Official task statements from the Amazon Web Services outline, in outline order.
1.1 Implement CI/CD pipelinesRepositories, source integration, build setup, secrets and deployment strategy selection.
- What it means
- This task covers configuring code, image and artifact repositories, triggering pipelines from version control, setting up CodeBuild projects with buildspec files, injecting build and deployment secrets from Secrets Manager or Systems Manager Parameter Store, and choosing an appropriate CodeDeploy strategy for each target.
- What to understand
- CodePipeline orchestrates stages and actions, and source actions can start from CodeConnections (GitHub, GitLab, Bitbucket), CodeCommit, S3 or ECR. CodeBuild reads a buildspec and can pull secrets through the env secrets-manager or parameter-store sections, so no credentials live in source. Cross-account pipelines need a customer managed KMS key for the artifact bucket and roles the pipeline can assume in target accounts.
- How it shows up
- A pipeline requirement is described, such as cross-account delivery or secret handling, and you choose the configuration that satisfies it.
- Common confusion
- Storing secrets as plaintext environment variables in a CodeBuild project instead of referencing Secrets Manager or Parameter Store.
1.2 Integrate automated testing into CI/CD pipelinesPull request builds, load testing, exit codes, unit tests, coverage and test invocation.
- What it means
- This task covers running builds and tests when pull requests open or code merges, adding load, stress and performance tests at scale, judging success from process exit codes, automating unit tests with coverage reports, and invoking AWS services such as Lambda or CodeBuild from a pipeline stage to run tests.
- What to understand
- A nonzero exit code from a build command fails the CodeBuild phase and stops the pipeline, which is how tests act as gates. CodeBuild report groups collect test and coverage results. Pull request events from the source provider can start a validation build before merge. Longer tests such as load runs often sit in a separate stage after deployment to a staging environment.
- How it shows up
- Defects reach production or tests run too late, and you choose where and how to run the automated check.
- Common confusion
- Expecting a failing test to stop the pipeline when the build command swallows the exit code and returns success.
1.3 Build and manage artifactsArtifact repositories, build tooling and automated AMI and container image creation.
- What it means
- This task covers creating and configuring artifact repositories in CodeArtifact, Amazon S3 and Amazon ECR, configuring CodeBuild or Lambda to produce build artifacts, and automating EC2 AMI and container image pipelines with EC2 Image Builder.
- What to understand
- CodeArtifact hosts npm, Maven, PyPI, NuGet and other packages and can proxy public upstream repositories, which caches dependencies and controls what developers pull. ECR stores container images with lifecycle policies, image scanning and cross-Region or cross-account replication. EC2 Image Builder runs build and test components on a schedule or trigger and distributes the resulting images to other Regions and accounts.
- How it shows up
- A package, image or golden AMI need is described, and you pick the repository or image pipeline that fits.
- Common confusion
- Using hand-built AMIs from a running instance when the scenario asks for repeatable, patched, tested images.
1.4 Implement deployment strategies for instance, container, and serverless environmentsRepository permissions, deployment agents, troubleshooting and blue/green or canary methods.
- What it means
- This task covers granting IAM access to artifact repositories, installing and configuring the CodeDeploy agent, troubleshooting failed deployments, and applying deployment methods such as in-place, rolling, blue/green, canary and linear across EC2 and on-premises servers, Amazon ECS and AWS Lambda.
- What to understand
- The CodeDeploy agent runs only on EC2 and on-premises hosts; ECS and Lambda deployments have no agent and shift traffic instead. On EC2, the instance profile must allow reads from the artifact bucket. Lifecycle hooks such as BeforeInstall, AfterInstall and ValidateService in appspec run scripts, and a failing hook fails the deployment. Blue/green for ECS swaps target groups behind the load balancer.
- How it shows up
- A release must meet downtime and rollback goals on a stated platform, and you choose the method or fix the failure.
- Common confusion
- Assuming ECS or Lambda deployments need the CodeDeploy agent; only EC2 and on-premises compute platforms use it.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
AWS CodePipeline
Managed release orchestration with stages and actions.
- Remember
- V2 pipelines support triggers with Git tag and branch filters.
- Tested as
- Backbone of most pipeline scenarios.
- Trap
- Thinking it compiles code; CodeBuild does the building.
-
AWS CodeBuild
Managed build service driven by a buildspec file.
- Remember
- Nonzero exit codes fail the build phase.
- Tested as
- Build, test and packaging questions.
- Trap
- Hard-coding credentials instead of using the buildspec secrets sections.
-
AWS CodeDeploy
Deploys to EC2, on-premises servers, ECS and Lambda.
- Remember
- Deployment configurations control how fast traffic or instances change.
- Tested as
- Release strategy and rollback questions.
- Trap
- Expecting the agent on ECS or Lambda.
-
appspec file
Defines files, permissions and lifecycle hooks for a CodeDeploy deployment.
- Remember
- Hook scripts that fail stop the deployment.
- Tested as
- Troubleshooting failed deployments.
- Trap
- Putting appspec logic in the buildspec.
-
Canary and linear configurations
Shift a percentage of traffic first, then the rest, or in equal steps.
- Remember
- Available for Lambda and ECS deployments.
- Tested as
- Gradual release scenarios.
- Trap
- Choosing all-at-once when risk control is required.
-
Blue/green deployment
Runs a new environment beside the old and switches traffic.
- Remember
- Rollback is fast because the old environment remains.
- Tested as
- Zero-downtime requirements.
- Trap
- Ignoring the cost of temporarily doubled capacity.
-
AWS CodeArtifact
Managed package repository with upstream proxying.
- Remember
- Domains share storage across repositories.
- Tested as
- Dependency control questions.
- Trap
- Storing packages in ad hoc S3 paths without versioning controls.
-
EC2 Image Builder
Automated pipeline that builds, tests and distributes AMIs and container images.
- Remember
- Can share outputs across Regions and accounts.
- Tested as
- Golden image scenarios.
- Trap
- Manually snapshotting instances instead.
-
Amazon ECR
Managed container registry with scanning and replication.
- Remember
- Lifecycle policies expire old images.
- Tested as
- Container artifact questions.
- Trap
- Forgetting repository policies for cross-account pulls.
-
Cross-account artifact access
Pipeline in one account deploying into others.
- Remember
- Needs a customer managed KMS key and assumable roles.
- Tested as
- Multi-account delivery scenarios.
- Trap
- Using the default S3 managed key, which other accounts cannot use.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
CodeDeploy deployment types
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| In-place (EC2) | Updates existing instances | No extra capacity, some downtime per batch | Expecting instant rollback |
| Blue/green (EC2) | New instances behind the load balancer | Old fleet kept for rollback | Overlooking duplicate cost |
| Canary (Lambda/ECS) | Small share first, then the rest | Two traffic steps | Confusing it with linear |
| Linear (Lambda/ECS) | Equal increments at fixed intervals | Many small steps | Assuming it is faster than canary |
Artifact stores
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| CodeArtifact | Language package repository | Upstream proxy for public registries | Using it for container images |
| Amazon ECR | Container image registry | Scanning and replication | Storing zip bundles there |
| Amazon S3 | General object store for build outputs | Default pipeline artifact location | Skipping versioning and encryption |
Secret sources for builds
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Secrets Manager | Stores and rotates secrets | Built-in rotation | Assuming Parameter Store rotates automatically |
| Parameter Store SecureString | KMS-encrypted parameters | No native rotation, lower cost | Using String instead of SecureString |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Agent everywhere
- What candidates pick
- Install the CodeDeploy agent on Fargate tasks.
- Why it looks right
- The agent is central to EC2 deployments.
- Why it's wrong
- ECS and Lambda deployments use traffic shifting through the service, so no agent is installed or needed.
Clue to watch for Compute platform is ECS, Fargate or Lambda.
-
Manual approval as a test
- What candidates pick
- Add a manual approval action to catch regressions.
- Why it looks right
- Approvals feel like quality control.
- Why it's wrong
- A human approval does not run tests; automated test actions with exit codes are what gate quality.
Clue to watch for The requirement says automated testing.
-
Rolling equals zero downtime
- What candidates pick
- Pick a rolling in-place deployment.
- Why it looks right
- Some instances stay in service.
- Why it's wrong
- Capacity drops during batches and rollback means redeploying, so it misses strict zero-downtime and fast-rollback needs.
Clue to watch for Words like instant rollback or no reduced capacity.
-
Secrets in environment variables
- What candidates pick
- Set the database password as a plaintext CodeBuild variable.
- Why it looks right
- It works quickly.
- Why it's wrong
- Plaintext variables appear in the console and logs; reference Secrets Manager or SecureString parameters instead.
Clue to watch for Credentials needed during build or deploy.
-
Default key cross-account
- What candidates pick
- Keep the artifact bucket on the default S3 managed key.
- Why it looks right
- Encryption is already on.
- Why it's wrong
- Target accounts cannot be granted use of an AWS managed key, so they cannot decrypt artifacts.
Clue to watch for Pipeline deploys into another account.
-
Rebuild per environment
- What candidates pick
- Rebuild the artifact separately for test and production.
- Why it looks right
- Each environment gets fresh output.
- Why it's wrong
- Promoting the same tested artifact is what proves production matches what passed tests.
Clue to watch for Requirement to deploy exactly what was tested.
Answer framework
Use these five checks to work through any DOP-C02 pipeline or release scenario before choosing an answer.
- Identify the compute platform first: EC2 and on-premises, ECS, or Lambda, because it decides agents and available deployment configurations.
- Read the release constraints: allowed downtime, rollback speed, traffic control and cost tolerance, then shortlist in-place, blue/green, canary or linear.
- Find where quality must be checked, and place unit tests in the build stage and integration or load tests after a staging deployment.
- Check how secrets, artifacts and permissions flow, including KMS keys, instance profiles and cross-account roles, since many failures hide there.
- Prefer managed AWS services and automatic rollback on CloudWatch alarms over custom scripts or manual steps when the question stresses low overhead.
Practice question
Want more like this? The DOP-C02 practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with a working pipeline of your own. Build a CodePipeline that pulls from a Git repository through CodeConnections, runs CodeBuild with a buildspec that executes unit tests and publishes a report, and deploys with CodeDeploy. Break it on purpose: make a test fail, remove the instance profile permission to the artifact bucket, and add a failing ValidateService hook. Reading the resulting errors teaches more than diagrams do.
Next, repeat the deployment step for each compute platform. Deploy the same app to EC2 with blue/green, to ECS with a canary configuration, and to Lambda with a linear configuration, and compare what CodeDeploy changes in each case. Then add CodeArtifact with an upstream repository and an EC2 Image Builder pipeline so the artifact side feels concrete.
Given the 22% weight, plan to spend about a quarter of your total study time here. Finish with timed scenario questions and, for every miss, write down which constraint in the stem you overlooked.
FAQ
How much of the DOP-C02 exam is SDLC Automation?
SDLC Automation is 22% of scored content, the largest of the six domains, which works out to about 14 of the 65 scored questions.
Do I need to know CodeCommit for DOP-C02?
The exam guide names repositories in general rather than one product. Know how CodePipeline connects to CodeCommit, S3, ECR and third-party Git providers through CodeConnections, since scenarios may use any of them.
Which deployment configurations come up most?
Expect CodeDeploy blue/green for EC2 and ECS, plus canary and linear traffic shifting for Lambda and ECS. Know the predefined configuration names and when each limits risk.
Does DOP-C02 test Jenkins or other third-party tools?
The focus is on AWS services. Third-party tools appear mainly as sources or integrations, so learn how AWS services connect to them rather than their internals.
How are secrets handled in pipelines?
Store them in Secrets Manager or Parameter Store SecureString and reference them from the buildspec or task definition. The build role needs permission to read and decrypt them.
Is there a newer version of the DevOps Professional exam?
Not as of 31 October 2026. DOP-C02 is the current exam guide, and AWS has not announced a DOP-C03, although several other AWS exams received new versions in late 2026.
How should I study this domain if I mainly use GitHub Actions?
Map each concept you know to its AWS equivalent, then build the AWS-native pipeline once. The exam asks how CodePipeline, CodeBuild and CodeDeploy behave, not general CI theory.
Other DevOps & Containers certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 1 knowledge
You have covered pipelines, automated testing, artifacts and deployment strategies. Check whether you can pick the right release method under timed conditions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the DOP-C02 AI tutor Get any concept explained your way