The AWS Service & Command Reference
DOP-C02 will never hand you a terminal. Every question is scenario text and four answer choices, and a large fraction of those choices are literal AWS CLI invocations, CloudFormation fragments, or CDK snippets — one of them correct, three of them wrong in some specific, learnable way: the wrong CLI service name, a flag that doesn't default the way the distractor assumes, a command that applies to the wrong compute platform. This page is that fast-lookup layer, organized the same way the exam is — six domains, the services and commands each one draws on, and the exact traps AWS likes to bait a wrong answer with. It is deliberately the DOP-C02 counterpart to a hands-on exam's CLI speed reference, rebuilt for recognition instead of recall: you don't need to type any of this from a blank file, you need to spot which line is right when it's sitting next to three lines that are almost right.
Imagine a test where every question shows you four walkie-talkies and asks which one actually reaches the fire station. They all look almost identical — same size, same antenna, same red button. Only one of them is tuned to the right channel. You don't have to build a walkie-talkie from scratch during the test; you just have to already know, at a glance, which channel each button is supposed to be on. This page is the channel list.
How to use this reference — recognition, not recall
☺ Like you're 10: You're not writing any of this from memory during the exam — you're picking the one true sentence out of four that all sound plausible.
Compare this honestly against a performance-based exam's docs map. A hands-on cloud-native exam gives you an allowlisted browser tab and tests whether you can produce a working manifest under time pressure — recall matters because there's a blank file waiting. DOP-C02 is the opposite shape entirely: it's 100% multiple-choice and multiple-response, there is no terminal, no code editor, and no documentation tab of any kind open during the test — see No Docs Map — Closed Book for exactly what that means logistically. So the skill this page trains isn't "can I type aws cloudformation create-change-set from an empty prompt" — it's "when a scenario answer choice shows me aws cloudformation update-stack where a change set was clearly called for, do I catch it in the four seconds I have to catch it." Read each table below once for shape. Then, when you hit the mock exams, come back here only if you got a command-shaped question wrong — that gap is your real study list, and it will be shorter than this page.
| Domain | Weight | Jump to |
|---|---|---|
| D1 — SDLC Automation | 22% | Services & commands ↓ |
| D2 — Configuration Management & IaC | 17% | Services & commands ↓ |
| D3 — Resilient Cloud Solutions | 15% | Services & commands ↓ |
| D4 — Monitoring & Logging | 15% | Services & commands ↓ |
| D5 — Incident & Event Response | 14% | Services & commands ↓ |
| D6 — Security & Compliance | 17% | Services & commands ↓ |
For the conceptual version of each domain — what it actually tests, why, and how it maps back to the tool-neutral practices earlier in this course — read the six blueprint pages linked in each section below before you lean on this page's tables alone. This page assumes that reading and skips straight to the surface area: service names, CLI aliases, and the specific flags an exam-writer likes to swap out.
The console name isn't always the CLI name
☺ Like you're 10: A service can have one friendly name on the console and a totally different, older name in the command line — and a wrong-answer choice loves to use the friendly name where it doesn't belong.
This is the single highest-value table on this page, because it's the trap that doesn't require knowing anything about what a service does — it only requires knowing what it's called in aws-cli, and a distractor answer built from the console name reads as completely plausible right up until you know better. AWS's CLI namespaces were locked in at each service's launch; the marketing name attached to that service kept evolving afterward, and the two drifted apart more than once.
| Console / exam name | CLI service alias | Why it trips people up |
|---|---|---|
| CodeDeploy | deploy | There is no codedeploy namespace at all — every command is aws deploy ... |
| Amazon EventBridge | events | A hand-me-down from CloudWatch Events, EventBridge's previous name — the CLI never renamed the namespace |
| Systems Manager Incident Manager | ssm-incidents | It's a Systems Manager capability conceptually, but it's a separate top-level CLI service — not a set of ssm subcommands |
| AWS Config | configservice | There is no aws config namespace — a scenario answer that writes one is wrong on syntax alone |
| Amazon CloudWatch Logs | logs | A sibling of cloudwatch (metrics and alarms only), not a subcommand under it |
| AWS Certificate Manager | acm | Easy to reach for aws certificatemanager — that namespace doesn't exist |
| Elastic Load Balancing (ALB / NLB) | elbv2 | The older elb namespace targets Classic Load Balancers only — using it against an ALB silently targets the wrong resource type |
| Application Auto Scaling | application-autoscaling | A completely different service from EC2's autoscaling, despite the near-identical name — this is what scales ECS services, DynamoDB capacity, and Aurora read replicas |
Every CLI service alias on this page was checked against a current aws-cli install in August 2026. AWS does occasionally add or reshuffle namespaces as services evolve — treat this table as "true as of this check" and, if you have aws-cli installed while you study, confirm any alias you're unsure of with aws help or aws <service> help rather than trusting memory alone on exam day.
D1 — SDLC Automation (22%): pipeline, build & deploy
☺ Like you're 10: Five tools that each do exactly one job in getting code from a commit to something running — dispatch, build, ship, store the package, store the image.
The exam's largest domain, and the one this page's sibling tool page covers in the most practical depth — see AWS Developer Tools for the full CodePipeline/CodeBuild/CodeDeploy walkthrough and SDLC Automation for the exam's own framing of it. What follows is the condensed lookup table plus the commands a scenario question is most likely to quote.
| Service | CLI alias | What it's for | One thing to remember |
|---|---|---|---|
| CodePipeline | codepipeline | Orchestrates stages and actions; has no compute or build capability of its own | A manual-approval action and the deploy action after it share a stage but need different runOrder values to actually block one another |
| CodeBuild | codebuild | Runs buildspec.yml's four phases inside a fresh, disposable container | privileged: true on the project is required the instant the build itself runs docker build |
| CodeDeploy | deploy | Ships to EC2/on-premises, Lambda, or ECS | Automatic rollback only fires when a CloudWatch alarm is explicitly attached to that specific deployment group's rollback configuration |
| CodeArtifact | codeartifact | Private package repository (npm, PyPI, Maven, NuGet, generic) with public-upstream passthrough | Auth tokens expire — 12 hours is the maximum lifetime — so a build that worked yesterday and fails today on an auth error is usually just a stale token, not a permissions regression |
| Amazon ECR | ecr | Private container image registry | get-login-password returns a short-lived token piped straight into docker login — there's no long-lived credential to leak into a build log |
| AWS SAM | own CLI: sam | A framework for serverless apps that wraps CloudFormation | AWS::Serverless::Function is a macro/transform CloudFormation expands at deploy time — it isn't a native resource type you'll find in the raw CloudFormation reference |
# CodePipeline — orchestration only, no compute of its own
$ aws codepipeline start-pipeline-execution --name checkout-pipeline
$ aws codepipeline get-pipeline-state --name checkout-pipeline
$ aws codepipeline put-approval-result --pipeline-name checkout-pipeline \
--stage-name Deploy --action-name ManualApproval \
--result summary="reviewed, shipping",status=Approved --token abc123token
# CodeBuild — one buildspec.yml, four phases, then the container disappears
$ aws codebuild start-build --project-name checkout-build \
--environment-variables-override name=IMAGE_TAG,value=abc1234,type=PLAINTEXT
$ aws codebuild batch-get-builds --ids checkout-build:1a2b3c4d-5678-90ab-cdef
# CodeDeploy — the CLI service name is "deploy", not "codedeploy"
$ aws deploy create-deployment --application-name checkout \
--deployment-group-name checkout-prod \
--s3-location bucket=checkout-artifacts,key=build.zip,bundleType=zip
$ aws deploy stop-deployment --deployment-id d-ABCDEF123 --auto-rollback-enabled
# CodeArtifact — token-based auth, 12h max lifetime
$ aws codeartifact get-authorization-token --domain acme --domain-owner 111122223333 \
--query authorizationToken --output text
$ aws codeartifact login --tool npm --repository app-deps --domain acme
# ECR — docker login through a generated token, not a saved credential
$ aws ecr get-login-password --region us-east-1 | \
docker login --username AWS --password-stdin 111122223333.dkr.ecr.us-east-1.amazonaws.com
# SAM CLI — its own binary, wraps CloudFormation package/deploy underneath
$ sam build
$ sam deploy --guided
$ sam local invoke CheckoutFunctionA scenario describing "the deployment should automatically roll back if error rates spike" almost always tests whether you know rollback isn't automatic just because CodeDeploy is in the picture — it fires only when a named CloudWatch alarm is wired into that deployment group's rollback configuration. An answer choice with no alarm mentioned anywhere is a deployment that will happily ship a broken build to 100% and stay there.
D2 — Configuration Management & IaC (17%): CloudFormation, the CDK & Systems Manager
☺ Like you're 10: One engine actually creates the AWS resources, one lets you write real code that turns into that engine's instructions, and one keeps servers that already exist in the shape you told them to be.
Tied for the exam's second-heaviest domain. Configuration Management & IaC covers the concepts; this table is the command surface underneath them.
| Service | CLI alias | What it's for | One thing to remember |
|---|---|---|---|
| CloudFormation | cloudformation | The declarative provisioning engine underneath the CDK, SAM, and most "IaC" scenario answers | A stack stuck in ROLLBACK_COMPLETE can't be updated at all — only deleted and recreated |
| CDK | own CLI: cdk | Code-first front end (TypeScript, Python, Java, C#, Go) that synthesizes to a plain CloudFormation template | cdk bootstrap must run once per account/region — before that, cdk deploy has nothing to deploy into |
| CloudFormation StackSets | cloudformation (create-stack-set / create-stack-instances) | One template, deployed and kept in sync across many accounts and regions from an admin account | Service-managed permissions (via Organizations) vs. self-managed IAM roles is the exam's favorite branch point on this feature |
| Systems Manager | ssm | Configures fleets that already exist — the managed-service answer to Ansible/Puppet/Chef | Parameter Store SecureString is not Secrets Manager — Parameter Store doesn't rotate a value on its own |
| Organizations | organizations | Multi-account structure, consolidated billing, service control policies | An SCP sets a ceiling, it never grants — a wide-open SCP plus an empty IAM policy still denies everything |
| Control Tower | mostly console/CloudFormation-driven | An opinionated landing zone built on Organizations, Config, and CloudTrail | Guardrails aren't permissions — a "mandatory" guardrail is SCP-backed and preventive; a "strongly recommended" one is Config-backed and only detective |
# CloudFormation — change sets are the safe path; update-stack skips the preview entirely
$ aws cloudformation create-change-set --stack-name checkout \
--template-body file://template.yaml --change-set-type UPDATE
$ aws cloudformation describe-change-set --stack-name checkout --change-set-name my-changes
$ aws cloudformation execute-change-set --stack-name checkout --change-set-name my-changes
$ aws cloudformation deploy --template-file packaged.yaml --stack-name checkout \
--capabilities CAPABILITY_NAMED_IAM --no-fail-on-empty-changeset
# Drift, and the command that recovers a stack a plain update can't touch
$ aws cloudformation detect-stack-drift --stack-name checkout
$ aws cloudformation describe-stack-resource-drifts --stack-name checkout \
--stack-resource-drift-status-filters MODIFIED DELETED
$ aws cloudformation continue-update-rollback --stack-name checkout # UPDATE_ROLLBACK_FAILED only
# StackSets — one template, many accounts and regions
$ aws cloudformation create-stack-set --stack-set-name org-baseline --template-body file://baseline.yaml
$ aws cloudformation create-stack-instances --stack-set-name org-baseline \
--deployment-targets OrganizationalUnitIds=ou-abcd-12345678 --regions us-east-1 eu-west-1
# CDK — synthesizes down to the exact CloudFormation flow above
$ cdk bootstrap aws://111122223333/us-east-1 # once per account/region — stack name CDKToolkit
$ cdk synth
$ cdk diff
$ cdk deploy
# Systems Manager — configuring fleets that already exist
$ aws ssm send-command --document-name AWS-RunShellScript \
--targets Key=tag:Env,Values=prod --parameters commands="systemctl restart app"
$ aws ssm get-parameter --name /checkout/prod/db-password --with-decryptionCDK constructs worth recognizing
| Construct | Level | What it is | Exam-relevant note |
|---|---|---|---|
App | Root | The tree's root; holds one or more Stacks | An app isn't itself deployed — cdk deploy targets the stacks inside it |
Stack | Root | Maps 1:1 to exactly one CloudFormation stack | Everything inside it synthesizes to the same template you'd get hand-writing CloudFormation |
Stage | Grouping | Groups stacks together for promotion across environments | What CDK Pipelines actually deploys one environment at a time, self-mutating on its own structure first |
CfnBucket, CfnFunction, etc. | L1 | Auto-generated, a 1:1 mirror of one CloudFormation resource type | Property names match the raw CloudFormation spec exactly — most verbose, least opinionated of the three levels |
Bucket, Function (aws-s3, aws-lambda) | L2 | Hand-curated, with sensible defaults and typed helper methods | bucket.grantRead(role) writes the IAM policy for you instead of you hand-authoring it |
ApplicationLoadBalancedFargateService (ecs-patterns) | L3 (pattern) | A whole reference architecture — ALB, service, task definition — behind one construct | Fastest to write, and the least visible about exactly what it provisions underneath |
RemovalPolicy | Property | Controls what happens to a resource when its stack is destroyed | Defaults mirror CloudFormation's own default (effectively Delete) — RETAIN is opt-in, not a built-in safety net |
Aspects | Cross-cutting | A visitor applied across every construct in a tree — tagging, policy checks | Runs at synth time, before a template ever exists — not a runtime/deploy-time check |
CfnOutput | Output | Exposes a value the same way a CloudFormation Outputs block does | How one Stack hands a value — a VPC ID, an ARN — to another stack in the same app |
A stack in UPDATE_ROLLBACK_FAILED and a stack in ROLLBACK_COMPLETE look like the same problem and need opposite fixes. UPDATE_ROLLBACK_FAILED recovers with continue-update-rollback, often after skipping the one resource that won't roll back cleanly. ROLLBACK_COMPLETE — a failed create that finished rolling itself back — cannot be updated at all; the only way forward is delete and recreate. An answer choice that tries update-stack against a ROLLBACK_COMPLETE stack is simply wrong, not just slow.
D3 — Resilient Cloud Solutions (15%): scaling, load balancing & failover
☺ Like you're 10: Keeping the right number of healthy copies running, sending traffic only to the ones that answer, and having a second site ready if the first one goes dark.
Concepts in Resilient Cloud Solutions; the command surface for Auto Scaling, load balancing, DNS failover, and managed databases follows.
| Service | CLI alias | What it's for | One thing to remember |
|---|---|---|---|
| Auto Scaling (EC2) | autoscaling | Maintains a target instance count inside an Auto Scaling Group | Target tracking is the exam's default-recommended policy type over step or simple scaling |
| Elastic Load Balancing (ALB/NLB) | elbv2 | Routes to healthy targets inside a target group | Health is evaluated per target group, not per instance — one target can be "unhealthy" in one target group and perfectly fine in another |
| Route 53 | route53 | DNS plus health-check-driven routing — failover, weighted, latency, geolocation | Failover routing needs a health check wired to the PRIMARY record; SECONDARY only answers once that check reports unhealthy |
| RDS / Aurora | rds | Managed relational databases | A Multi-AZ standby is not a read replica — it isn't readable, and failover is a deliberate action, not automatic promotion on every blip |
| AWS Backup | backup | Centralized, policy-driven backup across services | A backup plan with no resource assignment wired to it silently backs up nothing — no error, just an empty vault |
# Auto Scaling — target tracking is the exam's default-recommended policy type
$ aws autoscaling put-scaling-policy --auto-scaling-group-name checkout-asg \
--policy-type TargetTrackingScaling --target-tracking-configuration file://tt-config.json
$ aws autoscaling update-auto-scaling-group --auto-scaling-group-name checkout-asg \
--min-size 2 --max-size 10 --desired-capacity 4
# ELB — target health, not instance health, is what a listener actually routes on
$ aws elbv2 describe-target-health --target-group-arn arn:aws:elasticloadbalancing:us-east-1:111122223333:targetgroup/checkout/abc123
# Route 53 — failover routing needs a health check wired to the PRIMARY record
$ aws route53 create-health-check --caller-reference checkout-2026 \
--health-check-config file://health-check.json
$ aws route53 change-resource-record-sets --hosted-zone-id Z1PA6795UKMFR9 \
--change-batch file://failover-primary.json
# RDS / Aurora — Multi-AZ is provisioned at create time; failover is a deliberate action
$ aws rds create-db-instance --db-instance-identifier checkout-db --multi-az \
--engine postgres --db-instance-class db.r6g.large --master-username admin
$ aws rds failover-db-cluster --db-cluster-identifier checkout-aurora \
--target-db-instance-identifier checkout-aurora-instance-2Two Route 53 records with no health check attached to either one is not failover routing — it's just two records, and which one answers is undefined from the client's point of view. Failover routing specifically requires a health check on the PRIMARY record; without it, "failover" in the routing policy name is doing nothing.
D4 — Monitoring & Logging (15%): CloudWatch, Logs Insights, X-Ray & CloudTrail
☺ Like you're 10: Numbers over time, searchable logs, a map of which request went where, and a permanent record of who did what.
Concepts in Monitoring & Logging; see also monitoring & observability for the tool-neutral foundation this domain sits on.
| Service | CLI alias | What it's for | One thing to remember |
|---|---|---|---|
| CloudWatch | cloudwatch | Metrics, alarms, dashboards | --treat-missing-data defaults to missing (ignored) — a metric that silently stops reporting does not trip the alarm by default |
| CloudWatch Logs | logs | Log storage plus the Logs Insights query language | start-query / get-query-results is two calls — Insights queries run asynchronously, not inline |
| X-Ray | xray | Distributed tracing and service maps | Needs the X-Ray daemon or an OTel-compatible collector actually running beside the app — installing the SDK alone produces no traces |
| CloudTrail | cloudtrail | Audit log of every API call made in the account | A trail is regional unless --is-multi-region-trail is set — a single-region trail misses every call made outside it |
# CloudWatch — the fields that make an alarm actually alarm
$ aws cloudwatch put-metric-alarm --alarm-name checkout-high-cpu \
--namespace AWS/EC2 --metric-name CPUUtilization --statistic Average \
--period 300 --evaluation-periods 2 --threshold 80 \
--comparison-operator GreaterThanThreshold --treat-missing-data missing \
--alarm-actions arn:aws:sns:us-east-1:111122223333:checkout-alerts
$ aws cloudwatch put-composite-alarm --alarm-name checkout-degraded \
--alarm-rule "ALARM(checkout-high-cpu) AND ALARM(checkout-high-latency)"
# Logs Insights — asynchronous: start the query, then poll for results
$ aws logs start-query --log-group-name /aws/lambda/checkout \
--start-time 1700000000 --end-time 1700003600 \
--query-string 'fields @timestamp, @message | filter @message like /ERROR/'
$ aws logs get-query-results --query-id abcd-1234-efgh-5678
# Cross-account / cross-region log aggregation
$ aws logs put-subscription-filter --log-group-name /aws/lambda/checkout \
--filter-name ship-to-central --filter-pattern "" \
--destination-arn arn:aws:firehose:us-east-1:222233334444:deliverystream/central-logs
# X-Ray and CloudTrail
$ aws xray get-trace-summaries --start-time 1700000000 --end-time 1700003600
$ aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteBucket"The alarm should fire if the service stops reporting metrics" is not what a CloudWatch alarm does by default. treat-missing-data defaults to missing, which simply skips evaluation for that period — the alarm neither fires nor clears. A scenario that actually wants a stalled metric to page someone needs treat-missing-data breaching set explicitly.
D5 — Incident & Event Response (14%): EventBridge, Automation & Incident Manager
☺ Like you're 10: Something changes, a rule notices, a robot runbook tries to fix it, and if that's not enough, a real person gets paged with everything already gathered for them.
The exam's lightest domain by weight, still worth roughly one question in seven. Concepts in Incident & Event Response; the tool-neutral version in incident management.
| Service | CLI alias | What it's for | One thing to remember |
|---|---|---|---|
| EventBridge | events | Event bus, rules, scheduled and pattern-matched targets | The CLI namespace is a hand-me-down from CloudWatch Events — eventbridge is not a real namespace |
| Systems Manager Automation | ssm | Documented runbooks (SSM documents) that remediate without a human in the loop | Automation runs a document's steps strictly in order — nothing rolls back automatically if a later step fails |
| Incident Manager | ssm-incidents | Formal incident response: response plans, escalation, a shared timeline | Needs a response plan created ahead of time — start-incident against a plan that doesn't exist yet just errors |
| SNS | sns | Pub/sub fan-out; the layer most paging tools subscribe to | A filter policy lives on the subscription, not the topic — that's what lets one topic serve several different alert routes |
| AWS Chatbot | chatbot | Routes SNS/EventBridge notifications into Slack or Chime | Needs an IAM role scoped to exactly what it's allowed to read back into chat — an over-scoped one is a live audit finding, not a hypothetical |
# EventBridge — CLI service name is "events", not "eventbridge"
$ aws events put-rule --name nightly-scan --schedule-expression "rate(1 day)"
$ aws events put-rule --name ec2-state-change \
--event-pattern '{"source":["aws.ec2"],"detail-type":["EC2 Instance State-change Notification"]}'
$ aws events put-targets --rule ec2-state-change \
--targets "Id=1,Arn=arn:aws:lambda:us-east-1:111122223333:function:notify-oncall"
# Systems Manager Automation — a documented runbook, not an ad-hoc script
$ aws ssm start-automation-execution --document-name AWS-RestartEC2Instance \
--parameters "InstanceId=i-0123456789abcdef0"
# Incident Manager — CLI service name is "ssm-incidents"
$ aws ssm-incidents start-incident \
--response-plan-arn arn:aws:ssm-incidents::111122223333:response-plan/checkout-sev1
# SNS — the fan-out layer under most paging integrations
$ aws sns publish --topic-arn arn:aws:sns:us-east-1:111122223333:checkout-alerts \
--message "Deployment checkout-prod rolled back automatically"
$ aws sns set-subscription-attributes --subscription-arn arn:aws:sns:us-east-1:111122223333:checkout-alerts:sub-id \
--attribute-name FilterPolicy --attribute-value '{"severity":["critical"]}'A rule and a target are two different objects, created with two different calls — put-rule defines the pattern or schedule, put-targets is what actually connects it to a Lambda function, an SSM document, or anything else. A scenario answer that only calls put-rule has built a rule that matches events and does precisely nothing with them.
D6 — Security & Compliance (17%): IAM, KMS, Config, GuardDuty & Security Hub
☺ Like you're 10: Who's allowed to do what, how things stay encrypted, whether the account still matches the rules, and two different systems that both watch for trouble.
Tied for the exam's second-heaviest domain. Concepts in Security & Compliance; secrets specifically get a deeper treatment in Secrets & Credential Management.
| Service | CLI alias | What it's for | One thing to remember |
|---|---|---|---|
| IAM | iam | Identities, roles, policies | Explicit Deny always wins, and no matching statement is itself an implicit Deny — there is no default Allow anywhere in IAM |
| KMS | kms | Managed encryption keys | enable-key-rotation only automates rotation for AWS-managed key material — imported key material rotates on a different mechanism entirely |
| Secrets Manager | secretsmanager | Rotatable secrets with built-in rotation Lambda templates | Unlike Parameter Store, it ships ready-made rotation templates for RDS, Redshift, and DocumentDB — that's the actual "why Secrets Manager over Parameter Store" answer, not price alone |
| AWS Config | configservice | Continuous compliance evaluation against rules | A custom Lambda-backed rule with no trigger type configured (configuration-change vs. periodic) simply never runs |
| GuardDuty | guardduty | ML-based threat detection from VPC Flow Logs, DNS logs, and CloudTrail | A detector must be explicitly enabled per region — a region with no detector produces no findings, it doesn't borrow another region's |
| Security Hub | securityhub | Aggregates findings — including GuardDuty's — into one dashboard against compliance standards | Cross-region aggregation is opt-in through a designated home Region — it isn't automatic just because Security Hub is enabled everywhere |
# IAM — decisions, not documents: simulate before you assume the answer
$ aws iam create-role --role-name checkout-build-role --assume-role-policy-document file://trust.json
$ aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::111122223333:role/checkout-build-role \
--action-names s3:GetObject --resource-arns arn:aws:s3:::checkout-artifacts/*
$ aws sts assume-role --role-arn arn:aws:iam::111122223333:role/cross-account-deploy --role-session-name ci
# KMS and Secrets Manager
$ aws kms create-key --description "checkout app data key"
$ aws kms enable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab
$ aws secretsmanager rotate-secret --secret-id checkout/prod/db \
--rotation-lambda-arn arn:aws:lambda:us-east-1:111122223333:function:rotate-db-secret \
--rotation-rules AutomaticallyAfterDays=30
# AWS Config — CLI service name is "configservice", not "config"
$ aws configservice put-config-rule --config-rule file://required-tags-rule.json
$ aws configservice describe-compliance-by-config-rule --config-rule-names required-tags
$ aws configservice put-conformance-pack --conformance-pack-name pci-baseline \
--template-body file://pci-conformance-pack.yaml
# GuardDuty and Security Hub
$ aws guardduty list-findings --detector-id 12abc34d567e8901f2gh345i6789jkl
$ aws securityhub get-findings --filters '{"SeverityLabel":[{"Value":"CRITICAL","Comparison":"EQUALS"}]}'
$ aws securityhub batch-update-findings --finding-identifiers file://finding-ids.json \
--workflow '{"Status":"RESOLVED"}'aws config get-... is a syntactically appealing wrong answer precisely because "AWS Config" is the service's real name everywhere else — console, exam text, documentation. The CLI alone breaks the pattern with configservice, and an exam-writer who wants an easy distractor knows exactly how tempting the obvious guess is.
Flags and defaults that show up as wrong-answer bait
☺ Like you're 10: Most of these traps aren't about knowing a whole service — they're about knowing the one setting nobody bothers to change from its default, and what that default quietly does.
If you only revise one table in the last hour before the exam, revise this one — it's the cross-domain version of the single-domain warnings above, collected in one place because these are the specific defaults an exam-writer relies on you assuming wrong.
| Setting | Service | Default | What it means for a scenario |
|---|---|---|---|
--treat-missing-data | CloudWatch alarms | missing (ignored) | A metric that silently stops reporting does not trip the alarm unless this is set to breaching |
| Automatic rollback | CodeDeploy | Off unless wired | Requires a CloudWatch alarm explicitly attached to that deployment group's rollback configuration — an alarm existing elsewhere in the account does nothing |
| Stack recovery command | CloudFormation | State-dependent | UPDATE_ROLLBACK_FAILED → continue-update-rollback; ROLLBACK_COMPLETE → delete and recreate, full stop |
| Scaling cooldown | Auto Scaling | 300 seconds | Only governs simple/step scaling — target tracking policies manage their own cooldown internally and mostly ignore this setting |
| Policy evaluation | IAM | Implicit Deny | Explicit Deny always wins over Allow; no matching statement at all is itself a Deny — there's no default-Allow fallback anywhere |
| Rule trigger type | AWS Config | Must be set explicitly | A custom Lambda-backed rule with neither configuration-change nor periodic trigger configured simply never evaluates anything |
| Bucket default encryption | S3 | SSE-S3 on buckets created after Jan 2023 | Never assume for a bucket of unknown age — always check the bucket's own default-encryption setting rather than the service-wide rollout date |
| Failover answering | Route 53 | Requires a health check | Two records with no health check on the PRIMARY is not failover routing, regardless of what the routing policy is named |
RemovalPolicy | CDK | Effectively Delete | Mirrors CloudFormation's own default DeletionPolicy — a stateful resource with real data needs RETAIN set explicitly; it is not the built-in safety net people assume |
| Findings visibility | GuardDuty / Security Hub | Regional, opt-in per region | A region with no detector or no subscription produces zero findings there — they don't surface in another region's dashboard instead |
| Secret rotation | SSM Parameter Store | None built in | A SecureString parameter never rotates itself — that needs a hand-wired Lambda plus an EventBridge schedule, which Secrets Manager ships out of the box instead |
Test yourself before the real thing
☺ Like you're 10: Cover the answers, say the CLI name out loud, then check — the moment you hesitate on one is the moment you know what to restudy.
Cover everything below this line. For each service, say its CLI alias out loud before you check: CodeDeploy. EventBridge. AWS Config. Incident Manager. Application Auto Scaling. Elastic Load Balancing (ALB). Then answer four scenario-shaped questions without looking back: What does a CloudWatch alarm do by default when its metric stops reporting entirely? What single command recovers a stack stuck in UPDATE_ROLLBACK_FAILED, and does that same command work on ROLLBACK_COMPLETE? Which two separate API calls does an EventBridge rule need before it actually triggers anything? What CDK construct level is ApplicationLoadBalancedFargateService, and what's the trade-off of using it? Anything you hesitated on belongs on a flashcard — see flashcards — not a re-read of this page.
Nutty the Squirrel: Quick — AWS Config, in the CLI. What's the namespace?
Remy the Rabbit: aws config. Obviously. It's called AWS Config.
Nutty: Nope. There's no config namespace at all — it's aws configservice. And that exact mismatch is sitting in an answer choice somewhere on your exam.
Gizmo: Who cares, I'll just try aws cloudconfig too and see what sticks. 🤑
Timmy the Turtle: There's nothing to try on exam day, Gizmo — no terminal, no tab-completion. Four answer choices, one of them says aws config, and it's the wrong one every single time.
Remy: Fine. Quick again — EventBridge?
Nutty: events. Not eventbridge. It's a hand-me-down from CloudWatch Events, and the CLI never got the memo about the rename.
Foxy: Why does AWS even let the names drift apart like that?
Nutty: Because the CLI namespace locks in at launch, and the marketing name keeps evolving after. Learn the mismatch once, on your own time, and every "which command" question gets easier instead of scarier.
That's the fast-lookup layer: six domains, the services and CLI aliases each one leans on, the CDK constructs worth recognizing on sight, and the defaults an exam-writer counts on you assuming wrong. Pair it with Know It Cold for the facts that need to come back instantly rather than after a beat of thought, Answer Triage & Elimination for what to do when a question doesn't have an obviously right answer even after you've spotted every trap on this page, and the glossary when it's a term's meaning — not its CLI spelling — that won't come. Then go test it cold in Mock Exam · Set 1.
1. What's the CLI service alias for AWS Config, and why doesn't aws config work? 2. In CodeDeploy, exactly when does automatic rollback fire? 3. A CloudFormation stack shows UPDATE_ROLLBACK_FAILED — what command recovers it, and what has to happen instead if the stack is in ROLLBACK_COMPLETE? 4. What does --treat-missing-data default to on a CloudWatch alarm, and what does that mean for a metric that stops reporting entirely? 5. Name the three levels of CDK constructs and what distinguishes an L1 from an L2. 6. What's Application Auto Scaling's CLI alias, and how is it different from EC2 Auto Scaling's? 7. What does Route 53 failover routing need wired to the PRIMARY record before SECONDARY will ever answer?
Check your answers
configservice. There is noaws confignamespace in the CLI at all — the console and exam text both say "AWS Config," but the command line never adopted that name.- Only when a CloudWatch alarm has been explicitly attached to that specific deployment group's rollback configuration. An alarm that exists elsewhere in the account, watching the right metric but never wired to that deployment group, does nothing.
aws cloudformation continue-update-rollback --stack-name ...recoversUPDATE_ROLLBACK_FAILED, often after skipping the one resource that won't roll back cleanly. A stack inROLLBACK_COMPLETEcan't be updated at all — it has to be deleted and recreated.- Defaults to
missing, meaning the alarm simply skips evaluation for that period — it neither fires nor clears. A metric that silently stops reporting will not trip the alarm unlesstreat-missing-datais explicitly set tobreaching. - L1 (
Cfn*) — an auto-generated 1:1 mirror of a raw CloudFormation resource, most verbose. L2 — hand-curated with sensible defaults and typed helper methods likegrantRead(). L3 — a whole reference-architecture pattern behind one construct. L1 vs. L2: L1 exposes every CloudFormation property exactly as named in the spec; L2 wraps that with opinionated defaults and convenience methods. application-autoscaling— a completely separate service from EC2'sautoscaling, despite the nearly identical name. It's what scales ECS services, DynamoDB capacity, and Aurora read replicas, not EC2 instances in an ASG.- A health check. Without one attached to the
PRIMARYrecord, theSECONDARYrecord never activates — two records with no health check is just two records, not failover.