AWS Certified DevOps Engineer – Professional

This is the hardest operations-flavoured exam Amazon sells, and the one AWS credential that most closely resembles the job a platform engineer actually does: build the pipeline, express the infrastructure as code, keep the thing observable, respond when it breaks, and hold a hundred accounts in a governed shape. It is also, unavoidably, an exam about Amazon’s answers to those problems. Below: the official domains and weights straight from the AWS exam guide, the logistics with their caveats attached, an honest account of what transfers to a Kubernetes platform and what does not — and a clear recommendation about when to walk past it and spend the same 150 hours elsewhere.

What this credential is, and where it sits

☺ Like you’re 10: It is Amazon’s hardest “can you run things properly on our cloud?” badge. Amazon writes it, Amazon marks it, and it only counts for Amazon’s cloud.

The AWS Certified DevOps Engineer – Professional is issued by Amazon Web Services and, per the official exam guide, carries the code DOP-C02. AWS describes it as validating “technical expertise in provisioning, operating, and managing distributed systems and services on AWS,” with five headline abilities: run continuous delivery systems, automate security controls and compliance validation, define monitoring and logging, build systems that are highly available and self-healing, and maintain tooling that automates operational work. That is a strikingly good description of the platform-engineering job — which is why it deserves a page here, and why you have to be careful about it. The overlap is real; the vocabulary is not shared.

The AWS ladder around it

AWS organises its certifications into Foundational, Associate, Professional and Specialty tiers. The three Associate credentials that sit under DevOps Professional and share most of its ground are:

Note the rename in that last row, because it catches people out. AWS retired the “SysOps Administrator – Associate” name: per AWS’s own Coming soon to AWS Certification page, the last day to sit SOA-C02 under the old name was 29 September 2025, and AWS Certified CloudOps Engineer – Associate (SOA-C03) began the next day. The new badge is not applied retroactively to people holding the old one. If a study guide or a colleague still says “do SysOps first,” they mean CloudOps now.

The prerequisite AWS removed

Until the end of 2018, you could not sit a Professional exam without first holding the matching Associate certification. AWS scrapped that: its February 2019 announcement, New AWS Certification Policies Offer Customers More Choices and Flexibility, states plainly that “at the end of 2018, AWS Certification removed prerequisite requirements on all of its exams.” Today there is no formal prerequisite for DOP-C02 — you may book it cold.

Why a platform engineer might take it — and when to skip it

☺ Like you’re 10: If your whole platform lives inside Amazon, this badge teaches you your own house. If it does not, you are memorising someone else’s furniture.

The honest case for it

Take DOP-C02 if AWS is the substrate under your platform and will be for years. Most platform teams do not run Kubernetes on bare metal; they run EKS on top of an AWS account structure, with IAM as the real security boundary and a landing zone somebody built in CloudFormation before they arrived. This exam forces you to learn that layer underneath your cluster properly rather than by superstition — and that layer is where an alarming share of your incidents come from. It is also commonly named in enterprise job adverts and appears in AWS Partner Network competency requirements, which is a legitimate, unromantic reason to hold it. (We have not measured how often; treat “commonly” as an impression, not a statistic.)

A second real benefit: Domains 2 and 6 push you into multi-account governance — Organizations, Control Tower, service control policies, Config rules, Security Hub. Platform engineers routinely under-invest here and then discover that “self-service” means nothing if every new team needs a ticket to get an account.

The honest case against it

Now the part a marketing page will not tell you. A large fraction of this exam does not transfer. Knowing CodeDeploy hook ordering buys you precisely nothing on Google Cloud, on Azure, or on a Kubernetes-native platform built from Argo CD and Tekton. The CNCF credentials are built around portable, open specifications; this one is built around one vendor’s product catalogue, and that catalogue moves. It moves faster than the exam does: the guide’s own in-scope service list still names AWS Proton, AWS OpsWorks and AWS CodeStar, every one of which AWS has discontinued or is in the act of discontinuing. Part of what you would memorise for this exam is already dead outside it. Skip it — or defer it — if any of these is true:

What it actually tests — the six official domains

☺ Like you’re 10: Amazon publishes exactly what is on the test and how much each part counts. Here it is, copied faithfully — no guessing.

The DOP-C02 exam guide publishes six content domains with explicit weights. These are AWS’s names and AWS’s percentages, transcribed from the official guide — not summarised, not reordered by importance:

Two things follow. First, delivery is the single biggest slice at 22%, and adding Configuration Management and IaC puts you at 39% — nearly two-fifths of the exam is “how does software and infrastructure get from a repository into production, safely and repeatably.” That is the platform-engineering thesis in Amazon’s own words. Second, the exam is compensatory: AWS states you do not need to pass each section, only the overall exam — so you can be weak in one domain and still pass, which should change how you allocate revision time.

What the domains do not include

The guide is also explicit about what the target candidate is not expected to do: advanced networking (routing algorithms, failover techniques), deep security recommendations to developers, database design and query optimisation, and full-stack application development. That boundary tells you this is an exam about operating and delivering systems, not designing them from first principles — which is what separates it from Solutions Architect – Professional.

The substance you need to know

☺ Like you’re 10: Here are the actual files and commands. If these look familiar, you are closer than you think — they are the same ideas as your cluster tools, wearing different clothes.

Pipelines, the AWS way

Domain 1 revolves around three services that map cleanly onto ideas you already have. CodePipeline is the orchestrator (stages and actions — think a workflow engine). CodeBuild is the executor, configured by a buildspec.yml (think a Tekton Task). CodeDeploy is the release controller that knows how to do blue/green and canary shifts (think Argo Rollouts). Artifacts live in CodeArtifact, ECR or S3.

# buildspec.yml — read by AWS CodeBuild. Build an image, push it to ECR,
# and emit the image-reference file that the ECS deploy action consumes.
version: 0.2
env:
  variables:
    REGISTRY: "111122223333.dkr.ecr.eu-west-1.amazonaws.com"   # registry host only
    REPO_URI: "111122223333.dkr.ecr.eu-west-1.amazonaws.com/app"
phases:
  pre_build:
    commands:
      # docker login takes the REGISTRY host, not the repository path
      - aws ecr get-login-password --region "$AWS_REGION" \
          | docker login --username AWS --password-stdin "$REGISTRY"
      # commit ID for Git sources (version ID if the source is S3)
      - export TAG="$CODEBUILD_RESOLVED_SOURCE_VERSION"
  build:
    commands:
      - docker build -t "$REPO_URI:$TAG" .
      - docker push "$REPO_URI:$TAG"
  post_build:
    commands:
      # imageDetail.json is what the CodeDeployToECS (blue/green) action reads.
      # The rolling "Amazon ECS" action reads imagedefinitions.json instead —
      # a favourite exam distinction, and a favourite real-world pipeline bug.
      - printf '{"ImageURI":"%s"}' "$REPO_URI:$TAG" > imageDetail.json
artifacts:
  files:
    - imageDetail.json
    - appspec.yaml
    - taskdef.json

Then the release itself. A CodeDeploy appspec.yaml for an ECS blue/green deployment declares the target service and — the part the exam loves — the lifecycle hooks where you can run a Lambda function to verify the new version before any real traffic moves:

# appspec.yaml — AWS CodeDeploy, ECS blue/green.
version: 0.0
Resources:
  - TargetService:
      Type: AWS::ECS::Service
      Properties:
        TaskDefinition: "<TASK_DEFINITION>"        # CodePipeline substitutes this
        LoadBalancerInfo:
          ContainerName: "app"
          ContainerPort: 8080
Hooks:
  # ECS hook order: BeforeInstall, AfterInstall, AfterAllowTestTraffic,
  #                 BeforeAllowTraffic, AfterAllowTraffic
  # runs against the TEST listener, before any production traffic shifts
  - AfterAllowTestTraffic: "arn:aws:lambda:eu-west-1:111122223333:function:smoke-test"
  # last chance to abort: a FAILED hook fails the deployment, and the
  # deployment group rolls back if automatic rollback is enabled on it
  - BeforeAllowTraffic: "arn:aws:lambda:eu-west-1:111122223333:function:verify-slo"

IaC and multi-account governance

Domain 2 is CloudFormation (templates, change sets, StackSets across accounts and Regions), the CDK (real code that synthesises CloudFormation), SAM for serverless, Service Catalog for curated products, and Systems Manager and AWS Config for configuration state and drift. Domain 2 also owns account vending — its Task Statement 2.2 is literally “deploy automation to create, onboard, and secure AWS accounts in a multi-account or multi-Region environment,” and names Organizations, Control Tower, Security Hub, Detective, GuardDuty, Service Catalog and SCPs in its own skills list. So guardrail policy is examined in Domain 2 and Domain 6, not only in Domain 6. One of the most exam-relevant artefacts is the service control policy, an organisation-wide guardrail that sets the maximum permissions an account can ever have, no matter what its own IAM says:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyOutsideApprovedRegions",
      "Effect": "Deny",
      "NotAction": ["iam:*", "organizations:*", "sts:*", "route53:*", "support:*"],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": ["eu-west-1", "eu-central-1"]
        }
      }
    }
  ]
}

Read that as a guardrail, not a permission: an SCP never grants anything, it only removes. If that feels familiar, it should — it is the same shape as a Kyverno or Gatekeeper deny policy operating one layer down, and the same design principle covered in Governance & Compliance and Security & Policy. The global services in that NotAction list are the classic trap: deny them by Region and you lock yourself out of your own organisation.

Observability, incident response, and EKS

Domains 4 and 5 are CloudWatch (metrics, Logs, Logs Insights, metric filters, alarms, anomaly detection, dashboards), X-Ray for distributed tracing, CloudTrail for the audit record, and EventBridge as the nervous system that turns an event into an action. Amazon also runs Managed Service for Prometheus and Managed Grafana, both in scope — which is where the AWS world and the CNCF observability stack meet directly.

# Domain 4 — query structured logs without leaving the CLI.
# start-query is asynchronous: it returns a queryId, you poll for results.
# (date -v-1H is BSD/macOS; on GNU coreutils use: date -d '1 hour ago' +%s)
QID=$(aws logs start-query \
  --log-group-name /aws/lambda/checkout \
  --start-time "$(date -v-1H +%s)" --end-time "$(date +%s)" \
  --query-string 'fields @timestamp, @message
                  | filter @message like /ERROR/
                  | stats count() by bin(5m)' \
  --query queryId --output text)
aws logs get-query-results --query-id "$QID"

# Domain 5 — turn an event into an automated response.
# put-rule only creates the rule; put-targets is what makes it do something.
aws events put-rule --name ecs-task-stopped \
  --event-pattern '{"source":["aws.ecs"],"detail-type":["ECS Task State Change"],
                    "detail":{"lastStatus":["STOPPED"]}}'
aws events put-targets --rule ecs-task-stopped \
  --targets 'Id=1,Arn=arn:aws:sns:eu-west-1:111122223333:platform-alerts'

# Domain 2 — inspect the change set BEFORE it lands, then execute it.
# Plain `deploy` creates AND executes; --no-execute-changeset is the dry run.
aws cloudformation deploy --template-file platform.yaml --stack-name platform-prod \
  --capabilities CAPABILITY_NAMED_IAM --no-execute-changeset
aws cloudformation describe-change-set --stack-name platform-prod \
  --change-set-name CHANGE_SET_NAME_FROM_PREVIOUS_OUTPUT
cdk diff PlatformProdStack        # the CDK equivalent of a dry-run plan

# Domain 6 + EKS — bind a Kubernetes ServiceAccount to an IAM role (IRSA).
# EKS Pod Identity is the newer AWS mechanism for the same job; IRSA is the
# one the DOP-C02-era material assumes, and both are still supported.
eksctl create iamserviceaccount --cluster platform-prod \
  --namespace checkout --name checkout-sa \
  --attach-policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess --approve

That last command matters more than its size suggests. EKS is explicitly in scope — the guide lists Amazon EKS, EKS Distro, ECS, ECR, Fargate and even ROSA among in-scope services, and Domain 5 names EKS under “analysing incidents regarding failed processes.” The exam will not ask you to write a NetworkPolicy, but it will ask where a container platform’s failures surface. Everything on The Kubernetes Substrate applies; the AWS-specific part is the seam where IAM meets the cluster’s own identity model.

How it maps onto the CNPE and this site

☺ Like you’re 10: Almost every AWS domain has a twin somewhere on this site. Learn the twin first — it is the idea. The AWS version is one implementation of it.

Read this table left to right when studying for AWS; read it right to left to find the portable idea underneath that is actually worth your memory:

One row deserves a footnote. AWS’s own answer to the internal developer platform — AWS Proton — is still listed among the exam’s in-scope services (Management and Governance), and is being discontinued: per the official deprecation guide, new customers could not sign up after 7 October 2025 and support ends on 7 October 2026, after which the console and Proton resources become inaccessible (already-deployed CloudFormation stacks keep running). The alternatives AWS itself names are CloudFormation Git Sync, CodePipeline plus CodeBuild, GitHub Actions, and Harmonix on AWS — an AWS Partner solution built on Backstage. When the cloud vendor’s own migration guide points at the CNCF-ecosystem tool, that is a strong argument for learning Backstage and the ideas in Developer Experience ahead of any vendor’s portal product.

Exam logistics — attributed, and to be re-checked

☺ Like you’re 10: Here are the numbers Amazon published. Numbers move. Look them up yourself before you pay.

Everything in this table comes from the official AWS certification page and the official DOP-C02 exam guide, re-checked against those pages in July 2026. At that check the certification was still live, still coded DOP-C02, and no successor version and no retirement date had been announced. Nothing below is a promise about what is true on the day you book.

Verdict — where it fits in a realistic order

☺ Like you’re 10: Learn the ideas first, on the tools that work everywhere. Then, if your job lives in Amazon, learn Amazon’s version properly.

DOP-C02 is a good exam. It is well constructed, genuinely hard, and unlike a lot of vendor certification it rewards people who have actually operated production systems. It is also entirely about one vendor, delivered as multiple choice, and it expires in three years — weigh those facts together rather than separately.

For a platform engineer, the order that works is this. First, the portable substrate: Kubernetes and the delivery model — CKA if you need the badge, the lessons on this site if you need the understanding. Second, the discipline itself: CNPA or CNPE, because they are performance-based and test the thing you are actually hired to do. Third, and only if your platform genuinely lives on AWS: an AWS Associate for service fluency, then DOP-C02 to consolidate the delivery, governance and incident-response layers underneath your cluster. Taking it earlier is not wrong — it just means learning Amazon’s answers before you understand the questions, which is a harder way to become good. On another cloud the same logic applies to the GCP and Azure equivalents; start from the certification hub if you are still choosing.

Official sources verified for this page: the AWS Certified DevOps Engineer – Professional page, the DOP-C02 exam guide (domains, weights, task statements), the DOP-C02 in-scope AWS services list, the exam guide index (current codes — DOP-C02, SAA-C03, DVA-C02, SOA-C03), Coming soon to AWS Certification (the CloudOps rename and its dates), AWS recertification, the February 2019 certification policy change, and the AWS Proton deprecation guide. Last re-verified July 2026.