DVA-C02 cheat sheet: AWS Certified Developer – Associate

Compute for developers

Lambda: cold start = new execution environment initializing; provisioned concurrency keeps environments warm. Reserved concurrency caps (and guarantees) a function's own capacity out of the account-wide pool.
Lambda layers share code/dependencies across functions and are immutable once published — a function must be explicitly updated to point at a new layer version.
Lambda destinations route the outcome of an async invocation (or a stream/queue's failed batch) to SQS, SNS, another Lambda, or EventBridge — separate from a dead-letter queue, which just captures what destinations don't handle by default.
ECS Fargate removes EC2 instance management entirely; the EC2 launch type gives more control at the cost of managing the underlying instances yourself.

DynamoDB capacity: on-demand auto-scales to traffic with no planning; provisioned mode can auto-scale via a target-tracking policy. WCUs/RCUs round UP to the next whole 1 KB/4 KB unit.
Conditional writes (ConditionExpression) prevent race conditions — attribute_not_exists() for "create only if missing," a version-number check for optimistic locking.
GSIs are eventually consistent and support a different partition key than the base table; LSIs share the base table's partition key and must be created at table creation time.
S3 presigned URLs grant time-limited access to one action without exposing credentials; multipart upload splits large files into parallel, resumable parts.

SQS decouples and buffers; visibility timeout hides a received message during processing — set it well above the consumer's real processing time to avoid duplicate delivery.
SNS fans one message out to many subscribers (queues, Lambda, HTTP/S); FIFO queues and topics add strict ordering and deduplication that standard ones don't guarantee.
EventBridge routes events by pattern match to one or more targets, with optional input transformation and a dead-letter queue for failed target delivery.
Step Functions orchestrates multi-step workflows — Task states call services (including many directly, with no Lambda needed), Choice states branch, Parallel states run branches concurrently, Map states iterate a collection.

Prefer IAM roles over long-lived access keys for any AWS compute — roles hand out automatically-rotated temporary credentials, keys don't rotate themselves.
Secrets Manager rotates credentials and is built for that; Parameter Store SecureString encrypts but doesn't natively rotate; a plain Lambda environment variable is neither encrypted by default nor rotated.
KMS key usage (encrypt/decrypt vs. sign/verify) is fixed at key creation — one key can't do both. Encryption context is authenticated but not secret.
A resource-based policy (on the target: an SQS queue, an S3 bucket, a Lambda function) is what actually grants cross-account access — the caller's own identity policy alone can't reach into another account.

CodePipeline orchestrates source → build (CodeBuild) → deploy (CodeDeploy, CloudFormation, or others) as a series of stages and actions.
CodeDeploy Lambda deployments shift traffic between function versions via a weighted alias — canary (one jump, then a wait) or linear (steady increments) — and can auto-rollback on a CloudWatch alarm, including one built on a custom metric.
SAM extends CloudFormation with simpler serverless syntax (AWS::Serverless::Function, etc.) that expands into standard CloudFormation resources at build time.
A CloudFormation stack update fails safely by default — it automatically rolls back to the prior working state rather than leaving resources partially updated.

X-Ray traces one request across multiple services to show where time is actually spent; Lambda Insights and Container Insights give aggregated operational health metrics instead.
A Lambda timeout, a throttle (concurrency limit hit), and an unhandled code exception are three different failure modes with three different fixes — check CloudWatch Logs and the specific error before assuming which one occurred.
API Gateway enforces its own 29-second integration timeout independent of a Lambda function's own (longer) configured timeout — a common source of confusing, seemingly-inconsistent failures.
CloudWatch Logs Insights queries log data directly (filter, stats, aggregation) — faster than manually scanning raw log lines for a pattern across many invocations.

Reading a summary is the easy part. Take the free 10-question diagnostic to see which of these domains you actually have, then drill the rest.