DVA-C03 Cheat Sheet 2026: AWS Certified Developer – Associate

Compute for developers

Lambda: a cold start is a new execution environment initializing; provisioned concurrency keeps environments ready. Reserved concurrency caps (and guarantees) a function's own capacity out of the account-wide pool.
Lambda memory also sets CPU, so raising memory can make a function faster and sometimes cheaper. A function that needs private resources in a VPC gets ENIs in your subnets and needs a NAT gateway or VPC endpoints to reach AWS services.
Lambda layers share code and dependencies across functions and are immutable once published; a function must be updated to point at a new layer version.
Lambda destinations and dead-letter queues both apply to asynchronous invocations. Destinations receive success or failure records with the request, the response and error details; a DLQ receives only the failed event. For Kinesis and DynamoDB Streams event source mappings, an on-failure destination records failed batches; for an SQS trigger, failed messages go to the queue's own dead-letter queue through its redrive policy.

DynamoDB capacity: on-demand scales to traffic with no planning; provisioned mode can auto scale with a target-tracking policy. WCUs and RCUs round up to the next whole 1 KB or 4 KB unit; an eventually consistent read costs half a strongly consistent one.
Conditional writes (ConditionExpression) prevent race conditions: attribute_not_exists() for "create only if missing", a version-number check for optimistic locking.
GSIs can use a different partition key, are eventually consistent and can be added later; LSIs share the base table's partition key and must be created with the table. Pick high-cardinality partition keys to avoid hot partitions.
Data lifecycle: S3 Lifecycle rules move or expire objects, DynamoDB TTL deletes expired items in the background at no write cost, and CloudWatch Logs retention settings stop logs growing forever.

SQS decouples and buffers; the visibility timeout hides a received message during processing. For a Lambda trigger, set it to at least six times the function timeout to avoid duplicate processing.
SNS fans one message out to many subscribers (queues, Lambda, HTTP/S); subscription filter policies stop consumers receiving messages they would discard. FIFO queues and topics add strict ordering and deduplication.
EventBridge routes events by pattern match to one or more targets, with optional input transformation and a dead-letter queue for failed target delivery. S3 Event Notifications can send to SQS, SNS, Lambda or EventBridge.
Retries with exponential backoff and jitter are built into the AWS SDKs; make handlers idempotent so a retried or redelivered event does no harm.

Prefer IAM roles over long-lived access keys for any AWS compute: roles hand out temporary credentials that rotate automatically. Cross-account access needs a role to assume (sts:AssumeRole) or a resource-based policy on the target.
Secrets Manager has built-in rotation; Parameter Store SecureString is encrypted but rotation is up to you. Lambda environment variables are encrypted at rest with an AWS managed key by default, but anyone who can read the function's configuration sees them, and nothing rotates them.
KMS envelope encryption: GenerateDataKey returns a plaintext and an encrypted data key; encrypt locally, then store only the encrypted key with the data. Encryption context is authenticated but not secret.
Presigned URLs give time-limited access to one S3 object operation using the signer's permissions, so the URL can do no more than the signer can. CloudFront signed URLs and signed cookies do the same for content served through a distribution.
Cognito user pools sign users in and issue JWTs that API Gateway can validate; identity pools exchange a sign-in for temporary AWS credentials.

Calls to Amazon Bedrock are authorized with IAM like any other AWS API: allow actions such as bedrock:InvokeModel only on the model ARNs the application needs, from the role the code runs as.
Amazon Bedrock doesn't use your prompts and responses to train AWS models and doesn't share them with third parties, including model providers. Use an interface VPC endpoint (AWS PrivateLink) to keep traffic to Bedrock off the public internet.
Bedrock Guardrails filter both the prompt and the response: content filters, denied topics, word filters, sensitive information filters that block or mask PII, and prompt attack detection. Apply one by passing its ID and version on the model call, or check any text with the ApplyGuardrail API.
Model invocation logging is off by default; when on, it writes full prompts and responses to CloudWatch Logs or S3. Restrict who can read those logs and use a CloudWatch Logs data protection policy to mask sensitive data.
Agents: give each tool (for example, a Lambda function behind an action group) the least privilege it needs, keep each user's session separate, and require a human confirmation before sensitive actions.

Testing: sam local invoke and sam local start-api run functions and APIs locally; sam local generate-event creates sample event payloads; an API Gateway mock integration returns a fixed response with no backend, useful to stand in for a dependency.
Containers: build the image, push it to Amazon ECR, and tag it with a version, not just latest. ECR tag immutability stops a tag being overwritten, and lifecycle policies expire old images. In ECS, the task execution role pulls the image and writes logs; the task role is what your code uses to call AWS.
ECS rolling updates replace tasks with a new task definition revision; the deployment circuit breaker can stop a failing deployment and roll it back. EKS deploys from Kubernetes manifests, and readiness and liveness probes decide when a pod gets traffic or is restarted.
CodeDeploy for Lambda shifts traffic between versions through an alias: canary, linear or all-at-once, with automatic rollback on a CloudWatch alarm. CodePipeline orchestrates source, build (CodeBuild) and deploy stages.
SAM extends CloudFormation with shorter serverless syntax that expands into standard resources; a failed CloudFormation stack update rolls back to the last working state by default.

X-Ray traces one request across services to show where time is spent. Annotations are indexed and can be used in filter expressions; metadata is not.
A Lambda timeout, a throttle (concurrency limit hit) and an unhandled exception are three different failures with three different fixes; read the CloudWatch Logs and the exact error first.
API Gateway applies its own integration timeout (29 seconds by default; Regional and private REST APIs can request a higher limit) independent of the Lambda function's longer configured timeout, a common cause of 504s that look inconsistent. HTTP APIs allow at most 30 seconds.
Structured (JSON) logs make CloudWatch Logs Insights queries easy; the embedded metric format turns a log line into a custom metric without extra API calls.
AI tools can read errors, logs and traces and suggest a cause or a fix, but the exam still expects you to confirm it from the metrics, logs and traces yourself.

Reading a summary is the easy part. Take the free 10-question diagnostic to see which of these domains you actually have, then study the rest.