Overview

This domain focuses on implementing and managing infrastructure as code (IaC), configuration management, and governance practices using AWS services and tools.

Domain Weight: 17% of exam

Key Topics Covered

2.1 Infrastructure as Code (IaC)

• AWS CloudFormation for native IaC implementation
• AWS CDK for code-based infrastructure definition
• AWS SAM for serverless application modeling
• Terraform for multi-cloud infrastructure management

2.2 Configuration Management

• AWS Systems Manager for configuration and patch management
• AWS Config for configuration compliance and monitoring
• Parameter management and secrets handling

2.3 Governance and Compliance

• AWS Organizations for multi-account management
• AWS Control Tower for landing zones and guardrails
• AWS Service Catalog for standardized service portfolios
• Policy enforcement and compliance monitoring

Files in this Domain

Infrastructure as Code Services

• CloudFormation/ - Native AWS IaC service with advanced features
  • CloudFormation-General.md - Comprehensive CloudFormation guide
  • CloudFormation-DeepDive-Macros.md - Advanced macro functionality
  • CloudFormation-DeepDive-DriftDetection.md - Drift detection and remediation
  • CloudFormation-DeepDive-AdvancedFeatures.md - Advanced CloudFormation features

Configuration Management

• SystemsManager-SSM/ - Systems management and automation

  • SYSTEMSMANAGER-SSM-General.md - Comprehensive Systems Manager guide
  • SYSTEMSMANAGER-SSM-DeepDive-RunCommand.md - Run Command deep dive
  • SYSTEMSMANAGER-SSM-DeepDive-StateManager.md - State Manager automation

• Terraform/ - Third-party IaC tool

  • TERRAFORM-General.md - Terraform fundamentals and AWS integration
  • TERRAFORM-DeepDive-Workspaces.md - Terraform workspaces and state management

Development and Deployment Tools

• CDK-General.md - AWS Cloud Development Kit for code-based IaC
• CDK-Pipelines-General.md - Self-mutating CDK Pipelines, waves, cross-account bootstrap
• SAM-General.md - Serverless Application Model for serverless IaC

Governance and Compliance

• Organizations-General.md - Multi-account management and governance
• ControlTower-General.md - Landing zones and automated governance
• ServiceCatalog-General.md - Standardized service portfolios
• Config-General.md - Configuration compliance and monitoring

Key Concepts

Infrastructure as Code Principles

• Declarative Configuration - Define desired state, not steps
• Version Control - Track changes and enable rollbacks
• Immutable Infrastructure - Replace rather than modify
• Automated Testing - Validate infrastructure changes
• Continuous Integration - Integrate IaC with CI/CD pipelines

Configuration Management Strategies

• Configuration Drift - Detect and remediate configuration changes
• Compliance Monitoring - Continuous compliance assessment
• Automated Remediation - Self-healing infrastructure
• Change Management - Controlled configuration updates
• Audit and Reporting - Compliance reporting and audit trails

Governance Patterns

• Multi-Account Strategy - Account separation for security and compliance
• Centralized Management - Unified governance across accounts
• Policy Enforcement - Service Control Policies (SCPs) and guardrails
• Standardization - Consistent service deployment patterns
• Cost Management - Centralized billing and cost optimization

Integration Patterns

IaC Integration with CI/CD

Git Repository → CodePipeline → CodeBuild → CloudFormation/CDK → Deployment
     ↓              ↓             ↓              ↓              ↓
Version Control → Validation → Testing → Infrastructure → Application

Multi-Account Governance

Organizations (Management Account)
    ↓
Control Tower (Landing Zone)
    ↓
Service Catalog (Standardized Products)
    ↓
Config (Compliance Monitoring)
    ↓
Systems Manager (Configuration Management)

Configuration Management Flow

Systems Manager Parameter Store/Secrets Manager
    ↓
EC2/ECS/Lambda (Configuration Consumption)
    ↓
Config (Compliance Monitoring)
    ↓
CloudWatch (Monitoring and Alerting)
    ↓
Lambda (Automated Remediation)

Architecture Patterns

1. Multi-Environment IaC Pipeline

Development → Testing → Staging → Production
     ↓           ↓        ↓          ↓
CloudFormation Templates with Environment Parameters
Cross-Account Deployment with IAM Roles
Automated Testing and Validation at Each Stage

2. Centralized Configuration Management

Parameter Store/Secrets Manager (Central)
    ↓
Systems Manager (Distribution)
    ↓
EC2/ECS/Lambda (Consumption)
    ↓
Config (Compliance Validation)

3. Governance and Compliance Architecture

Organizations (Account Management)
    ↓
Control Tower (Guardrails)
    ↓
Service Catalog (Standardized Services)
    ↓
Config (Compliance Monitoring)
    ↓
CloudTrail (Audit Logging)

Best Practices

Infrastructure as Code

• Modular Design - Create reusable templates and modules
• Parameter Management - Use parameters for environment-specific values
• Resource Tagging - Consistent tagging strategy for management
• State Management - Proper state file management for Terraform
• Testing Strategy - Unit tests, integration tests, and validation

Configuration Management

• Least Privilege - Minimal required permissions for configuration access
• Encryption - Encrypt sensitive configuration data
• Versioning - Track configuration changes and enable rollbacks
• Automation - Automate configuration deployment and updates
• Monitoring - Monitor configuration compliance and drift

Governance and Compliance

• Account Strategy - Logical account separation based on workloads
• Policy Enforcement - Use SCPs to enforce organizational policies
• Standardization - Standardized service deployment through Service Catalog
• Audit Trails - Comprehensive logging and monitoring
• Regular Reviews - Periodic compliance and security reviews

Security Considerations

Access Control

• IAM Roles - Use roles for service-to-service access
• Cross-Account Access - Secure cross-account resource sharing
• Least Privilege - Minimal required permissions
• Regular Audits - Periodic access reviews and cleanup

Data Protection

• Encryption at Rest - Encrypt sensitive configuration data
• Encryption in Transit - Secure data transmission
• Secrets Management - Proper handling of sensitive information
• Access Logging - Log all configuration access and changes

Compliance

• Policy Enforcement - Automated policy compliance
• Audit Trails - Comprehensive audit logging
• Data Residency - Ensure data stays in required regions
• Regulatory Compliance - Meet industry-specific requirements

Monitoring and Troubleshooting

Key Metrics to Monitor

• Deployment Success Rate - Track successful deployments
• Configuration Drift - Monitor configuration changes
• Compliance Status - Track compliance rule violations
• Resource Utilization - Monitor infrastructure resource usage
• Cost Metrics - Track infrastructure costs and optimization

Common Issues and Solutions

1. CloudFormation Stack Failures - Check resource limits, permissions, dependencies
2. Configuration Drift - Use Config rules and automated remediation
3. Cross-Account Access Issues - Verify IAM roles and trust policies
4. Terraform State Conflicts - Implement proper state locking and management
5. Compliance Violations - Set up automated remediation workflows

Troubleshooting Tools

• CloudFormation Events - Detailed stack operation logs
• Systems Manager Session Manager - Secure instance access
• Config Timeline - Configuration change history
• CloudTrail - API call audit trails
• CloudWatch Logs - Centralized log analysis

Common Exam Scenarios

1. Design multi-environment IaC pipeline - CloudFormation + CodePipeline + cross-account deployment
2. Implement configuration drift detection - Config rules + automated remediation
3. Set up multi-account governance - Organizations + Control Tower + Service Catalog
4. Manage secrets in IaC deployments - Secrets Manager + CloudFormation integration
5. Create reusable infrastructure templates - CloudFormation nested stacks or CDK constructs
6. Implement compliance monitoring - Config + Lambda + automated remediation
7. Design secure parameter management - Parameter Store + IAM + encryption
8. Set up automated patch management - Systems Manager Patch Manager + maintenance windows
9. Implement infrastructure testing - CloudFormation validation + automated testing
10. Design cost-optimized IaC - Resource tagging + cost allocation + optimization

Study Tips

Focus Areas

• Understand CloudFormation intrinsic functions and advanced features
• Know Systems Manager capabilities and use cases
• Understand multi-account governance patterns
• Practice CDK and SAM for serverless applications
• Know Config rules and remediation patterns

Hands-on Practice

• Build CloudFormation templates with nested stacks
• Set up Systems Manager for configuration management
• Create CDK applications and deploy them
• Configure Organizations with Control Tower
• Implement Config rules with automated remediation

Integration Knowledge

• IaC integration with CI/CD pipelines
• Cross-account deployment patterns
• Configuration management automation
• Governance and compliance workflows
• Security and access control patterns

Additional Resources

AWS Documentation

• AWS CloudFormation User Guide
• AWS CDK Developer Guide
• AWS Systems Manager User Guide
• AWS Organizations User Guide

Best Practices

• Infrastructure as Code Best Practices
• AWS Multi-Account Strategy
• AWS Config Best Practices

Tools and Templates

• AWS CloudFormation Templates
• AWS CDK Examples
• AWS Config Rules Repository

Key Takeaways

IaC Benefits

• Consistency - Repeatable, predictable infrastructure deployments
• Version Control - Track changes and enable rollbacks
• Automation - Reduce manual errors and increase efficiency
• Testing - Validate infrastructure before deployment
• Documentation - Infrastructure as living documentation

Configuration Management

• Centralized Control - Manage configuration from central location
• Compliance - Ensure consistent configuration across environments
• Automation - Automate configuration deployment and updates
• Monitoring - Continuous monitoring of configuration state
• Remediation - Automated correction of configuration drift

Governance Success Factors

• Clear Policies - Well-defined organizational policies
• Automation - Automated policy enforcement and compliance
• Monitoring - Continuous compliance monitoring and reporting
• Education - Team training on governance practices
• Regular Reviews - Periodic policy and compliance reviews