DVA-C02 Cheat Sheet: Developer Associate Quick Reference

DVA-C02 rewards service-behavior precision — limits, defaults, and which feature solves which problem. This sheet compresses the repeated exam signals by service.

Lambda — the numbers that matter

• Timeout max: 15 minutes. Memory: 128 MB–10 GB (CPU scales with memory). /tmp: 512 MB–10 GB
• Deployment: 50 MB zipped direct, 250 MB unzipped (with layers), 10 GB container image
• Concurrency: default 1,000/region (soft); reserved = guarantee+ceiling; provisioned = pre-warmed (kills cold starts)
• Versions are immutable; aliases point at versions — weighted alias routing enables canary/blue-green via CodeDeploy
• Destinations: async success/failure routing (SQS/SNS/Lambda/EventBridge); DLQ for sync-invoked failures
• Environment variables are encrypted at rest by KMS but visible in console — use Secrets Manager for real secrets

DynamoDB — the gotchas

• Primary key: partition key (required) + optional sort key — no joins, no ad-hoc query by non-key attrs without GSI/scan
• GSI: any attributes, can be added anytime, own RCU/WCU; LSI: same PK, different sort, table-creation only
• On-demand vs provisioned capacity; DAX = in-memory cache (ms→µs); Streams capture item changes (Lambda triggers)
• Eventually consistent by default; strongly consistent reads cost 2x RCU — the classic cost/accuracy trade
• Point-in-time recovery, global tables (multi-region), TTL for free expiry

SQS / SNS / EventBridge

• SQS standard: at-least-once, best-effort ordering, ~unlimited throughput; FIFO: exactly-once + strict order (300 msg/s base)
• Visibility timeout ≠ retention — message hidden while being processed; DLQ after max receives
• Long polling (waitTimeSeconds 1–20s) reduces empty receives and cost — always prefer it
• SNS = fan-out pub/sub to many subscribers; EventBridge = event bus with content-based routing + SaaS/native integrations + schema registry
• Fan-out pattern: SNS → multiple SQS queues (each consumer gets its own copy)

API Gateway

• REST vs HTTP API: HTTP is cheaper/faster (proxy-style); REST adds keys, usage plans, request validation, caching, private endpoints
• WebSocket API: two-way real-time (chat); routes $connect/$disconnect/custom
• Authorizers: IAM, Cognito user pools, Lambda (custom); resource policies for cross-account/IP rules
• Throttling default 10k rps/account; stages + stage variables; canary deployments on stages

IAM & security must-knows

• Never embed credentials — EC2 instance profile, Lambda execution role, ECS task role
• Cognito: user pools = authN + JWTs; identity pools = AWS credentials for federated/guest access
• JWT verification: JWKS public keys + validate iss/aud/exp — verify signature, not just decode
• KMS: envelope encryption; SSM Parameter Store vs Secrets Manager (rotation built-in)

CI/CD & observability

• CodeCommit (source) → CodeBuild (build/test) → CodeDeploy (deploy) → CodePipeline (orchestrates all)
• CodeDeploy styles: in-place/blue-green on EC2; canary/linear traffic shifting on Lambda & ECS; auto-rollback on CloudWatch alarms
• X-Ray: end-to-end traces + service map + subsegments — 'where is latency' answers
• Elastic Beanstalk: upload code, AWS manages infra — 'fastest way to deploy without managing servers (non-Lambda)'
• SAM = IaC for serverless (template shorthand for Lambda/API/DynamoDB)