Study guide
12.1 AWS Health, CloudTrail Events & Operational Notification
AWS Certified DevOps Engineer – Professional Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CI/CD Pipeline Architecture & Source Integration
1.1 Multi-Stage & Multi-Account CodePipeline Design 1.2 CodeBuild Projects, Build Environments & Pipeline Secrets 1.3 Source Control Workflows, Webhooks & Branching Models
2 Chapter 2: Automated Testing, Test Gates & Quality Verification
2.1 Automated Unit, Integration & Acceptance Testing in Pipelines 2.2 Load Testing, Performance Benchmarking & Synthetic Canaries 2.3 Security Scanning, SAST/DAST & Approval Gates
3 Chapter 3: Artifact Management & Multi-Platform Deployment Strategies
3.1 Artifact Lifecycle Management with CodeArtifact, ECR & S3 3.2 Automated Image Baking with EC2 Image Builder 3.3 In-Place, Rolling & Immutable Deployments on EC2 3.4 Blue/Green & Canary Deployments for ECS, EKS & Lambda
4 Chapter 4: CloudFormation, CDK & Reusable IaC Components
4.1 Advanced CloudFormation: Nested Stacks, Change Sets & Custom Resources 4.2 Cross-Account & Multi-Region StackSets & Drift Detection 4.3 Modern IaC: AWS CDK, SAM & Service Catalog Governance
5 Chapter 5: Multi-Account Architecture, Organizations & Control Tower
5.1 AWS Organizations Hierarchy, OUs & Account Provisioning 5.2 Service Control Policies (SCPs) & Multi-Account Guardrails 5.3 AWS Control Tower, Account Factory & Landing Zone Automation
6 Chapter 6: Systems Manager & Large-Scale Fleet Configuration
6.1 SSM Agent, Hybrid Activation & Session Manager 6.2 Systems Manager Run Command, State Manager & Associations 6.3 Patch Manager, Parameter Store vs Secrets Manager & AppConfig
7 Chapter 7: High Availability & Multi-Region Resiliency
7.1 Designing Resilient Multi-AZ & Multi-Region Architectures 7.2 Route 53 Traffic Flow, Health Checks & DNS Failover 7.3 Data Replication: Aurora Global DB, DynamoDB Global Tables & S3 CRR
8 Chapter 8: Scalability, Auto Scaling & Disaster Recovery Automation
8.1 EC2 Auto Scaling Policies, Lifecycle Hooks & Warm Pools 8.2 Container & Serverless Scalability: ECS Capacity Providers, EKS & API Gateway 8.3 Disaster Recovery Strategies: RTO, RPO & Architecture Tiers 8.4 Automated Backup & Recovery with AWS Backup & Elastic Disaster Recovery
9 Chapter 9: CloudWatch Metrics, Agent Collection & Log Aggregation
9.1 CloudWatch Metrics, Dimensions, Metric Math & High Resolution 9.2 Unified CloudWatch Agent & Custom Metric Collection 9.3 Centralized Log Aggregation, Retention & Cross-Account Subscriptions
10 Chapter 10: Log Analysis, Dashboards & Distributed Tracing with X-Ray
10.1 CloudWatch Logs Insights, Filter Syntax & Query Optimization 10.2 CloudWatch Dashboards, Composite Alarms & Anomaly Detection 10.3 Distributed Tracing with AWS X-Ray & Service Maps
11 Chapter 11: Automated Observability & Event-Driven Monitoring
11.1 Application & Infrastructure Health Checks with Route 53 & ALB 11.2 Centralized Observability with Amazon OpenSearch & Athena 11.3 Synthetic Monitoring with CloudWatch Synthetics Canaries
12 Chapter 12: Event-Driven Incident Detection & Notification Pipelines
12.1 AWS Health, CloudTrail Events & Operational Notification 12.2 EventBridge Event Routing, Patterns & Multi-Account Buses 12.3 Asynchronous Event Processing: SNS, SQS Queues & Dead-Letter Handling
13 Chapter 13: Automated Remediation & Deployment Troubleshooting
13.1 AWS Config Managed Rules & Automated Remediation with SSM 13.2 Event-Driven Infrastructure Self-Healing with Lambda & Step Functions 13.3 Troubleshooting CI/CD Pipeline & Deployment Failures 13.4 Root Cause Analysis for Auto Scaling & Container Failures
14 Chapter 14: Identity, Access Management & Secrets at Scale
14.1 IAM Policy Evaluation Logic, NotAction & Explicit Denies 14.2 IAM Permissions Boundaries & Delegated Administration 14.3 IAM Identity Center, Cross-Account Roles & STS Session Policies 14.4 Automated Secrets Management & Secret Rotation with Secrets Manager
15 Chapter 15: Security Automation, Data Protection & Compliance Auditing
15.1 Network Security Automation: Security Groups, NACLs, Network Firewall & WAF 15.2 Cryptographic Controls & Key Management with AWS KMS & ACM 15.3 Automated Threat Detection: GuardDuty, Inspector & Security Hub 15.4 Continuous Compliance Auditing & Log Integrity with CloudTrail & Config
12.1 AWS Health, CloudTrail Events & Operational Notification
Key Takeaways Explain This Topic AI
AWS Health Dashboard (Personal Health Dashboard) provides authenticated, resource-specific operational alerts, scheduled maintenance notices, and account notifications, contrasting with the unauthenticated, aggregate AWS Service Health Dashboard.
AWS Health Organizational View aggregates health events across all accounts in an AWS Organization into a delegated administrator or management account, requiring Business, Enterprise On-Ramp, or Enterprise Support.
AWS CloudTrail captures management and data events; CloudTrail Insights can detect anomalous API call and error rates. Management call-rate Insights analyze write-only calls, while management error-rate Insights can analyze reads, writes, or both.
CloudTrail Lake provides an immutable, SQL-queryable event data store with up to 10-year retention, eliminating the need to construct complex Athena, Glue Crawler, and S3 ETL pipelines for compliance and security auditing.
EventBridge can react to best-effort CloudTrail and AWS Health events without waiting for periodically delivered CloudTrail S3 log files; neither path should be described with a hard sub-minute latency guarantee.
Last updated: September 2026
AWS Health: Personal Health Dashboard vs. Service Health Dashboard
In modern cloud operations, detecting infrastructure impairments and scheduled maintenance before they trigger severe application outages is paramount. AWS provides two distinct health visibility mechanisms that candidates on the AWS Certified DevOps Engineer - Professional (DOP-C02) exam must clearly differentiate.
Architectural Comparison of Health Dashboards
Dimension AWS Service Health Dashboard (SHD) AWS Health Dashboard (Personal Health Dashboard / PHD)
Access & Authentication Publicly accessible at status.aws.amazon.com ; unauthenticated Authenticated via AWS Management Console, CLI, or Health API
Scope & Specificity Macro-level regional status across all AWS services globally Micro-level visibility into events impacting your specific account's resources
Resource Correlation None; reports broad service availability by region Explicitly correlates events with affected resource ARNs (e.g., specific EC2 instance IDs, EBS volumes)
Event Notification RSS feeds only; no direct native event bus integration Native integration with Amazon EventBridge and AWS User Notifications
API Access No programmatic API AWS Health API ( DescribeEvents , DescribeAffectedEntities ) via Business/Enterprise Support Public Outage Status ──> [ AWS Service Health Dashboard (status.aws.amazon.com) ]
- │ (Macro-level regional view)
- ▼
- Account Resource Health ─> [ AWS Health Dashboard (Personal Health Dashboard) ]
- │ (Micro-level specific resource ARNs)
- ├──> Amazon EventBridge (Real-Time Rules)
- └──> AWS Health API (Enterprise Tooling)
- AWS Health Event Categories and Lifecycle States
AWS Health categorizes operational occurrences into three distinct event types:
issue : Active, open operational events indicating degraded performance or localized failure in the underlying AWS infrastructure affecting your resources (e.g., an underlying EC2 physical host degradation, degraded EBS storage volume throughput, or an Availability Zone network connectivity interruption).
scheduledChange : Planned lifecycle operations and mandatory infrastructure maintenance that require proactive customer scheduling or awareness (e.g., upcoming EC2 instance retirement, scheduled Amazon RDS database operating system or engine updates, hardware maintenance reboots, or network device replacements).
accountNotification : Administrative and operational notifications specific to the AWS account (e.g., deprecated runtime deprecation schedules such as Node.js or Python runtime end-of-support in AWS Lambda, upcoming AWS Certificate Manager (ACM) public certificate expiration, or billing threshold alerts).
Each health event progresses through well-defined lifecycle states: open (event is currently active and impacting resources), upcoming (event is scheduled for a future maintenance window), and closed (the event has completed or underlying issues have resolved).
AWS Health Organizational View & Multi-Account Aggregation
In an enterprise landing zone containing dozens or hundreds of AWS accounts managed under AWS Organizations, checking individual account dashboards is operationally untenable. AWS Health Organizational View provides centralized, cross-account aggregation of all AWS Health events across the entire organization.
Prerequisites and Delegation Architecture
Support Plan Requirement : Access to the AWS Health API and AWS Health Organizational View requires an active Business, Enterprise On-Ramp, or Enterprise Support plan.
Enabling Organization Access : The organization management account enables service access using the AWS Health CLI or console: aws health enable-health-service-access-for-organization
Delegated Administrator : To maintain separation of concerns and avoid operating out of the management account, organizations can designate a member account (such as a centralized Security, Operations, or Shared Services account) as a delegated administrator for AWS Health: aws organizations register-delegated-administrator \
- -account-id 111122223333 \
- -service-principal health.amazonaws.com
The delegated administrator account can query aggregated organizational health events across all accounts or filter by specific Organizational Units (OUs) using DescribeEventsForOrganization and DescribeAffectedEntitiesForOrganization .
AWS CloudTrail Architecture: Management, Data & Insights Events
AWS CloudTrail serves as the foundational auditing and compliance backbone for AWS accounts, capturing API activities, operational actions, and administrative modifications.
Event Categories Deep Dive
CloudTrail categorizes events into three primary types:
Management Events (Control Plane) : Operations executed against the control plane of AWS resources. Examples include ec2:RunInstances , iam:CreateRole , s3:CreateBucket , and ec2:AuthorizeSecurityGroupIngress . CloudTrail trails log management events by default. They can be filtered as read-only, write-only, or all.
Data Events (Data Plane) : Operations executed against or within the resource itself. Examples include s3:GetObject , s3:PutObject , s3:DeleteObject , lambda:InvokeFunction , and Amazon DynamoDB item-level operations ( PutItem , GetItem ). Data events are disabled by default due to extreme event volume and ingestion costs ($0.10 per 100,000 events). They must be selectively enabled by specifying resource ARNs or prefix patterns.
Insights Events (Behavioral Anomalies) : CloudTrail Insights analyzes selected management or data events against a rolling baseline. For management events, API call-rate Insights analyze write-only calls, while API error-rate Insights can analyze read events, write events, or both. Trails can also analyze data-event call and error rates; data-event Insights are not supported by CloudTrail Lake event data stores. CloudTrail builds the initial baseline from the preceding 28 days and recalculates it daily. Examples include an unusual surge in mutating calls such as CreateRole or DeleteBucket , or a surge in errors such as AccessDenied and ThrottlingException .
CloudTrail Lake
Traditionally, analyzing CloudTrail events across multiple accounts required deploying complex ETL pipelines: CloudTrail delivered gzipped JSON logs to Amazon S3, triggering Amazon SNS notifications to Amazon SQS, which crawled logs using AWS Glue and queried them using Amazon Athena.
CloudTrail Lake eliminates this architecture by providing a fully managed, serverless, SQL-queryable event data store (EDS):
Retention & Immutability : Provides tamper-evident, write-once storage with retention configurable from 7 days up to 3,653 days (10 years) for strict regulatory compliance.
Multi-Account & Multi-Region : Can ingest management events, data events, Insights events, and external third-party audit logs (via CloudTrail Lake Integrations for GitHub, Okta, Jira, and CrowdStrike).
- ANSI-SQL Querying : Enables direct, complex SQL analysis without managing partitions or Glue schemas: SELECT
- eventTime,
- eventName,
- userIdentity.arn AS principal_arn,
- sourceIPAddress,
- errorMessage
- FROM
- eds-ab12cd34ef56gh78
- WHERE
- errorCode = 'AccessDenied'
- AND eventTime > '2026-09-01 00:00:00'
- ORDER BY
- eventTime DESC
- LIMIT 50;
- Real-Time Operational Notifications & Automated Remediation via EventBridge
Important
DOP-C02 Exam Critical Insight : CloudTrail typically delivers trail log files to Amazon S3 in about five minutes on average, but that timing is not guaranteed. For prompt security detection and remediation (for example, an engineer opening port 22 to 0.0.0.0/0 ), use best-effort CloudTrail service events delivered to the default EventBridge bus instead of waiting for S3 objects.
- EventBridge Event Patterns for Operational Incident Pipelines
- 1. AWS Health Event Pattern (Impending Hardware Retirement or Issue) {
- "source": ["aws.health"],
- "detail-type": ["AWS Health Event"],
- "detail": {
- "service": ["EC2", "RDS"],
- "eventTypeCategory": ["issue", "scheduledChange"],
- "eventTypeCode": [
- "AWS_EC2_PERSISTENT_INSTANCE_RETIREMENT_SCHEDULED",
- "AWS_RDS_MAINTENANCE_SCHEDULED"
- ]
- }
- }
- 2. CloudTrail Management API Call Pattern (Security Group Modification) {
- "source": ["aws.ec2"],
- "detail-type": ["AWS API Call via CloudTrail"],
- "detail": {
- "eventSource": ["ec2.amazonaws.com"],
- "eventName": [
- "AuthorizeSecurityGroupIngress",
- "RevokeSecurityGroupIngress"
- ]
- }
- }
- 3. CloudTrail Insights Anomaly Event Pattern {
- "source": ["aws.cloudtrail"],
- "detail-type": ["AWS Insight via CloudTrail"],
- "detail": {
- "insightDetails": {
- "state": ["Start"],
- "insightType": ["ApiCallRateInsight", "ApiErrorRateInsight"]
- }
- }
- }
- Automated Remediation Architecture
When EventBridge matches an operational or security event pattern, it immediately dispatches the event payload to automated targets:
AWS Systems Manager (SSM) Automation : Automatically executes runbooks. For an AWS_EC2_PERSISTENT_INSTANCE_RETIREMENT_SCHEDULED event, SSM Automation can schedule a graceful instance stop and start during an off-peak maintenance window, migrating the instance to healthy physical hardware.
AWS Lambda : Evaluates the ingress rules in an AuthorizeSecurityGroupIngress event. If an ingress rule allows unrestricted access ( 0.0.0.0/0 on sensitive ports like 22 or 3389), Lambda immediately invokes ec2:RevokeSecurityGroupIngress to revoke the rule, publishes an alert to Amazon SNS, and posts a notification to Slack or PagerDuty.
Amazon SNS & Incident Ticketing : Fans out incident details to operations engineers, PagerDuty, Jira Service Management, or ServiceNow via webhooks or Amazon EventBridge API Destinations.
Incident Detection Mechanisms Comparison
Mechanism Ingestion Latency Best Suited For Key Operational Tradeoff
AWS Health (Personal) Near-real-time to minutes Infrastructure failures, maintenance reboots, runtime deprecations Only covers AWS-managed infrastructure events; no application insight
CloudTrail via EventBridge Best-effort near-real-time delivery Prompt reaction to supported CloudTrail service events Default rules match mutating management events; read-only forwarding requires explicit rule state
CloudTrail to S3 About 5 minutes on average; not guaranteed Compliance auditing, forensics, long-term archive Periodic file delivery is unsuitable for a hard sub-minute requirement
CloudTrail Insights Typically up to 30 minutes after unusual activity for trail delivery Identifying unusual call-rate and error-rate patterns Requires a baseline and does not detect a single isolated call
CloudTrail Lake Ingestion delay varies Multi-account, multi-Region SQL auditing with configured retention Query and ingestion charges apply