AWS Developer Associate (DVA-C02) – General & Best Practices Essentials

These are the bare minimum concepts needed to answer the quiz correctly.

Source: Quiz provided by the user. fileciteturn0file0

1. ElastiCache (Redis) – Cache-Aside (Lazy Loading)

What is it?

Store frequently read data in Redis instead of repeatedly querying the database.

How it works

1. Application checks Redis.
2. If found → return immediately.
3. If not found → read from database.
4. Store result in Redis.
5. Return data.

Best for

• Data read frequently
• Data changes rarely
• Product catalogs
• User profiles

Benefits

• Reduces database CPU
• Much faster responses
• Handles traffic spikes

Remember

Read-heavy + rarely changing data = Redis Cache-Aside

2. Cache TTL (Time To Live)

What is TTL?

How long an item stays in cache before expiring.

Why use TTL?

• Keeps cache reasonably fresh.
• Avoids stale data forever.
• Reduces database load dramatically.

Remember

Short TTL = Good balance between performance and freshness

3. S3 CORS (Cross-Origin Resource Sharing)

Problem

A website loads files from another domain.

Example

Website:
www.example.com

Assets:
assets.example.com

Browser blocks requests unless CORS allows them.

Fix

Configure CORS on the S3 bucket.

Allow:

• Origin
• Methods (GET, PUT etc.)

Remember

Cross-domain browser request → Configure S3 CORS

4. STS AssumeRole (Cross-Account Access)

Purpose

Access another AWS account securely.

How?

Account A
      |
AssumeRole
      |
Account B

STS returns

• Temporary credentials
• Automatically expire

Never use

• Root credentials
• Permanent IAM users

Remember

Cross-account access = STS AssumeRole

5. KMS Imported Key Material

Situation

Company wants AWS KMS but wants to provide its own encryption key.

Use

Customer Managed KMS Key (CMK)

with

Imported Key Material

Benefits

• Company owns key material
• Can delete imported key
• AWS still manages encryption service

Remember

6. S3 Pre-Signed URLs

Purpose

Allow someone to download/upload a specific object temporarily.

No AWS account required.

Good for

• Customers
• Partners
• Temporary downloads
• Temporary uploads

Features

• Time limited
• Object specific
• Secure

Remember

Temporary S3 access → Pre-Signed URL

7. AWS X-Ray Service Map

Purpose

Trace requests across microservices.

Shows

• Service dependencies
• Response times
• Errors
• Latency

Very useful for

• Finding slow services
• Debugging distributed systems

Remember

Microservice performance visualization = X-Ray Service Map

8. Decode Authorization Message

Sometimes AWS CLI returns

Encoded authorization failure

Decode using

aws sts decode-authorization-message

Shows

• Which policy denied access
• Missing permission
• Policy evaluation

Remember

Encoded permission error → decode-authorization-message

9. CloudTrail for Resource Deletion

If something suddenly disappears

Example

• S3 bucket deleted
• IAM role deleted
• Lambda removed

First check

CloudTrail

It records

• Who
• When
• API called
• Source IP

Remember

Who deleted something? → CloudTrail

10. AWS CLI Configuration

Instead of typing

--region
--output

every time,

Run

aws configure

Stores

• Region
• Output format
• Credentials

Location

~/.aws/config

~/.aws/credentials

Remember

CLI defaults → aws configure

11. Cognito Federation with Azure AD

Users already have Azure AD accounts.

Do NOT create IAM users.

Instead

Azure AD
     ↓
Cognito User Pool
     ↓
JWT Token
     ↓
API Gateway / Lambda

Supports

• SAML
• OIDC

Remember

Enterprise login → Cognito Federation

12. CloudTrail Log File Integrity Validation

Purpose

Prove CloudTrail logs were not modified.

Enable

Log File Integrity Validation

CloudTrail creates

• Signed digest files
• Hashes

Can later verify

• No modification
• No deletion

Remember

Tamper-proof CloudTrail logs → Log File Integrity Validation

Quick Exam Cheat Sheet