Domain 1: Development with AWS Services
- AWS Lambda is event-driven serverless compute: services such as API Gateway, S3, SNS, and EventBridge push events to it, while for SQS, Kinesis, and DynamoDB Streams an event source mapping polls the source and invokes the function in batches; you pay per request and per GB-second of execution.
- Choose between synchronous and asynchronous patterns: an API Gateway call to Lambda is synchronous (RequestResponse returns the result to the caller), while SQS-based processing and EventBridge event-driven workflows are asynchronous; pass --invocation-type Event to invoke Lambda asynchronously so the event is queued and the call returns immediately.
- Decouple tightly coupled components with event-driven patterns: EventBridge rules route events to targets, S3 Event Notifications react to object changes, SQS buffers work between producers and consumers, and SNS publishes one message to many subscribers.
- SQS standard queues offer best-effort ordering and at-least-once delivery; FIFO queues guarantee exactly-once processing and strict ordering and require a MessageGroupId and a MessageDeduplicationId (or content-based deduplication).
- Use AWS Step Functions to orchestrate multi-step workflows with built-in Retry and Catch for error handling and a visual state machine; start runs with aws stepfunctions start-execution.
- Build fault-tolerant applications by retrying throttling and transient errors with exponential backoff and jitter (the AWS SDKs do this automatically for retryable errors) and by degrading gracefully, for example serving cached or partial results when a dependency is unavailable.
- API Gateway integrates with Lambda (proxy or non-proxy), HTTP endpoints, and AWS services; HTTP APIs are cheaper and lower-latency, while REST APIs add request validation, request and response mapping transformations, API keys, and usage plans.
- Develop code that calls AWS services through the SDKs and APIs, and serialize and deserialize data to match each service's format; for example DynamoDB items use typed attribute values such as {"S":"123"} for a string, and core CLI verbs include aws dynamodb put-item, aws lambda invoke, aws sqs send-message, aws sns publish, and aws s3api put-object.
- Manage streaming data with Amazon Kinesis Data Streams for real-time ingestion that consumers such as Lambda read through an event source mapping, and with Amazon Data Firehose to deliver streaming data to destinations such as Amazon S3.
- Use AI-assisted development tools such as Kiro to generate, review, and optimize code: spec-driven code generation, automated code reviews, intelligent code completion, refactoring suggestions, and security scanning; generated code still needs your review and tests before it ships.
- Integrate managed AWS AI services into applications by calling them through the SDK, for example invoking a foundation model in Amazon Bedrock with the InvokeModel or Converse API, and running AI agents with Amazon Bedrock AgentCore.
- To grant a Lambda function access to private resources in a VPC, attach it to private subnets and security groups; a VPC-attached function then needs a NAT gateway or VPC endpoints to reach the internet or AWS service APIs.
- Configure Lambda with environment variables and settings for memory, timeout (up to 15 minutes), runtime, handler, layers, and extensions; /tmp ephemeral storage goes up to 10 GB, and a VPC-attached function can mount Amazon EFS to share large files such as ML models across invocations.
- Handle the Lambda event lifecycle and errors: for asynchronous invocations configure on-success or on-failure destinations, or a dead-letter queue, to capture events that still fail after Lambda's automatic retries.
- Manage data lifecycles with S3 Lifecycle policies that transition objects to S3 Glacier storage classes or expire them, DynamoDB TTL that deletes items after a timestamp attribute passes, and retention periods on CloudWatch Logs log groups.
- Choose data stores by access pattern (DynamoDB for key-value access at scale, RDS or Aurora for relational queries, S3 for objects) and pick a matching cache: DynamoDB Accelerator (DAX) gives microsecond reads in front of DynamoDB, and ElastiCache (Redis or Memcached) is a general-purpose cache for session state and hot reads in front of databases.
- Configure DynamoDB with a high-cardinality partition key so requests spread evenly and avoid hot partitions, choose eventually or strongly consistent reads, and prefer Query (by key) over Scan (reads the whole table) for efficient access.
- A DynamoDB Global Secondary Index (GSI) lets you query on a non-key attribute with its own partition and sort key and its own throughput; a Local Secondary Index (LSI) must share the table's partition key and be created at table creation.
Domain 2: Security
- Lambda functions, EC2 instances, and ECS tasks should obtain AWS access through an IAM role (execution, instance, or task role) that supplies temporary, auto-expiring credentials, never hard-coded access keys.
- Apply least privilege: grant only the specific actions and resources required, and prefer scoping resources by ARN rather than using wildcards.
- In IAM policy evaluation an explicit Deny always overrides any Allow; access is denied by default unless an Allow grants it and no Deny matches.
- Identity-based policies attach to a user, group, or role; resource-based policies (such as an S3 bucket policy or Lambda resource policy) attach to the resource and can grant cross-account access, for example a bucket policy granting another account's Lambda execution role s3:GetObject, with that role granted the matching permission.
- Use aws sts assume-role --role-arn ... --role-session-name to obtain short-lived credentials for cross-account access or role switching, reducing exposure if credentials leak.
- Implement identity federation with Amazon Cognito: user pools sign users in and issue JWTs, and identity pools exchange tokens from user pools or external identity providers for temporary AWS credentials; MFA can be required at sign-in.
- Protect APIs with an Amazon Cognito user pool authorizer that validates the caller's JWT, and add AWS WAF with managed rule groups to block common web exploits such as SQL injection and cross-site scripting.
- Use presigned URLs for secure, time-limited access: an S3 presigned URL (aws s3 presign ... --expires-in 3600) grants temporary access to a private object without changing bucket permissions, and CloudFront signed URLs or signed cookies restrict access to content served through a distribution.
- Restrict an S3 origin to CloudFront using Origin Access Control (OAC), the recommended replacement for the older Origin Access Identity (OAI), so the bucket is not directly reachable.
- Apply encryption at rest and in transit, and choose between server-side encryption (SSE-S3, SSE-KMS, or SSE-C, where the service encrypts the data) and client-side encryption, where the application encrypts data before sending it.
- AWS KMS manages encryption keys for data at rest in S3, EBS, RDS, and more; Encrypt and Decrypt handle small payloads (up to 4 KB), so for larger data call GenerateDataKey and use envelope encryption, and rotate customer managed keys as needed.
- Manage certificates with AWS Certificate Manager (ACM), which provisions and auto-renews free public TLS certificates for CloudFront, ALB, and API Gateway, and AWS Private CA for private certificates; for development, generate SSH key pairs with aws ec2 create-key-pair.
- Identify, mask, and limit access to sensitive data such as PII and PHI, for example with CloudWatch Logs data protection policies that detect and mask sensitive values so only principals with the logs:Unmask permission can view them.
- Store secrets in AWS Secrets Manager or SSM Parameter Store (SecureString) encrypted with KMS and fetch them at runtime with aws secretsmanager get-secret-value --secret-id or aws ssm get-parameter --name --with-decryption, so the app also picks up values rotated by a Secrets Manager rotation Lambda; never embed credentials in code or plaintext environment variables.
- Request and manage access to AI services such as Amazon Bedrock with IAM: grant the application role only the invoke actions it needs, scoped to the specific model ARNs, rather than broad access to every model.
- Use data privacy controls when sending data to AI services: VPC endpoints through AWS PrivateLink keep traffic to Amazon Bedrock on private connectivity, and Bedrock does not use your inputs and outputs to train models.
- Filter and control AI model inputs and outputs by applying content filtering, sensitive information detection with PII and PHI redaction, denied topic policies, and prompt injection and manipulation protection, for example the filters Amazon Bedrock Guardrails provides; designing AI safety frameworks and governance is out of scope for this exam.
- Secure AI agent interactions with tool-use authorization (the agent may call only the tools and resources it is permitted), session isolation between users, and human-in-the-loop approval before sensitive actions; protect sensitive content in monitoring logs, such as Bedrock model invocation logs that capture prompts and responses, by restricting and encrypting access and masking PII.
Domain 3: Testing and Deployment
- Manage dependencies for code modules within packages (environment variables, configuration files, container images), store build artifacts and deployment packages in Amazon S3, and store and version application packages and dependencies in AWS CodeArtifact.
- Build and manage container images for deployment: write a Dockerfile, tag images meaningfully (for example with a version or commit ID rather than relying on latest), push them to Amazon ECR, and use ECR lifecycle policies to expire old or untagged images.
- Manage environment-specific configuration outside the code with AWS AppConfig, Systems Manager Parameter Store, Secrets Manager, and Lambda environment variables (encrypted with KMS), so the same artifact can run in each environment.
- Use API Gateway stages for stage-specific URLs (for example dev and prod), stage variables to point each stage at different backends, and custom domain names to give a stable endpoint across deployments.
- Develop and validate tests with AWS SAM, AWS CDK, and AWS CloudFormation; with SAM, sam local invoke -e event.json runs a function locally with a JSON test event, sam local start-api serves the API locally, and sam local generate-event produces sample event payloads.
- Mock external dependencies with an API Gateway mock integration, which returns a configured response without calling a backend, so front-end and integration tests can run before the real service exists.
- Create application environments with Lambda aliases, container image tags, AWS Amplify branches, AWS Copilot environments, and API Gateway stages; publish an immutable Lambda version with aws lambda publish-version and point a mutable alias at it, and aliases can split traffic by weight between two versions.
- Use AWS AI tools to generate tests and automate repetitive testing work: generating unit and regression tests, running them automatically, analyzing results, and checking test coverage; review AI-generated tests the same way you review code.
- Choose a Lambda deployment packaging method for efficiency: a .zip archive of code and dependencies (update with aws lambda update-function-code --zip-file fileb://function.zip), a container image up to 10 GB stored in ECR, or layers that share common libraries across functions.
- Deploy containerized applications with Amazon ECS task definitions or Amazon EKS manifests, run them on AWS Fargate to avoid managing servers, and roll out new versions with rolling updates that replace tasks or pods gradually.
- AWS CloudFormation provisions infrastructure as code; create a change set to preview exactly what aws cloudformation update-stack will change, and share values between stacks by exporting Outputs and referencing them with Fn::ImportValue.
- AWS SAM is a CloudFormation extension for serverless apps: build with sam build and deploy with sam deploy; set AutoPublishAlias to publish a new version behind an alias and add DeploymentPreference (for example Type: Canary10Percent5Minutes) to shift alias traffic gradually through CodeDeploy.
- AWS CodeBuild compiles, tests, and packages code according to a buildspec.yml file at the root of the source directory.
- An AppSpec file drives CodeDeploy; lifecycle event hooks that run custom scripts are defined under the Hooks section, and the file is appspec.yml for EC2 and on-premises or appspec.yaml or JSON for Lambda and ECS.
- Implement deployment strategies: all-at-once, rolling, blue/green, linear (shift a fixed percentage on an interval), and canary (shift a small percentage, wait, then shift the rest); Elastic Beanstalk offers rolling, rolling with additional batch, and immutable deployment policies.
- Implement automatic or manual rollback: CodeDeploy can roll back automatically when an associated CloudWatch alarm trips during a deployment, and CloudFormation rolls a failed stack update back to the last known good state unless you choose to retain resources for debugging.
- Use AWS CodePipeline to orchestrate CI/CD: invoke a pipeline from a linked code repository, use source control branches and tags to manage versions and releases, progress through multiple environments, and add a manual approval action before production.
- Use AWS AI tools to support CI/CD workflows, for example automated deployment approvals, environment provisioning, and post-deployment validation of the release.
Domain 4: Troubleshooting and Optimization
- Debug application code and service integration issues by reading the error: an AccessDenied points to IAM permissions, a throttling error to limits or missing backoff, and an API Gateway 502 from a Lambda proxy integration often to a malformed function response; set a client timeout shorter than the downstream timeout so callers fail fast.
- Interpret application metrics with Amazon CloudWatch, querying them with aws cloudwatch get-metric-statistics using the correct namespace, dimensions, and time range, and use metrics such as duration, errors, and throttles to detect performance bottlenecks.
- Tail Lambda logs in real time with aws logs tail /aws/lambda/myFn --follow, and query logs with CloudWatch Logs Insights (aws logs start-query) for ad hoc analysis such as sorting by @duration.
- Troubleshoot deployment failures from output logs: CloudFormation stack events show which resource failed and why, CodeBuild logs show failed build commands, and CodeDeploy reports the lifecycle event that failed.
- Use AWS AI tools to analyze errors and generate troubleshooting suggestions during a root cause analysis, then confirm each suggestion against the actual metrics, logs, and traces before acting on it.
- Implement structured logging, for example JSON log entries for application events and user actions (Lambda can emit logs in JSON format), so logs can be filtered and queried by field.
- Emit custom metrics from code with the CloudWatch PutMetricData API or the Embedded Metric Format (EMF), which writes metrics as structured log entries that CloudWatch extracts.
- Implement notification alerts: CloudWatch alarms on operational metrics (for example Lambda Errors or DynamoDB throttles) notify an SNS topic, and EventBridge rules can notify on events such as a completed deployment or a quota limit being approached.
- Implement tracing with AWS X-Ray: enable active tracing on Lambda with aws lambda update-function-configuration --tracing-config Mode=Active, instrument code with OpenTelemetry (AWS Distro for OpenTelemetry) or the X-Ray SDK, and inspect the service map and trace segments to find latency.
- Monitor workload health with application health checks: load balancer target group health checks, container health checks in ECS task definitions, and liveness and readiness probes for pods on EKS.
- Apply concurrency concepts: Provisioned Concurrency keeps Lambda execution environments initialized to remove cold-start latency, while reserved concurrency (aws lambda put-function-concurrency --reserved-concurrent-executions) caps and guarantees a function's concurrent executions; EC2 Auto Scaling adjusts instance count to load.
- Lambda CPU is allocated in proportion to the memory setting, so increasing memory can speed up CPU-bound functions and sometimes lower overall cost by reducing duration.
- Use connection pooling: Amazon RDS Proxy pools and shares database connections so many concurrent Lambda invocations do not exhaust the database, and SDK clients created outside the handler are reused across invocations.
- Optimize application messaging: SQS long polling (--wait-time-seconds up to 20) reduces empty responses and cost, ReceiveMessage returns up to 10 messages per call, and SNS fan-out to multiple SQS queues lets several consumers process the same event independently.
- Configure an SQS dead-letter queue by setting a RedrivePolicy with deadLetterTargetArn and maxReceiveCount on the source queue so poison messages move aside after repeated failures.
- Implement caching with AWS services: DAX for hot DynamoDB reads, ElastiCache in front of databases, CloudFront at the edge, and API Gateway response caching; protect backends with API Gateway throttling and per-client usage plans with API keys.
- Reduce DynamoDB cost and throttling by using eventually consistent reads (half the read cost of strongly consistent) where strong consistency is not required, and match capacity mode to traffic: on-demand for unpredictable bursts, provisioned with auto scaling for steady load.
- Use AWS AI tools to identify optimization opportunities such as performance bottlenecks, resource usage that can be reduced, and code efficiency improvements, and measure the result with CloudWatch before and after the change.
AWS DVA-C03 exam tips
- Read each scenario for the deciding constraint (lowest cost, least operational overhead, fully managed, synchronous vs asynchronous, strong vs eventual consistency) and eliminate options that violate it before picking.
- Know which domain owns what in DVA-C03: SAM local testing now sits in Testing and Deployment, Lambda performance tuning and provisioned concurrency in Troubleshooting and Optimization, and presigned URLs in Security.
- Expect AI questions in every domain: AI-assisted coding and Amazon Bedrock integration in domain 1, AI service security (access, private connectivity, input and output filtering, agent controls, log protection) in domain 2, AI-generated tests and CI/CD support in domain 3, and AI-assisted root cause analysis and optimization in domain 4.
- Default to IAM roles and temporary credentials plus Secrets Manager or Parameter Store; any answer that hard-codes keys or embeds plaintext secrets is almost always wrong.
- Know the deployment vocabulary cold (container image tags and ECR lifecycle policies, ECS and EKS rolling updates, AutoPublishAlias, DeploymentPreference, canary vs linear vs all-at-once vs blue/green, alarm-based rollback), and map troubleshooting symptoms to CloudWatch metrics, Logs Insights queries, X-Ray traces, or health checks.
Study guide FAQ
How many questions are on DVA-C03 and what score do I need to pass?
The exam has 65 questions: 50 scored and 15 unscored questions that are not identified. You get 130 minutes, results are reported as a scaled score from 100 to 1000, and the minimum passing score is 720. Questions are multiple choice (one correct answer out of four) and multiple response (two or more correct answers out of five or more), and unanswered questions are scored as incorrect.
What changed from DVA-C02 to DVA-C03?
DVA-C02 is in use until 30 November 2026 and DVA-C03 from 1 December 2026. Domain 3 is renamed Testing and Deployment, and the weights move to 30%, 26%, 22%, and 22%. AWS added AI content across the exam: AI-assisted development tools and managed AI service integration in domain 1, a new Security task on AI service risks, AI tools for testing and CI/CD, and AI tools for troubleshooting and optimization. Container image builds and containerized deployments with ECS, EKS, and Fargate were also added, and several skills moved, such as SAM unit testing to domain 3 and Lambda performance tuning to domain 4.
Which AWS services should I focus on most?
Lambda, DynamoDB, API Gateway, S3, SQS, SNS, EventBridge, and IAM remain central, followed by deployment tooling (CloudFormation, SAM, CDK, CodeBuild, CodeDeploy, CodePipeline, ECR, ECS, EKS) and observability (CloudWatch, CloudWatch Logs, X-Ray). The in-scope list now also includes Amazon Bedrock, Amazon Bedrock AgentCore, Amazon Quick, and Kiro, while services such as Amazon SageMaker AI, Amazon Rekognition, and Strands Agents are out of scope.
How much hands-on experience is recommended before taking it?
AWS recommends 1 or more years of hands-on experience developing and maintaining applications with AWS services, proficiency in at least one high-level programming language, and experience with application development tools including AI tools. Designing architectures, designing CI/CD pipelines, selecting foundation models, prompt engineering, and designing AI safety frameworks are out of scope for the target candidate.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- AWS Certified Developer - Associate (DVA-C03) exam guideBlueprint revised DVA-C03 (in use from December 1, 2026) · link and content verified 13 November 2026"Registration for the updated version of the exam (DVA-C03) opened on October 27, 2026. The last day to take the current version of the exam (DVA-C02) is November 30, 2026." Domains and weightings: "Content Domain 1: Development with AWS Services (30% of scored content)", "Content Domain 2: Security (26% of scored content)", "Content Domain 3: Testing and Deployment (22% of scored content)", "Content Domain 4: Troubleshooting and Optimization (22% of scored content)". "The exam includes 50 questions that affect your score." "The exam includes 15 unscored questions that do not affect your score." "The minimum passing score is 720."
- Comparison of DVA-C02 and DVA-C03 (exam guide)link and content verified 13 November 2026"the DVA-C02 exam (in use until November 30, 2026) and the DVA-C03 exam (in use beginning December 1, 2026)"; the side-by-side domain table (Domain 3 renamed Testing and Deployment), the content added (AI-assisted development and AI service security among it) and the recategorizations.