System design and DevOps prep checklist

Use this as a coverage map before a long hands-on build (multi-hour system tests, production cutovers, or architecture reviews). Items marked missed are frequent gap areas in real projects - not obscure trivia.

How to use: For each row, confirm you can explain why, console path, IAM, and failure mode. Deep dives link to posts on this site.

---

1. Identity, access, and secrets

Topic	Industry use	Commonly missed	Reference
IAM roles vs users for workloads	Lambda, ECS, EKS use roles - no long-lived keys	Trust policy sts:AssumeRole conditions (aws:SourceAccount, aws:ArnLike)	IAM policies triage
Permission boundaries & SCPs	Org-wide guardrails	SCP deny does not grant; member account admin can still misconfigure	Security patterns (console)
IAM policy conditions	aws:SourceVpc, aws:PrincipalTag, kms:ViaService	Missing kms:EncryptionContext alignment with S3/SNS	IAM conditions
EKS access (API + RBAC)	aws eks update-cluster-config access entries	Mixing system:masters with IRSA/Pod Identity	EKS operations runbook
Cognito + external IdP (Keycloak)	Human login to apps and clusters	Token issuer URL, audience, separate admin vs app clients	Cognito + Keycloak · EKS + Keycloak (console)
Secrets Manager vs SSM Parameter Store	DB creds, API keys	Rotation Lambda not in same VPC/SG as RDS	RDS IAM auth

---

2. Networking (VPC, hybrid, edge)

Topic	Industry use	Commonly missed	Reference
VPC design (subnets, NAT, endpoints)	Private workloads + controlled egress	Interface endpoints without private DNS on SG	Networking overview
VPC peering	Simple two-VPC connectivity	No transitive routing; CIDR overlap; DNS resolution checkbox	VPC peering (console)
Site-to-Site VPN	On-prem to AWS	VGW vs TGW attachment; route propagation; overlapping CIDR	Site-to-Site VPN (console)
Transit Gateway	Hub for many VPCs/VPN/DX	TGW route tables per segment; appliance mode for stateful FW	Transit Gateway
Network Firewall / centralized egress	Inspection VPC	Asymmetric routing when return path bypasses firewall	Centralized egress
VPC Lattice	Service-to-service across accounts/VPCs	Lattice service network vs ALB; auth policy on association	Lattice app networking · EKS Ingress + Lattice (console)
PrivateLink	SaaS-style consumer/provider	NLB target type; endpoint service permissions	Networking overview

Official hub-and-spoke diagram: AWS Transit Gateway (VPC documentation).

---

3. Containers & Kubernetes (EKS)

Topic	Industry use	Commonly missed	Reference
EKS cluster baseline	Private API, logging, add-ons	Control plane logs not enabled; outdated OIDC provider	EKS getting started
Ingress (ALB)	HTTP(S) to pods	Subnet tags kubernetes.io/role/elb; IRSA for controller	ALB Ingress Controller
Ingress + VPC Lattice	Cross-VPC/account HTTP to K8s	Gateway API vs Ingress; Lattice target group health	EKS Lattice (console)
Kyverno	Policy-as-code (labels, images, nets)	Webhook timeout; exclude system namespaces carefully	Kyverno install · Kyverno console prep
Keycloak on EKS	OIDC for apps	Realm vs client; sticky sessions; DB for Keycloak HA	EKS Keycloak (console)
Storage (EBS/EFS/S3)	Stateful workloads	Fargate + EBS constraints; EFS access points	EKS storage
GitOps / CD	Argo CD, pipelines to cluster	Cluster secret vs repo creds; sync waves	Argo CD install
Node autoscaling	Pending pods get EC2	Cluster Autoscaler and Karpenter both acting on the same pods	Cluster Autoscaler and Karpenter
ECS queue workers	Tasks follow SQS depth	Scaling on CPU or on messages sent, not visible backlog	ECS autoscaling from SQS
AWS Batch	Queues, Fargate or EC2, fair-share	Legacy BEST_FIT, console settings mistaken for resources	Batch console
CloudWatch agent	Memory and disk on EC2	Alarming AWS/EC2 for memory	CloudWatch agent
Log search	Insights, Live Tail, field indexes	Filter syntax used in the wrong search box	Search CloudWatch Logs
Laptop and CLI	SSH, scp, S3 sync, baseline checks	Public SSH, S3 without block public access	SSH, SCP, and AWS CLI

---

4. CI/CD and application delivery

Topic	Industry use	Commonly missed	Reference
CodePipeline multi-stage	Build → test → approve → deploy	Artifact bucket KMS; cross-account roles	CI/CD CodePipeline · CodePipeline console system
CodeBuild	Docker build, tests	VPC build needs NAT/endpoints; privileged mode for Docker	Same as above
CodeDeploy (ECS/EC2/Lambda)	Blue/green	appspec.yaml hooks; listener rule duplication	ECS CodePipeline
ECR lifecycle + permissions	Image hygiene, pull from CI	Lifecycle prefix AND trap; repository policy for cross-account	ECR lifecycle · ECR console access
AppConfig	Safe feature flags & config rollout	Deployment strategy vs hosted configuration version	AppConfig freeform · AppConfig console

---

5. Data stores (networking, security, backup)

Topic	Industry use	Commonly missed	Reference
RDS / Aurora	OLTP	SG only from app tier; not public; subnet group spans 2+ AZ	Databases console guide
DynamoDB	Serverless app state	PITR; CMK vs AWS owned key; VPC endpoints for private access	Same + DAX
Redis / Valkey (ElastiCache)	Cache, sessions	Auth token; in-transit encryption; same VPC as consumers	Valkey + Lambda
Backup & DR	RPO/RTO	AWS Backup vault lock; cross-region copy; restore drill	Databases console guide

---

6. Messaging and integration

Topic	Industry use	Commonly missed	Reference
SQS + SNS with KMS	Event-driven decoupling	SNS → SQS subscription needs CMK on both; key policy ViaService	SQS/SNS KMS & IAM
EventBridge	Bus rules, schedules	Input transformer vs constant; dead-letter on rule target	EventBridge patterns
Streaming ETL (Glue)	Clickstream to lake	Firehose Lambda record contract; crawler vs job order; KMS on Glue role	Glue + Kinesis + Firehose + Lambda
API Gateway + auth	BFF, WebSocket	Cognito authorizer cache; resource policy for private API	API Gateway Cognito · Two authorizers, binary, canary, cache, CORS, ALB proxy

---

7. Storage and encryption

Topic	Industry use	Commonly missed	Reference
S3 SSE-KMS & bucket policies	Data lake, artifacts	Deny aws:SecureTransport; s3:x-amz-server-side-encryption condition	S3 KMS encryption
S3 access points / VPC endpoints	Multi-tenant buckets	AP policy + bucket policy intersection	IAM triage

---

8. Security, compliance, and observability

Topic	Industry use	Commonly missed	Reference
KMS key policies + IAM	Encryption everywhere	Key admin ≠ key user; grant vs policy	Security patterns
CloudTrail / Config	Audit	Multi-region trail; log file validation	Security patterns post
GuardDuty / Security Hub	Threat & posture	Delegated admin account	Security patterns post
WAF + Shield	Edge protection	Rate-based rule scope; logging to S3/Kinesis	API Gateway patterns
Observability stack	Metrics, traces, logs	ADOT vs Fluent Bit; AMP remote write IAM	Grafana/Prometheus

---

9. Full-system combinations (exam-style scenarios)

Practice explaining end-to-end flows - not isolated services:

Scenario	Services typically combined
Secure web app + API + DB	ALB, ECS/EKS, RDS, Secrets Manager, KMS, private subnets, NAT/endpoints
Hybrid reporting	Site-to-Site VPN or DX → TGW → VPC → RDS read replica / Redshift
Multi-account platform	Organizations SCPs, RAM shared subnets/TGW, CI/CD cross-account roles
Event-driven order flow	API Gateway → Lambda → DynamoDB → EventBridge → SQS → worker → SNS notify
Zero-trust internal APIs	VPC Lattice or PrivateLink, IAM auth, no public IPs on workloads
GitOps platform cluster	EKS, Keycloak/Cognito, Kyverno, Argo CD, ECR, CodePipeline

ECS reference implementation: ShopFlow walkthrough (ALB + Service Connect + EFS + Lambda).

GenAI platform: Bedrock AgentCore Part 4.

---

10. Roles, migration, cost, and hidden settings

The four cloud roles (architect, DevOps, developer, security) and the six responsibilities (design, run, build cloud-native, secure, migrate, optimize cost) are mapped in Cloud roles mapped to real AWS work.

Gap this checklist used to skip	Post
Lift-and-shift plus database plus files	MGN, DMS, DataSync
Bill, budgets, NAT, lifecycle	Cost optimization
Checkboxes a scoring rubric hides	Hidden settings
AI APIs without training a model	Textract and Comprehend

11. Console-first study order (suggested)

1. Networking: peering → VPN → TGW (peering, VPN, TGW)
2. Security: KMS, S3, IAM (S3, security patterns)
3. Messaging: SNS/SQS (messaging)
4. Data: RDS/Aurora (databases)
5. Delivery: ECR + CodePipeline (ECR, pipeline)
6. EKS: Lattice ingress, Kyverno, Keycloak (Lattice, Kyverno, Keycloak)
7. Config flags: AppConfig (AppConfig)
8. Roles and the sweep: role map, migration, cost, hidden settings, managed AI

---

AWS official references

• Well-Architected Framework
• AWS Architecture Center
• Prescriptive Guidance

Architecture links index