Skip to main content
Welcome back. This lesson is a focused review of Domain 2: Configuration Management and Infrastructure as Code (IaC). It’s a speed-run designed to surface the key concepts, patterns, and AWS services you should recognize and understand at a surface-to-intermediate level. If you encounter unfamiliar terms, note them and plan focused study with official documentation or course materials.
Domain 2 is 17% of the exam (about 11 of 65 questions). Focus on what each service does, common integration points, and design patterns used for multi-account governance, configuration drift prevention, and automated remediation.
Domain 2 emphasises infrastructure-as-code, platform management, and configuration management. Core services to know: CloudFormation (and StackSets), AWS CDK, Systems Manager (SSM), AWS Config, Control Tower, Service Catalog, AppConfig, and Parameter Store.
A presentation slide titled "Domain 2 at a Glance" summarizing exam details with three boxes: "Exam Weight" (17% of the exam, 11 questions), "3 Task Statements" (defining/deploying IaC, managing platforms, implementing configuration management), and "Core Services" (CloudFormation, CDK, Systems Manager, and AWS Config).

​
CloudFormation fundamentals

CloudFormation converts a declarative template into a stack and then creates the live resources described in that stack. The typical flow is: Template → CloudFormation engine → Stack → Resources Templates are commonly authored in YAML or JSON. Understand the logical grouping, dependency handling, and change set lifecycle so you can reason about safe updates, rollbacks, and drift.
A slide titled "CloudFormation Fundamentals Recall" that diagrams a three-step core flow. It lists 1) Template: JSON or YAML definition, 2) Stack: logical grouping, and 3) Resources: live infrastructure.
Key template sections you should recognize and be able to explain:
A slide titled "CloudFormation Fundamentals Recall" listing five essential components: 01 Parameters, 02 Mappings, 03 Conditions, 04 Resources, and 05 Outputs. The components are shown as colored rounded buttons arranged in a clean layout.
Also be familiar with these operational features:
  • StackSets: deploy a single CloudFormation template across multiple accounts and regions for centralized, consistent provisioning.
  • Drift detection: compares live resource configuration against the template; statuses include IN_SYNC, MODIFIED, DELETED, NOT_CHECKED.
  • Stack policies: JSON policies that protect critical resources during updates (they can be applied and intentionally overridden when necessary).
A presentation slide titled "StackSets – Multi-Account/Multi-Region Deployment." It lists four numbered points—Single Template Source, Administrator Control, Stack Instances, and Permission Models—with short explanations of each.
A presentation slide titled "Drift Detection and Stack Policies" with two colored boxes: one defines drift detection as when actual resource configuration diverges from the expected CloudFormation state, and the other explains stack policies as JSON documents that prevent accidental updates or deletions of critical resources.

​
AWS CDK (Cloud Development Kit)

The AWS CDK enables programmatic, higher-level definitions of CloudFormation resources using familiar languages (TypeScript, Python, Java, C#, Go). The CDK synthesizes code into CloudFormation templates and offers construct libraries at different abstraction layers:
  • L1: low-level CloudFormation resources (1:1 coverage)
  • L2: richer, opinionated constructs (convenience for common patterns)
  • L3: complete patterns or solutions for common architectures
Common CLI operations (conceptual familiarity expected):
A slide titled "AWS CDK Quick Reference" showing two info cards. The left card highlights "Language Flexibility" (TypeScript, Python, Java, C#, Go) and the right card outlines "Construct Levels" (L1: low-level CFN resources, L2: curated/opinionated components, L3: complete architectural patterns).

​
Systems Manager (SSM) — key subservices

Systems Manager is a suite for configuration, operations, and runtime management. Know the core subservices and typical uses:
A slide titled "State Manager and Automation" showing two columns of numbered feature lists: left column for State Manager (associates documents with instances, runs on schedule, ensures consistent config, example CloudWatch agent) and right column for Automation (multi-step runbooks, built‑in AWS automations, approval gates, EventBridge integration).
Note: Automation runbooks are commonly invoked by AWS Config for automated remediation.

​
AWS Config — compliance as code

AWS Config continuously records resource configurations, evaluates them against rules, and surfaces compliance results. Typical workflow: Configuration recording → Rule evaluation → Compliance / Non‑compliance → Remediation Key concepts:
  • Config Rules: Managed or custom checks that evaluate resource state.
  • Conformance Packs: Bundled sets of rules + remediation aligned to compliance frameworks (PCI, HIPAA, CIS).
  • Remediation: Often implemented by Systems Manager Automation documents to apply fixes automatically.
A slide titled "AWS Config – Compliance as Code" showing a four-step timeline: Configuration Recording, Config Rules, Conformance Packs, and Remediation with brief descriptions of each. Numbered colored markers 1–4 sit along a horizontal line under the headings.

​
Control Tower and Organizations

AWS Control Tower orchestrates a best-practice multi-account landing zone using AWS Organizations. Typical responsibilities:
  • Automated account provisioning (Account Factory)
  • Establishing Log Archive and Audit accounts
  • Configuring Single Sign-On (SSO)
  • Enforcing preventive and detective guardrails via Service Control Policies (SCPs) and Config rules
Control Tower helps enforce organizational standards while streamlining new-account onboarding.
A slide titled "Control Tower and Organizations" with a central "AWS Organizations" circle connected to boxes labeled Consolidated billing, Organizational Units (OUs), Service Control Policies (SCPs), and Account factory automation. A right-hand panel explains AWS Control Tower orchestration of multi-account setups with landing zones, guardrails, Account Factory, and compliance controls.

​
Service Catalog

Service Catalog lets platform teams curate and share approved infrastructure and application templates as products. Key concepts:
  • Portfolio: A collection of products (templates or provisioning resources)
  • Product: Versioned template (commonly CloudFormation)
  • Provisioned Product: A deployed instance of a product
  • Constraints: Governance controls applied to product provisioning
Service Catalog enables self-service provisioning with built-in guardrails for compliance and cost control.
A slide titled "Service Catalog Essentials" showing a hierarchical diagram: Portfolio → Product (versioned CloudFormation template) → branching to Provisioned Product (deployed instance) and Constraints (guardrails on deployment, e.g. launch/template constraints).

​
AppConfig vs Parameter Store

Understand when to use each:
  • Parameter Store (SSM): Secure, hierarchical store for static configuration values and secrets (supports SecureString for encryption). Use it for static app settings, secrets management, or cross-account retrieval via IAM.
  • AppConfig: Runtime configuration management for dynamic controls like feature flags, with validators and safe deployment strategies (can do gradual rollouts, automatic rollback based on metrics or anomalies). Use AppConfig when you need controlled, validated runtime configuration changes.
A presentation slide titled "AppConfig for Dynamic Configuration" showing four colorful numbered blocks that describe Configuration Data, Automatic Rollback, Validators, and Deployment Strategy. Each block has a short explanation about storing feature flags, CloudWatch-triggered rollbacks, JSON/Lambda validation, and gradual rollout.

​
Patterns to recognize (Design & Operational)

Recurring design patterns across Domain 2:
  • Multi-account governance and centralized deployment: StackSets, Control Tower, AWS Organizations
  • Compliance automation and remediation: AWS Config + Systems Manager Automation
  • Safe infrastructure changes and drift detection: CloudFormation drift detection, stack policies, CDK synth/diff
  • Self-service, governed provisioning: Service Catalog and AppConfig for runtime configuration
A slide titled "Domain 2 Exam Triggers – Final Review" showing that it covers 17% of the exam and listing must-know AWS services (CloudFormation, StackSets, CDK, Systems Manager, Config, Control Tower) and patterns (multi-account governance, compliance automation, safe infrastructure changes, etc.). The slide is from KodeKloud.
That completes the Domain 2 review. Make a concise list of unfamiliar terms from this lesson and study them more deeply using the links below and official AWS documentation. Good luck with your preparation.

Watch Video