Most Cloud Practitioner study time goes to the big service families: compute, storage, databases, networking. That is reasonable, because Domain 3 (Cloud Technology and Services) is 34% of the exam. But the very first task statement in that domain is not about any service family. Task Statement 3.1 asks you to “define methods of deploying and operating in the AWS Cloud”, and its skills are about how you work with AWS rather than what you build: programmatic access versus the console versus infrastructure as code, one-time operations versus repeatable processes, cloud versus hybrid versus on-premises, and how your network reaches AWS at all.
Behind that task statement sits the largest category in the exam guide’s in-scope list, Management and Governance, with nineteen services, plus a Developer Tools category of eleven. Our existing CLF-C02 guides touch several of these in passing: the core services overview has one line each for CloudFormation and Systems Manager, the security and compliance guide covers CloudTrail and Config, the pricing and billing guide covers Organizations’ consolidated billing and Compute Optimizer, and the support plans guide covers Trusted Advisor and the Health Dashboard. This article fills in the rest: the deployment and operation methods themselves, CloudFormation and the CDK at the depth the exam expects, and every management, governance and developer tool the guide lists, with the keyword cues that map a scenario to the right answer.
What the Exam Guide Actually Says
The CLF-C02 exam guide states Task Statement 3.1 as follows. Knowledge of: different ways of provisioning and operating in the AWS Cloud; different ways to access AWS services; types of cloud deployment models; connectivity options. Skills in:
- “Deciding between options such as programmatic access (for example, APIs, SDKs, CLI), the AWS Management Console, and infrastructure as code (IaC)”
- “Evaluating requirements to determine whether to use one-time operations or repeatable processes”
- “Identifying different deployment models (for example, cloud, hybrid, on-premises)”
- “Identifying connectivity options (for example, AWS VPN, AWS Direct Connect, public internet)”
Task Statement 3.8 then adds, under “developer tool services and capabilities”, the list “AWS AppConfig, AWS Cloud9, AWS CloudShell, AWS CodeArtifact, AWS CodeBuild, AWS CodeCommit, AWS CodeDeploy, AWS CodePipeline, AWS CodeStar, and AWS X-Ray”, with the skill of “identifying the tools to develop, deploy, and troubleshoot applications”.
And the in-scope appendix lists, under Management and Governance: AWS Auto Scaling, AWS CloudFormation, AWS CloudTrail, Amazon CloudWatch, AWS Compute Optimizer, AWS Config, AWS Control Tower, AWS Health Dashboard, AWS Launch Wizard, AWS License Manager, AWS Management Console, AWS Organizations, AWS Resource Groups and Tag Editor, AWS Service Catalog, AWS Systems Manager, AWS Trusted Advisor and the AWS Well-Architected Tool.
The exam itself is 65 questions (50 scored, 15 unscored) in 90 minutes with a passing score of 700 on a 100 to 1,000 scale; the exam guide walkthrough and the domain breakdown cover the format. What matters here is that Task 3.1 and the two service categories together account for a steady handful of questions on every form, and they are almost entirely vocabulary and judgement rather than memorised limits.
Four Ways to Talk to AWS
Everything in AWS is an API call. The console, the CLI, the SDKs and infrastructure-as-code tools are four different front ends to the same set of HTTPS APIs, authenticated by the same IAM identities and policies. Once you hold that model, the “which method” questions become questions about who is acting and how often.
| Method | What it is | Best for | Exam cues |
|---|---|---|---|
| AWS Management Console | Browser-based graphical interface (and a mobile app for monitoring and simple actions) | Exploring, learning, one-off tasks, viewing dashboards and billing | ”visual”, “point and click”, “one-time”, “a new user who wants to explore” |
| AWS Command Line Interface (CLI) | A single tool (aws) that exposes every service’s API as commands; runs on Windows, macOS, Linux, and pre-installed in AWS CloudShell | Scripting repetitive tasks, automation in shell scripts, quick queries | ”script”, “shell”, “automate from a terminal”, “without installing anything” (CloudShell) |
| AWS SDKs and APIs | Libraries for Python (Boto3), JavaScript, Java, .NET, Go, Ruby, PHP, C++, Rust, Kotlin, Swift that call the service APIs from application code | Applications that use AWS services at runtime, custom tooling | ”from within an application”, “programmatically”, “in Python code”, “integrate into existing software” |
| Infrastructure as code (IaC) | Declaring the desired infrastructure in files (CloudFormation templates, CDK code) and letting a service create, update and delete the resources to match | Repeatable environments, version-controlled infrastructure, multi-account and multi-Region rollouts | ”repeatable”, “consistent”, “version control”, “identical dev/test/prod”, “provision the same stack in several accounts” |
Two supporting facts round out the picture. First, every one of these methods needs credentials: the console takes a sign-in (root user, IAM user or federated identity through IAM Identity Center), while the CLI and SDKs take access keys, temporary credentials from an assumed role, or an Identity Center session. The exam guide’s Domain 2 skills name “access keys, password policies, and credential storage (for example, AWS Secrets Manager, AWS Systems Manager)” for exactly this reason; the security and compliance guide covers the identity side. Second, AWS CloudShell is the CLI’s answer to “I do not want to install anything”: a browser-based shell launched from the console with the CLI, common tools and your console permissions already in place, plus a small amount of persistent home-directory storage per Region, at no additional charge.
One-time operations versus repeatable processes
The second Task 3.1 skill is a judgement call the exam dresses up in scenarios. The pattern:
| Requirement | Method | Why |
|---|---|---|
| Look up a single S3 bucket’s settings | Console | One-off, read-only, no need to script |
| Delete 400 old snapshots matching a tag | CLI script | Repetitive within one session; a loop beats 400 clicks |
| Your web app must upload user files to S3 | SDK | Runtime integration inside application code |
| Stand up identical dev, test and prod environments every sprint | IaC (CloudFormation or CDK) | Repeatable, reviewable, version-controlled; drift is detectable |
| Deploy a security baseline to 30 accounts in 3 Regions | CloudFormation StackSets | Repeatable across accounts and Regions from one template |
| Audit which method someone used to delete a resource | CloudTrail | Every method ends in an API call, and CloudTrail records them all |
The tell in the wording is almost always “repeatable”, “consistent”, “identical” or “across multiple accounts” for IaC, versus “quickly”, “once”, “explore” or “a new team member” for the console.
Infrastructure as Code: CloudFormation
AWS CloudFormation is the native IaC service and the one the exam expects you to know best. The vocabulary:
| Term | Meaning |
|---|---|
| Template | A JSON or YAML file describing resources (an EC2 instance, a VPC, an IAM role, a DynamoDB table) and their properties, parameters and outputs |
| Stack | A running instance of a template: the set of resources CloudFormation created from it, managed as one unit; delete the stack and every resource goes with it |
| Change set | A preview of what an update will create, modify or replace before you apply it |
| Drift detection | A check comparing the real resources to the template, flagging anything changed outside CloudFormation |
| StackSets | One template deployed as stacks across many accounts and Regions, usually driven by AWS Organizations |
| Nested stacks | Stacks that create other stacks, for reusing common components |
| CloudFormation Registry | The catalogue of resource types CloudFormation can manage, including third-party and your own private types |
| Stack refactoring | Moving resources between stacks or renaming logical IDs without recreating them, added in February 2025 |
| IaC generator | Scans existing resources in an account and produces a template for them, so hand-built infrastructure can be brought under IaC |
| Git sync | Keeps a stack in step with a template committed in a Git repository |
| AWS Infrastructure Composer | A visual drag-and-drop designer that produces CloudFormation templates (renamed from AWS Application Composer in October 2024) |
CloudFormation itself has no charge; you pay for the resources it creates (with a small per-operation charge only for third-party resource types from the Registry). It rolls back a failed stack creation by default, so a half-built environment does not linger. Templates are declarative: you describe the end state and CloudFormation works out the API calls and their order, including dependencies between resources.
For the Cloud Practitioner, that is enough: a template is the blueprint, a stack is the deployed copy, change sets preview updates, drift detection catches console edits, StackSets scale to many accounts. The CloudFormation guide for the DevOps exam goes much deeper if you are heading that way.
The AWS Cloud Development Kit (CDK)
The CDK lets you write infrastructure in a general-purpose programming language (TypeScript, JavaScript, Python, Java, C#, Go) using high-level building blocks called constructs. When you run cdk deploy, the CDK synthesizes your code into a CloudFormation template and hands it to CloudFormation to deploy. So the CDK is not an alternative to CloudFormation; it is a way to author CloudFormation with loops, functions, types and unit tests instead of hand-written YAML.
The exam framing is one sentence: CloudFormation is the IaC engine; the CDK is a code-first way to produce CloudFormation templates. If a scenario says “the team wants to define infrastructure in Python with reusable components”, the answer is the CDK. If it says “the team wants to preview changes before applying them”, the answer is a CloudFormation change set, whether the template came from the CDK or not.
Where Elastic Beanstalk fits
AWS Elastic Beanstalk also creates CloudFormation stacks behind the scenes, but it is a platform-as-a-service for applications: you upload code and Beanstalk provisions the EC2 instances, load balancer, scaling and monitoring for you. The compute services guide positions it against Lightsail and App Runner. The distinction the exam draws is “I want to describe infrastructure” (CloudFormation or CDK) versus “I just want to deploy my web app and not think about infrastructure” (Beanstalk).
Third-party IaC tools exist and are widely used; the IaC concepts guide explains the declarative model they share with CloudFormation. They are not in scope for CLF-C02, and an answer option naming one is a distractor.
Deployment Models: Cloud, Hybrid, On-Premises
Task 3.1’s third skill is the three deployment models. The definitions are short; the exam tests whether you can name the AWS services that make the hybrid model work.
| Model | Definition | Typical reasons |
|---|---|---|
| Cloud (cloud-native, all-in) | Every part of the application runs in AWS | Elasticity, pay-as-you-go, global reach, no data-centre operations |
| Hybrid | Some components in AWS, some in an on-premises data centre or colocation facility, connected together | Gradual migration, data residency or latency constraints, existing hardware investments, regulatory requirements |
| On-premises (private cloud) | Everything stays in your own data centre, often using virtualisation and resource management tools to mimic cloud behaviour | Legacy constraints; rarely the “right” exam answer unless the scenario demands it |
The hybrid toolbox, each of which has appeared as a CLF-C02 answer:
| Need in a hybrid design | AWS service | Covered in |
|---|---|---|
| Run AWS infrastructure and services physically in your own data centre | AWS Outposts | global infrastructure guide |
| Single-digit-millisecond latency to a metro area, or 5G edge | AWS Local Zones, AWS Wavelength | same |
| Present on-premises applications with cloud storage (file, volume, tape) | AWS Storage Gateway | storage services guide |
| Move large datasets without the network | AWS Snow Family | same |
| Manage on-premises servers and VMs alongside EC2 from one place | AWS Systems Manager (hybrid and multicloud managed nodes) | below |
| Run containers on your own hardware with the same control plane | Amazon ECS Anywhere, Amazon EKS Anywhere | compute services guide |
| Extend a directory or identity to AWS | AWS Directory Service, IAM Identity Center | security guide |
| Private, dedicated or encrypted network path between sites | AWS Direct Connect, AWS Site-to-Site VPN | next section |
A hybrid question usually names a constraint (“must keep customer data on premises for two years”, “needs 2 ms latency to the factory floor”, “wants to retire tape backups”) and expects the matching service. Outposts, Storage Gateway and Direct Connect are the three most common correct answers.
Connectivity Options
The fourth skill lists three options by name. The networking guide covers them in detail; here is the decision view the exam uses:
| Option | What it is | Choose when the scenario says… |
|---|---|---|
| Public internet | Plain HTTPS to AWS public endpoints; the default for the console, CLI, SDKs and most API calls | ”quickly”, “no special setup”, “public website”, “small team” |
| AWS Site-to-Site VPN | Encrypted IPsec tunnels over the internet between your network and a VPC (via a virtual private gateway or transit gateway) | “encrypted”, “quick to set up”, “cost-effective”, “backup for Direct Connect” |
| AWS Client VPN | Managed OpenVPN-based access for individual users to a VPC | ”remote employees”, “laptops”, “individual users” |
| AWS Direct Connect | A dedicated private physical connection from your premises to AWS, not over the public internet | ”consistent network performance”, “large data transfer”, “lower data transfer cost”, “private connection”, “avoid the public internet” |
| AWS Transit Gateway | A hub connecting many VPCs and on-premises networks | ”hub-and-spoke”, “hundreds of VPCs” |
| AWS PrivateLink / VPC endpoints | Private connectivity from a VPC to AWS services without an internet gateway | ”access S3 without traversing the internet” |
Two nuances win points. Direct Connect is private but not encrypted by default; if the scenario needs both, the answer is a VPN over Direct Connect (or MACsec on supported ports, which is beyond CLF-C02). And Site-to-Site VPN is the fast, cheap option while Direct Connect takes weeks to provision, so “needed by next week” rules Direct Connect out.
The Management and Governance Toolbox
Here is every in-scope service in the category, with the one-sentence purpose and the phrase that signals it in a question. The services already covered in depth elsewhere are linked; the rest get their own sections below.
| Service | Purpose | Exam cue | Depth |
|---|---|---|---|
| AWS Management Console | Browser and mobile GUI for AWS | ”visual”, “one-time” | above |
| AWS CloudFormation | Infrastructure as code: templates, stacks, change sets, StackSets | ”repeatable”, “template”, “provision identical environments” | above |
| AWS Systems Manager | Operational hub for fleets of EC2 and on-premises nodes: patching, run commands, sessions, parameters, inventory | ”manage a fleet”, “patch”, “run a command on 500 instances”, “no SSH or bastion” | below |
| AWS Organizations | Central management of multiple accounts: OUs, policies, consolidated billing | ”multiple accounts”, “central policy”, “restrict what member accounts can do” | below |
| AWS Control Tower | Automated setup and governance of a multi-account environment (landing zone) with guardrails called controls | ”set up a new multi-account environment with best practices”, “landing zone” | below |
| AWS Service Catalog | Curated catalogue of approved, pre-configured products end users can launch themselves | ”self-service”, “approved templates”, “governance over what teams deploy” | below |
| AWS Launch Wizard | Guided sizing and deployment of enterprise applications such as SAP and Microsoft SQL Server, producing CloudFormation | ”deploy SAP / SQL Server following best practices without deep expertise” | below |
| AWS License Manager | Track and enforce software licences (Microsoft, Oracle, SAP, IBM) across AWS and on premises | ”bring your own licence”, “avoid licence overages”, “track licence usage” | below |
| AWS Resource Groups and Tag Editor | Group resources by tag or stack; bulk-edit tags across Regions | ”organise resources by project”, “apply tags to many resources at once” | below |
| AWS Auto Scaling | Unified scaling plans across EC2 Auto Scaling groups, ECS services, DynamoDB and Aurora | ”automatically adjust capacity”, “scale multiple resources with one plan” | below |
| AWS Compute Optimizer | ML-based rightsizing recommendations for EC2, Auto Scaling groups, EBS, Lambda, ECS on Fargate and RDS | ”rightsize”, “over-provisioned instances” | pricing guide |
| AWS Well-Architected Tool | Free console tool to review a workload against the six pillars and get improvement plans | ”review architecture against best practices” | cloud concepts guide |
| Amazon CloudWatch | Metrics, logs, alarms, dashboards, events | ”monitor CPU”, “alarm when…”, “application logs” | security guide FAQ and the SAA monitoring guide |
| AWS CloudTrail | Record of every API call: who, what, when, from where | ”audit”, “who deleted”, “compliance record of API activity” | security guide |
| AWS Config | Resource configuration inventory, history and compliance rules | ”is this resource compliant”, “configuration changed over time” | security guide |
| AWS Trusted Advisor | Best-practice checks across cost, performance, security, fault tolerance, service limits, operational excellence | ”recommendations”, “underutilised”, “open security groups” | support plans guide |
| AWS Health Dashboard | Service health (public) and your account’s events (personal) | “is there an AWS outage”, “scheduled maintenance affecting my instances” | support plans guide |
AWS Systems Manager
Systems Manager is the operations console for fleets. A managed node is any EC2 instance, on-premises server, VM or even another cloud’s VM running the SSM Agent and registered with the service, which is what makes it a hybrid tool as much as an AWS one. Its capabilities are each a small product of their own; the ones the exam reaches for:
| Capability | What it does | Cue |
|---|---|---|
| Session Manager | Browser or CLI shell into a node with no open inbound ports, no SSH keys and no bastion host, logged and IAM-controlled | ”securely connect without SSH”, “no bastion” |
| Run Command | Execute a command or script on many nodes at once | ”run on hundreds of instances” |
| Patch Manager | Scan and patch OS and applications on a schedule with patch baselines | ”automate patching” |
| State Manager | Keep nodes in a defined configuration (agents installed, settings applied) | “ensure configuration stays consistent” |
| Automation | Runbooks for multi-step operational tasks (create AMIs, remediate findings) | “automate common maintenance tasks” |
| Parameter Store | Hierarchical storage for configuration data and secrets (plain or encrypted with KMS) | “store configuration values”, “database connection string” (Secrets Manager when rotation is required) |
| Inventory | Collect installed software, OS details and network configuration from nodes | ”what software is installed across the fleet” |
| Fleet Manager | Console UI for node-level management (file system, logs, users) | “manage servers from the console” |
| OpsCenter and Incident Manager | Track operational issues and run incident response | ”central place for operational work items” |
| Quick Setup and Application Manager | Configure Systems Manager features across accounts; view applications as groups of resources | ”set up across the organisation” |
The exam cue is “operational management at scale”, and the distractor is usually CloudWatch (which observes) or Config (which records configuration) rather than Systems Manager (which acts on the instances). For the security angle on Session Manager, the Secure Administrative Access guide goes deep; the DevOps Systems Manager guide covers the automation side.
AWS Organizations
Organizations lets one management account govern many member accounts, arranged in organizational units (OUs). The pricing guide covers consolidated billing, the feature the exam asks about most: one bill, volume-pricing tiers and Reserved Instance or Savings Plans discounts shared across accounts. The governance side has grown into four policy types:
| Policy type | What it controls | Since |
|---|---|---|
| Service control policies (SCPs) | The maximum permissions IAM users and roles in member accounts can have, regardless of their IAM policies; they never grant permissions and do not apply to the management account | long-standing |
| Resource control policies (RCPs) | The maximum permissions on resources in the organisation, such as S3 buckets, KMS keys, SQS queues and Secrets Manager secrets, so that even an external principal cannot exceed them; a data-perimeter tool | November 2024 |
| Declarative policies | Baseline configuration enforced at the service level, for example blocking public AMIs or requiring IMDSv2 across EC2, EBS and VPC, regardless of who makes the API call | December 2024 |
| Tag, backup and AI services opt-out policies | Standardise tags, apply AWS Backup plans, and opt out of AI service data use across accounts | long-standing |
For CLF-C02, the two-sentence model is enough: SCPs restrict what identities in member accounts may do; consolidated billing gives one bill and shared discounts. A question that says “prevent any account in the organisation from disabling CloudTrail” is an SCP; “one invoice for all accounts” is consolidated billing; “restrict access to our S3 buckets even from outside identities” is an RCP. The multi-account governance guide covers the mechanics for the Security Specialty.
AWS Control Tower
Control Tower is the opinionated, automated way to build a multi-account environment. It sets up a landing zone: an organisation with recommended OUs (Security, Sandbox), dedicated log-archive and audit accounts, centralised CloudTrail and Config, and IAM Identity Center for sign-in. Account Factory then creates new accounts to that standard on request. Governance comes from controls (formerly called guardrails) in three flavours:
- Preventive controls stop actions from happening, implemented as SCPs.
- Detective controls find non-compliant resources after the fact, implemented as AWS Config rules.
- Proactive controls block non-compliant resources before CloudFormation creates them, implemented as CloudFormation hooks.
A dashboard shows compliance across accounts. The distinction from Organizations: Organizations is the foundation (accounts, OUs, policies); Control Tower is the prescriptive automation built on top of it. “Set up a secure multi-account environment quickly following AWS best practices” is Control Tower; “group accounts and apply a policy” is Organizations.
AWS Service Catalog
Service Catalog answers “how do we let teams deploy things themselves without losing governance?” Administrators create products (typically CloudFormation templates), group them into portfolios, grant access to users or groups, and attach constraints (for example a launch constraint that runs the deployment with an administrator role so the end user needs no direct permissions, or template constraints that limit instance sizes). End users browse the catalogue and launch provisioned products on demand. AppRegistry adds a view of applications as collections of resources. The cue is “self-service with approved configurations”; the governed self-service guide covers the architecture.
AWS Launch Wizard
Launch Wizard is a guided deployment tool for enterprise workloads that are hard to size and configure correctly: SAP, Microsoft SQL Server (including Always On availability groups), Exchange, Active Directory and others. You answer questions about the workload, it recommends instance types and storage, estimates cost, and deploys the environment following AWS and vendor best practices, generating CloudFormation templates you can reuse. There is no charge for Launch Wizard itself. The cue is a named enterprise application plus “best practices” and “without deep expertise”.
AWS License Manager
License Manager tracks software licences across AWS and on-premises, for vendors such as Microsoft, Oracle, SAP and IBM. You define licence rules (per vCPU, per socket, per instance), associate them with AMIs or launch templates, and License Manager counts usage and can block launches that would exceed your entitlement. It also manages Dedicated Hosts for bring-your-own-licence (BYOL) scenarios and tracks licences bought through AWS Marketplace. Cue words: “BYOL”, “avoid licence overages”, “track licence usage centrally”.
AWS Resource Groups and Tag Editor
Tags are the key-value labels on AWS resources that drive cost allocation, automation and access control. Resource Groups let you create a view of resources that share tags (or belong to a CloudFormation stack) and act on them together, for example in Systems Manager. Tag Editor finds resources across Regions and adds or edits tags on many of them at once. The exam cue is “organise resources by project or environment” and “apply tags in bulk”.
AWS Auto Scaling
The in-scope list names “AWS Auto Scaling”, which is the umbrella service that builds scaling plans across several resource types (EC2 Auto Scaling groups, ECS services, DynamoDB tables and indexes, Aurora replicas) with predictive and dynamic scaling. Amazon EC2 Auto Scaling is the EC2-specific service that most scaling questions are really about: launch templates, minimum, maximum and desired capacity, health checks and scaling policies. If a scenario is purely about EC2, the answer is EC2 Auto Scaling; if it says “scale several different resources with one unified plan”, it is AWS Auto Scaling. Both are free; you pay for the capacity they launch.
The Developer Tools Category
Task 3.8’s skill is “identifying the tools to develop, deploy, and troubleshoot applications”. The exam guide lists eleven tools, and three of them have changed status since the guide was written. Current state:
| Tool | Purpose | Status note |
|---|---|---|
| AWS CLI | Command-line access to every service | Active |
| AWS CloudShell | Browser-based shell with the CLI pre-installed and persistent home storage | Active; AWS’s recommended replacement for Cloud9 shell use |
| AWS Cloud9 | Browser-based IDE on an EC2 instance or your own server | No longer available to new customers since 25 July 2024; existing customers can continue; AWS points new users to IDE toolkits and CloudShell |
| AWS CodeCommit | Managed private Git repositories | Closed to new customers on 25 July 2024, then re-opened to new customers on 25 November 2025 |
| AWS CodeBuild | Managed build service: compiles, runs tests, produces artifacts | Active |
| AWS CodeDeploy | Automates deployments to EC2, on-premises servers, Lambda and ECS, including blue/green | Active |
| AWS CodePipeline | Orchestrates the stages of a release pipeline from source to deploy | Active |
| AWS CodeArtifact | Managed artifact repository for packages (npm, PyPI, Maven, NuGet) | Active |
| AWS CodeStar | Project templates that wired the Code services together | Reached end of support on 31 July 2024 |
| AWS AppConfig | Feature flags and dynamic configuration deployed safely with validation and rollback | Active |
| AWS X-Ray | Distributed tracing to find latency and errors across services | Active as a service; the X-Ray SDKs and daemon entered maintenance mode in February 2026 in favour of OpenTelemetry |
The exam will not ask about those dates, but it may still ask what each tool is for, because the guide lists them. The reliable mapping: develop (CodeCommit for source, Cloud9 or your own IDE for editing, CloudShell for a terminal), build (CodeBuild), store artifacts (CodeArtifact), deploy (CodeDeploy for the deployment itself, CodePipeline for the pipeline that orchestrates it, AppConfig for configuration changes without redeploying code), troubleshoot (X-Ray for traces, CloudWatch for metrics and logs). The CodePipeline guide, the AppConfig guide and the X-Ray internals guide go deep for the professional and associate exams.
Scenario Drill
| Scenario | Answer |
|---|---|
| A new administrator wants to explore AWS services and view a billing dashboard | AWS Management Console |
| A script must create 50 IAM users from a CSV file | AWS CLI (or an SDK) |
| A web application running on EC2 must store uploaded images in S3 | AWS SDK for the application’s language |
| A team must provision identical dev, test and prod environments every release and keep the definition in Git | AWS CloudFormation (IaC) |
| Developers want to define infrastructure in TypeScript with reusable components | AWS CDK (which synthesizes CloudFormation) |
| A company wants to preview exactly which resources an infrastructure update will replace | CloudFormation change set |
| Someone edited a security group in the console and the team wants to detect such changes against the template | CloudFormation drift detection |
| Deploy the same baseline stack to every account in the organisation | CloudFormation StackSets |
| Run a shell command on 300 instances without logging into each | Systems Manager Run Command |
| Connect to an instance for troubleshooting without opening port 22 or a bastion | Systems Manager Session Manager |
| Apply OS patches on a schedule across the fleet | Systems Manager Patch Manager |
| Receive one invoice for all 12 accounts and share Reserved Instance discounts | AWS Organizations consolidated billing |
| Prevent any member account from launching resources outside two approved Regions | AWS Organizations service control policy |
| Set up a new multi-account environment with pre-configured security and logging accounts in hours | AWS Control Tower |
| Let project teams launch pre-approved, pre-configured application stacks themselves | AWS Service Catalog |
| Deploy SQL Server Always On following best practices without a database expert on staff | AWS Launch Wizard |
| Track Oracle licences used across AWS and on-premises and stop launches that exceed entitlement | AWS License Manager |
| Add a cost-centre tag to hundreds of resources across three Regions | Tag Editor |
| Keep part of an application on premises for regulatory reasons while moving the rest to AWS | Hybrid deployment model |
| Run AWS services on hardware inside your own data centre | AWS Outposts |
| Need a private, consistent, high-bandwidth connection from a data centre to AWS | AWS Direct Connect |
| Need an encrypted connection to a VPC set up this week at low cost | AWS Site-to-Site VPN |
| Compile source code and run tests automatically on each commit | AWS CodeBuild |
| Orchestrate source, build, test and deploy stages into one release workflow | AWS CodePipeline |
| Deploy a new version to EC2 instances with blue/green to minimise downtime | AWS CodeDeploy |
| Find which downstream service adds latency to requests | AWS X-Ray |
| Review a workload against the six pillars and get improvement recommendations | AWS Well-Architected Tool |
Keyword Cue Cheat Sheet
- “Repeatable”, “consistent”, “template”, “version control”, “identical environments”: CloudFormation; “in a programming language”: CDK.
- “Preview changes”: change set; “changed outside the template”: drift detection; “many accounts and Regions”: StackSets.
- “Without installing anything”, “browser-based shell”: CloudShell.
- “Fleet”, “patch”, “run command”, “no SSH”: Systems Manager.
- “Multiple accounts”, “one bill”, “restrict member accounts”: Organizations (consolidated billing, SCPs).
- “Landing zone”, “guardrails/controls”, “best-practice multi-account setup”: Control Tower.
- “Self-service”, “approved products”, “portfolio”: Service Catalog.
- “SAP”, “SQL Server”, “guided deployment”: Launch Wizard.
- “BYOL”, “licence tracking”: License Manager.
- “Bulk tag”, “group by tag”: Resource Groups and Tag Editor.
- “Private connection”, “consistent bandwidth”: Direct Connect; “encrypted over the internet”, “quick”: Site-to-Site VPN.
- “On-premises hardware running AWS”: Outposts; “part cloud, part on-premises”: hybrid.
Common Mistakes
- Treating the CDK as a competitor to CloudFormation. It generates CloudFormation templates; CloudFormation still deploys them.
- Picking Elastic Beanstalk for an infrastructure question. Beanstalk deploys applications; CloudFormation describes infrastructure.
- Confusing Organizations with Control Tower. Organizations is the account-and-policy foundation; Control Tower is the automated, prescriptive landing zone built on it.
- Confusing Systems Manager with CloudWatch or Config. CloudWatch observes metrics and logs, Config records configuration and compliance, Systems Manager acts on instances.
- Assuming SCPs grant permissions. They only cap what IAM policies in member accounts can allow, and they do not affect the management account.
- Assuming Direct Connect is encrypted. It is private and dedicated, not encrypted by default; add a VPN for encryption.
- Answering “on-premises” when “hybrid” is meant. If any component runs in AWS, the model is hybrid.
- Forgetting that every method is an API call. CloudTrail records console, CLI, SDK and CloudFormation actions alike, which is why “who did this” is always CloudTrail.
Frequently Asked Questions
What does CLF-C02 Task Statement 3.1 cover?
“Define methods of deploying and operating in the AWS Cloud”: choosing between programmatic access (APIs, SDKs, CLI), the Management Console and infrastructure as code; deciding between one-time operations and repeatable processes; identifying cloud, hybrid and on-premises deployment models; and identifying connectivity options such as AWS VPN, Direct Connect and the public internet.
What is the difference between the AWS CLI, the SDKs and CloudFormation?
All three call the same AWS APIs. The CLI is for humans and scripts at a terminal, the SDKs are for application code, and CloudFormation is for declaring whole environments in templates so they can be created, updated and deleted repeatably. CloudShell is a browser-based terminal with the CLI pre-installed.
Is the AWS CDK the same as CloudFormation?
No. The CDK lets you write infrastructure in languages such as TypeScript or Python; it synthesizes that code into a CloudFormation template, which CloudFormation then deploys. Think of the CDK as an authoring layer on top of CloudFormation.
What is the difference between AWS Organizations and AWS Control Tower?
Organizations provides the multi-account foundation: accounts, organizational units, consolidated billing and policies such as SCPs. Control Tower uses Organizations (plus Config, CloudTrail and IAM Identity Center) to set up and govern a best-practice landing zone automatically, with preventive, detective and proactive controls and an Account Factory.
What is AWS Systems Manager used for?
Operating fleets of EC2 instances and on-premises servers at scale: shell access without SSH (Session Manager), running commands on many nodes (Run Command), patching (Patch Manager), configuration storage (Parameter Store), inventory, automation runbooks and more. Its nodes can be in AWS, on premises or in other clouds.
Which AWS services support a hybrid deployment model?
AWS Outposts, Local Zones and Wavelength for compute close to or inside your facilities; Storage Gateway and the Snow Family for storage and data transfer; Direct Connect and Site-to-Site VPN for connectivity; Systems Manager for managing on-premises servers alongside EC2; and ECS Anywhere and EKS Anywhere for containers on your own hardware.
Are Cloud9 and CodeCommit still on the Cloud Practitioner exam?
They remain on the CLF-C02 in-scope list, so you should know what they do. Cloud9 has not accepted new customers since July 2024; CodeCommit was closed to new customers in July 2024 and re-opened to them in November 2025. The exam tests purpose, not availability dates.
What is the difference between Direct Connect and a Site-to-Site VPN?
A Site-to-Site VPN is an encrypted tunnel over the public internet that can be set up in minutes at low cost. Direct Connect is a dedicated private physical connection with consistent bandwidth and lower data-transfer rates, but it is not encrypted by default and takes weeks to provision. Many organisations use a VPN as a backup for Direct Connect.
Conclusion
Task Statement 3.1 is about method rather than service: console for one-off and visual work, CLI and CloudShell for scripts, SDKs for application code, and CloudFormation (hand-written or synthesized by the CDK) whenever the word “repeatable” appears. Around it sit three deployment models, of which hybrid is the one with a toolbox to memorise (Outposts, Storage Gateway, Direct Connect, Systems Manager), and the connectivity trio of public internet, Site-to-Site VPN and Direct Connect. The Management and Governance category then adds the operating layer: Systems Manager to act on fleets, Organizations and Control Tower to govern accounts, Service Catalog to offer approved self-service, Launch Wizard and License Manager for enterprise workloads, and Tag Editor to keep everything labelled. Learn each service’s one-sentence purpose and its cue words, and this slice of Domain 3 becomes some of the most predictable scoring on the exam.
To check that the cues have stuck, Sailor.sh’s AWS Certified Cloud Practitioner (CLF-C02) Mock Exam Bundle includes deployment-method, IaC and management-tool scenarios across eight full-length timed mock exams, each with explanations of why the right answer is right and why the near-miss (Beanstalk for CloudFormation, Organizations for Control Tower, CloudWatch for Systems Manager) is wrong. Pair it with the CLF-C02 exam guide, the study plan and the free practice questions.
Continue with the core services overview for the service families these tools deploy, the security and compliance guide for CloudTrail, Config and IAM, and the pricing and billing guide for consolidated billing and Compute Optimizer.