AWS Certified Developer – Associate (DVA-C02): 5 Must-Know Concepts

The AWS Certified Developer – Associate (DVA-C02) validates the ability to develop, deploy, and debug cloud applications on AWS. These five concepts show up repeatedly in DVA-C02 scenarios.

1. AWS Lambda and Serverless Development#

Lambda is the backbone of serverless development on AWS and represents a significant portion of the DVA-C02 exam. You must understand execution context, concurrency, and common pitfalls.

Lambda Execution Model#

Understanding the Lambda execution lifecycle is critical for performance optimization:

# ✅ CORRECT: Initialize connections OUTSIDE the handler
import boto3
from pymysql import connect

# This runs once per execution environment (cold start)
dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('users')
db_connection = connect(host='...', user='...', password='...')

def handler(event, context):
    # This runs on EVERY invocation - keep it lean!
    user_id = event['user_id']
    response = table.get_item(Key={'id': user_id})
    return response['Item']

Key Lambda Limits to Memorize#

Lambda Concurrency#

• Reserved concurrency — Guarantees capacity but limits maximum
• Provisioned concurrency — Keeps execution environments warm to eliminate cold starts
• Unreserved concurrency — Shared pool across all functions (default)

Test Your Understanding#

2. DynamoDB for Developers#

DynamoDB is AWS's flagship NoSQL database and appears heavily on the DVA-C02. You must understand data modeling, capacity modes, and the SDK.

Key Concepts#

• Partition Key — Determines data distribution; high cardinality is essential
• Sort Key — Enables range queries within a partition
• Global Secondary Index (GSI) — Alternate partition/sort key for different access patterns
• Local Secondary Index (LSI) — Same partition key, different sort key (must be created at table creation)

Capacity Modes#

DynamoDB Streams and Event-Driven Patterns#

DynamoDB Streams capture item-level changes and can trigger Lambda functions:

// Lambda handler for DynamoDB Stream events
export const handler = async (event) => {
  for (const record of event.Records) {
    console.log('Event Type:', record.eventName); // INSERT, MODIFY, REMOVE
    console.log('New Image:', record.dynamodb.NewImage);
    console.log('Old Image:', record.dynamodb.OldImage);
  }
};

Conditional Writes for Idempotency#

Prevent duplicate processing with conditional expressions:

import boto3
from botocore.exceptions import ClientError

dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('orders')

def process_order(order_id, order_data):
    try:
        table.put_item(
            Item={'order_id': order_id, **order_data},
            ConditionExpression='attribute_not_exists(order_id)'
        )
        return {'status': 'created'}
    except ClientError as e:
        if e.response['Error']['Code'] == 'ConditionalCheckFailedException':
            return {'status': 'already_exists'}
        raise

3. API Gateway and Authentication#

API Gateway is the front door to your serverless applications. The DVA-C02 tests REST APIs, HTTP APIs, and various authentication/authorization patterns.

API Types Comparison#

Authorization Patterns#

1. IAM Authorization — For AWS service-to-service calls using SigV4
2. Cognito User Pool Authorizer — Validates JWT tokens from Cognito
3. Lambda Authorizer — Custom logic for tokens or request parameters

# Lambda Authorizer example
def handler(event, context):
    token = event['authorizationToken']
    method_arn = event['methodArn']
    
    # Custom validation logic
    if validate_token(token):
        return generate_policy('user123', 'Allow', method_arn)
    else:
        return generate_policy('user123', 'Deny', method_arn)

def generate_policy(principal_id, effect, resource):
    return {
        'principalId': principal_id,
        'policyDocument': {
            'Version': '2012-10-17',
            'Statement': [{
                'Action': 'execute-api:Invoke',
                'Effect': effect,
                'Resource': resource
            }]
        }
    }

Stage Variables and Deployment#

• Stages — Named references to deployment (dev, staging, prod)
• Stage Variables — Configuration values that differ by stage
• Canary Deployments — Route percentage of traffic to new deployment

# Access stage variables in Lambda via mapping template
${stageVariables.functionAlias}
${stageVariables.tableName}

4. AWS Security for Developers#

Security is 26% of the DVA-C02 exam. You must understand IAM, Cognito, Secrets Manager, and KMS integration patterns.

IAM for Lambda#

Lambda functions assume an execution role that defines what AWS services they can access:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/users"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "*"
    }
  ]
}

Secrets Manager vs Parameter Store#

Secrets Manager Lambda Extension#

For high-throughput functions, use the Lambda extension for caching:

import os
import urllib3

# Secrets Manager extension caches secrets in memory
SECRETS_EXTENSION_PORT = 2773
secrets_url = f'http://localhost:{SECRETS_EXTENSION_PORT}/secretsmanager/get?secretId='

def handler(event, context):
    http = urllib3.PoolManager()
    response = http.request('GET', f"{secrets_url}my-secret",
                           headers={'X-Aws-Parameters-Secrets-Token': os.environ['AWS_SESSION_TOKEN']})
    secret = response.data.decode('utf-8')
    # Use secret...

KMS for Encryption#

• Envelope encryption — Data key encrypts data, KMS key encrypts data key
• Client-side encryption — Encrypt before sending to AWS
• Server-side encryption — AWS encrypts at rest

import boto3

kms = boto3.client('kms')

# Encrypt data
response = kms.encrypt(
    KeyId='alias/my-key',
    Plaintext=b'sensitive data'
)
ciphertext = response['CiphertextBlob']

# Decrypt data
response = kms.decrypt(
    CiphertextBlob=ciphertext
)
plaintext = response['Plaintext']

5. Deployment and CI/CD#

Deployment patterns and infrastructure as code are critical for the DVA-C02. Understand CodePipeline, SAM, and deployment strategies.

AWS SAM (Serverless Application Model)#

SAM is an extension of CloudFormation specifically for serverless:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Globals:
  Function:
    Timeout: 30
    Runtime: python3.11
    Environment:
      Variables:
        TABLE_NAME: !Ref UsersTable

Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: app.handler
      CodeUri: src/
      Events:
        Api:
          Type: Api
          Properties:
            Path: /users
            Method: GET
      Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref UsersTable

  UsersTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH

Lambda Deployment Strategies#

CodeBuild Best Practices#

# buildspec.yml
version: 0.2

phases:
  install:
    runtime-versions:
      python: 3.11
  pre_build:
    commands:
      - pip install -r requirements.txt -t ./package
  build:
    commands:
      - sam build
      - sam package --s3-bucket $S3_BUCKET --output-template-file packaged.yaml
  post_build:
    commands:
      - sam deploy --template-file packaged.yaml --stack-name $STACK_NAME --capabilities CAPABILITY_IAM

cache:
  paths:
    - '/root/.cache/pip/**/*'  # Cache pip dependencies

Blue/Green Deployments with CodeDeploy#

For Lambda, CodeDeploy manages traffic shifting between function versions:

# SAM template with CodeDeploy integration
MyFunction:
  Type: AWS::Serverless::Function
  Properties:
    AutoPublishAlias: live
    DeploymentPreference:
      Type: Linear10PercentEvery3Minutes
      Alarms:
        - !Ref ErrorAlarm
      Hooks:
        PreTraffic: !Ref PreTrafficHook
        PostTraffic: !Ref PostTrafficHook

---

Know your range before test day#

Quizzes catch knowledge gaps; a timed DVA-C02 sitting shows which items are fluent, fragile, guessed, or a gap under the clock.

• Timed diagnostic with domain-level breakdown
• Clear signal on what to drill next
• Practice free; timed sittings and readiness range on Pro

Take the free Developer Associate assessment →

---

Next step: Start practicing free on the DVA-C02 hub, or sit a short diagnostic first.