SAP-C02
Deep Dive
Managing infrastructure across hundreds of AWS accounts requires tools that go beyond basic CloudFormation. StackSets, Service Catalog, Systems Manager, and CDK are the pillars of infrastructure governance at enterprise scale.
Contents
Consistency
Ensuring every account has the same security, networking, and compliance configuration.
Speed
Provisioning resources in new accounts without manual processes that take days.
Self-service
Letting dev teams deploy what they need without depending on ops.
Guardrails
Ensuring self-service doesn't create infrastructure that violates security or cost policies.
| Tool | Main purpose | Typical SAP-C02 scenario |
|---|---|---|
| CloudFormation StackSets | Deploy stacks to multiple accounts/regions from a single point | Create a baseline VPC in 50 accounts with identical network config |
| AWS Service Catalog | Catalog of approved products with controlled self-service | Let devs launch dev environments without violating policies |
| Systems Manager (SSM) | Fleet management: patching, configuration, secrets, command execution | Patching 1,000 EC2 instances across multiple accounts |
| AWS CDK | IaC with TypeScript/Python/Java/Go using reusable constructs | Teams that prefer code over YAML/JSON for defining infrastructure |
| Service Catalog (formerly Proton) | Self-service infrastructure platform for product teams | Centralizing deployment templates for dozens of microservices |
StackSets extends CloudFormation to deploy stacks across multiple AWS accounts and regions in a single operation. It's the central tool for infrastructure governance at the organizational level.
Deployment modes
Self-Managed (manual)
The admin manually configures IAM roles in each target account (AWSCloudFormationStackSetAdministrationRole + AWSCloudFormationStackSetExecutionRole). Works cross-account and outside Organizations.
Service-Managed (Organizations)
Uses Organizations to manage permissions automatically. You can deploy to entire OUs and enable auto-deployment for new accounts. No manual role setup required.
Deployment options
Service Catalog lets admins build a catalog of infrastructure products (based on CloudFormation) that users can deploy self-service, while always staying compliant with company policy.
Portfolio
A collection of related products. Shared with users, groups, or accounts via Organizations.
Product
A versioned CloudFormation template. The end user never sees or edits the template — they just pick from allowed parameters.
Constraint
Rules governing deployment: Launch Constraint (fixed IAM role), Notification Constraint (SNS), Template Constraint (limits available parameters).
Exam use case
"A company wants its developers to be able to launch EC2 dev environments without managing IAM or CloudFormation permissions, but limited to approved instance types and authorized regions." → Service Catalog with Template Constraints that restrict instanceType and region.
Key capabilities for the SAP-C02
Parameter Store vs Secrets Manager
SSM Parameter Store
Secrets Manager
CDK lets you define AWS infrastructure using TypeScript, Python, Java, Go, or C# instead of YAML/JSON. It compiles down to CloudFormation templates. It enables programming logic: loops, conditionals, inheritance, and reusable components.
Constructs
Reusable units. L1 (1:1 with CFn resources), L2 (abstractions with sensible defaults), L3 (full patterns: VPC+ECS+ALB).
CDK Pipelines
CI/CD pipeline for CDK-based IaC. Automatic deployment of infrastructure changes via CodePipeline.
CDK Aspects
Applies cross-cutting operations to every resource in the stack (e.g., adding tags to all resources, validating configurations).
AWS Proton stopped accepting new customers in October 2025 and support ends on October 7, 2026. The same pattern —a central platform team publishes deployment templates and product teams consume them self-service— is implemented today with AWS Service Catalog (CloudFormation or Terraform products), CDK or Terraform templates in a central repository, or platform portals such as Backstage.
Portfolios and products
Service Catalog publishes approved infrastructure (VPC, EKS cluster) as versioned products.
Constraints
Launch and template constraints limit which parameters each team can choose.
Versions
The platform team publishes new product versions and teams update their provisioned products.
Use case
"100 microservices need to use the same network and security pattern, updatable centrally." → Service Catalog (formerly Proton).
Pitfall: "CloudFormation StackSets Self-Managed and Service-Managed are equivalent"
Reality: Different. Service-Managed requires Organizations and manages permissions automatically. Self-Managed requires manually configuring IAM roles in each account — it works without Organizations.
Pitfall: "Secrets Manager and Parameter Store are interchangeable"
Reality: For secrets that need automatic rotation (DB passwords) → Secrets Manager. For app configuration and simple secrets with no rotation → Parameter Store (cheaper).
Pitfall: "AWS CDK is an AWS service that runs code"
Reality: CDK is a development framework that runs locally. It generates CloudFormation templates, which are what actually get executed. CDK itself isn't a service AWS manages.
Did you get this topic?
Test what you just learned
A company has 300 AWS accounts in Organizations. The security team wants to ensure ALL accounts have AWS Config enabled along with a specific Config Rule ('restricted-ssh') that detects security groups with port 22 open to the world. New accounts must receive this configuration automatically. What's the most efficient solution?
Put what you learned to the test with original SAP-C02 exam questions.
Start SAP-C02 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.