Packaging and application configuration: DVA-C03 study notes and practice questions
What to know about Packaging and application configuration for the DVA-C03 exam, from the Testing and Deployment domain (22% of the exam guide), then 3 free questions to test it. Part of the DVA-C03 study guide.
These questions ask where code and configuration should live so that one build runs in dev, test and prod without changes.
Dependencies and the package
A Lambda function is packaged as a .zip archive, a container image in Amazon ECR, or a .zip with layers. Each has different size limits.
For a .zip, a direct upload through the API, SDKs or console is limited to 50 MB zipped. Larger archives go through Amazon S3. The unzipped package, including layers, is limited to 250 MB.
A function can attach up to 5 layers. Layers hold shared libraries so several functions can reuse them. Layer contents count toward the 250 MB unzipped limit.
A container image can be up to 10 GB uncompressed. Choose it when the dependencies are too large for a .zip, such as a large machine-learning library.
Build dependencies once, in CI, and deploy the same artifact to every environment.
Environment-specific configuration
Need
Use
Settings that differ per environment (table names, endpoints)
Environment variables set per function, or Parameter Store paths such as /app/prod/...
Feature flags and dynamic settings that change while the app runs
AWS AppConfig with a deployment strategy and optional rollback alarms
Plain configuration values read by code or pipelines
Systems Manager Parameter Store (String, StringList, SecureString)
Database passwords and API keys that must rotate
AWS Secrets Manager with automatic rotation
Different backend URLs or variables per API stage
API Gateway stage variables
Secrets and sensitive values
Parameter Store SecureString values are encrypted with KMS. Secrets Manager adds rotation and a JSON secret model.
Do not put secrets in environment variables, buildspec files or source code. Reference them at runtime or through a dynamic reference.
A pipeline can read secrets through CodeBuild’s secrets-manager and parameter-store settings, so the value never appears in the repository.
API Gateway stages
Each REST API stage has its own invoke URL, in the form https://{api-id}.execute-api.{region}.amazonaws.com/{stage-name}. Dev and prod can share one API definition and still have separate URLs.
Stage variables are key-value pairs set on a stage. A method integration can read them with ${stageVariables.name}, for example to choose a Lambda alias per stage.
How to choose
“Change a flag without redeploying, and roll it out gradually” maps to AppConfig.
“Rotate a database password automatically” maps to Secrets Manager.
“Store a plain setting for many services” maps to Parameter Store.
“Same API, different backend per stage” maps to stage variables.
Common traps
Storing a password in a Lambda environment variable when the question asks for rotation or audit.
Rebuilding the package for each environment, which breaks the rule that you test what you deploy.
Using a .zip when the dependencies exceed the 250 MB unzipped limit. The answer is a container image, not a larger upload.
Expecting an API definition change to reach a stage without a new deployment to that stage.
A retail company wants to release a new gift-card checkout in production but keep it hidden until a marketing launch.
On launch day it wants to enable the feature gradually, starting small, and roll back automatically if the application's error-rate alarm fires. All of this must happen without redeploying any application code.
What should the developer use?
Choose one answer.
AA. AWS CodeDeploy with a canary configuration that shifts a small share of traffic to a new application version first.
BB. An AWS AppConfig feature flag, deployed with a gradual deployment strategy that is linked to a CloudWatch alarm.
CC. A Lambda environment variable holding the flag, changed in stages through the function configuration.
DD. An AWS CloudFormation parameter for the flag, updated in steps by running stack updates.
Show the answer and explanation
Answer: B
A. Wrong: CodeDeploy shifts traffic between versions of the code, so each release step is a deployment of code. The company wants to switch the feature on and off without redeploying, which needs a configuration service.
B. Right: Correct. AppConfig manages feature flags separately from code and rolls out changes gradually. If a configured CloudWatch alarm fires during the rollout, AppConfig rolls the change back automatically. Learn more: What is AWS AppConfig? (opens in a new tab)
C. Wrong: Changing an environment variable creates a new function configuration, and each stage is a manual step. There is no gradual rollout or alarm-based rollback built in.
D. Wrong: Stack updates can change the flag, but each one is a deployment with no percentage-based rollout and no automatic rollback tied to an application alarm.
Explanation
AWS AppConfig holds feature flags outside the application code, deploys changes gradually, and can roll back automatically when a CloudWatch alarm fires. Code deployment tools and stack or function configuration updates change the release itself and do not offer a monitored, gradual flag rollout.
A data science team has a Python Lambda function whose dependencies (NumPy, SciPy and a compiled model library) total about 1.4 GB when unzipped, so the .zip deployment fails.
The function must not be attached to a VPC, and the team wants the dependencies delivered with the function, not fetched over the network during cold starts.
What should the developer do?
Choose one answer.
AA. Build a container image with the code and dependencies, push it to Amazon ECR, and create the function from the image.
BB. Split the dependencies across the maximum number of Lambda layers and attach all of them to the function for more room.
CC. Upload the .zip to Amazon S3 and create the function from the S3 object, which removes the package size limit.
DD. Place the dependencies on an Amazon EFS file system mounted under /mnt/libs, and load them from there at cold start.
Show the answer and explanation
Answer: A
A. Right: Correct. A container image function can be up to 10 GB uncompressed, including its layers, which is enough for these libraries. The dependencies ship inside the image, and no VPC is needed. Learn more: Lambda container images (opens in a new tab)
B. Wrong: A function can use at most five layers, and the unzipped size of the function plus all its layers must stay within 250 MB. Layers do not raise the total, so 1.4 GB would still not fit. Learn more: Lambda quotas (opens in a new tab)
C. Wrong: Uploading through S3 avoids the 50 MB limit for direct uploads, but the unzipped contents must still be within 250 MB. A 1.4 GB package is still rejected. Learn more: Lambda quotas (opens in a new tab)
D. Wrong: A function connects to EFS over a VPC, which conflicts with the requirement not to attach it to a VPC. The libraries would also be read over the network instead of shipping with the function. Learn more: Lambda with Amazon EFS (opens in a new tab)
Explanation
Zip packages are limited to 250 MB unzipped, layers included, and S3 uploads do not change that. Container images can be up to 10 GB, ship the dependencies with the function and need no VPC. EFS would meet the size need but requires a VPC and loads files over the network.
A company's developers publish internal Python packages that several teams install with pip.
CodeBuild projects also install public packages from PyPI during builds. Security wants builds to use one private repository endpoint for both internal and public packages, and packages already fetched should stay available even if PyPI is unreachable. The company wants as few servers to manage as possible.
What should the developer set up?
Choose one answer.
AA. A pip package index on an Amazon EC2 instance that mirrors PyPI and also hosts the internal packages.
BB. An Amazon ECR repository where every Python package is stored as a container image.
CC. An AWS CodeArtifact repository for the internal packages that has an upstream repository with an external connection to PyPI.
DD. An Amazon S3 bucket holding the internal packages as wheel files, with builds also reaching PyPI through a NAT gateway.
Show the answer and explanation
Answer: C
A. Wrong: This can work, but the team must patch, scale and back up the server and keep the mirror up to date. A managed artifact repository gives the same endpoint without servers to run.
B. Wrong: ECR stores container images and OCI artifacts. pip cannot install packages from it, and it has no connection to PyPI.
C. Right: Correct. Builds use one CodeArtifact endpoint, and requests for public packages are passed to the upstream repository with the PyPI connection. Packages fetched that way are retained in CodeArtifact, so they remain available later. Learn more: Upstream repositories (opens in a new tab)
D. Wrong: Builds would use two sources, not one endpoint, and public packages would not be kept anywhere. The NAT gateway also adds cost and keeps the builds dependent on PyPI being reachable.
Explanation
CodeArtifact gives builds a single private endpoint. Linking the repository to an upstream repository that has an external connection to PyPI lets it serve public packages and retain the ones that were fetched. A self-run mirror adds servers, ECR cannot serve pip packages, and S3 plus a NAT gateway leaves two sources and no retention.
Want more on Packaging and application configuration? The 5 full-length practice sets have 15 more Packaging and application configuration questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →