☰ All modules Tier 2 · Elastic Beanstalk GuideCheat sheet ‹ cicdcloudformation ›
Contents
  1. How Elastic Beanstalk appears on DVA-C02
  2. 1. Core concepts and Elastic Beanstalk modes
  3. 2. Environment types and load balancers
  4. 3. Worker environments and periodic tasks
  5. 4. Platforms and platform updates
  6. 5. Deployment policies compared
  7. 6. Rolling deployments and configuration updates
  8. 7. Immutable and traffic splitting deployments
  9. 8. Blue green deployments and cloning
  10. 9. ebextensions and configuration precedence
  11. 10. Environment properties and secrets
  12. 11. RDS databases and decoupling
  13. 12. Docker and container environments
  14. 13. Source bundles and the lifecycle policy
  15. 14. Health logs and troubleshooting
  16. Quick decision rules
  17. Changed vs older material

Elastic Beanstalk — DVA-C02 Mastery Guide

  • Sources: course chapter 10 (Elastic Beanstalk, notes/source/10.Beanstalk.pdf). The course serves as the syllabus only; all wording here is original. Written 2026-10-12.
  • Values checked against AWS docs on 2026-10-12. The marker ⚠️ Changed: <current>. Older material may say <old>. flags a value or behaviour that differs from the course or older practice tests: learn the current value. ⚠️ unverified marks a value the docs did not confirm; ⚠️ volatile marks lists AWS changes often (platform branches, new modes). Every change is listed in Changed vs older material.
  • Tier 2 (deployment and messaging), bank target 30 questions. Domain: Deployment.
  • How to use it: /explain <topic> teaches from these sections (concept → exam facts → developer angle → traps → 3 check questions); /quiz beanstalk asks bank questions whose source_note links point at the ## N. headings below; /drill beanstalk fires short recall prompts from notes/beanstalk-cheat-sheet.md. Suggested loop: read a section and answer its practice questions before opening the answers → /explain what is still unclear → /quiz beanstalk → /drill beanstalk.

How Elastic Beanstalk appears on DVA-C02

Beanstalk questions are deployment questions. The exam treats it as the managed way to run a web app or a queue worker without assembling EC2, Auto Scaling, load balancing and monitoring yourself, and it asks what a developer must choose or configure:

Typical question shapes: a scenario with one deciding constraint; "Which TWO…" with five options; the exact namespace, option, file name or CLI command that does the job.

Domain map: Deployment → every topic. Security angles appear inside deployment scenarios (§1 roles and policies, §10 secrets); troubleshooting angles in §6, §7 and §14.

Out of scope: OS administration (packages, proxy tuning, file systems) and network design (subnets, routing, NAT). Neighbouring modules own: CloudFormation syntax and stack behaviour (notes/cloudformation-guide.md), CodePipeline/CodeBuild/CodeDeploy (notes/cicd-guide.md), SQS semantics (notes/sqs-sns-kinesis-guide.md), Secrets Manager vs Parameter Store (notes/security-encryption-guide.md), RDS features (notes/rds-guide.md), ECS/ECR/EKS (notes/containers-guide.md), CloudWatch and X-Ray (notes/monitoring-guide.md), Route 53 routing (notes/route53-guide.md), and IMDS, load balancers, Auto Scaling and Spot (notes/ec2-mastery-guide.md §2, §8, §10, §5).

# Topic Why it is on the exam
1 Core concepts and Elastic Beanstalk modes Application, version, environment and configuration vocabulary; roles, policies and quotas behind every scenario
2 Environment types and load balancers Single instance vs load balanced, which load balancer, what can't change after creation
3 Worker environments and periodic tasks Offloading long jobs to SQS, cron.yaml, timeouts and the dead-letter queue
4 Platforms and platform updates What runs today, in-place updates vs blue/green, managed updates, custom AMIs
5 Deployment policies compared The most tested Beanstalk decision: the policy that fits the constraint
6 Rolling deployments and configuration updates Batches, health checks, timeouts, and the separate rolling-update settings for instance replacement
7 Immutable and traffic splitting deployments New instances, quick rollback, canary percentages and their limits
8 Blue green deployments and cloning URL swap, DNS caching, when a second environment is mandatory, what a clone copies
9 ebextensions and configuration precedence Configuration as code, CloudFormation resources, run-once commands, which value wins
10 Environment properties and secrets Passing settings and secrets to code, size limits, refresh after rotation
11 RDS databases and decoupling Coupled vs external databases and the deletion policy
12 Docker and container environments Docker, ECS-based and Cluster options; Dockerrun.aws.json versions; ECR access
13 Source bundles and the lifecycle policy Bundle rules, the version quota and automatic cleanup
14 Health logs and troubleshooting Enhanced health, tail vs bundle logs, CloudWatch Logs, X-Ray, reading failures

1. Core concepts and Elastic Beanstalk modes

Concept

Exam facts

Role Default name Trusted principal Managed policies
Service role (Beanstalk manages resources, health, managed updates) aws-elasticbeanstalk-service-role elasticbeanstalk.amazonaws.com, condition sts:ExternalId = elasticbeanstalk AWSElasticBeanstalkEnhancedHealth, AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy
EC2 instance profile (credentials for your code and the on-instance agents) aws-elasticbeanstalk-ec2-role ec2.amazonaws.com AWSElasticBeanstalkWebTier (log upload to S3, X-Ray), AWSElasticBeanstalkWorkerTier (queue, leader election, periodic tasks, metrics), AWSElasticBeanstalkMulticontainerDocker (ECS)

Developer angle

Register a version and create or update an environment with the AWS CLI:

# 1. Upload the bundle and register it as a version (--process validates .ebextensions first)
aws s3 cp orders-v42.zip s3://elasticbeanstalk-eu-west-1-111122223333/orders/orders-v42.zip
aws elasticbeanstalk create-application-version \
  --application-name orders --version-label v42 \
  --source-bundle S3Bucket=elasticbeanstalk-eu-west-1-111122223333,S3Key=orders/orders-v42.zip \
  --auto-create-application --process

# 2. Create a load-balanced web environment with an ALB: the API default of LoadBalancerType
#    is classic, so set it explicitly (solution stack names change with every platform
#    release; list them with: aws elasticbeanstalk list-available-solution-stacks)
aws elasticbeanstalk create-environment \
  --application-name orders --environment-name orders-prod --version-label v42 \
  --solution-stack-name "64bit Amazon Linux 2023 v6.11.10 running Node.js 24" \
  --option-settings \
    Namespace=aws:elasticbeanstalk:environment,OptionName=LoadBalancerType,Value=application \
    Namespace=aws:autoscaling:launchconfiguration,OptionName=IamInstanceProfile,Value=orders-ec2-profile \
    Namespace=aws:elasticbeanstalk:environment,OptionName=ServiceRole,Value=aws-elasticbeanstalk-service-role

# 3. A later deployment only points the environment at another version
aws elasticbeanstalk update-environment --environment-name orders-prod --version-label v43
aws elasticbeanstalk describe-events --environment-name orders-prod --max-records 20

Least-privilege deployer limited to one application (it still needs permissions on the underlying S3, CloudFormation and EC2 resources):

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DeployOrdersOnly",
    "Effect": "Allow",
    "Action": ["elasticbeanstalk:CreateApplicationVersion", "elasticbeanstalk:UpdateEnvironment"],
    "Resource": [
      "arn:aws:elasticbeanstalk:eu-west-1:111122223333:applicationversion/orders/*",
      "arn:aws:elasticbeanstalk:eu-west-1:111122223333:environment/orders/*"
    ],
    "Condition": {"StringEquals": {
      "elasticbeanstalk:InApplication": "arn:aws:elasticbeanstalk:eu-west-1:111122223333:application/orders"}}
  }]
}

Traps

Practice questions

  1. A developer in a newly created AWS account launches the first Elastic Beanstalk environment from the console. The wizard asks for an EC2 instance profile, but the account has none. The application only needs to upload its logs to Amazon S3 and send traces to AWS X-Ray, with the least privilege that Elastic Beanstalk documents. What should the developer do?

    • A. Select the existing aws-elasticbeanstalk-service-role role as the environment's EC2 instance profile.
    • B. Attach AdministratorAccess-AWSElasticBeanstalk to the developer's IAM user and run the create wizard again.
    • C. Save an IAM user's access key ID and secret access key as environment properties for the SDK to use.
    • D. Create a role trusted by ec2.amazonaws.com with AWSElasticBeanstalkWebTier and choose its profile.

  2. A platform team must let a contractor deploy new versions of the orders application to its existing environments, without being able to create or delete applications or to change any other application. Which TWO policy elements implement this least-privilege requirement? (Select TWO.)

    • A. Attach AdministratorAccess-AWSElasticBeanstalk and add an explicit deny for elasticbeanstalk:DeleteApplication.
    • B. Allow elasticbeanstalk:CreateApplicationVersion and elasticbeanstalk:UpdateEnvironment on version and environment ARNs whose path starts with orders/.
    • C. Allow elasticbeanstalk:* on the resource arn:aws:elasticbeanstalk:*:*:application/orders only.
    • D. Add a condition that elasticbeanstalk:InApplication equals the ARN of the orders application.
    • E. Attach the AWSElasticBeanstalkReadOnly managed policy to the contractor's IAM user.
Answers
  1. D. Beanstalk no longer creates the default instance profile, and AWSElasticBeanstalkWebTier covers S3 log upload and X-Ray. A uses the role that Beanstalk itself assumes, which EC2 can't assume; B doesn't bring back automatic creation and grants far more than needed; C puts long-term keys on the instances.
  2. B, D. Actions on versions and environments are authorized against their own ARNs, and InApplication pins them to orders. A starts from full access; C names the application ARN, which doesn't cover version or environment resources; E is read-only and can't deploy.

2. Environment types and load balancers

Concept

Exam facts

Developer angle

eb create orders-dev --single                     # one instance with an Elastic IP, no load balancer
eb create orders-prod --elb-type application --min-instances 2 --max-instances 6
eb create reports-prod --elb-type application --shared-lb FrontEndLB --shared-lb-port 443
aws elasticbeanstalk check-dns-availability --cname-prefix orders-prod

HTTPS on the environment's ALB through a configuration file:

# .ebextensions/https.config
option_settings:
  aws:elbv2:listener:443:
    Protocol: HTTPS
    SSLCertificateArns: arn:aws:acm:eu-west-1:111122223333:certificate/0f1e2d3c-4b5a-6978-8a9b-0c1d2e3f4a5b
    SSLPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06
  aws:autoscaling:asg:
    MinSize: 2
    MaxSize: 6

Traps

Practice questions

  1. A team's production environment was created years ago with a Classic Load Balancer. The application now needs path-based routing that only an Application Load Balancer provides, and the change must not cause downtime. What should the developer do?

    • A. Edit the environment's load balancer settings and change the load balancer type to Application Load Balancer.
    • B. Clone the environment, deploy the current version to the clone, and then swap the two environments' URLs.
    • C. Create an environment with an Application Load Balancer, deploy the current version to it, and swap the URLs.
    • D. Add an .ebextensions file that sets LoadBalancerType: application and redeploy the current application version.

  2. A company runs several low-traffic Elastic Beanstalk web environments, each with its own Application Load Balancer. To reduce cost, the developer plans to move them onto one shared load balancer. Which TWO facts must the plan account for? (Select TWO.)

    • A. The shared load balancer must be an Application Load Balancer that the team creates itself, not one created by another environment.
    • B. A Network Load Balancer can be shared when each environment listens on a different TCP port.
    • C. An existing environment can't be switched to a shared load balancer, so each one must be recreated and its URL swapped.
    • D. Environments on a shared load balancer can still scale on the TargetResponseTime metric.
    • E. Elastic Beanstalk deletes the shared load balancer when the last environment that uses it is terminated.
Answers
  1. C. The load balancer type can only be chosen at creation, so a new environment plus a URL swap avoids downtime. A and D try to change the type in place, which isn't possible; B keeps the Classic Load Balancer because a clone copies the original's load balancer type.
  2. A, C. Only a self-created ALB can be shared, and dedicated vs shared is fixed when the environment is created. B is wrong because only ALBs can be shared; D is wrong because that metric isn't available with a shared load balancer; E is wrong because you own and manage the shared ALB.

3. Worker environments and periodic tasks

Concept

Exam facts

Developer angle

Web tier enqueues (first block); the worker app handles the daemon's POST (second block):

import json, os
import boto3

boto3.client("sqs").send_message(QueueUrl=os.environ["WORKER_QUEUE_URL"],
                                 MessageBody=json.dumps({"imageKey": "uploads/cat.jpg"}))

from flask import Flask, request

application = Flask(__name__)

@application.route("/jobs", methods=["POST"])
def job():
    resize(request.get_json()["imageKey"])  # long-running work (your function)
    return "", 200  # 200 OK -> the daemon deletes the message

Daemon settings and a nightly task:

# .ebextensions/worker.config
option_settings:
  aws:elasticbeanstalk:sqsd:
    HttpPath: /jobs
    VisibilityTimeout: 900
    InactivityTimeout: 840
    MaxRetries: 5

# cron.yaml (root of the source bundle)
version: 1
cron:
  - name: "nightly-report"
    url: "/tasks/report"
    schedule: "0 2 * * *"

Traps

Practice questions

  1. A worker environment resizes uploaded videos. Some jobs take up to 8 minutes, and the team notices that the same video is sometimes processed twice by different instances. The environment uses the default worker settings. Which change addresses the duplicates?

    • A. Lower MaxRetries in aws:elasticbeanstalk:sqsd to 1 and redeploy the worker application.
    • B. Raise VisibilityTimeout and InactivityTimeout in aws:elasticbeanstalk:sqsd above the longest job time.
    • C. Replace the autogenerated queue with an existing FIFO queue that uses content-based deduplication.
    • D. Raise HttpConnections in aws:elasticbeanstalk:sqsd to 100 and add more instances to the worker environment.

  2. A worker environment already processes jobs from its autogenerated queue. The team must also run a report every night at 02:00 UTC. Which TWO steps are required? (Select TWO.)

    • A. Create an Amazon EventBridge schedule that runs the report command on the worker instances at 02:00 UTC.
    • B. Point the worker environment at an existing FIFO queue with a single message group for the report.
    • C. Add a cron.yaml file at the root of the source bundle with the schedule 0 2 * * * and a url for the report.
    • D. Add a container_commands entry with leader_only: true that starts the report generation script.
    • E. Implement an HTTP POST handler at that url that returns 200 OK when the report completes.
Answers
  1. B. With the defaults, the message becomes visible again after 300 seconds while the 8-minute job is still running, so a second instance receives it. A only changes how soon a message goes to the dead-letter queue; C doesn't help because FIFO deduplication applies to sends, not to redelivery after a visibility timeout; D increases concurrency without fixing the timeout.
  2. C, E. cron.yaml defines the schedule and path, and the worker app must handle the POST and return 200 OK. A adds a scheduler and remote command execution that the worker tier already replaces; B breaks periodic tasks, which aren't supported with a FIFO queue; D runs only during deployments, not on a schedule.

4. Platforms and platform updates

Concept

Exam facts

Developer angle

eb platform list                      # platforms available in the Region
eb upgrade                            # newest version of the current branch, in place
aws elasticbeanstalk describe-platform-version \
  --platform-arn "arn:aws:elasticbeanstalk:eu-west-1::platform/Node.js 24 running on 64bit Amazon Linux 2023/6.11.10" \
  --query PlatformDescription.CustomAmiList
aws elasticbeanstalk update-environment --environment-name orders-prod \
  --options-to-remove Namespace=aws:autoscaling:launchconfiguration,OptionName=ImageId

# .ebextensions/managed-updates.config
option_settings:
  aws:elasticbeanstalk:managedactions:
    ManagedActionsEnabled: true
    PreferredStartTime: "Sun:03:00"
    ServiceRoleForManagedUpdates: AWSServiceRoleForElasticBeanstalkManagedUpdates
  aws:elasticbeanstalk:managedactions:platformupdate:
    UpdateLevel: minor
    InstanceRefreshEnabled: false

Mapping older exam wording: Multicontainer Docker → ECS running on AL2023; Single Container Docker → Docker running on AL2023; Java with Tomcat → Tomcat; Packer / custom platform → custom AMI on a managed platform, or a Docker image.

Traps

Practice questions

  1. An environment runs on the Node.js 22 running on 64bit Amazon Linux 2023 platform branch and must move to the Node.js 24 branch without downtime. Which approach does Elastic Beanstalk recommend?

    • A. Enable managed platform updates with UpdateLevel set to minor and wait for the next weekly maintenance window.
    • B. Use the console's platform Change action to select the Node.js 24 branch in the existing environment.
    • C. Create an environment on the Node.js 24 branch, deploy and test the app, and then swap the environment URLs.
    • D. Clone the environment and choose a Node.js 24 platform version in the clone's settings before swapping URLs.

  2. A team enables managed platform updates on a production environment. Which TWO outcomes should the team expect? (Select TWO.)

    • A. Updates start during a weekly two-hour maintenance window and are applied as immutable updates.
    • B. Updates can move the environment to a new major platform version when UpdateLevel is minor.
    • C. A custom AMI set in ImageId is replaced with the stock AMI of the new platform version.
    • D. Enhanced health reporting must be enabled for Elastic Beanstalk to judge whether an update succeeded.
    • E. Updates are applied batch by batch according to the environment's rolling update settings.
Answers
  1. C. Changing to another platform branch is a blue/green migration: new environment, test, URL swap. A never crosses branches; B updates only within the current branch; D fails because a clone can only use a version of the same branch.
  2. A, D. Managed updates run in a 2-hour weekly window as immutable updates and depend on enhanced health. B is wrong because major versions and other branches are never applied; C is wrong because the custom AMI is kept; E is wrong because managed updates are always immutable.

5. Deployment policies compared

Concept

Exam facts

Policy (DeploymentPolicy) What happens Downtime Capacity during rollout Extra cost Failure impact and rollback Speed
All at once (AllAtOnce) New version on every existing instance at the same time Yes, briefly Out of service briefly None Whole environment affected; manual redeploy Fastest
Rolling (Rolling) One batch at a time on existing instances No Reduced by one batch None Failed batch out of service, finished batches already new; manual redeploy Slower (batch size)
Rolling with additional batch (RollingWithAdditionalBatch) Launches an extra batch first, then rolls No Full Small (one batch, temporary) Minimal if the first batch fails, otherwise like rolling; manual redeploy Slower still
Immutable (Immutable) Full new set of instances in a temporary Auto Scaling group No Full, briefly doubled High (double capacity for a while) Minimal; rollback = terminate the new instances Slowest
Traffic splitting (TrafficSplitting) New instances get a percentage of traffic for an evaluation time No Full, doubled during evaluation High Only the canary share is affected; rollback = reroute traffic and terminate new instances Slowest (plus evaluation time)
Blue/green (pattern, §8) New environment, then URL swap No Full (two environments) High Minimal; rollback = swap back (DNS change) Slowest

Developer angle

# .ebextensions/deploy-policy.config (takes effect only if the console/EB CLI did not set these options)
option_settings:
  aws:elasticbeanstalk:command:
    DeploymentPolicy: RollingWithAdditionalBatch
    BatchSizeType: Fixed
    BatchSize: 2

# Set the policy directly on the environment (highest precedence)
aws elasticbeanstalk update-environment --environment-name orders-prod \
  --option-settings Namespace=aws:elasticbeanstalk:command,OptionName=DeploymentPolicy,Value=Immutable

Traps

Practice questions

  1. A production environment runs 10 instances behind an Application Load Balancer. A new version must be deployed with no downtime and without dropping below full capacity at any point, at the lowest additional instance cost. Which deployment policy should the developer choose?

    • A. Rolling
    • B. Rolling with additional batch
    • C. Immutable
    • D. All at once

  2. A payments API must deploy in a way that a failed deployment never leaves existing instances running a mix of old and new code, and rollback is as quick as removing the new instances. Which TWO deployment policies meet these requirements? (Select TWO.)

    • A. Rolling
    • B. Immutable
    • C. All at once
    • D. Rolling with additional batch
    • E. Traffic splitting
Answers
  1. B. It keeps full capacity by launching one extra batch first, which costs far less than immutable's full second fleet. A drops capacity during each batch; C meets availability but doubles capacity for a while; D causes downtime.
  2. B, E. Both deploy only to new instances, and rollback terminates them (traffic splitting also reroutes traffic back). A and D update existing instances and can leave a mixed fleet; C updates every existing instance at once and causes downtime.

6. Rolling deployments and configuration updates

Concept

Exam facts

Developer angle

# .ebextensions/rollout.config
option_settings:
  aws:elasticbeanstalk:command:
    DeploymentPolicy: Rolling
    BatchSizeType: Percentage
    BatchSize: 25
    Timeout: "900"
    IgnoreHealthCheck: false
  aws:elasticbeanstalk:healthreporting:system:
    SystemType: enhanced
    HealthCheckSuccessThreshold: Ok
  aws:elasticbeanstalk:application:
    Application Healthcheck URL: /health
  aws:autoscaling:updatepolicy:rollingupdate:
    RollingUpdateEnabled: true
    RollingUpdateType: Health
    MaxBatchSize: 2
    MinInstancesInService: 4

eb health                                                            # deployment ID and status per instance
aws elasticbeanstalk update-environment --environment-name orders-prod --version-label v41   # roll back
aws elasticbeanstalk restart-app-server --environment-name orders-prod                       # restart app servers

Traps

Practice questions

  1. During a rolling deployment with a batch size of 25 % on an eight-instance environment, the third batch does not become healthy within the command timeout. What is the state of the environment?

    • A. Elastic Beanstalk rolls every instance back to the previous version automatically and reports the deployment as aborted.
    • B. Elastic Beanstalk terminates the temporary Auto Scaling group and leaves the original instances unchanged.
    • C. Every instance runs the new version, because health checks are evaluated only for the first batch.
    • D. Finished batches run the new version, pending batches still run the old one, and a manual redeploy rolls back.

  2. A developer changes the instance type of an eight-instance production environment from t3.small to m7i.large. The change must not cause downtime. Which TWO statements are correct? (Select TWO.)

    • A. The change replaces all instances, so the settings in aws:autoscaling:updatepolicy:rollingupdate control it, not the deployment policy.
    • B. Setting RollingUpdateType to Health makes Elastic Beanstalk wait for new instances to pass health checks before it moves to the next batch.
    • C. Elastic Beanstalk applies the change in place by restarting the application server on each instance.
    • D. The BatchSize option in aws:elasticbeanstalk:command sets how many instances are replaced in each batch.
    • E. With rolling updates disabled, Elastic Beanstalk still keeps a minimum number of instances in service during the change.
Answers
  1. D. A rolling deployment that fails leaves finished batches on the new version and pending batches on the old one; rollback is a manual redeploy. A describes behaviour Beanstalk doesn't have; B describes an immutable deployment; C is wrong because every batch must pass health checks.
  2. A, B. Instance type is a launch configuration setting, so instances are replaced under the rolling update settings, and the Health type waits for health checks. C is wrong because the instances are replaced, not restarted; D is a deployment setting (MaxBatchSize applies here); E is wrong because Disabled replaces all instances without avoiding downtime.

7. Immutable and traffic splitting deployments

Concept

Exam facts

Developer angle

# .ebextensions/canary.config
option_settings:
  aws:elasticbeanstalk:command:
    DeploymentPolicy: TrafficSplitting
  aws:elasticbeanstalk:trafficsplitting:
    NewVersionPercent: "20"
    EvaluationTime: "15"

# .ebextensions/immutable-all.config: immutable for deployments AND configuration changes
option_settings:
  aws:autoscaling:updatepolicy:rollingupdate:
    RollingUpdateType: Immutable
  aws:elasticbeanstalk:command:
    DeploymentPolicy: Immutable

aws elasticbeanstalk abort-environment-update --environment-name orders-prod

Traps

Practice questions

  1. A team wants each new version of its API to receive 25 % of production traffic for 30 minutes, roll back automatically if the new instances become unhealthy, and keep the same environment URL without any DNS changes. Which configuration meets these requirements?

    • A. DeploymentPolicy: TrafficSplitting with NewVersionPercent: "25" and EvaluationTime: "30".
    • B. DeploymentPolicy: Immutable with HealthCheckSuccessThreshold: Warning and Timeout: "1800".
    • C. Route 53 weighted records that send 25 % of requests to a cloned environment, with health checks.
    • D. DeploymentPolicy: RollingWithAdditionalBatch with BatchSize: 25 and BatchSizeType: Percentage.

  2. An immutable deployment fails with an error. The source bundle contains .ebextensions files that change the load balancer idle timeout and the instance type along with the new code. Which TWO actions resolve the problem? (Select TWO.)

    • A. Set IgnoreHealthCheck: true in aws:elasticbeanstalk:command and retry the immutable deployment.
    • B. Switch the environment to basic health reporting and retry the immutable deployment.
    • C. Apply the configuration changes in a separate environment update, and then deploy the new version.
    • D. Create a new environment with the new settings and version, test it, and swap the environment URLs.
    • E. Raise the command Timeout in aws:elasticbeanstalk:command to 3,600 seconds and retry.
Answers
  1. A. Traffic splitting sends the stated share through the environment's ALB for the evaluation time and rolls back automatically. B moves all traffic once instances are healthy, with no canary share; C works but requires two environments and DNS changes; D updates batches of existing instances, which isn't a traffic percentage.
  2. C, D. Immutable updates can't be combined with resource configuration changes; separate updates fix it, and blue/green fits when the changes depend on each other. A only affects health-check failures; B is wrong because immutable requires enhanced health; E doesn't remove the restriction.

8. Blue green deployments and cloning

Concept

Exam facts

Developer angle

eb clone orders-blue                              # prompts for the clone's name and CNAME prefix
eb deploy orders-green --version v43              # deploy an existing version to the green environment
eb swap orders-blue --destination_name orders-green
aws elasticbeanstalk swap-environment-cnames \
  --source-environment-name orders-blue --destination-environment-name orders-green

Allow swaps between two named environments only:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "elasticbeanstalk:SwapEnvironmentCNAMEs",
    "Resource": [
      "arn:aws:elasticbeanstalk:eu-west-1:111122223333:environment/orders/orders-blue",
      "arn:aws:elasticbeanstalk:eu-west-1:111122223333:environment/orders/orders-green"]
  }]
}

Traps

Practice questions

  1. A team swapped environment URLs from its blue environment to the green one. Thirty minutes later, some users still reach the old version. The team wants every user on green with no errors. What should the team do?

    • A. Swap the environment URLs a second time and verify the green environment's URL again.
    • B. Terminate the blue environment now and let clients retry until they resolve the green one.
    • C. Keep the blue environment running until cached DNS records expire, and then terminate it.
    • D. Lower the TTL of the environment's CNAME in the aws:elasticbeanstalk:environment namespace.

  2. A developer clones a production environment to create a staging copy. Which TWO items must the developer handle after the clone is created? (Select TWO.)

    • A. Re-create the ingress security group rules for the clone.
    • B. Re-enter the environment properties in the clone.
    • C. Re-select the load balancer type for the clone.
    • D. Move the clone to a newer platform branch.
    • E. Load the data into the clone's new database.
Answers
  1. C. The swap changed the CNAMEs, but resolvers and clients keep cached answers for a while, so blue must keep serving until they expire. A rolls back to blue; B breaks the users who still resolve blue; D isn't a setting Beanstalk offers.
  2. A, E. Ingress security groups and RDS data aren't cloned, so the clone is open to the internet and its new database is empty. B is unnecessary because environment variables are copied; C is unnecessary because the clone keeps the original load balancer type; D isn't possible because a clone stays on the same platform branch.

9. ebextensions and configuration precedence

Concept

Exam facts

Developer angle

# .ebextensions/01-app.config
option_settings:
  aws:elasticbeanstalk:application:environment:
    JOBS_TABLE: '`{"Ref" : "JobsTable"}`'
Resources:
  JobsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: jobId
          AttributeType: S
      KeySchema:
        - AttributeName: jobId
          KeyType: HASH
container_commands:
  01_migrate:
    command: "python manage.py migrate --noinput"
    leader_only: true

web: gunicorn --bind :5000 app:application
metrics: python metrics_agent.py

#!/bin/bash
# .platform/hooks/predeploy/10-assets.sh: runs on every instance, after container_commands
set -euo pipefail
npm run build

eb config --display                                   # active settings (environment properties excluded)
aws elasticbeanstalk update-environment --environment-name orders-prod \
  --options-to-remove Namespace=aws:autoscaling:asg,OptionName=MinSize   # let the .ebextensions value apply
eb config save orders-prod --cfg prod-baseline        # .elasticbeanstalk/saved_configs/prod-baseline.cfg.yml
eb config put prod-baseline
eb create orders-prod-2 --cfg prod-baseline

Traps

Practice questions

  1. A developer adds .ebextensions/scaling.config that sets MinSize: 2 in aws:autoscaling:asg. The environment was created in the console with a minimum of 4 instances and still keeps 4 after the deployment. What explains this behaviour?

    • A. Configuration files are applied only to environments created with the EB CLI, not to console-created environments.
    • B. Settings applied directly to the environment through the console take precedence over configuration files.
    • C. Files in .ebextensions must use the .yaml extension; files with other extensions are ignored.
    • D. MinSize can only be changed through a saved configuration, so Elastic Beanstalk discards the file's setting.

  2. A Python application must run its database schema migration exactly once per deployment across a six-instance environment, after the new source is extracted and before the new version goes live. Which TWO configuration choices meet this requirement? (Select TWO.)

    • A. Define the migration under commands in an .ebextensions file.
    • B. Define the migration under container_commands in an .ebextensions file.
    • C. Set leader_only: true on that command.
    • D. Put the migration script in .platform/hooks/postdeploy.
    • E. Start the migration as the web process in the Procfile.
Answers
  1. B. Options set directly on the environment (here, by the console at creation) outrank configuration files. A is wrong because configuration files work with every client; C is wrong because the extension must be .config; D is wrong because MinSize can be set anywhere, and saved configurations rank above files but below direct settings.
  2. B, C. Container commands run after extraction and before deployment, and leader_only limits the command to one instance. A is wrong because commands run before extraction; D runs on every instance after the version is live; E is wrong because the web process must be the long-running application.

10. Environment properties and secrets

Concept

Exam facts

Developer angle

# .ebextensions/settings.config
option_settings:
  aws:elasticbeanstalk:application:environment:
    LOG_LEVEL: info
    API_BASE_URL: https://api.example.com
  aws:elasticbeanstalk:application:environmentsecrets:
    DB_PASSWORD: arn:aws:secretsmanager:eu-west-1:111122223333:secret:orders/db-AbCd12:password
    FEATURE_FLAGS: arn:aws:ssm:eu-west-1:111122223333:parameter/orders/flags

Instance profile permissions for those two values:

{
  "Version": "2012-10-17",
  "Statement": [
    {"Effect": "Allow",
     "Action": ["secretsmanager:GetSecretValue", "ssm:GetParameter"],
     "Resource": ["arn:aws:secretsmanager:eu-west-1:111122223333:secret:orders/db-AbCd12",
                  "arn:aws:ssm:eu-west-1:111122223333:parameter/orders/flags"]},
    {"Effect": "Allow", "Action": "kms:Decrypt",
     "Resource": "arn:aws:kms:eu-west-1:111122223333:key/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d"}
  ]
}

eb setenv LOG_LEVEL=debug OLD_FLAG=          # sets one property, deletes another
eb printenv
aws elasticbeanstalk restart-app-server --environment-name orders-prod   # re-fetch rotated secrets

Traps

Practice questions

  1. An application reads its database password from the environment variable DB_PASSWORD. A security review requires that the password no longer appears in plaintext in the environment configuration and that it comes from AWS Secrets Manager, with the fewest code changes. What should the developer do?

    • A. Keep the value in aws:elasticbeanstalk:application:environment and restrict read access to the bundles in the S3 bucket.
    • B. Grant secretsmanager:GetSecretValue to the Elastic Beanstalk service role and keep the plaintext property as a fallback value.
    • C. Rewrite the application to call GetSecretValue with the SDK at startup and cache the password in memory.
    • D. Map DB_PASSWORD to the secret ARN in aws:elasticbeanstalk:application:environmentsecrets and let the instance role read it.

  2. After a scheduled rotation of a Secrets Manager secret that is configured as an environment secret, the existing instances still use the old value. Which TWO statements are correct? (Select TWO.)

    • A. Running UpdateEnvironment or RestartAppServer makes the instances fetch the current value.
    • B. Elastic Beanstalk refreshes environment secrets automatically every 15 minutes.
    • C. Rotation events from Secrets Manager trigger an immutable update of the environment.
    • D. Instances launched by a scale-out after the rotation receive the new value, so the application must tolerate both values for a while.
    • E. Secret values are read only when a new application version is created.
Answers
  1. D. Environment secrets keep the variable name, so the code doesn't change, and only the ARN is stored; the instances need permission to read the secret. A leaves the password in plaintext; B grants the wrong role and keeps plaintext; C works but needs code changes.
  2. A, D. Values are fetched at bootstrap and not refreshed automatically; an environment update or app-server restart makes the running instances fetch them again, and newly launched instances already get the new value. B and C describe automation that doesn't exist; E is wrong because instances fetch the values at bootstrap or on an update or restart, not when a version is created.

11. RDS databases and decoupling

Concept

Exam facts

Developer angle

Decouple safely in two separate updates:

aws elasticbeanstalk update-environment --environment-name orders-test \
  --option-settings Namespace=aws:rds:dbinstance,OptionName=DBDeletionPolicy,Value=Retain
# wait until the update finishes (Ready), then decouple
aws elasticbeanstalk update-environment --environment-name orders-test \
  --option-settings Namespace=aws:rds:dbinstance,OptionName=HasCoupledDatabase,Value=false

Create a test environment with a coupled PostgreSQL database (the EB CLI prompts for the password); the app then reads RDS_HOSTNAME, RDS_PORT, RDS_DB_NAME, RDS_USERNAME and RDS_PASSWORD like any environment variable:

eb create orders-test --database --database.engine postgres --database.username appadmin

Traps

Practice questions

  1. A team created an RDS database coupled to its Elastic Beanstalk environment while testing. The environment will be replaced for production, and the database must keep running with minimal downtime and operational effort. What should the developer do?

    • A. Set the database deletion policy to Retain and apply it, and then decouple the database in a separate update.
    • B. Select Decouple database and change the deletion policy to Retain in the same configuration update.
    • C. Snapshot the database, enable deletion protection in RDS, terminate the environment, and delete the stack left in DELETE_FAILED.
    • D. Clone the environment and let the clone take over the existing database instance.

  2. A production application on Elastic Beanstalk must use an Amazon Aurora PostgreSQL cluster that several environments share. Which TWO steps are required? (Select TWO.)

    • A. Add the database in each environment's Database configuration and select the Aurora engine.
    • B. Create the Aurora cluster outside Elastic Beanstalk and pass its endpoint in through environment properties or secrets.
    • C. Set HasCoupledDatabase: true in every environment and point each one at the same cluster endpoint.
    • D. Store the master password in aws:elasticbeanstalk:application:environment and read it as RDS_PASSWORD.
    • E. Allow the database port from a security group that is attached to the environments' Auto Scaling groups.
Answers
  1. A. Applying Retain first and then decoupling keeps the database running outside Beanstalk without touching the environment. B risks losing the database because the pending policy is ignored; C is the older, longer procedure with more effort and risk; D creates a new, empty database.
  2. B, E. Aurora must be external, with its endpoint passed in, and the database security group must admit the environments' instances. A fails because coupled databases don't support Aurora and belong to one environment; C creates new coupled databases; D stores the password in plaintext.

12. Docker and container environments

Concept

Exam facts

File Platform branch Use
Dockerfile Docker Build the image during deployment (needs no .zip when it is the only file)
Dockerrun.aws.json v1 Docker (without Compose) Pull an existing image; Image.Name, Ports (ContainerPort), Volumes, Logging, Authentication, Entrypoint, Command
docker-compose.yml (+ Dockerrun.aws.json v3 if needed) Docker (with Compose) Several services on each instance
Dockerrun.aws.json v2 ECS containerDefinitions turned into an ECS task definition; images must be prebuilt

Developer angle

{
  "AWSEBDockerrunVersion": "1",
  "Image": {"Name": "111122223333.dkr.ecr.eu-west-1.amazonaws.com/orders-api:1.4.2", "Update": "true"},
  "Ports": [{"ContainerPort": 8080}],
  "Logging": "/var/log/orders"
}

{
  "AWSEBDockerrunVersion": 2,
  "containerDefinitions": [
    {"name": "api", "image": "111122223333.dkr.ecr.eu-west-1.amazonaws.com/orders-api:1.4.2",
     "essential": true, "memory": 512,
     "portMappings": [{"hostPort": 80, "containerPort": 8080}]},
    {"name": "proxy-sidecar", "image": "public.ecr.aws/nginx/nginx:stable",
     "essential": false, "memory": 128}
  ]
}

aws iam attach-role-policy --role-name orders-ec2-role \
  --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
eb local run --port 8080        # run the Docker app locally with the EB CLI

Traps

Practice questions

  1. A team runs its API image from a private Amazon ECR repository on the Docker running on AL2023 platform branch. The team must not store registry credentials anywhere. What should the developer do?

    • A. Upload a .dockercfg file containing an ECR authorization token to Amazon S3 and reference it in the Authentication key.
    • B. Add the ECR pull permissions to the Elastic Beanstalk service role and reference the image URI in Dockerrun.aws.json.
    • C. Attach AmazonEC2ContainerRegistryReadOnly to the instance profile role and use the image URI in Dockerrun.aws.json.
    • D. Run docker login in a commands block with access keys stored as environment properties.

  2. A legacy application ran on the retired Multicontainer Docker (Amazon Linux AMI) platform with a Dockerrun.aws.json v2 file that defines three containers. Which TWO statements about migrating it are correct? (Select TWO.)

    • A. The Docker running on AL2023 branch reads Dockerrun.aws.json v2 files natively.
    • B. Multicontainer Docker on Amazon Linux AMI can still be selected for new environments in the console.
    • C. The ECS running on AL2023 branch accepts the same Dockerrun.aws.json v2 file without source changes.
    • D. The ECS-based branch needs prebuilt images in a registry, because it can't build a Dockerfile during deployment.
    • E. The ECS-based branch rolls back automatically when an ECS task fails to start.
Answers
  1. C. Beanstalk authenticates to ECR with the instance profile, so read-only ECR permissions on that role are enough. A stores a credential file that expires and isn't needed for ECR; B gives the permissions to the wrong role; D places long-term keys in configuration.
  2. C, D. The ECS branch is the documented migration path for v2 files, and it only pulls prebuilt images. A is wrong because the Docker branch uses v1 or v3 files and Compose; B is wrong because the branch is retired; E is wrong because a failed ECS task isn't rolled back.

13. Source bundles and the lifecycle policy

Concept

Exam facts

Developer angle

cd orders-api
zip ../orders-v42.zip -r * .[^.]*              # contents only, hidden folders included, no parent folder
git archive -v -o ../orders-v42.zip --format=zip HEAD   # alternative: committed files only

eb init orders --platform "Node.js 24 running on 64bit Amazon Linux 2023" --region eu-west-1
eb deploy --label v42 --message "checkout fix"
eb appversion lifecycle --print
aws elasticbeanstalk update-application-resource-lifecycle --application-name orders \
  --resource-lifecycle-config file://lifecycle.json

lifecycle.json:

{
  "ServiceRole": "arn:aws:iam::111122223333:role/aws-elasticbeanstalk-service-role",
  "VersionLifecycleConfig": {
    "MaxCountRule": { "Enabled": true, "MaxCount": 100, "DeleteSourceFromS3": false },
    "MaxAgeRule": { "Enabled": false, "MaxAgeInDays": 180, "DeleteSourceFromS3": false }
  }
}

Traps

Practice questions

  1. A CI pipeline creates a new application version for every commit across 12 Elastic Beanstalk applications in one Region. Deployments start failing because no more versions can be created. What should the team do to prevent this with the LEAST operational overhead?

    • A. Request a quota increase to the maximum value and keep every application version indefinitely.
    • B. Configure an application version lifecycle policy with a count or age rule on each of the applications.
    • C. Write a scheduled AWS Lambda function that calls DeleteApplicationVersion for versions older than 30 days.
    • D. Create a separate Elastic Beanstalk application for each Git branch of the source repository.

  2. A developer configures a lifecycle policy with a MaxCountRule of 50 and DeleteSourceFromS3 set to false. Which TWO statements are true? (Select TWO.)

    • A. Versions that an environment is currently running are not deleted, even when they are the oldest.
    • B. Elastic Beanstalk applies the policy once a day, whether or not new versions are created.
    • C. The source bundles of deleted versions remain in the Elastic Beanstalk S3 bucket.
    • D. The policy needs no IAM role because Elastic Beanstalk deletes versions with the caller's credentials.
    • E. The version that is being created counts toward the limit of 50 before older versions are deleted.
Answers
  1. B. The built-in lifecycle policy prunes versions automatically and keeps the Region-wide total under the quota. A postpones the problem; C works but adds code to build and maintain; D doesn't help because the quota is shared across all applications in the Region.
  2. A, C. In-use versions are protected, and bundles stay in S3 unless DeleteSourceFromS3 is true. B is wrong because the policy runs when a version is created; D is wrong because a service role performs the deletions; E is wrong because the new version isn't counted.

14. Health logs and troubleshooting

Concept

Exam facts

Developer angle

# .ebextensions/observability.config
option_settings:
  aws:elasticbeanstalk:healthreporting:system:
    SystemType: enhanced
  aws:elasticbeanstalk:cloudwatch:logs:
    StreamLogs: true
    DeleteOnTerminate: false
    RetentionInDays: 90
  aws:elasticbeanstalk:cloudwatch:logs:health:
    HealthStreamingEnabled: true
  aws:elasticbeanstalk:xray:
    XRayEnabled: true

eb health                    # colour, status, cause and deployment ID per instance
eb events                    # recent environment events
eb logs                      # tail logs of every instance
eb logs --zip                # full bundle logs saved under .elasticbeanstalk/logs
eb logs -cw enable           # start streaming instance logs to CloudWatch Logs
aws elasticbeanstalk describe-environment-health --environment-name orders-prod --attribute-names All
aws elasticbeanstalk request-environment-info --environment-name orders-prod --info-type bundle
aws elasticbeanstalk retrieve-environment-info --environment-name orders-prod --info-type bundle

Traps

Practice questions

  1. A deployment fails and Elastic Beanstalk reports errors on several instances. The developer needs the complete log files from every instance, including eb-engine.log and the proxy logs, in one download. What should the developer do?

    • A. Request bundle logs (Full Logs) from the console, or run eb logs --zip.
    • B. Request tail logs (Last 100 Lines) from the console for each instance.
    • C. Run eb health for the environment and export the per-instance output.
    • D. Enable LogPublicationControl and wait for the next hourly upload of rotated logs.

  2. A team needs instance logs kept for 90 days, even after environments are terminated, and wants to trace requests with AWS X-Ray. Which TWO configuration settings meet these requirements? (Select TWO.)

    • A. aws:elasticbeanstalk:cloudwatch:logs:health with HealthStreamingEnabled: true.
    • B. aws:elasticbeanstalk:cloudwatch:logs with StreamLogs: true, RetentionInDays: 90 and DeleteOnTerminate: false.
    • C. aws:elasticbeanstalk:healthreporting:system with SystemType: enhanced and EnhancedHealthAuthEnabled: true.
    • D. aws:elasticbeanstalk:xray with XRayEnabled: true, plus instrumentation in the application code.
    • E. A daily eb logs run that downloads tail logs to a developer workstation.
Answers
  1. A. Bundle logs package the full log files from every instance into one archive. B returns only the last 100 lines; C shows health status, not logs; D only uploads rotated logs and adds a delay.
  2. B, D. CloudWatch Logs streaming with 90-day retention, kept after termination, meets the log requirement, and X-Ray needs the daemon plus instrumentation. A streams environment health data, not instance logs; C changes health reporting and sends nothing to X-Ray or CloudWatch Logs; E keeps only tail logs and stores them outside AWS.

Quick decision rules

Changed vs older material

Learn the Current column; older practice material may still show the Course / older material value. Values were checked on 2026-10-12.

Topic Course / older material Current (verified 2026-10-12) Source
§1 · Compute modes Beanstalk always runs your code on EC2 instances in its own Auto Scaling group Two modes: Standard (EC2) and Cluster (containers on a shared Amazon EKS cluster with EKS Auto Mode), since 2026-09-17 AWS docs
§1 · Default EC2 instance profile The console creates aws-elasticbeanstalk-ec2-role on the first environment No longer created; create a role trusted by ec2.amazonaws.com with the Beanstalk managed policies AWS docs
§1 · Managed user policies AWSElasticBeanstalkFullAccess, AWSElasticBeanstalkReadOnlyAccess; service policy AWSElasticBeanstalkService AdministratorAccess-AWSElasticBeanstalk, AWSElasticBeanstalkReadOnly; service policy AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy AWS docs
§2 · Default load balancer Classic Load Balancer as the default or a console choice ALB by default in the console and EB CLI; CLB disabled in the console create wizard; API default of LoadBalancerType still classic AWS docs
§2 · Launch configurations Instances launch from Auto Scaling launch configurations Accounts created on or after 2024-10-01 use launch templates; some options migrate older environments to them AWS docs
§2 · IMDSv1 on instances Both IMDS versions enabled AL2023 and Windows Server 2022+: DisableIMDSv1 defaults to true (IMDSv2 only) AWS docs
§3 · Worker scaling A worker tier follows its queue backlog by itself Built-in triggers use instance/load balancer metrics (default NetworkOut; docs describe CPU-based worker scaling); queue-depth scaling needs your own CloudWatch alarm and policy AWS docs
§4 · Platform list Language platforms with no OS or versions given (Go, Java SE, Java with Tomcat, .NET Core on Linux, .NET on Windows Server, Node.js, PHP, Python, Ruby) AL2023 branches for Docker, ECS, Go, Java SE (Corretto), Tomcat, .NET Core on Linux, Node.js, PHP, Python, Ruby, plus .NET on Windows Server 2019/2022/2025 (⚠️ volatile) AWS docs
§4 · Custom platforms (Packer) Supported platform Retired 2022-07-18 with all Amazon Linux AMI branches; use a custom AMI or a Docker image AWS docs
§4 · Amazon Linux 2 branches Current platforms All retired 2026-08-06; only AL2023 and Windows Server branches remain (Windows Server 2016 retired 2026-10-08) AWS docs
§8 · Cloning A clone keeps every resource and setting Only Beanstalk-managed settings; RDS data, unmanaged changes and ingress security groups aren't copied; same platform branch only AWS docs
§9 · Instance customization .ebextensions commands and files for every customization Amazon Linux 2 and later (AL2023 today): prefer Buildfile, Procfile and platform hooks AWS docs
§10 · Secrets Plaintext environment properties or SDK calls in code aws:elasticbeanstalk:application:environmentsecrets maps Secrets Manager / Parameter Store ARNs to variables (platform versions from 2025-03-26; JSON keys from 2026-01-13) AWS docs
§11 · Decoupling RDS Snapshot, deletion protection, new environment, URL swap, terminate, delete the DELETE_FAILED stack Decouple in place (console or HasCoupledDatabase: false) with DBDeletionPolicy Retain/Snapshot/Delete, since 2021-10-06 AWS docs
§12 · Several containers per instance Multicontainer Docker platform ECS running on AL2023 (same Dockerrun.aws.json v2), or Docker Compose on Docker running on AL2023 AWS docs
§12 · Single-container and preconfigured Docker One container per instance; preconfigured GlassFish/Go/Python Docker platforms Docker running on AL2023 runs one or more containers; preconfigured Docker superseded AWS docs
§13 · Version quota 1,000 versions is a fixed ceiling 1,000 is the default account quota per Region, shared by all applications, adjustable AWS docs
§13 · Lifecycle rules Rules based on time or on space Maximum count or maximum age; up to 100 deletions per run; in-use versions and versions used in the last 10 weeks are kept; bundles kept in S3 by default AWS docs