Deployment
Automated Test Events, Versioned Environments, and Infrastructure as Code
ImportantAutomate deployment testing with deterministic events, approved versions, isolated service environments, IaC, and verified AI-generated tests.
Aligned to AWS Certified Developer - Associate (DVA-C02) Version 2.1, verified August 23, 2026.
Why this matters
Automation is trustworthy only when it targets a known artifact and environment. Branch names, mutable tags, unpublished Lambda code, and manual resources make a green test impossible to reproduce or promote safely.
Must Know
- Create schema-valid test events with deterministic expected behavior for normal, invalid, duplicate, retry, and terminal paths.
- Deploy API revisions to explicit stages and bind stage-specific approved configuration; a source branch alone is not an API environment.
- A published Lambda version is an immutable snapshot of code and most configuration. An alias is a movable name that points to a version and can support traffic routing.
- For container testing, use an immutable digest or a controlled approved tag; tag mutability must not silently change the tested image.
- AWS Amplify branch environments can give an application branch its own deployed environment and configuration.
- AWS SAM and CloudFormation templates are executable infrastructure definitions. Deploy the versioned template to the test stack and fail the workflow on deployment or assertion errors.
- Keep development, test, and production separated across artifact identity, stage or stack, configuration, roles, and data.
- Amazon Q Developer can generate candidate automated tests, but developers must inspect assertions and fixtures and execute them in the approved workflow.
Compare and Distinguish
- Lambda version vs alias: the version is immutable; the alias is a movable pointer and optional traffic-routing surface.
- Image tag vs digest: a tag may be mutable unless controlled; a digest identifies immutable image content.
- Branch vs environment: a source branch names code history; a managed environment also binds deployed resources and configuration.
- API stage vs custom domain: a stage identifies an API deployment environment; a custom domain maps a hostname to API routing.
- SAM/CloudFormation vs manual resources: IaC makes declared resources repeatable and updateable through a versioned source of truth.
- Generated test vs verified test: generation proposes code; deterministic assertions and execution establish whether it checks the requirement.
Scenario examples
- Scenario: Integration tests must exercise the exact Lambda code considered for release. Publish a version and point the test alias to it.
- Scenario: A pipeline must reproduce a retry failure. Store a service-valid event fixture and assert the intended terminal behavior.
- Scenario: Test must use the same container later promoted. Reference an immutable digest or controlled approved tag without rebuilding.
- Scenario: A branch needs isolated full-stack validation. Deploy it to the approved Amplify branch environment with explicit configuration.
Exam traps
- `$LATEST` is mutable and is not an immutable Lambda release candidate.
- An alias name does not itself freeze the version it points to.
- An image tag is not guaranteed immutable unless repository policy enforces it.
- Any JSON document is not automatically a valid AWS service event.
- Manual test resources create drift from the IaC definition.
- AWS Copilot remains only a recognition-level example in Skill 3.3.3; do not infer standalone product depth from that example.
Key takeaways
- Automate with representative fixtures and deterministic assertions.
- Pin the exact artifact version under test.
- Bind environment identity across resources, configuration, roles, and data.
- Deploy test infrastructure from versioned IaC.
- Inspect and execute AI-generated tests before trusting their result.
How it works
- The workflow builds or selects an immutable approved artifact.
- Versioned IaC creates or updates the isolated test resources and environment bindings.
- Automated fixtures exercise endpoints or events and assert responses and side effects.
- Only successful deployment and behavioral evidence qualifies that artifact for later promotion.
When to use it
- Use Lambda versions and aliases for named, controlled function targets.
- Use immutable image references when container provenance is required.
- Use Amplify branch environments for supported branch-based application deployment.
- Use SAM or CloudFormation for repeatable serverless and AWS resource definitions.
- Use Amazon Q Developer to accelerate test creation while retaining developer verification.
Security and governance implications
- Give automation scoped roles for the intended test stages and stacks only.
- Keep test environment secrets and data isolated from production.
- Restrict artifact retagging, alias movement, and IaC changes to approved workflows.
- Inspect generated tests for exposed values, unsafe operations, and assertions that omit authorization boundaries.
Failure signals and diagnosis
- For non-reproducible tests, compare artifact digest/version, alias target, template revision, configuration, and fixture.
- For an event fixture rejection, compare the fixture with the current service event schema.
- For environment leakage, trace branch, stage/stack, role, configuration, data, and endpoint mappings.
- For generated-test failure, validate the expected behavior independently before changing application code.
More detail
- Service-specific environments use different surfaces: API Gateway stages, Lambda aliases, Amplify branches, container references, and IaC stacks.
- Environment labels are meaningful only when they resolve to approved immutable artifacts and isolated configuration.
- Automated deployment testing remains within an existing delivery workflow; designing the entire CI/CD system is excluded.
- A generated test that compiles can still contain a wrong assertion, incomplete fixture, or missing failure path.
Ready for the quiz?
- Why is a Lambda alias not an immutable snapshot?
- What makes a container reference suitable for reproducible testing?
- Which properties turn a branch into an isolated application environment?
- What should a machine-runnable event fixture include?
- How does IaC reduce test-environment drift?
Related objectives
- D3.3 — Automate deployment testing
- 3.3.1 — Create application test events (for example, JSON payloads for testing AWS Lambda, API Gateway, AWS SAM resources)
- 3.3.2 — Deploy API resources to various environments
- 3.3.3 — Create application environments that use approved versions for integration testing (for example, Lambda aliases, container image tags, AWS Amplify branches, AWS Copilot environments)
- 3.3.4 — Implement and deploy infrastructure as code (IaC) templates (for example, AWS SAM templates, AWS CloudFormation templates)
- 3.3.5 — Manage environments in individual AWS services (for example, differentiating between development, test, and production in API Gateway)
- 3.3.6 — Use Amazon Q Developer to generate automated tests