🔐
IAM — Identity and Access Management
Global service (not region-specific). Controls who can do what on which AWS resources. Every API call is authenticated and authorized through IAM.
⚠ Exam priority: Always use Roles for service-to-service access
(EC2, Lambda, etc.) — never embed access keys. Explicit Deny always wins over any Allow. Root account = only for
initial setup.
Core Entities
Users, Groups, Roles
Identity typesUser — permanent long-term credentials (password + access keys). For
humans or apps outside AWS.
Group — collection of users. Policies attached to groups apply to
all members. Cannot nest groups.
Role — temporary credentials via STS. Used by AWS services,
federated users, cross-account access. No static credentials.
Instance Profile — container for a role attached to EC2. Grants the
instance an IAM identity.
Policy Types
Know the differencesAWS Managed — created and maintained by AWS. Reusable across
accounts. Cannot be modified.
Customer Managed — you create and manage. Can be attached to
multiple principals.
Inline — embedded directly in a single user/group/role. Deleted when
the principal is deleted. Use sparingly.
SCP (Service Control Policy) — AWS Organizations. Sets maximum
permissions for an entire OU/account. Does not grant permissions — only restricts.
Resource-based policy — attached to a resource (S3, SQS, KMS…).
Allows cross-account access without assuming a role.
Policy Evaluation Logic
Decision flow1. Explicit Deny → DENY (final)
2. SCP boundary → DENY if outside
3. Permissions boundary → DENY if outside
4. Explicit Allow → ALLOW
5. Implicit Deny (default) → DENY
Cross-account: principal must have Allow AND resource policy must allow (or role must
be assumed).
STS & AssumeRole
Temporary credentialsSTS AssumeRole — returns temporary credentials (AccessKeyId,
SecretAccessKey, SessionToken). Duration: 15 min – 12 h.
Trust policy — on the role, defines who can assume it (the
principal). Separate from the permissions policy.
Cross-account flow: Account A role trusts Account B → Account B user
calls sts:AssumeRole → gets temp creds scoped to Account A role.
Use case: Lambda function assumes a role to write to S3 in another account.
Key Comparisons
| Feature | IAM Role | IAM User |
|---|---|---|
| Credentials | Temporary (STS) | Long-term (keys) |
| For AWS services | Yes (best practice) | No (avoid) |
| Cross-account | Yes, via trust policy | Possible but messy |
| MFA possible | Yes (on AssumeRole) | Yes |
| Permissions boundary | Yes | Yes |
AWS Organizations
Organizations & SCPs
Multi-account governanceManagement account — creates the organization, pays for all member accounts. Should have minimal workloads.
Organizational Units (OUs) — hierarchical grouping of accounts. Policies applied at OU level cascade to all children.
SCP (Service Control Policy) — defines maximum available permissions for accounts in the OU. Does NOT grant permissions by itself. Restricts even the root user of member accounts.
Consolidated billing — single payer. Volume discounts aggregated across all accounts. Reserved Instances and Savings Plans shared across member accounts.
Control Tower builds on Organizations to set up a landing zone with built-in guardrails (SCPs + Config rules).
🎯 Exam Traps & Typical Scenarios
Exam Traps
SCP does not grant permissions — it only restricts them. If an SCP denies something, no IAM policy in that account can override it, not even root.
Inline policy is deleted when its user/role is deleted. Customer Managed policy persists independently.
Trust policy (who can assume the role) ≠ Permission policy (what they can do). Both are required.
IAM is global, not per-region. Users, roles, and policies are all global.
A policy that doesn't mention a resource = implicitly denied by default. Explicit Deny always wins, even if another policy has an Allow.
Typical Scenarios
Q: App on EC2 needs DynamoDB access without hardcoded credentials. → IAM Role + Instance Profile (never put Access Keys in code).
Q: SCP on the OU denies
s3:DeleteObject. Admin creates an IAM Allow. Can they delete? → NO. SCP is the maximum permission ceiling.Q: User in account A needs access to account B's S3. → Role in account B with trust policy allowing account A +
sts:AssumeRole permission in account A.Q: Enforce MFA for all operations except the MFA setup itself. → IAM policy with Condition:
aws:MultiFactorAuthPresent: true.No results found.
🖥️
EC2 — Elastic Compute Cloud
Virtual servers (instances) with configurable CPU, memory, storage, and networking. Building block of most AWS architectures.
⚠ Exam priority: Know pricing models cold — they appear in almost every
scenario. Spot = cheapest for fault-tolerant batch. Reserved = cheapest for steady-state 1–3 yr.
On-Demand = flexible short-term.
Pricing Models
| Model | Discount vs On-Demand | Commitment | Best for |
|---|---|---|---|
| On-Demand | — | None | Short-term, unpredictable, dev/test |
| Reserved (Standard) | Up to 72% | 1 or 3 yr, fixed type | Steady-state predictable workloads |
| Reserved (Convertible) | Up to 54% | 1 or 3 yr, can change family | Steady-state, flexibility needed |
| Savings Plans (Compute) | Up to 66% | 1 or 3 yr, $/hr commitment | Flexible: applies to EC2, Lambda, Fargate |
| Spot | Up to 90% | None — can be interrupted 2 min notice | Fault-tolerant batch, ML training, CI/CD |
| Dedicated Host | Can use BYOL | On-Demand or Reserved | Compliance, per-socket/core licensing |
| Dedicated Instance | Higher cost | On-Demand | Compliance, isolated hardware (no host control) |
Instance Families & Placement Groups
Instance Families
Choose by workload typet (Burstable) — baseline CPU + burst credits. Good for variable
low-CPU workloads. Cheap.
m (General Purpose) — balanced CPU/RAM. Most common general
workloads.
c (Compute Optimized) — high CPU ratio. Batch, HPC, gaming servers,
ML inference.
r (Memory Optimized) — high RAM ratio. In-memory databases,
real-time big data analytics.
g / p (GPU) — ML training/inference, video transcoding.
i / d (Storage Optimized) — NVMe SSD, high IOPS. NoSQL databases,
data warehousing.
Placement Groups
Control physical placementCluster — all instances in same AZ, same rack. Ultra-low latency,
high throughput. Risk: single hardware failure. Use for HPC, tightly coupled apps.
Spread — each instance on distinct hardware. Max 7 instances per AZ
per group. Use for critical apps needing max HA.
Partition — groups of instances on separate racks (partitions). Up
to 7 partitions per AZ. Use for distributed systems: Hadoop, Kafka, Cassandra.
Storage & Metadata
Key conceptsInstance Store — physically attached NVMe/SSD. Extremely fast. Data
lost on stop/terminate. Not for persistent data.
EBS — network-attached block storage. Persists independently. Can be
detached/reattached.
User Data — bootstrap script, runs as root on first launch. Retrieve
at
169.254.169.254/latest/user-data.Instance Metadata — retrieve at
169.254.169.254/latest/meta-data/. Contains IAM role creds, instance-id, AMI-id, etc.IMDSv2 requires a session token (PUT request first). IMDSv1 is legacy — disable when
possible.
🎯 Exam Traps & Typical Scenarios
Exam Traps
Instance Store: data is lost on stop, terminate, or hardware failure. EBS persists. Never use Instance Store for durable data.
Reserved Instance Regional = discount but no capacity reservation. Zonal = discount + capacity reservation in that specific AZ.
Spot Instance: 2-minute interruption warning before termination (not immediate). Spot Block is no longer available for new users.
User Data runs only on first boot by default. To re-run it, explicitly enable re-execution or use SSM Run Command.
Cluster Placement Group = maximum throughput between instances, BUT all on the same rack → physical single point of failure.
Typical Scenarios
Q: Fault-tolerant batch job, maximum cost savings. → Spot Instance.
Q: 10 instances that need maximum bandwidth between them (HPC, ML). → Cluster Placement Group.
Q: 7 critical instances that must not share the same hardware. → Spread Placement Group (max 7 per AZ).
Q: Production web server running 24/7 for 1 year, lowest cost. → Reserved Instance (1 year, no convertible) with full upfront payment.
Q: Ultra-fast 2 GB ephemeral cache for the app. → Instance Store (local NVMe, sub-ms latency).
No results found.
🗄️
S3 & Storage Services
S3 = object storage (not block, not file). EBS = block storage for EC2. EFS = shared file system. Snow family = data migration. Storage Gateway = hybrid on-prem integration.
⚠ Exam priority: Know S3 storage class transition rules (minimum durations). S3
is 11 nines durability across all classes. EBS io1/io2 = highest IOPS. EFS = multi-AZ multi-EC2
Linux only.
S3 Storage Classes
| Class | Availability | Min Storage | Retrieval fee | Use case |
|---|---|---|---|---|
| Standard | 99.99% | — | None | Frequently accessed, general purpose |
| Standard-IA | 99.9% | 30 days | Per-GB | Infrequent access, backups, DR |
| One Zone-IA | 99.5% (1 AZ) | 30 days | Per-GB | Infrequent, reproducible data (thumbnails) |
| Intelligent-Tiering | 99.9% | — | None | Unknown or changing access patterns |
| Glacier Instant | 99.9% | 90 days | Per-GB | Archives needing ms retrieval |
| Glacier Flexible | 99.99% | 90 days | Per-GB | Archives, 1 min – 12 h retrieval |
| Glacier Deep Archive | 99.99% | 180 days | Per-GB, 12–48 h | Long-term compliance archives, lowest cost |
S3 Key Features
Encryption
SSE = server-sideSSE-S3 — AWS manages keys. AES-256. Default since Jan 2023. Header:
x-amz-server-side-encryption: AES256.SSE-KMS — KMS CMK. Audit trail in CloudTrail. Header:
aws:kms. Counts against KMS API limits.SSE-C — you provide the key per request. AWS encrypts/decrypts but
never stores the key. HTTPS required.
Client-side — encrypt before upload. You manage everything.
Bucket policy can enforce encryption: deny PutObject without the correct SSE header.
Replication
Requires versioning ONCRR (Cross-Region) — compliance, lower latency for global users,
replication across accounts.
SRR (Same-Region) — log aggregation, live replication between prod
and test.
Existing objects are NOT replicated automatically — use S3 Batch Replication for
that.
Delete markers are NOT replicated by default (configurable). Deletions with version
ID are never replicated.
Access Control
Layered permissionsBucket Policy — resource-based, JSON. Applies to bucket + objects.
Supports cross-account.
IAM Policy — identity-based. User/role must have S3 permission AND
(if cross-account) bucket policy must allow.
Presigned URL — time-limited URL signed with your credentials.
Anyone with the URL can access. Used for temporary downloads/uploads.
Block Public Access — account-level or bucket-level override.
Overrides even bucket policies that would grant public access.
Block & File Storage
| EBS Type | Category | Max IOPS | Use case |
|---|---|---|---|
| gp3 | SSD General | 16,000 | Default choice. Boot volumes, dev/test. IOPS independent of size. |
| gp2 | SSD General | 16,000 | Legacy. IOPS scales with size (3 IOPS/GB). |
| io2 Block Express | SSD Provisioned | 256,000 | Sub-ms latency, critical DBs, SAP HANA. Multi-Attach supported. |
| io1 | SSD Provisioned | 64,000 | High-perf DBs. Multi-Attach supported. |
| st1 | HDD Throughput | 500 MiB/s | Big data, data warehouses, log processing. Sequential access. |
| sc1 | HDD Cold | 250 MiB/s | Infrequently accessed archives. Lowest cost HDD. |
EFS vs FSx
Shared file systemsEFS — NFS v4. Linux only. Multi-AZ, elastic auto-scaling.
POSIX-compliant. Pay per GB used. Good for web serving, CMS, shared home dirs.
FSx for Windows — SMB protocol. Active Directory integration.
Windows NTFS. For Windows-based apps, SharePoint, SQL Server.
FSx for Lustre — high-performance parallel file system. HPC, ML
training. Can integrate with S3 as backend. Sub-ms latency.
EBS = single EC2 instance (mostly). EFS/FSx = multiple instances simultaneously.
Snow Family
Physical data migrationSnowcone — 8 TB HDD / 14 TB SSD. Portable, rugged. Edge computing +
storage. Can use DataSync online transfer.
Snowball Edge (Storage Optimized) — 80 TB usable. Large-scale data
migration.
Snowball Edge (Compute Optimized) — 42 TB + EC2/Lambda at the edge.
Disconnected environments, ML inference.
Snowmobile — 100 PB. Exabyte-scale migration. Physical truck.
Rule of thumb: if transfer > 1 week over your network → consider Snow family.
Storage Gateway
On-prem → AWS hybridS3 File Gateway — NFS/SMB mount backed by S3. Local cache for
recently accessed files. Use for file shares, home dirs.
FSx File Gateway — SMB mount backed by FSx for Windows. Local cache.
Volume Gateway (Cached) — iSCSI. Primary data in S3, frequently
accessed cached locally.
Volume Gateway (Stored) — iSCSI. All data locally, async backup to
S3 as EBS snapshots.
Tape Gateway — Virtual Tape Library (VTL) backed by S3/Glacier.
Replaces physical tape infrastructure.
AWS DataSync
Online data migration & syncTransfer data from on-prem (NFS, SMB, HDFS, S3-compatible) → AWS (S3, EFS, FSx), or between AWS storage services. Requires a DataSync Agent VM installed on-prem.
Scheduled or one-time. Preserves metadata and permissions. Automatic encryption in transit, integrity checksums, bandwidth throttling.
vs Storage Gateway — DataSync = bulk migration or periodic replication job. Storage Gateway = ongoing hybrid access (mount cloud storage as a local filesystem).
vs Snowball — DataSync = online (network). Snowball = offline (physical device, use when transfer > ~1 week).
🎯 Exam Traps & Typical Scenarios
Exam Traps
S3 Standard-IA: minimum storage charge of 30 days and 128 KB per object, even if the object is smaller.
Glacier Instant Retrieval (ms) ≠ Glacier Flexible (minutes/hours) ≠ Glacier Deep Archive (12h). Don't mix them up.
S3 Replication (CRR/SRR): does not replicate existing objects retroactively. Only new objects from activation onwards (use Batch Replication for existing objects).
Object Lock only works on buckets with Versioning enabled. Compliance mode = not even root can delete. Governance mode = admins can override.
DataSync vs Storage Gateway: DataSync = scheduled online migration/sync job. Storage Gateway = ongoing hybrid access (mount cloud storage as a local filesystem).
Typical Scenarios
Q: Videos accessed frequently for the first 30 days, then rarely. → Lifecycle rule: S3 Standard → Standard-IA after 30 days → Glacier after 90 days.
Q: Files that cannot be deleted for 7 years due to compliance. → S3 Object Lock in Compliance mode with a 7-year retention period.
Q: Migrate 50 TB from on-prem NAS to S3 with minimal network impact. → AWS Snowball Edge (if transfer would take >1 week over the network) or DataSync (if network can handle it).
Q: On-prem system needs S3 access as a local folder without changing the app. → Storage Gateway File Gateway.
No results found.
🌐
VPC — Virtual Private Cloud
Isolated virtual network in AWS. You control IP addressing, subnets, routing, and network gateways. Default VPC exists in every region.
⚠ Exam priority: Private subnet = no route to IGW. NAT = outbound internet for
private subnets. VPC Endpoint = reach S3/DynamoDB without internet. Security Groups are stateful; NACLs are
stateless.
Security Groups vs NACLs
| Feature | Security Groups | NACLs |
|---|---|---|
| Level | Instance (ENI) | Subnet |
| Statefulness | Stateful — return traffic auto-allowed | Stateless — must allow inbound AND outbound |
| Rules | Allow only | Allow and Deny |
| Rule evaluation | All rules evaluated together | Lowest rule number wins (1–32766) |
| Default | Deny all inbound, allow all outbound | Allow all inbound & outbound |
| Can block specific IP | No | Yes — use Deny rule |
Connectivity Options
| Option | Direction | Transitive? | Use case |
|---|---|---|---|
| Internet Gateway (IGW) | Both | — | Public subnet → internet. 1 per VPC. |
| NAT Gateway | Outbound only | — | Private subnet → internet. Managed, per-AZ. No inbound initiated from internet. |
| VPC Peering | Both | No | Connect 2 VPCs. Same or cross-account/region. No overlapping CIDRs. |
| Transit Gateway (TGW) | Both | Yes | Hub-and-spoke for many VPCs + on-prem. Supports VPN, Direct Connect. |
| VPC Endpoint (Gateway) | Outbound | — | S3 and DynamoDB only. Free. Route table entry. |
| VPC Endpoint (Interface) | Outbound | — | All other AWS services via PrivateLink. ENI in subnet. Paid. |
| Direct Connect | Both | — | Dedicated private connection to AWS. Consistent bandwidth, lower latency than VPN. |
| Site-to-Site VPN | Both | — | IPSec tunnel over internet. Quick to set up. Variable latency. |
Subnet & Routing Fundamentals
Core conceptsPublic subnet — has a route to an IGW. Instances need a
public/Elastic IP to be reachable from internet.
Private subnet — no route to IGW. Use NAT Gateway for outbound
internet access.
Route table — each subnet associates with one route table. Most
specific route wins.
Bastion host — EC2 in public subnet used to SSH into private subnet
instances. Also called jump server.
AWS reserves 5 IPs in each subnet (first 4 + last 1). A /28 gives only 11 usable IPs.
NAT Gateway vs NAT Instance
Private → internetNAT Gateway — AWS managed. Highly available within AZ. Scales
automatically. No security groups. Per-AZ: deploy one per AZ for HA.
NAT Instance — EC2 with NAT AMI. You manage patching/scaling. Can
use as bastion. Must disable Source/Dest check. Cheaper for low traffic.
NAT Gateway is per-AZ. For HA, create one in each AZ with separate route tables per
AZ.
VPC Flow Logs
Network visibilityCapture IP traffic metadata for VPC, subnet, or ENI. Does NOT capture payload
content.
Destination: CloudWatch Logs or S3. Query with Athena (S3) or CloudWatch Insights.
Fields include: srcaddr, dstaddr, srcport, dstport, protocol, bytes, action
(ACCEPT/REJECT).
Not real-time — slight delay. Does not capture DNS queries to Route 53 resolver,
DHCP, metadata service traffic.
🎯 Exam Traps & Typical Scenarios
Exam Traps
NACL is stateless: you need both inbound AND outbound rules. Security Groups are stateful: return traffic is allowed automatically.
VPC Peering is non-transitive. A↔B and B↔C does not mean A can reach C. Use Transit Gateway for many-to-many VPC connectivity.
IGW (Internet Gateway) is bidirectional (public subnets). NAT Gateway is one-way: private subnets can initiate outbound connections, but the internet cannot initiate inbound connections.
NACL evaluates rules in ascending number order and stops at the first match. An explicit DENY with a low rule number blocks everything that follows.
VPC Gateway Endpoint: only supports S3 and DynamoDB. All other AWS services use Interface Endpoints (PrivateLink, with hourly cost).
Typical Scenarios
Q: Instances in a private subnet need to download updates from the internet. → NAT Gateway in a public subnet, add route 0.0.0.0/0 → NAT GW in the private route table.
Q: Block a specific IP at the VPC network level. → NACL with explicit DENY rule (Security Groups have no explicit deny).
Q: Lambda in a VPC needs S3 access without going through the internet. → Gateway VPC Endpoint for S3 (free, no NAT needed).
Q: Connect a VPC to on-prem with redundancy and higher throughput. → Direct Connect (dedicated) + Site-to-Site VPN as backup.
No results found.
💾
Databases
RDS for relational, Aurora for high-performance relational, DynamoDB for NoSQL key-value/document, ElastiCache for in-memory caching, Redshift for analytics.
⚠ Exam priority: Multi-AZ = high availability (sync replication,
auto-failover). Read Replicas = read scaling (async replication, manual promotion). Aurora is 5x
faster than MySQL, 3x faster than PostgreSQL, and cheaper per GB.
RDS: Multi-AZ vs Read Replicas
| Feature | Multi-AZ | Read Replica |
|---|---|---|
| Purpose | High Availability / DR | Read Scaling / Performance |
| Replication | Synchronous | Asynchronous |
| Standby readable? | No (not accessible) | Yes (separate endpoint) |
| Failover | Automatic (<60s DNS cutover) | Manual promotion to standalone |
| Cross-region | No (same region only) | Yes |
| Max replicas | 1 standby | Up to 15 (Aurora) / 5 (RDS) |
| Use for DR? | Yes — primary purpose | Cross-region only, must promote |
Aurora & DynamoDB
Aurora
AWS-optimized relational DBStorage — 6 copies across 3 AZs automatically. Auto-grows from 10 GB
to 128 TB. Striped across 100s of volumes.
Read Replicas — up to 15. Share same underlying storage volume — no
replication lag for reads.
Aurora Serverless v2 — auto-scales capacity in ACUs. Good for
variable/unpredictable workloads. No idle cost.
Aurora Global — 1 primary region + up to 5 secondary. Sub-second
replication lag. Promote secondary in <1 min for DR.
Backtrack — rewind the DB to any point in time without restoring a
snapshot (MySQL-compatible only).
DynamoDB
Serverless NoSQL key-valuePartition Key — uniquely identifies item (alone or + Sort Key).
Determines physical partition. Choose high-cardinality keys.
Sort Key — optional. Together with partition key forms composite PK.
Enables range queries.
LSI (Local Secondary Index) — same partition key, different sort
key. Created at table creation only. Max 5 per table.
GSI (Global Secondary Index) — different partition + sort key.
Created any time. Has own RCU/WCU. Eventually consistent only.
DAX — in-memory cache for DynamoDB. Sub-ms reads. API-compatible (no
code change). Reduces Read Capacity Units consumed.
On-demand mode = pay per request. Provisioned mode = set RCU/WCU with optional Auto
Scaling.
ElastiCache & Redshift
Cache & analyticsRedis — single-threaded. Supports replication, persistence
(AOF/RDB), pub/sub, sorted sets, Lua scripts. Multi-AZ with failover. Use for sessions, leaderboards,
real-time analytics.
Memcached — multi-threaded. Pure cache, no persistence, no
replication. Simple horizontal scaling. Use for simple caching only.
Redshift — columnar data warehouse. OLAP, not OLTP. SQL-based.
Redshift Spectrum queries S3 directly. AQUA = hardware-accelerated query layer.
Redshift = petabyte-scale analytics. Not for transactional workloads.
AWS DMS — Database Migration Service
Migrate databases to AWSHomogeneous migration — same engine (MySQL→MySQL, Postgres→Postgres). Direct DMS, no SCT needed.
Heterogeneous migration — different engines (Oracle→Aurora, SQL Server→MySQL). Requires SCT (Schema Conversion Tool) first to convert schema + stored procedures.
CDC (Change Data Capture) — continuous replication after initial bulk load. Source DB stays live. Use for near-zero-downtime cutover.
Sources: on-prem DBs, RDS, S3, Azure SQL, Salesforce. Targets: RDS, Aurora, DynamoDB, Redshift, S3, OpenSearch, Kafka, Kinesis.
SCT is needed when engines differ. For TB+ migrations with minimal downtime: DMS full-load + CDC.
🎯 Exam Traps & Typical Scenarios
Exam Traps
RDS Multi-AZ: the standby replicates synchronously but does NOT serve read traffic. It only activates on failover. To scale reads → Read Replica.
DynamoDB: eventually consistent read costs 0.5 RCU. Strongly consistent read costs 1 RCU. Default is eventually consistent.
DynamoDB GSI (Global Secondary Index) enables queries on non-primary-key attributes, but has its own throughput capacity and does not support strongly consistent reads.
ElastiCache Redis: persistence (AOF/RDB) + replication + pub/sub. Memcached: pure cache, no persistence, no replication. If HA for cache is required → Redis.
DMS + SCT: SCT is only needed when engines differ (Oracle→Aurora). For same-engine migrations (MySQL→MySQL), DMS alone is enough.
Typical Scenarios
Q: RDS fails — you need minimal downtime without changing the app. → RDS Multi-AZ (automatic failover ~60s, same endpoint).
Q: App with 90% reads — scale without code changes. → RDS Read Replica (update the read endpoint in the app configuration).
Q: Query DynamoDB by an attribute that is not the partition key. → GSI (Global Secondary Index).
Q: Migrate Oracle on-prem to Aurora PostgreSQL with minimal downtime. → SCT (convert the schema) + DMS full-load + CDC (replicate live changes).
Q: User session cache that survives server restarts. → ElastiCache Redis (with persistence enabled).
No results found.
⚖️
High Availability & Auto Scaling
Elastic Load Balancing distributes traffic. Auto Scaling Groups adjust capacity automatically. Together they form the backbone of resilient, cost-efficient architectures.
⚠ Exam priority: ALB = Layer 7 (HTTP/HTTPS), path/host routing, WebSocket. NLB =
Layer 4 (TCP/UDP), static IP, ultra-low latency, millions of req/sec. GWLB = Layer 3, for 3rd-party security
appliances.
Elastic Load Balancer Types
| Type | Layer | Protocols | Key features | Use case |
|---|---|---|---|---|
| ALB | L7 | HTTP, HTTPS, gRPC, WebSocket | Path/host/header routing, Lambda targets, Cognito auth, sticky sessions | Web apps, microservices, containers |
| NLB | L4 | TCP, UDP, TLS | Static IP per AZ, Elastic IP, preserve source IP, PrivateLink, ultra-low latency | Gaming, IoT, financial trading, VoIP |
| GWLB | L3 | IP (GENEVE 6081) | Transparent bump-in-the-wire, distributes to virtual appliances | Firewalls, IDS/IPS, deep packet inspection |
| CLB | L4/L7 | HTTP, HTTPS, TCP, SSL | Legacy — not recommended for new workloads | Older EC2-Classic apps only |
Auto Scaling Groups
ASG Core Concepts
Elasticity engineMin / Max / Desired — Min = floor, Max = ceiling, Desired = current
target. Always Min ≤ Desired ≤ Max.
Launch Template — modern way to define instance config. Supports
versioning, mixed instance types, Spot + On-Demand mix.
Health checks — EC2 health (default) or ELB health. ELB health is
more granular (app-layer).
Lifecycle hooks — pause instances during launch or terminate to run
custom actions (install software, drain connections).
Cooldown period — wait before evaluating another scale-out. Default
300 s. Prevents thrashing.
Scaling Policies
When and how much to scaleTarget Tracking — maintain a metric at a target value (e.g., CPU =
60%). Simplest and recommended. ASG auto-creates CloudWatch alarms.
Step Scaling — define capacity adjustments for metric ranges. E.g.,
CPU 60-80% → add 2, CPU >80% → add 4. More granular than simple.
Simple Scaling — single adjustment when alarm triggers. Waits for
cooldown before next action. Legacy; prefer Step or Target Tracking.
Scheduled Scaling — set desired capacity at a specific time. Use for
predictable load patterns (business hours, weekly reports).
Predictive Scaling — ML-based forecast from historical patterns.
Pre-scales before expected traffic.
ALB Advanced Features
Most common in exam scenariosPath-based routing —
/api/* → target group A,
/static/* → target group B.Host-based routing —
api.example.com → TG A,
www.example.com → TG B.Sticky sessions — bind client to same target using cookie.
ALB-generated or app-generated cookie.
Connection draining — wait for in-flight requests to complete before
deregistering an instance. Default 300 s.
Cross-zone LB — ALB: always ON (free). NLB/GWLB: optional (paid).
Distributes evenly across all registered targets in all AZs.
🎯 Exam Traps & Typical Scenarios
Exam Traps
ALB (layer 7, HTTP/HTTPS) vs NLB (layer 4, TCP/UDP): NLB has ultra-low latency and a static IP (Elastic IP). ALB has no fixed IP.
ASG Cooldown Period: after a scaling event, ASG waits N seconds before another. Prevents launching a new instance while the previous one is still stabilizing.
Connection Draining (Deregistration Delay): when an instance is removed from the Target Group, ALB waits up to N seconds for active connections to finish.
Target Tracking Scaling ≠ Scheduled Scaling: Target Tracking reacts to real-time metrics. Scheduled acts on predefined times (e.g., known traffic peaks).
Cross-Zone Load Balancing: ALB has it enabled by default (no extra cost). NLB has it disabled by default and charges for inter-AZ traffic if enabled.
Typical Scenarios
Q: Client needs a static IP for firewall whitelisting towards the load balancer. → NLB with Elastic IP.
Q: Scale EC2 based on SQS queue depth. → ASG + Custom CloudWatch metric (
ApproximateNumberOfMessagesVisible / number of instances) + Target Tracking.Q: Predictable traffic spikes every Monday at 9am. → ASG Scheduled Scaling to pre-warm capacity.
Q: Balance traffic across instances in 3 AZs with even distribution. → ALB with Cross-Zone Load Balancing enabled.
No results found.
⚡
Serverless & Event-Driven
No servers to manage. Pay per invocation/request. Lambda runs code, API Gateway exposes HTTP APIs, SQS decouples, SNS fans out, EventBridge routes events.
⚠ Exam priority: SQS = decouple components (pull model).
SNS = pub/sub fanout (push model). EventBridge = event routing from AWS
services. Step Functions = orchestrate multi-step workflows.
Lambda & API Gateway
Lambda Key Concepts
Serverless computeInvocation types: Synchronous (API GW, ALB, SDK — caller waits),
Asynchronous (S3, SNS — event queued, retried 2x), Event Source Mapping (SQS/DynamoDB Streams/Kinesis —
Lambda polls).
Concurrency — default 1000 per account per region. Reserved
concurrency = cap for one function. Provisioned concurrency = pre-warm to eliminate cold starts.
Timeout — max 15 minutes. Default 3 s. For long-running tasks, use
ECS Fargate or Step Functions instead.
Layers — shared code/dependencies. Up to 5 layers per function. Not
counted in deployment package size (250 MB).
VPC — Lambda can run inside a VPC (needs ENI, ~10 s cold start
penalty). Required to access RDS, ElastiCache. Uses NAT for internet access.
API Gateway
Managed HTTP APIREST API — full-featured. API keys, usage plans, caching,
request/response transformation, WAF integration. Higher latency than HTTP API.
HTTP API — lower cost (70% cheaper), lower latency. OIDC/OAuth 2.0
auth, Lambda/HTTP backends only. No usage plans or API keys.
WebSocket API — stateful, bi-directional. Chat, dashboards,
real-time notifications. Manages connections.
Stages — deployment snapshots. Can canary-test new versions with %
traffic split.
Throttling — default 10,000 req/s per account per region (burst
5,000). Configure per-stage or per-method limits.
Messaging: SQS vs SNS vs EventBridge
| Feature | SQS | SNS | EventBridge |
|---|---|---|---|
| Model | Queue (pull) | Topic (push) | Event bus (route) |
| Consumers | 1 consumer per message | Many subscribers simultaneously | Many targets via rules |
| Persistence | Up to 14 days | Not stored — fire and forget | Not stored |
| Ordering | FIFO (strict), Standard (best-effort) | FIFO topics available | No guarantee |
| Filtering | No | Message filter policy (per subscription) | Rich event pattern matching |
| AWS service events | No (must push to SQS) | Some services push to SNS | Native: 90+ AWS services |
| Use case | Decouple microservices, buffer spikes | Fan-out (1 message → many queues/emails/HTTP) | Event-driven architectures, SaaS events |
SQS Key Settings
Know these numbersVisibility Timeout — time a message is invisible after being
received. Default 30 s, max 12 h. If not deleted within timeout → reappears. Set to > Lambda timeout.
Message Retention — 1 min to 14 days. Default 4 days.
Long Polling — waits up to 20 s for a message. Reduces API calls and
cost vs short polling.
Dead Letter Queue (DLQ) — messages that fail maxReceiveCount times
are moved here. Use for debugging. DLQ must be same type (Standard/FIFO) as source.
FIFO — exactly-once processing, strict ordering. Max 300 TPS (3000
with batching). Message Group ID for parallel processing within order.
Step Functions
Orchestrate workflowsStandard Workflows — max 1 year. Exactly-once execution. Auditable
via execution history. Pay per state transition. Use for long-running business processes.
Express Workflows — max 5 min. At-least-once. High-volume,
short-duration. Pay per execution duration. Use for high-frequency IoT, streaming processing.
States: Task (call Lambda/service), Choice (branch), Wait (pause),
Parallel (concurrent branches), Map (iterate array), Pass (no-op), Succeed, Fail.
Better than Lambda chaining: visual workflow, error handling, retry logic, no code
for orchestration.
Auth & Legacy Messaging
Amazon Cognito
Auth for web & mobile appsUser Pools — user directory. Sign-up/sign-in, password reset, MFA. Returns JWT tokens. Social federation (Google, Facebook, SAML/OIDC). Lambda triggers for custom flows (pre-signup, post-auth, etc.).
Identity Pools (Federated Identities) — exchange any identity token (User Pool JWT, Google, SAML…) for temporary AWS credentials via STS. Grants direct AWS resource access from client apps.
User Pool (authenticate) → Identity Pool (AWS credentials)
User Pool alone = JWT for your own API. Identity Pool = AWS access for any identity. Together = most common mobile/web app pattern.
Amazon MQ
Managed broker for migrations onlyManaged Apache ActiveMQ and RabbitMQ. For on-prem apps that use JMS, AMQP, STOMP, MQTT, OpenWire — lift-and-shift without code changes.
Runs on dedicated broker instances. Active/standby HA pair. Does NOT auto-scale infinitely like SQS.
New applications → use SQS/SNS instead. Amazon MQ is only justified when migrating an existing app already coupled to these protocols.
🎯 Exam Traps & Typical Scenarios
Exam Traps
API Gateway timeout: maximum 29 seconds (not Lambda's 15 min). If Lambda takes longer than 29s → 504 error from API Gateway.
SQS Standard = at-least-once delivery (possible duplicates, no ordering). FIFO = exactly-once with ordering, but limited to 300 TPS (3,000 with batching).
Cognito User Pool = authentication (login, JWT tokens). Cognito Identity Pool = authorization (temporary AWS credentials via STS). These are different concepts.
Lambda: by default it is outside any VPC. To access private RDS, Lambda must be placed inside the VPC (VPC config, ENI, and Security Groups required).
EventBridge vs SNS: EventBridge filters and routes events with complex rules (schema, content-based filtering). SNS is simple fan-out pub/sub. They are not interchangeable.
Typical Scenarios
Q: Mobile app logs in with Google then needs to upload to S3 with its own AWS credentials. → Cognito User Pool (federated login) + Identity Pool (temporary AWS credentials).
Q: Process messages in strict order with no duplicates. → SQS FIFO.
Q: Lambda needs to access RDS in a private subnet. → Lambda inside VPC with the same SG or an SG allowing ingress from Lambda's SG.
Q: Decouple producer/consumer and ensure each message is processed at least once even if the consumer fails. → SQS Standard + DLQ.
Q: Orchestrate multiple Lambdas with conditional logic and retries. → Step Functions.
No results found.
🛡️
Security Services
Encryption, secrets management, threat detection, vulnerability assessment, and DDoS protection. Defence in depth across all layers.
⚠ Exam priority: GuardDuty = detects threats (ML on logs).
Inspector = scans vulnerabilities (EC2/Lambda/ECR). Macie = finds PII in S3.
Secrets Manager = rotation. SSM Parameter Store = config/non-rotating secrets.
Encryption & Secrets
KMS — Key Management Service
Managed encryption keysAWS Managed Key — auto-created per service (aws/s3, aws/ebs…). Free,
3-yr auto-rotation. Cannot change rotation.
Customer Managed Key (CMK) — you create/control. Annual
auto-rotation optional. Can define key policy. Can be multi-region.
Envelope Encryption — KMS generates a Data Encryption Key (DEK). DEK
encrypts data. Encrypted DEK stored alongside data. KMS only decrypts the DEK, never sees the data.
Key Policy — resource-based policy on the key. Must grant root
account access or key becomes unmanageable.
Grants — delegated subset of key permissions to AWS services (e.g.,
EBS, RDS) without modifying key policy.
Secrets Manager vs SSM Parameter Store
Choosing the right serviceSecrets Manager — automatic rotation (native for RDS, Redshift,
DocumentDB). Cross-account. Per-secret cost. Use for DB passwords, API keys needing rotation.
SSM Parameter Store — Standard tier free (4 KB, 10,000 params).
Advanced tier paid. SecureString = KMS-encrypted. No native rotation. Use for config, feature flags,
non-rotating secrets.
Secrets Manager can trigger a Lambda for custom rotation of any secret type, not just
database credentials.
Threat Detection & WAF
| Service | What it does | Data sources | Key point |
|---|---|---|---|
| GuardDuty | ML-based threat detection | CloudTrail, VPC Flow Logs, DNS logs, EKS audit | No agents. Detects: compromised instances, crypto mining, unusual API calls, port scanning. |
| Inspector | Vulnerability assessment | EC2 (SSM agent), ECR images, Lambda functions | Automated scanning. CVE findings. Severity scores. Continuous or on-demand. |
| Macie | Sensitive data discovery | S3 buckets | Uses ML to find PII, credentials, financial data in S3. Alerts on unencrypted/public buckets. |
| Detective | Security investigation | CloudTrail, VPC Flow Logs, GuardDuty findings | Root cause analysis. Graph model of resource behavior. After GuardDuty finds a threat. |
| Security Hub | Centralized security posture | GuardDuty, Inspector, Macie, IAM Access Analyzer… | Single pane of glass. Automated compliance checks (CIS, PCI-DSS). Prioritized findings. |
| WAF | Web Application Firewall | ALB, API Gateway, CloudFront, AppSync | Rules for SQL injection, XSS, IP blocks, rate limiting. Web ACLs with rule groups. |
| Shield Standard | DDoS protection | All AWS services | Free, automatic for all customers. L3/L4 attacks. |
| Shield Advanced | Enhanced DDoS protection | EC2, ELB, CloudFront, Route 53, Global Accelerator | Paid ($3,000/mo). 24/7 DRT team, cost protection, L7 DDoS with WAF. |
🎯 Exam Traps & Typical Scenarios
Exam Traps
WAF only works on ALB, API Gateway, CloudFront, and AppSync. NOT directly on EC2.
GuardDuty ≠ Macie ≠ Inspector: GuardDuty = threat detection (CloudTrail, VPC Flow Logs, DNS). Macie = PII in S3. Inspector = vulnerabilities in EC2/containers. Don't mix them up.
Shield Standard = free and automatic for all AWS accounts. Shield Advanced = paid, with 24/7 DDoS support, SLAs, and advanced protection. Must be explicitly enabled.
Secrets Manager vs Parameter Store: Secrets Manager has built-in automatic rotation (integrated with RDS/Redshift). Parameter Store SecureString does not rotate automatically.
KMS CMK: the key policy defines who can use/manage the key. Even with an IAM Allow, without permissions in the key policy → access denied.
Typical Scenarios
Q: Detect exposed AWS credentials or personal data in an S3 bucket. → Amazon Macie.
Q: Suspicious account activity (unusual API calls, cryptominer IPs). → Amazon GuardDuty.
Q: Enforce SSE-S3 encryption on all objects uploaded to a bucket. → Bucket Policy with Condition:
s3:x-amz-server-side-encryption: AES256, or enable Default Encryption on the bucket.Q: RDS needs automatic password rotation every 30 days. → Secrets Manager (built-in automatic rotation integrated with RDS).
Q: Protect an API from SQL injection and XSS attacks. → WAF on API Gateway with AWS Managed Rules.
No results found.
📊
Monitoring, Audit & Compliance
CloudWatch for metrics and alarms, CloudTrail for API audit, Config for compliance, X-Ray for tracing, Trusted Advisor for best-practice checks.
⚠ Exam priority: CloudWatch = performance/metrics/alarms.
CloudTrail = "who did what" API audit log. Config = "is this resource
compliant?" configuration history. These are three separate, complementary services.
CloudWatch
Metrics & Alarms
Observe and reactStandard metrics — collected by AWS automatically: CPUUtilization,
NetworkIn/Out, Disk I/O. No agent needed.
Custom metrics — sent via PutMetricData API or CloudWatch Agent.
Required for: memory usage, disk space, swap (not provided by default for EC2).
Resolution — standard = 1 min. High-resolution = 1 s
(StorageResolution=1). More expensive.
Alarms — 3 states: OK, ALARM, INSUFFICIENT_DATA. Actions: Auto
Scaling, EC2 action (stop/reboot/terminate/recover), SNS. Period must be ≥ 10 s.
Composite Alarms — combine multiple alarms with AND/OR logic. Reduce
alarm noise.
CloudWatch Logs
Centralized log managementLog Group — collection of log streams with same retention policy.
Configure retention: 1 day to 10 years (default: never expire).
Log Stream — sequence of events from a single source (e.g., one
Lambda execution environment, one EC2 instance).
Metric Filters — extract custom metrics from log patterns. E.g.,
count ERROR occurrences and alarm on threshold.
Logs Insights — interactive query language. Query across log groups.
Use for ad-hoc analysis and troubleshooting.
Subscriptions — stream logs in real-time to Lambda, Kinesis,
OpenSearch for processing.
CloudTrail vs Config vs X-Ray
| Service | Question it answers | Key detail |
|---|---|---|
| CloudTrail | "Who called what API, when, from where?" | Enabled by default (90-day event history). Enable Trail for S3/CloudWatch Logs long-term storage. Management events (default) vs Data events (S3, Lambda — extra cost). Global services trail for IAM/STS/CloudFront. |
| AWS Config | "What is the configuration of this resource, and is it compliant?" | Records resource configuration changes over time. Config Rules evaluate compliance (managed or custom Lambda). Remediation actions (SSM Automation). Per-config-item cost. |
| X-Ray | "Where is the latency/error in my distributed application?" | Distributed tracing. Service map. Trace = collection of segments. Annotations (indexed, filterable) vs Metadata (not indexed). SDK in Lambda/EC2/ECS. Sampling to control cost. |
| Trusted Advisor | "Am I following AWS best practices?" | Checks: Cost Optimization, Performance, Security, Fault Tolerance, Service Limits. 6 free security checks for all. Full checks require Business/Enterprise Support. |
| EventBridge | "React to state changes in real time" | CloudWatch Events is now EventBridge. Default bus (AWS services), custom bus (your apps), partner bus (SaaS). Rules with patterns or schedules. 90+ AWS service sources. |
🎯 Exam Traps & Typical Scenarios
Exam Traps
CloudWatch Metrics: Basic monitoring = every 5 min. Detailed monitoring = every 1 min (extra cost on EC2). Custom metrics can be every 1s (High Resolution).
CloudTrail: captures only Management Events by default. Data Events (S3 object operations, Lambda invocations) must be explicitly enabled.
CloudWatch Logs Insights ≠ CloudWatch Logs: Insights is the interactive query engine over logs. The logs themselves are stored in Log Groups.
CloudWatch Alarms cannot trigger actions in INSUFFICIENT_DATA state. Actions only fire in ALARM or OK states.
X-Ray vs CloudWatch: X-Ray = distributed tracing (latency, service dependencies). CloudWatch = metrics, logs, and alarms. They are complementary, not alternatives.
Typical Scenarios
Q: Alert when CPU > 80% for 5 consecutive minutes. → CloudWatch Alarm on
CPUUtilization metric, threshold 80, period 300s, 1 datapoint.Q: Audit who deleted an S3 bucket or changed a Security Group rule. → CloudTrail (Management Events, actions
DeleteBucket / AuthorizeSecurityGroupIngress).Q: Trace a request through API Gateway, Lambda, and DynamoDB to pinpoint latency. → AWS X-Ray.
Q: Automatically detect and notify when someone disables CloudTrail. → EventBridge rule on
StopLogging event → SNS → email.No results found.
🏗️
Architecture & Well-Architected Framework
The 6 pillars of Well-Architected, Disaster Recovery strategies, and common design patterns. These appear in every SAA-C03 scenario question.
⚠ Exam priority: Match DR strategy to RTO/RPO requirement AND budget. Lower
RTO/RPO = higher cost. Know the difference between RPO (data loss tolerance) and RTO (downtime tolerance).
Well-Architected Framework — 6 Pillars
Operational Excellence
Run and improve systemsPerform operations as code (IaC with CloudFormation/CDK). Make frequent, small,
reversible changes. Anticipate failure. Refine operations procedures.
→ CloudFormation, Systems Manager, Config, CloudWatch dashboards
Security
Protect systems and dataImplement a strong identity foundation (least privilege). Enable traceability. Apply
security at all layers. Automate security best practices. Protect data in transit and at rest.
→ IAM, KMS, CloudTrail, GuardDuty, WAF, Shield, VPC
Reliability
Recover from failuresAutomatically recover from failure. Test recovery procedures. Scale horizontally.
Stop guessing capacity. Manage change through automation.
→ Multi-AZ RDS, ASG, ALB, Route 53 health checks, S3 versioning, backups
Performance Efficiency
Use resources efficientlyUse the right resource types and sizes. Monitor performance. Maintain efficiency as
demand evolves. Use serverless architectures. Go global in minutes.
→ CloudFront, ElastiCache, Lambda, Aurora Serverless, placement groups
Cost Optimization
Eliminate unnecessary costAdopt a consumption model. Measure overall efficiency. Stop spending on
undifferentiated heavy lifting. Analyze and attribute expenditure. Use managed services to reduce TCO.
→ Spot instances, Reserved/Savings Plans, S3 lifecycle, right-sizing, Trusted
Advisor
Sustainability
Minimise environmental impactUnderstand your impact. Set sustainability goals. Maximise utilisation. Use managed
services. Reduce downstream impact. Use efficient hardware and software.
→ Graviton instances, Spot, serverless, right-sizing, S3 Intelligent-Tiering
Disaster Recovery Strategies
| Strategy | RTO | RPO | Cost | Description |
|---|---|---|---|---|
| Backup & Restore | Hours | Hours | Lowest | Back up data to S3/Glacier. Restore from scratch in DR. No running resources in DR region. Pay only for storage. |
| Pilot Light | 10s min | Minutes | Low | Core services (DB) always running in DR. Other services stopped. On failure: scale up and start stopped resources. Like a pilot light on a gas furnace. |
| Warm Standby | Minutes | Seconds | Medium | Scaled-down but fully functional copy running in DR. On failure: scale up to full production size. Faster than Pilot Light. |
| Multi-Site Active/Active | Near zero | Near zero | Highest | Full production in multiple regions simultaneously. Route 53 or Global Accelerator splits traffic. Instant failover. |
Common Architecture Patterns
3-Tier Web Architecture
Most common exam patternRoute 53 → CloudFront → ALB (public)
ALB → ASG EC2 (private subnet)
EC2 → RDS Multi-AZ (private subnet)
CloudFront caches static content. ALB distributes across AZs. EC2 in private subnets
(no direct internet). RDS Multi-AZ for HA. Bastion or SSM for EC2 access.
Decoupling Pattern
Absorb traffic spikesProducers → SQS Queue → Consumers (ASG)
SQS absorbs bursts. ASG scales consumers based on queue depth
(ApproximateNumberOfMessages). Producers and consumers scale independently.
→ Order processing, image resizing, email sending, any async task
Fanout Pattern
1 event → multiple consumersPublisher → SNS Topic → [SQS A, SQS B, Lambda, Email]
One SNS message fans out to multiple independent SQS queues. Each queue has its own
consumer. If one consumer fails, others are unaffected.
→ New order event: 1 queue for inventory, 1 for shipping, 1 for analytics
Caching Strategies
Reduce latency and DB loadCloudFront — CDN at edge. Cache static + dynamic content. Reduce
latency globally. Offload origin.
ElastiCache (Lazy Loading) — check cache first. On miss: query DB,
populate cache. Risk: stale data.
ElastiCache (Write-Through) — write to DB AND cache simultaneously.
No stale data. Write penalty. Wasted cache if data rarely read.
DAX — DynamoDB Accelerator. Sub-ms reads. Transparent — no code
change needed for reads.
Cost Management
Control and optimize AWS spendCost Explorer — visualize cost and usage over time. Filter by service, tag, account. Forecast future spend. Identify top cost drivers.
AWS Budgets — set threshold alerts (email/SNS) for cost, usage, or coverage. Can trigger actions: apply SCP, stop EC2/RDS instances.
Savings Plans — commit to $/hour for 1 or 3 years. Compute SP: any instance, region, OS, Fargate, Lambda. EC2 Instance SP: specific family+region, flexible size/OS.
Reserved Instances — Zonal RI: discount + capacity reservation in one AZ. Regional RI: discount only, no reservation. Convertible RI: can exchange for different type.
Spot Instances — up to 90% discount. 2-minute interruption notice. Spot Fleet: mixed Spot + On-Demand pool with target capacity. Best for fault-tolerant batch jobs.
Trusted Advisor — automated checks across cost, performance, security, fault tolerance, service limits. Full checks require Business/Enterprise support plan.
🎯 Exam Traps & Typical Scenarios
Exam Traps
RTO vs RPO: RTO = how long you can be without service (downtime). RPO = how much data you can afford to lose (backup frequency). Lower RTO/RPO = higher cost. Don't mix them up.
Pilot Light ≠ Warm Standby: Pilot Light = only the DB is replicated, rest of infra is off (scales up for DR). Warm Standby = reduced-scale version already running (scales quickly for DR).
Multi-AZ ≠ Multi-Region: Multi-AZ = HA within a single region. Multi-Region = global DR. Multi-AZ does NOT protect against a region-wide outage.
Savings Plans are more flexible than Reserved Instances: Compute SP applies to any instance family, region, OS, Fargate, and Lambda. RI is tied to a specific instance family/region.
SQS as a buffer between tiers: if the consumer fails, messages stay in the queue (up to 14 days). The producer is completely unaffected by consumer failures.
Typical Scenarios
Q: App with RTO of 15 min and RPO of 1 hour, low DR cost. → Pilot Light strategy (cross-region RDS replica, EC2 AMI ready to launch).
Q: Decouple frontend from backend so traffic spikes don't crash the backend. → SQS between tiers (frontend produces messages, backend consumes at its own pace).
Q: Reduce latency for global users serving static content. → CloudFront + S3 as origin.
Q: Company with 50 AWS accounts needs to centralize security policies. → AWS Organizations + SCPs.
No results found.
📦
Containers — ECS, EKS, ECR & Fargate
ECS = AWS-native container orchestration. EKS = managed Kubernetes. ECR = private container registry. Fargate = serverless compute engine for containers (works with both ECS and EKS).
⚠ Exam priority: ECS Fargate = no EC2 to manage, pay per task CPU/memory. ECS EC2 = you control the instances, cheaper at scale. EKS = when Kubernetes portability or existing K8s workloads are required.
ECS Core Concepts
ECS Building Blocks
Know each componentTask Definition — blueprint (like docker-compose). Defines: container image, CPU/memory, port mappings, env vars, IAM Task Role, log driver, volumes. Versioned.
Task — running instance of a Task Definition. Ephemeral. 1 or more containers running together.
Service — maintains a desired number of running tasks. Replaces failed tasks. Integrates with ALB/NLB for load balancing. Supports rolling updates and blue/green deploys (via CodeDeploy).
Cluster — logical grouping of tasks/services. Can mix EC2 and Fargate capacity providers.
IAM Task Role = permissions for the container app (e.g., S3 access). IAM Task Execution Role = permissions for ECS agent (pull from ECR, write to CloudWatch Logs).
ECS Service Auto Scaling
Scale tasks, not instancesTarget Tracking — maintain a metric (ECSServiceAverageCPUUtilization, ALBRequestCountPerTarget, memory). Recommended.
Step Scaling — scale by defined increments based on CloudWatch alarm thresholds.
Scheduled Scaling — scale at a specific time (predictable load).
With EC2 launch type: also need to scale the underlying EC2 instances via ASG + ECS Cluster Auto Scaling (Capacity Provider). With Fargate: scaling is instant — no EC2 to provision.
ECR — Elastic Container Registry
Container image storagePrivate registry — per account/region. IAM-controlled access. Integrated with ECS, EKS, CodePipeline.
Image scanning — Basic (on push, OS CVEs) or Enhanced (via Inspector — runtime, packages, programming language libs).
Lifecycle policies — automatically delete untagged or old images to control storage cost.
Cross-region/cross-account replication — replicate images to other regions for DR or lower pull latency.
Public ECR (gallery.ecr.aws) for public images. Private ECR for your own images.
Launch Type & Orchestrator Comparison
| Feature | ECS — EC2 Launch Type | ECS — Fargate | EKS |
|---|---|---|---|
| Manage EC2 instances | Yes — you patch/scale | No — serverless | Yes (managed node groups) or No (Fargate profile) |
| Orchestrator | ECS (AWS native) | ECS (AWS native) | Kubernetes (portable) |
| Pricing model | Pay per EC2 instance | Pay per task vCPU + memory per second | Pay per EC2 or Fargate + $0.10/hr cluster |
| Cost at scale | Cheaper (pack tasks on instances) | More expensive (each task isolated) | Similar to ECS EC2 |
| K8s ecosystem / portability | No | No | Yes — Helm, operators, existing K8s workloads |
| Complexity | Medium | Low (no infra to manage) | High |
| Best for | Cost-optimised, long-running workloads | Variable workloads, simplicity, microservices | Existing K8s apps, large teams, multi-cloud |
🎯 Exam Traps & Typical Scenarios
Exam Traps
Task Role vs Execution Role: Task Role = app permissions (access DynamoDB/S3). Execution Role = ECS permissions to manage the container (pull from ECR, write CloudWatch logs). These are two separate roles.
ECS Task Definition ≠ Task ≠ Service: Task Definition = blueprint/template. Task = running instance (ephemeral). Service = keeps N tasks running and replaces failed ones.
Fargate vs EC2 launch type: Fargate = no EC2 to manage (serverless). EC2 = you control cluster instances (cheaper at scale, more operational responsibility).
EKS ≠ ECS: EKS is pure Kubernetes (portability, on-prem K8s migration). ECS is AWS-proprietary (simpler, lower operational overhead).
ECR = private registry (within AWS). ECR Public Gallery = public images. If the question asks about access control for container images → private ECR.
Typical Scenarios
Q: Migrate a Kubernetes app from on-prem to AWS without rewriting YAML manifests. → EKS.
Q: Run containers without managing servers, scale to 0 when idle. → ECS Fargate (or Lambda if the workload is event-driven and short-lived).
Q: Container needs to read from DynamoDB — how to avoid hardcoded credentials? → ECS Task Role (IAM role assigned to the Task Definition).
Q: Store private Docker images and automatically scan them for vulnerabilities. → Amazon ECR with Image Scanning enabled.
No results found.
🔀
Networking & Streaming — Route 53, CloudFront, Kinesis
Route 53 for DNS and traffic routing, CloudFront for global CDN, Global Accelerator for TCP/UDP acceleration, Kinesis for real-time data streaming pipelines.
⚠ Exam priority: Route 53 routing policies appear in almost every exam. CloudFront vs Global Accelerator is a classic differentiation question. Kinesis Streams = real-time processing (you manage). Kinesis Firehose = near-real-time load to destinations (fully managed).
Route 53 — Routing Policies
| Policy | How it works | Health checks | Use case |
|---|---|---|---|
| Simple | Returns single record (or multiple IPs — client picks randomly) | No | Single resource, no routing logic needed |
| Weighted | Distributes traffic by weight (0–255). Weight 0 = stop sending traffic | Optional | A/B testing, gradual blue/green migration |
| Latency | Routes to AWS region with lowest measured latency for the user | Optional | Multi-region apps optimising user experience |
| Failover | Active-passive. Primary receives traffic; secondary only if primary fails health check | Required (primary) | DR active-passive setup |
| Geolocation | Routes based on user's country/continent. Default record for unmatched locations | Optional | Content localisation, compliance (GDPR data residency) |
| Geoproximity | Routes based on geographic distance + optional bias (+/- shift traffic). Requires Traffic Flow | Optional | Fine-grained geographic traffic shifting |
| Multivalue Answer | Returns up to 8 healthy records. Client chooses. NOT a substitute for a load balancer | Yes | Simple client-side load balancing with health awareness |
| IP-based | Routes based on client IP CIDR blocks you define | Optional | ISP-specific routing, cost optimisation |
Route 53 Health Checks
Required for failover routingEndpoint health check — HTTP/HTTPS/TCP to a public IP or domain. Checks from 15 global checkers. Healthy if ≥ 18% report healthy.
Calculated health check — combines multiple child health checks (AND/OR logic). Parent is healthy if N of M children are healthy.
CloudWatch Alarm health check — monitors a CW alarm state. Use for private resources (can't be reached by R53 checkers directly).
Health checks cannot directly monitor private VPC resources — use a CloudWatch Alarm health check as a bridge.
CloudFront
Global CDN — HTTP/HTTPS onlyOrigins — S3 bucket, ALB, EC2, API Gateway, any HTTP server. Multiple origins per distribution via cache behaviors (path patterns).
OAC (Origin Access Control) — restricts S3 bucket to accept requests only from CloudFront. Use instead of legacy OAI. Bucket policy must allow CloudFront service principal.
Signed URLs / Cookies — Signed URL = access to 1 file. Signed Cookie = access to multiple files. Use when content is private (e.g., paid video).
Lambda@Edge — run Lambda at CloudFront edge locations. Modify request/response (viewer request, origin request, origin response, viewer response). Deploy from us-east-1.
CloudFront Functions — sub-ms JS functions at edge. Viewer request/response only. Cheaper and faster than Lambda@Edge for simple rewrites/redirects.
Geo Restriction — whitelist or blacklist countries. Uses 3rd-party GeoIP database.
Global Accelerator vs CloudFront
| Feature | CloudFront | Global Accelerator |
|---|---|---|
| Protocols | HTTP / HTTPS | TCP, UDP, HTTP/S — any protocol |
| Caching | Yes — caches content at edge | No — proxies traffic, no caching |
| Static IPs | No (domain-based) | 2 static Anycast IPs globally |
| Use case | CDN, static/dynamic web content, API acceleration | Gaming, IoT, VoIP, non-HTTP, IP whitelisting requirements |
| Failover speed | Seconds (DNS-based) | <30 s (Anycast, no DNS) |
| DDoS protection | Shield Standard + WAF | Shield Standard included |
Kinesis — Real-Time Data Streaming
| Feature | Data Streams | Data Firehose | Data Analytics |
|---|---|---|---|
| Management | You manage shards | Fully managed, auto-scale | Fully managed |
| Latency | Real-time (~200 ms) | Near real-time (60 s min buffer) | Real-time SQL |
| Consumers | Multiple custom consumers (Lambda, KCL, Flink) | S3, Redshift, OpenSearch, Splunk, HTTP endpoint | S3, Redshift, Streams |
| Data retention | 1 day (default) – 365 days | No retention — deliver only | No retention |
| Replay | Yes — reprocess from any point | No | No |
| Transformation | Custom in consumer code | Lambda transformation built-in | SQL / Apache Flink |
| Throughput unit | Shard (1 MB/s in, 2 MB/s out) | Automatic | KPU (Kinesis Processing Unit) |
| Use case | Click streams, log ingestion, real-time analytics with custom processing | ETL to data lake/warehouse — S3 or Redshift | Real-time metrics, anomaly detection, SQL on streams |
🎯 Exam Traps & Typical Scenarios
Exam Traps
Route 53 Alias can point to a root domain (
example.com). CNAME cannot point to the root (subdomains only). Alias records to AWS resources are free.Global Accelerator vs CloudFront: GA = network-layer routing (Layer 3/4, TCP/UDP), static IP, no caching. CloudFront = CDN (Layer 7), caches HTTP/S content, no fixed IP.
Kinesis Data Streams vs Firehose: KDS has retention (1–365 days) and allows replay. Firehose = delivery-only to destinations (S3, Redshift…), no retention, no replay.
CloudFront OAC (Origin Access Control) is the modern replacement for OAI. Use OAC for new distributions. OAI is deprecated.
SQS FIFO: limited to 300 TPS (3,000 with high throughput mode + batching). If you need more → Kinesis Data Streams (scales with shards).
Typical Scenarios
Q: Gaming app needing static IPs for firewall whitelisting and low global latency. → Global Accelerator (2 anycast IPs, routes over AWS backbone).
Q: Global users need images and videos with low latency. → CloudFront with S3 as origin + OAC.
Q: Log ingestion at 50,000 events/second, with the ability to reprocess the last 7 days. → Kinesis Data Streams (configurable retention + replay).
Q: Route 10% of traffic to a new app version for testing. → Route 53 Weighted routing (or ALB Weighted Target Groups).
Q: Cache API responses at the CDN level to reduce origin load. → CloudFront in front of API Gateway with a configured TTL.
No results found.
🛠️
Analytics & IaC
Serverless analytics on S3 (Athena/Glue), infrastructure as code (CloudFormation), managed deployments (Elastic Beanstalk), operations automation (SSM), certificates (ACM/CloudHSM), backup, and big data (EMR).
⚠ Exam priority: Athena = SQL on S3 without loading data. Glue = ETL + Data Catalog. CloudFormation = IaC native. SSM Session Manager = no SSH/bastion needed. ACM = free SSL/TLS for AWS services.
Serverless Analytics
Amazon Athena
Serverless SQL on S3Query data directly in S3 using standard SQL. No infrastructure, no loading data. Pay per TB scanned.
Supports CSV, JSON, Parquet, ORC, Avro. Use Parquet/ORC + column pruning to minimize cost (columnar = scan less data).
Federated Query — query non-S3 sources (RDS, DynamoDB, CloudWatch) via Lambda data source connectors. Results stored in S3.
Best combo: S3 data lake + Glue Data Catalog + Athena SQL = serverless analytics pipeline.
AWS Glue
Serverless ETL & Data CatalogETL Jobs — serverless Spark-based transform jobs (Python/Scala). Schedule or trigger. Output to S3, Redshift, RDS.
Data Catalog — central metadata repository. Tables, schemas, partitions. Shared by Athena, EMR, Redshift Spectrum.
Crawlers — scan S3/databases, infer schema automatically, update Data Catalog. Run on schedule or on-demand.
Glue Studio — visual ETL builder. Glue DataBrew — visual data preparation (no-code cleaning/transformation).
Amazon EMR
Managed big data (Hadoop/Spark)Managed cluster platform: Hadoop, Spark, HBase, Hive, Flink, Presto. Master + Core + Task nodes.
Use Spot instances for Task nodes (can be interrupted). On-Demand for Master/Core. Store data in S3 (not HDFS) for durability.
vs Glue — EMR = full control over cluster, frameworks, configuration. Glue = fully managed, no cluster ops, simpler ETL.
Infrastructure as Code
AWS CloudFormation
IaC — define AWS resources as codeStack — collection of AWS resources managed as a unit. Create/update/delete together. Template (JSON/YAML) → Stack → Resources.
Change Sets — preview changes before applying. Shows what will be added/modified/deleted. No changes occur until you execute.
StackSets — deploy stacks across multiple accounts and regions from one template. Requires delegated admin or org trust.
Drift Detection — detect when actual resource config differs from the template. Does not auto-remediate.
cfn-init / cfn-signal — bootstrap EC2 instances (install packages, configure). Signal to CloudFormation when instance is ready (CreationPolicy).
On rollback: resources are deleted/restored to previous state. DeletionPolicy: Retain, Snapshot, Delete.
Elastic Beanstalk
PaaS — deploy code, AWS manages infraUpload code (ZIP/WAR). Beanstalk handles EC2, ALB, Auto Scaling, RDS, CloudWatch. You still own all resources.
Web Tier — handles HTTP requests (ALB + EC2). Worker Tier — processes background jobs from SQS queue. Decouple with SQS between them.
Deployment Modes: All at once (fast, downtime), Rolling (batches, reduced capacity), Rolling with extra batch (no capacity loss), Immutable (new ASG, safest), Blue/Green (swap environments), Traffic splitting (canary).
Supports: Node.js, Python, Java, .NET, Ruby, Go, Docker (single/multi-container).
Immutable = safest for prod (new instances). Blue/Green = zero downtime with DNS swap (Route 53 weighted routing).
Operations & Automation
AWS Systems Manager (SSM)
Manage EC2 and on-prem at scaleSession Manager — browser/CLI shell to EC2 with no SSH, no key pairs, no open ports (port 22 closed). Audit sessions in CloudTrail/S3. Replaces bastion hosts.
Run Command — execute scripts/commands on multiple instances at once. No SSH needed. Logs output to S3/CloudWatch.
Patch Manager — auto-scan and patch instances on a schedule (Maintenance Windows). Define Patch Baselines per OS.
Automation — runbooks for common tasks (AMI creation, instance restart, RDS snapshot). Can be triggered by Events, scheduled, or manual.
Parameter Store — hierarchical key-value store for config and secrets. Standard (free) vs Advanced (larger values, TTL). Integrates with KMS for SecureString.
Inventory — collect metadata about instances (installed software, network config, running services). State Manager — ensure instances remain in a defined state.
AWS Backup
Centralized backup across servicesCentrally manage backups for EC2, EBS, RDS, Aurora, DynamoDB, EFS, FSx, S3, Storage Gateway from a single place.
Backup Plan — schedule + retention + lifecycle (warm → cold storage). Backup Vault — encrypted repository for recovery points. Vault Lock (WORM) prevents deletion.
Cross-account / cross-region — copy recovery points to another account or region for DR. Requires Backup Vault in destination.
Vault Lock + cross-account copy = ransomware-resistant backup strategy.
Certificates & Encryption Hardware
ACM — AWS Certificate Manager
Free SSL/TLS for AWS servicesIssue and auto-renew free public SSL/TLS certificates. Use with ALB, CloudFront, API Gateway, AppSync. Cannot export private key — tied to AWS services.
Domain validation: DNS (CNAME record) or email. DNS preferred — automatic renewal. Wildcard certs (*.domain.com) supported.
ACM Private CA — issue private certs for internal services (mTLS, internal APIs). Billable. Can export private keys.
ACM = public certs for AWS endpoints (free, no ops). Private CA = internal PKI for services not accessible via public internet.
CloudHSM
Dedicated Hardware Security ModuleDedicated FIPS 140-2 Level 3 validated hardware inside your VPC. AWS cannot access keys. You own and manage the HSM.
vs KMS — KMS = AWS manages HSM, shared hardware, FIPS 140-2 L2, simpler ops. CloudHSM = you manage the hardware, full control, required for Level 3 compliance or when AWS must have no key access.
Use cases: strict regulatory compliance (banking, government), customer-managed encryption for Oracle TDE, SSL/TLS offload with your own keys.
CloudHSM is expensive and operationally complex. Only choose it when KMS doesn't meet compliance requirements.
🎯 Exam Traps & Typical Scenarios
Exam Traps
Athena charges per TB scanned. Using Parquet/ORC + partitioning can cut costs by 90%. Never scan full CSV files when you can avoid it.
CloudFormation: if a stack update fails → automatic rollback. Use
DeletionPolicy: Retain or Snapshot on critical resources (RDS, S3) to protect them from rollback or stack deletion.Elastic Beanstalk Immutable = safest but creates new instances (temporarily more expensive). All-at-once = fastest but causes downtime. Blue/Green = zero downtime via DNS swap.
SSM Session Manager requires no open port 22 and no key pair. When an exam question asks how to connect to EC2 without opening ports → Session Manager.
ACM cannot export the private key of public certificates. These certs can only be used with AWS services (ALB, CloudFront, API Gateway). To export private keys → ACM Private CA.
Typical Scenarios
Q: Query ALB logs stored in S3 using SQL without loading them into a database. → Amazon Athena.
Q: Transform S3 data (CSV) to Parquet format and load into Redshift. → AWS Glue ETL Job.
Q: CloudFormation stack has an RDS instance you don't want deleted on stack deletion. → DeletionPolicy: Retain on the RDS resource.
Q: Connect to an instance in a private subnet without opening SSH or using a bastion host. → SSM Session Manager.
Q: Need FIPS 140-2 Level 3 key encryption where AWS has zero access to the keys. → CloudHSM (not KMS, which is Level 2).
No results found.