Chayan Samanta

Posted on Jul 28 Edited on Sep 6

AWS Cheatsheet

#architecture #aws #cloud

AWS SAA-C03 — DECISION MASTER GUIDE

One guide for understanding, choosing, eliminating, and spotting traps

Core mindset

QUESTION → REAL PROBLEM → HARD REQUIREMENT → CONSTRAINT → PATTERN → SERVICE → WHY → WHY NOT OTHERS → TRAP

Do not memorize AWS as service → definition. Learn the boundary between competing answers.

1. THE 30-SECOND EXAM DECISION ENGINE

The 8 questions

When you see a question, ask these in order:

What problem am I solving?
- HA? read scaling? write scaling? latency? security? DR? cost? migration?
What is the HARD requirement?
- Region failure?
- exactly-once/order?
- >15 minutes?
- no internet?
- customer-controlled keys?
- Windows shared filesystem?
- near-zero RTO?
What is the workload shape?
- synchronous vs asynchronous
- read-heavy vs write-heavy
- stateful vs stateless
- predictable vs unpredictable
- regional vs global
What is the data type?
- object / block / shared file
- relational / NoSQL / cache / warehouse
What is the security question actually asking?
- authentication vs authorization
- at rest vs in transit
- identity policy vs organization guardrail
- secret vs configuration
What is the networking requirement?
- internet outbound?
- private AWS service access?
- private service-to-service?
- dedicated connectivity?
- global HTTP content?
- global TCP/UDP?
What options are impossible?
Eliminate first. Do not compare four plausible answers equally.
Only now: among survivors, prefer:
- simpler
- managed
- lower operational overhead
- cost appropriate to workload

Priority order

HARD SECURITY/COMPLIANCE
→ RTO/RPO/RELIABILITY
→ FUNCTIONAL REQUIREMENT
→ PERFORMANCE
→ SCALABILITY
→ OPERATIONS
→ COST

⚠️ EXCEPTION

This is a decision framework, not an absolute AWS law. If the question explicitly makes cost the primary objective and all functional/security requirements are satisfied, cost can decide the final two.

2. HARD REQUIREMENT VS SOFT PREFERENCE

HARD = if violated, eliminate immediately

Hard requirement	Think
>15 min compute	Lambda eliminated
Region failure	Multi-AZ alone eliminated
Exactly-once + ordering requirement	SQS Standard eliminated
No internet path	NAT alone eliminated
Private access to AWS service	VPC Endpoint
Windows shared filesystem	EFS eliminated → FSx Windows
Customer-controlled key policy	AWS-managed key may be insufficient
Near-zero RTO	Backup/Restore usually eliminated
Global low-latency relational reads	ordinary single-region RDS eliminated
Microsecond DynamoDB reads	normal DynamoDB alone may be insufficient → DAX
Continuous server replication	Snowball/DataSync eliminated → DRS
DB engine conversion	MGN eliminated → DMS + SCT

SOFT = tie breakers

lowest cost
least operational overhead
easiest implementation
minimal code
managed service
serverless

🚨 EXAM TRAP

"Lowest cost" does not beat a hard requirement.

Example:

Need near-zero RTO and lowest cost.

Do not jump to Backup/Restore just because it is cheapest. First satisfy RTO.

3. THE BIGGEST TRAP: KEYWORD ≠ ANSWER

Keyword	Possible answers	Ask this
Serverless	Lambda, Fargate, DynamoDB, Aurora Serverless, Athena, Step Functions	What workload?
Encryption	KMS, SSE-S3, client-side encryption, ACM/TLS, CloudHSM	What is being protected and who controls keys?
Scaling	ASG, SQS, caching, DynamoDB, Aurora Serverless, Lambda	What is actually overloaded?
Private	private subnet, NAT, VPC Endpoint, PrivateLink, VPN, DX	Private from whom/to what?
Authentication	Cognito, IAM, Identity Center, federation	Who is logging in?
Database performance	Multi-AZ, Read Replica, cache, DAX, Aurora, DynamoDB	Read, write, connection, latency, or failure?
Global	CloudFront, Global Accelerator, Route 53, Aurora Global DB, Global Tables	Content, IP traffic, DNS, or database?
Backup	AWS Backup, snapshots, DRS, S3 versioning	What is being recovered and how fast?

4. ⚔️ SERVICE BATTLES — THE HIGH-VALUE ONES

4.1 Multi-AZ vs Read Replica vs Aurora Global DB

Problem

Database is slow or must be highly available.

Ask

What exactly is needed?

Database requirement
        |
        +-- AZ failure + automatic failover?
        |       → Multi-AZ
        |
        +-- More READ capacity?
        |       → Read Replica
        |
        +-- Global relational reads / regional DR?
        |       → Aurora Global Database
        |
        +-- Multi-region active-active NoSQL?
                → DynamoDB Global Tables

Remember

Multi-AZ = HA/failover
Read Replica = read scaling
Aurora Global DB = global relational
Global Tables = global DynamoDB

🚨 TRAP: High availability + database does NOT automatically mean Multi-AZ. Read scaling may be the real problem.

⚠️ EXCEPTION: Aurora replicas can also serve reads and provide failover capability.

4.2 ElastiCache vs DAX vs RDS Proxy

Database problem
 |
 +-- Repeated application data/query reads?
 |       → ElastiCache
 |
 +-- DynamoDB + microsecond reads?
 |       → DAX
 |
 +-- Too many DB connections, especially Lambda?
         → RDS Proxy

🚨 TRAP: "Performance" does not automatically mean cache.

repeated reads → cache
connection exhaustion → RDS Proxy
DynamoDB-specific microsecond cache → DAX

4.3 SQS vs SNS vs EventBridge vs Step Functions vs Kinesis

Need messaging?
 |
 +-- One queue / buffering?
 |      → SQS
 |
 +-- Ordered + deduplication requirement?
 |      → SQS FIFO
 |
 +-- One event → many subscribers?
 |      → SNS
 |
 +-- Route events using rules between services/apps?
 |      → EventBridge
 |
 +-- Multi-step workflow / branching?
 |      → Step Functions
 |
 +-- Streaming data + replay / ordered shards?
        → Kinesis Streams

🚨 TRAP: "Event" does not automatically mean EventBridge.

4.4 Lambda vs Fargate vs ECS vs EKS vs EC2

Compute
 |
 +-- Function/event, short execution?
 |      → Lambda
 |
 +-- Container, no server management?
 |      → Fargate
 |
 +-- AWS-native container orchestration?
 |      → ECS
 |
 +-- Kubernetes required?
 |      → EKS
 |
 +-- Full OS / special control / legacy software?
        → EC2

🚨 TRAP: "Serverless" ≠ Lambda.

⚠️ EXCEPTION: Fargate is serverless compute for containers, but ECS/EKS are the orchestration layer.

4.5 CloudFront vs Global Accelerator vs Route 53

Global requirement
 |
 +-- Cache HTTP/HTTPS content?
 |      → CloudFront
 |
 +-- TCP/UDP + static Anycast IPs?
 |      → Global Accelerator
 |
 +-- DNS-based traffic routing?
        → Route 53

🚨 TRAP: "Global" ≠ CloudFront.

4.6 NAT Gateway vs VPC Endpoint

Private subnet needs access
 |
 +-- Public internet / external API / OS updates?
 |      → NAT Gateway
 |
 +-- S3 or DynamoDB privately?
 |      → Gateway Endpoint
 |
 +-- Other AWS services privately?
        → Interface Endpoint

🚨 TRAP: NAT is outbound internet, not private AWS-service connectivity.

4.7 Gateway Endpoint vs Interface Endpoint

Requirement	Answer
S3	Gateway Endpoint
DynamoDB	Gateway Endpoint
Secrets Manager	Interface Endpoint
SNS	Interface Endpoint
Lambda API	Interface Endpoint
Private access to most other AWS services	Interface Endpoint

🚨 TRAP: See "S3 + private" and stop. If the same scenario also needs Secrets Manager/SNS, you need interface endpoints too.

4.8 SG vs NACL vs WAF vs Network Firewall

Where is the threat/control?
 |
 +-- Instance ENI / stateful traffic?
 |      → Security Group
 |
 +-- Subnet / stateless allow-deny?
 |      → NACL
 |
 +-- HTTP/HTTPS web attack?
 |      → WAF
 |
 +-- VPC-level stateful network inspection?
        → Network Firewall

Memory:

SG = resource
NACL = subnet
WAF = web
Network Firewall = VPC network inspection

4.9 IAM Policy vs SCP vs Permissions Boundary

Access problem
 |
 +-- Give an identity permission?
 |      → IAM Policy
 |
 +-- Organization-wide maximum guardrail?
 |      → SCP
 |
 +-- Limit maximum permissions of ONE identity?
        → Permissions Boundary

🚨 TRAP: SCP does not grant permissions. It sets the maximum permissions available in an account/OU.

4.10 KMS vs ACM vs CloudHSM

Security requirement
 |
 +-- Encrypt AWS data / manage encryption keys?
 |      → KMS
 |
 +-- TLS certificate for HTTPS?
 |      → ACM
 |
 +-- Dedicated HSM / stronger hardware control?
        → CloudHSM

🚨 TRAP: HTTPS certificate ≠ KMS.

4.11 Cognito User Pool vs Identity Pool vs IAM

Identity question
 |
 +-- Application customer needs login?
 |      → Cognito User Pool
 |
 +-- Authenticated user needs temporary AWS credentials?
 |      → Cognito Identity Pool
 |
 +-- AWS workload/service needs permissions?
        → IAM Role

🚨 TRAP: Authentication and authorization are different problems.

4.12 CloudWatch vs CloudTrail vs Config vs X-Ray

Question	Answer
What is my CPU/metric/health?	CloudWatch
Who called an API?	CloudTrail
What changed / configuration compliance?	Config
Where is request latency through the app?	X-Ray

Memory:
Metrics = Watch
API audit = Trail
Configuration = Config
Request trace = X-Ray

4.13 DMS vs MGN vs DataSync vs Snowball

Migration
 |
 +-- Database?
 |    |
 |    +-- Same/different engine + ongoing replication?
 |           → DMS
 |           + SCT if schema conversion is needed
 |
 +-- Whole server?
 |      → MGN
 |
 +-- Files/data sync over network?
 |      → DataSync
 |
 +-- Huge offline data transfer?
        → Snowball

🚨 TRAP: Snowball is not continuous database replication.

5. DATABASE DECISION TREE

Need database
 |
 +-- Relational / SQL?
 |      |
 |      +-- Managed relational → RDS
 |      |
 |      +-- High-performance MySQL/PostgreSQL compatible → Aurora
 |      |
 |      +-- Unpredictable relational workload → Aurora Serverless v2
 |      |
 |      +-- Global low-latency relational reads → Aurora Global DB
 |      |
 |      +-- Read scaling → Read Replicas
 |      |
 |      +-- HA/failover → Multi-AZ
 |
 +-- NoSQL?
 |      |
 |      +-- Key-value / huge scale → DynamoDB
 |      +-- DynamoDB microsecond cache → DAX
 |
 +-- Graph → Neptune
 +-- Time-series → Timestream
 +-- Document/Mongo-compatible → DocumentDB
 +-- Immutable ledger → QLDB
 +-- Warehouse/BI → Redshift

Database slow? First ask:

READ, WRITE, CONNECTION, or LATENCY?

Symptom	Likely direction
Repeated hot reads	ElastiCache
DynamoDB microsecond reads	DAX
Read load on relational DB	Read Replica
Lambda connection explosion	RDS Proxy
AZ failure	Multi-AZ
Global relational users	Aurora Global DB
Huge NoSQL scale	DynamoDB
Complex SQL joins	RDS/Aurora

6. STORAGE DECISION TREE

Storage
 |
 +-- Object → S3
 |      +-- unknown access → Intelligent-Tiering
 |      +-- archive → Glacier classes
 |
 +-- Block → EBS
 |      +-- attached to one EC2 instance
 |
 +-- Shared Linux file → EFS
 |
 +-- Shared Windows file → FSx for Windows File Server
 |
 +-- HPC scratch / high throughput → FSx for Lustre
 |
 +-- NetApp ONTAP → FSx ONTAP
 |
 +-- On-prem apps + AWS storage → Storage Gateway
 |
 +-- Offline bulk transfer → Snow Family

🚨 TRAP: S3 is object storage, not NFS/block storage.

7. NETWORKING DECISION TREE

Connectivity
 |
 +-- Private subnet → need internet?
 |      → NAT Gateway
 |
 +-- Private AWS service?
 |      → VPC Endpoint
 |
 +-- Two VPCs?
 |      → Peering
 |
 +-- Many VPCs?
 |      → Transit Gateway
 |
 +-- Dedicated predictable private circuit?
 |      → Direct Connect
 |
 +-- Fast encrypted hybrid setup?
 |      → VPN
 |
 +-- Private service exposed to other VPCs/accounts?
 |      → PrivateLink
 |
 +-- Global HTTP content?
 |      → CloudFront
 |
 +-- Global TCP/UDP/static IP?
 |      → Global Accelerator

8. DISASTER RECOVERY — THINK RTO/RPO FIRST

How fast must I recover?
 |
 +-- Hours acceptable + cheapest
 |      → Backup & Restore
 |
 +-- Minutes / low-cost continuously prepared
 |      → Pilot Light
 |
 +-- Minutes + running scaled-down environment
 |      → Warm Standby
 |
 +-- Near-zero RTO / highest cost
 |      → Multi-Site Active/Active
 |
 +-- Continuous server replication
        → AWS Elastic Disaster Recovery (DRS)

The trap

🚨 "Disaster recovery" alone does not tell you the answer.

Ask:

RTO?
RPO?
Region failure?
cost priority?
continuous replication?

9. SECURITY DECISION TREE

Authentication vs Authorization

"Who are you?"
→ Authentication

"What can you do?"
→ Authorization

Customer login → Cognito User Pool
AWS credentials for app user → Cognito Identity Pool
AWS workload permissions → IAM Role
AWS workforce SSO → IAM Identity Center

Encryption

Data security
 |
 +-- In transit → TLS/HTTPS
 |
 +-- At rest → service encryption / KMS
 |
 +-- Customer controls encryption process/keys outside AWS
        → Client-side encryption / appropriate key architecture

🚨 TRAP: "Encryption" alone is not enough.

Existing unencrypted RDS

⚠️ EXCEPTION / TRAP
For an existing unencrypted RDS database, you cannot simply flip an encryption switch.

Pattern:
Snapshot → copy snapshot with encryption → restore encrypted DB → cut over

10. SECRETS MANAGER VS PARAMETER STORE

Requirement	Choose
DB credentials + native rotation	Secrets Manager
Automatic secret rotation	Secrets Manager
Cross-account secret sharing	Secrets Manager
Normal configuration values	Parameter Store
Cost-sensitive non-secret config	Parameter Store

🚨 TRAP: "rotate" strongly points to Secrets Manager in typical SAA questions, but custom rotation can be implemented with Lambda. Read the exact operational/cost requirement.

11. MESSAGING DECISION

Traffic spike

Traffic spike
 |
 +-- Can work be asynchronous?
 |      |
 |      +-- Yes → SQS
 |              |
 |              +-- ordering/deduplication → FIFO
 |              +-- duplicates acceptable → Standard
 |
 +-- One event to many subscribers?
 |      → SNS fan-out
 |
 +-- Event routing by rules?
 |      → EventBridge
 |
 +-- Multi-step workflow?
 |      → Step Functions
 |
 +-- Streaming + replay?
        → Kinesis Streams

Classic architecture

Producer
   ↓
  SQS
   ↓
Worker ASG / ECS / Lambda
   ↓
Database

Why:

absorbs bursts
decouples producer/consumer
lets workers scale from queue depth
prevents the DB from being hit by the entire burst at once

12. COMPUTE DECISION

Requirement	Direction
Full OS control	EC2
Event-driven short function	Lambda
Long-running container without server management	Fargate
ECS-native container orchestration	ECS
Kubernetes	EKS
Batch/parallel workload	AWS Batch
Fault-tolerant cheapest compute	Spot
Quick simple web deployment	Elastic Beanstalk
Simple small VPS	Lightsail

🚨 TRAP: Job >15 minutes does not automatically mean Fargate.

Ask:

batch?
parallel?
container?
fault-tolerant?
cost critical?
workflow?

13. 30 HIGH-VALUE ARCHITECTURE PATTERNS

1. Burst absorption

Producer → SQS → ASG workers → DB

2. Read cache

App → ElastiCache → RDS/Aurora

3. DynamoDB acceleration

App → DAX → DynamoDB

4. Lambda DB connections

Lambda → RDS Proxy → RDS

5. Serverless API

Client → API Gateway → Lambda → DynamoDB

6. Static website

Client → CloudFront → S3

7. Three-tier HA

CloudFront → ALB → ASG → RDS Multi-AZ

8. Global TCP/UDP

Client → Global Accelerator → regional endpoints

9. Global relational

Regions → Aurora Global Database

10. Global NoSQL

Regions → DynamoDB Global Tables

11. Private S3

Private EC2 → Gateway Endpoint → S3

12. Private AWS services

Private EC2 → Interface Endpoint → AWS service

13. Internet from private subnet

Private EC2 → NAT Gateway → IGW → Internet

14. Multi-VPC hub

VPCs → Transit Gateway

15. Hybrid quick setup

On-prem → VPN → VPC

16. Hybrid dedicated

On-prem → Direct Connect → AWS

17. Private SaaS/service

Consumer VPC → PrivateLink → Provider service

18. Multi-account guardrail

Organizations/OUs → SCP

19. Central security

Security Hub → central findings

20. Central web protection

Firewall Manager → centralized WAF/security policies

21. Web protection

Client → WAF → ALB/API/CloudFront

22. Threat detection

AWS resources → GuardDuty → findings

23. Forensic investigation

Security finding → Detective

24. Configuration compliance

Resources → Config → compliance rules

25. API audit

AWS APIs → CloudTrail → logs

26. App tracing

Client → service A → service B → X-Ray

27. DB migration

Source DB → DMS → Target DB

28. Server migration

Source servers → MGN → EC2

29. Offline bulk migration

On-prem → Snowball → S3

30. Continuous DR

Primary servers → DRS replication → recovery Region

14. 50 DECISION RULES TO MEMORIZE

Failover ≠ read scaling.
Multi-AZ solves HA; Read Replica solves reads.
Region failure requires multi-region design.
Global relational → Aurora Global DB.
Global DynamoDB → Global Tables.
Repeated reads → cache.
DynamoDB microsecond cache → DAX.
Connection exhaustion → RDS Proxy.
SQL joins → relational.
Huge key-value scale → DynamoDB.
Async burst → SQS.
Ordered queue → FIFO.
Fan-out → SNS.
Event routing → EventBridge.
Workflow → Step Functions.
Stream/replay → Kinesis Streams.
Function → Lambda.
Long-running container → Fargate/ECS depending on orchestration.
Kubernetes → EKS.
Batch/parallel → AWS Batch.
Interruptible + cheapest → Spot.
Full OS control → EC2.
Object → S3.
Block → EBS.
Shared Linux → EFS.
Shared Windows → FSx Windows.
HPC filesystem → FSx Lustre.
Private internet outbound → NAT.
Private S3/DynamoDB → Gateway Endpoint.
Private other AWS services → Interface Endpoint.
Two VPCs → Peering.
Many VPCs → Transit Gateway.
Dedicated private connectivity → Direct Connect.
Fast encrypted hybrid → VPN.
Private service publishing → PrivateLink.
HTTP/HTTPS caching → CloudFront.
TCP/UDP/static Anycast IP → Global Accelerator.
DNS routing → Route 53.
Resource-level stateful firewall → SG.
Subnet-level stateless filter → NACL.
Web attacks → WAF.
VPC network inspection → Network Firewall.
Identity permissions → IAM Policy.
Org guardrail → SCP.
Identity maximum boundary → Permissions Boundary.
Customer login → Cognito User Pool.
AWS credentials for customers → Identity Pool.
AWS API audit → CloudTrail.
Metrics/alarms → CloudWatch.
Configuration/compliance → Config.

15. 50 SERVICE CONFUSIONS — ONE-LINE BOUNDARIES

Battle	Boundary
Multi-AZ vs Read Replica	failover vs read scaling
Read Replica vs Aurora Global DB	regional reads vs global relational
Aurora vs DynamoDB	relational SQL vs NoSQL
ElastiCache vs DAX	general cache vs DynamoDB cache
ElastiCache vs RDS Proxy	cached data vs DB connections
SQS vs SNS	queue vs fan-out
SQS vs EventBridge	queue/buffer vs event routing
SNS vs EventBridge	pub/sub fan-out vs rule-based event bus
SQS vs Step Functions	message buffering vs workflow
Kinesis vs SQS	streaming vs queue
Lambda vs Fargate	function vs container
ECS vs EKS	AWS container orchestration vs Kubernetes
Fargate vs EC2	serverless container compute vs VM control
Batch vs Fargate	batch scheduling vs generic containers
CloudFront vs GA	HTTP cache vs global network traffic
GA vs Route 53	Anycast IP traffic vs DNS
NAT vs Endpoint	internet egress vs private AWS access
Gateway vs Interface Endpoint	S3/DDB vs other services
Peering vs TGW	few VPCs vs many VPCs
VPN vs DX	quick encrypted tunnel vs dedicated circuit
SG vs NACL	ENI/resource vs subnet
WAF vs Shield	web attack filtering vs DDoS protection
WAF vs Network Firewall	HTTP layer vs network layer
IAM vs SCP	grant permission vs guardrail
IAM Policy vs Boundary	permission vs maximum permission
Cognito User Pool vs Identity Pool	login vs AWS credentials
IAM vs Identity Center	AWS resource permissions vs workforce SSO
KMS vs ACM	encryption keys vs TLS certificates
KMS vs CloudHSM	managed key service vs dedicated HSM
Secrets Manager vs Parameter Store	secrets/rotation vs config
CloudWatch vs CloudTrail	metrics vs API audit
Config vs CloudTrail	configuration state vs API history
X-Ray vs CloudWatch	request trace vs metrics/logs
GuardDuty vs Inspector	threat detection vs vulnerability assessment
Macie vs GuardDuty	sensitive data discovery vs threats
Security Hub vs GuardDuty	central findings vs detection
Detective vs GuardDuty	investigate vs detect
DMS vs MGN	DB migration vs server migration
DMS vs DataSync	DB migration vs file/data transfer
DataSync vs Snowball	network sync vs offline bulk
EBS vs EFS	block vs shared file
EFS vs FSx Windows	Linux shared file vs Windows SMB
S3 vs EBS	object vs block
S3 vs Glacier	active object vs archive
Athena vs Redshift	serverless S3 SQL vs warehouse
Glue vs Athena	ETL/catalog vs query
Backup vs DRS	backup recovery vs continuous server replication
Pilot Light vs Warm Standby	minimal core vs running scaled environment
Active/Active vs Warm Standby	near-zero RTO vs lower cost
Control Tower vs Organizations	landing-zone governance vs account organization

16. 🚨 100 EXAM TRAPS

IAM / Governance

🚨 Trap 1

Wording: "Prevent an OU from creating public resources."

Tempting: Security Group
Correct direction: SCP
Why: organization/account guardrail.
Make SG correct: restrict network traffic, not resource creation.

🚨 Trap 2

Wording: "Limit one developer role to a maximum set of permissions."

Tempting: SCP
Correct: Permissions Boundary
Trap: boundary applies to an identity; SCP is organizational.

🚨 Trap 3

Wording: "Allow Account A to assume a role in Account B."

Correct pattern: role trust policy in B + sts:AssumeRole permission in A.

🚨 Trap 4

Wording: "Cross-account S3 access."

Trap: bucket policy alone.
Check both resource policy and identity permissions as applicable.

🚨 Trap 5

Wording: "Temporary credentials for an EC2 workload."

Correct: IAM Role
Trap: hard-coded access keys.

🚨 Trap 6

Wording: "AWS workforce needs SSO across accounts."

Correct: IAM Identity Center
Trap: Cognito.

🚨 Trap 7

Wording: "Customer application login."

Correct: Cognito User Pool
Trap: IAM.

🚨 Trap 8

Wording: "Authenticated customer needs temporary AWS credentials."

Correct direction: Cognito Identity Pool
Trap: User Pool alone.

🚨 Trap 9

Wording: "Find unused/over-permissive IAM access."

Correct: IAM Access Analyzer
Trap: CloudTrail alone.

🚨 Trap 10

Wording: "Create a self-service catalog for teams."

Correct: Service Catalog
Trap: CloudFormation alone.

KMS / Encryption

🚨 Trap 11

Wording: "HTTPS certificate."

Correct: ACM
Trap: KMS.

🚨 Trap 12

Wording: "Encrypt data at rest with managed AWS key service."

Correct direction: KMS
Trap: ACM.

🚨 Trap 13

Wording: "Dedicated HSM."

Correct: CloudHSM
Trap: KMS.

🚨 Trap 14

Wording: "Existing RDS is unencrypted; compliance now requires encryption."

Trap: "Enable encryption."
Correct pattern: snapshot → encrypted copy → restore.

🚨 Trap 15

Wording: "Customer must control key policy."

Trap: automatically choosing AWS-managed key.
Correct direction: customer-managed KMS key when that control is required.

🚨 Trap 16

Wording: "Encrypt traffic between clients and server."

Correct: TLS/HTTPS
Trap: KMS.

🚨 Trap 17

Wording: "Encrypt before data reaches AWS and retain control of encryption process."

Consider client-side encryption.
Trap: assuming server-side KMS always satisfies the requirement.

🚨 Trap 18

Wording: "Rotate DB credentials automatically."

Correct direction: Secrets Manager
Trap: Parameter Store as the default.

🚨 Trap 19

Wording: "Store non-secret application configuration."

Correct: Parameter Store
Trap: paying for Secrets Manager unnecessarily.

🚨 Trap 20

Wording: "Compliance reports from AWS."

Correct: AWS Artifact
Trap: Config.

S3 / Storage

🚨 Trap 21

S3 is object, not block.

🚨 Trap 22

EBS is generally attached to an EC2 instance; it is not a shared filesystem solution.

🚨 Trap 23

Shared Linux filesystem → EFS, not EBS.

🚨 Trap 24

Shared Windows/SMB → FSx for Windows.

🚨 Trap 25

Unknown S3 access pattern → Intelligent-Tiering is a strong exam direction.

🚨 Trap 26

Cheapest long-term archive → Glacier Deep Archive.

🚨 Trap 27

Ad-hoc SQL over files in S3 → Athena.
Trap: Redshift when no warehouse is needed.

🚨 Trap 28

ETL/catalog → Glue.
Trap: Athena for transformation workflows.

🚨 Trap 29

Query a subset of a large S3 object → S3 Select where supported.
Trap: downloading the whole object unnecessarily.

🚨 Trap 30

Bulk actions over huge numbers of S3 objects → S3 Batch Operations.

Database

🚨 Trap 31

"Automatic DB failover" → Multi-AZ.
Trap: Read Replica.

🚨 Trap 32

"Offload reads" → Read Replica.
Trap: Multi-AZ standby.

🚨 Trap 33

"Global relational reads" → Aurora Global Database.
Trap: ordinary Read Replica in one region.

🚨 Trap 34

"Multi-region active-active NoSQL" → DynamoDB Global Tables.

🚨 Trap 35

"Microsecond DynamoDB reads" → DAX.
Trap: ElastiCache as the first choice.

🚨 Trap 36

"Repeated RDS query results" → ElastiCache.
Trap: DAX because you saw "cache."

🚨 Trap 37

"Lambda creates too many DB connections" → RDS Proxy.
Trap: ElastiCache.

🚨 Trap 38

"SQL joins/relational transactions" → RDS/Aurora direction.
Trap: DynamoDB because of "scale."

🚨 Trap 39

"Unpredictable relational workload" → Aurora Serverless v2 direction.
Trap: fixed-size RDS instance.

🚨 Trap 40

"Millions of key-value requests/sec" → DynamoDB direction.
Trap: one RDS instance.

Messaging / Decoupling

🚨 Trap 41

Traffic spike + async → SQS.
Trap: immediately scaling DB.

🚨 Trap 42

Order required → SQS FIFO.
Trap: Standard queue.

🚨 Trap 43

One message to many consumers → SNS + SQS fan-out.
Trap: one shared SQS queue when each consumer needs independent processing.

🚨 Trap 44

Event routing based on rules → EventBridge.
Trap: SNS simply because the word "event" appears.

🚨 Trap 45

Multi-step branching workflow → Step Functions.
Trap: manually chaining Lambda functions.

🚨 Trap 46

Long-lived streaming + replay → Kinesis Streams.
Trap: SQS.

🚨 Trap 47

Buffered delivery into destinations → Firehose.
Trap: Streams when you do not need custom stream processing.

🚨 Trap 48

Managed Kafka requirement → MSK.
Trap: generic SQS.

🚨 Trap 49

Do not confuse queue retry with workflow orchestration.
SQS retries messages; Step Functions orchestrates steps.

🚨 Trap 50

Async is not automatically better. If the user must receive an immediate response, you may need synchronous compute/API design.

Compute

🚨 Trap 51

Lambda max execution duration requirement >15 minutes → Lambda eliminated.

🚨 Trap 52

"Serverless containers" → Fargate, not Lambda.

🚨 Trap 53

"Kubernetes" → EKS, not ECS.

🚨 Trap 54

"Simple AWS-native containers" → ECS direction.
Trap: EKS when Kubernetes features are not required.

🚨 Trap 55

Long fault-tolerant ML job + lowest cost → Spot / Batch on Spot direction.
Trap: Fargate.

🚨 Trap 56

Full OS or special kernel/legacy requirement → EC2.
Trap: forcing serverless.

🚨 Trap 57

Batch/parallel jobs → AWS Batch.
Trap: Lambda for multi-hour jobs.

🚨 Trap 58

Quick simple web app deployment → Elastic Beanstalk.
Trap: building an unnecessarily complex EKS platform.

🚨 Trap 59

Cheap simple VPS → Lightsail.
Trap: overengineering with EKS.

🚨 Trap 60

Virtual desktops → WorkSpaces.
Streamed individual applications → AppStream 2.0.

VPC / Networking

🚨 Trap 61

Private subnet + internet egress → NAT Gateway.
Trap: Internet Gateway directly from a private subnet.

🚨 Trap 62

Private EC2 → S3 → Gateway Endpoint.
Trap: NAT when cost/private path is emphasized.

🚨 Trap 63

Private EC2 → Secrets Manager → Interface Endpoint.
Trap: Gateway Endpoint.

🚨 Trap 64

Private subnet + S3 + OS patches from internet → Gateway Endpoint + NAT.
Trap: choosing only one.

🚨 Trap 65

Two VPCs → VPC Peering.
Trap: Transit Gateway when the scenario is simply two VPCs.

🚨 Trap 66

Many VPCs → Transit Gateway.
Trap: building many point-to-point peerings.

🚨 Trap 67

Dedicated predictable hybrid connectivity → Direct Connect.
Trap: VPN when dedicated bandwidth is explicitly required.

🚨 Trap 68

Fast encrypted hybrid connection → VPN.
Trap: DX because it sounds more enterprise.

🚨 Trap 69

Private service exposure → PrivateLink.
Trap: public ALB + IP allowlist.

🚨 Trap 70

Global static IP + TCP/UDP → Global Accelerator.
Trap: CloudFront.

Security networking

🚨 Trap 71

Security Group is stateful.
NACL is stateless.

🚨 Trap 72

SG is associated with network interfaces/resources.
NACL is associated with subnets.

🚨 Trap 73

SQL injection / XSS → WAF.
Trap: Security Group.

🚨 Trap 74

DDoS protection → Shield.
Trap: WAF alone for every DDoS scenario.

🚨 Trap 75

VPC-wide stateful packet inspection → Network Firewall.
Trap: WAF.

🚨 Trap 76

Need to diagnose why two resources cannot connect → Reachability Analyzer.
Trap: changing SGs blindly.

🚨 Trap 77

Centralize WAF/security policies across many accounts → Firewall Manager.
Trap: manually editing every account.

Monitoring / Security operations

🚨 Trap 78

"Who made this API call?" → CloudTrail.
Trap: CloudWatch.

🚨 Trap 79

"CPU/latency/alarm" → CloudWatch.
Trap: CloudTrail.

🚨 Trap 80

"What configuration changed / does it comply?" → Config.
Trap: CloudTrail alone.

🚨 Trap 81

"Trace request through microservices" → X-Ray.
Trap: CloudWatch metrics alone.

🚨 Trap 82

"Threat detection" → GuardDuty.
Trap: Inspector.

🚨 Trap 83

"Find software vulnerabilities/CVEs" → Inspector.
Trap: GuardDuty.

🚨 Trap 84

"Find sensitive/PII data in S3" → Macie.
Trap: GuardDuty.

🚨 Trap 85

"Centralize security findings" → Security Hub.
Trap: GuardDuty as the central dashboard for everything.

🚨 Trap 86

"Investigate why a finding happened" → Detective.
Trap: GuardDuty, which detects rather than investigates.

🚨 Trap 87

"Best-practice account checks" → Trusted Advisor.
Trap: Config.

🚨 Trap 88

"Personalized AWS maintenance/event affecting my resource" → AWS Health Dashboard.
Trap: public Service Health page.

Migration

🚨 Trap 89

Whole server lift-and-shift → MGN.
Trap: DMS.

🚨 Trap 90

Database migration → DMS.
Trap: MGN.

🚨 Trap 91

Different DB engine/schema conversion → DMS + SCT.
Trap: MGN.

🚨 Trap 92

Continuous file/data synchronization → DataSync.
Trap: Snowball.

🚨 Trap 93

Huge offline data transfer → Snowball.
Trap: DataSync when bandwidth/time makes network transfer impractical.

🚨 Trap 94

SFTP managed endpoint → Transfer Family.
Trap: building an SFTP server on EC2 unnecessarily.

🚨 Trap 95

Track migration projects → Migration Hub.
Trap: DMS itself as the central migration portfolio tool.

DR / Cost / Governance

🚨 Trap 96

Cheapest DR + hours acceptable → Backup/Restore.
Trap: Active/Active.

🚨 Trap 97

Near-zero RTO + cost not concern → Active/Active.
Trap: Pilot Light.

🚨 Trap 98

Continuous server replication → DRS.
Trap: periodic snapshots.

🚨 Trap 99

Steady predictable compute → Savings Plans / Reserved Instances direction.
Trap: Spot when interruption is unacceptable.

🚨 Trap 100

Interruptible fault-tolerant workload → Spot.
Trap: On-Demand simply because it is easier.

17. "IF THIS CHANGES, THE ANSWER CHANGES"

Database

AZ failure → Multi-AZ.
Read scaling → Read Replica.
Global relational reads → Aurora Global DB.
Global NoSQL active-active → Global Tables.
DynamoDB + μs reads → DAX.
Lambda connection exhaustion → RDS Proxy.
SQL joins → RDS/Aurora.
Millions of key-value requests → DynamoDB.
Unpredictable relational traffic → Aurora Serverless v2.
Repeated RDS reads → ElastiCache.

Networking

Private subnet + internet → NAT.
Private S3/DDB → Gateway Endpoint.
Private Secrets Manager/SNS/etc. → Interface Endpoint.
Two VPCs → Peering.
Many VPCs → Transit Gateway.
Dedicated circuit → Direct Connect.
Quick encrypted hybrid → VPN.
Private service publishing → PrivateLink.
HTTP content caching → CloudFront.
UDP + static IP → Global Accelerator.

Security

Customer login → User Pool.
Customer AWS credentials → Identity Pool.
AWS workload permissions → IAM Role.
Org restriction → SCP.
Identity maximum restriction → Permissions Boundary.
API audit → CloudTrail.
Configuration compliance → Config.
Runtime metrics → CloudWatch.
Web exploit → WAF.
DDoS → Shield.
CVE scan → Inspector.
Threat detection → GuardDuty.
PII discovery → Macie.
Investigation → Detective.
TLS certificate → ACM.
Encryption key management → KMS.
Dedicated HSM → CloudHSM.

Migration / DR

DB → DMS.
Different DB engine → DMS + SCT.
Whole server → MGN.
Continuous network file sync → DataSync.
Offline bulk → Snowball.
Hours RTO → Backup/Restore.
Minutes + minimal environment → Pilot Light.
Minutes + running scaled environment → Warm Standby.
Near-zero RTO → Active/Active.
Continuous server replication → DRS.

Compute

<15-min function → Lambda.
>15-min container → Fargate/ECS depending on need.
Kubernetes requirement → EKS.

18. 20 "WHEN I AM WRONG" MINI SCENARIOS

Scenario 1

You choose: Multi-AZ

Question: DB reads are overloaded.

Correct: Read Replica.

Thinking mistake: confusing HA with read scaling.

Reverse: "DB must automatically fail over after AZ failure" → Multi-AZ.

Scenario 2

You choose: DAX

Question: RDS query results are repeatedly requested.

Correct: ElastiCache.

Mistake: DAX is DynamoDB-specific.

Reverse: DynamoDB + microsecond reads → DAX.

Scenario 3

You choose: Fargate

Question: 8-hour interruptible ML job, lowest cost.

Correct: Spot / Batch on Spot.

Mistake: "serverless" is not the same as "cheapest."

Reverse: long-running container with no server management → Fargate.

Scenario 4

You choose: NAT

Question: Private EC2 needs only S3 privately.

Correct: Gateway Endpoint.

Mistake: NAT is for internet egress.

Reverse: EC2 also needs public OS updates → add NAT.

Scenario 5

You choose: CloudFront

Question: UDP gaming + static IP.

Correct: Global Accelerator.

Mistake: global ≠ HTTP caching.

Reverse: global static website → CloudFront.

Scenario 6

You choose: Gateway Endpoint

Question: Private EC2 needs S3 + Secrets Manager.

Correct: Gateway Endpoint for S3 + Interface Endpoint for Secrets Manager.

Mistake: gateway endpoint is only S3/DDB.

Scenario 7

You choose: Lambda

Question: serverless container runs 2 hours.

Correct: Fargate.

Mistake: Lambda has a 15-minute execution limit.

Scenario 8

You choose: Secrets Manager automatically

Question: plain non-secret configuration.

Correct: Parameter Store.

Mistake: secret-management service is unnecessary.

Scenario 9

You choose: SCP

Question: limit permissions of one IAM role.

Correct: Permissions Boundary.

Mistake: SCP is organizational guardrail.

Scenario 10

You choose: Security Group

Question: block SQL injection.

Correct: WAF.

Mistake: wrong network/application layer.

Scenario 11

You choose: CloudTrail

Question: CPU alarm.

Correct: CloudWatch.

Mistake: audit vs monitoring.

Scenario 12

You choose: GuardDuty

Question: scan EC2/container software for vulnerabilities.

Correct: Inspector.

Mistake: threat detection vs vulnerability assessment.

Scenario 13

You choose: DMS

Question: migrate entire VMware server to EC2 with continuous replication.

Correct: MGN.

Mistake: database migration vs server migration.

Scenario 14

You choose: DataSync

Question: 500 TB must move over a slow line within a short deadline.

Correct: Snowball direction.

Mistake: bandwidth constraint makes network transfer impractical.

Scenario 15

You choose: Read Replica

Question: zero-data-loss automatic DB failover during AZ outage.

Correct: Multi-AZ.

Mistake: asynchronous read scaling ≠ synchronous HA.

Scenario 16

You choose: RDS

Question: millions of key-value requests/sec with NoSQL access pattern.

Correct: DynamoDB.

Mistake: relational service does not match data model.

Scenario 17

You choose: EFS

Question: Windows SMB shared filesystem.

Correct: FSx for Windows.

Mistake: filesystem family matters.

Scenario 18

You choose: EBS

Question: multiple EC2 instances need a shared Linux filesystem.

Correct: EFS.

Mistake: EBS is block storage, not the normal shared-file answer.

Scenario 19

You choose: Active/Active

Question: DR cost must be minimized and hours of downtime are acceptable.

Correct: Backup/Restore.

Mistake: optimizing RTO that the question does not require.

Scenario 20

You choose: CloudFormation

Question: non-technical teams need a controlled self-service catalog of approved products.

Correct: Service Catalog.

Mistake: IaC and self-service governance are different problems.

19. THE "THREE WORD" METHOD

When stuck between two answers, reduce the question to three words.

Example

"automatic failover after AZ outage"

→ FAILOVER / AZ / AUTO
→ Multi-AZ

"offload database reads"

→ READ / SCALE / DB
→ Read Replica

"private S3 access"

→ PRIVATE / S3 / AWS
→ Gateway Endpoint

"UDP global static IP"

→ UDP / GLOBAL / IP
→ Global Accelerator

"Lambda DB connections"

→ CONNECTION / LAMBDA / DB
→ RDS Proxy

"customer login"

→ CUSTOMER / LOGIN / APP
→ Cognito User Pool

"customer AWS credentials"

→ CUSTOMER / AWS / CREDENTIALS
→ Cognito Identity Pool

20. THE ELIMINATION MATRIX

When two answers remain:

Ask	Prefer
Does one violate a hard requirement?	Eliminate it
Does one require re-architecture?	Avoid unless required
Does one add unnecessary components?	Avoid
Does one have lower operational overhead?	Prefer
Does one cost less for the stated workload?	Prefer
Does one directly match the architecture pattern?	Prefer

🚨 IMPORTANT

Do not use:

"AWS managed service always wins."

Use:

"After hard requirements are satisfied, the simplest managed/cost-effective solution usually wins."

21. QUICK WELL-ARCHITECTED CHECK

Use:

O S R P C S

O = Operational Excellence
S = Security
R = Reliability
P = Performance Efficiency
C = Cost Optimization
S = Sustainability

Mnemonic:
Our Systems Run Pretty Cool & Smooth

🚨 Trap:
"Reduce carbon footprint" does not automatically mean redesigning the application. Think managed services, utilization, efficient architecture, and appropriate region/resource choices.

22. FINAL ONE-PAGE REVISION SHEET

Database

Failover → Multi-AZ
Read scale → Read Replica
Global relational → Aurora Global DB
Global NoSQL → Global Tables
DynamoDB μs → DAX
General cache → ElastiCache
Connections → RDS Proxy

Messaging

Queue → SQS
Order/dedup → FIFO
Fan-out → SNS
Routing → EventBridge
Workflow → Step Functions
Stream/replay → Kinesis

Compute

Function <15m → Lambda
Container no servers → Fargate
Kubernetes → EKS
AWS containers → ECS
Batch → AWS Batch
Interruptible cheap → Spot
Full control → EC2

Storage

Object → S3
Block → EBS
Shared Linux → EFS
Shared Windows → FSx Windows
HPC → FSx Lustre
Archive cheapest → Deep Archive

Networking

Internet outbound from private → NAT
Private S3/DDB → Gateway Endpoint
Private other AWS → Interface Endpoint
2 VPCs → Peering
Many VPCs → TGW
Dedicated → DX
Quick hybrid → VPN
Private service → PrivateLink
HTTP cache → CloudFront
TCP/UDP static IP → Global Accelerator

Security

Customer login → User Pool
AWS creds for customers → Identity Pool
Workload creds → IAM Role
Org guardrail → SCP
Identity cap → Permissions Boundary
At rest keys → KMS
TLS cert → ACM
Dedicated HSM → CloudHSM
Secrets rotation → Secrets Manager
Config → Parameter Store
Web attack → WAF
DDoS → Shield

Monitoring

Metrics → CloudWatch
API audit → CloudTrail
Config compliance → Config
Trace → X-Ray
Threat → GuardDuty
Vulnerabilities → Inspector
PII → Macie
Investigate → Detective
Central security → Security Hub

Migration

DB → DMS
DB engine conversion → DMS + SCT
Server → MGN
Network data sync → DataSync
Offline bulk → Snowball
SFTP → Transfer Family

DR

Hours / cheap → Backup Restore
Minutes / minimal → Pilot Light
Minutes / running → Warm Standby
Near-zero RTO → Active/Active
Continuous server replication → DRS

23. THE GOLDEN RULE

Never ask:

"Which service is associated with this keyword?"

Ask:

"What failure/problem/requirement am I trying to solve?"

Then:

QUESTION
   ↓
REAL PROBLEM
   ↓
HARD REQUIREMENT
   ↓
CONSTRAINT
   ↓
WORKLOAD SHAPE
   ↓
ARCHITECTURE PATTERN
   ↓
ELIMINATE IMPOSSIBLE ANSWERS
   ↓
COMPARE FINAL 2
   ↓
SERVICE
   ↓
TRAP CHECK
   ↓
FINAL ANSWER

Final exam mantra

FAILURE → REQUIREMENT → BOUNDARY → SERVICE

If you can explain why your answer wins AND why the tempting answer loses, you are thinking like a Solutions Architect rather than memorizing AWS.