DEV Community

Chayan Samanta
Chayan Samanta

Posted on

AWS Cheatsheet

#aws #architecture #cloud

πŸ† AWS SAA-C03 CHEAT SHEET

πŸ“‹ TABLE OF CONTENTS****

  1. Exam Domain Breakdown
  2. Exam Framework
  3. Thinking Process
  4. Well-Architected Framework
  5. Service Selection Matrix
  6. Flowchart Lookup
  7. Distractor Dictionary
  8. Service Families
  9. Synonyms
  10. Default Choices
  11. One-Line Definitions
  12. Question Patterns
  13. Decision Trees
  14. VPC Deep Dive
  15. IAM Deep Dive
  16. S3 Deep Dive
  17. Auto Scaling & ELB Deep Dive
  18. Route 53 Deep Dive
  19. Analytics Deep Dive
  20. Cost Optimization Toolkit
  21. Additional Services
  22. Comparisons
  23. Why Answers Are Wrong
  24. Architectures
  25. Vocabulary
  26. Limits
  27. Memory Tricks
  28. Star Ratings
  29. Final 30-Min Sheet

1️⃣ EXAM DOMAIN BREAKDOWN

Official SAA-C03 domain weighting β€” study time should roughly follow this.

Domain 1: Design Secure Architectures β€” 30%
IAM, KMS, Secrets Manager, VPC security, encryption, compliance

Domain 2: Design Resilient Architectures β€” 26%
Multi-AZ, DR strategies, decoupling, HA, backup

Domain 3: Design High-Performing Architectures β€” 24%
Compute selection, storage selection, database selection, caching, networking performance

Domain 4: Design Cost-Optimized Architectures β€” 20%
Storage classes, compute pricing models, cost tools

πŸ“Œ Domain 1 + 2 = 56% of the exam. Security and resilience are NOT optional study areas.

2️⃣ EXAM FRAMEWORK

7 Steps:

1️⃣ Read the LAST sentence first
2️⃣ Find the REQUIREMENT
3️⃣ Find the CONSTRAINT
4️⃣ Highlight KEYWORDS
5️⃣ ELIMINATE impossible answers
6️⃣ COMPARE the final 2
7️⃣ Pick the BEST-PRACTICE answer

πŸ§ͺ Example 1

πŸ“ "...automatic failover, AZ outage, zero data loss, no app changes"

Keywords:

  • automatic failover
  • zero data loss

Eliminate:

  • ❌ Read Replica (async, manual)

βœ… Answer: RDS Multi-AZ

πŸ§ͺ Example 2

πŸ“ "...serve video worldwide, lowest latency, signed URLs"

Eliminate:

  • ❌ Direct S3 (no edge cache)

βœ… Answer: CloudFront + S3 (OAC) + Signed URLs

πŸ§ͺ Example 3

πŸ“ "...exactly once, exact order"

Eliminate:

  • ❌ SQS Standard
  • ❌ SNS

βœ… Answer: SQS FIFO

πŸ§ͺ Example 4 (NEW)

πŸ“ "A company runs a nightly batch job that takes 2 hours. It must not run on EC2 that needs patching. Lowest cost, fault-tolerant."

Keywords:

  • 2 hours (rules out Lambda)
  • lowest cost + fault-tolerant (Spot)
  • no patching (rules out self-managed EC2 ASG)

Eliminate:

  • ❌ Lambda (>15min limit)
  • ❌ On-Demand EC2 (not lowest cost)

βœ… Answer: AWS Batch on Spot Instances / Fargate

3️⃣ THE AWS THINKING PROCESS

  1. Managed > Self-managed
  2. Serverless > Provisioned
  3. Native AWS > 3rd-party
  4. Automated > Manual
  5. Least ops overhead wins ties
  6. Elastic > Fixed capacity
  7. Secure by default
  8. HA by default (if "production")
  9. Cost matched to workload pattern

⚠️ Override: Compliance/security beats cost/efficiency every time.

4️⃣ WELL-ARCHITECTED FRAMEWORK

Explicitly tested in Domain 4 and referenced throughout the exam.

πŸ›οΈ The 6 Pillars

1. Operational Excellence

  • Run/monitor systems, improve processes
  • Services: CloudFormation, CloudWatch, Config, Systems Manager
  • Keyword: "automate operations", "IaC", "runbooks"

2. Security

  • Protect data/systems, manage identities
  • Services: IAM, KMS, GuardDuty, WAF, Shield, Macie
  • Keyword: "least privilege", "defense in depth", "encrypt everything"

3. Reliability

  • Recover from failure, scale to meet demand
  • Services: Multi-AZ, Auto Scaling, ELB, Route 53 health checks
  • Keyword: "self-healing", "fault isolation", "recover automatically"

4. Performance Efficiency

  • Use resources efficiently, adapt to changing needs
  • Services: Lambda, DynamoDB, CloudFront, right-sized EC2
  • Keyword: "elastic", "use serverless", "select correct instance type"

5. Cost Optimization

  • Avoid unnecessary costs
  • Services: Cost Explorer, Trusted Advisor, Compute Optimizer, Savings Plans
  • Keyword: "lowest cost", "right-sizing", "eliminate waste"

6. Sustainability

  • Minimize environmental impact
  • Services: managed services (share infra efficiently), region selection
  • Keyword: "minimize carbon footprint", "maximize utilization"

πŸ“Œ Exam trap: A question mentioning "reduce carbon footprint" or "sustainability" β†’ pick managed services / consolidate workloads, NOT a technical redesign.

5️⃣ SERVICE SELECTION MATRIX

Scan this before decision trees.

Database

  • HA relational β†’ Multi-AZ
  • Read scaling β†’ Read Replica
  • Global relational reads β†’ Aurora Global DB
  • Massive NoSQL β†’ DynamoDB
  • Microsecond cache (DynamoDB) β†’ DAX
  • In-memory cache β†’ ElastiCache
  • Data warehouse β†’ Redshift
  • Graph β†’ Neptune
  • Time-series β†’ Timestream
  • Ledger/immutable audit β†’ QLDB

Messaging

  • Queue β†’ SQS Standard
  • Exactly-once + order β†’ SQS FIFO
  • Fan-out β†’ SNS
  • Event routing β†’ EventBridge
  • Workflow orchestration β†’ Step Functions
  • Real-time stream + replay β†’ Kinesis Streams
  • Buffered delivery β†’ Kinesis Firehose
  • Managed Kafka β†’ MSK

Storage

  • Block, 1 instance β†’ EBS
  • Shared file, Linux β†’ EFS
  • Shared file, Windows β†’ FSx Windows
  • HPC scratch β†’ FSx Lustre
  • NetApp features β†’ FSx ONTAP
  • Object storage β†’ S3
  • Cheapest archive β†’ Glacier Deep Archive
  • Unknown access pattern β†’ Intelligent-Tiering

Compute

  • Serverless, <15min β†’ Lambda
  • Serverless container β†’ Fargate
  • Kubernetes β†’ EKS
  • Simple containers β†’ ECS
  • Simple web app deploy β†’ Elastic Beanstalk
  • Cheap simple VPS β†’ Lightsail
  • Batch/HPC β†’ AWS Batch

Networking

  • CDN β†’ CloudFront
  • Global static IP β†’ Global Accelerator
  • DNS routing β†’ Route 53
  • Dedicated bandwidth β†’ Direct Connect
  • Quick hybrid link β†’ VPN
  • Remote user access β†’ Client VPN
  • Many VPCs β†’ Transit Gateway
  • 2 VPCs β†’ VPC Peering
  • Free private S3/DynamoDB β†’ Gateway Endpoint
  • Private access, other services β†’ Interface Endpoint

Security

  • Temp credentials β†’ IAM Role
  • Multi-account guardrail β†’ SCP
  • Cap 1 identity's perms β†’ Permissions Boundary
  • Secret w/ rotation β†’ Secrets Manager
  • Plain config β†’ Parameter Store
  • Encryption keys β†’ KMS
  • Dedicated HSM β†’ CloudHSM
  • Threat detection β†’ GuardDuty
  • Vulnerability scan β†’ Inspector
  • Sensitive data discovery β†’ Macie
  • Central security view β†’ Security Hub
  • Web exploits β†’ WAF
  • DDoS β†’ Shield
  • TLS certs β†’ ACM

Monitoring

  • API audit β†’ CloudTrail
  • Config drift β†’ AWS Config
  • Metrics/alarms β†’ CloudWatch
  • Tracing β†’ X-Ray
  • Automated best-practice checks β†’ Trusted Advisor
  • Instance right-sizing β†’ Compute Optimizer

Migration

  • DB migration β†’ DMS
  • Server lift & shift β†’ MGN
  • Bulk offline β†’ Snowball
  • Ongoing sync β†’ DataSync
  • SFTP β†’ Transfer Family

Cost

  • Spend forecasting β†’ Cost Explorer
  • Budget alerts β†’ AWS Budgets
  • Detailed billing data β†’ Cost & Usage Report
  • Best-practice recommendations β†’ Trusted Advisor

6️⃣ FLOWCHART LOOKUP

πŸ—ƒοΈ Database?

  • Relational?

    • Need HA? β†’ Multi-AZ
    • Need reads? β†’ Read Replica
    • Need global reads? β†’ Aurora Global DB
    • Unpredictable load? β†’ Aurora Serverless v2
    • Specific engine? β†’ RDS

  • NoSQL?

    • Key-value, huge scale? β†’ DynamoDB
    • Need ΞΌs cache? β†’ DAX
    • Graph? β†’ Neptune
    • Time-series? β†’ Timestream
    • MongoDB-style? β†’ DocumentDB
    • Immutable ledger? β†’ QLDB

πŸ—„οΈ Storage?

  • Block, 1 instance? β†’ EBS
  • Shared file, Linux? β†’ EFS
  • Shared file, Windows? β†’ FSx Windows
  • HPC scratch? β†’ FSx Lustre
  • Object, general? β†’ S3 Standard
  • Object, infrequent? β†’ S3 Standard-IA
  • Unknown pattern? β†’ Intelligent-Tiering
  • Archive (hrs)? β†’ Glacier Flexible
  • Archive (cheapest)? β†’ Glacier Deep Archive

πŸ’» Compute?

  • Full OS control? β†’ EC2
  • Simple web app, quick deploy? β†’ Elastic Beanstalk
  • Simple VPS, predictable low cost? β†’ Lightsail
  • Event-driven, <15min? β†’ Lambda
  • Containers, K8s? β†’ EKS
  • Containers, AWS-native? β†’ ECS
  • No server mgmt? β†’ Fargate
  • Batch/HPC? β†’ AWS Batch

🌐 Networking?

  • Dedicated bandwidth? β†’ Direct Connect
  • Quick setup? β†’ Site-to-Site VPN
  • Many VPCs (hub-spoke)? β†’ Transit Gateway
  • 2 VPCs simply? β†’ VPC Peering
  • Private, S3/DynamoDB? β†’ Gateway Endpoint
  • Private, other services? β†’ Interface Endpoint
  • Global static IP? β†’ Global Accelerator
  • Cache content? β†’ CloudFront

πŸ” Security?

  • Temp credentials? β†’ IAM Role
  • Multi-account rule? β†’ SCP
  • Cap 1 identity? β†’ Permissions Boundary
  • Encrypt data? β†’ KMS
  • Rotate DB creds? β†’ Secrets Manager
  • Plain config? β†’ Parameter Store
  • Detect threats? β†’ GuardDuty
  • Scan CVEs? β†’ Inspector
  • Find PII? β†’ Macie
  • Web exploits? β†’ WAF
  • DDoS? β†’ Shield
  • TLS certificates? β†’ ACM

πŸ“¨ Messaging?

  • Decoupling? β†’ SQS Standard
  • Exactly-once + order? β†’ SQS FIFO
  • Fan-out? β†’ SNS
  • Rule-based routing? β†’ EventBridge
  • Multi-step workflow? β†’ Step Functions
  • Stream + replay? β†’ Kinesis Streams
  • Managed Kafka? β†’ MSK

7️⃣ DISTRACTOR DICTIONARY

Phrase β†’ Correct Service

  • πŸ“Œ Lowest ops overhead β†’ Managed service
  • πŸ“Œ Least admin effort β†’ Managed/serverless
  • πŸ“Œ Don't rewrite app β†’ Rehost (EC2)
  • πŸ“Œ Existing Oracle/SQL Server β†’ RDS
  • πŸ“Œ Existing MySQL/Postgres, want perf β†’ Aurora
  • πŸ“Œ Existing Kubernetes β†’ EKS
  • πŸ“Œ Existing Docker β†’ ECS/Fargate
  • πŸ“Œ Millions of requests/sec β†’ DynamoDB / Lambda / Auto Scaling
  • πŸ“Œ Unpredictable traffic β†’ Auto Scaling / Aurora Serverless
  • πŸ“Œ Compliance requirement β†’ KMS + IAM + Config + CloudTrail
  • πŸ“Œ Analytics/BI β†’ Athena / Glue / Redshift
  • πŸ“Œ Real-time streaming β†’ Kinesis Data Streams
  • πŸ“Œ Near-real-time β†’ Kinesis Firehose
  • πŸ“Œ Static content β†’ S3 + CloudFront
  • πŸ“Œ Temporary credentials β†’ IAM Role
  • πŸ“Œ Cross-account access β†’ IAM Role + Trust Policy
  • πŸ“Œ No server management β†’ Lambda / Fargate / DynamoDB
  • πŸ“Œ Cost-effective, steady β†’ Reserved Instance / Savings Plan
  • πŸ“Œ Cost-effective, flexible β†’ Spot Instances
  • πŸ“Œ Encrypted at rest β†’ KMS / SSE-S3
  • πŸ“Œ Rotate credentials β†’ Secrets Manager
  • πŸ“Œ Non-sensitive config β†’ Parameter Store
  • πŸ“Œ Compromised credentials β†’ GuardDuty
  • πŸ“Œ Scan vulnerabilities β†’ Inspector
  • πŸ“Œ Discover PII β†’ Macie
  • πŸ“Œ Centralize security β†’ Security Hub
  • πŸ“Œ SQL injection β†’ WAF
  • πŸ“Œ DDoS β†’ Shield
  • πŸ“Œ Who did this β†’ CloudTrail
  • πŸ“Œ What changed β†’ AWS Config
  • πŸ“Œ Monitor CPU/memory β†’ CloudWatch
  • πŸ“Œ Trace request across services β†’ X-Ray
  • πŸ“Œ Dedicated line β†’ Direct Connect
  • πŸ“Œ Quick encrypted link β†’ Site-to-Site VPN
  • πŸ“Œ Remote employees need VPC β†’ Client VPN
  • πŸ“Œ Many VPCs, central routing β†’ Transit Gateway
  • πŸ“Œ Two VPCs only β†’ VPC Peering
  • πŸ“Œ Private, S3 only β†’ Gateway Endpoint
  • πŸ“Œ Private, other services β†’ Interface Endpoint
  • πŸ“Œ Expose service privately β†’ PrivateLink
  • πŸ“Œ Global app, static IP, non-HTTP β†’ Global Accelerator
  • πŸ“Œ Automatic DB failover β†’ Multi-AZ
  • πŸ“Œ Offload reads β†’ Read Replica
  • πŸ“Œ Cross-region DB reads β†’ Aurora Global DB
  • πŸ“Œ Multi-region active-active β†’ DynamoDB Global Tables
  • πŸ“Œ Centralized backup β†’ AWS Backup
  • πŸ“Œ Continuous DR replication β†’ Elastic Disaster Recovery
  • πŸ“Œ DB migration, minimal downtime β†’ DMS (CDC)
  • πŸ“Œ DB migration, diff engine β†’ DMS + SCT
  • πŸ“Œ Whole server migration β†’ MGN
  • πŸ“Œ Bulk offline transfer β†’ Snowball
  • πŸ“Œ Scheduled sync β†’ DataSync
  • πŸ“Œ SFTP access β†’ Transfer Family
  • πŸ“Œ On-prem app, cloud storage β†’ Storage Gateway
  • πŸ“Œ Serverless SQL on S3 β†’ Athena
  • πŸ“Œ ETL + catalog β†’ Glue
  • πŸ“Œ Lambdaβ†’RDS pooling β†’ RDS Proxy
  • πŸ“Œ SaaS multi-tenant data β†’ DynamoDB w/ tenant partition key
  • πŸ“Œ Mobile app login β†’ Cognito User Pools
  • πŸ“Œ Federated temp creds β†’ Cognito Identity Pools
  • πŸ“Œ Central SSO β†’ IAM Identity Center
  • πŸ“Œ Auto landing zone β†’ Control Tower
  • πŸ“Œ Share resource cross-account β†’ RAM
  • πŸ“Œ IaC, AWS native β†’ CloudFormation
  • πŸ“Œ IaC, programming language β†’ CDK
  • πŸ“Œ TLS cert management β†’ ACM
  • πŸ“Œ Dedicated HSM β†’ CloudHSM
  • πŸ“Œ SSH without open ports β†’ SSM Session Manager
  • πŸ“Œ Right-size EC2 fleet β†’ Compute Optimizer
  • πŸ“Œ Best-practice health check β†’ Trusted Advisor
  • πŸ“Œ Detailed hourly billing data β†’ Cost & Usage Report
  • πŸ“Œ Simple 3-tier deploy, minimal config β†’ Elastic Beanstalk
  • πŸ“Œ Cheap predictable small workload β†’ Lightsail
  • πŸ“Œ Track migration project status β†’ Migration Hub
  • πŸ“Œ Discover on-prem servers β†’ Application Discovery Service
  • πŸ“Œ Reduce carbon footprint β†’ Managed services / consolidate
  • πŸ“Œ Immutable audit ledger β†’ QLDB
  • πŸ“Œ Central data catalog for governance β†’ Lake Formation

8️⃣ SERVICE FAMILIES

πŸ—„οΈ Storage
S3 β€’ EBS β€’ EFS β€’ FSx β€’ Storage Gateway β€’ AWS Backup β€’ Snow Family

πŸ—ƒοΈ Database
RDS β€’ Aurora β€’ DynamoDB β€’ ElastiCache β€’ Redshift β€’ Neptune β€’ Timestream β€’ QLDB β€’ DocumentDB

🌐 Networking
ALB β€’ NLB β€’ GWLB β€’ CloudFront β€’ Global Accelerator β€’ VPN β€’ Client VPN β€’ Direct Connect β€’ Transit Gateway β€’ PrivateLink β€’ Route 53

πŸ” Security
IAM β€’ KMS β€’ Secrets Manager β€’ Parameter Store β€’ GuardDuty β€’ Inspector β€’ Macie β€’ Security Hub β€’ WAF β€’ Shield β€’ CloudHSM β€’ ACM

πŸ’» Compute
EC2 β€’ Lambda β€’ ECS β€’ EKS β€’ Fargate β€’ Batch β€’ Elastic Beanstalk β€’ Lightsail

πŸ“¨ Messaging
SQS β€’ SNS β€’ EventBridge β€’ Step Functions β€’ Kinesis β€’ MSK

πŸ“Š Monitoring
CloudWatch β€’ CloudTrail β€’ Config β€’ X-Ray β€’ Trusted Advisor β€’ Compute Optimizer

🚚 Migration
DMS β€’ MGN β€’ DataSync β€’ Storage Gateway β€’ Snow Family β€’ Transfer Family β€’ Migration Hub β€’ Application Discovery Service

πŸ“ˆ Analytics
Athena β€’ Glue β€’ EMR β€’ Redshift β€’ QuickSight β€’ Lake Formation β€’ Kinesis family

πŸ’° Cost
Cost Explorer β€’ AWS Budgets β€’ Cost & Usage Report β€’ Trusted Advisor β€’ Compute Optimizer β€’ Savings Plans

9️⃣ SERVICE SYNONYMS

AWS says β†’ Think

  • πŸ”Ή Durable β†’ S3
  • πŸ”Ή Elastic β†’ Auto Scaling
  • πŸ”Ή Fault tolerant β†’ Multi-AZ
  • πŸ”Ή Resilient β†’ Multi-AZ/Region
  • πŸ”Ή Archive β†’ Glacier
  • πŸ”Ή Queue β†’ SQS
  • πŸ”Ή Fan-out β†’ SNS
  • πŸ”Ή Orchestration β†’ Step Functions
  • πŸ”Ή Event routing β†’ EventBridge
  • πŸ”Ή Temp credentials β†’ IAM Role
  • πŸ”Ή Secrets β†’ Secrets Manager
  • πŸ”Ή Config values β†’ Parameter Store
  • πŸ”Ή Encryption keys β†’ KMS
  • πŸ”Ή Audit trail β†’ CloudTrail
  • πŸ”Ή Compliance drift β†’ AWS Config
  • πŸ”Ή Performance β†’ CloudWatch
  • πŸ”Ή Latency bottleneck β†’ X-Ray
  • πŸ”Ή Threats β†’ GuardDuty
  • πŸ”Ή CVEs β†’ Inspector
  • πŸ”Ή PII β†’ Macie
  • πŸ”Ή Dedicated bandwidth β†’ Direct Connect
  • πŸ”Ή Quick hybrid β†’ VPN
  • πŸ”Ή Hub-and-spoke β†’ Transit Gateway
  • πŸ”Ή Private connectivity β†’ VPC Endpoint
  • πŸ”Ή Global static IP β†’ Global Accelerator
  • πŸ”Ή Content caching β†’ CloudFront
  • πŸ”Ή Serverless β†’ Lambda/Fargate/DynamoDB
  • πŸ”Ή Lift and shift β†’ EC2/MGN
  • πŸ”Ή Zero data loss β†’ Sync replication (Multi-AZ)
  • πŸ”Ή Right-sizing β†’ Compute Optimizer
  • πŸ”Ή Data governance/catalog β†’ Lake Formation/Glue

πŸ”Ÿ AWS DEFAULT CHOICES

When question is ambiguous:

  • βœ… "Production" β†’ Multi-AZ
  • βœ… Encryption unspecified β†’ Enable it
  • βœ… Service-to-service auth β†’ IAM Role
  • βœ… Database placement β†’ Private subnet
  • βœ… Public HTTP traffic β†’ ALB
  • βœ… Global content β†’ CloudFront
  • βœ… Static content β†’ S3
  • βœ… Private S3 access β†’ Gateway Endpoint
  • βœ… Private other-service access β†’ Interface Endpoint
  • βœ… "No server management" β†’ Fargate
  • βœ… Job >15min β†’ NOT Lambda
  • βœ… Steady workload β†’ Reserved/Savings Plan
  • βœ… Spiky workload β†’ Spot
  • βœ… Rotating creds β†’ Secrets Manager
  • βœ… Plain config β†’ Parameter Store
  • βœ… Cross-account β†’ IAM Role + Trust Policy
  • βœ… Multi-account restriction β†’ SCP
  • βœ… Quick web app deployment β†’ Elastic Beanstalk
  • βœ… Simple predictable workload/budget β†’ Lightsail

1️⃣1️⃣ ONE-LINE DEFINITIONS 

CloudTrail   β†’ Who did it?
CloudWatch   β†’ How is it performing?
Config       β†’ What changed?
GuardDuty    β†’ Who is attacking?
Inspector    β†’ What is vulnerable?
Macie        β†’ Where is sensitive data?
Security Hub β†’ What's the overall security posture?
WAF          β†’ Block bad web requests
Shield       β†’ Block DDoS floods
KMS          β†’ Manage encryption keys
Secrets Mgr  β†’ Store & rotate secrets
Param Store  β†’ Store plain config
SQS          β†’ Hold messages until processed
SNS          β†’ Broadcast to many subscribers
EventBridge  β†’ Route events by rule
Step Functions β†’ Orchestrate multi-step workflow
Multi-AZ     β†’ Survive AZ failure (HA)
Read Replica β†’ Scale read traffic
Aurora Global DB β†’ Cross-region reads + fast DR
Transit Gateway β†’ Hub for many VPCs
VPC Peering  β†’ Direct link between 2 VPCs (non-transitive)
Gateway Endpoint β†’ Free private path to S3/DynamoDB only
Interface Endpoint β†’ Private path to everything else
Direct Connect β†’ Dedicated, consistent bandwidth
VPN          β†’ Quick, encrypted, internet-based link
Trusted Advisor β†’ Automated best-practice checks
Compute Optimizer β†’ Right-size your EC2/Lambda
Cost Explorer β†’ Analyze/forecast spend
AWS Budgets  β†’ Alert before overspending
Elastic Beanstalk β†’ Deploy app without managing infra
Lightsail    β†’ Simple VPS, predictable pricing
Lake Formation β†’ Central data lake governance
Enter fullscreen mode Exit fullscreen mode

1️⃣2️⃣ QUESTION PATTERNS

  • πŸ“ "A company wants..." β†’ Architecture question
  • πŸ“ "A company needs..." β†’ Service selection
  • πŸ“ "A company must..." β†’ Compliance/security
  • πŸ“ "An application..." β†’ Compute/storage/DB
  • πŸ“ "Developers need..." β†’ IAM / CI-CD
  • πŸ“ "...LEAST operational overhead" β†’ Most-managed option
  • πŸ“ "...LOWEST cost" β†’ Check workload pattern
  • πŸ“ "MOST secure way" β†’ Encryption + least privilege
  • πŸ“ "MOST resilient" β†’ Multi-AZ / Multi-Region
  • πŸ“ "Without re-architecting" β†’ Keep relational/EC2
  • πŸ“ "Minimize administrative burden" β†’ Managed service
  • πŸ“ "Reduce carbon footprint" β†’ Managed services / consolidate regions

1️⃣3️⃣ DECISION TREES

πŸ—„οΈ Storage

Need storage?

  • Block, single instance?

    • β†’ EBS
    • ⚠️ Shared block across AZs?
    • β†’ NO SUCH THING β†’ use EFS/FSx

  • Block, shared, same AZ?

    • β†’ EBS Multi-Attach (io1/io2 only)
    • ⚠️ Multi-Attach across AZs?
    • β†’ NO SUCH THING β†’ use EFS/FSx

  • Shared file, Linux?

    • β†’ EFS

  • Shared file, Windows?

    • β†’ FSx Windows

  • HPC scratch?

    • β†’ FSx Lustre

  • NetApp features (snapshots/cloning)?

    • β†’ FSx for NetApp ONTAP

  • Object storage?

    • β†’ S3
    • ⚠️ Low-latency file access at S3 scale?
    • β†’ NO SUCH THING β†’ use EFS/FSx
    • Frequent β†’ S3 Standard
    • Infrequent β†’ Standard-IA
    • Unknown pattern β†’ Intelligent-Tiering
    • Archive (hrs) β†’ Glacier Flexible
    • Deep archive β†’ Glacier Deep Archive

  • On-prem, cloud-backed local vol?

    • β†’ Storage Gateway

  • Migrate/sync large data?

    • β†’ DataSync (online) / Snowball (offline)

πŸ’» Compute

  • Full OS control?

    • β†’ EC2

  • Quick web app, minimal config?

    • β†’ Elastic Beanstalk
    • ⚠️ Need low-level infra control?
    • β†’ NO (that's the point of EB) β†’ use raw EC2 instead

  • Cheap simple VPS?

    • β†’ Lightsail

  • Event-driven, short?

    • β†’ Lambda
    • ⚠️ Runs >15min?
    • β†’ NO SUCH THING β†’ Fargate/Batch/EC2

  • Containers, K8s?

    • β†’ EKS

  • Containers, AWS-native?

    • β†’ ECS

  • No EC2 mgmt?

    • β†’ Fargate
    • ⚠️ Need GPU/custom AMI?
    • β†’ NO SUCH THING β†’ use EC2 launch type

  • Batch/HPC?

    • β†’ AWS Batch

πŸ—ƒοΈ Database

  • Relational, specific engine?

    • β†’ RDS

  • Relational, MySQL/Postgres?

    • β†’ Aurora
    • Spiky traffic β†’ Aurora Serverless v2
    • ⚠️ Scale to zero?
    • β†’ NO SUCH THING in v2 (min 0.5 ACU)
    • Auto replica failover β†’ possible βœ” (priority tiers)

  • Need HA (AZ failure)?

    • β†’ Multi-AZ
    • ⚠️ Standby also serves reads?
    • β†’ NO SUCH THING (standard RDS) β†’ use Read Replica/Aurora

  • Need read scaling?

    • β†’ Read Replica
    • ⚠️ Auto failover from Replica?
    • β†’ NO SUCH THING β†’ use Multi-AZ

  • Cross-region reads + DR?

    • β†’ Aurora Global Database

  • Lambda + RDS pooling issue?

    • β†’ RDS Proxy

  • NoSQL, massive scale?

    • β†’ DynamoDB
    • ⚠️ SQL joins across tables?
    • β†’ NO SUCH THING β†’ use Aurora/RDS

  • DynamoDB + ΞΌs cache?

    • β†’ DAX

  • Multi-region active-active NoSQL?

    • β†’ DynamoDB Global Tables

  • In-memory cache?

    • β†’ ElastiCache

  • Data warehouse?

    • β†’ Redshift

  • Graph?

    • β†’ Neptune

  • Time-series?

    • β†’ Timestream

  • Immutable ledger?

    • β†’ QLDB

  • MongoDB-compatible?

    • β†’ DocumentDB

🌐 Networking & Hybrid

  • Public subnet in/out?

    • β†’ Internet Gateway

  • Private subnet, outbound only?

    • β†’ NAT Gateway
    • ⚠️ NAT for inbound?
    • β†’ NO SUCH THING β†’ use ALB/NLB

  • On-prem, quick + encrypted?

    • β†’ Site-to-Site VPN

  • Individual remote users?

    • β†’ Client VPN

  • Dedicated bandwidth?

    • β†’ Direct Connect

  • Many VPCs, hub-spoke?

    • β†’ Transit Gateway

  • 2 VPCs, simple?

    • β†’ VPC Peering
    • ⚠️ Transitive routing (A↔B↔C)?
    • β†’ NO SUCH THING β†’ use Transit Gateway

  • Free private S3/DynamoDB?

    • β†’ Gateway Endpoint
    • ⚠️ Gateway for EC2/SNS/etc?
    • β†’ NO SUCH THING β†’ use Interface Endpoint

  • Private, other AWS/SaaS?

    • β†’ Interface Endpoint

  • Expose your service privately?

    • β†’ PrivateLink

  • Global static IP, non-HTTP?

    • β†’ Global Accelerator

  • Content caching?

    • β†’ CloudFront

πŸ” Security & IAM

  • Temp access, app/service?

    • β†’ IAM Role
    • ⚠️ Long-term keys for app?
    • β†’ AVOID β†’ use Role

  • Multi-account guardrail?

    • β†’ SCP
    • ⚠️ SCP to GRANT permission?
    • β†’ NO SUCH THING β†’ use IAM Policy

  • Cap 1 delegated admin?

    • β†’ Permissions Boundary

  • Share resource cross-account?

    • β†’ RAM

  • Encrypt, AWS manages keys?

    • β†’ SSE-S3

  • Encrypt, control key policy?

    • β†’ SSE-KMS

  • Dedicated HSM?

    • β†’ CloudHSM

  • Rotate DB credentials?

    • β†’ Secrets Manager
    • ⚠️ Parameter Store auto-rotate?
    • β†’ NO SUCH THING natively β†’ use Secrets Manager

  • Plain config?

    • β†’ Parameter Store

  • Detect threats?

    • β†’ GuardDuty
    • ⚠️ GuardDuty scans CVEs?
    • β†’ NO SUCH THING β†’ use Inspector

  • Scan vulnerabilities?

    • β†’ Inspector

  • Discover sensitive data?

    • β†’ Macie

  • SQLi/XSS protection?

    • β†’ WAF

  • DDoS protection?

    • β†’ Shield

πŸ“¨ Messaging

  • Point-to-point decoupling?

    • β†’ SQS Standard
    • ⚠️ Order/exactly-once w/ Standard?
    • β†’ NO SUCH THING β†’ use SQS FIFO

  • Fan-out?

    • β†’ SNS
    • ⚠️ Fan-out w/ SQS alone?
    • β†’ NO SUCH THING β†’ use SNS + SQS

  • Rule-based routing?

    • β†’ EventBridge

  • Multi-step workflow?

    • β†’ Step Functions

  • Real-time stream + replay?

    • β†’ Kinesis Data Streams
    • ⚠️ Replay from SQS?
    • β†’ NO SUCH THING (deleted after ack) β†’ use Kinesis

  • Buffered delivery?

    • β†’ Kinesis Firehose

πŸŒͺ️ Disaster Recovery

RTO/RPO budget?

  • Hours-days, cheapest

    • β†’ Backup & Restore

  • ~10s of minutes

    • β†’ Pilot Light

  • Minutes

    • β†’ Warm Standby

  • Near-zero

    • β†’ Multi-Site Active/Active

⚠️ Multi-AZ covers region failure?
β†’ NO SUCH THING (Multi-AZ β‰  DR) β†’ use Cross-Region

🚚 Migration

  • PB-scale, poor network?

    • β†’ Snowball/Snowmobile

  • Ongoing scheduled transfer?

    • β†’ DataSync

  • SFTP into S3/EFS?

    • β†’ Transfer Family

  • Migrate databases?

    • β†’ DMS (+SCT if hetero)
    • ⚠️ DMS migrates whole VMs?
    • β†’ NO SUCH THING (DB only) β†’ use MGN

  • Lift-and-shift servers?

    • β†’ MGN

  • On-prem, cloud storage as local drive?

    • β†’ Storage Gateway

  • Discover on-prem infra first?

    • β†’ Application Discovery Service

  • Track migration progress?

    • β†’ Migration Hub

1️⃣4️⃣ VPC DEEP DIVE

Networking is heavily tested. Master these fundamentals.

CIDR & Subnetting

  • VPC CIDR block: /16 to /28
  • Each subnet lives in exactly ONE AZ
  • AWS reserves 5 IPs per subnet (first 4 + last 1)
  • Public subnet = has route to Internet Gateway
  • Private subnet = no direct route to IGW

Route Tables

  • Each subnet associates with ONE route table
  • One route table can serve multiple subnets
  • Local route (VPC CIDR) is always present, can't be removed
  • Most specific route wins (longest prefix match)

Security Group vs NACL β€” Full Comparison

Security Group

  • Level: Instance (ENI)
  • State: Stateful (return traffic auto-allowed)
  • Rules: Allow only
  • Evaluation: ALL rules evaluated
  • Default: Deny all inbound, allow all outbound

NACL

  • Level: Subnet
  • State: Stateless (must allow both directions)
  • Rules: Allow AND Deny
  • Evaluation: Lowest rule number first, first match wins
  • Default: Allow all (default NACL) / Deny all (custom NACL)

πŸ“Œ Trap: Forgetting NACL is stateless means you must explicitly allow the EPHEMERAL PORT RANGE (1024-65535) for return traffic.

VPC Flow Logs

  • Capture IP traffic metadata (not payload)
  • Can publish to CloudWatch Logs or S3
  • Used by GuardDuty as a data source
  • Doesn't capture: DHCP traffic, Windows license activation, traffic to/from 169.254.169.254 (metadata)

VPC Peering Limits

  • NOT transitive
  • No overlapping CIDR blocks allowed
  • Cross-region peering supported
  • Cross-account peering supported

1️⃣5️⃣ IAM DEEP DIVE

Policy Types

  • Identity-based policy β€” attached to user/group/role
  • Resource-based policy β€” attached to a resource (e.g., S3 bucket policy)
  • Permissions boundary β€” sets the MAX permissions an identity can have
  • SCP β€” sets the MAX permissions for an entire account/OU
  • Session policy β€” passed when assuming a role, further restricts

Policy Evaluation Logic (memorize this order)

  1. Explicit DENY anywhere β†’ immediately denied
  2. Explicit ALLOW required somewhere
  3. Default is DENY if nothing matches

πŸ“Œ An explicit DENY always wins, no matter how many ALLOWs exist elsewhere.

Effective Permissions Formula 

Effective permissions =
  Identity-based policy
  ∩ Permissions Boundary (if set)
  ∩ SCP (if in an Organization)
  ∩ Resource-based policy (if applicable)
Enter fullscreen mode Exit fullscreen mode

(∩ = intersection β€” the most restrictive combination wins)

πŸ“Œ Trap: Granting S3FullAccess via IAM Policy does NOTHING if an SCP denies S3 at the OU level.

IAM Best Practices (frequently tested)

  • Never use root account for daily tasks
  • Enable MFA on root and privileged users
  • Use IAM Roles for EC2/Lambda, never embedded access keys
  • Grant least privilege, expand only when needed
  • Use IAM Access Analyzer to find overly permissive policies
  • Rotate credentials regularly (or use Roles to avoid this entirely)

1️⃣6️⃣ S3 DEEP DIVE

Consistency Model

βœ… S3 now provides strong read-after-write consistency for ALL operations (PUT, GET, LIST, DELETE) β€” since Dec 2020. No more "eventual consistency" caveat.

Versioning

  • Once enabled, cannot be disabled (only suspended)
  • Protects against accidental overwrite/delete
  • Each version has a unique version ID
  • Combine with MFA Delete for extra protection

Replication

  • CRR (Cross-Region Replication) β€” different region, DR/compliance/latency
  • SRR (Same-Region Replication) β€” same region, log aggregation/compliance
  • Requires versioning enabled on both buckets
  • Not retroactive β€” only replicates NEW objects after enabling (unless using S3 Batch Replication)

Lifecycle Policies

  • Automate transitions between storage classes
  • Automate expiration (deletion) of old objects/versions
  • Common pattern: Standard β†’ Standard-IA (30 days) β†’ Glacier (90 days) β†’ Deep Archive (180 days) β†’ Delete (365 days)

Storage Classes β€” Full List

  • S3 Standard β€” frequent access, ms retrieval
  • S3 Intelligent-Tiering β€” unknown/changing patterns, auto-moves between tiers
  • S3 Standard-IA β€” infrequent, ms retrieval, lower storage cost
  • S3 One Zone-IA β€” infrequent, single AZ (cheaper, less durable)
  • S3 Glacier Instant Retrieval β€” archive, ms retrieval
  • S3 Glacier Flexible Retrieval β€” archive, minutes-hours retrieval
  • S3 Glacier Deep Archive β€” cheapest, ~12hr retrieval

Advanced Features (worth knowing)

  • S3 Object Lock β€” WORM compliance (write once read many)
  • S3 Object Lambda β€” transform data on retrieval without duplicating
  • S3 Multi-Region Access Points β€” single global endpoint, routes to nearest bucket
  • S3 Transfer Acceleration β€” speeds up uploads via CloudFront edge locations
  • S3 Access Points β€” simplify access management for shared buckets

1️⃣7️⃣ AUTO SCALING & ELB DEEP DIVE

Auto Scaling Policies

  • Target Tracking β€” maintain a metric at a target value (e.g., CPU at 50%) β€” MOST COMMON exam answer
  • Step Scaling β€” scale by different amounts based on alarm breach size
  • Scheduled Scaling β€” scale at predictable times (e.g., before Black Friday)
  • Predictive Scaling β€” uses ML to forecast and scale ahead of demand

πŸ“Œ Default exam answer for "automatically scale based on demand": Target Tracking

Lifecycle Hooks

  • Pause instance in Pending/Terminating state
  • Run custom actions (e.g., install software) before instance goes into service

ELB Comparison Recap

  • ALB β€” Layer 7, path/host routing, WebSockets, best for HTTP(S) microservices
  • NLB β€” Layer 4, extreme performance, static IP, preserves source IP
  • GWLB β€” Layer 3, for inline third-party virtual appliances (firewalls, IDS/IPS)

Health Checks

  • ELB health checks determine if a target receives traffic
  • Auto Scaling health checks determine if an instance gets replaced
  • Can combine ELB + ASG health checks for more accurate replacement decisions

1️⃣8️⃣ ROUTE 53 DEEP DIVE

Routing Policies β€” Full List

  • Simple β€” one record, no health checks, basic routing
  • Weighted β€” split traffic by percentage (e.g., A/B testing, gradual migration)
  • Latency-based β€” route to the region with lowest latency for the user
  • Failover β€” active-passive DR setup, routes to secondary if primary unhealthy
  • Geolocation β€” route based on user's geographic location (compliance, content localization)
  • Geoproximity β€” route based on geographic location with ability to shift traffic using bias
  • Multi-value answer β€” return multiple healthy records, basic load balancing + health checks

Health Checks

  • Can check endpoint health (HTTP/HTTPS/TCP)
  • Can check the status of OTHER health checks (calculated health checks)
  • Can check CloudWatch alarms

Hosted Zones

  • Public hosted zone β€” routes traffic on the internet
  • Private hosted zone β€” routes traffic within one or more VPCs

1️⃣9️⃣ ANALYTICS DEEP DIVE

Kinesis Family Comparison

Kinesis Data Streams

  • Real-time, custom processing
  • Data retained 24hr default (up to 365 days)
  • You manage shards/consumers
  • Clue: "real-time, need replay, custom consumers"

Kinesis Data Firehose

  • Near-real-time, fully managed
  • Auto-delivers to S3/Redshift/OpenSearch/Splunk
  • No data retention/replay
  • Clue: "load streaming data into S3/Redshift automatically"

Kinesis Data Analytics

  • Run SQL or Apache Flink on streaming data in real time
  • Clue: "real-time analytics/SQL queries on a stream"

Kinesis Video Streams

  • Ingest video/audio streams
  • Clue: "video from cameras/devices"

Other Analytics Services

  • Athena β€” serverless SQL directly on S3 data, pay-per-query
  • Glue β€” serverless ETL + Data Catalog
  • Glue DataBrew β€” visual data prep, no code
  • EMR β€” managed Hadoop/Spark for big data processing
  • Redshift β€” data warehouse, complex joins, BI
  • Redshift Spectrum β€” query S3 data directly from Redshift without loading it
  • QuickSight β€” BI dashboards/visualization
  • Lake Formation β€” centralized data lake setup, security, and governance on top of S3/Glue

2️⃣0️⃣ COST OPTIMIZATION TOOLKIT

  • Cost Explorer β€” visualize/analyze/forecast spend over time
  • AWS Budgets β€” proactive alerts when spend/usage approaches a threshold
  • Cost & Usage Report (CUR) β€” most detailed, granular billing data (for custom analysis)
  • Trusted Advisor β€” automated checks across cost, security, performance, fault tolerance, service limits
  • Compute Optimizer β€” ML-based right-sizing recommendations for EC2/Lambda/EBS
  • Savings Plans β€” flexible commitment-based discount (Compute or EC2 Instance Savings Plans)
  • Reserved Instances β€” commitment tied to instance family/region
  • Cost Allocation Tags β€” track spend by project/team/environment

Reserved Instance vs Savings Plan (recap)

Reserved Instance

  • Locked to instance family/region (Standard RI)
  • 1 or 3 year term
  • Convertible RI = can change instance family

Savings Plan

  • Flexible across instance family/region (Compute Savings Plan)
  • Commit to $/hour spend, not a specific instance
  • Clue: "flexible compute usage, consistent spend"

2️⃣1️⃣ ADDITIONAL SERVICES

Compute Extras

  • Elastic Beanstalk β€” PaaS, upload code, AWS handles provisioning/deployment/scaling. Clue: "quick deploy, don't manage infrastructure details"
  • Lightsail β€” simplified VPS with predictable pricing, bundled compute+storage+network. Clue: "simple website, predictable low cost, don't need full VPC complexity"
  • AWS OpsWorks β€” Chef/Puppet-based configuration management (rarely tested, legacy)

Systems Manager Suite

  • Session Manager β€” SSH/RDP access without open ports or bastion hosts
  • Patch Manager β€” automate OS patching across fleets
  • Parameter Store β€” config/secrets storage (already covered)
  • Run Command β€” execute commands remotely across instances at scale
  • State Manager β€” maintain consistent configuration state
  • Automation β€” run predefined workflows (e.g., AMI creation)

Governance & Multi-Account

  • AWS Organizations β€” consolidated billing, account structure, SCPs
  • Control Tower β€” automated landing zone setup, built ON Organizations
  • AWS RAM β€” share resources (subnets, TGW attachments) cross-account
  • AWS Config Conformance Packs β€” pre-built compliance rule sets

Developer Tools (CI/CD)

  • CodeCommit β€” managed Git repository
  • CodeBuild β€” managed build service
  • CodeDeploy β€” automates deployment to EC2/Lambda/ECS (supports Blue/Green, Canary)
  • CodePipeline β€” orchestrates the full CI/CD pipeline

2️⃣2️⃣ COMPARISONS (Stacked Card Format)

RDS Multi-AZ

  • Purpose: HA/failover
  • Replication: Sync
  • Failover: Automatic
  • Readable: No

Read Replica (RDS)

  • Purpose: Read scaling
  • Replication: Async
  • Failover: Manual
  • Readable: Yes

Aurora Replica

  • Purpose: Reads + optional HA
  • Replication: Shared storage, near-sync
  • Failover: Automatic (priority tiers)
  • Readable: Yes

πŸ“Œ Clue: "HA/zero data loss" β†’ Multi-AZ | "scale reads" β†’ Read Replica

Aurora Serverless v1

  • Scaling: Coarse, auto-pauses to ZERO
  • Cold start: Yes
  • Best for: Dev/test

Aurora Serverless v2

  • Scaling: Fine-grained, min 0.5 ACU
  • Cold start: Minimal
  • Best for: Variable production
  • ⚠️ Does NOT scale to zero

CloudFormation

  • Language: YAML/JSON
  • Native: Yes
  • Clue: "AWS native IaC"

CDK

  • Language: TS/Python/Java
  • Native: Yes (compiles to CFN)
  • Clue: "programming language IaC"

Terraform

  • Language: HCL
  • Native: No
  • Clue: Rarely correct on SAA-C03

CloudWatch

  • Purpose: Metrics/logs/alarms
  • Clue: "monitor CPU/errors"

X-Ray

  • Purpose: Distributed tracing
  • Clue: "trace request across services"

Gateway Endpoint

  • Services: S3, DynamoDB ONLY
  • Cost: Free
  • Clue: "no cost, S3 access"

Interface Endpoint

  • Services: Most AWS + SaaS
  • Cost: Hourly + data
  • Clue: "private access, other services"

S3 Transfer Acceleration

  • Direction: Speeds up uploads
  • Clue: "large uploads, global users"

CloudFront

  • Direction: Speeds up downloads
  • Clue: "content delivery, global users"

Global Accelerator

  • Layer: Network (TCP/UDP)
  • IP: Static Anycast
  • Failover: Fast, no DNS delay
  • Clue: "static IP, non-HTTP"

Route 53

  • Layer: DNS
  • Failover: Depends on TTL
  • Clue: "domain routing, geo/latency"

ALB

  • Layer: 7 (HTTP)
  • Targets: EC2/ECS/Lambda
  • Clue: "load balance servers"

API Gateway

  • Type: Managed API layer
  • Features: Throttling, API keys
  • Clue: "serverless API, throttling"

ECS on EC2

  • Mgmt: You manage EC2
  • Clue: "custom instance/GPU"

ECS on Fargate

  • Mgmt: AWS manages infra
  • Clue: "no server management"

IAM Role

  • Creds: Temporary (STS)
  • Clue: "temp creds, EC2β†’S3"

IAM User

  • Creds: Long-term
  • Clue: Rarely correct if Role possible

Snapshot

  • Scope: Single resource
  • Clue: "point-in-time, one volume"

AWS Backup

  • Scope: Centralized, cross-service
  • Clue: "centralized policy, multi-service"

Site-to-Site VPN

  • Connects: Network-to-network
  • Setup: Minutes
  • Clue: "on-prem network"

Client VPN

  • Connects: User-to-VPC
  • Setup: Minutes
  • Clue: "remote employees"

Direct Connect

  • Connects: Dedicated network
  • Setup: Weeks
  • Clue: "dedicated bandwidth"

SCP

  • Scope: Org/OU/Account
  • Grants access: Never

IAM Policy

  • Scope: Individual identity
  • Grants access: Yes

Security Hub

  • Function: Aggregates findings

GuardDuty

  • Function: Generates threat findings

Macie

  • Focus: Sensitive data (PII)

Inspector

  • Focus: Vulnerabilities (CVEs)

DataSync

  • Purpose: Scheduled transfer

Storage Gateway

  • Purpose: Ongoing hybrid access

DMS

  • Migrates: Databases

MGN

  • Migrates: Whole servers/VMs

Elastic Beanstalk

  • Control: Low (PaaS, AWS handles infra)
  • Clue: "quick deploy, minimal config"

Lightsail

  • Control: Low (bundled VPS)
  • Clue: "simple, predictable pricing, small workload"

EC2

  • Control: Full
  • Clue: "full control needed"

Athena

  • Purpose: Serverless SQL on S3
  • Clue: "ad-hoc query on data in S3"

Redshift

  • Purpose: Data warehouse
  • Clue: "complex BI joins, large-scale analytics"

Redshift Spectrum

  • Purpose: Query S3 from Redshift without loading
  • Clue: "query S3 data alongside Redshift tables"

2️⃣3️⃣ WHY AWS REJECTS THIS ANSWER

(Top 30 β€” expanded)

1. Need HA
❌ Read Replica β€” reads only, no failover
βœ… Multi-AZ

2. Need DR (region loss)
❌ Multi-AZ β€” AZ only, not region
βœ… Cross-Region (Global DB/Tables/CRR)

3. Need queue
❌ SNS β€” push, not pull queue
βœ… SQS

4. Need fan-out
❌ SQS β€” single consumer group
βœ… SNS

5. Need exactly-once + order
❌ SQS Standard β€” best-effort only
βœ… SQS FIFO

6. Need encryption
❌ Secrets Manager β€” that's for secrets
βœ… KMS

7. Need to store/rotate password
❌ Parameter Store β€” no native rotation
βœ… Secrets Manager

8. Need compliance drift detection
❌ CloudTrail β€” logs API calls only
βœ… AWS Config

9. Need "who did it"
❌ CloudWatch β€” metrics, not identity
βœ… CloudTrail

10. Need threat detection
❌ Inspector β€” CVEs, not live threats
βœ… GuardDuty

11. Need vulnerability scan
❌ GuardDuty β€” threats, not CVEs
βœ… Inspector

12. Need PII discovery
❌ GuardDuty/Inspector β€” no classification
βœ… Macie

13. Need central security dashboard
❌ GuardDuty alone β€” own findings only
βœ… Security Hub

14. Need transitive VPC routing
❌ VPC Peering β€” not transitive
βœ… Transit Gateway

15. Need dedicated bandwidth
❌ VPN β€” shared internet
βœ… Direct Connect

16. Need quick hybrid setup
❌ Direct Connect β€” weeks to provision
βœ… Site-to-Site VPN

17. Need free S3 private access
❌ Interface Endpoint β€” costs money
βœ… Gateway Endpoint

18. Need private access to Kinesis/SNS
❌ Gateway Endpoint β€” S3/DynamoDB only
βœ… Interface Endpoint

19. Need shared block storage, multi-AZ
❌ EBS Multi-Attach β€” same AZ only
βœ… EFS/FSx

20. Need cheapest archive
❌ Standard-IA β€” still ms access, pricier
βœ… Glacier Deep Archive

21. Need SCP to grant permission
❌ SCP β€” never grants, only restricts
βœ… IAM Policy

22. Need to cap 1 admin's perms
❌ SCP β€” org-wide, not single identity
βœ… Permissions Boundary

23. Need temp creds for EC2 app
❌ IAM User + keys β€” long-term, risky
βœ… IAM Role

24. Job runs >15 min
❌ Lambda β€” hard limit
βœ… Fargate/Batch/EC2

25. Need GPU in container
❌ Fargate β€” no custom AMI/GPU
βœ… EC2 launch type

26. Need automatic replay of a stream
❌ SQS β€” deletes after processing
βœ… Kinesis Data Streams

27. Need to right-size an EC2 fleet
❌ Trusted Advisor alone β€” limited, high-level checks
βœ… Compute Optimizer (ML-based, detailed)

28. Need consistent read-after-write on S3
❌ Assuming "eventual consistency" caveat still applies
βœ… S3 provides strong consistency for all ops since Dec 2020

29. Need Aurora that pauses to zero cost
❌ Aurora Serverless v2 β€” min 0.5 ACU, never zero
βœ… Aurora Serverless v1 (has true auto-pause)

30. Need to grant access despite an SCP deny
❌ Attaching a broader IAM policy β€” SCP still wins
βœ… Modify the SCP itself (deny always overrides allow)

2️⃣4️⃣ ARCHITECTURES (Vertical Flow)

Static Website 

User
 ↓
Route 53
 ↓
CloudFront (+WAF)
 ↓
S3 (Origin, OAC private)
Enter fullscreen mode Exit fullscreen mode

Why: Bucket stays private, edge caching = speed + cost savings.

Three-Tier Web App 

Users
 ↓
CloudFront
 ↓
Route 53
 ↓
ALB (public subnet)
 ↓
EC2/ASG (private subnet)
 ↓
RDS Multi-AZ (private, isolated)
Enter fullscreen mode Exit fullscreen mode

Why: Layered isolation, ALB spreads load across AZs, HA at DB tier.

Serverless App 

Client
 ↓
API Gateway
 ↓
Lambda
 ↓
DynamoDB
Enter fullscreen mode Exit fullscreen mode
  • S3 for assets, CloudWatch for logs

Why: Zero server mgmt, auto-scales, pay-per-use.

Event-Driven 

S3 Upload
 ↓
EventBridge
 β”œβ†’ Lambda (process)
 β”œβ†’ SQS (buffer)
 β””β†’ Step Functions (orchestrate)
Enter fullscreen mode Exit fullscreen mode

Why: Decoupled, independently scalable, resilient.

Microservices 

Client β†’ ALB
          β”œβ†’ ECS Orders (Fargate) β†’ DynamoDB
          β”œβ†’ ECS Payments (Fargate) β†’ Aurora
          β””β†’ ECS Shipping (Fargate) β†’ DynamoDB
Enter fullscreen mode Exit fullscreen mode

Why: Independent deploy/scale, Fargate = no host mgmt.

Hybrid Cloud 

On-Prem
 ↓ (Direct Connect - primary)
 ↓ (VPN - backup)
VPC
 ↓
Transit Gateway
 β”œβ†’ VPC-A
 β”œβ†’ VPC-B
 β””β†’ VPC-C
Enter fullscreen mode Exit fullscreen mode

Why: DX for bandwidth, VPN failover, TGW for scale.

DR β€” Warm Standby 

Region A (ACTIVE, 100%)
 ↕ Route 53 Failover
Region B (PASSIVE, 10% scale)

Aurora Write (A) β†’ Replication β†’ Aurora Read (B)
Enter fullscreen mode Exit fullscreen mode

Why: Fast recovery, cost-controlled standby.

DR β€” Active/Active 

Region A (ACTIVE) ←→ DynamoDB Global Tables ←→ Region B (ACTIVE)
        \                                          /
         Route 53 Latency Routing β†’ All Users
Enter fullscreen mode Exit fullscreen mode

Why: Near-zero RTO, both regions live.

Secure Enterprise VPC 

Internet
 ↓
IGW
 ↓
ALB (public subnet, SG:443)
 ↓
App Tier (private, SG: from ALB)
 ↓
DB Tier (isolated, no NAT/IGW)

Side: NAT GW (public) β€” outbound only
Side: VPC Flow Logs β†’ CloudWatch
Side: VPC Endpoints (S3/KMS/Secrets) β€” no NAT needed
Enter fullscreen mode Exit fullscreen mode

Why: Defense-in-depth, reduced attack surface + cost.

Data Lake 

Sources β†’ Kinesis Firehose β†’ S3 (raw)
                                ↓
                             Glue ETL
                                ↓
                          S3 (processed)
                          ↙    ↓    β†˜
                   Athena  Redshift  QuickSight

Governance layer: Lake Formation (across all of S3/Glue)
Enter fullscreen mode Exit fullscreen mode

Streaming Pipeline 

IoT/Clickstream
 ↓
Kinesis Data Streams β†’ Lambda (real-time)
 ↓
Kinesis Firehose β†’ S3 β†’ Athena/Redshift
Enter fullscreen mode Exit fullscreen mode

CI/CD Pipeline 

Dev push β†’ CodeCommit/GitHub
             ↓
        CodePipeline
             ↓
        CodeBuild (test/build)
             ↓
        CodeDeploy (Blue/Green or Canary)
             ↓
     EC2 / ECS / Lambda
             ↓
   CloudWatch Alarms β†’ auto-rollback on failure
Enter fullscreen mode Exit fullscreen mode

Why: Fully automated release, minimizes deployment risk.

IoT Pipeline 

Devices β†’ IoT Core (MQTT)
             ↓
        IoT Rules Engine
        β”œβ†’ Kinesis Data Streams (real-time)
        β”œβ†’ Lambda (process/alert)
        β””β†’ S3/Timestream (storage)
Enter fullscreen mode Exit fullscreen mode

Why: IoT Core handles device auth/connectivity at scale; Rules Engine routes without custom device-management code.

SaaS Multi-Tenant 

Tenant Requests β†’ CloudFront β†’ API Gateway β†’ Lambda
                                                 ↓
                              DynamoDB (partition key = tenant_id)
                              Cognito (tenant-aware user pools)
Enter fullscreen mode Exit fullscreen mode

Why: Fully serverless, scales per-tenant, cheap isolation via partition key.

2️⃣5️⃣ VOCABULARY 

Durable                β†’ won't be lost (S3)
Available              β†’ responsive when needed
Elastic                β†’ auto grow/shrink
Ephemeral              β†’ temp, lost on stop
Fault Tolerant         β†’ zero disruption
Highly Available       β†’ fast recovery, brief gap ok
Eventually Consistent  β†’ reads may lag briefly
Strongly Consistent    β†’ always latest write
Shared Responsibility  β†’ AWS=of cloud, You=in cloud
Immutable Infra        β†’ replace, don't patch
Serverless             β†’ no provisioning, auto-scale
Lift and Shift         β†’ rehost, minimal change
Replatform             β†’ small optimizations
Refactor               β†’ redesign cloud-native
Blue/Green             β†’ 2 envs, instant switch
Canary                 β†’ gradual traffic shift
Burstable              β†’ baseline + credits (T-family)
Idempotent             β†’ repeat = same result
Decoupled              β†’ no direct calls, via queue
Stateless              β†’ no session on instance
Stateful               β†’ retains session/context
Multi-tenant           β†’ shared infra, multiple customers
Defense in Depth       β†’ multiple security layers stacked
Loosely Coupled        β†’ failure isolation between components
Enter fullscreen mode Exit fullscreen mode

2️⃣6️⃣ LIMITS (Quick List)

⚠️ Verify before exam β€” quotas change.

  • Lambda max time: 15 min
  • Lambda /tmp: up to 10GB
  • SQS retention: 4 days default / 14 max
  • SQS msg size: 256 KB
  • S3 max object: 5 TB
  • EBS max volume: 64 TiB
  • EBS Multi-Attach: same AZ, io1/io2
  • DynamoDB item: 400 KB
  • Aurora max storage: 128 TB
  • RDS replicas: 5 / Aurora: 15
  • VPC per region: 5 (soft)
  • VPC CIDR: /16 to /28
  • SG rules: 60 in / 60 out
  • ALB target groups: 100
  • CFN resources/stack: 500
  • IAM policy size: 6144 chars
  • Route 53 health check interval: 10s (fast) / 30s (standard)
  • CloudFormation stack limit: 500 per account (soft)

2️⃣7️⃣ MEMORY TRICKS

🧠 Security Group = Stateful
β†’ "Guard remembers you"

🧠 NACL = Stateless
β†’ "Checks you again leaving"

🧠 S3 classes (hotβ†’cold)
β†’ "Sally Is In One Giant Igloo, Deeply frozen"

🧠 Route 53 policies
β†’ "Sillie Wabbits Like Failing, Geo Multiplying"

🧠 Multi-AZ vs Replica
β†’ "Availability=AZ, Reads=Replica"

🧠 DR cost ladder
β†’ "Budget People Want More"
(Backup→Pilot→Warm→Multi-Site)

🧠 Load Balancers
β†’ "Apps Need Gateways" (ALB/NLB/GWLB)

🧠 Messaging trio
β†’ "Queue Notifies Events" (SQS/SNS/EventBridge)

🧠 VPN vs DX
β†’ "VPN=Virtually instant, DX=Dedicated but delayed"

🧠 Snow Family
β†’ "Cone < Ball < Mobile"

🧠 GuardDuty/Inspector/Macie
β†’ "Guard=threats, Inspector=vulnerabilities, Macie=Mine data"

🧠 Gateway vs Interface
β†’ "Gateway=Gratis(free), Interface=Invoiced"

🧠 SCP vs IAM Policy
β†’ "SCP=Stop(ceiling), IAM=Issues permission"

🧠 Aurora Serverless v1 vs v2
β†’ "v1=Vanishes to zero, v2=never below point-5"

🧠 Well-Architected Pillars
β†’ "Old Sailors Rarely Perform Correctly Sober"
(Operational Excellence, Security, Reliability, Performance, Cost, Sustainability)

🧠 IAM Policy Evaluation
β†’ "Deny Always Wins" (explicit deny beats any allow)

🧠 Kinesis Family
β†’ "Streams Store, Firehose Flows, Analytics Analyzes"

2️⃣8️⃣ STAR RATINGS (Study Priority) 

β˜…β˜…β˜…β˜…β˜… Almost guaranteed:
EC2, S3, VPC, IAM, RDS/Aurora, Lambda, DynamoDB, ELB, Auto Scaling,
Multi-AZ vs Read Replica, S3 Storage Classes, Security Group vs NACL

β˜…β˜…β˜…β˜…β˜† Very common:
Route 53, CloudFront, SQS/SNS/EventBridge, KMS, CloudWatch/CloudTrail/Config,
VPN/Direct Connect/Transit Gateway, Gateway vs Interface Endpoint

β˜…β˜…β˜…β˜†β˜† Sometimes:
ECS/EKS/Fargate, GuardDuty/Inspector/Macie, AWS Backup/DRS, DMS/MGN/Snow Family,
Step Functions, Kinesis, Well-Architected Framework, Cost tools

β˜…β˜…β˜†β˜†β˜† Rare:
Redshift, Glue/Athena, Organizations/Control Tower/RAM, RDS Proxy, DAX,
Elastic Beanstalk, Lightsail, Lake Formation

β˜…β˜†β˜†β˜†β˜† Very rare:
Outposts, Wavelength, Local Zones, QLDB, Neptune, Timestream, OpsWorks
Enter fullscreen mode Exit fullscreen mode

2️⃣9️⃣ ⏰ LAST 30 MINUTES BEFORE THE EXAM

10 Golden Rules

  1. Managed > Self-managed, always, when tied.
  2. Multi-AZ = HA. Read Replica = Reads. Never confuse them.
  3. Multi-AZ β‰  DR. DR = Cross-Region.
  4. SCP restricts, never grants.
  5. Gateway Endpoint = S3/DynamoDB ONLY, free.
  6. VPC Peering is NOT transitive β€” use Transit Gateway.
  7. Lambda hard limit = 15 minutes.
  8. SQS Standard β‰  ordered/exactly-once β€” need FIFO.
  9. Aurora Serverless v2 does NOT scale to zero (v1 did).
  10. Explicit DENY always wins in IAM policy evaluation.

20 Limits to Remember

Lambda 15min Β· SQS 256KB/14days Β· S3 5TB Β· EBS 64TiB Β· DynamoDB 400KB item Β· Aurora 128TB Β· RDS 5 replicas / Aurora 15 Β· VPC 5/region Β· SG 60 rules Β· ALB 100 target groups Β· CFN 500 resources Β· IAM policy 6144 chars Β· EBS Multi-Attach same-AZ only Β· NACL evaluated lowest-number-first Β· Route53 health check 10s/30s Β· S3 multipart recommended >100MB Β· Aurora Serverless v2 min 0.5 ACU Β· VPC CIDR /16 to /28 Β· S3 strong consistency (all ops) Β· Well-Architected = 6 pillars.

30 Architectures to Recognize

Static site (S3+CF) Β· 3-tier (ALB+EC2+RDS) Β· Serverless (APIGW+Lambda+DynamoDB) Β· Event-driven (EventBridge+SQS+Lambda) Β· Microservices (ECS/EKS+Fargate) Β· Data lake (S3+Glue+Athena+Lake Formation) Β· Streaming (Kinesis) Β· Hybrid (DX+VPN+TGW) Β· Warm Standby DR Β· Active/Active DR Β· CI/CD pipeline Β· IoT pipeline Β· SaaS multi-tenant Β· Secure VPC Β· Multi-region DB (Aurora Global/DynamoDB Global Tables) Β· Cross-account resource sharing (RAM) Β· Centralized logging (CloudTrail org trail) Β· Landing zone (Control Tower) Β· Bastion-less access (SSM) Β· Blue/Green deploy Β· Canary deploy Β· Fan-out (SNS+SQS) Β· Cache-aside (ElastiCache) Β· DAX in front of DynamoDB Β· Global content delivery (CF+GA) Β· VPC endpoint-secured architecture Β· Centralized backup (AWS Backup) Β· WAF+Shield protected web app Β· RDS Proxy + Lambda Β· Cognito-secured mobile backend.

30 Traps

β†’ Section 23 in full (all 30 "Why AWS Rejects This Answer" entries).

Golden Rule Recap by Domain

Security (30% of exam): Least privilege, encryption by default, Roles over Users, defense in depth.

Resilience (26%): Multi-AZ for HA, Cross-Region for DR, decouple with queues/events.

Performance (24%): Right service for the workload pattern, caching where possible, serverless for spiky loads.

Cost (20%): Match pricing model to usage pattern, use storage lifecycle policies, right-size continuously.

🎯 Final Checklist

  • [ ] Read the last sentence first
  • [ ] Highlight the constraint keyword
  • [ ] Scan the Service Selection Matrix mentally
  • [ ] Watch for "NO SUCH THING" traps
  • [ ] Pick more managed/native/automated when tied
  • [ ] DR β†’ RTO/RPO ladder
  • [ ] Networking β†’ check direction + transitivity
  • [ ] IAM β†’ remember explicit deny always wins
  • [ ] Trust your first instinct

πŸ“Œ PREP TIME ALLOCATION 

70% β–“β–“β–“β–“β–“β–“β–“ Practice exams
20% β–“β–“      Review wrong answers
10% β–“       Re-read this sheet
Enter fullscreen mode Exit fullscreen mode

Go score 850+. πŸš€

Top comments (0)