Chayan Samanta

Posted on Jul 28 Edited on Aug 17

AWS Cheatsheet

#architecture #aws #cloud

🎯 AWS SAA-C03 COMPLETE MASTER STUDY GUIDE — FINAL EDITION

1️⃣ EXAM DOMAIN BREAKDOWN

Domain 1: Design Secure Architectures — 30%
IAM, KMS, Secrets Manager, VPC security, encryption, compliance

Domain 2: Design Resilient Architectures — 26%
Multi-AZ, DR strategies, decoupling, HA, backup

Domain 3: Design High-Performing Architectures — 24%
Compute selection, storage selection, database selection, caching, networking performance

Domain 4: Design Cost-Optimized Architectures — 20%
Storage classes, compute pricing models, cost tools

📌 Domain 1 + 2 = 56% of the exam. Security and resilience are NOT optional study areas.

Task Statement Cheat Sheet

Domain	Task Statement	Core Ask
1.1	Secure network architectures	SG/NACL/VPC layers
1.2	Secure compute/storage/DB	Encryption, IAM roles
1.3	Determine access controls	IAM, SCP, boundaries
1.4	Data security options	KMS, Secrets Manager
2.1	Scalable/loosely coupled	SQS/SNS/EventBridge
2.2	HA/fault tolerant	Multi-AZ, ASG, ELB
2.3	Disaster recovery	Backup, DRS, RTO/RPO
3.1	High-performing storage	S3 classes, EBS types
3.2	High-performing compute	EC2 families, Lambda
3.3	High-performing DB	Aurora, DynamoDB, DAX
3.4	High-performing networking	CloudFront, GA, Direct Connect
4.1	Cost-effective storage	Lifecycle, tiering
4.2	Cost-effective compute	Spot, RI, Savings Plans
4.3	Cost-effective DB	Aurora Serverless, read replicas
4.4	Cost monitoring	Cost Explorer, Budgets, CUR

2️⃣ EXAM FRAMEWORK

7 Steps:
1️⃣ Read the LAST sentence first
2️⃣ Find the REQUIREMENT
3️⃣ Find the CONSTRAINT
4️⃣ Highlight KEYWORDS
5️⃣ ELIMINATE impossible answers
6️⃣ COMPARE the final 2
7️⃣ Pick the BEST-PRACTICE answer

🧪 Worked Examples

📝 "...automatic failover, AZ outage, zero data loss, no app changes" → Eliminate ❌ Read Replica (async, manual) → ✅ RDS Multi-AZ
📝 "...serve video worldwide, lowest latency, signed URLs" → Eliminate ❌ Direct S3 (no edge cache) → ✅ CloudFront + S3 (OAC) + Signed URLs
📝 "...exactly once, exact order" → Eliminate ❌ SQS Standard, ❌ SNS → ✅ SQS FIFO
📝 "Nightly batch job, 2 hours, must not need patching, lowest cost, fault-tolerant" → Eliminate ❌ Lambda (>15min limit), ❌ On-Demand EC2 → ✅ AWS Batch on Spot / Fargate
📝 "Users worldwide need lowest latency access to a REST API backed by Lambda, with throttling" → Eliminate ❌ ALB alone → ✅ API Gateway (edge-optimized) + Lambda
📝 "500TB, 1 week deadline, 100Mbps line" → Eliminate ❌ DataSync (too slow) → ✅ Snowball Edge
📝 "Recover in under 1 minute, region failure, cost not a concern" → Eliminate ❌ Warm Standby → ✅ Multi-Site Active/Active
📝 "No EC2 in Sandbox OU should ever get a public IP, regardless of IAM permissions" → Eliminate ❌ Security Group → ✅ SCP
📝 "Ad-hoc SQL on 2 years of raw CSV in S3, no infra" → Eliminate ❌ Redshift (requires load) → ✅ Athena
📝 "On-prem VMware → EC2, minimal downtime, continuous replication until cutover" → Eliminate ❌ Snowball → ✅ MGN

3️⃣ THE AWS THINKING PROCESS

Managed > Self-managed
Serverless > Provisioned
Native AWS > 3rd-party
Automated > Manual
Least ops overhead wins ties
Elastic > Fixed capacity
Secure by default
HA by default (if "production")
Cost matched to workload pattern

⚠️ Override: Compliance/security beats cost/efficiency every time.

Tie-Breaker Priority Order

1. Does it meet the HARD constraint (RTO/RPO/compliance)? — disqualifies first
2. Is it the MOST managed option remaining?
3. Is it the MOST secure option remaining?
4. Is it the LOWEST cost option remaining?
5. Is it the option requiring the LEAST re-architecture?

4️⃣ WELL-ARCHITECTED FRAMEWORK

🏛️ The 6 Pillars

Pillar	Focus	Key Services	Keyword
Operational Excellence	Run/monitor/improve	CloudFormation, CloudWatch, Config, SSM	"automate", "IaC", "runbooks"
Security	Protect data/identities	IAM, KMS, GuardDuty, WAF, Shield, Macie	"least privilege", "defense in depth"
Reliability	Recover/scale	Multi-AZ, ASG, ELB, R53 health checks	"self-healing", "fault isolation"
Performance Efficiency	Use resources well	Lambda, DynamoDB, CloudFront	"elastic", "serverless", "right instance"
Cost Optimization	Avoid waste	Cost Explorer, Trusted Advisor, Savings Plans	"lowest cost", "right-sizing"
Sustainability	Minimize footprint	Managed services, region choice	"carbon footprint", "utilization"

🧠 "Old Sailors Rarely Perform Correctly Sober"

📌 Trap: "reduce carbon footprint" → managed services/consolidation, NOT a technical redesign.

Design Principles Cheat Sheet

Pillar	Core Design Principles
Operational Excellence	Perform ops as code, make frequent small reversible changes, refine procedures often, anticipate failure, learn from failure
Security	Strong identity foundation, traceability, security at all layers, automate best practices, protect data in transit/rest, keep people from data
Reliability	Auto-recover from failure, test recovery procedures, scale horizontally, stop guessing capacity, automate change
Performance	Democratize advanced tech, go global in minutes, serverless first, experiment often, mechanical sympathy
Cost	Adopt consumption model, measure efficiency, stop spending on undifferentiated heavy lifting, analyze/attribute spend
Sustainability	Understand impact, set goals, maximize utilization, anticipate/adopt efficient offerings

AWS Well-Architected Tool

Free service → self-review workload against the 6 pillars → generates improvement plan.
📝 "Structured, free way to review architecture against best practices" → Well-Architected Tool

🆕 AWS Artifact

On-demand access to AWS compliance reports (SOC, PCI, ISO) and to accept agreements (BAA for HIPAA).
📝 "Auditor needs AWS's SOC 2 report" → AWS Artifact

🆕 AWS Trusted Advisor + Personal Health Dashboard

Trusted Advisor — account-level best practice checks (cost/security/performance/fault tolerance/limits)
AWS Health Dashboard (Personal Health Dashboard) — personalized alerts about AWS events/maintenance affecting YOUR resources specifically (vs the public Service Health Dashboard which shows AWS-wide status)

📝 "Need proactive notification when an upcoming AWS maintenance event affects one of my specific EC2 instances" → AWS Health Dashboard, not the public status page

5️⃣ 🆕 AWS GLOBAL INFRASTRUCTURE BASICS

Region          → geographic area, fully isolated (≥3 AZs typically)
Availability Zone (AZ) → 1+ discrete data centers, isolated power/network/cooling, low-latency link to other AZs in region
Edge Location    → CloudFront/Route 53 cache points, far more numerous than regions
Regional Edge Cache → sits between edge locations and origin, larger cache, less frequently accessed content
Local Zone       → extension of a Region, closer to large population/industry centers, low latency for specific metros
Wavelength Zone  → embedded in telecom 5G network, ultra-low latency for mobile edge use cases

Choosing a Region — Common Exam Factors

Compliance/data residency (data must stay in-country) → pick specific region
Latency to end users → pick nearest region
Service availability → not all services in all regions
Cost → prices vary slightly by region

📝 "EU data protection law requires customer data never leaves EU soil" → pick an EU region, replicate only within EU, avoid global services that might replicate elsewhere without control (encrypt + control replication).

Availability Zone Math

Minimum recommended for HA = 2 AZs (most exam answers want this at minimum for "production")
Best practice = 3 AZs for maximum resilience
📝 "Design must survive loss of a single data center" → deploy across ≥2 AZs

6️⃣ SERVICE SELECTION MATRIX

7️⃣ FLOWCHART LOOKUP

Database? Relational→HA Multi-AZ / Reads Read Replica / Global Aurora Global DB / Unpredictable Aurora Serverless v2 || NoSQL→huge scale DynamoDB / with cache DAX / Graph Neptune / Time-series Timestream / Mongo-style DocumentDB / Ledger QLDB

Disaster Recovery? Cheapest, hours ok→Backup & Restore | ~10min RTO→Pilot Light | Minutes RTO→Warm Standby | Near-zero RTO→Multi-Site Active/Active | Continuous server-level replication→AWS DRS

IaC? AWS-native declarative→CloudFormation | Familiar programming language→CDK | Self-service for non-technical teams→Service Catalog | Full account automation→Control Tower

8️⃣ DISTRACTOR DICTIONARY

9️⃣ SERVICE FAMILIES

🗄️ Storage: S3 • EBS • EFS • FSx • Storage Gateway • AWS Backup • Snow Family
🗃️ Database: RDS • Aurora • DynamoDB • ElastiCache • Redshift • Neptune • Timestream • QLDB • DocumentDB
🌐 Networking: ALB • NLB • GWLB • CloudFront • Global Accelerator • VPN • Client VPN • Direct Connect • Transit Gateway • PrivateLink • Route 53 • IPAM • Network Firewall • Reachability Analyzer
🔐 Security: IAM • KMS • Secrets Manager • Parameter Store • GuardDuty • Inspector • Macie • Security Hub • WAF • Shield • CloudHSM • ACM • Cognito • IAM Identity Center • Access Analyzer • Directory Service • Detective • Firewall Manager
💻 Compute: EC2 • Lambda • ECS • EKS • Fargate • Batch • Elastic Beanstalk • Lightsail
🖥️ End-User Computing: WorkSpaces • AppStream 2.0
📨 Messaging: SQS • SNS • EventBridge • Step Functions • Kinesis • MSK • AppSync
📊 Monitoring: CloudWatch • CloudTrail • Config • X-Ray • Trusted Advisor • Compute Optimizer • Health Dashboard
🚚 Migration: DMS • MGN • DataSync • Storage Gateway • Snow Family • Transfer Family • Migration Hub • Application Discovery Service
📈 Analytics: Athena • Glue • EMR • Redshift • QuickSight • Lake Formation • Kinesis family • OpenSearch
💰 Cost: Cost Explorer • AWS Budgets • CUR • Trusted Advisor • Compute Optimizer • Savings Plans • License Manager
🌍 Edge/Hybrid: Outposts • Local Zones • Wavelength • Direct Connect
🏛️ Governance: Organizations • Control Tower • RAM • Service Catalog • Config Conformance Packs • Artifact
🔧 Dev Tools: CodeCommit • CodeBuild • CodeDeploy • CodePipeline

🔟 SERVICE SYNONYMS

1️⃣1️⃣ AWS DEFAULT CHOICES

1️⃣2️⃣ ONE-LINE DEFINITIONS

CloudTrail     → Who did it?
CloudWatch     → How is it performing?
Config         → What changed?
GuardDuty      → Who is attacking?
Inspector      → What is vulnerable?
Macie          → Where is sensitive data?
Security Hub   → What's the overall security posture?
Detective      → WHY did this happen? (root cause investigation)
Firewall Manager → Centralize WAF/SG/Shield rules across accounts
Network Firewall → Stateful, VPC-level traffic filtering
WAF            → Block bad web requests
Shield         → Block DDoS floods
KMS            → Manage encryption keys
Secrets Mgr    → Store & rotate secrets
Param Store    → Store plain config
SQS            → Hold messages until processed
SNS            → Broadcast to many subscribers
EventBridge    → Route events by rule
Step Functions → Orchestrate multi-step workflow
Multi-AZ       → Survive AZ failure (HA)
Read Replica   → Scale read traffic
Aurora Global DB → Cross-region reads + fast DR
Transit Gateway → Hub for many VPCs
VPC Peering    → Direct link between 2 VPCs (non-transitive)
Gateway Endpoint → Free private path to S3/DynamoDB only
Interface Endpoint → Private path to everything else
Direct Connect → Dedicated, consistent bandwidth
VPN            → Quick, encrypted, internet-based link
Trusted Advisor → Automated best-practice checks
Compute Optimizer → Right-size your EC2/Lambda
Cost Explorer  → Analyze/forecast spend
AWS Budgets    → Alert before overspending
Elastic Beanstalk → Deploy app without managing infra
Lightsail      → Simple VPS, predictable pricing
Lake Formation → Central data lake governance
Cognito User Pools → Sign-up/sign-in for your app's users
Cognito Identity Pools → Temp AWS creds for federated users
API Gateway    → Managed front door for APIs (throttle, auth, cache)
Outposts       → AWS hardware physically in your data center
Local Zones    → AWS infra closer to a metro area
Wavelength     → AWS compute at telecom 5G edge
WorkSpaces     → Managed virtual desktop (persistent)
AppStream 2.0  → Streamed applications (non-persistent)
AWS DRS        → Continuous server replication for DR (near-CDP)
IAM Identity Center → One login for all AWS accounts + SaaS apps
Access Analyzer → Finds resources shared outside your account/org
Service Catalog → Curated self-service list of approved AWS products
License Manager → Track/enforce software license usage
AppSync        → Managed GraphQL API w/ real-time subscriptions
IPAM           → Plan/track/audit IP address usage across accounts
CDK            → Define infra using real programming languages
Control Tower  → Automates multi-account landing zone setup
ElastiCache    → Managed in-memory cache (Redis/Memcached)
DAX            → In-memory cache specifically for DynamoDB
Reachability Analyzer → Diagnoses why two resources can't connect
Artifact       → On-demand access to AWS compliance reports
Health Dashboard → Personalized alerts about AWS events affecting YOUR resources

1️⃣3️⃣ QUESTION PATTERNS

📝 "A company wants..." → Architecture question
📝 "A company needs..." → Service selection
📝 "A company must..." → Compliance/security
📝 "An application..." → Compute/storage/DB
📝 "Developers need..." → IAM / CI-CD
📝 "...LEAST operational overhead" → Most-managed option
📝 "...LOWEST cost" → Check workload pattern
📝 "MOST secure way" → Encryption + least privilege
📝 "MOST resilient" → Multi-AZ / Multi-Region
📝 "Without re-architecting" → Keep relational/EC2
📝 "Minimize administrative burden" → Managed service
📝 "Reduce carbon footprint" → Managed services / consolidate regions
📝 "...with the LEAST amount of code" → Managed integration over custom Lambda glue
📝 "...must be encrypted using keys the company fully controls" → KMS Customer Managed Key
📝 "...must not leave AWS network" → PrivateLink / VPC Endpoints
📝 "...single pane of glass" → Security Hub / CloudWatch Dashboards
📝 "...at a specific point in time in the past" → Snapshot / PITR
📝 "...choose TWO/THREE" → read carefully, ALL must be correct, no partial credit
📝 "...MOST cost-effective AND meets requirement" → eliminate non-compliant options FIRST, then pick cheapest survivor

1️⃣4️⃣ DECISION TREES

(⚠️ = "NO SUCH THING" trap)

Storage

Block,1 instance→EBS ⚠️shared across AZs→NO→EFS/FSx | Block,shared,same AZ→EBS Multi-Attach(io1/io2) ⚠️cross-AZ→NO | Shared Linux→EFS | Shared Windows→FSx Windows | HPC scratch→FSx Lustre | NetApp→FSx ONTAP | Object→S3 ⚠️low-latency file access at scale→NO→EFS/FSx | On-prem cached vol→Storage Gateway | Migrate/sync→DataSync(online)/Snowball(offline)

Compute

Database

Relational, specific engine→RDS | Relational MySQL/Postgres→Aurora(Serverless v2 if spiky) ⚠️scale to zero in v2→NO(min 0.5 ACU) | Need HA→Multi-AZ ⚠️standby serves reads→NO→Read Replica/Aurora | Need read scaling→Read Replica ⚠️auto failover from replica→NO→Multi-AZ | Cross-region reads+DR→Aurora Global DB | Lambda+RDS pooling→RDS Proxy | NoSQL massive scale→DynamoDB ⚠️SQL joins→NO→Aurora/RDS | DynamoDB+μs cache→DAX | Multi-region active-active NoSQL→DynamoDB Global Tables | In-memory cache, general purpose→ElastiCache | Data warehouse→Redshift | Graph→Neptune | Time-series→Timestream | Immutable ledger→QLDB | Mongo-compatible→DocumentDB

Networking & Hybrid

Public subnet in/out→IGW | Private subnet outbound only→NAT Gateway ⚠️NAT for inbound→NO→ALB/NLB | On-prem quick+encrypted→Site-to-Site VPN | Individual remote users→Client VPN | Dedicated bandwidth→Direct Connect | Many VPCs hub-spoke→Transit Gateway | 2 VPCs simple→VPC Peering ⚠️transitive routing→NO→Transit Gateway | Free private S3/DDB→Gateway Endpoint ⚠️for EC2/SNS etc→NO→Interface Endpoint | Private other AWS/SaaS→Interface Endpoint | Expose service privately→PrivateLink | Global static IP non-HTTP→Global Accelerator | Content caching→CloudFront | Share subnets across accounts→VPC Sharing (RAM) | Plan IP space org-wide→IPAM | Inline stateful firewall at VPC edge→Network Firewall | Debug why traffic isn't reaching target→Reachability Analyzer

Security & IAM

Messaging

Point-to-point decoupling→SQS Standard ⚠️order/exactly-once→NO→FIFO | Fan-out→SNS ⚠️fan-out w/ SQS alone→NO→SNS+SQS | Rule-based routing→EventBridge | Multi-step workflow→Step Functions | Real-time+replay→Kinesis Data Streams ⚠️replay from SQS→NO(deleted after ack) | Buffered delivery→Kinesis Firehose | Real-time GraphQL updates→AppSync

Disaster Recovery (RTO/RPO ladder)

Hours-days, cheapest→Backup & Restore | ~10min→Pilot Light | Minutes→Warm Standby | Near-zero→Multi-Site Active/Active | Continuous block-level server replication→AWS Elastic Disaster Recovery (DRS)
⚠️ Multi-AZ covers region failure→NO(Multi-AZ≠DR)→Cross-Region

Migration

PB-scale, poor network→Snowball/Snowmobile | Ongoing scheduled transfer→DataSync | SFTP into S3/EFS→Transfer Family | Migrate databases, SAME engine→DMS | Migrate databases, DIFFERENT engine→DMS+SCT ⚠️DMS migrates VMs→NO(DB only)→MGN | Lift-shift servers→MGN | On-prem, cloud storage as local drive→Storage Gateway | Discover on-prem infra first→Application Discovery Service | Track migration progress→Migration Hub

IaC / Governance

Declarative AWS-native template→CloudFormation | Prefer Python/TypeScript/Java→CDK | Give teams pre-approved self-service products→Service Catalog | Automate multi-account setup w/ guardrails→Control Tower | Share VPC subnets/TGW cross-account→RAM

1️⃣5️⃣ VPC DEEP DIVE

CIDR & Subnetting

VPC CIDR: /16 to /28
Each subnet lives in exactly ONE AZ
AWS reserves 5 IPs per subnet (first 4 + last 1)
Public subnet = route to IGW | Private subnet = no direct route to IGW

🆕 Subnet Sizing Math (commonly tested)

/24 subnet = 256 total IPs - 5 reserved = 251 usable
/28 subnet = 16 total IPs - 5 reserved = 11 usable
Formula: usable IPs = 2^(32-prefix) - 5

📝 "Need a subnet supporting at least 20 hosts" → smallest CIDR that fits = /27 (32 - 5 = 27 usable)

Route Tables

Each subnet → ONE route table (a route table can serve many subnets)
Local route (VPC CIDR) always present, can't be removed
Most specific route wins (longest prefix match)

Security Group vs NACL

	Security Group	NACL
Level	Instance (ENI)	Subnet
State	Stateful	Stateless (must allow both directions)
Rules	Allow only	Allow AND Deny
Evaluation	All rules evaluated	Lowest number first, first match wins
Default	Deny all in, allow all out	Default NACL=allow all / Custom=deny all

📌 Trap: NACL is stateless → must explicitly allow EPHEMERAL PORTS (1024-65535) for return traffic.

NAT Gateway vs NAT Instance

	NAT Gateway	NAT Instance
Managed	Yes (AWS)	No (you patch it)
HA	Built into AZ, multi-AZ needs one per AZ	Manual (ASG needed)
Bandwidth	Scales automatically	Limited by instance type
Security Group	N/A (doesn't have one)	Has one, can act as bastion
Exam default	✅ Always pick this	Rare legacy answer

🆕 NAT Gateway HA Design Pattern

NAT Gateway is per-AZ, NOT automatically multi-AZ
📝 "Design NAT for HA across 3 AZs" → deploy ONE NAT Gateway PER AZ, each private subnet routes to the NAT Gateway in ITS OWN AZ (avoids cross-AZ data transfer charges + single point of failure)

Elastic IP vs ENI

Elastic IP — static public IPv4, can be remapped between instances, charged when NOT attached to a running instance (common cost trap)
ENI — virtual network card, can have multiple per instance, can be detached/reattached (used for failover architectures)

VPC Flow Logs

Capture IP traffic metadata (not payload)
Publish to CloudWatch Logs, S3, or Kinesis Data Firehose
Used by GuardDuty as a data source
Doesn't capture: DHCP traffic, Windows license activation, traffic to 169.254.169.254 (metadata)

VPC Peering Limits

NOT transitive · No overlapping CIDRs · Cross-region OK · Cross-account OK

VPC Endpoint Types Recap

Gateway Endpoint — S3, DynamoDB only, free, route table entry
Interface Endpoint (PrivateLink) — everything else, hourly+data cost, ENI with private IP

🆕 VPC Sharing (RAM)

Owner account shares subnets with other accounts in same Organization. Participants launch resources into shared subnets but can't modify the subnet itself.
📝 "Centralize VPC management but let 5 dev teams deploy into the same subnets" → VPC Sharing via RAM

🆕 IPAM (IP Address Manager)

Plans, tracks, audits IP usage across accounts/regions.
📝 "Prevent CIDR overlaps across 200 VPCs" → IPAM

🆕 IPv6 Notes

VPC can be dual-stack | IPv6 addresses are always public — use Egress-Only Internet Gateway for outbound-only IPv6 (IPv6 equivalent of NAT Gateway)

🆕 VPC Traffic Mirroring

Copies network traffic from an ENI for inspection (IDS/IPS, troubleshooting) without disrupting flow.

🆕 AWS Network Firewall

Managed, stateful, VPC-level network firewall — deep packet inspection, intrusion prevention (IPS), domain filtering.
📝 "Need stateful firewall rules AND intrusion prevention at the VPC perimeter, not just per-instance SGs" → AWS Network Firewall

Different from GWLB — Network Firewall IS an AWS-managed appliance; GWLB is for routing to 3rd-party appliances.

🆕 VPC Reachability Analyzer

Static configuration analysis tool — tells you WHY two resources can/can't communicate (checks SG, NACL, route tables) without sending live traffic.
📝 "EC2 instance in subnet A can't reach RDS in subnet B, need to know exactly which rule is blocking it" → Reachability Analyzer

🆕 AWS Firewall Manager

Centrally manage WAF rules, Security Groups, Shield Advanced protections, and Network Firewall policies across multiple accounts in an Organization.
📝 "Apply the same WAF rule to every ALB across 40 accounts automatically, including new accounts" → Firewall Manager

1️⃣6️⃣ IAM DEEP DIVE

Policy Types

Identity-based — attached to user/group/role
Resource-based — attached to a resource (e.g., S3 bucket policy)
Permissions boundary — MAX permissions for ONE identity
SCP — MAX permissions for an account/OU
Session policy — passed at role-assumption time, further restricts

Policy Evaluation Order (memorize)

Explicit DENY anywhere → immediately denied
Explicit ALLOW required somewhere
Default = DENY if nothing matches

📌 Explicit DENY always wins, no matter how many ALLOWs exist.

Effective Permissions Formula

Effective permissions =
  Identity-based policy
  ∩ Permissions Boundary (if set)
  ∩ SCP (if in an Organization)
  ∩ Resource-based policy (if applicable)

(∩ = most restrictive wins)

📌 Trap: S3FullAccess IAM policy does NOTHING if an SCP denies S3 at OU level.

Best Practices

Never use root for daily tasks · Enable MFA everywhere privileged
IAM Roles for EC2/Lambda, never embedded keys
Least privilege, expand only when needed
IAM Access Analyzer → find overly permissive policies
Roles > rotating credentials

IAM Identity Center (formerly AWS SSO)

Central place to manage workforce access across ALL AWS accounts + SaaS apps. Integrates with external IdP (Okta, Azure AD) or built-in directory.
📝 "1000 employees need SSO across 50 AWS accounts and 3 SaaS apps" → IAM Identity Center

IAM Access Analyzer

Continuously analyzes resource policies to find access granted to external entities.
📝 "Find any S3 bucket accidentally accessible from outside the organization" → IAM Access Analyzer

AWS Directory Service Options

Option	Use Case
AWS Managed Microsoft AD	Full AD features, trust relationships with on-prem AD
AD Connector	Proxy/redirect to existing on-prem AD (no user data stored in AWS)
Simple AD	Basic AD-compatible directory, small scale, no trusts

📝 "Need AWS resources to authenticate against existing on-prem Active Directory without duplicating users" → AD Connector

STS (Security Token Service)

Issues temporary credentials for role assumption, federation, cross-account access. Key APIs: AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity.

🆕 Cross-Account Role Assumption Pattern

Account A (User) → sts:AssumeRole → Account B (Role w/ Trust Policy allowing Account A)
→ Temp credentials → Access Account B resources

📝 "Central security team in Account A needs read-only access to audit logs in 30 member accounts" → IAM Role in each account with trust policy to Account A + AssumeRole

🆕 Federation Types

SAML 2.0        → enterprise IdP (Active Directory Federation Services, Okta) → AssumeRoleWithSAML
Web Identity    → social login (Google, Facebook, Amazon) → AssumeRoleWithWebIdentity (or Cognito, preferred)
Cognito         → preferred method for mobile/web app federation → Identity Pools

1️⃣7️⃣ S3 DEEP DIVE

Consistency

✅ Strong read-after-write consistency for ALL operations (since Dec 2020).

Versioning

Once enabled, can only be suspended (not disabled)
Protects against accidental overwrite/delete
Combine with MFA Delete for extra protection

Replication (CRR/SRR)

CRR = different region (DR/compliance/latency) | SRR = same region (log aggregation/compliance)
Requires versioning on both buckets
NOT retroactive (unless S3 Batch Replication)

Lifecycle Policies

Common pattern: Standard → Standard-IA (30d) → Glacier (90d) → Deep Archive (180d) → Delete (365d)

Storage Classes

Class	Access	Retrieval
Standard	Frequent	ms
Intelligent-Tiering	Unknown/changing	ms (auto-moves)
Standard-IA	Infrequent	ms
One Zone-IA	Infrequent, non-critical	ms
Glacier Instant Retrieval	Archive, need fast	ms
Glacier Flexible	Archive	mins-hours
Glacier Deep Archive	Archive, cheapest	~12hrs

Advanced Features

Object Lock — WORM compliance
Object Lambda — transform on retrieval
Multi-Region Access Points — single global endpoint
Transfer Acceleration — speeds up uploads via edge locations
Access Points — simplify shared-bucket access management
Static Website Hosting — S3 can serve a website directly (but no HTTPS without CloudFront)
Presigned URLs — temporary access to private objects without changing bucket policy

CloudFront + S3 Access Control

OAC (Origin Access Control) — current best-practice, keeps S3 bucket private, only CloudFront can read
OAI (Origin Access Identity) — legacy, still tested, same purpose as OAC

S3 Select / Glacier Select

Retrieve a SUBSET of data using SQL, instead of downloading the whole object.
📝 "App only needs 3 columns from a 10GB CSV, minimize transfer/cost" → S3 Select

S3 Batch Operations

Perform bulk actions (copy, tag, restore, invoke Lambda) across billions of objects in one job.
📝 "Apply a new tag to 2 billion existing objects" → S3 Batch Operations

S3 Event Notifications

Trigger Lambda/SQS/SNS on object create/delete/restore events.
📝 "Automatically process an image the moment it's uploaded" → S3 Event Notification → Lambda

🆕 Bucket Policy vs ACL vs IAM Policy

	Attached To	Grants Cross-Account?	Modern Best Practice?
IAM Policy	User/Role	No (same account)	✅ Yes
Bucket Policy	The bucket itself	✅ Yes	✅ Yes
ACL (Access Control List)	Bucket or Object	✅ Yes (legacy)	❌ Legacy, avoid

📝 "Grant read access to a bucket from a DIFFERENT AWS account" → Bucket Policy (or Access Point), not IAM policy alone

📌 AWS now recommends disabling ACLs entirely (Bucket Owner Enforced setting) and using policies only.

🆕 S3 Cross-Account Access Pattern

Account A (bucket owner) → Bucket Policy allows Account B's role
Account B → IAM Policy allows s3:GetObject on that bucket ARN
BOTH must allow → effective access

🆕 Requester Pays

Bucket owner can shift data transfer/request costs to whoever downloads objects — useful for public datasets shared broadly.
📝 "Publish a large public dataset but don't want to pay everyone else's download costs" → S3 Requester Pays

1️⃣8️⃣ 🆕 RDS & AURORA DEEP DIVE

RDS Backup Types

	Automated Backups	Manual Snapshots
Trigger	Daily, automatic, during backup window	On-demand, user-initiated
Retention	1-35 days	Until manually deleted
Deleted with instance?	✅ Yes (unless final snapshot taken)	❌ No, persists
Cross-region copy	✅ Supported	✅ Supported
Cross-account share	❌ No	✅ Yes

📝 "Need to retain a specific backup indefinitely even after the DB instance is deleted" → Manual Snapshot
📝 "Need point-in-time restore to any second within the last 2 weeks" → Automated Backups (enables PITR)

RDS Encryption Rules (frequently tested trap)

⚠️ Cannot enable encryption on an existing UNENCRYPTED RDS instance directly
✅ Workaround: Snapshot the unencrypted instance → Copy the snapshot WITH encryption enabled → Restore new (encrypted) instance from that snapshot 📝 "Existing unencrypted RDS instance must become encrypted with minimal effort" → Snapshot → Copy (encrypt) → Restore

RDS Multi-AZ vs Multi-AZ DB Cluster (newer)

	Multi-AZ Instance	Multi-AZ DB Cluster
Standby readable?	❌ No	✅ Yes (readable replicas)
Failover time	~60-120 sec	Faster (~35 sec), uses replicas
Replicas	0 (standby only)	2 readable standbys

RDS Proxy

Connection pooling for Lambda/serverless apps hitting RDS — prevents connection exhaustion, faster failover.
📝 "Lambda functions spike to thousands of concurrent executions, RDS running out of connections" → RDS Proxy

Aurora-Specific Features

Aurora Replicas         → up to 15, low replication lag (~10-20ms), can auto-failover (unlike RDS Read Replicas)
Aurora Cloning          → fast, copy-on-write clone of a DB for testing, doesn't copy full storage
Backtrack               → rewind a cluster to a previous point in time WITHOUT restoring from backup (MySQL-compatible only)
Custom Endpoints        → route specific queries to a defined subset of Aurora instances
Writer/Reader Endpoint  → writer=single instance, reader=load-balanced across all replicas
Global Database         → 1 primary region (write) + up to 5 secondary regions (read), <1s lag, fast regional failover

📝 "Need to quickly test schema changes against a copy of production data without doubling storage cost" → Aurora Cloning
📝 "Accidentally ran a bad DELETE, need to rewind the DB in seconds without a full restore" → Aurora Backtrack

Aurora Serverless v1 vs v2

	v1	v2
Scale to zero	✅ Yes	❌ No (min 0.5 ACU)
Scaling speed	Seconds-minutes (cold start possible)	Fast, fine-grained, near-instant
Use case	Infrequent, intermittent workloads	Variable/unpredictable but still active

📝 "Dev/test database used a few hours a week, must have zero cost when idle" → Aurora Serverless v1
📝 "Production workload with unpredictable but continuous traffic" → Aurora Serverless v2

🆕 RDS Read Replica Cross-Region

Read Replicas CAN be cross-region (unlike Multi-AZ standby) — useful for disaster recovery + reducing read latency for global users.
📝 "Reduce read latency for users in Asia while primary DB is in US" → Cross-Region Read Replica

1️⃣9️⃣ 🆕 DYNAMODB DEEP DIVE

Indexes

	GSI	LSI
Key structure	New partition + sort key	Same partition, different sort key
Created when	Anytime	ONLY at table creation
Consistency	Eventually consistent only	Strong or eventual
Max per table	20 (default)	5

📝 "Need to query by an attribute that's not part of the primary key, added after table creation" → GSI
📝 "Need strongly consistent reads on an alternate sort key" → LSI (must be planned at table creation!)

DynamoDB Streams

Captures item-level changes (insert/update/delete) → triggers Lambda for real-time processing.
📝 "React in real-time to every item change, trigger downstream processing" → DynamoDB Streams + Lambda

TTL (Time to Live)

Auto-deletes expired items at no additional cost.
📝 "Session data should auto-expire after 24 hours, zero extra cost" → DynamoDB TTL

Capacity Modes

	On-Demand	Provisioned
Best for	Unpredictable/spiky traffic	Steady, predictable traffic
Scaling	Automatic	Manual or Auto Scaling
Cost model	Pay per request	Pay for provisioned capacity

Hot Partition Problem

⚠️ Poor partition key choice (e.g., using a low-cardinality attribute like "status") → throttling on that partition even with capacity available elsewhere.
✅ Fix: choose a high-cardinality partition key (e.g., user ID), not add more capacity.
📝 "DynamoDB table throttles despite having available overall capacity" → Redesign partition key (not "increase provisioned capacity")

PITR (Point-in-Time Recovery)

Continuous backups, restore to any second within the last 35 days.
📝 "Need to restore a DynamoDB table to exactly 3 days ago at 2:14pm" → PITR

Conditional Writes

Prevent race conditions on concurrent updates (e.g., attribute_not_exists).

🆕 DynamoDB Accelerator (DAX)

Fully managed, in-memory cache for DynamoDB — microsecond latency, write-through cache.
📝 "DynamoDB read-heavy workload needs microsecond response times without app code rewrite for cache logic" → DAX

⚠️ DAX is API-compatible — minimal code change vs building your own ElastiCache caching layer.

2️⃣0️⃣ 🆕 ELASTICACHE DEEP DIVE

Redis vs Memcached (HIGH-YIELD comparison)

Feature	Redis	Memcached
Persistence	✅ Yes (snapshots/AOF)	❌ No
Replication	✅ Yes (Multi-AZ)	❌ No
Data structures	Rich (lists, sets, sorted sets, hashes)	Simple key-value only
Multi-threading	Single-threaded (mostly)	✅ Multi-threaded
Backup/Restore	✅ Yes	❌ No
Pub/Sub	✅ Yes	❌ No
Transactions	✅ Yes	❌ No
Use case	Leaderboards, session store, HA cache needing durability	Simple, high-throughput cache, easily rebuilt

📝 "Need a cache that persists data and supports automatic failover" → Redis
📝 "Need pure simple caching, data loss acceptable, want to scale horizontally across many nodes easily" → Memcached
📝 "Need a leaderboard with sorted rankings" → Redis (Sorted Sets)

🧠 "Redis Remembers (persists), Memcached Might forget."

Caching Strategies

Pattern	How It Works	Trade-off
Lazy Loading (Cache-Aside)	App checks cache, on miss queries DB then populates cache	Cache can go stale, only caches requested data
Write-Through	Data written to cache AND DB simultaneously	Cache always fresh, but write penalty + wasted cache space for unused data

📝 "Cache should stay current with DB writes, and app can accept slightly slower writes" → Write-Through
📝 "Only cache what's actually requested to save memory" → Lazy Loading

2️⃣1️⃣ 🆕 KMS & ENCRYPTION DEEP DIVE

Envelope Encryption

KMS doesn't directly encrypt large data — it encrypts a Data Encryption Key (DEK), which encrypts your actual data. This is how S3/EBS/RDS encryption works under the hood.

Plaintext Data + DEK → Ciphertext
DEK + KMS CMK → Encrypted DEK (stored alongside ciphertext)

CMK Types

Type	Who Manages	Rotation	Use Case
AWS Managed Key (aws/s3, aws/ebs)	AWS	Automatic, AWS-controlled schedule	Default, simplest, no customization
Customer Managed Key (CMK)	You	Optional automatic annual rotation (you enable)	Full control: policy, rotation, deletion, cross-account sharing
AWS Owned Key	AWS (shared across accounts, invisible to you)	AWS-controlled	Some AWS service internals

📝 "Must fully control key policy, rotation schedule, and be able to disable/delete the key" → Customer Managed Key
📝 "Just needs encryption at rest, doesn't care about key management" → AWS Managed Key (SSE-S3 or default)

Key Policies vs Grants

Key Policy — resource-based policy, primary access control mechanism for a CMK (required, even if IAM also allows)
Grants — temporary, programmatic delegated permissions (used by AWS services needing short-term key access)

Multi-Region Keys

Same key material replicated across regions — used for Global Tables, Aurora Global DB, or multi-region DR needing consistent encryption without re-encrypting.
📝 "Encrypt data consistently across DynamoDB Global Tables in 3 regions using related keys" → KMS Multi-Region Keys

Asymmetric CMKs

Used for digital signing/verification (not just encrypt/decrypt) — e.g., verifying software integrity.

Encryption in Transit vs At Rest

	At Rest	In Transit
Mechanism	KMS/SSE encryption on storage	TLS/SSL
Services	S3 (SSE-S3/KMS), EBS, RDS	ACM certs on ALB/CloudFront, VPN, HTTPS

📝 "Data must be encrypted both while stored AND while moving between services" → KMS (at rest) + TLS/ACM (in transit) — both required, not either/or

Secrets Manager vs Parameter Store — Full Comparison

	Secrets Manager	Parameter Store (Standard)	Parameter Store (Advanced)
Automatic rotation	✅ Native (Lambda-based)	❌ No	❌ No (needs custom automation)
Cost	$$ per secret/month	Free	$ small monthly fee
Max size	64KB	4KB	8KB
Cross-account	✅ Via resource policy	Limited	Limited
Native integration	RDS, Redshift, DocumentDB	General config	General config

📝 "Store DB password AND automatically rotate it every 30 days" → Secrets Manager
📝 "Store a non-sensitive API endpoint URL, free of charge" → Parameter Store (Standard)

2️⃣2️⃣ 🆕 CLOUDFRONT DEEP DIVE

Signed URL vs Signed Cookie

	Signed URL	Signed Cookie
Scope	ONE file	MULTIPLE files/whole site
Use case	Single video/document download	Video streaming site with many assets per session

📝 "User needs access to an entire private video library during their session, not just one file" → Signed Cookies
📝 "Grant temporary access to ONE private PDF" → Signed URL

Origin Failover (Origin Groups)

Primary + secondary origin — CloudFront automatically fails over to secondary if primary fails/returns errors.
📝 "Need automatic failover to a backup S3 bucket in another region if primary origin is down" → CloudFront Origin Groups

Lambda@Edge vs CloudFront Functions

	CloudFront Functions	Lambda@Edge
Language	JavaScript only	Node.js/Python
Trigger points	Viewer request/response only	All 4 (viewer/origin request/response)
Execution	Lightweight, microseconds	Heavier, up to seconds
Use case	Simple header manipulation, redirects	Complex logic, external calls, A/B testing

📝 "Modify HTTP headers at the edge with minimal latency, simple logic only" → CloudFront Functions
📝 "Need to call an external API or do complex request transformation at the edge" → Lambda@Edge

Field-Level Encryption

Encrypts specific sensitive fields (e.g., credit card numbers) end-to-end, even the origin only sees ciphertext unless it holds the private key.

Cache Behaviors

Path-pattern based routing to different origins within a single distribution (e.g., /images/* → S3, /api/* → ALB).

🆕 Geo Restriction

Block or allow access to your CloudFront distribution based on viewer's country (allowlist/denylist) — simpler than Route 53 Geolocation for pure content blocking.
📝 "Content must not be accessible from specific embargoed countries" → CloudFront Geo Restriction

2️⃣3️⃣ 🆕 LAMBDA DEEP DIVE

Concurrency Controls

Feature	Purpose
Reserved Concurrency	Guarantees AND caps capacity for a function (throttles beyond limit)
Provisioned Concurrency	Pre-warmed execution environments — eliminates cold starts

📝 "Latency-sensitive API cannot tolerate cold-start delay" → Provisioned Concurrency
📝 "Ensure one noisy function can't consume all account-wide concurrency, starving others" → Reserved Concurrency

Cold Starts

VPC-attached Lambdas historically had slower cold starts (ENI attachment) — significantly improved with Hyperplane ENIs, but still a testable concept when comparing VPC vs non-VPC Lambda.

Lambda Layers

Share code/libraries across multiple functions without duplicating in each deployment package.
📝 "Share a common logging library across 20 Lambda functions" → Lambda Layers

Lambda Destinations vs DLQ

	DLQ	Destinations
Captures	Failed async invocations only	Success AND failure
Targets	SQS, SNS	SQS, SNS, EventBridge, another Lambda

📝 "Need to route BOTH successful and failed async Lambda results to different downstream targets" → Lambda Destinations

Environment Variables

Can be encrypted with KMS for sensitive values (though Secrets Manager/Parameter Store preferred for actual secrets).

🆕 Lambda SnapStart

Pre-initializes a snapshot of the execution environment (JVM state) to dramatically reduce cold starts for Java functions specifically.

2️⃣4️⃣ 🆕 MESSAGING DEEP DIVE (SQS / SNS / EventBridge / Step Functions)

SQS Core Mechanics

Visibility Timeout   → time a message is hidden after being received, before it's deletable/re-visible (default 30s)
Dead Letter Queue (DLQ) → captures messages that fail processing after max receive count
Long Polling         → waits up to 20s for messages, reduces empty responses & cost (vs Short Polling)
Delay Queues          → delay message visibility up to 15 min after being sent
Message Retention     → default 4 days, max 14 days

📝 "Messages failing repeatedly should be isolated for investigation instead of blocking the queue" → DLQ
📝 "Reduce empty API call costs when polling SQS" → Long Polling
📝 "Consumer needs more time to process a large message before it reappears in the queue" → Increase Visibility Timeout

SNS Advanced Features

Message Filtering    → subscribers receive only messages matching a filter policy (reduces unnecessary processing)
FIFO Topics           → ordered, exactly-once delivery to SQS FIFO queues only
Message Attributes    → metadata used for filtering

📝 "Only some subscribers should receive certain message types from the same topic" → SNS Message Filtering

EventBridge

Event Bus            → default, custom, or partner (SaaS) buses
Schema Registry      → auto-discovers and stores event structure
Rules                → pattern match events → route to targets (Lambda, SQS, Step Functions, etc.)
Scheduler             → cron/rate-based invocations (newer, more scalable than CloudWatch Events rules)

📝 "Route events from Salesforce/Zendesk/etc. based on event type" → EventBridge (partner event bus)

Step Functions: Standard vs Express

	Standard	Express
Max duration	1 year	5 minutes
Execution semantics	Exactly-once	At-least-once
Pricing	Per state transition	Per execution + duration
Use case	Long-running workflows, audit history needed	High-volume, short-duration event processing

📝 "High-volume IoT event processing workflow, sub-second executions, cost-sensitive" → Express Workflow
📝 "Multi-day order fulfillment workflow needing full execution history" → Standard Workflow

2️⃣5️⃣ EC2, AUTO SCALING & ELB DEEP DIVE

EC2 Purchasing Options

Option	Best For	Commitment
On-Demand	Unpredictable, short-term, no commitment	None
Reserved Instance	Steady-state, known usage	1 or 3 years
Savings Plan	Steady $/hr spend, flexible instance family	1 or 3 years
Spot	Fault-tolerant, flexible, interruptible	None (2min warning)
Dedicated Host	Compliance needs physical server visibility, BYOL	Physical host billing
Dedicated Instance	Isolated hardware, no visibility needed	Per-instance billing

🆕 Savings Plans Subtypes

Type	Flexibility	Discount Depth
Compute Savings Plan	Highest — any instance family/region/OS, EC2+Fargate+Lambda	Lower than EC2 SP
EC2 Instance Savings Plan	Locked to instance family + region, flexible size/OS/tenancy	Deepest discount
SageMaker Savings Plan	ML workloads specifically	N/A

📝 "Wants maximum flexibility across compute services AND regions" → Compute Savings Plan
📝 "Committed to c5 family in us-east-1, wants deepest possible discount" → EC2 Instance Savings Plan

Placement Groups

Type	Use Case	Trap
Cluster	Low latency, high throughput, same AZ	⚠️ Single AZ = single point of failure
Spread	Critical instances, max 7 per AZ, each on distinct hardware	Reduces correlated failure
Partition	Large distributed systems (Hadoop, Cassandra), partitions = separate racks	Failure isolation per partition

EBS Volume Types

Type	Best For
gp3/gp2 (SSD)	General purpose, boot volumes
io1/io2 (SSD)	High IOPS databases, Multi-Attach support
st1 (HDD)	Big data, throughput-heavy, streaming workloads
sc1 (HDD)	Cold data, infrequent access, cheapest

🆕 EBS Encryption Rules

⚠️ Cannot directly encrypt an existing UNENCRYPTED volume
✅ Workaround: Snapshot → Copy snapshot with encryption enabled → Create new volume from encrypted snapshot
Encrypting the root/default EBS encryption setting applies only to NEW volumes going forward

Auto Scaling Policies

Policy	Use When
Target Tracking	Maintain metric at target (e.g. CPU 50%) — MOST COMMON answer
Step Scaling	Scale by different amounts based on alarm breach size
Scheduled Scaling	Predictable timing (e.g. Black Friday)
Predictive Scaling	ML-based, scales ahead of forecasted demand

Other ASG Concepts

Lifecycle Hooks — pause instance in Pending/Terminating state to run custom actions
Warm Pools — pre-initialized instances sitting ready, reduces scale-out latency
Health Checks — ELB health check = traffic eligibility; ASG health check = replacement decision

ELB Comparison

	Layer	Best For
ALB	7 (HTTP)	Path/host routing, WebSockets, microservices
NLB	4 (TCP/UDP)	Extreme performance, static IP, preserves source IP
GWLB	3 (Network)	Inline 3rd-party appliances (firewalls, IDS/IPS)

🆕 ELB Target Types

Instance    → route to EC2 instance ID
IP          → route to any IP (even on-prem via VPN/DX!) — enables hybrid load balancing
Lambda      → ALB can invoke a Lambda function as a target (HTTP-triggered serverless)

📝 "Load balance traffic between EC2 instances in AWS AND on-prem servers" → ALB/NLB with IP target type
📝 "Expose a Lambda function behind an ALB for simple HTTP triggering" → ALB with Lambda target type

ELB Extras

Cross-Zone Load Balancing — ALB: on by default, NLB: off by default
Sticky Sessions — cookie-based, use only if app is NOT stateless
🆕 Deregistration Delay (Connection Draining) — in-flight requests finish before instance removed from rotation (default 300s)

🆕 EC2 Hibernate

Saves RAM contents to EBS on stop, resumes faster than cold boot.

🆕 Spot Fleet / Mixed Instance ASG

ASG can mix On-Demand + Spot across multiple instance types for cost + resilience.

🆕 IMDSv2

Session-oriented, token-required metadata service — mitigates SSRF attacks.
📝 "Harden EC2 against credential theft via metadata service" → Enforce IMDSv2

2️⃣6️⃣ ROUTE 53 DEEP DIVE

Routing Policies

Policy	Use When
Simple	One resource, no health checks
Weighted	% split (A/B testing, gradual rollout)
Latency-based	Route to lowest-latency region
Failover	Active-passive DR
Geolocation	Route by user's country (compliance/localization)
Geoproximity	Geo + bias to shift traffic
Multi-value	Multiple healthy IPs returned, basic LB + health checks

🧠 "Sillie Wabbits Like Failing, Geo Multiplying"

Health Checks

HTTP/HTTPS/TCP endpoint checks
Calculated health checks (check other health checks)
Can monitor CloudWatch alarms

Hosted Zones

Public — internet routing
Private — routing within VPC(s)

Route 53 Resolver

Inbound Endpoint — on-prem DNS queries resolve AWS private hosted zone records
Outbound Endpoint — VPC resources resolve on-prem DNS names 📝 "Hybrid DNS resolution between on-prem and VPC private hosted zone" → Route 53 Resolver (inbound + outbound)

Route 53 Application Recovery Controller

Manages/automates regional failover with readiness checks and routing controls for highly critical apps.

2️⃣7️⃣ 🆕 CLOUDFORMATION & IaC DEEP DIVE

Core Concepts

Template       → JSON/YAML describing desired resources
Stack           → deployed instance of a template
Change Set      → preview of changes before applying (safety check)
Drift Detection → identifies resources manually changed outside CloudFormation
Stack Policy    → prevents accidental updates/deletes of specific resources

Deletion Policies

Delete (default)  → resource deleted when stack deleted
Retain            → resource kept even if stack deleted (e.g., for S3 buckets/RDS with important data)
Snapshot          → creates a snapshot before deleting (RDS, EBS, ElastiCache)

📝 "Deleting a CloudFormation stack must NOT delete the production database's data" → DeletionPolicy: Retain (or Snapshot)

Nested Stacks vs StackSets

	Nested Stacks	StackSets
Purpose	Break one large template into reusable components	Deploy the SAME template across MULTIPLE accounts/regions
Scope	Single account/region	Multi-account/multi-region

📝 "Deploy the same security baseline stack across 50 accounts in 3 regions" → CloudFormation StackSets
📝 "Reuse a common VPC template inside multiple larger templates" → Nested Stacks

Intrinsic Functions (commonly tested conceptually)

!Ref            → reference a parameter/resource
!GetAtt         → get an attribute of a resource
!Sub            → string substitution
!Join           → concatenate strings
Outputs         → export values for cross-stack references

CDK vs CloudFormation vs Service Catalog vs Elastic Beanstalk

See Confusion Killer Y in Section 34.

2️⃣8️⃣ 🆕 DEPLOYMENT STRATEGIES DEEP DIVE

Elastic Beanstalk Deployment Policies

Policy	Downtime	Rollback Speed	Use Case
All at Once	✅ Yes	Slow (redeploy)	Dev/test, speed over availability
Rolling	❌ No	Slow	Reduce capacity gradually, cost-conscious
Rolling with Additional Batch	❌ No	Slow	Maintains full capacity during deploy
Immutable	❌ No	Fast (just terminate new)	Production, safest, doubles capacity briefly
Blue/Green	❌ No	Instant (swap URL/DNS)	Zero-risk, full environment swap

📝 "Zero downtime AND maintain full capacity during deployment, cost is secondary" → Immutable or Rolling with Additional Batch
📝 "Need instant rollback capability with a completely separate environment" → Blue/Green

CodeDeploy Deployment Types

	In-Place	Blue/Green
Instances	Same instances updated	New instances stood up, traffic shifted
Downtime risk	Higher	Lower
Rollback	Redeploy previous version	Route back to old environment

CodeDeploy Configs

AllAtOnce          → fastest, most risk
HalfAtATime         → 50% batches
OneAtATime          → safest, slowest
Canary(X%,Y min)    → shift X% traffic, wait, then rest
Linear(X%,Y min)    → shift X% every Y minutes until 100%

📝 "Gradually shift traffic in fixed percentage increments over time, not all at once" → Linear deployment config
📝 "Shift 10% of traffic, monitor 5 minutes, then shift rest" → Canary deployment config

2️⃣9️⃣ ANALYTICS DEEP DIVE

Kinesis Family

Service	Purpose	Retention/Replay
Data Streams	Real-time, custom consumers	24hr default, up to 365 days, replayable
Firehose	Auto-delivery to S3/Redshift/OpenSearch/Splunk	No retention/replay
Data Analytics	SQL/Flink on streaming data	N/A
Video Streams	Ingest video/audio	N/A

🧠 "Streams Store, Firehose Flows, Analytics Analyzes"

Other Analytics Services

Athena — serverless SQL directly on S3, pay-per-query
Glue — serverless ETL + Data Catalog
Glue DataBrew — visual data prep, no code
EMR — managed Hadoop/Spark
Redshift — data warehouse, complex joins, BI
Redshift Spectrum — query S3 from Redshift without loading
QuickSight — BI dashboards
Lake Formation — centralized data lake governance on S3/Glue
OpenSearch Service — managed Elasticsearch fork, log analytics/full-text search
MSK — managed Kafka, use when team has existing Kafka tooling

3️⃣0️⃣ COST OPTIMIZATION TOOLKIT

Cost Explorer — visualize/forecast spend, RI/SP recommendations
AWS Budgets — proactive alerts (cost, usage, RI/SP utilization budgets)
Cost & Usage Report (CUR) — most granular billing data
Trusted Advisor — best-practice checks (cost, security, performance, fault tolerance, limits)
Compute Optimizer — ML-based right-sizing (EC2/Lambda/EBS)
Savings Plans — flexible $/hr commitment
Reserved Instances — locked to instance family/region
Cost Allocation Tags — track spend by project/team
License Manager — track/enforce BYOL software license usage

RI vs Savings Plan

	Reserved Instance	Savings Plan
Locked to	Instance family/region	$/hr commitment, flexible family/region
Term	1 or 3 years	1 or 3 years
Flexibility	Low (Standard) / Medium (Convertible)	High

🆕 Billing Alarms

CloudWatch billing alarm (in us-east-1, must enable billing alerts first) — simplest way to get notified of unexpected spend before AWS Budgets existed; still occasionally tested as the "basic" answer vs Budgets.
📝 "Simplest way to get an alert if total account spend exceeds $500" → CloudWatch Billing Alarm (simple) or AWS Budgets (more feature-rich/preferred in modern exam answers)

3️⃣1️⃣ ADDITIONAL SERVICES

Cognito Deep Dive

	User Pools	Identity Pools
Purpose	Sign-up/sign-in directory	Temp AWS credentials
Output	JWT tokens	STS temp creds

API Gateway Deep Dive

Edge-optimized   → global clients (uses CloudFront)
Regional         → clients in same region
Private          → internal VPC-only APIs (via Interface Endpoint)
Usage Plans      → throttling + quota per API key/customer
Caching          → reduce backend load, TTL-configurable
Request Validation → reject malformed requests before hitting backend
Mapping Templates → transform request/response between client and backend format

📝 "Different customers need different rate limits on the same API" → Usage Plans + API Keys
📝 "API must only be reachable from within our VPC" → Private API Gateway + Interface Endpoint

Systems Manager Suite

Session Manager — SSH/RDP without open ports or bastion hosts
Patch Manager — automate OS patching
Parameter Store — config/secrets
Run Command — remote command execution at scale
State Manager — maintain consistent config state
Automation — predefined workflows (e.g., AMI creation)
Inventory — collect metadata about instances
OpsCenter — central place to view/resolve operational issues
🆕 Compliance — scan instances against patch/config baselines
🆕 Documents (SSM Documents) — define actions performed on instances (used by Run Command/Automation)

Governance & Multi-Account

AWS Organizations — consolidated billing, account structure, SCPs
Control Tower — automated landing zone, built on Organizations
AWS RAM — share resources (subnets, TGW) cross-account
Config Conformance Packs — pre-built compliance rule sets
Service Catalog — curated self-service catalog of approved products
🆕 AWS Artifact — compliance reports and agreements

Edge / Hybrid Infrastructure

Outposts — AWS hardware physically installed in YOUR data center
Local Zones — AWS infrastructure extension near major metro areas
Wavelength — AWS compute embedded in telecom 5G networks

🆕 Direct Connect Deep Dive

Private VIF (Virtual Interface) → access VPC resources privately
Public VIF                       → access AWS public services (S3, DynamoDB) over DX, not internet
Transit VIF                      → connect to Transit Gateway over DX
Direct Connect Gateway           → connect DX to multiple VPCs across regions
Link Aggregation Group (LAG)     → bundle multiple DX connections for higher bandwidth

📝 "Need to reach S3 over Direct Connect without traversing the public internet" → Public VIF
📝 "Single DX connection needs to reach VPCs in multiple regions" → Direct Connect Gateway

⚠️ DX alone has NO built-in encryption — for encrypted DX traffic, layer a VPN over Direct Connect.
📝 "Need dedicated bandwidth AND encryption in transit" → VPN over Direct Connect

🆕 Amazon Detective

Automatically analyzes/visualizes security data (from GuardDuty, VPC Flow Logs, CloudTrail) to help find the ROOT CAUSE of a finding.
📝 "GuardDuty flagged suspicious activity — need to investigate the underlying cause and related events" → Amazon Detective

🆕 Firewall Manager

Centrally manage WAF, Security Groups, Shield Advanced, and Network Firewall across an Organization.

🆕 Network Firewall

Managed, stateful VPC-level firewall with IPS capabilities.

🆕 VPC Reachability Analyzer

Diagnoses connectivity issues via static config analysis (SG/NACL/route tables).

🆕 End-User Computing

WorkSpaces — persistent managed virtual desktops (VDI)
AppStream 2.0 — streams individual applications, non-persistent

Developer Tools (CI/CD)

CodeCommit — managed Git repo
CodeBuild — managed build service
CodeDeploy — automates deploy (In-place/Blue-Green, Canary, Linear)
CodePipeline — orchestrates full CI/CD

3️⃣2️⃣ 🆆 CONFUSION KILLERS — Side-by-Side with Examples

🔐 A. WAF vs Shield vs GuardDuty

Service	Protects Against	Blocks or Detects?
WAF	Malicious request content	Blocks
Shield	Traffic volume floods	Blocks
GuardDuty	Suspicious behavior	Detects only

🧠 "WAF Watches words, Shield Stops storms, GuardDuty Gives detection."

🕵️ B. Macie vs Inspector vs GuardDuty vs Detective

Service	Finds
Macie	Sensitive data (PII) in S3
Inspector	Vulnerabilities (CVEs)
GuardDuty	Active threats/malicious behavior
Detective	ROOT CAUSE of a finding (investigation)

🧠 "Macie Mines data, Inspector Inspects code, Guard Guards traffic, Detective Digs deeper."

🗃️ C. Multi-AZ vs Read Replica vs Aurora Global DB

	Multi-AZ	Read Replica	Aurora Global DB
Purpose	HA/failover	Read scaling	Cross-region + DR
Replication	Sync	Async	Async (<1s)
Failover	Automatic	Manual	Manual (~1min)
Readable?	❌	✅	✅

📨 D. SQS vs SNS vs EventBridge vs Kinesis

🧠 "Queue holds, Notifies broadcasts, Events route, Kinesis streams+replays."

📨 E. SQS Standard vs FIFO

Litmus: "order"/"exactly-once" → FIFO. Otherwise → Standard.

🌐 F. Gateway vs Interface Endpoint

🧠 "Gateway = Gratis (free), Interface = Invoiced."

🌐 G. VPC Peering vs Transit Gateway vs VPN vs Direct Connect

🧠 "VPN = Virtually instant, DX = Dedicated but delayed."

🌐 H. Security Group vs NACL

🧠 "Security Group remembers you leaving. NACL checks you again on the way out."

💻 I. Lambda vs Fargate vs ECS vs EKS vs EC2

🧠 "Lambda = short & serverless, Fargate = containers & serverless, EC2 = full control."

🗄️ J. S3 vs EBS vs EFS vs FSx

🧠 "EBS = one drive one PC. EFS/FSx = shared drive many PCs. S3 = cloud filing cabinet."

🗄️ K. S3 Storage Classes

🧠 "Sally Is In One Giant Igloo, Deeply frozen."

🔑 L. IAM Role vs User vs SCP vs Permissions Boundary

🧠 "SCP = Stop (ceiling), IAM Policy = Issues permission, Boundary = Bounds one person."

📊 M. CloudTrail vs CloudWatch vs Config vs X-Ray

🧠 "Trail tracks the actor. Watch watches metrics. Config catches change. X-Ray x-rays the path."

🚚 N. DMS vs MGN vs Snowball vs DataSync

🧠 "DMS = Data, MGN = Machines, Snowball = Ship it, DataSync = Schedule it."

⚖️ O. ALB vs NLB vs GWLB

🧠 "Apps Need Gateways" (ALB app layer, NLB raw speed, GWLB for appliances).

🌍 P. Route 53 Routing Policies

🧠 "Sillie Wabbits Like Failing, Geo Multiplying."

🌪️ Q. DR Strategies (RTO/RPO Ladder)

🧠 "Budget People Want More" (Backup→Pilot→Warm→Multi-site).

💰 R. Reserved Instances vs Savings Plans vs Spot

🧠 "RI = Rigid, Savings Plan = Stretchy, Spot = Sacrificial."

📈 S. Kinesis Streams vs Firehose vs Data Analytics

🧠 "Streams Store (& replay), Firehose Flows (auto), Analytics Analyzes (SQL)."

💻 T. Elastic Beanstalk vs Lightsail vs EC2

🧠 "Beanstalk grows your app for you. Lightsail = light & cheap. EC2 = you're the sysadmin."

🆕 U. Cognito User Pools vs Identity Pools

🧠 "User Pools = who you are, Identity Pools = what you can touch."

🆕 V. Snapshot vs AWS Backup vs AMI

🧠 "Snapshot = one disk, AMI = one server clone, Backup = the whole org."

🆕 W. Athena vs Redshift vs Redshift Spectrum vs EMR

🧠 "Athena = ask S3 directly. Redshift = warehouse the data. Spectrum = warehouse + peek at S3. EMR = build your own big-data cluster."

🆕 X. Global Accelerator vs CloudFront vs Route 53

🧠 "CloudFront caches content, Global Accelerator routes packets, Route 53 resolves names."

🆕 Y. CloudFormation vs CDK vs Elastic Beanstalk vs Service Catalog

🧠 "CloudFormation = blueprint, CDK = code that draws the blueprint, Beanstalk = someone else builds it for you, Service Catalog = the approved catalog of blueprints."

🆕 Z. AWS Backup vs AWS DRS vs Cross-Region Replication vs Multi-AZ

🧠 "Backup = restore point, DRS = live standby copy, CRR = object mirror, Multi-AZ = same-region safety net."

🆕 AA. WorkSpaces vs AppStream 2.0

🧠 "WorkSpaces = your desk. AppStream = a single app in a window."

🆕 BB. IAM Identity Center vs Cognito vs Directory Service

🧠 "Identity Center = employees into AWS. Cognito = customers into your app. Directory Service = Windows/AD compatibility."

🆕 CC. ElastiCache Redis vs Memcached

🧠 "Redis Remembers (persists), Memcached Might forget."
📝 "Need pub/sub + persistence + replication" → Redis
📝 "Need simple, disposable, multi-threaded cache" → Memcached

🆕 DD. GSI vs LSI (DynamoDB)

	GSI	LSI
Created	Anytime	Only at table creation
Key	New partition+sort	Same partition, diff sort
Consistency	Eventual only	Strong or eventual

🧠 "GSI = Grows anytime, LSI = Locked at launch."

🆕 EE. Network Firewall vs Security Group vs NACL vs WAF vs GWLB

Service	Scope	Layer
Security Group	Instance	L4
NACL	Subnet	L3/L4
Network Firewall	VPC-wide, stateful, IPS	L3-L7
WAF	HTTP application layer	L7
GWLB	Routes to 3rd-party appliance	L3

📝 "Need intrusion prevention and deep packet inspection at the VPC perimeter" → AWS Network Firewall
📝 "Need to route traffic through a 3rd-party firewall appliance transparently" → GWLB

🆕 FF. Firewall Manager vs Security Hub vs Organizations SCP

	Purpose
Firewall Manager	Centrally deploy/enforce WAF, SG, Shield, Network Firewall rules org-wide
Security Hub	Aggregate and prioritize security FINDINGS across accounts
SCP	Restrict IAM ACTIONS/permissions org-wide

📝 "Automatically apply the same WAF rule to every new ALB created in any account" → Firewall Manager
📝 "See a consolidated dashboard of GuardDuty + Inspector + Macie findings across all accounts" → Security Hub

🔑 MASTER LITMUS-TEST FLOWCHART

Block or just detect? → WAF/Shield (block) vs GuardDuty (detect)
Automatic failover needed? → Multi-AZ, not Read Replica
Cross-region? → Needs "Global"/"Cross-Region" in the name
Does it need to GRANT permission? → SCP/Boundary never do; only IAM Policy does
Is it free? → Gateway Endpoint (S3/DynamoDB) vs paid Interface Endpoint
Needs replay? → Kinesis, not SQS
Single point or shared storage? → EBS (single) vs EFS/FSx (shared)
How fast must recovery be? → Maps to DR ladder
Steady or spiky workload? → RI/Savings Plan (steady) vs Spot (spiky)
HTTP or non-HTTP traffic? → CloudFront/ALB (HTTP) vs Global Accelerator/NLB (non-HTTP)
Employee or customer identity? → IAM Identity Center (employee) vs Cognito (customer)
Persistent desktop or single app? → WorkSpaces (desktop) vs AppStream (app)
Backup restore point or live standby? → AWS Backup (point-in-time) vs AWS DRS (continuous)
🆕 Needs persistence/pub-sub? → Redis vs Memcached
🆕 Index at table creation or anytime? → LSI (creation only) vs GSI (anytime)
🆕 Investigating WHY vs WHAT happened? → Detective (why) vs GuardDuty/Config (what)
🆕 Centralizing rules vs aggregating findings? → Firewall Manager (rules) vs Security Hub (findings)

3️⃣3️⃣ WHY AWS REJECTS THIS ANSWER (Top 55)

1-45: (all prior entries retained — see below for the full list)

1. Need HA → ❌ Read Replica → ✅ Multi-AZ
2. Need DR (region loss) → ❌ Multi-AZ → ✅ Cross-Region
3. Need queue → ❌ SNS → ✅ SQS
4. Need fan-out → ❌ SQS → ✅ SNS
5. Need exactly-once+order → ❌ SQS Standard → ✅ SQS FIFO
6. Need encryption → ❌ Secrets Manager → ✅ KMS
7. Need to rotate password → ❌ Parameter Store → ✅ Secrets Manager
8. Need drift detection → ❌ CloudTrail → ✅ AWS Config
9. Need "who did it" → ❌ CloudWatch → ✅ CloudTrail
10. Need threat detection → ❌ Inspector → ✅ GuardDuty
11. Need vulnerability scan → ❌ GuardDuty → ✅ Inspector
12. Need PII discovery → ❌ GuardDuty/Inspector → ✅ Macie
13. Need central security dashboard → ❌ GuardDuty alone → ✅ Security Hub
14. Need transitive VPC routing → ❌ VPC Peering → ✅ Transit Gateway
15. Need dedicated bandwidth → ❌ VPN → ✅ Direct Connect
16. Need quick hybrid setup → ❌ Direct Connect → ✅ VPN
17. Need free S3 private access → ❌ Interface Endpoint → ✅ Gateway Endpoint
18. Need private access to Kinesis/SNS → ❌ Gateway Endpoint → ✅ Interface Endpoint
19. Need shared block storage, multi-AZ → ❌ EBS Multi-Attach → ✅ EFS/FSx
20. Need cheapest archive → ❌ Standard-IA → ✅ Glacier Deep Archive
21. Need SCP to grant permission → ❌ SCP → ✅ IAM Policy
22. Need to cap 1 admin's perms → ❌ SCP → ✅ Permissions Boundary
23. Need temp creds for EC2 app → ❌ IAM User+keys → ✅ IAM Role
24. Job runs >15 min → ❌ Lambda → ✅ Fargate/Batch/EC2
25. Need GPU in container → ❌ Fargate → ✅ EC2 launch type
26. Need automatic replay of stream → ❌ SQS → ✅ Kinesis Data Streams
27. Need to right-size EC2 fleet → ❌ Trusted Advisor alone → ✅ Compute Optimizer
28. Need consistent read-after-write on S3 → ✅ S3 = strong consistency by default
29. Need Aurora that pauses to zero → ❌ Serverless v2 → ✅ Serverless v1
30. Need to grant access despite SCP deny → ❌ Broader IAM policy → ✅ Modify the SCP itself
31. Need static IP for non-HTTP global app → ❌ CloudFront → ✅ Global Accelerator
32. Need NAT for inbound traffic → ❌ NAT Gateway → ✅ ALB/NLB
33. Need mobile app to directly call S3 after login → ❌ Cognito User Pool alone → ✅ + Identity Pool
34. Need HPC lowest-latency clustering → ❌ Spread Placement Group → ✅ Cluster Placement Group
35. Need on-prem AWS-native services → ❌ Direct Connect alone → ✅ AWS Outposts
36. Need sub-minute RPO DR for on-prem servers → ❌ AWS Backup → ✅ AWS DRS
37. Need SSO for employees across 40 accounts → ❌ Cognito → ✅ IAM Identity Center
38. Need to find publicly exposed IAM roles/buckets → ❌ Security Hub → ✅ IAM Access Analyzer
39. Need EC2 to join on-prem AD without duplicating users → ❌ Simple AD → ✅ AD Connector
40. Need self-service deployment for non-technical teams → ❌ raw CloudFormation → ✅ Service Catalog
41. Need query subset of columns from huge S3 CSV cheaply → ❌ Download whole object → ✅ S3 Select
42. Need bulk tag/update on billions of S3 objects → ❌ Manual Lambda loop → ✅ S3 Batch Operations
43. Need IPv6 outbound-only internet access → ❌ NAT Gateway → ✅ Egress-Only Internet Gateway
44. Need to track software license compliance → ❌ Cost Explorer → ✅ License Manager
45. Need virtual desktop persistence for full-time staff → ❌ AppStream 2.0 → ✅ WorkSpaces
46. 🆕 Need cache with persistence and pub/sub → ❌ Memcached → ✅ Redis
47. 🆕 Need strongly consistent read on alternate sort key → ❌ GSI (eventual only) → ✅ LSI
48. 🆕 Need index added AFTER table already exists → ❌ LSI (creation-time only) → ✅ GSI
49. 🆕 Need to encrypt an EXISTING unencrypted RDS instance → ❌ "Enable encryption" toggle (doesn't exist) → ✅ Snapshot→Copy(encrypted)→Restore
50. 🆕 Need root cause investigation of a GuardDuty finding → ❌ GuardDuty alone (just alerts) → ✅ Amazon Detective
51. 🆕 Need centralized WAF rule enforcement across new + existing accounts → ❌ Manual per-account WAF → ✅ Firewall Manager
52. 🆕 Need stateful deep packet inspection at VPC edge → ❌ Security Group (stateful but L4 only, no IPS) → ✅ AWS Network Firewall
53. 🆕 Need to diagnose exactly why traffic is blocked between 2 resources without sending live packets → ❌ Manually reading SG/NACL rules → ✅ VPC Reachability Analyzer
54. 🆕 Need Lambda cold-start elimination → ❌ Reserved Concurrency (only caps capacity) → ✅ Provisioned Concurrency
55. 🆕 Need same CloudFormation stack deployed to 50 accounts/3 regions → ❌ Nested Stacks (single account/region) → ✅ StackSets

3️⃣4️⃣ ARCHITECTURES (Vertical Flow)

Static Website

User → Route 53 → CloudFront (+WAF) → S3 (Origin, OAC private)

Three-Tier Web App

Users → CloudFront → Route 53 → ALB (public subnet) → EC2/ASG (private) → RDS Multi-AZ (isolated)

Serverless App

Client → API Gateway → Lambda → DynamoDB

Event-Driven

S3 Upload → EventBridge → Lambda (process) / SQS (buffer) / Step Functions (orchestrate)

Microservices

Client → ALB → ECS Orders(Fargate)→DynamoDB
             → ECS Payments(Fargate)→Aurora
             → ECS Shipping(Fargate)→DynamoDB

Hybrid Cloud

On-Prem → Direct Connect(primary)+VPN(backup) → VPC → Transit Gateway → VPC-A/B/C

DR — Warm Standby

Region A(ACTIVE 100%) ↔ Route 53 Failover ↔ Region B(PASSIVE 10%)
Aurora Write(A) → Replication → Aurora Read(B)

DR — Active/Active

Region A(ACTIVE) ↔ DynamoDB Global Tables ↔ Region B(ACTIVE)
Route 53 Latency Routing → All Users

DR — Continuous Replication (AWS DRS)

On-Prem Servers → AWS DRS Replication Agent → Low-Cost Staging Subnet (EBS only, no live EC2)
On disaster → DRS Launches Full EC2 in minutes → Route 53 Failover

Secure Enterprise VPC

Internet → IGW → ALB(public,SG:443) → App Tier(private) → DB Tier(isolated, no NAT/IGW)
Side: NAT GW (one per AZ) | VPC Flow Logs → CloudWatch | VPC Endpoints (S3/KMS/Secrets)
Perimeter: AWS Network Firewall (inline inspection) | Firewall Manager (org-wide policy)

Data Lake

Sources → Kinesis Firehose → S3(raw) → Glue ETL → S3(processed) → Athena/Redshift/QuickSight
Governance: Lake Formation (across S3/Glue)

Streaming Pipeline

IoT/Clickstream → Kinesis Data Streams → Lambda(real-time)
                → Kinesis Firehose → S3 → Athena/Redshift

CI/CD Pipeline

Dev push → CodeCommit → CodePipeline → CodeBuild → CodeDeploy(Blue/Green/Canary/Linear) → EC2/ECS/Lambda
CloudWatch Alarms → auto-rollback on failure

IoT Pipeline

Devices → IoT Core(MQTT) → IoT Rules Engine → Kinesis/Lambda/S3/Timestream

SaaS Multi-Tenant

Tenant → CloudFront → API Gateway → Lambda → DynamoDB(partition key=tenant_id)
                                    Cognito (tenant-aware pools)

Mobile Backend with Federated Access

Mobile App → Cognito User Pool (login) → Cognito Identity Pool (temp creds) → S3/DynamoDB directly

Multi-Account Landing Zone

Management Account → Control Tower → Organizations (OUs: Security/Sandbox/Prod/Dev)
                                    → SCPs per OU
                                    → IAM Identity Center (SSO)
                                    → Config Conformance Packs (compliance)
                                    → Firewall Manager (org-wide WAF/SG rules)

Centralized Cross-Account Networking (VPC Sharing)

Network Account (owns VPC/subnets) → AWS RAM → Shares subnets → App Account A/B/C

Bastion-less Remote Access

Admin → SSM Session Manager → Private EC2 (no open SSH/RDP ports, no bastion host)

Cache-Aside Pattern

App → Check ElastiCache (Redis) → Miss → Query RDS/DynamoDB → Write result to cache → Return

Hybrid End-User Computing

Remote Employees → WorkSpaces (persistent desktop) → VPC → Internal Apps/Databases
Contractors → AppStream 2.0 (single streamed app) → Same VPC, limited scope

🆕 Serverless DB-Backed API with Caching

Client → API Gateway (with caching) → Lambda → DAX → DynamoDB
                                              ↳ Provisioned Concurrency for cold-start-sensitive functions

🆕 Security Investigation Pipeline

VPC Flow Logs + CloudTrail + DNS Logs → GuardDuty (detect) → Security Hub (aggregate)
                                       → Amazon Detective (investigate root cause)
                                       → EventBridge → Lambda (auto-remediate)

🆕 Regulated Database Encryption Retrofit

Existing Unencrypted RDS → Manual Snapshot → Copy Snapshot (enable KMS CMK encryption) → Restore New Encrypted Instance → Cutover (update endpoint) → Delete Old Instance

3️⃣5️⃣ VOCABULARY

Durable                → won't be lost (S3)
Available              → responsive when needed
Elastic                → auto grow/shrink
Ephemeral              → temp, lost on stop
Fault Tolerant         → zero disruption
Highly Available       → fast recovery, brief gap ok
Eventually Consistent  → reads may lag briefly
Strongly Consistent    → always latest write
Shared Responsibility  → AWS=of cloud, You=in cloud
Immutable Infra        → replace, don't patch
Serverless             → no provisioning, auto-scale
Lift and Shift         → rehost, minimal change
Replatform             → small optimizations
Refactor               → redesign cloud-native
Blue/Green             → 2 envs, instant switch
Canary                 → gradual traffic shift
Burstable              → baseline + credits (T-family)
Idempotent             → repeat = same result
Decoupled              → no direct calls, via queue
Stateless              → no session on instance
Stateful               → retains session/context
Multi-tenant           → shared infra, multiple customers
Defense in Depth       → multiple security layers stacked
Loosely Coupled        → failure isolation between components
Anycast IP             → same IP, routed to nearest location (Global Accelerator)
WORM                   → Write Once Read Many (Object Lock)
RTO                    → Recovery Time Objective (how long to recover)
RPO                    → Recovery Point Objective (how much data loss tolerable)
Idle capacity          → unused, wasted resources (cost target)
Landing Zone           → pre-configured, secure multi-account baseline
Guardrail              → preventive/detective control (SCP, Config rule)
Blast Radius           → scope of impact if a component fails
Chaos Engineering      → intentionally injecting failure to test resilience
Data Gravity           → tendency of data to attract compute near it
North-South Traffic    → traffic in/out of a network
East-West Traffic      → traffic between resources inside a network
Envelope Encryption    → encrypting a data key with a master key
Write-Through Cache    → cache updated at the same time as DB
Lazy Loading (Cache-Aside) → cache populated only on read-miss
Hot Partition          → uneven load on a single DB partition due to poor key design
Poison Pill Message    → message that repeatedly fails processing, needs DLQ
Bulkhead Pattern        → isolate failures so they don't cascade across the system
Circuit Breaker Pattern → stop calling a failing dependency temporarily

3️⃣6️⃣ LIMITS (Quick List)

Lambda 15min · Lambda /tmp 10GB · SQS 256KB msg/14 days max retention · S3 max object 5TB · EBS max 64TiB · EBS Multi-Attach same-AZ, io1/io2 only · DynamoDB item 400KB · Aurora max storage 128TB · RDS 5 replicas / Aurora 15 · VPC 5/region (soft) · VPC CIDR /16-/28 · SG 60 rules in/out · ALB 100 target groups · CFN 500 resources/stack · IAM policy 6144 chars · Route53 health check 10s(fast)/30s(standard) · S3 multipart recommended >100MB · Aurora Serverless v2 min 0.5 ACU · S3 strong consistency (all ops) · Well-Architected = 6 pillars · Spot interruption warning = 2 min · Placement Group (Spread) max 7 instances/AZ

More Limits

Lambda concurrent executions default = 1000 (soft) · Lambda deployment package 50MB zipped/250MB unzipped · API Gateway timeout = 29 seconds max · DynamoDB max throughput per partition = 3000 RCU/1000 WCU · Kinesis Data Streams default retention = 24hrs (max 365 days) · Kinesis shard = 1MB/sec in, 2MB/sec out · SNS message size = 256KB · Step Functions Standard = 1 year max execution / Express = 5 min max · EFS scales automatically · FSx Lustre min size 1.2TiB (scratch) · CloudFront cache TTL default = 24hrs · Transit Gateway max VPC attachments = 5000 · Organizations max accounts = 10 default (increasable) · Glacier Deep Archive retrieval = ~12hrs standard, ~48hrs bulk

🆕 Even More Limits

DynamoDB GSI max = 20 per table · DynamoDB LSI max = 5 per table (creation-time only) · SQS visibility timeout max = 12 hours · SQS delay queue max = 15 min · RDS automated backup retention max = 35 days · DynamoDB PITR window = 35 days · EBS io2 Block Express max IOPS = 256,000 · NAT Gateway bandwidth up to 100Gbps (burst) · CloudFront max origins per distribution = 25 · Security Group max per ENI = 5 (default, can request increase) · IAM: max 5000 users per account (soft) · IAM: max 500 roles per account (soft, increasable) · Direct Connect port speeds = 1/10/100 Gbps · Placement Group (Cluster) recommended for tightly coupled HPC only

3️⃣7️⃣ MEMORY TRICKS (All in One Place)

WAF/Shield/GuardDuty    → Watches words / Stops storms / Gives detection
Macie/Inspector/Guard/Detective → Mines data / Inspects code / Guards traffic / Digs deeper
Multi-AZ/Replica        → Availability=AZ, Reads=Replica
SQS/SNS/EventBridge     → Queue holds, Notifies broadcasts, Events route
Gateway/Interface       → Gratis(free) / Invoiced(paid)
VPN/Direct Connect      → Virtually instant / Dedicated but delayed
SG/NACL                 → Remembers you leaving / Checks you again leaving
S3 classes              → Sally Is In One Giant Igloo, Deeply frozen
SCP/IAM/Boundary        → Stop(ceiling) / Issues permission / Bounds one person
DMS/MGN/Snowball/Sync   → Data / Machines / Ship it / Schedule it
ALB/NLB/GWLB            → Apps Need Gateways
Route 53 policies       → Sillie Wabbits Like Failing, Geo Multiplying
DR ladder               → Budget People Want More
RI/Savings/Spot         → Rigid / Stretchy / Sacrificial
Kinesis family          → Streams Store, Firehose Flows, Analytics Analyzes
Beanstalk/Lightsail/EC2 → Grows for you / Light & cheap / You're the sysadmin
Cognito Pools           → User Pools=who you are, Identity Pools=what you can touch
Snapshot/AMI/Backup     → One disk / One server clone / The whole org
Athena/Redshift/Spectrum/EMR → Ask S3 directly / Warehouse it / Warehouse+peek / Build your own cluster
CloudFront/GA/Route53   → Caches content / Routes packets / Resolves names
Well-Architected Pillars→ Old Sailors Rarely Perform Correctly Sober
IAM Evaluation          → Deny Always Wins
Snow Family             → Cone < Ball < Mobile
WorkSpaces/AppStream    → Your desk / A single app in a window
Backup/DRS/CRR/Multi-AZ → Restore point / Live standby copy / Object mirror / Same-region net
Identity Center/Cognito/Directory → Employees into AWS / Customers into your app / Windows/AD
CloudFormation/CDK/Beanstalk/Catalog → Blueprint / Code that draws it / Someone builds it / Approved catalog
Redis/Memcached         → Redis Remembers (persists), Memcached Might forget
GSI/LSI                 → Grows anytime / Locked at launch
Firewall Manager/Security Hub → Enforces rules / Aggregates findings

3️⃣8️⃣ STAR RATINGS (Study Priority)

★★★★★ Almost guaranteed:
EC2, S3, VPC, IAM, RDS/Aurora, Lambda, DynamoDB, ELB, Auto Scaling,
Multi-AZ vs Read Replica, S3 Storage Classes, Security Group vs NACL,
DynamoDB GSI/LSI/Streams/TTL, RDS encryption retrofit process

★★★★☆ Very common:
Route 53, CloudFront (incl. Signed URL/Cookie, OAC), SQS/SNS/EventBridge,
KMS (incl. CMK types, envelope encryption), CloudWatch/CloudTrail/Config,
VPN/Direct Connect/Transit Gateway, Gateway vs Interface Endpoint,
WAF/Shield/GuardDuty, Cognito, DR Strategies (RTO/RPO ladder), ElastiCache (Redis vs Memcached)

★★★☆☆ Sometimes:
ECS/EKS/Fargate, GuardDuty/Inspector/Macie/Detective, AWS Backup/DRS, DMS/MGN/Snow Family,
Step Functions (Standard vs Express), Kinesis, Well-Architected Framework, Cost tools, API Gateway,
Placement Groups, EBS volume types, IAM Identity Center, Access Analyzer,
CloudFormation (StackSets/Nested Stacks), Elastic Beanstalk deployment policies

★★☆☆☆ Rare:
Redshift, Glue/Athena, Organizations/Control Tower/RAM, RDS Proxy, DAX,
Elastic Beanstalk, Lightsail, Lake Formation, WorkSpaces/AppStream, Directory Service,
Service Catalog, IPAM, Network Firewall, Firewall Manager, Reachability Analyzer

★☆☆☆☆ Very rare:
Outposts, Wavelength, Local Zones, QLDB, Neptune, Timestream, OpsWorks,
AppSync, License Manager, MSK, OpenSearch, AWS Artifact

3️⃣9️⃣ PRACTICE QUESTION BANK (Full Reasoning)

Q1. Automatic failover during AZ outage, zero data loss, no app changes.
✅ RDS Multi-AZ ❌ Read Replica (async, manual)

Q2. Process orders in exact sequence, no duplicates.
✅ SQS FIFO ❌ SQS Standard/SNS

Q3. 50TB footage, accessed once every few years, lowest cost.
✅ S3 Glacier Deep Archive ❌ Glacier Flexible

Q4. DB tier must never be internet-reachable, but needs outbound patching access.
✅ Private subnet + NAT Gateway ❌ Public subnet + SG restriction

Q5. Prevent every account in an OU from disabling CloudTrail.
✅ SCP deny ❌ IAM Policy (overridable per-account)

Q6. SSH into private EC2 without opening port 22 or bastion.
✅ SSM Session Manager ❌ Bastion host

Q7. Cross-region active-active DynamoDB.
✅ DynamoDB Global Tables ❌ Cross-region snapshot restore

Q8. Ad-hoc SQL on JSON logs in S3, zero infra.
✅ Athena ❌ Redshift

Q9. Backup data immutable for 7 years, even from admins.
✅ S3 Object Lock (Compliance mode) ❌ Versioning alone

Q10. Static IP for UDP game server, fast cross-region failover.
✅ Global Accelerator ❌ CloudFront

Q11. 10% traffic to new version for validation.
✅ Route 53 Weighted ❌ Failover routing

Q12. Immutable, cryptographically verifiable transaction log.
✅ QLDB ❌ DynamoDB + versioning

Q13. Continuous block-level replication of on-prem VMware, minutes RPO, launch EC2 only during failover.
✅ AWS DRS ❌ AWS Backup/MGN

Q14. 60 accounts, employees log in once via existing Okta.
✅ IAM Identity Center ❌ Cognito

Q15. Self-service portal for pre-approved CloudFormation templates.
✅ Service Catalog ❌ Direct CloudFormation access

🆕 Q16. DynamoDB table throttles despite available overall provisioned capacity.
✅ Redesign the partition key (hot partition problem) ❌ Simply increase provisioned capacity

🆕 Q17. Need to query DynamoDB by a new attribute added after the table already has millions of items.
✅ GSI (can be added anytime) ❌ LSI (creation-time only)

🆕 Q18. Existing production RDS instance (unencrypted) must become encrypted with minimal downtime.
✅ Snapshot → Copy with encryption → Restore new instance → Cutover ❌ "Enable encryption" toggle (doesn't exist for existing instances)

🆕 Q19. Need a cache that supports pub/sub messaging and automatic Multi-AZ failover.
✅ ElastiCache for Redis ❌ Memcached (no persistence/replication)

🆕 Q20. GuardDuty flagged an EC2 instance — need to understand the full timeline and related resources involved.
✅ Amazon Detective ❌ GuardDuty alone (only shows the finding, not root cause)

🆕 Q21. Security team wants the same WAF rule automatically applied to every ALB in every account, including future ones, org-wide.
✅ Firewall Manager ❌ Manually configuring WAF per account

🆕 Q22. API behind Lambda has strict latency SLAs; cold starts are causing SLA violations during traffic spikes.
✅ Provisioned Concurrency ❌ Reserved Concurrency (only limits/guarantees max, doesn't pre-warm)

🆕 Q23. Need to deploy an identical security baseline CloudFormation stack to 80 accounts across 4 regions automatically.
✅ CloudFormation StackSets ❌ Nested Stacks (single account/region scope)

🆕 Q24. Need Lambda-based ALB target for simple internal HTTP-triggered serverless function without API Gateway overhead.
✅ ALB with Lambda target type ❌ API Gateway + Lambda (unnecessary here)

🆕 Q25. EC2 fleet must join existing on-premises Active Directory without duplicating user accounts in AWS.
✅ AD Connector ❌ AWS Managed Microsoft AD (creates a new directory) / Simple AD (standalone)

4️⃣0️⃣ COMMON EXAM CALCULATIONS

RTO/RPO Interpretation

RTO = "How long can we be DOWN?"        → drives DR strategy choice
RPO = "How much DATA can we LOSE?"      → drives replication frequency/method

S3 Storage Cost Reasoning

Standard > Intelligent-Tiering ≈ Standard-IA > One Zone-IA > Glacier IR > Glacier Flexible > Glacier Deep Archive

Read Replica Math

Aurora → up to 15 read replicas | RDS (non-Aurora) → up to 5
If question implies >5 read replicas needed on a relational engine → Aurora

Data Transfer Reasoning

Same-AZ private IP = cheapest/free | Cross-AZ = costs money | Egress to internet = most expensive (use CloudFront)

Lambda Cost/Concurrency Reasoning

More memory = more CPU = may finish faster = can be CHEAPER despite higher per-ms rate

Spot Savings vs Risk

Spot ≈ up to 90% cheaper, reclaimable with 2-min warning → fault-tolerant workloads only

🆕 Subnet CIDR Math

Usable IPs = 2^(32-prefix) - 5
/24 = 251 usable | /28 = 11 usable | /27 = 27 usable

🆕 DynamoDB Capacity Math (conceptual)

RCU: 1 strongly consistent read of 4KB = 1 RCU (eventually consistent = 0.5 RCU)
WCU: 1 write of 1KB = 1 WCU

📝 "App does 100 strongly consistent reads/sec of 4KB items" → needs 100 RCU

4️⃣1️⃣ CONTAINER DEEP DIVE (ECS vs EKS vs Fargate)

Launch Types

	EC2 Launch Type	Fargate Launch Type
Who manages servers	You	AWS
Use case	GPU/custom AMI/cost control at scale	No ops overhead, variable workloads
Billing	Per EC2 instance	Per task (vCPU/memory-second)

ECS vs EKS

	ECS	EKS
Orchestrator	AWS proprietary	Kubernetes
Best for	AWS-only shops	Multi-cloud/k8s portability
Control plane cost	Free	Hourly charge per cluster

Task Definitions & Services (ECS)

Task Definition — blueprint (image, CPU/memory, ports, env vars)
Task — running instance of a task definition
Service — maintains desired count of tasks, integrates with ALB

4️⃣2️⃣ EXAM DAY TIPS

Logistics

Arrive/log in 30 min early (online proctoring needs ID + room scan)
130 minutes, ~65 questions → ~2 min/question budget
Flag-and-review is available — don't get stuck, mark and move on
Unanswered = wrong; ALWAYS select something before flagging

Mental Checklist Per Question

What is the LAST sentence really asking?
What's the non-negotiable constraint?
Eliminate 2 answers immediately
Between final 2 — which is MORE managed/secure/native?
Trust the framework, not panic

Common Mistakes to Avoid

Don't switch a confident answer without a strong reason
Don't assume "cheapest" ignores compliance requirements
Don't pick Lambda for anything >15 min or requiring persistent state
Don't pick Multi-AZ when the question says "region" or "disaster"
Don't forget SCPs/Permissions Boundaries never grant, only restrict
🆕 Don't confuse GSI (flexible) with LSI (rigid, creation-time only)
🆕 Don't forget RDS encryption retrofit requires snapshot→copy→restore
🆕 Read "choose TWO/THREE" instructions carefully — no partial credit

4️⃣3️⃣ ⏰ LAST 30 MINUTES BEFORE THE EXAM

15 Golden Rules

Managed > Self-managed, always, when tied.
Multi-AZ = HA. Read Replica = Reads. Never confuse them.
Multi-AZ ≠ DR. DR = Cross-Region.
SCP restricts, never grants.
Gateway Endpoint = S3/DynamoDB ONLY, free.
VPC Peering is NOT transitive — use Transit Gateway.
Lambda hard limit = 15 minutes.
SQS Standard ≠ ordered/exactly-once — need FIFO.
Aurora Serverless v2 does NOT scale to zero (v1 did).
Explicit DENY always wins in IAM policy evaluation.
IAM Identity Center = employees; Cognito = customers.
AWS DRS = continuous replication DR; AWS Backup = scheduled point-in-time.
WorkSpaces = persistent desktop; AppStream = single streamed app.
Redis persists/replicates; Memcached does not.
GSI = add anytime; LSI = table-creation only.

25 Limits to Remember

Lambda 15min · SQS 256KB/14days · S3 5TB · EBS 64TiB · DynamoDB 400KB item · Aurora 128TB · RDS 5 replicas/Aurora 15 · VPC 5/region · SG 60 rules · ALB 100 target groups · CFN 500 resources · IAM policy 6144 chars · EBS Multi-Attach same-AZ only · NACL lowest-number-first · Route53 health check 10s/30s · S3 multipart >100MB · Aurora Serverless v2 min 0.5 ACU · VPC CIDR /16-/28 · S3 strong consistency · Well-Architected = 6 pillars · DynamoDB GSI max 20/LSI max 5 · SQS visibility timeout max 12hrs · RDS backup retention max 35 days · DynamoDB PITR window 35 days · API Gateway timeout 29s · Lambda concurrency default 1000.

35+ Architectures to Recognize

Static site · 3-tier · Serverless · Event-driven · Microservices · Data lake · Streaming · Hybrid · Warm Standby DR · Active/Active DR · DRS continuous DR · CI/CD pipeline · IoT pipeline · SaaS multi-tenant · Secure VPC · Multi-region DB · Cross-account sharing (RAM) · Centralized logging · Landing zone (Control Tower) · Bastion-less access (SSM) · Blue/Green · Canary · Fan-out (SNS+SQS) · Cache-aside (ElastiCache) · DAX+DynamoDB · Global delivery (CF+GA) · VPC endpoint-secured · Centralized backup · WAF+Shield web app · RDS Proxy+Lambda · Cognito mobile backend · VPC sharing · Hybrid end-user computing · Security investigation pipeline (GuardDuty→Detective) · DB encryption retrofit · Serverless API with DAX caching.

Traps → Section 33 (55 entries) + Section 32 Confusion Killers (34 groups)

Golden Rule Recap by Domain

Security (30%): Least privilege, encryption by default, Roles over Users, defense in depth.
Resilience (26%): Multi-AZ for HA, Cross-Region for DR, decouple with queues/events.
Performance (24%): Right service for workload pattern, caching, serverless for spiky loads.
Cost (20%): Match pricing model to usage pattern, lifecycle policies, right-size continuously.

🎯 Final Checklist

[ ] Read the last sentence first
[ ] Highlight the constraint keyword
[ ] Scan the Service Selection Matrix mentally
[ ] Watch for "NO SUCH THING" traps
[ ] Run through Section 32 Confusion Killers if two answers feel similar
[ ] Pick more managed/native/automated when tied
[ ] DR → RTO/RPO ladder
[ ] Networking → check direction + transitivity
[ ] IAM → remember explicit deny always wins
[ ] DynamoDB → GSI flexible, LSI rigid
[ ] Cache → Redis persists, Memcached doesn't
[ ] Trust your first instinct

📌 PREP TIME ALLOCATION

70% ▓▓▓▓▓▓▓ Practice exams
20% ▓▓      Review wrong answers (esp. Section 32 & 33)
10% ▓       Re-read this sheet

Go score 850+. 🚀