DEV Community: Chayan Samanta The latest articles on DEV Community by Chayan Samanta (@chayan_samanta). https://dev.to/chayan_samanta https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4050930%2Ff44672dd-baca-4c97-a0f5-860e9687a4d3.jpg DEV Community: Chayan Samanta https://dev.to/chayan_samanta en AWS Cheatsheet Chayan Samanta Tue, 28 Jul 2026 19:50:39 +0000 https://dev.to/chayan_samanta/aws-cheatsheet-2jo https://dev.to/chayan_samanta/aws-cheatsheet-2jo <h1> πŸ† AWS SAA-C03 CHEAT SHEET </h1> <h1> πŸ“‹ TABLE OF CONTENTS**** </h1> <ol> <li>Exam Domain Breakdown</li> <li>Exam Framework</li> <li>Thinking Process</li> <li>Well-Architected Framework</li> <li>Service Selection Matrix</li> <li>Flowchart Lookup</li> <li>Distractor Dictionary</li> <li>Service Families</li> <li>Synonyms</li> <li>Default Choices</li> <li>One-Line Definitions</li> <li>Question Patterns</li> <li>Decision Trees</li> <li>VPC Deep Dive</li> <li>IAM Deep Dive</li> <li>S3 Deep Dive</li> <li>Auto Scaling &amp; ELB Deep Dive</li> <li>Route 53 Deep Dive</li> <li>Analytics Deep Dive</li> <li>Cost Optimization Toolkit</li> <li>Additional Services</li> <li>Comparisons</li> <li>Why Answers Are Wrong</li> <li>Architectures</li> <li>Vocabulary</li> <li>Limits</li> <li>Memory Tricks</li> <li>Star Ratings</li> <li>Final 30-Min Sheet</li> </ol> <h1> 1️⃣ EXAM DOMAIN BREAKDOWN </h1> <p><em>Official SAA-C03 domain weighting β€” study time should roughly follow this.</em></p> <p><strong>Domain 1: Design Secure Architectures β€” 30%</strong><br> IAM, KMS, Secrets Manager, VPC security, encryption, compliance</p> <p><strong>Domain 2: Design Resilient Architectures β€” 26%</strong><br> Multi-AZ, DR strategies, decoupling, HA, backup</p> <p><strong>Domain 3: Design High-Performing Architectures β€” 24%</strong><br> Compute selection, storage selection, database selection, caching, networking performance</p> <p><strong>Domain 4: Design Cost-Optimized Architectures β€” 20%</strong><br> Storage classes, compute pricing models, cost tools</p> <blockquote> <p>πŸ“Œ Domain 1 + 2 = 56% of the exam. Security and resilience are NOT optional study areas.</p> </blockquote> <h1> 2️⃣ EXAM FRAMEWORK </h1> <p><strong>7 Steps:</strong></p> <p>1️⃣ Read the LAST sentence first<br> 2️⃣ Find the REQUIREMENT<br> 3️⃣ Find the CONSTRAINT<br> 4️⃣ Highlight KEYWORDS<br> 5️⃣ ELIMINATE impossible answers<br> 6️⃣ COMPARE the final 2<br> 7️⃣ Pick the BEST-PRACTICE answer</p> <h3> πŸ§ͺ Example 1 </h3> <p>πŸ“ <em>"...automatic failover, AZ outage, zero data loss, no app changes"</em></p> <p>Keywords:</p> <ul> <li>automatic failover</li> <li>zero data loss</li> </ul> <p>Eliminate:</p> <ul> <li>❌ Read Replica (async, manual)</li> </ul> <p>βœ… <strong>Answer: RDS Multi-AZ</strong></p> <h3> πŸ§ͺ Example 2 </h3> <p>πŸ“ <em>"...serve video worldwide, lowest latency, signed URLs"</em></p> <p>Eliminate:</p> <ul> <li>❌ Direct S3 (no edge cache)</li> </ul> <p>βœ… <strong>Answer: CloudFront + S3 (OAC) + Signed URLs</strong></p> <h3> πŸ§ͺ Example 3 </h3> <p>πŸ“ <em>"...exactly once, exact order"</em></p> <p>Eliminate:</p> <ul> <li>❌ SQS Standard</li> <li>❌ SNS</li> </ul> <p>βœ… <strong>Answer: SQS FIFO</strong></p> <h3> πŸ§ͺ Example 4 (NEW) </h3> <p>πŸ“ <em>"A company runs a nightly batch job that takes 2 hours. It must not run on EC2 that needs patching. Lowest cost, fault-tolerant."</em></p> <p>Keywords:</p> <ul> <li>2 hours (rules out Lambda)</li> <li>lowest cost + fault-tolerant (Spot)</li> <li>no patching (rules out self-managed EC2 ASG)</li> </ul> <p>Eliminate:</p> <ul> <li>❌ Lambda (&gt;15min limit)</li> <li>❌ On-Demand EC2 (not lowest cost)</li> </ul> <p>βœ… <strong>Answer: AWS Batch on Spot Instances / Fargate</strong></p> <h1> 3️⃣ THE AWS THINKING PROCESS </h1> <ol> <li>Managed <strong>&gt;</strong> Self-managed</li> <li>Serverless <strong>&gt;</strong> Provisioned</li> <li>Native AWS <strong>&gt;</strong> 3rd-party</li> <li>Automated <strong>&gt;</strong> Manual</li> <li>Least ops overhead wins ties</li> <li>Elastic <strong>&gt;</strong> Fixed capacity</li> <li>Secure by default</li> <li>HA by default (if "production")</li> <li>Cost matched to workload pattern</li> </ol> <blockquote> <p>⚠️ <strong>Override:</strong> Compliance/security beats cost/efficiency every time.</p> </blockquote> <h1> 4️⃣ WELL-ARCHITECTED FRAMEWORK </h1> <p><em>Explicitly tested in Domain 4 and referenced throughout the exam.</em></p> <h3> πŸ›οΈ The 6 Pillars </h3> <p><strong>1. Operational Excellence</strong></p> <ul> <li>Run/monitor systems, improve processes</li> <li>Services: CloudFormation, CloudWatch, Config, Systems Manager</li> <li>Keyword: "automate operations", "IaC", "runbooks"</li> </ul> <p><strong>2. Security</strong></p> <ul> <li>Protect data/systems, manage identities</li> <li>Services: IAM, KMS, GuardDuty, WAF, Shield, Macie</li> <li>Keyword: "least privilege", "defense in depth", "encrypt everything"</li> </ul> <p><strong>3. Reliability</strong></p> <ul> <li>Recover from failure, scale to meet demand</li> <li>Services: Multi-AZ, Auto Scaling, ELB, Route 53 health checks</li> <li>Keyword: "self-healing", "fault isolation", "recover automatically"</li> </ul> <p><strong>4. Performance Efficiency</strong></p> <ul> <li>Use resources efficiently, adapt to changing needs</li> <li>Services: Lambda, DynamoDB, CloudFront, right-sized EC2</li> <li>Keyword: "elastic", "use serverless", "select correct instance type"</li> </ul> <p><strong>5. Cost Optimization</strong></p> <ul> <li>Avoid unnecessary costs</li> <li>Services: Cost Explorer, Trusted Advisor, Compute Optimizer, Savings Plans</li> <li>Keyword: "lowest cost", "right-sizing", "eliminate waste"</li> </ul> <p><strong>6. Sustainability</strong></p> <ul> <li>Minimize environmental impact</li> <li>Services: managed services (share infra efficiently), region selection</li> <li>Keyword: "minimize carbon footprint", "maximize utilization"</li> </ul> <blockquote> <p>πŸ“Œ Exam trap: A question mentioning "reduce carbon footprint" or "sustainability" β†’ pick managed services / consolidate workloads, NOT a technical redesign.</p> </blockquote> <h1> 5️⃣ SERVICE SELECTION MATRIX </h1> <p><em>Scan this before decision trees.</em></p> <p><strong>Database</strong></p> <ul> <li>HA relational β†’ Multi-AZ</li> <li>Read scaling β†’ Read Replica</li> <li>Global relational reads β†’ Aurora Global DB</li> <li>Massive NoSQL β†’ DynamoDB</li> <li>Microsecond cache (DynamoDB) β†’ DAX</li> <li>In-memory cache β†’ ElastiCache</li> <li>Data warehouse β†’ Redshift</li> <li>Graph β†’ Neptune</li> <li>Time-series β†’ Timestream</li> <li>Ledger/immutable audit β†’ QLDB</li> </ul> <p><strong>Messaging</strong></p> <ul> <li>Queue β†’ SQS Standard</li> <li>Exactly-once + order β†’ SQS FIFO</li> <li>Fan-out β†’ SNS</li> <li>Event routing β†’ EventBridge</li> <li>Workflow orchestration β†’ Step Functions</li> <li>Real-time stream + replay β†’ Kinesis Streams</li> <li>Buffered delivery β†’ Kinesis Firehose</li> <li>Managed Kafka β†’ MSK</li> </ul> <p><strong>Storage</strong></p> <ul> <li>Block, 1 instance β†’ EBS</li> <li>Shared file, Linux β†’ EFS</li> <li>Shared file, Windows β†’ FSx Windows</li> <li>HPC scratch β†’ FSx Lustre</li> <li>NetApp features β†’ FSx ONTAP</li> <li>Object storage β†’ S3</li> <li>Cheapest archive β†’ Glacier Deep Archive</li> <li>Unknown access pattern β†’ Intelligent-Tiering</li> </ul> <p><strong>Compute</strong></p> <ul> <li>Serverless, &lt;15min β†’ Lambda</li> <li>Serverless container β†’ Fargate</li> <li>Kubernetes β†’ EKS</li> <li>Simple containers β†’ ECS</li> <li>Simple web app deploy β†’ Elastic Beanstalk</li> <li>Cheap simple VPS β†’ Lightsail</li> <li>Batch/HPC β†’ AWS Batch</li> </ul> <p><strong>Networking</strong></p> <ul> <li>CDN β†’ CloudFront</li> <li>Global static IP β†’ Global Accelerator</li> <li>DNS routing β†’ Route 53</li> <li>Dedicated bandwidth β†’ Direct Connect</li> <li>Quick hybrid link β†’ VPN</li> <li>Remote user access β†’ Client VPN</li> <li>Many VPCs β†’ Transit Gateway</li> <li>2 VPCs β†’ VPC Peering</li> <li>Free private S3/DynamoDB β†’ Gateway Endpoint</li> <li>Private access, other services β†’ Interface Endpoint</li> </ul> <p><strong>Security</strong></p> <ul> <li>Temp credentials β†’ IAM Role</li> <li>Multi-account guardrail β†’ SCP</li> <li>Cap 1 identity's perms β†’ Permissions Boundary</li> <li>Secret w/ rotation β†’ Secrets Manager</li> <li>Plain config β†’ Parameter Store</li> <li>Encryption keys β†’ KMS</li> <li>Dedicated HSM β†’ CloudHSM</li> <li>Threat detection β†’ GuardDuty</li> <li>Vulnerability scan β†’ Inspector</li> <li>Sensitive data discovery β†’ Macie</li> <li>Central security view β†’ Security Hub</li> <li>Web exploits β†’ WAF</li> <li>DDoS β†’ Shield</li> <li>TLS certs β†’ ACM</li> </ul> <p><strong>Monitoring</strong></p> <ul> <li>API audit β†’ CloudTrail</li> <li>Config drift β†’ AWS Config</li> <li>Metrics/alarms β†’ CloudWatch</li> <li>Tracing β†’ X-Ray</li> <li>Automated best-practice checks β†’ Trusted Advisor</li> <li>Instance right-sizing β†’ Compute Optimizer</li> </ul> <p><strong>Migration</strong></p> <ul> <li>DB migration β†’ DMS</li> <li>Server lift &amp; shift β†’ MGN</li> <li>Bulk offline β†’ Snowball</li> <li>Ongoing sync β†’ DataSync</li> <li>SFTP β†’ Transfer Family</li> </ul> <p><strong>Cost</strong></p> <ul> <li>Spend forecasting β†’ Cost Explorer</li> <li>Budget alerts β†’ AWS Budgets</li> <li>Detailed billing data β†’ Cost &amp; Usage Report</li> <li>Best-practice recommendations β†’ Trusted Advisor</li> </ul> <h1> 6️⃣ FLOWCHART LOOKUP </h1> <h3> πŸ—ƒοΈ Database? </h3> <ul> <li> <p>Relational?</p> <ul> <li>Need HA? β†’ <strong>Multi-AZ</strong> </li> <li>Need reads? β†’ <strong>Read Replica</strong> </li> <li>Need global reads? β†’ <strong>Aurora Global DB</strong> </li> <li>Unpredictable load? β†’ <strong>Aurora Serverless v2</strong> </li> <li>Specific engine? β†’ <strong>RDS</strong> </li> </ul> </li> <li> <p>NoSQL?</p> <ul> <li>Key-value, huge scale? β†’ <strong>DynamoDB</strong> </li> <li>Need ΞΌs cache? β†’ <strong>DAX</strong> </li> <li>Graph? β†’ <strong>Neptune</strong> </li> <li>Time-series? β†’ <strong>Timestream</strong> </li> <li>MongoDB-style? β†’ <strong>DocumentDB</strong> </li> <li>Immutable ledger? β†’ <strong>QLDB</strong> </li> </ul> </li> </ul> <h3> πŸ—„οΈ Storage? </h3> <ul> <li>Block, 1 instance? β†’ <strong>EBS</strong> </li> <li>Shared file, Linux? β†’ <strong>EFS</strong> </li> <li>Shared file, Windows? β†’ <strong>FSx Windows</strong> </li> <li>HPC scratch? β†’ <strong>FSx Lustre</strong> </li> <li>Object, general? β†’ <strong>S3 Standard</strong> </li> <li>Object, infrequent? β†’ <strong>S3 Standard-IA</strong> </li> <li>Unknown pattern? β†’ <strong>Intelligent-Tiering</strong> </li> <li>Archive (hrs)? β†’ <strong>Glacier Flexible</strong> </li> <li>Archive (cheapest)? β†’ <strong>Glacier Deep Archive</strong> </li> </ul> <h3> πŸ’» Compute? </h3> <ul> <li>Full OS control? β†’ <strong>EC2</strong> </li> <li>Simple web app, quick deploy? β†’ <strong>Elastic Beanstalk</strong> </li> <li>Simple VPS, predictable low cost? β†’ <strong>Lightsail</strong> </li> <li>Event-driven, &lt;15min? β†’ <strong>Lambda</strong> </li> <li>Containers, K8s? β†’ <strong>EKS</strong> </li> <li>Containers, AWS-native? β†’ <strong>ECS</strong> </li> <li>No server mgmt? β†’ <strong>Fargate</strong> </li> <li>Batch/HPC? β†’ <strong>AWS Batch</strong> </li> </ul> <h3> 🌐 Networking? </h3> <ul> <li>Dedicated bandwidth? β†’ <strong>Direct Connect</strong> </li> <li>Quick setup? β†’ <strong>Site-to-Site VPN</strong> </li> <li>Many VPCs (hub-spoke)? β†’ <strong>Transit Gateway</strong> </li> <li>2 VPCs simply? β†’ <strong>VPC Peering</strong> </li> <li>Private, S3/DynamoDB? β†’ <strong>Gateway Endpoint</strong> </li> <li>Private, other services? β†’ <strong>Interface Endpoint</strong> </li> <li>Global static IP? β†’ <strong>Global Accelerator</strong> </li> <li>Cache content? β†’ <strong>CloudFront</strong> </li> </ul> <h3> πŸ” Security? </h3> <ul> <li>Temp credentials? β†’ <strong>IAM Role</strong> </li> <li>Multi-account rule? β†’ <strong>SCP</strong> </li> <li>Cap 1 identity? β†’ <strong>Permissions Boundary</strong> </li> <li>Encrypt data? β†’ <strong>KMS</strong> </li> <li>Rotate DB creds? β†’ <strong>Secrets Manager</strong> </li> <li>Plain config? β†’ <strong>Parameter Store</strong> </li> <li>Detect threats? β†’ <strong>GuardDuty</strong> </li> <li>Scan CVEs? β†’ <strong>Inspector</strong> </li> <li>Find PII? β†’ <strong>Macie</strong> </li> <li>Web exploits? β†’ <strong>WAF</strong> </li> <li>DDoS? β†’ <strong>Shield</strong> </li> <li>TLS certificates? β†’ <strong>ACM</strong> </li> </ul> <h3> πŸ“¨ Messaging? </h3> <ul> <li>Decoupling? β†’ <strong>SQS Standard</strong> </li> <li>Exactly-once + order? β†’ <strong>SQS FIFO</strong> </li> <li>Fan-out? β†’ <strong>SNS</strong> </li> <li>Rule-based routing? β†’ <strong>EventBridge</strong> </li> <li>Multi-step workflow? β†’ <strong>Step Functions</strong> </li> <li>Stream + replay? β†’ <strong>Kinesis Streams</strong> </li> <li>Managed Kafka? β†’ <strong>MSK</strong> </li> </ul> <h1> 7️⃣ DISTRACTOR DICTIONARY </h1> <p><em>Phrase β†’ Correct Service</em></p> <ul> <li>πŸ“Œ Lowest ops overhead β†’ Managed service</li> <li>πŸ“Œ Least admin effort β†’ Managed/serverless</li> <li>πŸ“Œ Don't rewrite app β†’ Rehost (EC2)</li> <li>πŸ“Œ Existing Oracle/SQL Server β†’ RDS</li> <li>πŸ“Œ Existing MySQL/Postgres, want perf β†’ Aurora</li> <li>πŸ“Œ Existing Kubernetes β†’ EKS</li> <li>πŸ“Œ Existing Docker β†’ ECS/Fargate</li> <li>πŸ“Œ Millions of requests/sec β†’ DynamoDB / Lambda / Auto Scaling</li> <li>πŸ“Œ Unpredictable traffic β†’ Auto Scaling / Aurora Serverless</li> <li>πŸ“Œ Compliance requirement β†’ KMS + IAM + Config + CloudTrail</li> <li>πŸ“Œ Analytics/BI β†’ Athena / Glue / Redshift</li> <li>πŸ“Œ Real-time streaming β†’ Kinesis Data Streams</li> <li>πŸ“Œ Near-real-time β†’ Kinesis Firehose</li> <li>πŸ“Œ Static content β†’ S3 + CloudFront</li> <li>πŸ“Œ Temporary credentials β†’ IAM Role</li> <li>πŸ“Œ Cross-account access β†’ IAM Role + Trust Policy</li> <li>πŸ“Œ No server management β†’ Lambda / Fargate / DynamoDB</li> <li>πŸ“Œ Cost-effective, steady β†’ Reserved Instance / Savings Plan</li> <li>πŸ“Œ Cost-effective, flexible β†’ Spot Instances</li> <li>πŸ“Œ Encrypted at rest β†’ KMS / SSE-S3</li> <li>πŸ“Œ Rotate credentials β†’ Secrets Manager</li> <li>πŸ“Œ Non-sensitive config β†’ Parameter Store</li> <li>πŸ“Œ Compromised credentials β†’ GuardDuty</li> <li>πŸ“Œ Scan vulnerabilities β†’ Inspector</li> <li>πŸ“Œ Discover PII β†’ Macie</li> <li>πŸ“Œ Centralize security β†’ Security Hub</li> <li>πŸ“Œ SQL injection β†’ WAF</li> <li>πŸ“Œ DDoS β†’ Shield</li> <li>πŸ“Œ Who did this β†’ CloudTrail</li> <li>πŸ“Œ What changed β†’ AWS Config</li> <li>πŸ“Œ Monitor CPU/memory β†’ CloudWatch</li> <li>πŸ“Œ Trace request across services β†’ X-Ray</li> <li>πŸ“Œ Dedicated line β†’ Direct Connect</li> <li>πŸ“Œ Quick encrypted link β†’ Site-to-Site VPN</li> <li>πŸ“Œ Remote employees need VPC β†’ Client VPN</li> <li>πŸ“Œ Many VPCs, central routing β†’ Transit Gateway</li> <li>πŸ“Œ Two VPCs only β†’ VPC Peering</li> <li>πŸ“Œ Private, S3 only β†’ Gateway Endpoint</li> <li>πŸ“Œ Private, other services β†’ Interface Endpoint</li> <li>πŸ“Œ Expose service privately β†’ PrivateLink</li> <li>πŸ“Œ Global app, static IP, non-HTTP β†’ Global Accelerator</li> <li>πŸ“Œ Automatic DB failover β†’ Multi-AZ</li> <li>πŸ“Œ Offload reads β†’ Read Replica</li> <li>πŸ“Œ Cross-region DB reads β†’ Aurora Global DB</li> <li>πŸ“Œ Multi-region active-active β†’ DynamoDB Global Tables</li> <li>πŸ“Œ Centralized backup β†’ AWS Backup</li> <li>πŸ“Œ Continuous DR replication β†’ Elastic Disaster Recovery</li> <li>πŸ“Œ DB migration, minimal downtime β†’ DMS (CDC)</li> <li>πŸ“Œ DB migration, diff engine β†’ DMS + SCT</li> <li>πŸ“Œ Whole server migration β†’ MGN</li> <li>πŸ“Œ Bulk offline transfer β†’ Snowball</li> <li>πŸ“Œ Scheduled sync β†’ DataSync</li> <li>πŸ“Œ SFTP access β†’ Transfer Family</li> <li>πŸ“Œ On-prem app, cloud storage β†’ Storage Gateway</li> <li>πŸ“Œ Serverless SQL on S3 β†’ Athena</li> <li>πŸ“Œ ETL + catalog β†’ Glue</li> <li>πŸ“Œ Lambdaβ†’RDS pooling β†’ RDS Proxy</li> <li>πŸ“Œ SaaS multi-tenant data β†’ DynamoDB w/ tenant partition key</li> <li>πŸ“Œ Mobile app login β†’ Cognito User Pools</li> <li>πŸ“Œ Federated temp creds β†’ Cognito Identity Pools</li> <li>πŸ“Œ Central SSO β†’ IAM Identity Center</li> <li>πŸ“Œ Auto landing zone β†’ Control Tower</li> <li>πŸ“Œ Share resource cross-account β†’ RAM</li> <li>πŸ“Œ IaC, AWS native β†’ CloudFormation</li> <li>πŸ“Œ IaC, programming language β†’ CDK</li> <li>πŸ“Œ TLS cert management β†’ ACM</li> <li>πŸ“Œ Dedicated HSM β†’ CloudHSM</li> <li>πŸ“Œ SSH without open ports β†’ SSM Session Manager</li> <li>πŸ“Œ Right-size EC2 fleet β†’ Compute Optimizer</li> <li>πŸ“Œ Best-practice health check β†’ Trusted Advisor</li> <li>πŸ“Œ Detailed hourly billing data β†’ Cost &amp; Usage Report</li> <li>πŸ“Œ Simple 3-tier deploy, minimal config β†’ Elastic Beanstalk</li> <li>πŸ“Œ Cheap predictable small workload β†’ Lightsail</li> <li>πŸ“Œ Track migration project status β†’ Migration Hub</li> <li>πŸ“Œ Discover on-prem servers β†’ Application Discovery Service</li> <li>πŸ“Œ Reduce carbon footprint β†’ Managed services / consolidate</li> <li>πŸ“Œ Immutable audit ledger β†’ QLDB</li> <li>πŸ“Œ Central data catalog for governance β†’ Lake Formation</li> </ul> <h1> 8️⃣ SERVICE FAMILIES </h1> <p><strong>πŸ—„οΈ Storage</strong><br> S3 β€’ EBS β€’ EFS β€’ FSx β€’ Storage Gateway β€’ AWS Backup β€’ Snow Family</p> <p><strong>πŸ—ƒοΈ Database</strong><br> RDS β€’ Aurora β€’ DynamoDB β€’ ElastiCache β€’ Redshift β€’ Neptune β€’ Timestream β€’ QLDB β€’ DocumentDB</p> <p><strong>🌐 Networking</strong><br> ALB β€’ NLB β€’ GWLB β€’ CloudFront β€’ Global Accelerator β€’ VPN β€’ Client VPN β€’ Direct Connect β€’ Transit Gateway β€’ PrivateLink β€’ Route 53</p> <p><strong>πŸ” Security</strong><br> IAM β€’ KMS β€’ Secrets Manager β€’ Parameter Store β€’ GuardDuty β€’ Inspector β€’ Macie β€’ Security Hub β€’ WAF β€’ Shield β€’ CloudHSM β€’ ACM</p> <p><strong>πŸ’» Compute</strong><br> EC2 β€’ Lambda β€’ ECS β€’ EKS β€’ Fargate β€’ Batch β€’ Elastic Beanstalk β€’ Lightsail</p> <p><strong>πŸ“¨ Messaging</strong><br> SQS β€’ SNS β€’ EventBridge β€’ Step Functions β€’ Kinesis β€’ MSK</p> <p><strong>πŸ“Š Monitoring</strong><br> CloudWatch β€’ CloudTrail β€’ Config β€’ X-Ray β€’ Trusted Advisor β€’ Compute Optimizer</p> <p><strong>🚚 Migration</strong><br> DMS β€’ MGN β€’ DataSync β€’ Storage Gateway β€’ Snow Family β€’ Transfer Family β€’ Migration Hub β€’ Application Discovery Service</p> <p><strong>πŸ“ˆ Analytics</strong><br> Athena β€’ Glue β€’ EMR β€’ Redshift β€’ QuickSight β€’ Lake Formation β€’ Kinesis family</p> <p><strong>πŸ’° Cost</strong><br> Cost Explorer β€’ AWS Budgets β€’ Cost &amp; Usage Report β€’ Trusted Advisor β€’ Compute Optimizer β€’ Savings Plans</p> <h1> 9️⃣ SERVICE SYNONYMS </h1> <p><em>AWS says β†’ Think</em></p> <ul> <li>πŸ”Ή Durable β†’ S3</li> <li>πŸ”Ή Elastic β†’ Auto Scaling</li> <li>πŸ”Ή Fault tolerant β†’ Multi-AZ</li> <li>πŸ”Ή Resilient β†’ Multi-AZ/Region</li> <li>πŸ”Ή Archive β†’ Glacier</li> <li>πŸ”Ή Queue β†’ SQS</li> <li>πŸ”Ή Fan-out β†’ SNS</li> <li>πŸ”Ή Orchestration β†’ Step Functions</li> <li>πŸ”Ή Event routing β†’ EventBridge</li> <li>πŸ”Ή Temp credentials β†’ IAM Role</li> <li>πŸ”Ή Secrets β†’ Secrets Manager</li> <li>πŸ”Ή Config values β†’ Parameter Store</li> <li>πŸ”Ή Encryption keys β†’ KMS</li> <li>πŸ”Ή Audit trail β†’ CloudTrail</li> <li>πŸ”Ή Compliance drift β†’ AWS Config</li> <li>πŸ”Ή Performance β†’ CloudWatch</li> <li>πŸ”Ή Latency bottleneck β†’ X-Ray</li> <li>πŸ”Ή Threats β†’ GuardDuty</li> <li>πŸ”Ή CVEs β†’ Inspector</li> <li>πŸ”Ή PII β†’ Macie</li> <li>πŸ”Ή Dedicated bandwidth β†’ Direct Connect</li> <li>πŸ”Ή Quick hybrid β†’ VPN</li> <li>πŸ”Ή Hub-and-spoke β†’ Transit Gateway</li> <li>πŸ”Ή Private connectivity β†’ VPC Endpoint</li> <li>πŸ”Ή Global static IP β†’ Global Accelerator</li> <li>πŸ”Ή Content caching β†’ CloudFront</li> <li>πŸ”Ή Serverless β†’ Lambda/Fargate/DynamoDB</li> <li>πŸ”Ή Lift and shift β†’ EC2/MGN</li> <li>πŸ”Ή Zero data loss β†’ Sync replication (Multi-AZ)</li> <li>πŸ”Ή Right-sizing β†’ Compute Optimizer</li> <li>πŸ”Ή Data governance/catalog β†’ Lake Formation/Glue</li> </ul> <h1> πŸ”Ÿ AWS DEFAULT CHOICES </h1> <p><em>When question is ambiguous:</em></p> <ul> <li>βœ… "Production" β†’ Multi-AZ</li> <li>βœ… Encryption unspecified β†’ Enable it</li> <li>βœ… Service-to-service auth β†’ IAM Role</li> <li>βœ… Database placement β†’ Private subnet</li> <li>βœ… Public HTTP traffic β†’ ALB</li> <li>βœ… Global content β†’ CloudFront</li> <li>βœ… Static content β†’ S3</li> <li>βœ… Private S3 access β†’ Gateway Endpoint</li> <li>βœ… Private other-service access β†’ Interface Endpoint</li> <li>βœ… "No server management" β†’ Fargate</li> <li>βœ… Job &gt;15min β†’ NOT Lambda</li> <li>βœ… Steady workload β†’ Reserved/Savings Plan</li> <li>βœ… Spiky workload β†’ Spot</li> <li>βœ… Rotating creds β†’ Secrets Manager</li> <li>βœ… Plain config β†’ Parameter Store</li> <li>βœ… Cross-account β†’ IAM Role + Trust Policy</li> <li>βœ… Multi-account restriction β†’ SCP</li> <li>βœ… Quick web app deployment β†’ Elastic Beanstalk</li> <li>βœ… Simple predictable workload/budget β†’ Lightsail</li> </ul> <h1> 1️⃣1️⃣ ONE-LINE DEFINITIONS </h1> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>CloudTrail β†’ Who did it? CloudWatch β†’ How is it performing? Config β†’ What changed? GuardDuty β†’ Who is attacking? Inspector β†’ What is vulnerable? Macie β†’ Where is sensitive data? Security Hub β†’ What's the overall security posture? WAF β†’ Block bad web requests Shield β†’ Block DDoS floods KMS β†’ Manage encryption keys Secrets Mgr β†’ Store &amp; rotate secrets Param Store β†’ Store plain config SQS β†’ Hold messages until processed SNS β†’ Broadcast to many subscribers EventBridge β†’ Route events by rule Step Functions β†’ Orchestrate multi-step workflow Multi-AZ β†’ Survive AZ failure (HA) Read Replica β†’ Scale read traffic Aurora Global DB β†’ Cross-region reads + fast DR Transit Gateway β†’ Hub for many VPCs VPC Peering β†’ Direct link between 2 VPCs (non-transitive) Gateway Endpoint β†’ Free private path to S3/DynamoDB only Interface Endpoint β†’ Private path to everything else Direct Connect β†’ Dedicated, consistent bandwidth VPN β†’ Quick, encrypted, internet-based link Trusted Advisor β†’ Automated best-practice checks Compute Optimizer β†’ Right-size your EC2/Lambda Cost Explorer β†’ Analyze/forecast spend AWS Budgets β†’ Alert before overspending Elastic Beanstalk β†’ Deploy app without managing infra Lightsail β†’ Simple VPS, predictable pricing Lake Formation β†’ Central data lake governance </code></pre> </div> <h1> 1️⃣2️⃣ QUESTION PATTERNS </h1> <ul> <li>πŸ“ "A company wants..." β†’ Architecture question</li> <li>πŸ“ "A company needs..." β†’ Service selection</li> <li>πŸ“ "A company must..." β†’ Compliance/security</li> <li>πŸ“ "An application..." β†’ Compute/storage/DB</li> <li>πŸ“ "Developers need..." β†’ IAM / CI-CD</li> <li>πŸ“ "...LEAST operational overhead" β†’ Most-managed option</li> <li>πŸ“ "...LOWEST cost" β†’ Check workload pattern</li> <li>πŸ“ "MOST secure way" β†’ Encryption + least privilege</li> <li>πŸ“ "MOST resilient" β†’ Multi-AZ / Multi-Region</li> <li>πŸ“ "Without re-architecting" β†’ Keep relational/EC2</li> <li>πŸ“ "Minimize administrative burden" β†’ Managed service</li> <li>πŸ“ "Reduce carbon footprint" β†’ Managed services / consolidate regions</li> </ul> <h1> 1️⃣3️⃣ DECISION TREES </h1> <h3> πŸ—„οΈ Storage </h3> <p>Need storage?</p> <ul> <li> <p>Block, single instance?</p> <ul> <li>β†’ <strong>EBS</strong> </li> <li>⚠️ Shared block across AZs?</li> <li>β†’ NO SUCH THING β†’ use EFS/FSx</li> </ul> </li> <li> <p>Block, shared, same AZ?</p> <ul> <li>β†’ <strong>EBS Multi-Attach</strong> (io1/io2 only)</li> <li>⚠️ Multi-Attach across AZs?</li> <li>β†’ NO SUCH THING β†’ use EFS/FSx</li> </ul> </li> <li> <p>Shared file, Linux?</p> <ul> <li>β†’ <strong>EFS</strong> </li> </ul> </li> <li> <p>Shared file, Windows?</p> <ul> <li>β†’ <strong>FSx Windows</strong> </li> </ul> </li> <li> <p>HPC scratch?</p> <ul> <li>β†’ <strong>FSx Lustre</strong> </li> </ul> </li> <li> <p>NetApp features (snapshots/cloning)?</p> <ul> <li>β†’ <strong>FSx for NetApp ONTAP</strong> </li> </ul> </li> <li> <p>Object storage?</p> <ul> <li>β†’ <strong>S3</strong> </li> <li>⚠️ Low-latency file access at S3 scale?</li> <li>β†’ NO SUCH THING β†’ use EFS/FSx</li> <li>Frequent β†’ S3 Standard</li> <li>Infrequent β†’ Standard-IA</li> <li>Unknown pattern β†’ Intelligent-Tiering</li> <li>Archive (hrs) β†’ Glacier Flexible</li> <li>Deep archive β†’ Glacier Deep Archive</li> </ul> </li> <li> <p>On-prem, cloud-backed local vol?</p> <ul> <li>β†’ <strong>Storage Gateway</strong> </li> </ul> </li> <li> <p>Migrate/sync large data?</p> <ul> <li>β†’ <strong>DataSync</strong> (online) / <strong>Snowball</strong> (offline)</li> </ul> </li> </ul> <h3> πŸ’» Compute </h3> <ul> <li> <p>Full OS control?</p> <ul> <li>β†’ <strong>EC2</strong> </li> </ul> </li> <li> <p>Quick web app, minimal config?</p> <ul> <li>β†’ <strong>Elastic Beanstalk</strong> </li> <li>⚠️ Need low-level infra control?</li> <li>β†’ NO (that's the point of EB) β†’ use raw EC2 instead</li> </ul> </li> <li> <p>Cheap simple VPS?</p> <ul> <li>β†’ <strong>Lightsail</strong> </li> </ul> </li> <li> <p>Event-driven, short?</p> <ul> <li>β†’ <strong>Lambda</strong> </li> <li>⚠️ Runs &gt;15min?</li> <li>β†’ NO SUCH THING β†’ Fargate/Batch/EC2</li> </ul> </li> <li> <p>Containers, K8s?</p> <ul> <li>β†’ <strong>EKS</strong> </li> </ul> </li> <li> <p>Containers, AWS-native?</p> <ul> <li>β†’ <strong>ECS</strong> </li> </ul> </li> <li> <p>No EC2 mgmt?</p> <ul> <li>β†’ <strong>Fargate</strong> </li> <li>⚠️ Need GPU/custom AMI?</li> <li>β†’ NO SUCH THING β†’ use EC2 launch type</li> </ul> </li> <li> <p>Batch/HPC?</p> <ul> <li>β†’ <strong>AWS Batch</strong> </li> </ul> </li> </ul> <h3> πŸ—ƒοΈ Database </h3> <ul> <li> <p>Relational, specific engine?</p> <ul> <li>β†’ <strong>RDS</strong> </li> </ul> </li> <li> <p>Relational, MySQL/Postgres?</p> <ul> <li>β†’ <strong>Aurora</strong> </li> <li>Spiky traffic β†’ Aurora Serverless v2</li> <li>⚠️ Scale to zero?</li> <li>β†’ NO SUCH THING in v2 (min 0.5 ACU)</li> <li>Auto replica failover β†’ possible βœ” (priority tiers)</li> </ul> </li> <li> <p>Need HA (AZ failure)?</p> <ul> <li>β†’ <strong>Multi-AZ</strong> </li> <li>⚠️ Standby also serves reads?</li> <li>β†’ NO SUCH THING (standard RDS) β†’ use Read Replica/Aurora</li> </ul> </li> <li> <p>Need read scaling?</p> <ul> <li>β†’ <strong>Read Replica</strong> </li> <li>⚠️ Auto failover from Replica?</li> <li>β†’ NO SUCH THING β†’ use Multi-AZ</li> </ul> </li> <li> <p>Cross-region reads + DR?</p> <ul> <li>β†’ <strong>Aurora Global Database</strong> </li> </ul> </li> <li> <p>Lambda + RDS pooling issue?</p> <ul> <li>β†’ <strong>RDS Proxy</strong> </li> </ul> </li> <li> <p>NoSQL, massive scale?</p> <ul> <li>β†’ <strong>DynamoDB</strong> </li> <li>⚠️ SQL joins across tables?</li> <li>β†’ NO SUCH THING β†’ use Aurora/RDS</li> </ul> </li> <li> <p>DynamoDB + ΞΌs cache?</p> <ul> <li>β†’ <strong>DAX</strong> </li> </ul> </li> <li> <p>Multi-region active-active NoSQL?</p> <ul> <li>β†’ <strong>DynamoDB Global Tables</strong> </li> </ul> </li> <li> <p>In-memory cache?</p> <ul> <li>β†’ <strong>ElastiCache</strong> </li> </ul> </li> <li> <p>Data warehouse?</p> <ul> <li>β†’ <strong>Redshift</strong> </li> </ul> </li> <li> <p>Graph?</p> <ul> <li>β†’ <strong>Neptune</strong> </li> </ul> </li> <li> <p>Time-series?</p> <ul> <li>β†’ <strong>Timestream</strong> </li> </ul> </li> <li> <p>Immutable ledger?</p> <ul> <li>β†’ <strong>QLDB</strong> </li> </ul> </li> <li> <p>MongoDB-compatible?</p> <ul> <li>β†’ <strong>DocumentDB</strong> </li> </ul> </li> </ul> <h3> 🌐 Networking &amp; Hybrid </h3> <ul> <li> <p>Public subnet in/out?</p> <ul> <li>β†’ <strong>Internet Gateway</strong> </li> </ul> </li> <li> <p>Private subnet, outbound only?</p> <ul> <li>β†’ <strong>NAT Gateway</strong> </li> <li>⚠️ NAT for inbound?</li> <li>β†’ NO SUCH THING β†’ use ALB/NLB</li> </ul> </li> <li> <p>On-prem, quick + encrypted?</p> <ul> <li>β†’ <strong>Site-to-Site VPN</strong> </li> </ul> </li> <li> <p>Individual remote users?</p> <ul> <li>β†’ <strong>Client VPN</strong> </li> </ul> </li> <li> <p>Dedicated bandwidth?</p> <ul> <li>β†’ <strong>Direct Connect</strong> </li> </ul> </li> <li> <p>Many VPCs, hub-spoke?</p> <ul> <li>β†’ <strong>Transit Gateway</strong> </li> </ul> </li> <li> <p>2 VPCs, simple?</p> <ul> <li>β†’ <strong>VPC Peering</strong> </li> <li>⚠️ Transitive routing (A↔B↔C)?</li> <li>β†’ NO SUCH THING β†’ use Transit Gateway</li> </ul> </li> <li> <p>Free private S3/DynamoDB?</p> <ul> <li>β†’ <strong>Gateway Endpoint</strong> </li> <li>⚠️ Gateway for EC2/SNS/etc?</li> <li>β†’ NO SUCH THING β†’ use Interface Endpoint</li> </ul> </li> <li> <p>Private, other AWS/SaaS?</p> <ul> <li>β†’ <strong>Interface Endpoint</strong> </li> </ul> </li> <li> <p>Expose your service privately?</p> <ul> <li>β†’ <strong>PrivateLink</strong> </li> </ul> </li> <li> <p>Global static IP, non-HTTP?</p> <ul> <li>β†’ <strong>Global Accelerator</strong> </li> </ul> </li> <li> <p>Content caching?</p> <ul> <li>β†’ <strong>CloudFront</strong> </li> </ul> </li> </ul> <h3> πŸ” Security &amp; IAM </h3> <ul> <li> <p>Temp access, app/service?</p> <ul> <li>β†’ <strong>IAM Role</strong> </li> <li>⚠️ Long-term keys for app?</li> <li>β†’ AVOID β†’ use Role</li> </ul> </li> <li> <p>Multi-account guardrail?</p> <ul> <li>β†’ <strong>SCP</strong> </li> <li>⚠️ SCP to GRANT permission?</li> <li>β†’ NO SUCH THING β†’ use IAM Policy</li> </ul> </li> <li> <p>Cap 1 delegated admin?</p> <ul> <li>β†’ <strong>Permissions Boundary</strong> </li> </ul> </li> <li> <p>Share resource cross-account?</p> <ul> <li>β†’ <strong>RAM</strong> </li> </ul> </li> <li> <p>Encrypt, AWS manages keys?</p> <ul> <li>β†’ <strong>SSE-S3</strong> </li> </ul> </li> <li> <p>Encrypt, control key policy?</p> <ul> <li>β†’ <strong>SSE-KMS</strong> </li> </ul> </li> <li> <p>Dedicated HSM?</p> <ul> <li>β†’ <strong>CloudHSM</strong> </li> </ul> </li> <li> <p>Rotate DB credentials?</p> <ul> <li>β†’ <strong>Secrets Manager</strong> </li> <li>⚠️ Parameter Store auto-rotate?</li> <li>β†’ NO SUCH THING natively β†’ use Secrets Manager</li> </ul> </li> <li> <p>Plain config?</p> <ul> <li>β†’ <strong>Parameter Store</strong> </li> </ul> </li> <li> <p>Detect threats?</p> <ul> <li>β†’ <strong>GuardDuty</strong> </li> <li>⚠️ GuardDuty scans CVEs?</li> <li>β†’ NO SUCH THING β†’ use Inspector</li> </ul> </li> <li> <p>Scan vulnerabilities?</p> <ul> <li>β†’ <strong>Inspector</strong> </li> </ul> </li> <li> <p>Discover sensitive data?</p> <ul> <li>β†’ <strong>Macie</strong> </li> </ul> </li> <li> <p>SQLi/XSS protection?</p> <ul> <li>β†’ <strong>WAF</strong> </li> </ul> </li> <li> <p>DDoS protection?</p> <ul> <li>β†’ <strong>Shield</strong> </li> </ul> </li> </ul> <h3> πŸ“¨ Messaging </h3> <ul> <li> <p>Point-to-point decoupling?</p> <ul> <li>β†’ <strong>SQS Standard</strong> </li> <li>⚠️ Order/exactly-once w/ Standard?</li> <li>β†’ NO SUCH THING β†’ use SQS FIFO</li> </ul> </li> <li> <p>Fan-out?</p> <ul> <li>β†’ <strong>SNS</strong> </li> <li>⚠️ Fan-out w/ SQS alone?</li> <li>β†’ NO SUCH THING β†’ use SNS + SQS</li> </ul> </li> <li> <p>Rule-based routing?</p> <ul> <li>β†’ <strong>EventBridge</strong> </li> </ul> </li> <li> <p>Multi-step workflow?</p> <ul> <li>β†’ <strong>Step Functions</strong> </li> </ul> </li> <li> <p>Real-time stream + replay?</p> <ul> <li>β†’ <strong>Kinesis Data Streams</strong> </li> <li>⚠️ Replay from SQS?</li> <li>β†’ NO SUCH THING (deleted after ack) β†’ use Kinesis</li> </ul> </li> <li> <p>Buffered delivery?</p> <ul> <li>β†’ <strong>Kinesis Firehose</strong> </li> </ul> </li> </ul> <h3> πŸŒͺ️ Disaster Recovery </h3> <p>RTO/RPO budget?</p> <ul> <li> <p>Hours-days, cheapest</p> <ul> <li>β†’ <strong>Backup &amp; Restore</strong> </li> </ul> </li> <li> <p>~10s of minutes</p> <ul> <li>β†’ <strong>Pilot Light</strong> </li> </ul> </li> <li> <p>Minutes</p> <ul> <li>β†’ <strong>Warm Standby</strong> </li> </ul> </li> <li> <p>Near-zero</p> <ul> <li>β†’ <strong>Multi-Site Active/Active</strong> </li> </ul> </li> </ul> <blockquote> <p>⚠️ Multi-AZ covers region failure?<br> β†’ NO SUCH THING (Multi-AZ β‰  DR) β†’ use Cross-Region</p> </blockquote> <h3> 🚚 Migration </h3> <ul> <li> <p>PB-scale, poor network?</p> <ul> <li>β†’ <strong>Snowball/Snowmobile</strong> </li> </ul> </li> <li> <p>Ongoing scheduled transfer?</p> <ul> <li>β†’ <strong>DataSync</strong> </li> </ul> </li> <li> <p>SFTP into S3/EFS?</p> <ul> <li>β†’ <strong>Transfer Family</strong> </li> </ul> </li> <li> <p>Migrate databases?</p> <ul> <li>β†’ <strong>DMS</strong> (+SCT if hetero)</li> <li>⚠️ DMS migrates whole VMs?</li> <li>β†’ NO SUCH THING (DB only) β†’ use MGN</li> </ul> </li> <li> <p>Lift-and-shift servers?</p> <ul> <li>β†’ <strong>MGN</strong> </li> </ul> </li> <li> <p>On-prem, cloud storage as local drive?</p> <ul> <li>β†’ <strong>Storage Gateway</strong> </li> </ul> </li> <li> <p>Discover on-prem infra first?</p> <ul> <li>β†’ <strong>Application Discovery Service</strong> </li> </ul> </li> <li> <p>Track migration progress?</p> <ul> <li>β†’ <strong>Migration Hub</strong> </li> </ul> </li> </ul> <h1> 1️⃣4️⃣ VPC DEEP DIVE </h1> <p><em>Networking is heavily tested. Master these fundamentals.</em></p> <h3> CIDR &amp; Subnetting </h3> <ul> <li>VPC CIDR block: /16 to /28</li> <li>Each subnet lives in exactly ONE AZ</li> <li>AWS reserves 5 IPs per subnet (first 4 + last 1)</li> <li>Public subnet = has route to Internet Gateway</li> <li>Private subnet = no direct route to IGW</li> </ul> <h3> Route Tables </h3> <ul> <li>Each subnet associates with ONE route table</li> <li>One route table can serve multiple subnets</li> <li>Local route (VPC CIDR) is always present, can't be removed</li> <li>Most specific route wins (longest prefix match)</li> </ul> <h3> Security Group vs NACL β€” Full Comparison </h3> <p><strong>Security Group</strong></p> <ul> <li>Level: Instance (ENI)</li> <li>State: Stateful (return traffic auto-allowed)</li> <li>Rules: Allow only</li> <li>Evaluation: ALL rules evaluated</li> <li>Default: Deny all inbound, allow all outbound</li> </ul> <p><strong>NACL</strong></p> <ul> <li>Level: Subnet</li> <li>State: Stateless (must allow both directions)</li> <li>Rules: Allow AND Deny</li> <li>Evaluation: Lowest rule number first, first match wins</li> <li>Default: Allow all (default NACL) / Deny all (custom NACL)</li> </ul> <blockquote> <p>πŸ“Œ Trap: Forgetting NACL is stateless means you must explicitly allow the EPHEMERAL PORT RANGE (1024-65535) for return traffic.</p> </blockquote> <h3> VPC Flow Logs </h3> <ul> <li>Capture IP traffic metadata (not payload)</li> <li>Can publish to CloudWatch Logs or S3</li> <li>Used by GuardDuty as a data source</li> <li>Doesn't capture: DHCP traffic, Windows license activation, traffic to/from 169.254.169.254 (metadata)</li> </ul> <h3> VPC Peering Limits </h3> <ul> <li>NOT transitive</li> <li>No overlapping CIDR blocks allowed</li> <li>Cross-region peering supported</li> <li>Cross-account peering supported</li> </ul> <h1> 1️⃣5️⃣ IAM DEEP DIVE </h1> <h3> Policy Types </h3> <ul> <li> <strong>Identity-based policy</strong> β€” attached to user/group/role</li> <li> <strong>Resource-based policy</strong> β€” attached to a resource (e.g., S3 bucket policy)</li> <li> <strong>Permissions boundary</strong> β€” sets the MAX permissions an identity can have</li> <li> <strong>SCP</strong> β€” sets the MAX permissions for an entire account/OU</li> <li> <strong>Session policy</strong> β€” passed when assuming a role, further restricts</li> </ul> <h3> Policy Evaluation Logic (memorize this order) </h3> <ol> <li>Explicit DENY anywhere β†’ immediately denied</li> <li>Explicit ALLOW required somewhere</li> <li>Default is DENY if nothing matches</li> </ol> <blockquote> <p>πŸ“Œ An explicit DENY always wins, no matter how many ALLOWs exist elsewhere.</p> </blockquote> <h3> Effective Permissions Formula </h3> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>Effective permissions = Identity-based policy ∩ Permissions Boundary (if set) ∩ SCP (if in an Organization) ∩ Resource-based policy (if applicable) </code></pre> </div> <p><em>(∩ = intersection β€” the most restrictive combination wins)</em></p> <blockquote> <p>πŸ“Œ Trap: Granting S3FullAccess via IAM Policy does NOTHING if an SCP denies S3 at the OU level.</p> </blockquote> <h3> IAM Best Practices (frequently tested) </h3> <ul> <li>Never use root account for daily tasks</li> <li>Enable MFA on root and privileged users</li> <li>Use IAM Roles for EC2/Lambda, never embedded access keys</li> <li>Grant least privilege, expand only when needed</li> <li>Use IAM Access Analyzer to find overly permissive policies</li> <li>Rotate credentials regularly (or use Roles to avoid this entirely)</li> </ul> <h1> 1️⃣6️⃣ S3 DEEP DIVE </h1> <h3> Consistency Model </h3> <blockquote> <p>βœ… S3 now provides <strong>strong read-after-write consistency</strong> for ALL operations (PUT, GET, LIST, DELETE) β€” since Dec 2020. No more "eventual consistency" caveat.</p> </blockquote> <h3> Versioning </h3> <ul> <li>Once enabled, cannot be disabled (only suspended)</li> <li>Protects against accidental overwrite/delete</li> <li>Each version has a unique version ID</li> <li>Combine with MFA Delete for extra protection</li> </ul> <h3> Replication </h3> <ul> <li> <strong>CRR</strong> (Cross-Region Replication) β€” different region, DR/compliance/latency</li> <li> <strong>SRR</strong> (Same-Region Replication) β€” same region, log aggregation/compliance</li> <li>Requires versioning enabled on both buckets</li> <li>Not retroactive β€” only replicates NEW objects after enabling (unless using S3 Batch Replication)</li> </ul> <h3> Lifecycle Policies </h3> <ul> <li>Automate transitions between storage classes</li> <li>Automate expiration (deletion) of old objects/versions</li> <li>Common pattern: Standard β†’ Standard-IA (30 days) β†’ Glacier (90 days) β†’ Deep Archive (180 days) β†’ Delete (365 days)</li> </ul> <h3> Storage Classes β€” Full List </h3> <ul> <li> <strong>S3 Standard</strong> β€” frequent access, ms retrieval</li> <li> <strong>S3 Intelligent-Tiering</strong> β€” unknown/changing patterns, auto-moves between tiers</li> <li> <strong>S3 Standard-IA</strong> β€” infrequent, ms retrieval, lower storage cost</li> <li> <strong>S3 One Zone-IA</strong> β€” infrequent, single AZ (cheaper, less durable)</li> <li> <strong>S3 Glacier Instant Retrieval</strong> β€” archive, ms retrieval</li> <li> <strong>S3 Glacier Flexible Retrieval</strong> β€” archive, minutes-hours retrieval</li> <li> <strong>S3 Glacier Deep Archive</strong> β€” cheapest, ~12hr retrieval</li> </ul> <h3> Advanced Features (worth knowing) </h3> <ul> <li> <strong>S3 Object Lock</strong> β€” WORM compliance (write once read many)</li> <li> <strong>S3 Object Lambda</strong> β€” transform data on retrieval without duplicating</li> <li> <strong>S3 Multi-Region Access Points</strong> β€” single global endpoint, routes to nearest bucket</li> <li> <strong>S3 Transfer Acceleration</strong> β€” speeds up uploads via CloudFront edge locations</li> <li> <strong>S3 Access Points</strong> β€” simplify access management for shared buckets</li> </ul> <h1> 1️⃣7️⃣ AUTO SCALING &amp; ELB DEEP DIVE </h1> <h3> Auto Scaling Policies </h3> <ul> <li> <strong>Target Tracking</strong> β€” maintain a metric at a target value (e.g., CPU at 50%) β€” MOST COMMON exam answer</li> <li> <strong>Step Scaling</strong> β€” scale by different amounts based on alarm breach size</li> <li> <strong>Scheduled Scaling</strong> β€” scale at predictable times (e.g., before Black Friday)</li> <li> <strong>Predictive Scaling</strong> β€” uses ML to forecast and scale ahead of demand</li> </ul> <blockquote> <p>πŸ“Œ Default exam answer for "automatically scale based on demand": <strong>Target Tracking</strong></p> </blockquote> <h3> Lifecycle Hooks </h3> <ul> <li>Pause instance in Pending/Terminating state</li> <li>Run custom actions (e.g., install software) before instance goes into service</li> </ul> <h3> ELB Comparison Recap </h3> <ul> <li> <strong>ALB</strong> β€” Layer 7, path/host routing, WebSockets, best for HTTP(S) microservices</li> <li> <strong>NLB</strong> β€” Layer 4, extreme performance, static IP, preserves source IP</li> <li> <strong>GWLB</strong> β€” Layer 3, for inline third-party virtual appliances (firewalls, IDS/IPS)</li> </ul> <h3> Health Checks </h3> <ul> <li>ELB health checks determine if a target receives traffic</li> <li>Auto Scaling health checks determine if an instance gets replaced</li> <li>Can combine ELB + ASG health checks for more accurate replacement decisions</li> </ul> <h1> 1️⃣8️⃣ ROUTE 53 DEEP DIVE </h1> <h3> Routing Policies β€” Full List </h3> <ul> <li> <strong>Simple</strong> β€” one record, no health checks, basic routing</li> <li> <strong>Weighted</strong> β€” split traffic by percentage (e.g., A/B testing, gradual migration)</li> <li> <strong>Latency-based</strong> β€” route to the region with lowest latency for the user</li> <li> <strong>Failover</strong> β€” active-passive DR setup, routes to secondary if primary unhealthy</li> <li> <strong>Geolocation</strong> β€” route based on user's geographic location (compliance, content localization)</li> <li> <strong>Geoproximity</strong> β€” route based on geographic location with ability to shift traffic using bias</li> <li> <strong>Multi-value answer</strong> β€” return multiple healthy records, basic load balancing + health checks</li> </ul> <h3> Health Checks </h3> <ul> <li>Can check endpoint health (HTTP/HTTPS/TCP)</li> <li>Can check the status of OTHER health checks (calculated health checks)</li> <li>Can check CloudWatch alarms</li> </ul> <h3> Hosted Zones </h3> <ul> <li> <strong>Public hosted zone</strong> β€” routes traffic on the internet</li> <li> <strong>Private hosted zone</strong> β€” routes traffic within one or more VPCs</li> </ul> <h1> 1️⃣9️⃣ ANALYTICS DEEP DIVE </h1> <h3> Kinesis Family Comparison </h3> <p><strong>Kinesis Data Streams</strong></p> <ul> <li>Real-time, custom processing</li> <li>Data retained 24hr default (up to 365 days)</li> <li>You manage shards/consumers</li> <li>Clue: "real-time, need replay, custom consumers"</li> </ul> <p><strong>Kinesis Data Firehose</strong></p> <ul> <li>Near-real-time, fully managed</li> <li>Auto-delivers to S3/Redshift/OpenSearch/Splunk</li> <li>No data retention/replay</li> <li>Clue: "load streaming data into S3/Redshift automatically"</li> </ul> <p><strong>Kinesis Data Analytics</strong></p> <ul> <li>Run SQL or Apache Flink on streaming data in real time</li> <li>Clue: "real-time analytics/SQL queries on a stream"</li> </ul> <p><strong>Kinesis Video Streams</strong></p> <ul> <li>Ingest video/audio streams</li> <li>Clue: "video from cameras/devices"</li> </ul> <h3> Other Analytics Services </h3> <ul> <li> <strong>Athena</strong> β€” serverless SQL directly on S3 data, pay-per-query</li> <li> <strong>Glue</strong> β€” serverless ETL + Data Catalog</li> <li> <strong>Glue DataBrew</strong> β€” visual data prep, no code</li> <li> <strong>EMR</strong> β€” managed Hadoop/Spark for big data processing</li> <li> <strong>Redshift</strong> β€” data warehouse, complex joins, BI</li> <li> <strong>Redshift Spectrum</strong> β€” query S3 data directly from Redshift without loading it</li> <li> <strong>QuickSight</strong> β€” BI dashboards/visualization</li> <li> <strong>Lake Formation</strong> β€” centralized data lake setup, security, and governance on top of S3/Glue</li> </ul> <h1> 2️⃣0️⃣ COST OPTIMIZATION TOOLKIT </h1> <ul> <li> <strong>Cost Explorer</strong> β€” visualize/analyze/forecast spend over time</li> <li> <strong>AWS Budgets</strong> β€” proactive alerts when spend/usage approaches a threshold</li> <li> <strong>Cost &amp; Usage Report (CUR)</strong> β€” most detailed, granular billing data (for custom analysis)</li> <li> <strong>Trusted Advisor</strong> β€” automated checks across cost, security, performance, fault tolerance, service limits</li> <li> <strong>Compute Optimizer</strong> β€” ML-based right-sizing recommendations for EC2/Lambda/EBS</li> <li> <strong>Savings Plans</strong> β€” flexible commitment-based discount (Compute or EC2 Instance Savings Plans)</li> <li> <strong>Reserved Instances</strong> β€” commitment tied to instance family/region</li> <li> <strong>Cost Allocation Tags</strong> β€” track spend by project/team/environment</li> </ul> <h3> Reserved Instance vs Savings Plan (recap) </h3> <p><strong>Reserved Instance</strong></p> <ul> <li>Locked to instance family/region (Standard RI)</li> <li>1 or 3 year term</li> <li>Convertible RI = can change instance family</li> </ul> <p><strong>Savings Plan</strong></p> <ul> <li>Flexible across instance family/region (Compute Savings Plan)</li> <li>Commit to $/hour spend, not a specific instance</li> <li>Clue: "flexible compute usage, consistent spend"</li> </ul> <h1> 2️⃣1️⃣ ADDITIONAL SERVICES </h1> <h3> Compute Extras </h3> <ul> <li> <strong>Elastic Beanstalk</strong> β€” PaaS, upload code, AWS handles provisioning/deployment/scaling. Clue: "quick deploy, don't manage infrastructure details"</li> <li> <strong>Lightsail</strong> β€” simplified VPS with predictable pricing, bundled compute+storage+network. Clue: "simple website, predictable low cost, don't need full VPC complexity"</li> <li> <strong>AWS OpsWorks</strong> β€” Chef/Puppet-based configuration management (rarely tested, legacy)</li> </ul> <h3> Systems Manager Suite </h3> <ul> <li> <strong>Session Manager</strong> β€” SSH/RDP access without open ports or bastion hosts</li> <li> <strong>Patch Manager</strong> β€” automate OS patching across fleets</li> <li> <strong>Parameter Store</strong> β€” config/secrets storage (already covered)</li> <li> <strong>Run Command</strong> β€” execute commands remotely across instances at scale</li> <li> <strong>State Manager</strong> β€” maintain consistent configuration state</li> <li> <strong>Automation</strong> β€” run predefined workflows (e.g., AMI creation)</li> </ul> <h3> Governance &amp; Multi-Account </h3> <ul> <li> <strong>AWS Organizations</strong> β€” consolidated billing, account structure, SCPs</li> <li> <strong>Control Tower</strong> β€” automated landing zone setup, built ON Organizations</li> <li> <strong>AWS RAM</strong> β€” share resources (subnets, TGW attachments) cross-account</li> <li> <strong>AWS Config Conformance Packs</strong> β€” pre-built compliance rule sets</li> </ul> <h3> Developer Tools (CI/CD) </h3> <ul> <li> <strong>CodeCommit</strong> β€” managed Git repository</li> <li> <strong>CodeBuild</strong> β€” managed build service</li> <li> <strong>CodeDeploy</strong> β€” automates deployment to EC2/Lambda/ECS (supports Blue/Green, Canary)</li> <li> <strong>CodePipeline</strong> β€” orchestrates the full CI/CD pipeline</li> </ul> <h1> 2️⃣2️⃣ COMPARISONS (Stacked Card Format) </h1> <h3> RDS Multi-AZ </h3> <ul> <li>Purpose: HA/failover</li> <li>Replication: Sync</li> <li>Failover: Automatic</li> <li>Readable: No</li> </ul> <h3> Read Replica (RDS) </h3> <ul> <li>Purpose: Read scaling</li> <li>Replication: Async</li> <li>Failover: Manual</li> <li>Readable: Yes</li> </ul> <h3> Aurora Replica </h3> <ul> <li>Purpose: Reads + optional HA</li> <li>Replication: Shared storage, near-sync</li> <li>Failover: Automatic (priority tiers)</li> <li>Readable: Yes</li> </ul> <blockquote> <p>πŸ“Œ Clue: "HA/zero data loss" β†’ Multi-AZ | "scale reads" β†’ Read Replica</p> </blockquote> <h3> Aurora Serverless v1 </h3> <ul> <li>Scaling: Coarse, auto-pauses to ZERO</li> <li>Cold start: Yes</li> <li>Best for: Dev/test</li> </ul> <h3> Aurora Serverless v2 </h3> <ul> <li>Scaling: Fine-grained, min 0.5 ACU</li> <li>Cold start: Minimal</li> <li>Best for: Variable production</li> <li>⚠️ Does NOT scale to zero</li> </ul> <h3> CloudFormation </h3> <ul> <li>Language: YAML/JSON</li> <li>Native: Yes</li> <li>Clue: "AWS native IaC"</li> </ul> <h3> CDK </h3> <ul> <li>Language: TS/Python/Java</li> <li>Native: Yes (compiles to CFN)</li> <li>Clue: "programming language IaC"</li> </ul> <h3> Terraform </h3> <ul> <li>Language: HCL</li> <li>Native: No</li> <li>Clue: Rarely correct on SAA-C03</li> </ul> <h3> CloudWatch </h3> <ul> <li>Purpose: Metrics/logs/alarms</li> <li>Clue: "monitor CPU/errors"</li> </ul> <h3> X-Ray </h3> <ul> <li>Purpose: Distributed tracing</li> <li>Clue: "trace request across services"</li> </ul> <h3> Gateway Endpoint </h3> <ul> <li>Services: S3, DynamoDB ONLY</li> <li>Cost: Free</li> <li>Clue: "no cost, S3 access"</li> </ul> <h3> Interface Endpoint </h3> <ul> <li>Services: Most AWS + SaaS</li> <li>Cost: Hourly + data</li> <li>Clue: "private access, other services"</li> </ul> <h3> S3 Transfer Acceleration </h3> <ul> <li>Direction: Speeds up uploads</li> <li>Clue: "large uploads, global users"</li> </ul> <h3> CloudFront </h3> <ul> <li>Direction: Speeds up downloads</li> <li>Clue: "content delivery, global users"</li> </ul> <h3> Global Accelerator </h3> <ul> <li>Layer: Network (TCP/UDP)</li> <li>IP: Static Anycast</li> <li>Failover: Fast, no DNS delay</li> <li>Clue: "static IP, non-HTTP"</li> </ul> <h3> Route 53 </h3> <ul> <li>Layer: DNS</li> <li>Failover: Depends on TTL</li> <li>Clue: "domain routing, geo/latency"</li> </ul> <h3> ALB </h3> <ul> <li>Layer: 7 (HTTP)</li> <li>Targets: EC2/ECS/Lambda</li> <li>Clue: "load balance servers"</li> </ul> <h3> API Gateway </h3> <ul> <li>Type: Managed API layer</li> <li>Features: Throttling, API keys</li> <li>Clue: "serverless API, throttling"</li> </ul> <h3> ECS on EC2 </h3> <ul> <li>Mgmt: You manage EC2</li> <li>Clue: "custom instance/GPU"</li> </ul> <h3> ECS on Fargate </h3> <ul> <li>Mgmt: AWS manages infra</li> <li>Clue: "no server management"</li> </ul> <h3> IAM Role </h3> <ul> <li>Creds: Temporary (STS)</li> <li>Clue: "temp creds, EC2β†’S3"</li> </ul> <h3> IAM User </h3> <ul> <li>Creds: Long-term</li> <li>Clue: Rarely correct if Role possible</li> </ul> <h3> Snapshot </h3> <ul> <li>Scope: Single resource</li> <li>Clue: "point-in-time, one volume"</li> </ul> <h3> AWS Backup </h3> <ul> <li>Scope: Centralized, cross-service</li> <li>Clue: "centralized policy, multi-service"</li> </ul> <h3> Site-to-Site VPN </h3> <ul> <li>Connects: Network-to-network</li> <li>Setup: Minutes</li> <li>Clue: "on-prem network"</li> </ul> <h3> Client VPN </h3> <ul> <li>Connects: User-to-VPC</li> <li>Setup: Minutes</li> <li>Clue: "remote employees"</li> </ul> <h3> Direct Connect </h3> <ul> <li>Connects: Dedicated network</li> <li>Setup: Weeks</li> <li>Clue: "dedicated bandwidth"</li> </ul> <h3> SCP </h3> <ul> <li>Scope: Org/OU/Account</li> <li>Grants access: Never</li> </ul> <h3> IAM Policy </h3> <ul> <li>Scope: Individual identity</li> <li>Grants access: Yes</li> </ul> <h3> Security Hub </h3> <ul> <li>Function: Aggregates findings</li> </ul> <h3> GuardDuty </h3> <ul> <li>Function: Generates threat findings</li> </ul> <h3> Macie </h3> <ul> <li>Focus: Sensitive data (PII)</li> </ul> <h3> Inspector </h3> <ul> <li>Focus: Vulnerabilities (CVEs)</li> </ul> <h3> DataSync </h3> <ul> <li>Purpose: Scheduled transfer</li> </ul> <h3> Storage Gateway </h3> <ul> <li>Purpose: Ongoing hybrid access</li> </ul> <h3> DMS </h3> <ul> <li>Migrates: Databases</li> </ul> <h3> MGN </h3> <ul> <li>Migrates: Whole servers/VMs</li> </ul> <h3> Elastic Beanstalk </h3> <ul> <li>Control: Low (PaaS, AWS handles infra)</li> <li>Clue: "quick deploy, minimal config"</li> </ul> <h3> Lightsail </h3> <ul> <li>Control: Low (bundled VPS)</li> <li>Clue: "simple, predictable pricing, small workload"</li> </ul> <h3> EC2 </h3> <ul> <li>Control: Full</li> <li>Clue: "full control needed"</li> </ul> <h3> Athena </h3> <ul> <li>Purpose: Serverless SQL on S3</li> <li>Clue: "ad-hoc query on data in S3"</li> </ul> <h3> Redshift </h3> <ul> <li>Purpose: Data warehouse</li> <li>Clue: "complex BI joins, large-scale analytics"</li> </ul> <h3> Redshift Spectrum </h3> <ul> <li>Purpose: Query S3 from Redshift without loading</li> <li>Clue: "query S3 data alongside Redshift tables"</li> </ul> <h1> 2️⃣3️⃣ WHY AWS REJECTS THIS ANSWER </h1> <p><em>(Top 30 β€” expanded)</em></p> <p><strong>1. Need HA</strong><br> ❌ Read Replica β€” reads only, no failover<br> βœ… Multi-AZ</p> <p><strong>2. Need DR (region loss)</strong><br> ❌ Multi-AZ β€” AZ only, not region<br> βœ… Cross-Region (Global DB/Tables/CRR)</p> <p><strong>3. Need queue</strong><br> ❌ SNS β€” push, not pull queue<br> βœ… SQS</p> <p><strong>4. Need fan-out</strong><br> ❌ SQS β€” single consumer group<br> βœ… SNS</p> <p><strong>5. Need exactly-once + order</strong><br> ❌ SQS Standard β€” best-effort only<br> βœ… SQS FIFO</p> <p><strong>6. Need encryption</strong><br> ❌ Secrets Manager β€” that's for secrets<br> βœ… KMS</p> <p><strong>7. Need to store/rotate password</strong><br> ❌ Parameter Store β€” no native rotation<br> βœ… Secrets Manager</p> <p><strong>8. Need compliance drift detection</strong><br> ❌ CloudTrail β€” logs API calls only<br> βœ… AWS Config</p> <p><strong>9. Need "who did it"</strong><br> ❌ CloudWatch β€” metrics, not identity<br> βœ… CloudTrail</p> <p><strong>10. Need threat detection</strong><br> ❌ Inspector β€” CVEs, not live threats<br> βœ… GuardDuty</p> <p><strong>11. Need vulnerability scan</strong><br> ❌ GuardDuty β€” threats, not CVEs<br> βœ… Inspector</p> <p><strong>12. Need PII discovery</strong><br> ❌ GuardDuty/Inspector β€” no classification<br> βœ… Macie</p> <p><strong>13. Need central security dashboard</strong><br> ❌ GuardDuty alone β€” own findings only<br> βœ… Security Hub</p> <p><strong>14. Need transitive VPC routing</strong><br> ❌ VPC Peering β€” not transitive<br> βœ… Transit Gateway</p> <p><strong>15. Need dedicated bandwidth</strong><br> ❌ VPN β€” shared internet<br> βœ… Direct Connect</p> <p><strong>16. Need quick hybrid setup</strong><br> ❌ Direct Connect β€” weeks to provision<br> βœ… Site-to-Site VPN</p> <p><strong>17. Need free S3 private access</strong><br> ❌ Interface Endpoint β€” costs money<br> βœ… Gateway Endpoint</p> <p><strong>18. Need private access to Kinesis/SNS</strong><br> ❌ Gateway Endpoint β€” S3/DynamoDB only<br> βœ… Interface Endpoint</p> <p><strong>19. Need shared block storage, multi-AZ</strong><br> ❌ EBS Multi-Attach β€” same AZ only<br> βœ… EFS/FSx</p> <p><strong>20. Need cheapest archive</strong><br> ❌ Standard-IA β€” still ms access, pricier<br> βœ… Glacier Deep Archive</p> <p><strong>21. Need SCP to grant permission</strong><br> ❌ SCP β€” never grants, only restricts<br> βœ… IAM Policy</p> <p><strong>22. Need to cap 1 admin's perms</strong><br> ❌ SCP β€” org-wide, not single identity<br> βœ… Permissions Boundary</p> <p><strong>23. Need temp creds for EC2 app</strong><br> ❌ IAM User + keys β€” long-term, risky<br> βœ… IAM Role</p> <p><strong>24. Job runs &gt;15 min</strong><br> ❌ Lambda β€” hard limit<br> βœ… Fargate/Batch/EC2</p> <p><strong>25. Need GPU in container</strong><br> ❌ Fargate β€” no custom AMI/GPU<br> βœ… EC2 launch type</p> <p><strong>26. Need automatic replay of a stream</strong><br> ❌ SQS β€” deletes after processing<br> βœ… Kinesis Data Streams</p> <p><strong>27. Need to right-size an EC2 fleet</strong><br> ❌ Trusted Advisor alone β€” limited, high-level checks<br> βœ… Compute Optimizer (ML-based, detailed)</p> <p><strong>28. Need consistent read-after-write on S3</strong><br> ❌ Assuming "eventual consistency" caveat still applies<br> βœ… S3 provides strong consistency for all ops since Dec 2020</p> <p><strong>29. Need Aurora that pauses to zero cost</strong><br> ❌ Aurora Serverless v2 β€” min 0.5 ACU, never zero<br> βœ… Aurora Serverless v1 (has true auto-pause)</p> <p><strong>30. Need to grant access despite an SCP deny</strong><br> ❌ Attaching a broader IAM policy β€” SCP still wins<br> βœ… Modify the SCP itself (deny always overrides allow)</p> <h1> 2️⃣4️⃣ ARCHITECTURES (Vertical Flow) </h1> <h2> Static Website </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>User ↓ Route 53 ↓ CloudFront (+WAF) ↓ S3 (Origin, OAC private) </code></pre> </div> <p><strong>Why:</strong> Bucket stays private, edge caching = speed + cost savings.</p> <h2> Three-Tier Web App </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>Users ↓ CloudFront ↓ Route 53 ↓ ALB (public subnet) ↓ EC2/ASG (private subnet) ↓ RDS Multi-AZ (private, isolated) </code></pre> </div> <p><strong>Why:</strong> Layered isolation, ALB spreads load across AZs, HA at DB tier.</p> <h2> Serverless App </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>Client ↓ API Gateway ↓ Lambda ↓ DynamoDB </code></pre> </div> <ul> <li>S3 for assets, CloudWatch for logs</li> </ul> <p><strong>Why:</strong> Zero server mgmt, auto-scales, pay-per-use.</p> <h2> Event-Driven </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>S3 Upload ↓ EventBridge β”œβ†’ Lambda (process) β”œβ†’ SQS (buffer) β””β†’ Step Functions (orchestrate) </code></pre> </div> <p><strong>Why:</strong> Decoupled, independently scalable, resilient.</p> <h2> Microservices </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>Client β†’ ALB β”œβ†’ ECS Orders (Fargate) β†’ DynamoDB β”œβ†’ ECS Payments (Fargate) β†’ Aurora β””β†’ ECS Shipping (Fargate) β†’ DynamoDB </code></pre> </div> <p><strong>Why:</strong> Independent deploy/scale, Fargate = no host mgmt.</p> <h2> Hybrid Cloud </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>On-Prem ↓ (Direct Connect - primary) ↓ (VPN - backup) VPC ↓ Transit Gateway β”œβ†’ VPC-A β”œβ†’ VPC-B β””β†’ VPC-C </code></pre> </div> <p><strong>Why:</strong> DX for bandwidth, VPN failover, TGW for scale.</p> <h2> DR β€” Warm Standby </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>Region A (ACTIVE, 100%) ↕ Route 53 Failover Region B (PASSIVE, 10% scale) Aurora Write (A) β†’ Replication β†’ Aurora Read (B) </code></pre> </div> <p><strong>Why:</strong> Fast recovery, cost-controlled standby.</p> <h2> DR β€” Active/Active </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>Region A (ACTIVE) ←→ DynamoDB Global Tables ←→ Region B (ACTIVE) \ / Route 53 Latency Routing β†’ All Users </code></pre> </div> <p><strong>Why:</strong> Near-zero RTO, both regions live.</p> <h2> Secure Enterprise VPC </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>Internet ↓ IGW ↓ ALB (public subnet, SG:443) ↓ App Tier (private, SG: from ALB) ↓ DB Tier (isolated, no NAT/IGW) Side: NAT GW (public) β€” outbound only Side: VPC Flow Logs β†’ CloudWatch Side: VPC Endpoints (S3/KMS/Secrets) β€” no NAT needed </code></pre> </div> <p><strong>Why:</strong> Defense-in-depth, reduced attack surface + cost.</p> <h2> Data Lake </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>Sources β†’ Kinesis Firehose β†’ S3 (raw) ↓ Glue ETL ↓ S3 (processed) ↙ ↓ β†˜ Athena Redshift QuickSight Governance layer: Lake Formation (across all of S3/Glue) </code></pre> </div> <h2> Streaming Pipeline </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>IoT/Clickstream ↓ Kinesis Data Streams β†’ Lambda (real-time) ↓ Kinesis Firehose β†’ S3 β†’ Athena/Redshift </code></pre> </div> <h2> CI/CD Pipeline </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>Dev push β†’ CodeCommit/GitHub ↓ CodePipeline ↓ CodeBuild (test/build) ↓ CodeDeploy (Blue/Green or Canary) ↓ EC2 / ECS / Lambda ↓ CloudWatch Alarms β†’ auto-rollback on failure </code></pre> </div> <p><strong>Why:</strong> Fully automated release, minimizes deployment risk.</p> <h2> IoT Pipeline </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>Devices β†’ IoT Core (MQTT) ↓ IoT Rules Engine β”œβ†’ Kinesis Data Streams (real-time) β”œβ†’ Lambda (process/alert) β””β†’ S3/Timestream (storage) </code></pre> </div> <p><strong>Why:</strong> IoT Core handles device auth/connectivity at scale; Rules Engine routes without custom device-management code.</p> <h2> SaaS Multi-Tenant </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>Tenant Requests β†’ CloudFront β†’ API Gateway β†’ Lambda ↓ DynamoDB (partition key = tenant_id) Cognito (tenant-aware user pools) </code></pre> </div> <p><strong>Why:</strong> Fully serverless, scales per-tenant, cheap isolation via partition key.</p> <h1> 2️⃣5️⃣ VOCABULARY </h1> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>Durable β†’ won't be lost (S3) Available β†’ responsive when needed Elastic β†’ auto grow/shrink Ephemeral β†’ temp, lost on stop Fault Tolerant β†’ zero disruption Highly Available β†’ fast recovery, brief gap ok Eventually Consistent β†’ reads may lag briefly Strongly Consistent β†’ always latest write Shared Responsibility β†’ AWS=of cloud, You=in cloud Immutable Infra β†’ replace, don't patch Serverless β†’ no provisioning, auto-scale Lift and Shift β†’ rehost, minimal change Replatform β†’ small optimizations Refactor β†’ redesign cloud-native Blue/Green β†’ 2 envs, instant switch Canary β†’ gradual traffic shift Burstable β†’ baseline + credits (T-family) Idempotent β†’ repeat = same result Decoupled β†’ no direct calls, via queue Stateless β†’ no session on instance Stateful β†’ retains session/context Multi-tenant β†’ shared infra, multiple customers Defense in Depth β†’ multiple security layers stacked Loosely Coupled β†’ failure isolation between components </code></pre> </div> <h1> 2️⃣6️⃣ LIMITS (Quick List) </h1> <blockquote> <p>⚠️ Verify before exam β€” quotas change.</p> </blockquote> <ul> <li>Lambda max time: <strong>15 min</strong> </li> <li>Lambda /tmp: <strong>up to 10GB</strong> </li> <li>SQS retention: <strong>4 days default / 14 max</strong> </li> <li>SQS msg size: <strong>256 KB</strong> </li> <li>S3 max object: <strong>5 TB</strong> </li> <li>EBS max volume: <strong>64 TiB</strong> </li> <li>EBS Multi-Attach: <strong>same AZ, io1/io2</strong> </li> <li>DynamoDB item: <strong>400 KB</strong> </li> <li>Aurora max storage: <strong>128 TB</strong> </li> <li>RDS replicas: <strong>5</strong> / Aurora: <strong>15</strong> </li> <li>VPC per region: <strong>5 (soft)</strong> </li> <li>VPC CIDR: <strong>/16 to /28</strong> </li> <li>SG rules: <strong>60 in / 60 out</strong> </li> <li>ALB target groups: <strong>100</strong> </li> <li>CFN resources/stack: <strong>500</strong> </li> <li>IAM policy size: <strong>6144 chars</strong> </li> <li>Route 53 health check interval: <strong>10s (fast) / 30s (standard)</strong> </li> <li>CloudFormation stack limit: <strong>500 per account (soft)</strong> </li> </ul> <h1> 2️⃣7️⃣ MEMORY TRICKS </h1> <p>🧠 <strong>Security Group</strong> = Stateful<br> β†’ "Guard remembers you"</p> <p>🧠 <strong>NACL</strong> = Stateless<br> β†’ "Checks you again leaving"</p> <p>🧠 <strong>S3 classes</strong> (hotβ†’cold)<br> β†’ "Sally Is In One Giant Igloo, Deeply frozen"</p> <p>🧠 <strong>Route 53 policies</strong><br> β†’ "Sillie Wabbits Like Failing, Geo Multiplying"</p> <p>🧠 <strong>Multi-AZ vs Replica</strong><br> β†’ "Availability=AZ, Reads=Replica"</p> <p>🧠 <strong>DR cost ladder</strong><br> β†’ "Budget People Want More"<br> (Backupβ†’Pilotβ†’Warmβ†’Multi-Site)</p> <p>🧠 <strong>Load Balancers</strong><br> β†’ "Apps Need Gateways" (ALB/NLB/GWLB)</p> <p>🧠 <strong>Messaging trio</strong><br> β†’ "Queue Notifies Events" (SQS/SNS/EventBridge)</p> <p>🧠 <strong>VPN vs DX</strong><br> β†’ "VPN=Virtually instant, DX=Dedicated but delayed"</p> <p>🧠 <strong>Snow Family</strong><br> β†’ "Cone &lt; Ball &lt; Mobile"</p> <p>🧠 <strong>GuardDuty/Inspector/Macie</strong><br> β†’ "Guard=threats, Inspector=vulnerabilities, Macie=Mine data"</p> <p>🧠 <strong>Gateway vs Interface</strong><br> β†’ "Gateway=Gratis(free), Interface=Invoiced"</p> <p>🧠 <strong>SCP vs IAM Policy</strong><br> β†’ "SCP=Stop(ceiling), IAM=Issues permission"</p> <p>🧠 <strong>Aurora Serverless v1 vs v2</strong><br> β†’ "v1=Vanishes to zero, v2=never below point-5"</p> <p>🧠 <strong>Well-Architected Pillars</strong><br> β†’ "Old Sailors Rarely Perform Correctly Sober"<br> (Operational Excellence, Security, Reliability, Performance, Cost, Sustainability)</p> <p>🧠 <strong>IAM Policy Evaluation</strong><br> β†’ "Deny Always Wins" (explicit deny beats any allow)</p> <p>🧠 <strong>Kinesis Family</strong><br> β†’ "Streams Store, Firehose Flows, Analytics Analyzes"</p> <h1> 2️⃣8️⃣ STAR RATINGS (Study Priority) </h1> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>β˜…β˜…β˜…β˜…β˜… Almost guaranteed: EC2, S3, VPC, IAM, RDS/Aurora, Lambda, DynamoDB, ELB, Auto Scaling, Multi-AZ vs Read Replica, S3 Storage Classes, Security Group vs NACL β˜…β˜…β˜…β˜…β˜† Very common: Route 53, CloudFront, SQS/SNS/EventBridge, KMS, CloudWatch/CloudTrail/Config, VPN/Direct Connect/Transit Gateway, Gateway vs Interface Endpoint β˜…β˜…β˜…β˜†β˜† Sometimes: ECS/EKS/Fargate, GuardDuty/Inspector/Macie, AWS Backup/DRS, DMS/MGN/Snow Family, Step Functions, Kinesis, Well-Architected Framework, Cost tools β˜…β˜…β˜†β˜†β˜† Rare: Redshift, Glue/Athena, Organizations/Control Tower/RAM, RDS Proxy, DAX, Elastic Beanstalk, Lightsail, Lake Formation β˜…β˜†β˜†β˜†β˜† Very rare: Outposts, Wavelength, Local Zones, QLDB, Neptune, Timestream, OpsWorks </code></pre> </div> <h1> 2️⃣9️⃣ ⏰ LAST 30 MINUTES BEFORE THE EXAM </h1> <h3> 10 Golden Rules </h3> <ol> <li>Managed &gt; Self-managed, always, when tied.</li> <li>Multi-AZ = HA. Read Replica = Reads. Never confuse them.</li> <li>Multi-AZ β‰  DR. DR = Cross-Region.</li> <li>SCP restricts, never grants.</li> <li>Gateway Endpoint = S3/DynamoDB ONLY, free.</li> <li>VPC Peering is NOT transitive β€” use Transit Gateway.</li> <li>Lambda hard limit = 15 minutes.</li> <li>SQS Standard β‰  ordered/exactly-once β€” need FIFO.</li> <li>Aurora Serverless v2 does NOT scale to zero (v1 did).</li> <li>Explicit DENY always wins in IAM policy evaluation.</li> </ol> <h3> 20 Limits to Remember </h3> <p>Lambda 15min Β· SQS 256KB/14days Β· S3 5TB Β· EBS 64TiB Β· DynamoDB 400KB item Β· Aurora 128TB Β· RDS 5 replicas / Aurora 15 Β· VPC 5/region Β· SG 60 rules Β· ALB 100 target groups Β· CFN 500 resources Β· IAM policy 6144 chars Β· EBS Multi-Attach same-AZ only Β· NACL evaluated lowest-number-first Β· Route53 health check 10s/30s Β· S3 multipart recommended &gt;100MB Β· Aurora Serverless v2 min 0.5 ACU Β· VPC CIDR /16 to /28 Β· S3 strong consistency (all ops) Β· Well-Architected = 6 pillars.</p> <h3> 30 Architectures to Recognize </h3> <p>Static site (S3+CF) Β· 3-tier (ALB+EC2+RDS) Β· Serverless (APIGW+Lambda+DynamoDB) Β· Event-driven (EventBridge+SQS+Lambda) Β· Microservices (ECS/EKS+Fargate) Β· Data lake (S3+Glue+Athena+Lake Formation) Β· Streaming (Kinesis) Β· Hybrid (DX+VPN+TGW) Β· Warm Standby DR Β· Active/Active DR Β· CI/CD pipeline Β· IoT pipeline Β· SaaS multi-tenant Β· Secure VPC Β· Multi-region DB (Aurora Global/DynamoDB Global Tables) Β· Cross-account resource sharing (RAM) Β· Centralized logging (CloudTrail org trail) Β· Landing zone (Control Tower) Β· Bastion-less access (SSM) Β· Blue/Green deploy Β· Canary deploy Β· Fan-out (SNS+SQS) Β· Cache-aside (ElastiCache) Β· DAX in front of DynamoDB Β· Global content delivery (CF+GA) Β· VPC endpoint-secured architecture Β· Centralized backup (AWS Backup) Β· WAF+Shield protected web app Β· RDS Proxy + Lambda Β· Cognito-secured mobile backend.</p> <h3> 30 Traps </h3> <p>β†’ Section 23 in full (all 30 "Why AWS Rejects This Answer" entries).</p> <h3> Golden Rule Recap by Domain </h3> <p><strong>Security (30% of exam):</strong> Least privilege, encryption by default, Roles over Users, defense in depth.</p> <p><strong>Resilience (26%):</strong> Multi-AZ for HA, Cross-Region for DR, decouple with queues/events.</p> <p><strong>Performance (24%):</strong> Right service for the workload pattern, caching where possible, serverless for spiky loads.</p> <p><strong>Cost (20%):</strong> Match pricing model to usage pattern, use storage lifecycle policies, right-size continuously.</p> <h3> 🎯 Final Checklist </h3> <ul> <li>[ ] Read the <strong>last sentence</strong> first</li> <li>[ ] Highlight the <strong>constraint keyword</strong> </li> <li>[ ] Scan the <strong>Service Selection Matrix</strong> mentally</li> <li>[ ] Watch for <strong>"NO SUCH THING"</strong> traps</li> <li>[ ] Pick more <strong>managed/native/automated</strong> when tied</li> <li>[ ] DR β†’ <strong>RTO/RPO ladder</strong> </li> <li>[ ] Networking β†’ check <strong>direction + transitivity</strong> </li> <li>[ ] IAM β†’ remember <strong>explicit deny always wins</strong> </li> <li>[ ] Trust your first instinct</li> </ul> <h1> πŸ“Œ PREP TIME ALLOCATION </h1> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>70% β–“β–“β–“β–“β–“β–“β–“ Practice exams 20% β–“β–“ Review wrong answers 10% β–“ Re-read this sheet </code></pre> </div> <p><strong>Go score 850+. πŸš€</strong></p> architecture aws cloud