S3 Storage Classes
S3| Class | Min Duration | Retrieval | Use Case |
|---|
| Standard | None | Instant | Frequently accessed |
| Intelligent-Tiering | None | Instant | Unknown access pattern |
| Standard-IA | 30 days | Instant | Infrequent, rapid access |
| One Zone-IA | 30 days | Instant | Infrequent, non-critical |
| Glacier Instant | 90 days | Instant | Archive, ms retrieval |
| Glacier Flexible | 90 days | Min – 12 h | Archive, flexible retrieval |
| Glacier Deep Archive | 180 days | 12 – 48 h | Long-term archive, cheapest |
Standard-IA and One Zone-IA charge a retrieval fee per GB.
S3 Replication
S3| Feature | CRR | SRR |
|---|
| Full name | Cross-Region Replication | Same-Region Replication |
| Bucket owner | Different regions | Same region |
| Use case | DR, latency | Log aggregation, compliance |
| Versioning required | Both buckets | Both buckets |
| Delete marker replication | Optional | Optional |
EC2 Instance Families
EC2| Family | Optimized For | Examples |
|---|
| T | Burstable (baseline CPU) | T3, T4g |
| M | General purpose | M6i, M7g |
| C | Compute (high CPU) | C6g, C7i |
| R | Memory (high RAM) | R6g, R7i |
| X | Extreme memory | X2idn |
| I | Storage (NVMe SSD) | I3, I4i |
| D | Dense HDD storage | D3 |
| P / G / Inf | GPU / ML / Inference | P4, G5, Inf2 |
| H | High disk throughput | H1 |
EC2 Purchasing Options
EC2| Type | Discount | Best For |
|---|
| On-Demand | — | Short-term, unpredictable workloads |
| Reserved (1 yr) | up to 40% | Steady-state, known usage |
| Reserved (3 yr) | up to 60% | Long-term commitment |
| Savings Plans | up to 66% | Flexible family/region |
| Spot | up to 90% | Fault-tolerant, batch, stateless |
| Dedicated Instance | — | Compliance (no shared hardware) |
| Dedicated Host | BYOL eligible | Per-socket licensing, compliance |
Spot instances can be interrupted with 2-minute warning.
EC2 Storage Options
EC2| Type | Persistence | Use Case |
|---|
| Instance Store | Ephemeral (lost on stop) | Temp buffers, caches |
| EBS gp3 | Persistent | General purpose boot/data |
| EBS io2 | Persistent | High IOPS databases |
| EBS st1 | Persistent | Throughput (logs, big data) |
| EBS sc1 | Persistent | Cold, infrequently accessed |
| EFS | Persistent, shared | Multi-AZ shared filesystem |
| FSx for Windows | Persistent, shared | Windows SMB workloads |
| FSx for Lustre | Persistent, shared | HPC, ML training |
Load Balancer Types
ELB / ASG| Type | OSI Layer | Protocols | Targets |
|---|
| ALB | 7 (Application) | HTTP, HTTPS, gRPC | Instance, IP, Lambda |
| NLB | 4 (Transport) | TCP, UDP, TLS | Instance, IP, ALB |
| GLB | 3 (Network) | IP packets | Instance, IP (appliances) |
| CLB (legacy) | 4 + 7 | HTTP, TCP | Instance only |
Only ALB supports path-based and host-based routing.
Auto Scaling Policy Types
ELB / ASG| Policy | Trigger | Notes |
|---|
| Simple Scaling | CloudWatch alarm | Cooldown period required |
| Step Scaling | CloudWatch alarm | Different steps per breach size |
| Target Tracking | Keep metric at target | Recommended, automatic |
| Scheduled | Time-based | Predictable load patterns |
| Predictive | ML forecast | Proactive, SAA-C03 exam topic |
RDS vs Aurora
RDS| Feature | RDS | Aurora |
|---|
| Engines | MySQL, PG, Oracle, SQL Server, MariaDB | MySQL, PostgreSQL |
| Storage scaling | Manual (up to 64 TB) | Auto (up to 128 TB) |
| Read replicas | Up to 5 | Up to 15 |
| Failover time | ~60–120 s | ~30 s |
| Replication | Async | Sync (shared storage) |
| Multi-AZ | Standby replica | Native, all replicas |
| Cost | Lower | Up to 5× more (but faster) |
RDS Backup & Recovery
RDS| Feature | Automated Backup | Manual Snapshot |
|---|
| Retention | 0–35 days | Indefinite |
| Deleted on instance delete | Yes (configurable) | No |
| Point-in-time restore | Yes (5 min granularity) | No |
| Cross-region copy | No (use snapshot) | Yes |
DynamoDB Key Concepts
DynamoDB| Concept | Detail |
|---|
| Primary key types | Partition key only | Partition key + Sort key |
| Read modes | Eventually consistent (default), Strongly consistent |
| Capacity modes | Provisioned (predictable) | On-demand (spiky) |
| GSI | Global Secondary Index — different partition key, own RCU/WCU |
| LSI | Local Secondary Index — same partition key, different sort key |
| DynamoDB Streams | Ordered change log per item (24 h retention) |
| DAX | In-memory cache, microsecond reads, no code change |
| TTL | Auto-delete expired items, no extra cost |
| Global Tables | Multi-region active-active replication |
SQS vs SNS vs EventBridge
SQS / SNS| Feature | SQS | SNS | EventBridge |
|---|
| Model | Queue (pull) | Pub/Sub (push) | Event bus (push) |
| Message persistence | Up to 14 days | No | No |
| Consumers | One (or competing) | Many (fan-out) | Many (rules) |
| Message filtering | No | Attribute-based | Pattern matching |
| FIFO support | Yes (SQS FIFO) | Yes (SNS FIFO) | No |
| Dead-letter queue | Yes | Yes | Yes |
| 3rd-party events | No | No | Yes (Shopify, Zendesk…) |
SQS Standard: at-least-once, out-of-order. FIFO: exactly-once, ordered.
Lambda Limits
Lambda| Limit | Value |
|---|
| Max execution time | 15 minutes |
| Memory | 128 MB – 10 GB |
| /tmp storage | 512 MB – 10 GB |
| Sync payload (request/response) | 6 MB |
| Async payload | 256 KB |
| Default concurrency per region | 1,000 (soft limit) |
| Layers | 5 per function |
| Deployment package (zip) | 50 MB |
| Deployment package (unzipped) | 250 MB |
| Environment variables | 4 KB total |
Lambda Invocation Types
Lambda| Type | Source | Retry |
|---|
| Synchronous | API GW, ALB, CLI | Caller handles |
| Asynchronous | S3, SNS, EventBridge | 2 retries built-in |
| Event source mapping | SQS, Kinesis, DynamoDB Streams | Automatic (DLQ optional) |
IAM Key Concepts
IAM| Concept | Description |
|---|
| User | Long-term identity with credentials |
| Group | Collection of users sharing policies |
| Role | Temporary credentials, assumed by services/users |
| Policy (identity-based) | Attached to user/group/role |
| Policy (resource-based) | Attached to resource (e.g. S3 bucket, SQS queue) |
| Permission Boundary | Maximum permissions a user/role can have |
| SCP (Service Control Policy) | AWS Org guardrails — deny only, apply to OUs |
| Session Policy | Passed at AssumeRole, limits effective permissions |
Evaluation order: Deny > SCP > Resource > Identity > Boundary > Session.
VPC Components
VPC| Component | Description |
|---|
| VPC | Isolated virtual network scoped to a region |
| Subnet | AZ-specific segment of a VPC (public or private) |
| Route Table | Rules controlling traffic routing per subnet |
| Internet Gateway (IGW) | Enables public internet access for a VPC |
| NAT Gateway | Outbound internet for private subnets (managed, HA) |
| Security Group | Stateful firewall at instance level (allow rules only) |
| NACL | Stateless firewall at subnet level (allow + deny rules) |
| VPC Peering | Private link between two VPCs (non-transitive) |
| Transit Gateway | Hub-and-spoke for many VPCs + on-prem |
| PrivateLink / Endpoint | Private access to AWS services without IGW |
| VPN Gateway | Site-to-site IPSec VPN to on-prem |
| Direct Connect | Dedicated physical link to on-prem |
Security Groups are stateful (return traffic auto-allowed). NACLs are stateless.
Security Group vs NACL
VPC| Feature | Security Group | NACL |
|---|
| Scope | Instance (ENI) | Subnet |
| Stateful | Yes | No |
| Rules | Allow only | Allow + Deny |
| Rule processing | All rules evaluated | First match wins (numbered) |
| Default | Deny all inbound | Allow all |
| Applies to | EC2, RDS, Lambda in VPC | All resources in subnet |
CloudFront Key Facts
CloudFront| Feature | Detail |
|---|
| Edge locations | 400+ worldwide |
| Origin types | S3, ALB, EC2, any HTTP endpoint |
| Default TTL | 24 hours (configurable per behavior) |
| SSL certificate region | Must be in us-east-1 (ACM) |
| Geo restriction | Allowlist or blocklist by country |
| Cache invalidation | Costs money — use versioned filenames instead |
| CloudFront Functions | Lightweight JS — viewer request/response only |
| Lambda@Edge | Full Lambda — all 4 event types, more powerful |
| Signed URLs / Cookies | Restrict content to authorized users |
| Origin Access Control | Restricts S3 to CloudFront only (replaces OAI) |
Route 53 Routing Policies
Route 53| Policy | Use Case | Health Check |
|---|
| Simple | Single resource, no logic | No |
| Weighted | A/B testing, canary deploys | Optional |
| Latency | Route to lowest-latency region | Optional |
| Failover | Active-passive disaster recovery | Required |
| Geolocation | Route by user's country/continent | Optional |
| Geoproximity | Shift traffic by geographic bias | Optional |
| Multivalue Answer | Return up to 8 healthy records | Optional |
| IP-based | Route by CIDR / ISP | Optional |
Geolocation routes by location; Latency routes by response time — different!
CloudWatch vs CloudTrail vs Config
CloudWatch| Service | Purpose | What It Answers |
|---|
| CloudWatch Metrics | Resource performance monitoring | "Is my EC2 CPU high?" |
| CloudWatch Logs | Log aggregation & querying | "What did my app log?" |
| CloudWatch Alarms | Alert on metric thresholds | "Notify me when CPU > 80%" |
| CloudTrail | API call audit log (who did what) | "Who deleted that S3 bucket?" |
| AWS Config | Resource config history + compliance | "Was my SG ever open to 0.0.0.0?" |
CloudTrail is for auditing; CloudWatch is for monitoring.
Common Ports
General| Port | Protocol / Service |
|---|
| 22 | SSH |
| 80 | HTTP |
| 443 | HTTPS |
| 3306 | MySQL / Aurora MySQL |
| 5432 | PostgreSQL / Aurora PostgreSQL |
| 1433 | Microsoft SQL Server |
| 3389 | RDP (Windows) |
| 6379 | Redis (ElastiCache) |
| 11211 | Memcached (ElastiCache) |
| 27017 | MongoDB |
| 2049 | NFS (EFS) |
| 8080 | HTTP alternate |
AWS Security Services
General| Service | Purpose |
|---|
| Shield Standard | Free automatic DDoS protection |
| Shield Advanced | Enhanced DDoS + WAF integration ($3,000/mo) |
| WAF | Web Application Firewall — L7 rules (SQL injection, XSS) |
| GuardDuty | Threat detection using ML on logs (VPC, DNS, CloudTrail) |
| Inspector | Automated vulnerability scanning (EC2, Lambda, ECR) |
| Macie | S3 sensitive data discovery (PII, credentials) |
| Security Hub | Aggregated security findings across accounts |
| Detective | Root-cause analysis for security findings |
| KMS | Managed encryption key service |
| Secrets Manager | Automatic secrets rotation + retrieval |
| ACM | Free SSL/TLS certificates for AWS services |
| Cognito | User auth / federation for web & mobile apps |
Disaster Recovery Strategies
General| Strategy | RTO / RPO | Cost | Description |
|---|
| Backup & Restore | Hours | $ | Backups to S3, restore when needed |
| Pilot Light | Tens of minutes | $$ | Core services running, scale on failover |
| Warm Standby | Minutes | $$$ | Scaled-down full environment, ready to scale |
| Multi-Site Active/Active | Seconds | $$$$ | Full production in multiple regions |
RTO = Recovery Time Objective (downtime). RPO = Recovery Point Objective (data loss).
ECS Launch Types
ECS / Fargate| Feature | ECS on EC2 | ECS on Fargate |
|---|
| Infrastructure management | You manage EC2 instances | AWS manages (serverless) |
| Pricing | Pay for EC2 instances | Pay per vCPU/memory per second |
| Control | Full host-level control | Task-level only |
| Spot savings | EC2 Spot Instances | Fargate Spot |
| GPU support | Yes | No |
| Best for | Stable, predictable workloads | Spiky / variable workloads |
ECS on EC2 requires managing AMIs, patching, and capacity. Fargate removes all that overhead.
ECS vs EKS
ECS / Fargate| Feature | ECS | EKS |
|---|
| Orchestrator | AWS proprietary | Kubernetes (CNCF standard) |
| Learning curve | Lower | Higher |
| Portability | AWS only | Multi-cloud / on-prem |
| Fargate support | Yes | Yes |
| Cost | No control plane fee | $0.10/hr per cluster |
| Best for | Simpler AWS-native apps | K8s expertise / portability needed |
Redis vs Memcached
ElastiCache| Feature | Redis | Memcached |
|---|
| Data persistence | Yes (RDB + AOF) | No |
| Replication / Multi-AZ | Yes | No |
| Pub/Sub messaging | Yes | No |
| Complex data types | Yes (lists, sets, hashes) | Strings only |
| Multi-threading | Single-threaded | Multi-threaded |
| Cluster mode | Yes (sharding) | Yes (horizontal) |
| Use case | Sessions, leaderboards, queues | Simple high-throughput cache |
Choose Redis when you need durability, replication, or complex data structures.
Kinesis Services Comparison
Kinesis| Service | Purpose | Latency | Key Detail |
|---|
| Data Streams | Real-time custom processing | ~200 ms | Shards; replay up to 365 days |
| Data Firehose | Load to S3/Redshift/OpenSearch | 60 s – 15 min | No code; auto-scales |
| Data Analytics | SQL / Apache Flink on streams | Sub-second | Built on top of Streams or Firehose |
| Video Streams | Ingest video / ML inference | Varies | WebRTC, HLS playback |
Kinesis vs SQS: use Kinesis for ordered, replay-capable streaming; SQS for decoupled queuing.
API Gateway Types
API Gateway| Feature | REST API | HTTP API | WebSocket API |
|---|
| Cost | $$$ | $ | $ |
| Latency | Higher | Lower (~60%) | Persistent connection |
| Cognito auth | Yes | Yes | Yes |
| API keys / usage plans | Yes | No | No |
| Request validation | Yes | No | No |
| Caching | Yes | No | No |
| VPC Link | Yes | Yes | No |
| Best for | Full features needed | Low-cost simple APIs | Real-time two-way comms |
HTTP API is ~70% cheaper than REST API. Choose REST API only when you need caching, request validation, or usage plans.
User Pools vs Identity Pools
Cognito| Feature | User Pools | Identity Pools |
|---|
| Purpose | Authentication (who are you?) | Authorization (what can you access?) |
| Issues | JWT tokens (ID, Access, Refresh) | Temporary AWS credentials (STS) |
| Federation | SAML, OIDC, social logins | User Pools, social, SAML, custom |
| AWS resource access | No | Yes (via IAM roles) |
| MFA support | Yes | No (handled by identity provider) |
| Use case | App login / sign-up | Access S3, DynamoDB directly from app |
Common pattern: User Pool authenticates → Identity Pool exchanges JWT for temporary AWS credentials.
Shield Standard vs Advanced
WAF / Shield| Feature | Shield Standard | Shield Advanced |
|---|
| Cost | Free | $3,000/month + data transfer |
| Protection | Layer 3/4 (SYN floods, UDP) | Layer 3/4/7 (+ sophisticated) |
| DDoS Response Team (SRT) | No | Yes (24/7 access) |
| Cost protection | No | Yes (DDoS cost credits) |
| Real-time visibility | Limited | Full CloudWatch metrics |
| WAF integration | Separate | Included WAF fee waived |
Shield Advanced is worth it for business-critical apps with high-volume DDoS risk.
CloudTrail vs CloudWatch vs Config
CloudTrail| Service | Answers | Data Type | Retention |
|---|
| CloudTrail | Who did what, when, from where? | API call audit logs | 90 days free; S3 for longer |
| CloudWatch | What is happening now (metrics/logs)? | Metrics, logs, alarms | Configurable |
| AWS Config | What did this resource look like at time X? | Resource config history | Configurable |
CloudTrail = audit; CloudWatch = operational monitoring; Config = compliance and config history.
Secrets Manager vs SSM Parameter Store
Secrets Manager| Feature | Secrets Manager | SSM Parameter Store |
|---|
| Cost | $0.40/secret/month | Free (Standard); $0.05/10k API calls (Advanced) |
| Auto rotation | Yes (built-in for RDS, etc.) | No (manual or custom Lambda) |
| Cross-account access | Yes | No |
| Max size | 64 KB | 4 KB (Standard) / 8 KB (Advanced) |
| KMS encryption | Always | Optional (SecureString) |
| Best for | DB credentials needing rotation | Config values, non-secret params |
If automatic rotation is required → Secrets Manager. For static config or cost sensitivity → Parameter Store.
Standard vs Express Workflows
Step Functions| Feature | Standard | Express |
|---|
| Max duration | 1 year | 5 minutes |
| Execution rate | 2,000/sec | 100,000/sec |
| Pricing | Per state transition | Per execution + duration |
| Execution history | Full audit (90 days) | CloudWatch only |
| Idempotency | At-most-once | At-least-once |
| Best for | Long-running, auditable workflows | High-throughput, short IoT/streaming jobs |
Standard workflows guarantee exactly-once execution; Express workflows may execute more than once.
EventBridge vs SNS vs SQS
EventBridge| Feature | EventBridge | SNS | SQS |
|---|
| Model | Event router | Pub/Sub fan-out | Queue |
| Filtering | Rich content-based filtering | Attribute-based only | None |
| Targets | 20+ AWS services | Subscribers (Lambda, SQS, HTTP) | One consumer group |
| SaaS events | Yes (partner integrations) | No | No |
| Ordering | No | No | Yes (FIFO) |
| Retention | None (fire and forget) | None | Up to 14 days |
| Best for | Decoupled event routing | Fan-out notifications | Durable queuing |
EventBridge is the evolution of CloudWatch Events. Use it when you need content-based routing to multiple targets.
SCPs vs IAM Policies
Organizations / SCP| Aspect | SCPs | IAM Policies |
|---|
| Scope | Accounts / OUs in Organizations | Users, roles, groups in an account |
| Effect | Set maximum permissions | Grant actual permissions |
| Applies to root user? | Yes (restricts root too) | No (root bypasses IAM) |
| Default behavior | Implicit allow if no SCP | Implicit deny everything |
| Attached to | Root, OU, or account | Identity or resource |
| Can grant permissions? | No (only restrict) | Yes |
Both an SCP AND an IAM policy must allow an action for it to be permitted.
AWS Organizations Key Concepts
Organizations / SCP| Concept | Description |
|---|
| Management account | Root account; pays for all; not affected by SCPs |
| Member accounts | Joined accounts; subject to SCPs |
| Organizational Unit (OU) | Logical grouping of accounts; SCPs inherit down |
| SCP | Policy that sets permission boundaries for an OU/account |
| AWS Control Tower | Automates multi-account setup with guardrails |
| Consolidated billing | Single payment; aggregate usage for Reserved Instance discounts |
Direct Connect vs Site-to-Site VPN
Direct Connect / VPN| Feature | Direct Connect | Site-to-Site VPN |
|---|
| Connection type | Dedicated private fiber | IPsec over public internet |
| Bandwidth | Up to 100 Gbps | Up to 1.25 Gbps per tunnel |
| Latency | Consistent, low | Variable (internet) |
| Setup time | Weeks to months | Minutes |
| Cost | Higher (port + data) | Lower ($0.05/hr per VPN) |
| Encryption | Not by default (add MACsec) | Yes (IPsec) |
| Best for | Stable high-bandwidth hybrid workloads | Quick setup / DX backup |
Common pattern: Direct Connect as primary + Site-to-Site VPN as failover for HA.
Transit Gateway
Direct Connect / VPN| Feature | Detail |
|---|
| Purpose | Hub-and-spoke network hub for VPCs and on-premises |
| Replaces | VPC peering mesh (N×(N-1)/2 connections → N connections to TGW) |
| Attachments | VPCs, VPNs, Direct Connect Gateways, other TGWs |
| Inter-region peering | Yes (connect TGWs across regions) |
| Route tables | Multiple route tables for traffic segmentation |
| Multicast | Supported |
Use Transit Gateway when you have 5+ VPCs. VPC peering is simpler for 2–4 VPCs.
AWS Config vs CloudTrail vs CloudWatch
AWS Config| Service | Answers | Key Use Case |
|---|
| AWS Config | What did this resource look like over time? | Compliance, config drift |
| CloudTrail | Who made this API call and when? | Audit, forensics |
| CloudWatch | Is my system healthy right now? | Ops monitoring, alerting |
All three are complementary. Use Config for "was this S3 bucket ever public?", CloudTrail for "who changed it?", CloudWatch for "is it up?".
Global Accelerator vs CloudFront
Global Accelerator| Feature | Global Accelerator | CloudFront |
|---|
| Layer | Network (L4 — TCP/UDP) | Application (L7 — HTTP/S) |
| Caching | No | Yes (CDN) |
| IP addresses | Static anycast IPs (2) | Dynamic (changes per DNS TTL) |
| Protocols | TCP, UDP | HTTP, HTTPS, WebSocket |
| Use cases | Gaming, VoIP, IoT, non-HTTP, static IP | Web content, APIs, video streaming |
| Routing | Anycast via AWS backbone | Edge cache + origin pull |
| Blue/Green | Traffic dials per endpoint group | Lambda@Edge / origins |
If the question mentions "static IP" or "non-HTTP" → Global Accelerator. If it mentions "caching" or "content delivery" → CloudFront.
Analytics Services Comparison
Redshift / Athena| Service | Type | Data Location | Best For |
|---|
| Athena | Serverless SQL | S3 (query in place) | Ad-hoc S3 queries, pay-per-query |
| Redshift | Data warehouse (MPP) | Redshift cluster / Serverless | Frequent complex analytics |
| EMR | Managed Hadoop/Spark | S3, HDFS | Complex ETL, ML at scale |
| Glue | Serverless ETL + Data Catalog | S3, JDBC sources | Data discovery, ETL pipelines |
| OpenSearch | Search + log analytics | OpenSearch cluster | Full-text search, log analysis |
Athena + Glue Data Catalog + S3 = standard serverless data lake. Add Redshift for repeated heavy queries.
Athena Cost Optimization
Redshift / Athena| Technique | Savings |
|---|
| Use columnar format (Parquet/ORC) | Up to 87% less data scanned |
| Partition data in S3 (by date, region) | Skip irrelevant partitions |
| Compress data (Snappy, GZIP) | Reduces data scanned |
| Use workgroups | Set per-query data scan limits |
| Avoid SELECT * | Only scan columns you need |
Athena charges $5 per TB scanned. Columnar + partitions is the #1 exam answer for cost reduction.
Elastic Beanstalk Deployment Policies
Elastic Beanstalk| Policy | Downtime | Speed | Rollback | Extra Cost |
|---|
| All at once | Yes | Fastest | Manual redeploy | None |
| Rolling | No (partial) | Slow | Manual redeploy | None |
| Rolling + additional batch | No | Slow | Manual redeploy | Small (extra instances) |
| Immutable | No | Slowest | Terminate new ASG | Yes (double instances briefly) |
| Blue/Green | No | Slow | Swap URL back | Yes (full duplicate env) |
For zero downtime + easy rollback → Immutable or Blue/Green. Immutable is safer for production.