Browse by topic
Explore AWS concepts grouped by domain
Recent Articles
Fresh learning content updated regularly
Exam Day Tips & Question Strategy
If English is NOT your native language, you can request an extra 30 minutes at no cost. Request the "ESL +30" accommodation through your AWS Certification account BEFORE scheduling the exam. This gives you valuable extra time to read and process longer scenario questions.
How to Study for AWS Certifications
Start: Cloud Practitioner (build foundation). Next: Solutions Architect Associate (most valuable, broadest coverage). Then: specialize based on your role — Developer, SysOps, Data, ML, or Security. Professional and Specialty exams are advanced — get Associate first.
Security Logging & Monitoring Architecture
Comprehensive logging is the foundation of security on AWS. Without logs, you cannot detect threats, investigate incidents, prove compliance, or automate response. AWS provides a rich ecosystem of log sources that, when combined, give complete visibility into your environment.
Infrastructure Protection Deep Dive
Infrastructure protection uses multiple overlapping security layers. If one layer fails, the next layer catches the threat. This is the defense-in-depth principle applied to AWS.
Data Protection & Privacy on AWS
Data protection on AWS covers two dimensions: protecting data at rest (stored) and data in transit (moving). AWS provides encryption services, key management, data classification, and access controls to protect data throughout its lifecycle.
Automated Security Remediation
Manual incident response is too slow for cloud-scale threats. Attacks can compromise resources in seconds. Automated remediation detects and responds to security events in real-time without human intervention.
Incident Response on AWS
Incident response (IR) is the process of detecting, investigating, containing, eradicating, and recovering from security incidents. AWS follows NIST SP 800-61 and provides native services for each IR phase.
Route 53 Advanced — DNS Deep Dive
Amazon Route 53 is a highly available, scalable DNS web service. It performs three main functions: domain registration, DNS routing, and health checking. It is a global service with a 100% availability SLA.
Transit Gateway Advanced
Transit Gateway (TGW) is a regional network hub that connects VPCs, VPN connections, and Direct Connect gateways through a central point. This lesson covers advanced patterns beyond basic hub-and-spoke.
Direct Connect Advanced
AWS Direct Connect (DX) establishes a dedicated, private network connection between your on-premises data center and AWS. Unlike VPN (over the internet), DX provides consistent latency, higher bandwidth, and lower per-GB data transfer costs.
AWS PrivateLink Deep Dive
AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-premises networks without exposing traffic to the public internet. Traffic stays entirely within the AWS network.
Advanced VPC Design
Careful CIDR planning prevents IP conflicts when VPCs peer, connect via Transit Gateway, or bridge to on-premises networks.
Serverless Architecture Patterns
Serverless means you don’t manage any servers. AWS handles provisioning, scaling, patching, and availability. You focus only on code and business logic. Pay only for what you use — no idle costs.
Performance Optimization Patterns
Performance optimization on AWS spans five dimensions: compute, storage, database, networking, and caching. Each has specific patterns and services for improvement.
Multi-Account & Multi-Region Architecture
AWS best practice is to use multiple accounts to isolate workloads, environments, teams, and billing. A single account for everything creates security, blast radius, and governance problems.
Event-Driven Architecture
In event-driven architecture (EDA), components produce and consume events. Services are decoupled: producers don’t know about consumers, and vice versa. Events flow through a broker (EventBridge, SNS, SQS, Kinesis) to interested subscribers.
Microservices Architecture on AWS
Microservices decompose a monolith into small, loosely coupled services that communicate via APIs or messaging. Each service is independently deployable, scalable, and replaceable. AWS provides native services for every microservices pattern: compute (Lambda, ECS, EKS)
Disaster Recovery Strategies on AWS
RPO vs RTO RPO = about DATA (how much you lose). RTO = about TIME (how long you’re down). A bank might need RPO = 0 (no data loss) and RTO = 15 minutes. A blog might accept RPO = 24 hours and RTO = 48 hours. Lower RPO/RTO = higher cost. The exam ALWAYS defines scenarios using RPO and RTO.
Designing for High Availability
Each additional nine roughly 10x the cost. Going from 99.9% to 99.99% is much more expensive than 99% to 99.9%. Design for the availability your BUSINESS requires, not the maximum possible. Over-engineering availability wastes money.
Data Preparation for Machine Learning
Data preparation is the most time-consuming part of any ML project — typically 60–80% of the total effort. Poor data leads to poor models regardless of algorithm choice. This lesson covers the key concepts, techniques, and AWS services for preparing data for ML.
Bedrock Knowledge Bases & Agents
Knowledge Bases enable Retrieval-Augmented Generation (RAG) on Bedrock. Your documents are indexed and used as context when the model generates responses, ensuring answers are grounded in YOUR data.
Amazon Bedrock — Foundation Models
Amazon Bedrock is a fully managed service that provides access to high-performing foundation models (FMs) from leading AI companies through a single API. It is the easiest way to build and scale generative AI applications on AWS.
SageMaker MLOps & Feature Store
SageMaker Pipelines is a purpose-built CI/CD service for ML. It defines, orchestrates, and automates end-to-end ML workflows.
SageMaker Inference & Deployment
After training, you deploy a model to generate predictions (inference). SageMaker offers multiple deployment options depending on latency, cost, and traffic requirements.
SageMaker Training & Tuning
SageMaker Training Jobs run your training code on managed infrastructure. You specify the algorithm, data location, compute resources, and hyperparameters. SageMaker provisions instances, runs training, saves the model to S3, and terminates instances.
SageMaker Studio & Notebooks
SageMaker Studio is a web-based integrated development environment (IDE) for machine learning. It provides a single interface for the entire ML workflow.
AWS AI/ML Service Landscape
AWS AI/ML services are organized in three layers based on the level of ML expertise required.
Generative AI Concepts
Generative AI refers to AI models that can create new content — text, images, code, audio, video — based on patterns learned from training data. Unlike traditional ML that classifies or predicts, GenAI generates.
AI, ML, and Deep Learning Concepts
These terms are often confused but represent nested concepts with increasing specificity.
Data Pipeline Design Patterns on AWS
A data pipeline is an automated workflow that ingests data from sources, transforms it, and delivers it to destinations for storage, analytics, or consumption. AWS provides services for every stage of the pipeline.
Amazon OpenSearch Service
Amazon OpenSearch Service is a managed search, log analytics, and real-time monitoring service using the OpenSearch engine (successor to Elasticsearch).
Amazon QuickSight
Amazon QuickSight is a serverless, ML-powered BI service for interactive dashboards and visualizations.
Amazon Redshift
Amazon Redshift is a petabyte-scale cloud data warehouse optimized for OLAP — complex analytical queries across massive datasets.
Amazon Athena
Amazon Athena is a serverless, interactive query service that analyzes data directly in S3 using standard SQL. No infrastructure — point at data and query.
Amazon EMR
Amazon EMR (Elastic MapReduce) is a managed big data platform for processing vast amounts of data using open-source frameworks like Apache Spark, Hadoop, Hive, Presto, HBase, and Flink.
AWS Glue
AWS Glue is a fully managed, serverless ETL (Extract, Transform, Load) service. It discovers data, catalogs metadata, and transforms data for analytics and machine learning.
AWS Lake Formation
A data lake is a centralized repository that stores all your structured and unstructured data at any scale. On AWS, S3 is the foundation of the data lake — you store raw data in S3 and use various services to process, catalog, and analyze it.
AWS DataSync & Transfer Family
AWS provides multiple services for moving data into, out of, and within the cloud. Choosing the right service depends on data volume, transfer speed, protocol requirements, and whether the transfer is one-time or ongoing.
AWS DMS (Database Migration Service)
AWS Database Migration Service migrates databases to AWS quickly and securely. The source database remains fully operational during the migration, minimizing downtime for applications.
AWS Migration Hub & Application Discovery
AWS Migration Hub provides a single location to track the progress of application migrations across multiple AWS tools and partner solutions.
AWS Application Migration Service (MGN)
AWS defines 7 migration strategies, commonly called the "7 Rs." Choosing the right strategy depends on your application’s complexity, business requirements, and desired outcome.
AWS Cloud Adoption Framework & 7 Rs Deep Dive
The AWS Cloud Adoption Framework (CAF) is a comprehensive guide that helps organizations plan and execute their cloud migration. It organizes cloud transformation into six perspectives, covering both technical and business dimensions.
AWS Billing Dashboard & Cost Explorer
The Billing & Cost Management Console is your central hub for understanding and managing AWS spending. It provides tools for viewing bills, forecasting costs, setting budgets, and optimizing spend.
AWS Audit Manager
AWS Audit Manager helps you continuously audit your AWS usage to simplify how you assess risk and compliance with regulations and industry standards. It automates evidence collection and maps it to audit frameworks.
AWS Cost Optimization Strategies
Cost optimization is not about spending less — it is about eliminating waste while delivering maximum business value.
AWS Pricing Models & Free Tier
AWS uses a pay-as-you-go pricing model.
AWS Health Dashboard & EventBridge
The AWS Health Dashboard provides personalized information about AWS service health and events that affect your account’s resources.
AWS Trusted Advisor
AWS Trusted Advisor is an online tool that inspects your AWS environment and provides real-time recommendations to help you follow AWS best practices across five categories: cost optimization, performance, security, fault tolerance, and service limits.
AWS Systems Manager (SSM)
AWS Systems Manager is a management service that helps you manage your EC2 instances, on-premises servers, and other AWS resources at scale.
Configuration Management & Automation
Configuration management ensures that your infrastructure and applications are configured consistently, reproducibly, and automatically. AWS provides several services and patterns for managing configuration at scale.
Deployment Strategies on AWS
The way you deploy new application versions directly affects availability, risk, rollback speed, and cost.
AWS SAM (Serverless Application Model)
AWS SAM is an open-source framework for building serverless applications.
AWS CDK (Cloud Development Kit)
The AWS Cloud Development Kit (CDK) is an open-source framework that lets you define AWS infrastructure using familiar programming languages.
AWS CloudFormation
AWS CloudFormation is an Infrastructure as Code (IaC) service that lets you define your entire AWS infrastructure in a declarative template file (JSON or YAML).
AWS CodePipeline
Orchestrates Source → Build → Test → Deploy into automated workflow.
AWS CodeDeploy
Automated deployment to EC2, on-premises, Lambda, ECS.
AWS CodeBuild
Managed build service: compile, test, produce artifacts.
AWS X-Ray
AWS X-Ray is a distributed tracing service that helps you analyze and debug distributed applications. It traces requests as they travel through your application’s services, showing the complete request path, latency at each hop, and errors.
Amazon CloudWatch — Logs & Insights
CloudWatch Logs is a centralized log management service. It collects, stores, monitors, and analyzes log data from AWS services, applications, and on-premises servers.
Amazon CloudWatch — Metrics & Alarms
Amazon CloudWatch is a monitoring and observability service for AWS resources and applications. It collects metrics, logs, and events, providing a unified view of operational health.
Compliance & Governance
AWS Audit Manager helps you continuously audit your AWS usage to simplify how you assess risk and compliance with regulations and industry standards. It automates evidence collection and maps it to audit frameworks.
AWS CloudTrail
AWS CloudTrail records ALL API calls made in your AWS account. Every action taken by a user, role, or AWS service is logged as an event. It provides governance, compliance, operational auditing, and risk auditing of your account.
AWS Config
AWS Config is a service that tracks resource configuration changes over time and evaluates configurations against desired rules. It provides a detailed view of how your AWS resources are configured, how they relate to each other, and how configurations have changed.
Amazon Detective
Amazon Detective makes it easy to analyze, investigate, and identify the root cause of security findings or suspicious activities. It automatically collects log data and uses machine learning, statistical analysis, and graph theory to build a linked set of data for investigations.
Amazon Macie
Amazon Macie is a fully managed data security and privacy service that uses machine learning and pattern matching to discover and protect sensitive data stored in Amazon S3.
Amazon Inspector
Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure.
AWS Security Hub
AWS Security Hub provides a comprehensive view of your security state across AWS. It aggregates, organizes, and prioritizes security findings from multiple AWS services and third-party tools in a single dashboard.
Amazon GuardDuty
Amazon GuardDuty is an intelligent threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence.
AWS Secrets Manager & Parameter Store
Manages, retrieves, and rotates secrets (DB credentials, API keys). Eliminates hardcoded credentials.
AWS Certificate Manager (ACM)
ACM provisions, manages, and deploys SSL/TLS certificates for AWS services. Public certificates are FREE with automatic renewal.
AWS CloudHSM
AWS CloudHSM provides dedicated single-tenant Hardware Security Modules. Unlike KMS, YOU manage the keys — AWS manages only the hardware.
AWS KMS (Key Management Service)
AWS KMS is a managed service for creating and controlling encryption keys used to encrypt your data across AWS services.
AWS AppSync & Amazon API Gateway
Amazon API Gateway is a fully managed service for creating, publishing, maintaining, monitoring, and securing APIs at any scale. It acts as the "front door" for applications to access backends like Lambda, EC2, or any HTTP endpoint.
Amazon MQ & Amazon MSK
Amazon MQ is a managed message broker service for Apache ActiveMQ and RabbitMQ. It is designed for migrating existing on-premises message broker workloads to AWS without rewriting application code.
Amazon EventBridge
Amazon EventBridge is a serverless event bus that connects applications using events. It receives events from sources (AWS services, custom apps, SaaS partners) and routes them to targets based on rules you define.
Amazon Kinesis
Amazon Kinesis is a platform for real-time streaming data. It enables you to collect, process, and analyze data streams in real time. Kinesis has four services.
Amazon SNS (Simple Notification Service)
Amazon SNS is a fully managed publish/subscribe (pub/sub) messaging service. A publisher sends a message to a topic, and SNS delivers it to all subscribers of that topic simultaneously.
Amazon SQS (Simple Queue Service)
Amazon SQS is a fully managed message queuing service that enables you to decouple and scale distributed systems. Producers send messages to a queue, and consumers poll the queue to process them.
AWS Network Firewall
AWS Network Firewall is a managed stateful firewall and intrusion detection/prevention service (IDS/IPS) for your VPC. It provides deep packet inspection, protocol detection, and domain-based filtering at the network level (Layer 3–7).
AWS WAF, Shield, Firewall Manager
AWS provides multiple layers of network security. Each operates at a different level and addresses different threats. Understanding which service handles which type of attack is critical for the exam.
AWS Global Accelerator
AWS Global Accelerator is a networking service that improves the availability and performance of your applications by using the AWS global network. It provides two static anycast IP addresses that route traffic to the optimal AWS endpoint based on health, geography, and routing policies.
Amazon CloudFront
Amazon CloudFront is a Content Delivery Network (CDN) that caches content at 400+ Edge Locations worldwide. It delivers data, videos, applications, and APIs with low latency and high transfer speeds.
Amazon Route 53
Amazon Route 53 is a highly available, scalable, and authoritative DNS (Domain Name System) service. It translates domain names (e.g., example.com) into IP addresses. It also provides domain registration and health checking.
AWS Direct Connect
AWS Direct Connect (DX) is a dedicated, private physical connection between your on-premises network and AWS. Unlike VPN, traffic does NOT go over the public internet. It provides consistent, low-latency, high-bandwidth connectivity.
AWS VPN (Site-to-Site & Client VPN)
VPN = encrypted tunnel over the public internet. Quick to set up (minutes–hours). Lower cost. Variable performance (depends on internet). Direct Connect = dedicated physical fiber connection. Weeks–months to set up. Higher cost. Consistent performance, lower latency. Both can be used together for re
VPC Flow Logs (Deep Dive)
VPC Flow Logs capture metadata about IP traffic flowing through network interfaces in your VPC. They are essential for security monitoring, troubleshooting connectivity issues, and compliance auditing.
AWS Transit Gateway
Transit Gateway is a Regional router that acts as a central hub. Attach VPCs, VPN, and Direct Connect to the TGW. All attached networks can communicate with each other through the TGW (if route tables allow). It replaces complex VPC Peering meshes and simplifies multi-VPC, hybrid architectures.
VPC Endpoints (Gateway & Interface)
VPC Endpoints = private access to AWS services. Traffic stays on the AWS backbone network. No IGW, NAT Gateway, or internet required. Improves security (no internet exposure) and reduces cost (no NAT Gateway data processing charges for AWS service traffic).
VPC Peering
VPC Peering creates a private networking connection between two VPCs. Instances in either VPC can communicate as if they are in the same network, using private IP addresses. Traffic stays on the AWS backbone and never traverses the public internet.
Network ACLs vs Security Groups
Traffic to/from an instance passes through BOTH the NACL (at the subnet boundary) AND the Security Group (at the instance). Both must allow the traffic. Think: NACL = the building’s front door security. Security Group = the apartment’s door lock. You need to pass both to get in.
NAT Gateway & NAT Instance
NAT allows private instances to INITIATE connections to the internet (outbound), but the internet CANNOT initiate connections to the private instances (inbound). This is the key security benefit: your private instances can reach the internet, but the internet cannot reach them directly.
VPC, Subnets, Route Tables, Internet Gateway
A VPC is your private network in AWS. Every resource you launch (EC2, RDS, Lambda in VPC, etc.) lives inside a VPC. You control who can access it, how traffic flows, and how it connects to the internet or other networks. Think of a VPC as your own data center network in the cloud.
Amazon Keyspaces, Neptune, QLDB, Timestream, MemoryDB
QLDB is NOT blockchain. QLDB is centralized — one trusted authority (your organization) owns and controls the ledger. Blockchain is decentralized — no single authority. If the exam asks about decentralized ledger or multi-party trust, the answer is Amazon Managed Blockchain, NOT QLDB.
Amazon DocumentDB
Amazon DocumentDB is a fully managed document database service designed for JSON workloads. It is compatible with the MongoDB API and drivers, making it easy to migrate existing MongoDB applications to AWS.
Amazon ElastiCache (Redis & Memcached)
Amazon ElastiCache is a fully managed in-memory data store and cache service. It supports two open-source engines: Redis and Memcached. ElastiCache delivers sub-millisecond latency for read-heavy workloads and reduces database load by caching frequently accessed data.
DynamoDB Advanced Features
DynamoDB Streams captures a time-ordered sequence of item-level modifications in a table and stores this information for up to 24 hours.
Amazon DynamoDB Fundamentals
Amazon DynamoDB is a fully managed, serverless, key-value and document NoSQL database. It delivers single-digit millisecond performance at any scale with built-in security, backup, and in-memory caching.
RDS Proxy
Amazon RDS Proxy is a fully managed database proxy that sits between your application and your RDS/Aurora database. It pools and shares database connections, improving application scalability, resilience, and security.
Amazon Aurora
Amazon Aurora is an AWS-built, cloud-native relational database that is compatible with MySQL and PostgreSQL. It delivers up to 5x the throughput of standard MySQL and 3x the throughput of standard PostgreSQL, with the same code, tools, and drivers.
Amazon RDS Fundamentals
Amazon Relational Database Service (RDS) is a fully managed service that makes it easy to set up, operate, and scale relational databases in the cloud. AWS handles provisioning, patching, backup, recovery, failure detection, and repair.
AWS Backup
AWS Backup is a fully managed, centralized backup service that automates and manages backups across AWS services. Instead of managing backups separately for each service, AWS Backup provides a single place to configure, schedule, and monitor all your backups.
AWS Snow Family
The AWS Snow Family is a collection of physical devices for transferring large amounts of data into and out of AWS, or running compute in edge locations where there is limited or no network connectivity.
AWS Storage Gateway
AWS Storage Gateway is a hybrid cloud storage service that connects your on-premises environment to AWS cloud storage. It provides a local cache for low-latency access while seamlessly integrating with S3, EBS, and Glacier.
Amazon FSx
Amazon FSx provides fully managed third-party high-performance file systems on AWS. It offers four file system options, each optimized for specific workloads and protocols.
Amazon EFS (Elastic File System)
Amazon Elastic File System is a fully managed, serverless, elastic NFS (Network File System) that can be shared across multiple EC2 instances, Lambda functions, and ECS/EKS containers simultaneously.
S3 Event Notifications & Analytics
S3 Advanced Lesson 3: "React to file uploads" = S3 Event Notifications (use EventBridge for modern architectures). "Org-wide storage visibility" = S3 Storage Lens. "Recommend when to move to IA" = Storage Class Analysis. "List all objects in bucket" = S3 Inventory. "Who accessed my bucket?" = Access
S3 Performance Optimization
S3 automatically scales to high request rates. Understanding the baseline performance helps you identify when optimization is needed.
S3 Replication (CRR & SRR)
S3 Replication allows you to automatically copy objects between S3 buckets. It can work across AWS Regions (Cross-Region Replication) or within the same Region (Same-Region Replication).
S3 Encryption
S3 supports encryption for data at rest (stored in S3) and data in transit (moving to/from S3). As of January 2023, all new objects uploaded to S3 are automatically encrypted at rest by default using SSE-S3.
S3 Security - Bucket Policies & ACLs
S3 provides multiple layers of access control. Understanding how they interact is critical for the exam and for securing your data.
S3 Lifecycle Rules & Transitions
S3 Lifecycle rules automate the transition of objects between storage classes and the expiration (deletion) of objects. They help optimize costs by automatically moving data to cheaper storage as it ages.
S3 Storage Classes
S3 offers multiple storage classes designed for different use cases. Each class has different pricing, availability, durability, and retrieval time characteristics. Choosing the right class is key to cost optimization.
S3 Basics — Buckets, Objects, Keys
Amazon Simple Storage Service (S3) is an object storage service that offers virtually unlimited storage with industry-leading durability, availability, security, and performance. It is one of the oldest and most important AWS services.
AWS Lightsail & App Runner
Amazon Lightsail is the simplest way to get started with AWS. It provides virtual servers (instances), storage, databases, and networking at a low, predictable monthly price. Think of it as a simplified, bundled AWS experience designed for users who don’t need the full complexity of EC2.
AWS Batch
AWS Batch is a fully managed service that plans, schedules, and executes batch computing workloads across AWS compute resources. It dynamically provisions the optimal quantity and type of compute resources based on the volume and requirements of your batch jobs.
AWS Elastic Beanstalk
AWS Elastic Beanstalk is a Platform as a Service (PaaS) that makes it easy to deploy and manage web applications and services. You upload your code, and Beanstalk automatically handles deployment, capacity provisioning, load balancing, auto scaling, and application health monitoring.
AWS Step Functions
AWS Step Functions is a serverless orchestration service that lets you coordinate multiple AWS services into workflows. You define your workflow as a state machine using a JSON-based language called Amazon States Language (ASL).
AWS Lambda — Advanced
When Lambda receives a request, it creates an execution environment (a lightweight container) to run your function. Understanding this lifecycle is critical for performance optimization.
AWS Lambda — Fundamentals
AWS Lambda is a serverless compute service that lets you run code without provisioning or managing servers. You upload your code, and Lambda handles everything needed to run and scale it with high availability. You pay only for the compute time you consume.
Amazon ECR (Elastic Container Registry)
Amazon Elastic Container Registry (ECR) is a fully managed Docker container image registry that makes it easy to store, manage, and deploy Docker container images. Think of it as a private Docker Hub hosted on AWS.
Amazon EKS (Elastic Kubernetes Service)
Kubernetes (K8s) is an open-source container orchestration platform originally developed by Google. It automates the deployment, scaling, and management of containerized applications. It is the industry standard for container orchestration.
Amazon ECS (Elastic Container Service)
Before diving into ECS, it’s important to understand what containers are and why they matter.
Elastic Load Balancing (ALB, NLB, GLB, CLB)
Elastic Load Balancing (ELB) automatically distributes incoming application traffic across multiple targets (EC2 instances, containers, IP addresses, Lambda functions) in one or more Availability Zones. It increases the availability and fault tolerance of your application.
EC2 Auto Scaling
Auto Scaling provides two key benefits: 1) Elasticity — automatically scale out (add instances) when demand increases and scale in (remove instances) when demand decreases. 2) High Availability — automatically replace unhealthy instances and maintain your desired instance count across AZs.
EC2 Placement Groups
EC2 Placement Groups let you control how your instances are placed on the underlying hardware. Different strategies optimize for different goals: performance, availability, or cost. There are three strategies.
AMI & EC2 Image Builder
An Amazon Machine Image (AMI) is a template that contains the software configuration (OS, application server, applications) required to launch an EC2 instance. Think of it as a snapshot of a complete server that you can use to create identical instances.
EC2 Storage (EBS, Instance Store)
EC2 instances need storage. AWS provides two main types of block storage for EC2: Amazon EBS (network-attached, persistent) and Instance Store (physically attached, ephemeral).
EC2 Pricing Models
EC2 offers multiple pricing models to optimize cost based on your workload pattern. Choosing the right model is one of the most tested topics on the exam.
EC2 Launch, Security Groups & Key Pairs
Security Groups are STATEFUL: if you allow inbound traffic, the response is automatically allowed outbound (and vice versa). You don’t need to create separate inbound and outbound rules for the same connection.
EC2 Instance Types & Families
EC2 is the foundation of AWS compute. An EC2 instance is a virtual machine running on AWS physical hardware. You choose the instance type, OS, storage, and network settings. You pay only for the compute time you use.
Cross-Account Access Patterns
Cross-account access is a common pattern in AWS multi-account architectures. It allows principals in one account to access resources in another account securely, without creating duplicate IAM users.
AWS Directory Service & Federation
AWS Directory Service provides multiple ways to use Microsoft Active Directory (AD) with AWS services. It is essential for enterprises that use AD for identity management.
AWS IAM Identity Center (SSO)
IAM Identity Center provides one login portal for accessing ALL your AWS accounts in an Organization, plus third-party applications (Salesforce, Slack, Microsoft 365, etc.). One login, one set of credentials, one place to manage.
AWS Organizations & SCPs
AWS Organizations is a service that lets you consolidate multiple AWS accounts into a single organization. It provides centralized billing, account management, and policy-based governance.
IAM Policy Evaluation Logic
Understanding how AWS evaluates policies is critical for passing any AWS exam and for designing secure architectures. When a principal (user, role) makes a request, AWS evaluates all applicable policies to determine whether to allow or deny the request.
IAM Best Practices & Security
Every user, role, and application should have ONLY the minimum permissions necessary to perform their specific task. This is the most important IAM security principle and is tested extensively on the exam.
IAM Roles and Assume Role
IAM User = long-term credentials (password, access keys) for a specific person or application. IAM Role = temporary credentials that can be assumed by users, services, or external accounts. Think of a role like a "hat" you can put on temporarily to gain specific permissions.
IAM Users, Groups, and Policies
IAM is about two things: Authentication (proving who you are) and Authorization (what you are allowed to do). IAM is a global service — it is not Region-specific. IAM is free to use.
AWS Management Console, CLI & SDK
AWS provides three main ways to interact with AWS services. All three are built on the same underlying AWS API. Understanding when to use each is important.
AWS Support Plans
AWS offers multiple support plans to meet different needs and budgets. Understanding the differences between each plan is essential for the exam.
AWS Shared Responsibility Model
AWS is responsible for security OF the cloud (infrastructure). The customer is responsible for security IN the cloud (data, configuration, access management).
AWS Well-Architected Framework
The Well-Architected Framework consists of 6 pillars. Each pillar represents a fundamental area of cloud architecture best practices. Memorize all 6 pillars — they are heavily tested.
AWS Global Infrastructure
AWS Global Infrastructure is built around Regions, Availability Zones (AZs), and Edge Locations. Each serves a specific purpose in delivering reliable, low-latency cloud services worldwide.
Benefits of Cloud Computing
AWS loves to test the 6 advantages. The most commonly tested are: Trade CapEx for OpEx, Stop Guessing Capacity, and Economies of Scale. If a question mentions reducing upfront costs, the answer relates to trading CapEx for variable expense (OpEx).
Cloud Service Models (IaaS, PaaS, SaaS)
Think of cloud models like getting pizza: IaaS = You buy ingredients and cook at home (you manage most things). PaaS = You buy a take-and-bake pizza (provider handles the oven/kitchen). SaaS = You order delivery (provider handles everything, you just eat).
What is Cloud Computing?
Cloud computing is the on-demand delivery of IT resources over the internet with pay-as-you-go pricing. Instead of buying, owning, and maintaining physical data centers and servers, you can access technology services (compute power, storage, databases) on an as-needed basis from a cloud