Review
Read the description, try to recall the service or concept, then open the card to check.
The exam
What is it?An Associate level exam that validates the ability to design solutions based on the AWS Well-Architected Framework, secure, resilient, high-performing and cost-optimized.Show answer
FormatAWS Certified Solutions Architect - Associate (SAA-C03)
Distractors are plausible answers that match the content area. Expect two options that both work, and pick the one that meets every requirement in the stem.
What is it?The result is pass or fail, reported as a scaled score so that exam forms with slightly different difficulty are comparable.Show answer
Scoring
A weak domain does not fail you by itself. Domain 1 (30%) and Domain 2 (26%) together are more than half of the scored content, so they deserve the most study time.
What is it?Four content domains, each split into task statements. The guide lists the knowledge and skills behind every task, which makes it the real syllabus.Show answer
Domains
The domain names mirror four Well-Architected pillars. When a question says "most secure", "most resilient", "best performance" or "lowest cost", it is telling you which domain, and which trade-off, it is grading.
What is it?The exam targets someone with at least 1 year of hands-on experience designing cloud solutions with AWS services. The guide publishes both an in-scope and an out-of-scope service list.Show answer
Candidate and scope
An option built on an out-of-scope service (Lightsail, CDK, CodeDeploy) is almost never the expected answer. Prefer the in-scope managed service that meets the requirement.
What is it?Most questions are scenarios with several technically valid answers. The qualifier in the last sentence decides which one is correct.Show answer
Reading questions
Read the last sentence first. "Most secure" and "least operational overhead" can point to different answers for the same scenario, and the distractor is usually the one that optimizes the wrong qualifier.
What is it?The certification is valid for 3 years. Renewal requires an active certification.Show answer
Validity
Not an exam topic, but plan for it: a renewal exam started with the 50% voucher costs half of the 150 USD fee.
Well-Architected and global infrastructure
What is it?A set of design principles, best practices and questions for building secure, reliable, efficient, cost-effective and sustainable workloads. A review is a conversation about trade-offs, not an audit.Show answer
The frameworkAWS Well-Architected Framework
The four exam domains are four pillars. Operational excellence and sustainability have no domain of their own, but show up as qualifiers such as "least operational overhead".
What is it?The design principles behind Domains 1 and 2. Most correct answers in those domains apply one of them.Show answer
Security and reliability
Long-lived access keys on an instance lose to an IAM role. A single large instance loses to an Auto Scaling group across AZs. Both are these principles in answer form.
What is it?The design principles behind Domains 3 and 4: consume technology as a service, match it to the access pattern and pay only for what delivers value.Show answer
Performance and cost
"Key-value lookups at any scale" is mechanical sympathy pointing to DynamoDB, not a bigger relational instance. "Environments idle at night" is the consumption model: schedule them off.
What is it?The two pillars without their own domain. They still decide many answers through automation, managed services and utilization.Show answer
Operations and sustainability
Infrastructure as code with small, reversible deployments is the operational excellence answer. Rightsizing and S3 Lifecycle to colder tiers serve both sustainability and cost.
What is it?A Region is a separate geographic area, isolated from the others. Each Region has at least 3 Availability Zones, each made of one or more discrete data centers.Show answer
Regions and AZs
"Survive the loss of a data center" means multi-AZ. "Survive the loss of a Region" or "regulator requires another geography" means multi-Region, which costs more. To align zones across accounts, use the AZ ID.
What is it?Infrastructure outside the Region core: edge locations for content and traffic, and zones or racks that bring AWS closer to users or into your data center.Show answer
Edge and hybrid
"Single-digit millisecond latency to an on-premises system" or "data must stay in our facility" is Outposts. "Users in a metro without a Region" is Local Zones. "5G mobile devices" is Wavelength. "Static IP and TCP/UDP acceleration" is Global Accelerator, not CloudFront.
What is it?AWS is responsible for security of the cloud, the customer for security in the cloud. How much stays with you depends on how abstracted the service is.Show answer
Shared responsibility
At Associate level the question becomes design: moving from EC2 to a managed service is how you shift patching and OS hardening to AWS. Encrypting data and scoping IAM permissions always stay with you.
What is it?A console service, at no additional charge, for reviewing a workload against the framework, recording decisions and tracking improvements.Show answer
Well-Architected ToolAWS Well-Architected Tool
"Review a workload against AWS best practices and track remediation over time" is the Well-Architected Tool. Trusted Advisor checks the account for specific issues, it does not run the architecture review.
Identity and access management
What is it?IAM authenticates principals and authorizes each request with JSON policies. Prefer roles with temporary credentials over users with long-term keys.Show answer
IAM building blocksAWS Identity and Access Management
An application on EC2 needs S3 access -> attach an IAM role through an instance profile. Storing access keys on the instance or in the code is always the wrong answer.
What is it?Every request starts as an implicit deny. An explicit deny in any policy wins, and every guardrail in the path must also allow the action.Show answer
Policy evaluation
"Let developers create roles without escalating their own privileges" -> permissions boundary required on the roles they create. Limiting a whole account or OU is an SCP, not a boundary.
What is it?STS issues temporary credentials when a principal assumes a role. It is the mechanism behind instance profiles, cross-account access and federation.Show answer
Roles and STSAWS Security Token Service
"Give a partner or another account access to resources" -> cross-account IAM role, with an external ID for third parties. Creating IAM users for them or sharing access keys is the distractor.
What is it?The identity created with the account has unrestricted access. Protect it with MFA and use it only for the few tasks that require it.Show answer
Root user
"Secure the root user" -> MFA, no access keys, use only for root-only tasks. When asked which task needs the root user, look for closing a standalone account or restoring a locked-out administrator.
What is it?Workforce single sign-on to many AWS accounts and applications from one place. It is the recommended way to give people access in a multi-account organization.Show answer
IAM Identity CenterAWS IAM Identity Center
"Employees need single sign-on to many accounts with their corporate credentials" -> IAM Identity Center connected to the corporate IdP. Cognito serves the customers of your app, not your workforce.
What is it?Users keep their identity in an external IdP and receive temporary AWS credentials, so no IAM users or long-term keys are handed out.Show answer
Federation
"On-premises Active Directory users must reach the AWS console without new credentials" -> SAML 2.0 federation or IAM Identity Center with AD. "A server or pipeline outside AWS needs credentials" -> OIDC federation or IAM Roles Anywhere, not access keys.
What is it?Customer identity for web and mobile apps. User pools answer who the user is, identity pools answer which AWS resources the user may reach.Show answer
Amazon Cognito
"Mobile app users upload straight to their own S3 prefix" -> Cognito identity pool issuing temporary credentials. "Sign-up and sign-in with Google for the app" -> user pool.
What is it?Managed ways to use Microsoft Active Directory with AWS, from a full managed AD to a proxy that keeps the directory on premises.Show answer
Directory ServiceAWS Directory Service
"Keep users in the on-premises AD and let them sign in to WorkSpaces" -> AD Connector. "Trust with on-premises AD" or "RDS for SQL Server with Windows authentication" -> AWS Managed Microsoft AD.
Multi-account governance
What is it?Groups accounts into a hierarchy under one management account, with central policies, consolidated billing and service integrations.Show answer
AWS Organizations
"Isolate environments and apply controls per group of accounts" -> separate accounts in OUs with policies attached to each OU. IAM alone inside one account gives no central guardrail.
What is it?Authorization policies set the maximum available permissions in member accounts. SCPs cap principals, RCPs cap resources, and neither grants anything.Show answer
SCPs and RCPsService control policies and resource control policies
"Stop every account in the OU from disabling CloudTrail or using unapproved Regions, even administrators" -> SCP. "Block principals outside the organization from our S3 buckets in all accounts" -> RCP.
What is it?Sets up and governs a multi-account landing zone that follows AWS best practices, orchestrating Organizations, IAM Identity Center and Service Catalog.Show answer
AWS Control Tower
"Quickly set up a governed multi-account environment with guardrails and account vending" -> Control Tower. Assembling the same with Organizations by hand means more operational overhead.
What is it?Share resources you own with other accounts, OUs or the whole organization instead of duplicating them in every account.Show answer
AWS RAMAWS Resource Access Manager
"Many accounts must place workloads in a centrally managed network" -> share subnets or a transit gateway with AWS RAM. Recreating the resource in every account is the distractor.
What is it?Register a member account to administer an integrated service for the whole organization, keeping daily work out of the management account.Show answer
Delegated administration
"A central security team must manage GuardDuty findings for all accounts without using the management account" -> delegated administrator for GuardDuty in the security account.
What is it?Organization policies that configure services centrally instead of limiting permissions. Unlike SCPs, they also apply to the management account.Show answer
Declarative policies
"Enforce a consistent CostCenter tag format across all accounts" -> tag policy. Remember that tag policies do not flag resources that have no tags at all.
Network security
What is it?Routing defines the subnet type. Keep only load balancers and gateways public, and put application and data tiers in private subnets.Show answer
Public and private subnets
"Instances must download patches but must not be reachable from the internet" -> private subnet with a route to a NAT gateway. A NAT gateway takes no security group, so filter with instance security groups and NACLs.
What is it?Security groups are the primary, stateful filter at the instance. Network ACLs are a stateless guard rail at the subnet that can also deny.Show answer
Security groups vs NACLs
"Block a malicious IP range now" -> NACL deny rule (or AWS WAF for HTTP). "Allow the app tier only from the web tier" -> security group that references the web tier security group.
What is it?Reach AWS services and endpoint services privately, without an internet gateway, a NAT device or public IPs.Show answer
VPC endpoints
"Private instances must reach S3 without NAT gateway data charges" -> S3 gateway endpoint. "On-premises servers on Direct Connect must reach S3 privately" -> S3 interface endpoint.
What is it?A layer 7 web application firewall that inspects HTTP(S) requests before they reach CloudFront, an ALB, API Gateway or another front door.Show answer
AWS WAF
"Block SQL injection and XSS against the web app" -> AWS WAF on the ALB or CloudFront. Security groups and NACLs cannot inspect HTTP content, and WAF does not attach to a Network Load Balancer.
What is it?Managed DDoS protection. Standard is automatic for every customer at no cost, Advanced adds expert response and cost protection for critical apps.Show answer
AWS Shield
"DDoS experts on call and no surprise bill after an attack" -> Shield Advanced. If the question only asks for basic DDoS protection at no cost, Shield Standard is already on.
What is it?Managed stateful firewall and intrusion prevention for the VPC perimeter, for traffic through internet gateways, NAT gateways, VPN and Direct Connect.Show answer
AWS Network Firewall
"Filter outbound traffic of every VPC by domain name, with IPS signatures" -> Network Firewall. WAF only covers HTTP(S) at the application front door.
What is it?Central firewall policies for every account of an organization, applied automatically to new accounts and resources.Show answer
Firewall ManagerAWS Firewall Manager
"Every ALB in every account must always carry the corporate WAF rules, including future accounts" -> Firewall Manager. Configuring WAF account by account does not scale.
What is it?Protect traffic between on premises and AWS. Site-to-Site VPN encrypts over the internet, while Direct Connect is private but not encrypted by default.Show answer
Encrypted hybrid links
"Traffic over Direct Connect must be encrypted" -> MACsec on a supported dedicated connection or an IPsec VPN over Direct Connect. Direct Connect alone does not meet an encryption requirement.
Data protection
What is it?Managed keys protected by FIPS 140-3 Security Level 3 validated HSMs that never leave the service unencrypted, integrated with most services for encryption at rest.Show answer
AWS KMSAWS Key Management Service
"Share an encrypted snapshot or object with another account" -> customer managed key with the other account in the key policy. AWS managed keys cannot be shared.
What is it?Single-tenant hardware security modules in the AWS Cloud for when you must fully control the keys and the HSM users yourself.Show answer
AWS CloudHSM
"Single-tenant HSM", "exclusive control of the keys" or "AWS must not access the keys" -> CloudHSM. Plain encryption at rest with an audit trail is KMS.
What is it?Every S3 bucket encrypts new objects by default. Choose the option by who must control the key and how many encryption layers compliance demands.Show answer
S3 encryption
"Audit every use of the key and control who can decrypt" -> SSE-KMS with a customer managed key. "Two layers of encryption" -> DSSE-KMS. "The company manages its own keys outside AWS" -> SSE-C or client-side encryption.
What is it?Public and private TLS certificates for integrated services at no additional charge, with managed renewal so certificates do not expire unnoticed.Show answer
ACM and TLSAWS Certificate Manager
"HTTPS on CloudFront with a custom domain" -> ACM certificate in us-east-1. "Avoid outages from expired certificates" -> ACM certificate with DNS validation, not an imported one.
What is it?Keep credentials out of code. Secrets Manager rotates secrets automatically, while Parameter Store holds configuration and simple encrypted values.Show answer
Secrets and parameters
"A database password must rotate automatically" -> Secrets Manager. "Store AMI IDs or configuration values cheaply" -> Parameter Store.
What is it?Managed services that find threats, vulnerabilities and sensitive data, then aggregate and investigate the findings.Show answer
Detection services
"Find PII in S3" -> Macie. "Compromised credentials or crypto mining" -> GuardDuty. "CVEs in EC2 or container images" -> Inspector. "One view of compliance posture" -> Security Hub. "Root cause of a finding" -> Detective.
What is it?Immutable storage for regulatory retention and ransomware protection, at the object, vault or backup level.Show answer
WORM retention
"Records that nobody, including administrators, may delete for 7 years" -> S3 Object Lock in compliance mode. Governance mode still lets privileged users with the bypass permission remove data.
What is it?Self-service portal for AWS compliance reports and agreements, free of charge.Show answer
AWS Artifact
"An auditor asks for the AWS SOC report or PCI attestation" -> AWS Artifact. AWS Config and AWS Audit Manager assess your own resources instead.
Decoupling and messaging
What is it?A fully managed queue that buffers work between producers and consumers, so a slow or failed consumer does not lose requests. Consumers poll the queue and delete each message after processing it.Show answer
SQSAmazon Simple Queue Service
"Decouple the tiers and absorb traffic spikes" -> SQS standard. "Process orders exactly once and in order" -> SQS FIFO. Messages processed twice point to a visibility timeout shorter than the processing time, not to a missing DLQ.
What is it?Publish and subscribe: a producer publishes once to a topic and SNS pushes a copy to every subscriber. Subscribers do not poll.Show answer
SNSAmazon Simple Notification Service
"One event must trigger several independent processes" -> SNS + SQS fan-out. Writing the same message to several queues from the application is the distractor: it couples the producer to every consumer.
What is it?A serverless event router: event buses receive events from AWS services, your applications and third-party software, and rules send them to targets.Show answer
EventBridgeAmazon EventBridge
"React to a change in an AWS service" or "route events by content to many targets" -> EventBridge rule. "Run a task every night without servers" -> EventBridge Scheduler, not a cron job on an EC2 instance.
What is it?Workflow orchestration as a state machine: retries, error handling, parallel branches and waits are declared in the workflow instead of coded in each service.Show answer
Step FunctionsAWS Step Functions
"Coordinate several Lambda functions with retries and a manual approval step" -> Step Functions Standard. Lambda functions calling each other is the distractor. "Thousands of short events per second" -> Express.
What is it?A managed front door for APIs that handles authorization, throttling and monitoring in front of Lambda, HTTP endpoints or AWS services.Show answer
API GatewayAmazon API Gateway
"Limit each partner by API key with a monthly quota" -> REST API with usage plans. "Cheapest proxy to Lambda with JWT auth" -> HTTP API. "Server pushes updates to clients" -> WebSocket API, not polling.
What is it?Managed Apache ActiveMQ and RabbitMQ brokers, to migrate applications that already use standard messaging protocols without rewriting the messaging code.Show answer
Amazon MQ
"Migrate an on-premises app that uses JMS or AMQP with minimal code changes" -> Amazon MQ. Rewriting it for SQS is the distractor when the question stresses keeping the existing code.
What is it?A stream of ordered records kept for replay and read by several consumer applications at once. Pick it over SQS when many consumers need the same data or must reprocess it.Show answer
Kinesis vs SQSAmazon Kinesis Data Streams
"Several applications must process the same clickstream in real time and replay it" -> Kinesis Data Streams. SQS is the distractor: each message is processed by one consumer and then deleted.
What is it?Instances that keep no session data can be added, replaced or terminated at any time, which is what makes Auto Scaling and load balancing safe.Show answer
Stateless design
"Users are logged out when Auto Scaling terminates an instance" -> move sessions to ElastiCache or DynamoDB. Enabling sticky sessions is the distractor: it keeps the state on the instance.
High availability
What is it?Availability Zones are isolated locations inside a Region. Spreading every tier across at least 2 AZs removes the single point of failure that one AZ represents.Show answer
Multi-AZ design
"Survive the failure of one Availability Zone at the lowest cost" -> Multi-AZ (ALB, Auto Scaling across AZs, RDS Multi-AZ). A second Region is the distractor unless the question mentions a Region-wide outage.
What is it?ELB spreads traffic across healthy targets in several Availability Zones and stops routing to a target that fails its health checks.Show answer
Load balancersElastic Load Balancing
"Clients must allowlist fixed IP addresses" or "UDP traffic" -> NLB. "Route /api and /images to different services" -> ALB. "Insert third-party firewalls transparently" -> GWLB.
What is it?Keeps the desired number of healthy instances across AZs and changes that number with demand, between a minimum and a maximum.Show answer
EC2 Auto ScalingAmazon EC2 Auto Scaling
"Traffic rises every weekday at 9 a.m. and instances take minutes to boot" -> predictive or scheduled scaling, plus a warm pool. "Keep CPU near a value" -> target tracking. Simple scaling is rarely the best answer.
What is it?Multi-AZ deployments fail over automatically inside a Region. Read replicas scale reads and can be promoted, but they replicate asynchronously and are promoted by hand.Show answer
RDS availabilityAmazon RDS
"Automatic failover with no application changes" -> Multi-AZ. "Offload reporting queries" -> read replica. A read replica is the distractor for HA: it is asynchronous and must be promoted.
What is it?Aurora separates compute from a shared cluster volume copied across 3 AZs, so replicas add read capacity and failover targets without copying data.Show answer
AuroraAmazon Aurora
"Fastest failover for a relational database with many read replicas" -> Aurora with replicas in other AZs. "Choose which replica becomes the writer" -> promotion tier.
What is it?A managed connection pool between the application and RDS or Aurora that absorbs connection surges and hides failovers from clients.Show answer
RDS ProxyAmazon RDS Proxy
"Lambda functions exhaust database connections" -> RDS Proxy. A bigger instance class is the distractor. "Make an app tolerate database failover without changing code" -> RDS Proxy.
What is it?Route 53 health checks remove unhealthy endpoints from DNS answers, giving active-active or active-passive failover across AZs or Regions.Show answer
Route 53 failoverAmazon Route 53
"Send users to a backup site only when the primary fails" -> failover routing with health checks. "Spread traffic and skip unhealthy Regions" -> latency or weighted routing with health checks.
What is it?Resilience also depends on limits, deployments and visibility: quotas that cap scaling, throttling that needs retries and tracing that finds the failing component.Show answer
Quotas and operations
"The failover Region could not launch enough instances" -> raise service quotas in the standby Region beforehand. "Find which microservice adds latency" -> X-Ray, not CloudWatch Logs alone.
Disaster recovery
What is it?The 2 recovery objectives the business sets for each workload. They drive the choice of DR strategy and its cost.Show answer
RPO and RTO
"Can lose at most 15 minutes of data" is an RPO requirement. "Must be back online within 1 hour" is an RTO requirement. Check which one the question constrains before picking a strategy.
What is it?The whitepaper Disaster Recovery of Workloads on AWS groups DR into 4 strategies, from cheap and slow to expensive and near zero.Show answer
DR strategies
"Data must be live in the second Region but servers can start on failover" -> pilot light. "Must take traffic immediately at reduced capacity" -> warm standby. The difference is whether the DR copy serves requests without being switched on first.
What is it?Central, policy-based backup for EC2, EBS, RDS, Aurora, DynamoDB, EFS, FSx, S3 and more, with copies to other Regions and accounts.Show answer
AWS Backup
"Centralize backups across many accounts and copy them to another Region" -> AWS Backup with Organizations. "Ransomware must not delete backups" -> Vault Lock in compliance mode plus cross-account copies.
What is it?Continuous block-level replication of servers from on premises, another cloud or another AWS Region into a low-cost staging area in AWS.Show answer
Elastic Disaster RecoveryAWS Elastic Disaster Recovery
"Replicate on-premises servers to AWS with RPO in seconds and RTO in minutes" -> Elastic Disaster Recovery. AWS Backup is the distractor: it takes point-in-time backups, not continuous replication.
What is it?Asynchronous copying of objects to buckets in another Region (CRR) or the same Region (SRR), owned by the same or another account.Show answer
S3 replicationAmazon S3 Replication
"Copy objects to another Region within a predictable 15 minutes" -> CRR with S3 RTC. "Objects that existed before the rule were not copied" -> Batch Replication.
What is it?Managed cross-Region replication for relational and NoSQL data keeps RPO low without building your own pipelines.Show answer
Database replication
"Relational database, Region outage, RPO in seconds and RTO under 1 minute" -> Aurora Global Database. "Users in several Regions must write locally" -> DynamoDB global tables.
What is it?Incremental, point-in-time block backups stored in S3 and replicated across the AZs of the Region, the building block of EC2 backup and restore.Show answer
EBS snapshotsAmazon EBS snapshots
"Automate daily EBS snapshots and copy them to another Region at no extra cost" -> Data Lifecycle Manager. Pick AWS Backup when the scope spans many services and accounts.
What is it?Moving users to the recovery Region needs traffic routing, capacity that can actually launch and the same configuration in both Regions.Show answer
Regional failover
"The DR Region could not scale during the test" -> service quotas were not raised there. "Clients cache DNS and fail over too slowly" -> Global Accelerator instead of DNS failover.
Storage performance
What is it?The first decision is the storage type. It defines how data is addressed, who can share it and how far it scales.Show answer
Block, file, object
"Shared file system for many Linux instances" -> EFS, not EBS. "Lowest latency disk for one database instance" -> EBS (or instance store if the data is temporary). "Millions of images or a data lake" -> S3.
What is it?Amazon S3 scales automatically, but request rates are counted per prefix and large objects move faster when split into parallel requests.Show answer
S3 performanceAmazon S3 performance
"Large uploads from offices on other continents are slow" -> Transfer Acceleration plus multipart upload. "503 errors on a hot prefix" -> spread keys across more prefixes. "Read only a part of a huge file" -> byte-range fetch.
What is it?Every recommended class is designed for 99.999999999% (11 nines) durability. They differ in availability, number of AZs, minimum storage duration and retrieval time.Show answer
S3 storage classes
"Unknown or changing access pattern" -> Intelligent-Tiering. "Read once a quarter but needs milliseconds" -> Glacier Instant Retrieval. "Compliance archive, 48 hours to retrieve is fine, lowest cost" -> Glacier Deep Archive.
What is it?SSD volumes are tuned for IOPS on small random I/O. HDD volumes are tuned for throughput on large sequential I/O.Show answer
EBS volume typesAmazon EBS
"More IOPS without paying for more GiB" -> gp3 (gp2 ties IOPS to size). "More than 80,000 IOPS or sub-millisecond latency" -> io2 Block Express. "Cheapest EBS for sequential logs" -> st1, or sc1 if rarely read.
What is it?Two block options outside the usual one durable volume per instance: a shared Provisioned IOPS volume, and fast local disks that live and die with the instance.Show answer
Multi-Attach and instance store
"Clustered application in one AZ needs a shared block device" -> EBS Multi-Attach with io2. "Highest disk I/O for temporary data, loss is acceptable" -> instance store. Data that must survive a stop belongs on EBS.
What is it?Serverless NFS file system that grows to petabytes on its own and is shared by EC2, ECS, EKS, Fargate and Lambda. Windows instances are not supported.Show answer
EFSAmazon Elastic File System
"Hundreds of Linux instances across AZs share the same files" -> EFS Regional. "File system throttled in Bursting mode" -> switch to Elastic or Provisioned throughput. "Windows file shares" is never EFS.
What is it?Fully managed file systems built on popular commercial and open source technologies. Pick the one that matches the protocol or the file system already in use.Show answer
FSxAmazon FSx
"Windows shares joined to Active Directory" -> FSx for Windows File Server. "HPC job over a dataset stored in S3" -> FSx for Lustre. "Move a NetApp NAS without changing tools" -> FSx for NetApp ONTAP. "Lift a ZFS server" -> FSx for OpenZFS.
What is it?A software or hardware appliance on premises that gives local applications standard storage interfaces backed by AWS, with local caching for low latency.Show answer
Storage GatewayAWS Storage Gateway
"Replace physical tapes without changing the backup software" -> Tape Gateway. "On-premises app writes files over NFS or SMB that must land in S3" -> S3 File Gateway. "Whole dataset on site with low latency, backups in AWS" -> Volume Gateway stored volumes.
Compute performance
What is it?The instance type fixes the CPU, memory, storage and network of the host. Pick the category first, then the size.Show answer
Instance typesAmazon EC2 instance types
"In-memory database or real-time analytics" -> memory optimized (R, X). "Batch processing, transcoding, game servers" -> compute optimized (C). "High random I/O on large local datasets" -> storage optimized (I, D).
What is it?Placement groups decide how instances sit on the underlying hardware, trading network performance against isolation from correlated failures.Show answer
Placement groups
"HPC nodes exchange data constantly" -> cluster (with EFA or enhanced networking). "Cassandra or HDFS rack awareness" -> partition. "A handful of critical instances must not fail together" -> spread.
What is it?Network performance depends on the instance type and on the network device. Both options below have no additional charge.Show answer
Enhanced networkingENA and Elastic Fabric Adapter
"Tightly coupled HPC or distributed ML training with MPI or NCCL" -> EFA inside a cluster placement group. "More PPS and lower latency for a regular application tier" -> ENA enhanced networking, not EFA.
What is it?Auto Scaling moves the desired capacity between the minimum and the maximum. The policy and the metric decide how fast and how precisely it follows load.Show answer
Scaling metricsAmazon EC2 Auto Scaling
"Workers consuming an SQS queue fall behind" -> target tracking on backlog per instance. "Load jumps every weekday at 9 AM and instances boot slowly" -> predictive or scheduled scaling. "Keep CPU around 50%" -> target tracking.
What is it?Hibernation writes RAM to the EBS root volume and resumes the same processes on start, skipping a long boot or cache warm-up.Show answer
HibernationEC2 instance hibernation
"Application takes too long to rebuild its in-memory state after a restart" -> hibernate instead of stop. If the instance belongs to an Auto Scaling group, hibernation is not an option.
What is it?Managed engines for workloads made of jobs, not servers: AWS Batch for containerized batch jobs, Amazon EMR for big data frameworks.Show answer
Batch and EMRAWS Batch and Amazon EMR
"Thousands of containerized jobs, no scheduler to run" -> AWS Batch. "Petabyte-scale Spark or Hive processing" -> Amazon EMR (EMR Serverless to skip cluster management). A job over 15 minutes rules out Lambda.
What is it?When milliseconds or data location matter, AWS infrastructure runs outside the Region while the parent Region keeps the same APIs and tools.Show answer
Compute near usersOutposts, Local Zones and Wavelength
"Low latency to systems that must stay in our data center" -> Outposts. "Low latency for users in a city far from any Region" -> Local Zones. "Mobile app on a 5G carrier network" -> Wavelength.
What is it?Upload the code and Elastic Beanstalk provisions the environment, load balancing, health monitoring and scaling. No additional charge beyond the resources.Show answer
Elastic BeanstalkAWS Elastic Beanstalk
"Developers want to deploy a web app fast without managing infrastructure" -> Elastic Beanstalk. "Long background tasks slow the web tier" -> a worker environment with SQS.
Serverless and containers
What is it?Runs code in response to events with no servers to manage. Designed for short-lived tasks that keep no state between invocations.Show answer
LambdaAWS Lambda
"CPU-bound function is slow" -> raise memory (CPU follows). "Processing takes 40 minutes" -> not Lambda, use ECS on Fargate or AWS Batch. "Same library in many functions" -> layers.
What is it?Concurrency is average requests per second times average duration. Functions in a Region share 1,000 concurrent executions by default, a quota that can be raised.Show answer
ConcurrencyLambda concurrency
"Cold starts unacceptable on a latency-sensitive API" -> provisioned concurrency (or SnapStart for Java, Python, .NET). "A function overwhelms the database" -> reserved concurrency as a cap.
What is it?Services either push events to Lambda through triggers, or Lambda polls them through an event source mapping that reads batches.Show answer
Event sources
"Process SQS messages with Lambda in batches" -> event source mapping. "Run code when an object arrives in S3" -> S3 event notification trigger. "Duplicates broke the results" -> make the handler idempotent.
What is it?Both orchestrate containers on EC2, Fargate or on premises. The choice comes down to whether you want Kubernetes.Show answer
ECS vs EKSAmazon ECS and Amazon EKS
"Team already runs Kubernetes and wants a managed control plane" -> EKS. "Simplest AWS-native container orchestration with least overhead" -> ECS, usually on Fargate.
What is it?The capacity under ECS or EKS. Fargate runs each task with no servers to manage, while the EC2 launch type runs tasks on instances you manage.Show answer
Fargate vs EC2AWS Fargate
"Run containers without managing or patching servers" -> Fargate. "Containers need GPUs or privileged mode" -> EC2 launch type. "Cheap, interruptible container jobs" -> Fargate Spot.
What is it?Amazon ECR stores the images that ECS, EKS and Lambda pull. Moving an application into containers starts with building an image and pushing it to ECR.Show answer
ECR and migrationAmazon ECR
"Store and scan images, copy them to a DR Region" -> ECR with replication. "Fargate tasks in private subnets cannot pull images" -> add an ECR interface endpoint or a NAT gateway.
What is it?The same orchestrators can manage servers in your own data center, for data that must stay local or for a gradual migration.Show answer
Containers on premisesECS Anywhere and EKS Anywhere
"Run containers on premises, managed from the ECS console" -> ECS Anywhere. "Kubernetes in a disconnected data center" -> EKS Anywhere. "On-premises service needs inbound traffic through a load balancer" -> ECS Anywhere is a poor fit.
What is it?Most designs mix both. The deciding factors are run time, control over the runtime, traffic shape and the operational effort the team can carry.Show answer
Choosing the modelContainers or serverless
"Unpredictable traffic, no servers, pay only when it runs" -> Lambda. "Containerized service running 24/7 without host management" -> ECS on Fargate. "Reuse a published serverless app across accounts" -> Serverless Application Repository.
Databases
What is it?Managed relational databases on instances that you size. You choose the engine, the instance class and the storage, and AWS runs patching, backups and failover.Show answer
Amazon RDSAmazon Relational Database Service
"Reporting queries slow down the production database" -> read replica, not Multi-AZ (the Multi-AZ standby instance serves no reads). "Consistent low-latency I/O for OLTP" -> Provisioned IOPS (io2 Block Express), not gp2.
What is it?MySQL and PostgreSQL compatible engine with a distributed storage layer shared by the writer and all readers, which makes replicas cheap and failover fast.Show answer
Amazon Aurora
"Unpredictable or spiky relational load, pay for what is used" -> Aurora Serverless v2. "Global reads with sub-second lag and Regional DR" -> Aurora Global Database, not cross-Region RDS read replicas.
What is it?Serverless key-value and document database with single-digit millisecond latency at any scale. Performance depends on capacity mode and on how evenly the partition key spreads traffic.Show answer
Amazon DynamoDB
"Millions of requests per second, schemaless, single-digit ms" -> DynamoDB, not RDS. Throttling on a few keys points to a bad partition key, not to a lack of total capacity.
What is it?Indexes, caching, change streams, expiry and multi-Region replication extend DynamoDB beyond simple key lookups.Show answer
DynamoDB features
"Read-heavy DynamoDB, microsecond latency, no code change" -> DAX, not ElastiCache. "Query by another attribute after the table exists" -> GSI (an LSI cannot be added later).
What is it?Managed in-memory cache with Valkey, Redis OSS or Memcached. It offloads repeated reads from databases and stores sessions, with node-based or serverless deployment.Show answer
Amazon ElastiCache
"Leaderboard, sorted ranking, HA cache, session store with failover" -> ElastiCache for Valkey or Redis OSS. "Simple multithreaded cache, no persistence" -> Memcached.
What is it?Each data model has its own managed engine. The exam describes the data and the queries and expects the matching service.Show answer
Purpose-built databases
"Migrate MongoDB with minimal changes" -> DocumentDB. "Cassandra workload, no servers" -> Keyspaces. "Social network, fraud rings, recommendations" -> Neptune.
What is it?Managed connection pool between the application and the database. It absorbs connection storms and keeps connections open during failover.Show answer
RDS ProxyAmazon RDS Proxy
"Lambda functions exhaust database connections" or "too many connections errors" -> RDS Proxy, not a larger instance class.
What is it?AWS DMS moves data into AWS while the source stays operational. Changing the engine also requires converting the schema and code.Show answer
Database migrationAWS Database Migration Service
"Oracle to PostgreSQL with minimal downtime" -> DMS Schema Conversion (or SCT) + DMS with CDC. DMS alone does not convert stored procedures or schema.
Networking
What is it?A VPC is a private network in one Region, divided into subnets that each live in one AZ. Address planning and subnet tiers decide how far it can grow.Show answer
VPC designAmazon Virtual Private Cloud
"Running out of IPs in the VPC" -> add a secondary CIDR block, not a new VPC. A /28 subnet has only 11 usable addresses because 5 are reserved.
What is it?Internet gateways give public subnets two-way internet access. NAT and egress-only gateways let private resources reach out without being reachable.Show answer
Internet and egress
"Private instances need patches from the internet, highly available" -> NAT gateway in each AZ, not a NAT instance. "IPv6 outbound only" -> egress-only internet gateway.
What is it?Peering links two VPCs directly. AWS Transit Gateway is a Regional hub that scales to many VPCs and on premises connections.Show answer
Peering and Transit Gateway
"Dozens of VPCs and on premises sites, full mesh is unmanageable" -> Transit Gateway. "Two VPCs, lowest cost, no transit" -> VPC peering. A peered VPC never forwards traffic for a third one.
What is it?Private access to AWS services and to services in other VPCs without internet gateways, NAT or peering. Traffic stays on the AWS network.Show answer
PrivateLink and endpointsAWS PrivateLink
"Expose one service to hundreds of customer VPCs with overlapping CIDRs" -> PrivateLink endpoint service, not peering. "EC2 to S3 without NAT, no cost" -> gateway endpoint.
What is it?Encrypted IPsec tunnels over the internet. Site-to-Site VPN joins networks, Client VPN connects individual users.Show answer
VPN options
"Connect the office this week, encrypted, low cost" -> Site-to-Site VPN. "Remote employees on laptops" -> Client VPN. More than 1.25 Gbps over VPN -> ECMP on a transit gateway or Large Bandwidth Tunnels.
What is it?A private, dedicated link from your network to AWS that bypasses the internet, for consistent bandwidth and latency.Show answer
Direct ConnectAWS Direct Connect
"Consistent throughput, large daily transfers, no internet" -> Direct Connect. "Needed now" is a VPN, because a new connection takes time to provision. "Encrypted private link" -> DX + IPsec VPN or MACsec.
What is it?Pick the load balancer by protocol layer and requirement. High availability and health checks are covered in the resilience notes.Show answer
Load balancer choiceElastic Load Balancing
"Path-based routing to microservices" -> ALB. "Static IP for allowlisting, UDP, extreme throughput" -> NLB. "Inline third-party firewall fleet" -> Gateway Load Balancer.
Edge and DNS
What is it?Route 53 hosts public and private DNS zones. The alias record is the AWS extension that the exam tests most.Show answer
Route 53 recordsAmazon Route 53
"Point the root domain to a load balancer or CloudFront" -> alias record, never a CNAME. Alias also avoids query charges.
What is it?The routing policy decides which record answers each DNS query. Combined with health checks it gives DNS-level failover and traffic steering.Show answer
Routing policies
"Lowest latency for global users" -> latency, not geolocation. "Content rights or language by country" -> geolocation. "Send 10% to the new version" -> weighted.
What is it?Route 53 health checks remove unhealthy endpoints from DNS answers, which drives failover between Regions.Show answer
Health checks
"Fail over to a backup Region automatically when the primary is unhealthy" -> failover routing + health check. "Health of a private resource" -> CloudWatch alarm based check.
What is it?Content delivery network with more than 750 points of presence and 15 Regional edge caches. It caches static and dynamic content close to users and protects the origin.Show answer
Amazon CloudFront
"Global users, static content from S3, lower latency and lower origin load" -> CloudFront. A cache hit ratio problem points to cache policy and TTLs, not to a bigger origin.
What is it?CloudFront can keep the origin private, require signed access, block countries and encrypt sensitive fields at the edge.Show answer
Restricting content
"Users must not reach the S3 bucket directly" -> OAC. "Paid video library, many files per subscriber" -> signed cookies. "One download link" -> signed URL, not presigned S3 URLs when CloudFront is in front.
What is it?Code that runs in CloudFront to change requests and responses. CloudFront Functions are light and cheap, Lambda@Edge is more capable.Show answer
Edge functions
"Rewrite URLs or add headers at massive scale, lowest cost" -> CloudFront Functions. "Call a third-party API or change the origin request" -> Lambda@Edge.
What is it?Static anycast IP addresses that send users onto the AWS global network at the nearest edge and on to healthy Regional endpoints. No caching.Show answer
Global AcceleratorAWS Global Accelerator
"Static IPs for allowlisting, UDP, fast Regional failover" -> Global Accelerator. "Cache content at the edge, HTTP" -> CloudFront. Both use the edge, only CloudFront caches.
What is it?Faster uploads and downloads to a bucket over long distances, entering the AWS network at a CloudFront edge location.Show answer
S3 Transfer AccelerationAmazon S3 Transfer Acceleration
"Users on other continents upload large files to one bucket" -> S3 Transfer Acceleration, combined with multipart upload for large objects. Not CloudFront, which is mainly for delivery.
Data ingestion and analytics
What is it?Real-time stream that stores records in shards so several consumers can read, and re-read, them in order.Show answer
Kinesis Data StreamsAmazon Kinesis Data Streams
"Real-time, multiple consumers, replay, ordering per key" -> Kinesis Data Streams. Throttled writes -> more shards or a better partition key.
What is it?Fully managed delivery of streaming data to storage and analytics destinations, with buffering, transformation and format conversion. No shards to manage.Show answer
Amazon Data Firehose
"Load streaming data into S3 or Redshift with no code, near real time" -> Data Firehose. "Custom consumers, replay, milliseconds" -> Kinesis Data Streams.
What is it?Managed Apache Kafka for teams already on Kafka, and a dedicated service for video from devices.Show answer
MSK and video streamsAmazon MSK and Amazon Kinesis Video Streams
"Migrate an on premises Kafka cluster with minimal changes" -> Amazon MSK, not Kinesis. "Camera streams for analysis with Rekognition" -> Kinesis Video Streams.
What is it?Glue discovers, catalogs and transforms data, and Lake Formation governs who can read which parts of the data lake in S3.Show answer
Glue and Lake FormationAWS Glue and AWS Lake Formation
"Convert CSV in S3 to Parquet on a schedule, serverless" -> Glue ETL job. "Column-level access to the data lake for different teams" -> Lake Formation, not bucket policies.
What is it?Athena queries S3 with SQL without servers, and Amazon Quick turns the results into dashboards.Show answer
Athena and QuickAmazon Athena and Amazon Quick
"Ad hoc SQL on logs in S3, no infrastructure" -> Athena. "Athena too slow and costly on CSV" -> convert to Parquet and partition. "Interactive BI dashboards" -> Amazon Quick.
What is it?Big data frameworks, the data warehouse and search and log analytics answer different questions about the same data.Show answer
EMR, Redshift, OpenSearch
"Existing Spark or Hadoop jobs, full control of the cluster" -> EMR. "Complex SQL joins across terabytes for BI" -> Redshift. "Full-text search over logs or a catalog" -> OpenSearch.
What is it?Online services move data over the network on a schedule or protocol, physical options move it when the network is too slow.Show answer
Data transfer
"Partners send files over SFTP into S3" -> Transfer Family. "Recurring sync of an NFS share to S3 or EFS" -> DataSync. Exam questions with petabytes and little bandwidth still point to Snowball Edge.
What is it?Managed ways to bring data from SaaS applications and from third-party providers into AWS.Show answer
AppFlow and Data ExchangeAmazon AppFlow and AWS Data Exchange
"Import Salesforce data into S3 daily without code" -> AppFlow, not a custom Lambda. "Subscribe to a commercial data set" -> Data Exchange.
Compute costs
What is it?The same instance costs very different amounts depending on how you buy it. Match the option to how steady, how long and how interruptible the workload is.Show answer
Purchase optionsAmazon EC2 billing and purchasing options
"Steady 24/7 load for 3 years, lowest price" -> Savings Plans or Standard Reserved Instances. "Guarantee capacity in one AZ for a launch, no long commitment" -> On-Demand Capacity Reservation, not a Reserved Instance.
What is it?Both trade a commitment for a lower rate. Savings Plans commit to an hourly spend and follow the workload, Reserved Instances commit to an instance configuration.Show answer
Savings Plans vs RIsSavings Plans and Reserved Instances
"Workloads may move from EC2 to Fargate or Lambda, or to another Region" -> Compute Savings Plans. "Highest discount, the instance family will not change" -> EC2 Instance Savings Plans or Standard RIs. Convertible RIs are the distractor when Fargate or Lambda appear.
What is it?Spare EC2 capacity at up to 90% off On-Demand. EC2 can reclaim it at any time, so the workload must tolerate interruption.Show answer
Spot InstancesAmazon EC2 Spot Instances
"Batch job, can restart, lowest cost" -> Spot with checkpoints. "Database that must stay up" -> never Spot. "Always keep 2 instances, scale out cheaply" -> mixed instances group with an On-Demand base and Spot on top.
What is it?Single-tenant hardware answers compliance and licensing needs, and Capacity Reservations answer capacity needs. Neither is the cheap option on its own.Show answer
Dedicated capacityDedicated Hosts, Dedicated Instances and Capacity Reservations
"License priced per socket or per core, keep using it on AWS" -> Dedicated Hosts. "Only needs single-tenant hardware, no license visibility" -> Dedicated Instances.
What is it?A discount on an oversized instance still wastes money. Rightsize and remove idle resources first, then commit to the new baseline.Show answer
RightsizingAWS Compute Optimizer
"Instances average 10% CPU, cut cost with least effort" -> Compute Optimizer recommendations and a smaller size. "Same performance, lower price, code runs on Arm" -> Graviton.
What is it?Serverless removes idle cost: you pay per request and duration, or per task second. At a high, steady load, well-used instances can be cheaper.Show answer
Lambda and FargateAWS Lambda and AWS Fargate
"Runs a few times a day, a few seconds each time" -> Lambda, not an always-on instance. "Containers, no servers to manage, can be interrupted" -> Fargate Spot.
What is it?Non-production environments rarely need to run at night or need production availability. Stop them off hours, run them smaller and in fewer AZs.Show answer
Scheduling and hibernationInstance Scheduler on AWS
"Dev environment used only in business hours" -> scheduled stop and start with Instance Scheduler. "App needs 20 minutes to warm its memory before serving" -> hibernation, not a plain stop.
Storage costs
What is it?Cheaper classes trade storage price for retrieval fees, minimum storage durations and minimum billable sizes. These hidden charges decide most exam answers.Show answer
S3 storage classesAmazon S3 storage classes
"Millions of 20 KB objects, rarely read" -> keep them in Standard or aggregate them, the 128 KB minimum makes IA cost more. "Re-creatable thumbnails, rarely read" -> One Zone-IA.
What is it?Lifecycle rules move objects down the storage class waterfall or delete them on a schedule, with no code. The schedule must respect each class minimum.Show answer
S3 LifecycleAmazon S3 Lifecycle
"Logs read for 30 days, kept 7 years for audit, lowest cost" -> Lifecycle transitions down to Deep Archive plus an expiration at 7 years. A scheduled Lambda that copies objects is the distractor.
What is it?The class for unknown or changing access patterns. It moves each object between tiers by its own access history, with no retrieval fees.Show answer
Intelligent-TieringAmazon S3 Intelligent-Tiering
"Access pattern unknown or unpredictable, no operational effort" -> Intelligent-Tiering. "Known pattern, hot for 30 days and then cold" -> a Lifecycle rule, which avoids the per-object monitoring fee.
What is it?Storage Lens and Storage Class Analysis show where the bytes and the waste are. Requester Pays moves download costs to whoever reads the data.Show answer
S3 cost visibilityS3 Storage Lens, Storage Class Analysis and Requester Pays
"Share a large dataset, the consumers must pay for downloads" -> Requester Pays. "Find the age when objects become cold to tune lifecycle" -> Storage Class Analysis. "Organization-wide view of storage and waste" -> Storage Lens.
What is it?Block storage is billed for what you provision, not what you use. Pick the cheapest type that meets IOPS and throughput, and archive old snapshots.Show answer
EBS volumes and snapshotsAmazon EBS
"Lower EBS cost, same performance, no downtime" -> modify gp2 to gp3. "Keep yearly snapshots for compliance, rarely restored" -> EBS Snapshots Archive.
What is it?File storage gets much cheaper when cold files leave the primary tier. EFS does it with lifecycle policies, FSx with storage type and data reduction choices.Show answer
EFS and FSxAmazon EFS and Amazon FSx
"Shared Linux files, most untouched after a month" -> EFS lifecycle management to IA or Archive. "Temporary HPC working space at the lowest cost" -> FSx for Lustre scratch, not persistent.
What is it?The cheaper the archive, the slower and costlier the way back. Choose the class by how fast a restore must finish, not only by price per GB.Show answer
Archive retrievalS3 Glacier storage classes
"Archive, occasionally needed within minutes" -> Glacier Flexible Retrieval with Expedited. "Kept 10 years, 48 hours is fine, lowest cost" -> Glacier Deep Archive. "Rarely read but must open in milliseconds" -> Glacier Instant Retrieval.
What is it?Data transfer from the internet into AWS is free, so the cost is in the tool, the link and the time. Pick by data size, bandwidth and deadline.Show answer
Moving data inAWS DataSync and AWS Transfer Family
"Partners upload over SFTP, retire the self-managed server" -> Transfer Family. "Migrate hundreds of TB from NFS with ongoing sync and integrity checks" -> DataSync. Older questions may still offer Snowball Edge as the offline option for huge datasets on thin links.
Network costs
What is it?In AWS you pay mostly for data going out and across boundaries. Every AZ, Region or internet hop on the path can add a charge.Show answer
Data transfer pricing
"Cut transfer cost between the app tier and the database" -> keep chatty components in the same AZ where availability allows, or cache. Cross-Region replication only pays off when DR or latency requires it.
What is it?A NAT gateway bills per hour and per GB processed, so heavy outbound traffic, or traffic to AWS services sent through NAT, gets expensive.Show answer
NAT gatewaysNAT gateways and NAT instances
"Production, must survive an AZ failure" -> one NAT gateway per AZ or a regional NAT gateway. "Dev VPC, minimize cost" -> one shared NAT gateway. "Large NAT bill caused by S3 traffic" -> S3 gateway endpoint.
What is it?Endpoints keep traffic to AWS services off the NAT gateway and the internet. Gateway endpoints are free, interface endpoints are not.Show answer
VPC endpointsGateway and interface VPC endpoints
"Private instances push TBs to S3 through NAT, cut cost" -> S3 gateway endpoint. An interface endpoint for S3 is the distractor here, it bills per hour and per GB.
What is it?Caching at the edge cuts origin load and origin egress. Fewer requests reach EC2 or S3, so the origin can be smaller and transfers less.Show answer
CloudFrontAmazon CloudFront
"Global users download the same static files, reduce cost and latency" -> CloudFront in front of S3. Bigger instances or replicating buckets to more Regions are the distractors.
What is it?The cheapest link depends on volume and bandwidth. VPN rides the internet and is quick to set up. Direct Connect bills port hours but lowers per-GB egress and gives consistent bandwidth.Show answer
Direct Connect vs VPNAWS Direct Connect and AWS Site-to-Site VPN
"Moves tens of TB per month to on premises, needs consistent throughput" -> Direct Connect. "Connect a branch within days, low volume" -> Site-to-Site VPN. "Need more than 1.25 Gbps over VPN" -> several tunnels with ECMP on a transit gateway.
What is it?Peering is the cheaper path for a few VPCs. Transit Gateway adds a per-attachment and per-GB fee in exchange for hub-and-spoke routing at scale.Show answer
Transit Gateway vs peeringAWS Transit Gateway and VPC peering
"3 VPCs exchanging heavy traffic, lowest cost" -> VPC peering. "200 VPCs plus on premises, central routing" -> Transit Gateway.
What is it?Brings user traffic onto the AWS global network through 2 static anycast IPv4 addresses. It buys performance and availability, it does not reduce transfer cost.Show answer
Global AcceleratorAWS Global Accelerator
"Game over UDP, static IPs, fast failover between Regions" -> Global Accelerator. "Reduce the cost of serving static content" -> CloudFront, not Global Accelerator.
What is it?Throttling and caching keep the backend from paying for traffic it does not need to serve.Show answer
API Gateway leversAmazon API Gateway
"The same reads hit Lambda and DynamoDB over and over" -> API Gateway caching. "Limit a partner to 1,000 requests per day" -> usage plan quota with an API key.
Cost management
What is it?The interactive view of cost and usage: filter, group, compare periods and forecast. The usual answer to "analyze where the money goes".Show answer
Cost ExplorerAWS Cost Explorer
"Visualize which service drove last month increase" -> Cost Explorer. "Be warned before overspending" is AWS Budgets, not Cost Explorer.
What is it?Thresholds on cost, usage or commitment metrics, with alerts on actual or forecasted values and optional automatic actions.Show answer
BudgetsAWS Budgets
"Block new provisioning automatically when the forecast passes 90%" -> budget action with a deny IAM policy or SCP. "Notify when Savings Plans utilization drops below 80%" -> Savings Plans utilization budget.
What is it?Machine learning that learns normal spend and alerts on unusual spikes with root cause analysis, without fixed thresholds.Show answer
Anomaly DetectionAWS Cost Anomaly Detection
"Detect unexpected spend spikes without setting thresholds" -> Cost Anomaly Detection. A fixed budget threshold is the distractor.
What is it?The most granular cost data, delivered as files to S3 for Athena, Redshift or Amazon Quick. CUR 2.0 in Data Exports is the current form of the Cost and Usage Report.Show answer
Data Exports and CURAWS Data Exports
"Most detailed line-item cost data, query it with SQL in Athena" -> CUR 2.0 through Data Exports. Cost Explorer is the distractor, it is for interactive analysis, not raw files.
What is it?Tags become cost dimensions only after activation in the Billing console. They are how showback and chargeback by team, project or environment work.Show answer
Cost allocation tags
"Resources are tagged but per-project costs do not show in Cost Explorer" -> activate the cost allocation tags in the Billing console. Tagging the resources again is the distractor.
What is it?One bill for every account in the organization, paid by the management account, with usage combined for discounts.Show answer
Consolidated billingConsolidated billing in AWS Organizations
"Several accounts, want one invoice and volume discounts" -> AWS Organizations consolidated billing. "Keep one unit RI discount away from other accounts" -> restrict or turn off RI and Savings Plans sharing.
What is it?Tools that find waste in what runs today and estimate what you plan to run next.Show answer
Advisors and estimatesTrusted Advisor, Cost Optimization Hub and AWS Pricing Calculator
"Estimate the monthly cost of a planned migration" -> AWS Pricing Calculator, not Cost Explorer, which only covers what already runs.
What is it?Database bills follow the capacity model: per request, per provisioned unit, per ACU or per instance hour. Match it to how steady the load is.Show answer
Database pricingAmazon DynamoDB, Aurora and RDS pricing models
"New app, unpredictable traffic, no capacity planning" -> DynamoDB on-demand. "Steady, well-known traffic, lowest cost" -> provisioned with auto scaling and reserved capacity. "Dev database idle most of the day" -> Aurora Serverless v2 scaling to 0 ACUs.