AWS CloudFront vs Global Accelerator

AWS CloudFront vs Global Accelerator

  • Both CloudFront and Global Accelerator use the AWS global edge network to improve performance, but they serve different purposes.
  • CloudFront is a Content Delivery Network (CDN) that caches content at edge locations.
  • Global Accelerator routes traffic over the AWS backbone to the optimal regional endpoint without caching.

CloudFront vs Global Accelerator Comparison

Feature CloudFront Global Accelerator
Purpose Content caching and delivery (CDN) Network traffic acceleration (no caching)
Layer Layer 7 (HTTP/HTTPS/WebSocket) Layer 4 (TCP/UDP)
Caching Yes – caches content at 400+ edge locations No caching – proxies all requests to origin
Static IP No (uses DNS-based routing) Yes – 2 anycast static IPs
IP Whitelisting Difficult (IPs change) Easy (fixed anycast IPs)
Protocols HTTP, HTTPS, WebSocket TCP, UDP
DNS Propagation Affected by DNS TTL during failover Instant failover (no DNS change, same IPs)
Failover Origin failover (primary/secondary) Automatic endpoint failover (<30 seconds)
DDoS Protection AWS Shield Standard (Shield Advanced optional) AWS Shield Standard (Shield Advanced optional)
WAF Integration Yes (AWS WAF) No
Origins/Endpoints S3, ALB, EC2, custom HTTP origins ALB, NLB, EC2, Elastic IP
Client Affinity No (stateless caching) Yes (source IP based)
Best For Static/dynamic web content, APIs, video streaming Gaming, IoT, VoIP, non-HTTP apps needing fixed IPs

When to Choose Which

  • Choose CloudFront – Web applications, static asset delivery, video streaming, API acceleration with caching, need WAF integration.
  • Choose Global Accelerator – Non-HTTP protocols (TCP/UDP gaming, IoT), need static IP for whitelisting, instant failover without DNS propagation, multi-region active-active.
  • Use Both Together – CloudFront for cacheable content + Global Accelerator for the origin endpoint requiring fixed IPs and fast failover.

AWS Certification Exam Practice Questions

  1. A gaming company needs to route UDP traffic to the nearest regional server with sub-30-second failover and static IPs for firewall whitelisting. Which service should they use?
    1. CloudFront
    2. Route 53 latency-based routing
    3. Global Accelerator
    4. ALB with multi-region
  2. A media company wants to serve video content and static assets globally with lowest latency and reduce origin load. Which service is most appropriate?
    1. Global Accelerator
    2. CloudFront
    3. S3 Transfer Acceleration
    4. Route 53 geolocation routing
  3. An application needs both fast failover (no DNS propagation delay) and static anycast IP addresses for a TCP-based service. The content is dynamic and cannot be cached. Which service fits?
    1. CloudFront with cache disabled
    2. Global Accelerator
    3. Route 53 with health checks
    4. NLB with Elastic IPs

Related Posts

References

Amazon CloudFront Developer Guide

AWS Global Accelerator Developer Guide

AWS S3 vs EBS vs EFS vs FSx

📌 Updated Guide Available: For a comprehensive comparison with architecture diagrams and practice questions, see our updated AWS S3 vs EBS vs EFS – Complete Storage Comparison Guide.

This page covers FSx in addition to S3, EBS, and EFS.

AWS S3 vs EBS vs EFS vs FSx

  • AWS offers four primary storage services, each designed for different access patterns and use cases.
  • S3 is object storage, EBS is block storage for EC2, EFS is managed NFS file storage, and FSx is managed file systems for specific workloads (Windows, Lustre, NetApp, OpenZFS).
  • Choice depends on access patterns, performance needs, sharing requirements, and protocol compatibility.

S3 vs EBS vs EFS vs FSx Comparison

Feature S3 EBS EFS FSx
Type Object storage Block storage File storage (NFS) File storage (multiple protocols)
Access HTTP/HTTPS API Attached to single EC2 (multi-attach for io2) Concurrent access from multiple EC2/ECS/Lambda Concurrent access from multiple instances
Protocol REST API, S3 API Block device (no protocol) NFSv4.1 SMB, NFS, Lustre, iSCSI
Max Size Unlimited (5TB per object) 64TB per volume Unlimited (petabyte scale) Varies (up to petabytes)
Durability 99.999999999% (11 nines) 99.999% (within AZ) 99.999999999% (across AZs) 99.999999999% (Multi-AZ option)
Availability Zone Regional (across 3+ AZs) Single AZ Regional (Multi-AZ) Single AZ or Multi-AZ
Performance High throughput, higher latency Low latency (sub-ms for io2) Low latency, scales with file system Sub-ms latency (Lustre/OpenZFS)
Use Case Backup, data lake, static hosting, archive Databases, boot volumes, transactional workloads Shared content, CMS, home dirs, containers HPC, Windows shares, ML training, ONTAP
Pricing Model Per GB stored + requests + transfer Per GB provisioned + IOPS (io2) Per GB used (no provisioning) Per GB provisioned + throughput
Lifecycle/Tiering Yes (Intelligent-Tiering, Glacier) No Yes (EFS IA, Archive) Limited (FSx Lustre S3 integration)
Encryption SSE-S3, SSE-KMS, SSE-C AES-256 (KMS) AES-256 (KMS) AES-256 (KMS)
Backup Versioning, Cross-Region Replication Snapshots (to S3) AWS Backup AWS Backup, automatic backups

Amazon S3

  • Object storage – stores data as objects (key-value) with unlimited capacity.
  • Best for data lakes, backups, static website hosting, media storage, and archive.
  • Multiple storage classes: Standard, IA, One Zone-IA, Intelligent-Tiering, Glacier Instant/Flexible/Deep Archive.
  • Not a file system – cannot be mounted directly (use S3 Mountpoint for read-heavy workloads).
  • Supports event notifications to Lambda, SQS, SNS, EventBridge for event-driven processing.

Amazon EBS

  • Block-level storage designed for single EC2 instance attachment (io2 supports multi-attach).
  • Best for databases, boot volumes, and applications requiring low-latency block access.
  • Volume types: gp3 (general purpose), io2 Block Express (high IOPS), st1 (throughput), sc1 (cold).
  • Single AZ – volume and instance must be in the same AZ; use snapshots for cross-AZ/region copies.
  • Supports live volume resizing and type changes without downtime.

Amazon EFS

  • Fully managed NFS file system – multiple EC2, ECS, and Lambda can access simultaneously.
  • Best for shared content repositories, CMS, home directories, container storage, and ML training data.
  • Elastic – automatically grows and shrinks; pay only for storage used.
  • Performance modes: General Purpose (latency-sensitive) and Max I/O (high throughput).
  • EFS Infrequent Access and Archive tiers reduce costs for rarely accessed files.
  • Supports cross-region replication for DR.

Amazon FSx

  • Managed file systems for specialized workloads – four options available.
  • FSx for Windows File Server – fully managed Windows-native (SMB) with Active Directory integration.
  • FSx for Lustre – high-performance parallel file system for HPC, ML training; integrates with S3.
  • FSx for NetApp ONTAP – multi-protocol (NFS, SMB, iSCSI) with NetApp features (SnapMirror, FlexClone).
  • FSx for OpenZFS – high-performance NFS with snapshots, cloning, and data compression.

When to Choose Which

  • Choose S3 – Unstructured data, backups, data lake, web assets, archive, serverless data processing.
  • Choose EBS – Database storage, single-instance applications requiring low-latency block I/O.
  • Choose EFS – Shared Linux file system, containers needing shared storage, Lambda file access.
  • Choose FSx for Windows – Windows applications, SMB shares, Active Directory integration.
  • Choose FSx for Lustre – HPC, ML training, video processing needing sub-ms latency with S3 integration.
  • Choose FSx for ONTAP – Multi-protocol access, hybrid cloud, applications needing NetApp features.

AWS Certification Exam Practice Questions

  1. A web application running on multiple EC2 instances across AZs needs shared access to uploaded user files. Which storage service is most appropriate?
    1. S3 with Mountpoint
    2. EBS Multi-Attach
    3. EFS
    4. FSx for OpenZFS
  2. A database workload requires consistent sub-millisecond latency with 64,000 IOPS on a single EC2 instance. Which storage should be used?
    1. EFS Max I/O mode
    2. S3 Express One Zone
    3. EBS io2 Block Express
    4. FSx for Lustre
  3. A company needs to migrate Windows file shares with Active Directory permissions to AWS. Which service maintains full compatibility?
    1. EFS
    2. S3
    3. FSx for OpenZFS
    4. FSx for Windows File Server
  4. An ML training job needs to process a 50TB dataset stored in S3 with the highest possible throughput. Which storage approach minimizes training time?
    1. Copy data to EBS gp3
    2. Access directly from S3
    3. FSx for Lustre linked to S3 bucket
    4. Copy to EFS

Related Posts

📖 Related: AWS S3 vs EBS vs EFS – Complete Storage Comparison Guide

References

Amazon S3 User Guide

Amazon EBS User Guide

Amazon EFS User Guide

Amazon FSx for Windows File Server User Guide

AWS Lambda vs Fargate vs App Runner

AWS Lambda vs Fargate vs App Runner

  • AWS offers multiple serverless/managed compute options for running application code without managing servers.
  • Lambda is for event-driven functions, Fargate is for containerized workloads, and App Runner is for web applications and APIs with zero configuration.
  • All three eliminate server management but differ in execution model, duration limits, and use cases.

Lambda vs Fargate vs App Runner Comparison

Feature Lambda Fargate App Runner
Execution Model Event-driven functions Long-running containers Always-running web service
Max Duration 15 minutes Unlimited Unlimited
Scale to Zero Yes (no charge when idle) No (minimum 1 task running) Yes (pause instances when no traffic)
Cold Start Yes (mitigated with Provisioned Concurrency) Container startup time (seconds) Minimal (keeps warm instances)
Memory 128MB – 10GB 512MB – 120GB 512MB – 12GB
vCPU Proportional to memory (up to 6 vCPU) 0.25 – 16 vCPU 0.25 – 4 vCPU
Deployment ZIP or container image Container image Source code (GitHub) or container image
Auto Scaling Automatic per-request concurrency Task-level with ECS/EKS Auto Scaling Automatic based on concurrent requests
Networking Optional VPC access Full VPC integration VPC Connector (optional)
Pricing Per request + per GB-second Per vCPU/hour + per GB/hour Per vCPU/hour + per GB/hour (pause charge lower)
Configuration Moderate (triggers, IAM, layers) High (task definitions, clusters, services) Minimal (source → running service)
Load Balancer Not needed (API Gateway or Function URL) ALB/NLB required Built-in (managed HTTPS endpoint)
Custom Runtime Yes (custom runtime or container) Any container Limited runtimes (Python, Node, Java, Go, .NET, Ruby) or container

AWS Lambda

  • Event-driven, function-as-a-service – runs code in response to events (S3, API Gateway, SQS, DynamoDB, etc.).
  • Scales automatically to thousands of concurrent executions per second.
  • Pay only for execution time – billed per millisecond with a generous free tier (1M requests/month).
  • 15-minute maximum execution – not suitable for long-running processes.
  • Supports Provisioned Concurrency to eliminate cold starts for latency-sensitive workloads.
  • Lambda@Edge and CloudFront Functions for edge computing.
  • Best for: event processing, API backends, data transformations, scheduled tasks, and glue logic.

AWS Fargate

  • Serverless compute for containers – runs Docker containers without managing EC2 instances.
  • Works with ECS or EKS as the orchestration layer.
  • No duration limit – suitable for long-running services, background workers, batch jobs.
  • Full VPC networking – each task gets its own ENI with security group control.
  • Supports persistent storage via EFS for shared file systems.
  • Fargate Spot for up to 70% savings on fault-tolerant workloads.
  • Best for: microservices, APIs needing persistent connections, background processing, and containerized applications.

AWS App Runner

  • Fully managed service – goes from source code or container to running web service in minutes.
  • Zero infrastructure configuration – no load balancer, no cluster, no task definition to manage.
  • Provides a managed HTTPS endpoint with automatic TLS certificate.
  • Auto-deploys from GitHub repository or ECR on code push.
  • Can pause instances when no traffic – lower cost than Fargate minimum.
  • VPC Connector for private resource access (RDS, ElastiCache, etc.).
  • Best for: web applications, REST APIs, and teams that want the simplest deployment experience.

When to Choose Which

  • Choose Lambda – Short-lived event processing (<15 min), API backends with variable traffic, integrations between AWS services, cost optimization for sporadic workloads.
  • Choose Fargate – Long-running containers, persistent connections (WebSocket, gRPC), complex multi-container applications, need full ECS/EKS ecosystem.
  • Choose App Runner – Simple web apps/APIs, want fastest time-to-deploy, team unfamiliar with containers/orchestration, predictable HTTP request-response workloads.

AWS Certification Exam Practice Questions

  1. A startup needs to deploy a REST API that handles unpredictable traffic spikes (0 to thousands of requests per second) and they want to pay nothing during idle periods. Which service is most cost-effective?
    1. App Runner
    2. Fargate with ECS
    3. Lambda with API Gateway
    4. EC2 with Auto Scaling
  2. A team needs to run a containerized web application that maintains WebSocket connections and requires persistent EFS storage. Which compute option supports this?
    1. Lambda
    2. Fargate with ECS
    3. App Runner
    4. Lambda with container image
  3. A developer wants to deploy a Python web application directly from a GitHub repository with automatic HTTPS, auto-scaling, and zero infrastructure management. Which service requires the least configuration?
    1. Lambda with API Gateway
    2. Fargate with ALB
    3. App Runner
    4. Elastic Beanstalk

Related Posts

References

AWS Lambda Developer Guide

AWS Fargate Documentation

AWS App Runner Developer Guide

AWS Aurora vs RDS – Performance & Cost Comparison

AWS Aurora vs RDS – MySQL & PostgreSQL

  • Both Amazon Aurora and Amazon RDS provide managed relational database services, but Aurora is AWS’s cloud-native redesign with significantly different architecture.
  • Aurora is compatible with MySQL and PostgreSQL but delivers up to 5x throughput of MySQL and 3x of PostgreSQL on the same hardware.
  • Choice depends on performance requirements, cost tolerance, and need for advanced features like global databases or serverless scaling.

Aurora vs RDS Comparison

Feature Amazon Aurora Amazon RDS (MySQL/PostgreSQL)
Architecture Cloud-native, distributed storage (6 copies across 3 AZs) Traditional architecture with EBS-based storage
Performance 5x MySQL, 3x PostgreSQL throughput Standard MySQL/PostgreSQL performance
Storage Auto-scales 10GB to 128TB, no pre-provisioning Provision up to 64TB (gp3/io1/io2)
Replication Up to 15 read replicas, millisecond lag Up to 15 read replicas, seconds to minutes lag
Failover <30 seconds (shared storage, no data sync needed) 60-120 seconds (Multi-AZ DNS failover)
Multi-AZ Built-in (storage spans 3 AZs by default) Synchronous standby in separate AZ
Global Database Yes – cross-region replication <1 second lag Cross-region read replicas (minutes lag)
Serverless Aurora Serverless v2 (scales to 0 ACU, instant scaling) Not available
Backtrack Yes – rewind DB to any point in seconds (MySQL only) Not available (use point-in-time restore)
Cloning Fast clone using copy-on-write (seconds, no storage cost initially) Snapshot restore (minutes to hours)
Blue/Green Deployments Yes Yes
Cost ~20-30% more than RDS for same instance size Lower base cost
I/O Cost Standard (pay per I/O) or I/O-Optimized (included) Included in storage (gp3) or provisioned (io1/io2)
Max Connections Higher (optimized connection handling) Based on instance memory
Engines MySQL-compatible, PostgreSQL-compatible only MySQL, PostgreSQL, MariaDB, Oracle, SQL Server

When to Choose Aurora

  • High availability is critical – built-in 6-way replication across 3 AZs, <30s failover.
  • Read-heavy workloads – up to 15 read replicas with millisecond replication lag.
  • Variable workloads – Aurora Serverless v2 scales compute automatically (even to zero).
  • Global applications – Aurora Global Database provides <1 second cross-region replication.
  • Development/testing – fast cloning creates copies in seconds without additional storage cost.
  • Need to undo mistakes quickly – Backtrack rewinds the database without restoring from backup.

When to Choose RDS

  • Cost-sensitive workloads – 20-30% cheaper for equivalent instance sizes.
  • Non-MySQL/PostgreSQL engines – need Oracle, SQL Server, or MariaDB.
  • Simple workloads – don’t need Aurora’s advanced features (global DB, serverless, cloning).
  • Lift-and-shift migrations – exact MySQL/PostgreSQL compatibility without Aurora-specific behavior.
  • Predictable I/O costs – gp3 storage includes I/O in the storage price.

AWS Certification Exam Practice Questions

  1. A company needs a database that automatically scales storage and provides sub-second failover with no data loss. Which service meets these requirements?
    1. RDS MySQL with Multi-AZ
    2. Amazon Aurora
    3. RDS PostgreSQL with read replicas
    4. DynamoDB
  2. A developer accidentally ran a DELETE query on a production Aurora MySQL database 5 minutes ago. What is the fastest recovery method?
    1. Restore from automated backup
    2. Point-in-time recovery
    3. Aurora Backtrack
    4. Promote a read replica
  3. A global application needs a relational database with cross-region read access and less than 1 second replication lag for disaster recovery. Which solution is appropriate?
    1. RDS with cross-region read replicas
    2. Aurora Global Database
    3. DynamoDB Global Tables
    4. RDS Multi-AZ with manual failover
  4. A startup has unpredictable traffic – sometimes zero users, sometimes thousands. They need a relational database that scales to zero during idle periods to minimize costs. What should they use?
    1. RDS with Scheduled Scaling
    2. Aurora Provisioned with Auto Scaling
    3. Aurora Serverless v2
    4. DynamoDB On-Demand

Related Posts

References

Amazon Aurora User Guide

Amazon RDS User Guide

ECS vs EKS vs Fargate – Container Services Compared

AWS ECS vs EKS vs Fargate – Container Services Compared

AWS offers three primary container services — Amazon ECS, Amazon EKS, and AWS Fargate — each solving container orchestration differently. Understanding the architecture, pricing, and operational trade-offs is essential for the AWS Solutions Architect and DevOps certification exams and for making real-world architectural decisions. This comprehensive comparison covers architecture differences, use cases, pricing models, scaling, networking, security, monitoring, and guidance on when to choose each service.

Quick Overview

  • Amazon ECS (Elastic Container Service) — AWS-native container orchestration service with zero control plane cost. Tightly integrated with AWS services. Uses Task Definitions to define containers.
  • Amazon EKS (Elastic Kubernetes Service) — Managed Kubernetes service running upstream, CNCF-conformant Kubernetes. Provides full Kubernetes API compatibility and ecosystem access.
  • AWS Fargate — Serverless compute engine for containers (not an orchestrator). Works as a launch type for both ECS and EKS, eliminating node/instance management.

Key distinction: ECS and EKS are orchestrators (they schedule and manage containers). Fargate is a compute engine (it runs the containers). You choose ECS or EKS as your orchestrator, then choose Fargate or EC2 as your compute layer.

Architecture Differences

Amazon ECS Architecture

  • AWS-proprietary orchestration engine — not based on Kubernetes.
  • ClusterServiceTaskContainer hierarchy.
  • Task Definition — JSON blueprint specifying container images, CPU/memory, networking mode, volumes, and IAM roles.
  • Service — Maintains desired count of tasks, handles rolling deployments, integrates with load balancers.
  • Capacity Providers — Abstract compute capacity (Fargate, Fargate Spot, EC2 Auto Scaling Groups).
  • ECS Agent — Runs on EC2 instances (EC2 launch type) to communicate with the ECS control plane.
  • ECS Express Mode (GA Nov 2025) — Simplifies deployment to just a container image + two IAM roles. Automatically provisions ALB, auto scaling, networking, and monitoring with best-practice defaults.
  • ECS Service Connect — Built-in service mesh providing service discovery, traffic management, and observability without sidecar configuration.
  • Control plane is fully managed and free — no cluster fee.

Amazon EKS Architecture

  • Runs upstream, unmodified Kubernetes — passes CNCF conformance tests.
  • Control Plane — AWS-managed (etcd, API server, scheduler, controller-manager) across 3 AZs. Costs $0.10/hour ($73/month).
  • Data Plane options:
    • Managed Node Groups — AWS provisions and manages EC2 instances; you control instance types and scaling.
    • Self-Managed Nodes — Full control over EC2 instances (custom AMIs, GPU, Windows).
    • Fargate — Serverless pods; each pod runs in its own micro-VM.
    • EKS Auto Mode (GA Dec 2024) — Fully automates compute, storage, and networking. Selects optimal instances, scales dynamically, patches OS, manages add-ons.
  • Full Kubernetes ecosystem: Helm charts, Operators, CRDs, service meshes (Istio, Linkerd), GitOps (ArgoCD, Flux).
  • EKS Pod Identity — Simplified IAM integration for pods (replaces IRSA complexity).
  • Extended Support — Run older K8s versions for 12 extra months at $0.60/cluster/hour.

AWS Fargate Architecture

  • Serverless compute engine — AWS manages all underlying infrastructure (no EC2 instances to provision, patch, or scale).
  • Each task (ECS) or pod (EKS) runs in an isolated Firecracker micro-VM — hardware-level isolation between tenants.
  • You specify vCPU and memory per task/pod; Fargate provisions exactly that capacity.
  • Supports Linux and Windows containers (Windows on ECS Fargate GA).
  • Ephemeral storage: 20 GB free, expandable to 200 GB.
  • No SSH/exec into underlying host — container-level access only.
  • Integrates with both ECS and EKS as a capacity provider / Fargate profile.

Detailed Comparison Table

Feature Amazon ECS Amazon EKS AWS Fargate
Type Container orchestrator Container orchestrator (Kubernetes) Serverless compute engine
Control Plane Cost Free ($0) $0.10/hour (~$73/month per cluster) N/A (uses ECS or EKS control plane)
Compute Pricing EC2 instance costs or Fargate per-task pricing EC2 instance costs, Fargate, or EKS Auto Mode $0.04048/vCPU-hour + $0.004445/GB-hour
Kubernetes Compatible No (AWS-proprietary) Yes (CNCF-conformant upstream K8s) N/A (compute layer)
Multi-Cloud Portability No (AWS only) Yes (K8s workloads portable to GKE, AKS, on-premises) No (AWS only)
Learning Curve Low — simpler concepts High — requires Kubernetes expertise Lowest — no infrastructure to manage
Scaling ECS Service Auto Scaling (target tracking, step, scheduled, predictive) HPA, VPA, Karpenter, Cluster Autoscaler, EKS Auto Mode Automatic — scales with task/pod count
Cold Start Minimal (EC2), ~30-60s (Fargate) Minimal (EC2/Auto Mode), ~60-90s (Fargate) 30-90 seconds per task/pod
Networking awsvpc (ENI per task), bridge, host modes VPC CNI (ENI per pod), Calico, Cilium awsvpc only (ENI per task/pod)
Service Mesh ECS Service Connect (built-in) Istio, Linkerd, VPC Lattice Inherits from ECS/EKS
IAM Integration Task Roles (per task), Execution Roles EKS Pod Identity, IRSA Same as ECS/EKS (Task Roles or Pod Identity)
Monitoring CloudWatch Container Insights, X-Ray CloudWatch, Prometheus, Grafana, Datadog CloudWatch Container Insights
Deployment Strategies Rolling, Blue/Green (CodeDeploy), Canary (Express Mode) Rolling, Blue/Green, Canary (Argo Rollouts, Flagger) Inherits from ECS/EKS
GPU Support Yes (EC2 launch type) Yes (EC2, Auto Mode) No
Windows Containers Yes (EC2 and Fargate) Yes (EC2 managed node groups) Yes (ECS on Fargate only)
Spot/Savings Fargate Spot (up to 70% off), EC2 Spot EC2 Spot (Karpenter), Savings Plans Fargate Spot (up to 70% off), Compute Savings Plans (up to 52%)
Ecosystem AWS-native integrations Full CNCF/K8s ecosystem (Helm, Operators, CRDs) N/A (compute layer)

Pricing Models

Amazon ECS Pricing

  • Control plane: Free — no charge for using ECS itself.
  • EC2 launch type: Pay standard EC2 pricing for instances in your cluster. You manage capacity and utilization.
  • Fargate launch type: Pay per-task based on vCPU and memory requested (see Fargate pricing below).
  • Cost optimization: Use Capacity Providers with managed scaling for EC2; mix Fargate and Fargate Spot for serverless workloads.

Amazon EKS Pricing

  • Control plane: $0.10/hour per cluster (~$73/month) — standard support.
  • Extended support: $0.60/hour per cluster for Kubernetes versions past end-of-standard-support.
  • EKS Auto Mode: Compute charged per second (EC2 equivalent rates) with automatic instance selection and consolidation. Additional $0.10/hour cluster fee applies.
  • Data plane (EC2): Standard EC2 instance pricing. Use Karpenter + Spot for 60-90% savings.
  • Data plane (Fargate): Same Fargate per-pod pricing as ECS + cluster fee overhead.
  • EKS Anywhere: $24,000/cluster/year (1-year) or $18,000/cluster/year (3-year) for on-premises.

AWS Fargate Pricing

  • On-Demand: $0.04048 per vCPU per hour + $0.004445 per GB memory per hour (US East).
  • Fargate Spot: Up to 70% discount; tasks can be interrupted with 30-second warning.
  • Compute Savings Plans: Up to 52% discount with 1-year or 3-year commitment (applies to Fargate and EC2).
  • Ephemeral storage: $0.000111 per GB per hour beyond the free 20 GB.
  • Billing granularity: Per-second with 1-minute minimum.
  • Cost example: A task with 1 vCPU + 2 GB memory running 24/7 costs ~$36/month (On-Demand).

Scaling Approaches

ECS Scaling

  • Service Auto Scaling — Target tracking (CPU/memory utilization), step scaling, scheduled scaling, and predictive scaling (uses ML to anticipate traffic patterns).
  • Cluster Auto Scaling — Capacity Providers automatically add/remove EC2 instances based on pending task demand.
  • High-resolution metrics (2026) — 10-second granularity metrics enable faster scaling decisions.
  • Scales from 0 tasks (with scheduled scaling or EventBridge triggers).

EKS Scaling

  • Horizontal Pod Autoscaler (HPA) — Scales pod count based on CPU, memory, or custom metrics.
  • Vertical Pod Autoscaler (VPA) — Adjusts resource requests/limits per pod.
  • Karpenter — Fast, intelligent node provisioning (provisions right-sized instances in seconds, consolidates underutilized nodes).
  • EKS Auto Mode — Combines Karpenter-like provisioning with AWS-managed lifecycle. Automatic consolidation, Spot diversification, and right-sizing.
  • KEDA — Event-driven autoscaling (scale on queue depth, custom metrics, etc.).

Fargate Scaling

  • No node scaling needed — capacity is provisioned per task/pod automatically.
  • Scaling is limited by task/pod launch speed (30-90 seconds cold start).
  • For rapid scaling, pre-warm with minimum task counts or use EC2 launch type.
  • Account-level Fargate quotas may limit burst scaling (default 500 on-demand tasks per region).

Networking

ECS Networking

  • awsvpc mode (recommended) — Each task gets its own ENI with a private IP in your VPC. Full security group control per task.
  • bridge mode — Docker bridge networking; multiple tasks share the host’s ENI. Port mapping required.
  • host mode — Tasks use the host’s network namespace directly. Best performance, no port mapping isolation.
  • ECS Service Connect — Managed service mesh providing DNS-based service discovery, load balancing, retries, and circuit breaking between ECS services.
  • Load balancing: ALB, NLB integration with dynamic port mapping. Express Mode auto-provisions ALB with HTTPS.

EKS Networking

  • Amazon VPC CNI plugin — Each pod gets a real VPC IP address (ENI-attached). Enables direct pod-to-pod and pod-to-AWS-service communication without overlay networks.
  • Prefix delegation — Assigns /28 prefixes to ENIs for higher pod density per node.
  • Network Policies — Enforce pod-to-pod traffic rules (Calico, Cilium, or VPC CNI network policy).
  • Service types: ClusterIP, NodePort, LoadBalancer (ALB/NLB via AWS Load Balancer Controller).
  • Ingress: AWS ALB Ingress Controller, Nginx, Traefik, Istio Gateway.
  • VPC Lattice — Application-layer service-to-service networking across VPCs and accounts.

Fargate Networking

  • Always uses awsvpc mode — each task/pod gets its own ENI.
  • Each Fargate task runs in an isolated environment; no shared networking with other tasks.
  • Security groups are applied at the task/pod level for fine-grained control.
  • Supports VPC endpoints (PrivateLink) for private connectivity to AWS services.
  • No public IP by default — use NAT Gateway or VPC endpoints for outbound internet access.

Security

ECS Security

  • Task IAM Roles — Fine-grained permissions per task (each task assumes its own IAM role).
  • Task Execution Role — Permissions for the ECS agent to pull images and write logs.
  • Security Groups — Per-task network isolation (awsvpc mode).
  • Secrets Management — Native integration with AWS Secrets Manager and SSM Parameter Store (injected as environment variables).
  • Image scanning — Amazon ECR image scanning (Basic + Enhanced with Inspector).
  • Runtime monitoring — Amazon GuardDuty Runtime Monitoring for ECS detects container-level threats.

EKS Security

  • EKS Pod Identity (recommended) — Simplified IAM role assignment per pod without OIDC provider complexity.
  • IRSA (IAM Roles for Service Accounts) — Legacy approach using OIDC federation.
  • Kubernetes RBAC — Fine-grained access control within the cluster (roles, cluster roles, bindings).
  • Network Policies — Pod-level firewall rules (deny-all by default with explicit allows).
  • Pod Security Standards — Enforce baseline or restricted security profiles (replaced PodSecurityPolicies).
  • Secrets encryption — KMS envelope encryption for etcd secrets.
  • GuardDuty EKS Protection — Monitors control plane audit logs and runtime behavior for threats.
  • EKS Auto Mode security — Automated OS patching, locked-down node configuration, managed security groups.

Fargate Security

  • Micro-VM isolation — Each task/pod runs in a dedicated Firecracker micro-VM. Strongest isolation model (hardware-level).
  • No host access — Cannot SSH into underlying infrastructure; eliminates node-level attack surface.
  • Automated patching — AWS manages the underlying kernel and runtime; no OS patching burden.
  • Ephemeral — No persistent host means no long-lived compromised instances.
  • Compliance: SOC, PCI, HIPAA, ISO eligible. Fargate’s isolation model simplifies compliance boundary definition.

Monitoring and Observability

  • ECS: CloudWatch Container Insights (CPU, memory, network, storage metrics per task/service/cluster), AWS X-Ray for distributed tracing, CloudWatch Logs (awslogs driver), ECS Service Connect metrics for service-to-service observability.
  • EKS: CloudWatch Container Insights (with enhanced observability for EKS), Amazon Managed Prometheus + Amazon Managed Grafana (CNCF-native stack), Kubernetes Metrics Server (HPA), OpenTelemetry Collector, third-party tools (Datadog, New Relic, Dynatrace via operators).
  • Fargate: CloudWatch Container Insights, CloudWatch Logs (built-in log router using Fluent Bit — no sidecar needed on ECS; sidecar required on EKS). No host-level metrics (by design). FireLens for advanced log routing.

When to Choose Each — Decision Guidance

Choose Amazon ECS When:

  • Your team is AWS-centric and does not need Kubernetes portability.
  • You want the simplest container orchestration with zero control plane cost.
  • You have fewer than ~15 microservices and want fast time-to-production.
  • You want deep, native AWS integrations without plugins or add-ons.
  • Budget is constrained — $0/month for orchestration vs $73/month for EKS.
  • You want ECS Express Mode for near-instant production deployments.
  • Team does not have Kubernetes expertise and hiring/training isn’t justified.

Choose Amazon EKS When:

  • Your organization has existing Kubernetes expertise or CNCF tooling investments.
  • You need multi-cloud or hybrid portability — workloads must run on AWS, GCP, Azure, or on-premises.
  • You need the full Kubernetes ecosystem — Helm, Operators, CRDs, Istio, ArgoCD, Crossplane.
  • You’re running complex, large-scale microservices (50+ services) requiring advanced traffic management.
  • You need custom controllers or want to extend the platform with CRDs.
  • You have regulatory requirements mandating Kubernetes (some compliance frameworks specifically audit K8s).
  • Consider EKS Auto Mode to get Kubernetes benefits with significantly reduced operational overhead.

Choose AWS Fargate When:

  • You want to eliminate infrastructure management completely — no patching, no capacity planning, no node scaling.
  • Workloads are bursty or unpredictable — pay only for actual compute consumed.
  • Running batch jobs, scheduled tasks, or short-lived workloads where provisioning instances is wasteful.
  • Team is small and operational overhead must be minimized.
  • You need the strongest isolation model (micro-VM per task) for compliance or security.
  • Not ideal for: GPU workloads, extremely cost-sensitive steady-state workloads (EC2 is cheaper at high utilization), or latency-sensitive apps that cannot tolerate 30-90s cold starts.

Decision Flowchart

START → Do you need Kubernetes API/ecosystem?

  ├── YES → Do you want AWS to manage nodes?

  │   ├── YES, fullyEKS + Fargate (serverless pods)

  │   ├── YES, mostlyEKS Auto Mode (automated EC2 lifecycle)

  │   └── NO, I want controlEKS + Managed Node Groups (+ Karpenter)

  └── NO → Do you want to manage EC2 instances?

      ├── NOECS + Fargate (simplest serverless containers)

      └── YES (cost optimization/GPU) → ECS + EC2 (maximum cost control)

Common Use Cases

Use Case Recommended Service Reason
Small team, 3-10 microservices, AWS only ECS + Fargate Zero ops overhead, no control plane cost, fast deployment
Large platform team, 50+ services, multi-cloud EKS + Managed Node Groups Full K8s ecosystem, portability, advanced orchestration
ML/AI training with GPU requirements EKS + EC2 (GPU instances) GPU support, Karpenter for mixed instance scheduling
Batch processing / ETL jobs ECS + Fargate Spot Pay only during execution, up to 70% savings with Spot
Kubernetes migration from on-premises EKS (+ EKS Anywhere for hybrid) Compatible K8s API, reuse existing manifests/Helm charts
Startup prototyping / MVP deployment ECS Express Mode Container image → production in seconds, zero config
Compliance-heavy regulated workloads ECS/EKS + Fargate Micro-VM isolation simplifies compliance boundary
Cost-optimized steady-state workloads ECS/EKS + EC2 Spot + Savings Plans Up to 90% savings vs Fargate On-Demand

AWS Certification Exam Tips

  • SAA-C03 / SAP-C02: Understand that Fargate is a launch type (not an orchestrator). Know when ECS vs EKS is appropriate based on portability and complexity requirements.
  • DevOps Professional (DOP-C02): Know ECS deployment strategies (rolling, blue/green with CodeDeploy) and EKS deployment approaches (ArgoCD, Flux, Argo Rollouts).
  • Specialty certifications: Security questions often test Fargate’s isolation model and task role permissions.
  • Exam questions asking about “simplest” or “least operational overhead” typically point to Fargate. Questions about “portability” or “Kubernetes” point to EKS.
  • If a question mentions cost-conscious steady-state workloads, EC2 launch type with Spot is typically the answer over Fargate.

Practice Questions

Question 1

A company is migrating a containerized application to AWS. The development team has Kubernetes expertise and uses Helm charts and Argo CD for deployments. They require the ability to run the same workloads on Azure in the future for disaster recovery. Which solution meets these requirements?

  1. Amazon ECS with Fargate launch type
  2. Amazon EKS with managed node groups
  3. Amazon ECS with EC2 launch type
  4. AWS Lambda with container image support
Show Answer

Answer: B – Amazon EKS runs upstream Kubernetes, providing compatibility with Helm, ArgoCD, and portability to other Kubernetes platforms (AKS on Azure). ECS is AWS-proprietary and not portable.

Question 2

A startup needs to deploy a containerized web application with minimal operational overhead. The team has no Kubernetes experience and wants to avoid managing any infrastructure. The application has unpredictable traffic patterns. Which architecture is MOST suitable?

  1. Amazon EKS with self-managed node groups
  2. Amazon ECS with EC2 launch type and Cluster Auto Scaling
  3. Amazon ECS with Fargate launch type
  4. Amazon EKS with Fargate profiles
Show Answer

Answer: C – ECS + Fargate provides the simplest container deployment with no infrastructure management, no K8s expertise required, and automatic scaling for unpredictable traffic. EKS adds unnecessary complexity for a team without Kubernetes skills.

Question 3

A company runs 200 microservices on Amazon EKS. They want to reduce the operational burden of managing EC2 instances, patching AMIs, and handling node scaling — while maintaining full Kubernetes API compatibility and access to Helm and custom controllers. Which approach should they use?

  1. Migrate all services to Amazon ECS with Fargate
  2. Use EKS Auto Mode
  3. Use EKS with Fargate profiles for all pods
  4. Use EKS with self-managed nodes and Systems Manager for patching
Show Answer

Answer: B – EKS Auto Mode automates compute provisioning, scaling, OS patching, and cost optimization while maintaining full Kubernetes API compatibility including Helm and custom controllers. Fargate profiles would limit functionality (no DaemonSets, limited storage), and ECS migration loses Kubernetes ecosystem benefits.

Question 4

A financial services company must run containers in an environment where each workload is isolated at the hardware level for regulatory compliance. They need the STRONGEST isolation between containers. Which compute option provides this?

  1. ECS with EC2 launch type using Docker bridge networking
  2. EKS with managed node groups and Pod Security Standards
  3. ECS or EKS with AWS Fargate
  4. EKS with self-managed nodes and gVisor runtime
Show Answer

Answer: C – AWS Fargate runs each task/pod in a dedicated Firecracker micro-VM, providing hardware-level isolation between workloads. This is the strongest isolation model available, stronger than container-level isolation on shared EC2 instances.

Question 5

A company runs steady-state containerized workloads (constant 80% CPU utilization, 24/7) on AWS. They want to minimize container compute costs. The workloads are fault-tolerant and can handle interruptions. Which combination provides the LOWEST cost?

  1. ECS with Fargate Spot
  2. ECS with EC2 Spot Instances and Compute Savings Plans
  3. EKS with Fargate and Compute Savings Plans
  4. ECS with Fargate On-Demand and Compute Savings Plans
Show Answer

Answer: B – For steady-state, high-utilization, fault-tolerant workloads, EC2 Spot instances provide the lowest per-unit compute cost (up to 90% off On-Demand). Combining with Savings Plans for the baseline provides additional savings. Fargate carries a ~3x premium over well-utilized EC2 Spot instances.

Frequently Asked Questions

What is the difference between ECS and EKS?

ECS is AWS’s proprietary container orchestration service that’s simpler to set up, while EKS is a managed Kubernetes service offering full Kubernetes API compatibility and portability across clouds.

When should I use Fargate vs EC2 launch type?

Use Fargate for serverless workloads where you don’t want to manage infrastructure, and EC2 launch type when you need GPU instances, greater cost control, or specific instance types.

Is EKS more expensive than ECS?

EKS charges $0.10/hour per cluster ($73/month) for the control plane plus compute costs, while ECS has no control plane fee. However, total cost depends on workload size and whether you use Fargate or EC2.

References

AWS SQS vs SNS vs EventBridge

AWS SQS vs SNS vs EventBridge

  • AWS provides multiple messaging and event-driven services for decoupling application components.
  • SQS is a message queue for point-to-point communication, SNS is a pub/sub notification service, and EventBridge is a serverless event bus for event-driven architectures.
  • These services are often used together but serve different purposes.

SQS vs SNS vs EventBridge Comparison

Feature SQS SNS EventBridge
Pattern Queue (point-to-point) Pub/Sub (fan-out) Event Bus (event-driven)
Delivery Pull-based (consumers poll) Push-based (pushes to subscribers) Push-based (routes to targets)
Consumers Single consumer per message Multiple subscribers Multiple targets per rule
Filtering No native filtering Message attribute filtering Content-based filtering (event patterns)
Retention 1 min to 14 days (default 4 days) No retention (immediate delivery) No retention (replay via archive up to indefinite)
Ordering FIFO queue guarantees order FIFO topic with SQS FIFO No ordering guarantee
Throughput Standard: unlimited; FIFO: 3,000 msg/sec (batching) Standard: unlimited; FIFO: 300 msg/sec Default: varies by region, scalable
Dead Letter Queue Yes Yes (for failed deliveries) Yes (DLQ on target failures)
Targets/Subscribers Consumer applications SQS, Lambda, HTTP/S, Email, SMS, Kinesis Firehose 200+ AWS services, APIs, SaaS apps
Event Sources Producers send messages Producers publish messages 90+ AWS services, custom apps, SaaS partners
Schema No schema enforcement No schema enforcement Schema Registry with discovery
Replay No (message deleted after processing) No Yes (Event Archive and Replay)
Cross-account Yes (resource policy) Yes (resource policy) Yes (cross-account event bus)
Scheduling Delay queues (up to 15 min) No Yes (EventBridge Scheduler)

Amazon SQS – Simple Queue Service

  • Fully managed message queue for decoupling producers from consumers.
  • Standard Queue – at-least-once delivery, best-effort ordering, unlimited throughput.
  • FIFO Queue – exactly-once processing, strict ordering, up to 3,000 msg/sec with batching.
  • Messages are retained up to 14 days – acts as a buffer for traffic spikes.
  • Supports visibility timeout to prevent multiple consumers processing the same message.
  • Supports long polling to reduce empty receives and costs.
  • Dead Letter Queue (DLQ) for messages that fail processing after max retries.
  • Integrates natively with Lambda (event source mapping) for serverless processing.

Amazon SNS – Simple Notification Service

  • Fully managed pub/sub service for fan-out messaging to multiple subscribers.
  • A single message published to a topic is delivered to all subscribers simultaneously.
  • Supports multiple protocols – SQS, Lambda, HTTP/S, Email, SMS, Kinesis Data Firehose, mobile push.
  • Message filtering – subscribers can set filter policies on message attributes to receive only relevant messages.
  • FIFO topics – strict ordering and deduplication when paired with SQS FIFO queues.
  • Fan-out pattern – SNS + multiple SQS queues for parallel processing of the same event.
  • Supports message encryption (SSE-KMS) and cross-account subscriptions.

Amazon EventBridge

  • Serverless event bus for building event-driven architectures at scale.
  • Receives events from 90+ AWS services automatically (no configuration needed).
  • Content-based filtering with event patterns – filter on any field in the event JSON body.
  • Routes events to 200+ AWS service targets including Lambda, Step Functions, API Gateway, SQS, SNS.
  • Schema Registry – automatically discovers and stores event schemas for code generation.
  • Event Archive and Replay – store events indefinitely and replay them for debugging or reprocessing.
  • EventBridge Scheduler – create one-time or recurring schedules (replaces CloudWatch Events cron).
  • EventBridge Pipes – point-to-point integration between sources and targets with filtering, enrichment, and transformation.
  • SaaS partner integrations – receive events from Zendesk, Datadog, Auth0, Shopify, etc.
  • Global endpoints – automatic failover to a secondary region for high availability.

When to Choose Which

  • Choose SQS – Decouple a producer from a single consumer, buffer traffic spikes, guarantee message processing with retries, maintain message ordering (FIFO).
  • Choose SNS – Fan-out a message to multiple subscribers simultaneously, send notifications (email/SMS), simple pub/sub without complex routing.
  • Choose EventBridge – React to AWS service events, route events based on content to different targets, integrate with SaaS applications, need schema discovery, event replay, or scheduling.
  • Combine SNS + SQS – Fan-out pattern where each subscriber needs independent processing with buffering and retry.
  • Combine EventBridge + SQS – Route events to SQS for buffered, reliable processing with backpressure handling.

AWS Certification Exam Practice Questions

  1. A company needs to process orders where each order must be processed exactly once and in the order received. Which service and configuration is most appropriate?
    1. SNS Standard topic
    2. SQS FIFO queue
    3. EventBridge with ordering
    4. SQS Standard queue
  2. An application needs to fan out a single event to three different microservices for parallel processing, each requiring independent retry logic. Which architecture is recommended?
    1. EventBridge with three targets
    2. SQS with three consumers
    3. SNS topic with three SQS queue subscriptions
    4. Three separate SQS queues with direct publishing
  3. A team needs to automatically trigger a Lambda function whenever an S3 object is created, an EC2 instance changes state, or a CodePipeline deployment fails. Which service requires the least configuration?
    1. SNS with S3 event notifications
    2. SQS with CloudWatch Events
    3. EventBridge (receives AWS events automatically)
    4. Lambda with direct triggers
  4. A SaaS application needs to react to events from Shopify and route them to different Lambda functions based on the event type (order_created vs order_cancelled). Which service is best suited?
    1. SNS with message filtering
    2. SQS with message attributes
    3. EventBridge with event pattern rules
    4. API Gateway with Lambda
  5. After a production incident, a team needs to replay all events from the past 7 days to reprocess failed orders. Which service supports this natively?
    1. SQS (messages already consumed)
    2. SNS (no retention)
    3. EventBridge (Archive and Replay)
    4. Kinesis Data Streams

Related Posts

References

Amazon SQS Developer Guide

Amazon SNS Developer Guide

Amazon EventBridge User Guide

AWS ELB – ALB vs NLB vs GWLB Comparison

📌 Updated & Expanded: This topic has been significantly expanded with advanced patterns, exam questions, and decision matrices. See the complete guide:

ALB vs NLB vs GWLB – Load Balancer Advanced Decision Guide →

AWS ELB – ALB vs NLB vs GWLB

  • AWS Elastic Load Balancing (ELB) automatically distributes incoming application traffic across multiple targets.
  • AWS offers four types of load balancers: Application Load Balancer (ALB), Network Load Balancer (NLB), Gateway Load Balancer (GWLB), and Classic Load Balancer (CLB – deprecated).
  • Choosing the right load balancer depends on the use case – Layer 7 routing, ultra-low latency, or third-party appliance integration.

ALB vs NLB vs GWLB Comparison

Feature ALB NLB GWLB
OSI Layer Layer 7 (HTTP/HTTPS) Layer 4 (TCP/UDP/TLS) Layer 3 (IP)
Use Case Web apps, microservices, content-based routing Ultra-low latency, static IP, TCP/UDP traffic Third-party virtual appliances (firewalls, IDS/IPS)
Routing Host, path, header, query string, HTTP method, source IP Port-based Transparent (GENEVE encapsulation)
Performance Handles millions of requests/sec Millions of requests/sec with ultra-low latency High throughput for appliance traffic
Static IP No (use Global Accelerator for fixed IPs) Yes (one static IP per AZ, Elastic IP supported) No
Preserve Source IP Via X-Forwarded-For header Yes (natively preserved) Yes (GENEVE encapsulation)
SSL/TLS Termination Yes Yes (TLS listener) No
WebSocket Yes Yes No
Target Types Instance, IP, Lambda Instance, IP, ALB Instance, IP
Health Checks HTTP, HTTPS TCP, HTTP, HTTPS TCP, HTTP, HTTPS
Cross-zone LB Enabled by default Disabled by default Disabled by default
Sticky Sessions Yes (cookie-based) Yes (source IP based) Yes (5-tuple/3-tuple/2-tuple)
PrivateLink Support No Yes Yes (via GWLB endpoints)
Mutual TLS (mTLS) Yes No No

Application Load Balancer – ALB

  • Operates at Layer 7 (HTTP/HTTPS) and is best suited for web applications.
  • Supports content-based routing – routes requests based on URL path, host header, HTTP headers, query strings, HTTP method, and source IP.
  • Supports multiple target groups per listener with weighted routing for blue/green and canary deployments.
  • Native integration with AWS WAF for web application security.
  • Supports authentication – integrates with Amazon Cognito and OIDC-compliant identity providers.
  • Supports Lambda functions as targets for serverless architectures.
  • Provides detailed access logs and integration with CloudWatch metrics.
  • Supports HTTP/2 and gRPC protocols.
  • Supports mutual TLS (mTLS) for client certificate authentication.
  • Supports fixed response actions and redirect actions at the listener level.

Network Load Balancer – NLB

  • Operates at Layer 4 (TCP/UDP/TLS) and handles millions of requests per second with ultra-low latency.
  • Provides a static IP address per Availability Zone and supports Elastic IP assignment.
  • Preserves source IP natively – no X-Forwarded-For header needed for TCP traffic.
  • Supports AWS PrivateLink – expose services to other VPCs or AWS accounts privately.
  • Can target ALB as a target – combines NLB’s static IP with ALB’s Layer 7 routing.
  • Supports TLS termination and centralized certificate management via ACM.
  • Handles volatile workloads and sudden traffic spikes without pre-warming.
  • Supports long-lived TCP connections – ideal for IoT, gaming, and real-time applications.
  • Supports UDP for DNS, SIP, and IoT protocols.
  • Cross-zone load balancing disabled by default – enable for even distribution across AZs.

Gateway Load Balancer – GWLB

  • Operates at Layer 3 (IP packets) using GENEVE protocol for transparent network traffic inspection.
  • Designed for deploying third-party virtual appliances – firewalls, IDS/IPS, deep packet inspection.
  • Creates a single entry/exit point for all traffic using Gateway Load Balancer Endpoints (GWLBe).
  • Traffic is transparently routed through appliances – source and destination IPs preserved.
  • Uses 5-tuple flow stickiness (source IP, dest IP, protocol, source port, dest port) by default.
  • Scales horizontally – automatically distributes traffic across multiple appliance instances.
  • Supports cross-VPC inspection via AWS PrivateLink (GWLBe in service consumer VPC).
  • Integrates with AWS Marketplace appliances from vendors like Palo Alto, Fortinet, Check Point.

When to Choose Which

  • Choose ALB – Web applications, microservices needing URL-based routing, gRPC, Lambda targets, OIDC authentication, WAF integration.
  • Choose NLB – TCP/UDP applications requiring ultra-low latency, static IPs, PrivateLink exposure, gaming/IoT, volatile traffic patterns.
  • Choose GWLB – Network traffic inspection via third-party appliances, centralized firewall deployments, compliance-driven packet inspection.
  • Combine NLB + ALB – When you need both static IPs (NLB) and content-based routing (ALB), use NLB with ALB as a target.

AWS Certification Exam Practice Questions

  1. A company needs to expose a microservices application that routes traffic based on URL paths and requires integration with AWS WAF. Which load balancer should they use?
    1. Network Load Balancer
    2. Application Load Balancer
    3. Gateway Load Balancer
    4. Classic Load Balancer
  2. An application requires a static IP address for whitelisting by partner organizations while maintaining ultra-low latency for TCP traffic. Which load balancer is most appropriate?
    1. Application Load Balancer with Global Accelerator
    2. Network Load Balancer
    3. Gateway Load Balancer
    4. Classic Load Balancer
  3. A security team needs to route all VPC traffic through a centralized fleet of third-party firewall appliances for deep packet inspection. Which AWS service should they use?
    1. Network Load Balancer
    2. AWS Network Firewall
    3. Gateway Load Balancer
    4. Application Load Balancer with AWS WAF
  4. A company needs to provide a service to multiple AWS accounts privately, with clients connecting using a static IP. Which combination is required?
    1. ALB + VPC Peering
    2. NLB + AWS PrivateLink
    3. GWLB + Transit Gateway
    4. ALB + Global Accelerator
  5. An architect needs to implement a blue/green deployment strategy with weighted routing between two versions of an application. Which load balancer feature supports this?
    1. NLB with multiple target groups
    2. ALB with weighted target groups
    3. GWLB with flow stickiness
    4. NLB with cross-zone load balancing

Related Posts

📖 Related: AWS Auto Scaling with ELB – Integration Guide

References

AWS Elastic Load Balancing User Guide

AWS ELB Features Comparison

Amazon DynamoDB Backup and Restore

DynamoDB Backup and Restore

  • DynamoDB Backup and Restore provides fully automated on-demand backup, restore, and point-in-time recovery for data protection and archiving.
  • On-demand backup allows the creation of full backups of DynamoDB table for data archiving, helping you meet corporate and governmental regulatory requirements.
  • Point-in-time recovery (PITR) provides continuous backups of your DynamoDB table data with per-second granularity.
  • All backups are automatically encrypted, cataloged, and easily discoverable.
  • Backups can be created for tables from a few megabytes to hundreds of terabytes of data, with no impact on performance and availability of production applications.

On-demand Backups

  • DynamoDB on-demand backup helps create full backups of the tables for long-term retention, and archiving for regulatory compliance needs.
  • On-demand backups create a snapshot of the table that DynamoDB stores and manages.
  • Backup and restore actions run with no impact on table performance or availability.
  • Backups process in seconds regardless of the size of the tables.
  • Backups are preserved regardless of table deletion and retained until they are explicitly deleted.
  • On-demand backups are cataloged, and discoverable.
  • Charged based on the size and duration of the backups.
  • Can restore the entire DynamoDB table to the exact state it was in when the backup was created.

Creating On-demand Backups

  • On-demand backups can be created using two methods:

DynamoDB Native Backup

  • Can be used to backup and restore DynamoDB tables.
  • Create backups via AWS Management Console, AWS CLI, or API.
  • Limitation: DynamoDB on-demand backups cannot be copied to a different account or Region.
  • Suitable for simple backup and restore within the same account and region.

AWS Backup (Recommended)

  • AWS Backup is a fully managed data protection service that makes it easy to centralize and automate backups across AWS services, in the cloud, and on-premises.
  • Provides enhanced backup features beyond native DynamoDB backups.
  • Key Advantages:
    • Centralized Management: Configure backup schedules & policies and monitor activity for AWS resources and on-premises workloads in one place.
    • Cross-Region Backup: Copy on-demand backups across AWS Regions.
    • Cross-Account Backup: Copy on-demand backups across AWS accounts (requires enabling advanced features).
    • Independent Encryption: Encryption using an AWS KMS key that is independent of the DynamoDB table encryption key.
    • Vault Lock (WORM): Apply write-once-read-many (WORM) setting for backups using AWS Backup Vault Lock policy for compliance.
    • Cost Allocation Tags: Add cost allocation tags to on-demand backups for better cost tracking.
    • Cold Storage Tier: Transition on-demand backups to cold storage for lower costs (requires opting in to advanced features).
    • Automated Backup Plans: Create scheduled backup plans with retention policies.

Cross-Region and Cross-Account Restore

  • DynamoDB table data can be restored across AWS Regions such that the restored table is created in a different Region from where the source table resides.
  • Cross-Region restores are supported between:
    • AWS commercial Regions
    • AWS China Regions
    • AWS GovCloud (US) Regions
  • Cross-Account Backup and Restore: Using AWS Backup, backups can be copied across AWS accounts for disaster recovery or data migration scenarios.
  • Pricing: Pay for data transfer out of the source Region and for restoring to a new table in the destination Region.

PITR – Point-In-Time Recovery

  • DynamoDB point-in-time recovery – PITR enables automatic, continuous, incremental backup of the table with per-second granularity.
  • PITR backups are fully managed by DynamoDB.
  • PITR helps protect against accidental writes and deletes.
  • PITR can back up tables with hundreds of terabytes of data with no impact on the performance or availability of the production applications.

Configurable Recovery Period (January 2025)

  • Announced in January 2025, DynamoDB now supports a configurable recovery period for PITR.
  • Recovery period can be set to any value between 1 and 35 days on a per-table basis.
  • Default: Recovery period is 35 days if not explicitly configured.
  • Can restore to any given second from within the configured recovery period.
  • Use Cases:
    • Shorter retention (e.g., 7 days) for cost optimization when long-term recovery is not needed.
    • Compliance requirements that mandate specific retention periods.
    • Development/test environments where shorter recovery windows are acceptable.
  • Pricing Impact: Shortening the recovery period has no impact on PITR pricing because the price is based on the size of table and local secondary indexes, not the retention period.

PITR Restore Capabilities

  • Can restore to any point in time between EarliestRestorableDateTime and LatestRestorableDateTime.
  • LatestRestorableDateTime is typically five minutes before the current time.
  • PITR-enabled tables that were deleted can be recovered in the preceding 35 days (or configured retention period) and restored to their state just before they were deleted.
  • Restored table is created as a new, independent table (not part of the original global table if applicable).

PITR with Global Tables

  • Can enable point-in-time recovery on each local replica of a global table.
  • When restoring a global table replica, the backup restores to an independent table that is not part of the global table.
  • If using Global Tables version 2019.11.21 (Current), a new global table can be created from the restored table.

PITR Considerations

  • If PITR is disabled and later re-enabled on a table, the start time for recovery is reset.
  • After re-enabling, can only immediately restore using the LatestRestorableDateTime.
  • AWS CloudTrail logs all console and API actions for PITR for auditing and compliance.
  • PITR can be enabled or disabled at any time without impacting table performance.

Backup and Restore Best Practices

  • Use AWS Backup for Production: Leverage AWS Backup for centralized management, cross-region/cross-account capabilities, and advanced features.
  • Enable PITR for Critical Tables: Always enable PITR for production tables to protect against accidental data loss.
  • Configure Appropriate Retention: Set PITR retention period based on recovery requirements and compliance needs.
  • Test Restore Procedures: Regularly test backup restoration to ensure recovery processes work as expected.
  • Use Vault Lock for Compliance: Apply AWS Backup Vault Lock for immutable backups when required by regulations.
  • Implement Cross-Region Backups: Copy critical backups to another region for disaster recovery.
  • Tag Backups: Use cost allocation tags to track backup costs by project, environment, or team.
  • Automate Backup Plans: Create scheduled backup plans with AWS Backup for consistent data protection.
  • Monitor Backup Status: Use CloudWatch and AWS Backup monitoring to track backup success and failures.
  • Consider Cold Storage: Transition long-term backups to cold storage tier for cost savings.

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. A sysops engineer must create nightly backups of an Amazon DynamoDB table. Which backup methodology should the database specialist use to MINIMIZE management overhead?
    1. Install the AWS CLI on an Amazon EC2 instance. Write a CLI command that creates a backup of the DynamoDB table. Create a scheduled job or task that runs the command on a nightly basis.
    2. Create an AWS Lambda function that creates a backup of the DynamoDB table. Create an Amazon CloudWatch Events rule that runs the Lambda function on a nightly basis.
    3. Create a backup plan using AWS Backup, specify a backup frequency of every 24 hours, and give the plan a nightly backup window.
    4. Configure DynamoDB backup and restore for an on-demand backup frequency of every 24 hours.
  2. A company needs to copy DynamoDB table backups to a different AWS account for disaster recovery purposes. What is the BEST solution?
    1. Use DynamoDB native backup and manually export/import data to the other account.
    2. Use AWS Backup to create backups and copy them across accounts after enabling advanced features and cross-account backup.
    3. Enable PITR and restore the table in the other account.
    4. Use AWS Data Pipeline to copy data between accounts.
  3. A company wants to protect a DynamoDB table against accidental deletions with the ability to recover data from any point in the last 7 days. What should a solutions architect recommend?
    1. Create daily on-demand backups and retain them for 7 days.
    2. Enable PITR with a recovery period configured to 7 days.
    3. Use AWS Backup with a 7-day retention policy.
    4. Enable DynamoDB Streams and store data in S3 for 7 days.
  4. A company needs to restore a DynamoDB table to a different AWS Region. The table is currently in us-east-1 and needs to be restored to eu-west-1. What is the correct approach?
    1. Enable PITR and restore directly to eu-west-1.
    2. Use DynamoDB native backup and restore to eu-west-1.
    3. Create a backup and perform a cross-Region restore to eu-west-1.
    4. Create a Global Table with a replica in eu-west-1.
  5. A company has enabled PITR on a DynamoDB table with a 35-day retention period. They want to reduce costs by shortening the retention to 14 days. What will be the impact on PITR pricing?
    1. PITR costs will be reduced by approximately 60%.
    2. PITR costs will be reduced proportionally to the retention period.
    3. There will be no impact on PITR pricing as it is based on table size, not retention period.
    4. PITR costs will increase due to more frequent backup cycles.
  6. Which of the following are advantages of using AWS Backup over DynamoDB native backups? (Select THREE)
    1. Cross-account backup and restore capabilities
    2. Faster backup creation time
    3. Ability to transition backups to cold storage tier
    4. Lower backup storage costs
    5. Centralized backup management across multiple AWS services
    6. Automatic PITR enablement
  7. A DynamoDB table with PITR enabled was accidentally deleted. How long does the company have to recover the table?
    1. 7 days from deletion
    2. 24 hours from deletion
    3. Up to 35 days (or the configured retention period) from deletion
    4. PITR cannot recover deleted tables

References

AWS ML Engineer (MLA-C01) Exam Learning Path

AWS Certified Machine Learning Engineer - Associate (MLA-C01) Certificate

AWS Certified Machine Learning Engineer – Associate (MLA-C01) Exam Learning Path

🔄 July 2026 Update: Refreshed with Amazon Bedrock AgentCore (GA Oct 2025), SageMaker Lakehouse, SageMaker AI with MLflow 3.0 (serverless), SageMaker HyperPod elastic training, and Amazon Nova models. The AWS Certified Machine Learning – Specialty (MLS-C01) was retired on March 31, 2026, making MLA-C01 the primary AWS certification for ML practitioners.

  • Certified for the last pending AWS Certified Machine Learning Engineer – Associate (MLA-C01) certification, which was newly introduced on October 8, 2024, following its beta period.
  • Machine Learning Engineer – Associate exam validates knowledge to build, operationalize, deploy, and maintain machine learning (ML) solutions and pipelines by using the AWS Cloud.
  • Exam also validates a candidate’s ability to complete the following tasks:
    • Ingest, transform, validate, and prepare data for ML modeling.
    • Select general modeling approaches, train models, tune hyperparameters, analyze model performance, and manage model versions.
    • Choose deployment infrastructure and endpoints, provision compute resources, and configure auto scaling based on requirements.
    • Set up continuous integration and continuous delivery (CI/CD) pipelines to automate orchestration of ML workflows.
    • Monitor models, data, and infrastructure to detect issues.
    • Secure ML systems and resources through access controls, compliance features, and best practices.

Refer AWS Certified Machine Learning Engineer – Associate (MLA-C01) Exam Guide

AWS Certified Machine Learning Engineer – Associate (MLA-C01) Exam Summary

  • MLA-C01 exam consists of 65 questions (50 scored and 15 unscored) in 130 minutes, and the time is more than sufficient if you are well-prepared.
  • MLA-C01 exam covers four domains:
    • Domain 1: Data Preparation for Machine Learning (28%)
    • Domain 2: ML Model Development (26%)
    • Domain 3: Deployment and Orchestration of ML Workflows (22%)
    • Domain 4: ML Solution Monitoring, Maintenance, and Security (24%)
  • In addition to the usual types of multiple-choice and multiple-response questions, the MLA-C01 exam has introduced the following new types
    • Ordering: Has a list of 3-5 responses which you need to select and place in the correct order to complete a specified task.
    • Matching: Has a list of responses to match with a list of 3-7 prompts. You must match all the pairs correctly to receive credit for the question.
    • Case study: A case study presents a single scenario with multiple questions. Each question is evaluated independently, and credit is given for each correct answer.
  • MLA-C01 has a scaled score between 100 and 1,000. The scaled score needed to pass the exam is 720.
  • Associate exams currently cost $150 + tax.
  • You can get an additional 30 minutes if English is your second language by requesting Exam Accommodations. It might not be needed for Associate exams but is helpful for Professional and Specialty ones.
  • AWS exams can be taken either remotely or online, I prefer to take them online as it provides a lot of flexibility. Just make sure you have a proper place to take the exam with no disturbance and nothing around you.
  • Also, if you are taking the AWS Online exam for the first time try to join at least 30 minutes before the actual time as I have had issues with both PSI and Pearson with long wait times.

AWS Certified Machine Learning Engineer – Associate (MLA-C01) Exam Resources

AWS Certified Machine Learning Engineer – Associate (MLA-C01) Exam Topics

  • AWS Certified Machine Learning Engineer – Associate exam covers a lot of Machine Learning concepts in addition to the AWS ML Services.
  • AWS Certified Machine Learning exam covers the Machine Learning lifecycle, data collection, transformation, making it usable and efficient for Machine Learning, pre-processing data for Machine Learning, training and validation, and implementation.
  • With the Q1 2026 refresh, the exam now includes increased coverage of Amazon Bedrock (Knowledge Bases, Agents, Guardrails, AgentCore), Generative AI workflows, and the unified SageMaker AI platform including Lakehouse and MLflow.

Machine Learning Concepts

  • Exploratory Data Analysis
    • Feature selection and Engineering
      • remove features that are not related to training
      • remove features that have the same values, very low correlation, very little variance, or a lot of missing values
      • Apply techniques like Principal Component Analysis (PCA) for dimensionality reduction i.e. reduce the number of features.
      • Apply techniques such as One-hot encoding and label encoding to help convert strings to numeric values, which are easier to process.
      • Apply Normalization i.e. values between 0 and 1 to handle data with large variance.
      • Apply feature engineering for feature reduction e.g. using a single height/weight feature instead of both features.
    • Handle Missing data
      • remove the feature or rows with missing data
      • impute using Mean/Median values – valid only for Numeric values and not categorical features also does not factor correlation between features
      • impute using k-NN, Multivariate Imputation by Chained Equation (MICE), Deep Learning – more accurate and helps factors correlation between features
    • Handle unbalanced data
      • Source more data
      • Oversample minority or Undersample majority
      • Data augmentation using techniques like Synthetic Minority Oversampling Technique (SMOTE).
  • Modeling
    • Know about Algorithms – Supervised, Unsupervised and Reinforcement and which algorithm is best suitable based on the available data either labelled or unlabelled.
      • Supervised learning trains on labeled data e.g. Linear regression. Logistic regression, Decision trees, Random Forests
      • Unsupervised learning trains on unlabelled data e.g. PCA, SVD, K-means
      • Reinforcement learning trained based on actions and rewards e.g. Q-Learning
    • Hyperparameters
      • are parameters exposed by machine learning algorithms that control how the underlying algorithm operates and their values affect the quality of the trained models
      • some of the common hyperparameters are learning rate, batch, epoch (hint: If the learning rate is too large, the minimum slope might be missed and the graph would oscillate. If the learning rate is too small, it requires too many steps which would take the process longer and is less efficient)
  • Evaluation
    • Know difference in evaluating model accuracy
      • Use Area Under the (Receiver Operating Characteristic) Curve (AUC) for Binary classification
      • Use root mean square error (RMSE) metric for regression
    • Understand Confusion matrix
      • A true positive is an outcome where the model correctly predicts the positive class. Similarly, a true negative is an outcome where the model correctly predicts the negative class.
      • A false positive is an outcome where the model incorrectly predicts the positive class. A false negative is an outcome where the model incorrectly predicts the negative class.
      • Recall or Sensitivity or TPR (True Positive Rate): Number of items correctly identified as positive out of total true positives- TP/(TP+FN) (hint: use this for cases like fraud detection, cost of marking non fraud as frauds is lower than marking fraud as non-frauds)
      • Specificity or TNR (True Negative Rate): Number of items correctly identified as negative out of total negatives- TN/(TN+FP) (hint: use this for cases like videos for kids, the cost of dropping few valid videos is lower than showing few bad ones)
    • Handle Overfitting problems
      • Simplify the model, by reducing the number of layers
      • Early Stopping – form of regularization while training a model with an iterative method, such as gradient descent
      • Data Augmentation
      • Regularization – technique to reduce the complexity of the model
      • Dropout is a regularization technique that prevents overfitting
      • Never train on test data

Machine Learning Services

SageMaker AI (formerly SageMaker)

Note: At re:Invent 2024, AWS rebranded Amazon SageMaker to Amazon SageMaker AI as part of the next-generation SageMaker platform that unifies data, analytics, and AI. The next-gen SageMaker umbrella includes SageMaker AI, SageMaker Lakehouse, and SageMaker Unified Studio.

  • supports both File mode, Pipe mode, and Fast File mode
    • File mode loads all of the data from S3 to the training instance volumes VS Pipe mode streams data directly from S3
    • File mode needs disk space to store both the final model artifacts and the full training dataset. VS Pipe mode which helps reduce the required size for EBS volumes.
    • Fast File mode combines the ease of use of the existing File Mode with the performance of Pipe Mode.
  • Using RecordIO format allows algorithms to take advantage of Pipe mode when training the algorithms that support it.
  • supports Model tracking capability to manage up to thousands of machine learning model experiments
  • supports automatic scaling for production variants. Automatic scaling dynamically adjusts the number of instances provisioned for a production variant in response to changes in your workload
  • provides pre-built Docker images for its built-in algorithms and the supported deep learning frameworks used for training & inference
  • SageMaker Automatic Model Tuning
    • is the process of finding a set of hyperparameters for an algorithm that can yield an optimal model.
    • Best practices
      • limit the search to a smaller number as the difficulty of a hyperparameter tuning job depends primarily on the number of hyperparameters that Amazon SageMaker has to search
      • DO NOT specify a very large range to cover every possible value for a hyperparameter as it affects the success of hyperparameter optimization.
      • log-scaled hyperparameter can be converted to improve hyperparameter optimization.
      • running one training job at a time achieves the best results with the least amount of compute time.
      • Design distributed training jobs so that they report the objective metric that you want.
  • know how to take advantage of multiple GPUs (hint: increase learning rate and batch size w.r.t to the increase in GPUs)
  • Elastic Inference (deprecated April 2023, replaced by AWS Inferentia) — previously helped attach low-cost GPU-powered acceleration to EC2 and SageMaker instances for deep learning inference. Use AWS Inferentia (Inf2 instances) or AWS Trainium (Trn1/Trn2 instances) for cost-effective ML acceleration.
  • SageMaker AI Inference options.
    • Real-time inference is ideal for online inferences that have low latency or high throughput requirements.
    • Serverless Inference is ideal for intermittent or unpredictable traffic patterns as it manages all of the underlying infrastructure with no need to manage instances or scaling policies.
    • Batch Transform is suitable for offline processing when large amounts of data are available upfront and you don’t need a persistent endpoint.
    • Asynchronous Inference is ideal when you want to queue requests and have large payloads with long processing times.
  • SageMaker AI Model deployment allows deploying multiple variants of a model to the same SageMaker endpoint to test new models without impacting the user experience
    • Production Variants
      • supports A/B or Canary testing where you can allocate a portion of the inference requests to each variant.
      • helps compare production variants’ performance relative to each other.
    • Shadow Variants
      • replicates a portion of the inference requests that go to the production variant to the shadow variant.
      • logs the responses of the shadow variant for comparison and not returned to the caller.
      • helps test the performance of the shadow variant without exposing the caller to the response produced by the shadow variant.
  • SageMaker Managed Spot training can help use spot instances to save cost and with Checkpointing feature can save the state of ML models during training
  • SageMaker Feature Store
    • helps to create, share, and manage features for ML development.
    • is a centralized store for features and associated metadata so features can be easily discovered and reused.
    • now supports Apache Iceberg table format, streaming ingestion, scalable batch ingestion, and fine-grained access control through AWS Lake Formation.
  • SageMaker Debugger provides tools to debug training jobs and resolve problems such as overfitting, saturated activation functions, and vanishing gradients to improve the model’s performance.
  • SageMaker Model Monitor monitors the quality of SageMaker machine learning models in production and can help set alerts that notify when there are deviations in the model quality.
  • SageMaker Automatic Model Tuning helps find a set of hyperparameters for an algorithm that can yield an optimal model.
  • SageMaker Data Wrangler
    • reduces the time it takes to aggregate and prepare tabular and image data for ML from weeks to minutes.
    • Note: Data Wrangler has been integrated into Amazon SageMaker Canvas. The new Data Wrangler experience in SageMaker Canvas includes a natural language interface in addition to the visual interface for data exploration and transformation.
  • SageMaker Experiments is a capability of SageMaker that lets you create, manage, analyze, and compare machine learning experiments.
  • SageMaker Clarify helps improve the ML models by detecting potential bias and helping to explain the predictions that the models make.
    • Pre-training bias metrics: CI, DPL, KL Divergence, JS Divergence
    • Post-training bias metrics: DI, DPD, DCA, AD, CDDPL
    • SHAP values for feature importance and individual prediction explanations
    • Foundation model evaluation for accuracy, toxicity, and robustness
    • Integrates with Model Monitor for continuous bias drift detection
  • SageMaker Model Governance is a framework that gives systematic visibility into ML model development, validation, and usage.
  • SageMaker Model Cards
    • helps document critical details about the ML models in a single place for streamlined governance and reporting.
    • helps capture key information about the models throughout their lifecycle and implement responsible AI practices.
  • SageMaker Autopilot
    • is an automated machine learning (AutoML) feature set that automates the end-to-end process of building, training, tuning, and deploying machine learning models.
    • Note: Autopilot UI has been migrated to Amazon SageMaker Canvas. Use SageMaker Canvas for no-code/low-code AutoML capabilities.
  • SageMaker Neo enables machine learning models to train once and run anywhere in the cloud and at the edge.
  • SageMaker API and SageMaker Runtime support VPC interface endpoints powered by AWS PrivateLink that helps connect VPC directly to the SageMaker API or SageMaker Runtime using AWS PrivateLink without using an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection.
  • SageMaker managed warm pools retain and reuse provisioned infrastructure after the training job completion to reduce latency for repetitive workloads.
  • SageMaker supports Elastic File System (EFS) and FSx for Lustre file systems as data sources for training machine learning models.
  • SageMaker MLOps
    • ML Lineage Tracking creates and stores tracking information about the steps of a ML workflow from data preparation to model deployment that can help reproduce the workflow steps, track model and dataset lineage, and establish model governance and audit standards.
    • Model Registry provides a model catalog, helps manage model versions, associate metadata, manage model approval status, deploy models to production and share models with other users.

SageMaker AI with MLflow (New – 2024/2025)

  • provides fully managed, serverless MLflow tracking for experiment tracking, model packaging, and model registry — no infrastructure to manage.
  • supports MLflow 3.0 (GA July 2025) with tracing capabilities to record inputs, outputs, and metadata at every step of a generative AI application.
  • helps track multiple training runs as experiments, compare runs with visualizations, evaluate models, and register the best models.
  • models registered in MLflow are automatically registered to SageMaker Model Registry with an associated SageMaker Model Card.
  • supports cross-account sharing, automated version upgrades, and integration with SageMaker Pipelines.
  • integrates with SageMaker HyperPod to track foundation model training experiments at scale.

SageMaker HyperPod (New – 2023/2024/2025)

  • purpose-built infrastructure for training and inference of foundation models at scale, reducing training time by up to 40%.
  • efficiently distributes and parallelizes training workloads across hundreds or thousands of AI accelerators (GPUs/Trainium chips).
  • continuously checks for hardware problems, resolves them automatically, and ensures workloads recover without manual intervention.
  • key features:
    • Checkpointless Training — maintains forward training progress despite failures using peer-to-peer transfer of model and optimizer states from healthy accelerators, enabling 95%+ training goodput and 80-93% reduction in recovery time.
    • Elastic Training (Dec 2025) — automatically adjusts the number of data-parallel replicas based on cluster utilization and priority of workloads.
    • Flexible Training Plans — helps meet training timelines and budgets with automated capacity planning.
    • Amazon EKS Integration — orchestrates HyperPod clusters via Amazon EKS, supporting containerized workloads, PyTorchJob auto-resume, and inference on the same cluster.
    • Interactive IDEs — supports running interactive workloads alongside training jobs with fractional GPU allocations.
  • integrates with Amazon CloudWatch Container Insights, Amazon Managed Prometheus, and Amazon Managed Grafana for observability.

SageMaker Lakehouse (New – re:Invent 2024)

  • a unified, open, and secure data lakehouse architecture built on Apache Iceberg that unifies data across S3 data lakes and Amazon Redshift data warehouses.
  • enables running analytics and ML workloads — including Apache Spark jobs, SQL dashboards, ML models, and generative AI applications — on a single copy of data.
  • key capabilities:
    • Unified access to Amazon S3 data lakes (including S3 Tables), Amazon Redshift data warehouses, and operational databases via zero-ETL integrations.
    • Fine-grained access control through AWS Lake Formation with consistent permissions across all query engines.
    • Compatible with Amazon Athena, Amazon EMR, AWS Glue, and Amazon Redshift for querying and analysis.
    • Fully compatible with Apache Iceberg REST API for open interoperability.
  • relevant to MLA-C01 Domain 1 (Data Preparation) — provides unified data access for ML feature engineering and training data preparation.

SageMaker Unified Studio (New – re:Invent 2024)

  • a unified interface combining data preparation, ML model development, generative AI, and governance.
  • integrates SageMaker AI, Amazon Bedrock, analytics, and data governance into a single platform.
  • supports one-click onboarding with existing IAM roles and permissions.
  • provides collaborative workspace for data engineers, ML engineers, and business analysts.

SageMaker Canvas

  • a visual, no-code/low-code ML service that enables building, evaluating, and deploying production-ready models without writing code.
  • now integrates Data Wrangler and Autopilot capabilities.
  • supports petabyte-scale data preparation and time series forecasting (replacing Amazon Forecast).
  • supports fine-tuning foundation models via Amazon Bedrock integration.

SageMaker Ground Truth

  • provides automated data labeling using machine learning
  • helps build highly accurate training datasets for machine learning quickly using Amazon Mechanical Turk
  • provides annotation consolidation to help improve the accuracy of the data object’s labels. It combines the results of multiple worker’s annotation tasks into one high-fidelity label.
  • automated data labeling uses machine learning to label portions of the data automatically without having to send them to human workers

Amazon Bedrock (Critical for 2026 Exam)

  • Amazon Bedrock is a fully managed service providing access to foundation models (FMs) from Amazon and third-party providers through a unified API.
    • supports models from Amazon (Nova, Titan), Anthropic (Claude), Meta (Llama), Mistral, Cohere, and others.
    • provides serverless experience — no infrastructure to manage.
  • Bedrock Knowledge Bases
    • enables RAG (Retrieval-Augmented Generation) by grounding FM responses in enterprise data.
    • automatically chunks documents, creates embeddings, and stores them in a vector database.
    • supports vector stores including Amazon OpenSearch Serverless, Amazon Aurora, Pinecone, and Redis Enterprise.
    • Managed Knowledge Base (GA June 2026) — fully managed RAG without managing vector databases or data pipelines.
    • integrates with Amazon Kendra GenAI Index for enhanced semantic retrieval.
  • Bedrock Agents
    • orchestrate multi-step generative AI workflows by connecting FMs to APIs and data sources.
    • automatically break down tasks, create orchestration plans, and execute actions.
    • support action groups (Lambda functions) and knowledge base integration.
  • Bedrock AgentCore (Preview Jul 2025, GA Oct 2025)
    • a dedicated platform to build, deploy, and operate AI agents at any scale with enterprise-grade security.
    • framework-agnostic and model-agnostic — works with any open-source agent framework (LangChain, CrewAI, AutoGen) and any model.
    • key components:
      • AgentCore Runtime — serverless, scalable environment to host and run agents without managing infrastructure; supports VPC, PrivateLink, and CloudFormation.
      • AgentCore Tools — pre-built tools including Code Interpreter, browser automation, and MCP (Model Context Protocol) connectors for enterprise data.
      • AgentCore Identity — manages authentication and fine-grained access control for agents connecting to third-party tools and data sources.
      • AgentCore Observability — tracing and monitoring for agent execution in production.
      • AgentCore Harness (GA 2026) — go from idea to production-grade agent in minutes with automated container packaging and deployment.
    • now included in MLA-C01 exam scope per Q1 2026 refresh.
  • Bedrock Guardrails
    • configurable safeguards to filter harmful content, block sensitive data (PII), and ensure compliance.
    • enforces deterministic controls independent of model’s reasoning quality.
    • supports content filters, denied topics, word filters, sensitive information filters, and contextual grounding checks.
    • can be associated with agents, knowledge bases, and direct model invocations.
  • Bedrock Model Evaluation
    • evaluate, compare, and select the best FM for a specific use case.
    • supports automatic evaluation (built-in metrics) and human evaluation.
  • Bedrock Model Customization
    • supports continued pre-training and fine-tuning of FMs with proprietary data.
    • supports Reinforcement Fine-Tuning (RFT) for Amazon Nova and open-source models.
    • Custom Model Import allows bringing SageMaker-trained models into Bedrock for serverless inference.
    • Model Distillation enables creating smaller, faster, cost-effective models from larger teacher models (e.g., Nova Premier → Nova Pro/Lite/Micro).
  • Bedrock Flows
    • visual builder for creating generative AI workflows connecting prompts, models, knowledge bases, and agents.

Amazon Nova Models

  • Amazon’s own family of foundation models available exclusively in Amazon Bedrock, launched at re:Invent 2024.
    • Nova Micro — text-only, fastest and lowest cost; optimized for summarization, translation, classification, and simple reasoning. 128K context.
    • Nova Lite — multimodal (text, image, video input → text output); cost-efficient for simple automation and document processing.
    • Nova Pro — multimodal; balanced capability, accuracy, speed, and cost for a wide range of tasks including agentic workflows.
    • Nova Premier — most capable; excels at complex tasks requiring deep context understanding, multistep planning, and multi-tool execution. Ideal as a teacher model for distillation.
  • All Nova models support fine-tuning and model distillation through Amazon Bedrock.
  • Nova 2 family (2025) offers next-generation improvements in intelligence and cost-efficiency.

Machine Learning & AI Managed Services

  • Comprehend
    • natural language processing (NLP) service to find insights and relationships in text.
    • identifies the language of the text; extracts key phrases, places, people, brands, or events; understands how positive or negative the text is; analyzes text using tokenization and parts of speech; and automatically organizes a collection of text files by topic.
  • Rekognition – analyze images and video to identify objects, people, text, scenes, and activities in images and videos, as well as detect any inappropriate content.
  • Transcribe – automatic speech recognition (ASR) speech-to-text
  • Kendra – an intelligent search service that uses NLP and advanced ML algorithms to return specific answers to search questions from your data.
    • Kendra GenAI Index (New – re:Invent 2024) — delivers highest accuracy for RAG and intelligent search using latest information retrieval technologies and semantic models.
    • integrates with Amazon Q Business and Amazon Bedrock Knowledge Bases.
  • Augmented AI (Amazon A2I) is an ML service that makes it easy to build the workflows required for human review.
  • Amazon Q Developer (formerly CodeWhisperer) — AI-powered coding assistant for building, deploying, and operating applications on AWS.

Generative AI

Refer: AWS AI & Generative AI Services Cheat Sheet

  • MLA-C01 covers Generative AI concepts with increased emphasis post-Q1 2026 refresh, including practical AWS Bedrock integration.
  • Foundation Models:
    • Large, pre-trained models built on diverse data that can be fine-tuned for specific tasks like text, image, and speech generation. for e.g. GPT, BERT, DALL·E, Amazon Nova, Claude, Llama.
  • Large Language Models (LLMs):
    • A subset of foundation models designed to understand and generate human-like text. Capable of answering questions, summarizing, translating, and more.
    • LLM Components
      • Tokens: Basic units of text (words, subwords, or characters) that LLMs process.
      • Vectors: Numerical representations of tokens in high-dimensional space, enabling the model to perform mathematical operations on text.
      • Embeddings: Pre-trained numerical vector representations of tokens that capture their semantic meaning.
      • Attention Mechanism: Allows models to weigh the importance of different tokens in a sequence relative to each other (e.g., self-attention in Transformers).
  • Prompt Engineering:
    • Crafting effective input instructions to guide generative AI toward desired outputs. Key for improving performance without fine-tuning the model.
    • Techniques include zero-shot, few-shot, chain-of-thought (CoT), and ReAct prompting.
  • Retrieval-Augmented Generation (RAG):
    • Combines LLMs with external knowledge bases to retrieve accurate and up-to-date information during text generation.
    • Reduces hallucinations by grounding responses in verified enterprise data.
    • AWS Implementation: Amazon Bedrock Knowledge Bases + vector stores.
  • Fine-Tuning:
    • Adjusting pre-trained models using domain-specific data to optimize performance for specific applications.
    • AWS options: Amazon Bedrock fine-tuning, SageMaker AI fine-tuning (SFT, DPO, RLVR, RLAIF).
  • Responsible AI Features:
    • Incorporates fairness, transparency, and bias mitigation techniques to ensure ethical AI outputs.
    • Amazon Bedrock Guardrails provides managed responsible AI controls.
  • Multi-Modal Capabilities:
    • Models that process and generate outputs across multiple data types, such as text, images, and audio.
    • Amazon Nova models support text, image, and video generation.
  • Controls
    • Temperature: Adjusts randomness in the output; lower values (e.g., 0.2) produce focused and deterministic results, while higher values (e.g., 1.0+) generate creative and diverse outputs.
    • Top P (Nucleus Sampling): Determines the probability threshold for token selection — with Top P = 0.9, the model considers only the smallest set of tokens whose cumulative probability is 90%.
    • Top K: Limits the token selection to the top K most probable tokens — with Top K = 10, the model randomly chooses tokens only from the 10 most likely options.
    • Token Length (Max Tokens): Sets the maximum number of tokens the model can generate in a response.

Analytics

  • Kinesis
  • Glue is a fully managed, ETL (extract, transform, and load) service that automates the time-consuming steps of data preparation for analytics
    • helps setup, orchestrate, and monitor complex data flows.
    • Glue Data Catalog is a central repository to store structural and operational metadata for all the data assets.
    • Glue crawler connects to a data store, extracts the schema of the data, and then populates the Glue Data Catalog with this metadata
    • Glue DataBrew is a visual data preparation tool that enables users to clean and normalize data without writing any code.

Security, Identity & Compliance

  • SageMaker can read data from KMS-encrypted S3. Make sure, the KMS key policies include the role attached with SageMaker
  • Amazon Bedrock supports AWS PrivateLink for private connectivity, encryption at rest and in transit, and IAM-based access control.
  • Bedrock AgentCore supports VPC isolation, PrivateLink, and fine-grained IAM permissions for agent-to-tool authentication.

Management & Governance Tools

  • Understand AWS CloudWatch for Logs and Metrics. (hint: SageMaker is integrated with CloudWatch and logs and metrics are all stored in it)

Deprecated Services to Be Aware Of

  • Amazon Elastic Inference — deprecated April 2023. Use AWS Inferentia (Inf2 instances) or AWS Trainium (Trn1/Trn2 instances) for cost-effective ML inference/training acceleration.
  • SageMaker Edge Manager — discontinued April 26, 2024. Use AWS IoT Greengrass V2 with ONNX format for edge ML deployments.
  • Amazon Forecast — closed to new customers July 29, 2024. Use SageMaker Canvas for time series forecasting.
  • SageMaker Studio Classic — replaced by the updated SageMaker Studio experience and SageMaker Unified Studio.
  • AWS Certified Machine Learning – Specialty (MLS-C01) — retired March 31, 2026. MLA-C01 is now the primary ML certification.

Practice Questions (2025-2026 Updates)

  1. A company is training a large language model with 70 billion parameters across 256 GPUs. During training, individual GPU nodes occasionally fail, causing the entire job to restart from the last checkpoint. This adds days to the training timeline. Which AWS service minimizes the impact of hardware failures on foundation model training?
    1. Amazon SageMaker AI training jobs with managed spot instances
    2. Amazon SageMaker HyperPod with checkpointless training
    3. Amazon EC2 P5 instances with EBS snapshots
    4. AWS Batch with retry strategies
    Show Answer

    Answer: B. – SageMaker HyperPod with checkpointless training automatically detects and replaces faulty nodes, then recovers training using peer-to-peer transfer of model states from healthy accelerators — achieving 95%+ training goodput and 80-93% reduction in recovery time without relying on checkpoint files.

  2. A machine learning team wants to deploy an AI agent that can access company databases, execute code, and call external APIs autonomously. The agent must run in a production environment with enterprise security controls, VPC isolation, and the ability to scale to thousands of concurrent requests. The team uses LangChain as their agent framework. Which AWS service should they use?
    1. Amazon Bedrock Agents
    2. Amazon Bedrock AgentCore
    3. AWS Lambda with Amazon Bedrock API calls
    4. Amazon ECS with a custom agent container
    Show Answer

    Answer: B. – Amazon Bedrock AgentCore provides a framework-agnostic (including LangChain) and model-agnostic platform for deploying production-grade AI agents with serverless scaling, VPC/PrivateLink support, built-in identity management for tool authentication, and observability — all without managing infrastructure.

  3. A data science team needs to track experiments across multiple foundation model fine-tuning runs on SageMaker HyperPod, compare metrics visually, and automatically register the best model for deployment. They want to avoid managing any tracking infrastructure. Which solution meets these requirements with LEAST operational overhead?
    1. Deploy a self-managed MLflow server on Amazon EC2 and configure SageMaker to log metrics
    2. Use Amazon SageMaker AI with serverless MLflow and SageMaker Model Registry integration
    3. Use Amazon CloudWatch custom metrics with CloudWatch dashboards
    4. Use SageMaker Experiments with manual model registration
    Show Answer

    Answer: B. – SageMaker AI with serverless MLflow provides fully managed, infrastructure-free experiment tracking that integrates with HyperPod, automatically scales, and automatically registers models to SageMaker Model Registry with an associated Model Card — the least operational overhead for this workflow.

  4. A company wants to build a RAG-based chatbot that answers questions using internal documents. They need to ensure the chatbot never reveals personally identifiable information (PII) from the documents and does not generate responses about competitors. Which combination of Amazon Bedrock features should they use? (Choose TWO)
    1. Bedrock Knowledge Bases
    2. Bedrock Model Customization with continued pre-training
    3. Bedrock Guardrails with sensitive information filters and denied topics
    4. Bedrock AgentCore Code Interpreter
    5. Amazon Comprehend PII detection
    Show Answer

    Answer: A, C – Bedrock Knowledge Bases provides the RAG capability to ground responses in internal documents. Bedrock Guardrails with sensitive information filters (PII blocking) and denied topics (competitor mentions) enforces deterministic controls to prevent PII leakage and off-topic responses regardless of the model’s reasoning.

  5. An organization is preparing ML training datasets that span data in Amazon S3 data lakes, Amazon Redshift data warehouses, and Amazon DynamoDB operational tables. They want to access all this data through a unified interface with consistent fine-grained access controls for their SageMaker AI training jobs. Which service provides this unified data access?
    1. AWS Glue Data Catalog with Lake Formation permissions
    2. Amazon SageMaker Lakehouse
    3. Amazon Athena federated queries
    4. Amazon Redshift Spectrum
    Show Answer

    Answer: B. – Amazon SageMaker Lakehouse provides a unified, open (Apache Iceberg-based) data lakehouse that unifies access to S3 data lakes (including S3 Tables), Redshift data warehouses, and operational databases via zero-ETL integrations — all with consistent fine-grained access controls through AWS Lake Formation.

Whitepapers and Articles

Related AWS AI/ML Certifications

  • AWS Certified AI Practitioner (AIF-C01) — foundational-level certification for understanding AI/ML concepts and AWS AI services.
  • AWS Certified Generative AI Developer – Professional (AIP-C01) — professional-level certification for building production-ready generative AI solutions using Amazon Bedrock. Launched late 2025 (GA April 2026).
  • AWS Certified Machine Learning – Specialty (MLS-C01) — retired March 31, 2026. Holders retain active certification for 3 years from date earned.

AWS Architecture Patterns for MLA-C01

On the Exam Day

  • Make sure you are relaxed and get some good night’s sleep. The exam is not tough if you are well-prepared.
  • If you are taking the AWS Online exam
    • Try to join at least 30 minutes before the actual time as I have had issues with both PSI and Pearson with long wait times.
    • The online verification process does take some time and usually, there are glitches.
    • Remember, you would not be allowed to take the take if you are late by more than 30 minutes.
    • Make sure you have your desk clear, no hand-watches, or external monitors, keep your phones away, and nobody can enter the room.

Finally, All the Best 🙂

AWS Certified AI Practitioner AIF-C01 Exam Learning Path

AWS Certified AI Practitioner

AWS Certified AI Practitioner AIF-C01 Exam Learning Path

  • Started the AI journey by clearing the AWS Certified AI Practitioner AIF-C01 exam with a perfect score.
  • AWS Certified AI Practitioner AIF-C01 exam is the latest AWS exam released on October 8, 2024, following its beta period.
  • AI Practitioner exam validates knowledge of AI/ML, generative AI technologies, and associated AWS services and tools, independent of a specific job role.
  • The AIF-C01 exam has been refreshed in 2026 to reflect changes in AWS services, including the addition of Amazon Bedrock AgentCore.
  • Exam also validates a candidate’s ability to complete the following tasks:
    • Understand AI, ML, and generative AI concepts, methods, and strategies in general and on AWS.
    • Understand the appropriate use of AI/ML and generative AI technologies to ask relevant questions within the candidate’s organization.
    • Determine the correct types of AI/ML technologies to apply to specific use cases.
    • Use AI, ML, and generative AI technologies responsibly

🎯 AWS AI/ML Certification Path Update (2026)

  • AWS Certified Machine Learning – Specialty retired on March 31, 2026. Certification holders retain active status through their original expiration date.
  • AWS Certified Generative AI Developer – Professional (AIP-C01) is now generally available (beta ended March 31, 2026). It validates advanced skills in building production-ready AI solutions using Bedrock, RAG architectures, and agentic AI.
  • AWS Agentic AI Demonstrated microcredential — a free, hands-on credential for implementing AI solutions in a provisioned AWS environment.
  • Current AI/ML certification path:
    • Foundational: AWS Certified AI Practitioner (AIF-C01)
    • Associate: AWS Certified Machine Learning Engineer – Associate (MLA-C01)
    • Professional: AWS Certified Generative AI Developer – Professional (AIP-C01)

Refer AWS Certified AI Practitioner AIF-C01 Exam Guide

See also: AWS AI & Generative AI Services – Cheat Sheet

AWS Certified AI Practitioner AIF-C01 Exam Summary

  • AIF-C01 exam consists of 65 questions (50 scored and 15 unscored) in 90 minutes, and the time is more than sufficient if you are well-prepared.
  • In addition to the usual types of multiple-choice and multiple-response questions, the AIF exams have introduced the following new types
    • Ordering: Has a list of 3-5 responses which you need to select and place in the correct order to complete a specified task.
    • Matching: Has a list of responses to match with a list of 3-7 prompts. You must match all the pairs correctly to receive credit for the question.
    • Case study: A case study presents a single scenario with multiple questions. Each question is evaluated independently, and credit is given for each correct answer.
  • AIF-C01 has a scaled score between 100 and 1,000. The scaled score needed to pass the exam is 700.
  • Associate exams currently cost $ 100 + tax.
  • You can get an additional 30 minutes if English is your second language by requesting Exam Accommodations. It might not be needed for Associate exams but is helpful for Professional and Specialty ones.
  • AWS exams can be taken either remotely or online, I prefer to take them online as it provides a lot of flexibility. Just make sure you have a proper place to take the exam with no disturbance and nothing around you.
  • Also, if you are taking the AWS Online exam for the first time try to join at least 30 minutes before the actual time as I have had issues with both PSI and Pearson with long wait times.

📖 Deep Dive Guides: Bedrock vs SageMaker | RAG Architecture | Prompt Engineering | Responsible AI | AI Services Decision Guide

AWS Certified AI Practitioner AIF-C01 Exam Resources

AWS Certified AI Practitioner AIF-C01 Exam Topics

AIF-C01 Exam covers the AI and ML aspects in terms of AI & ML fundamentals, ML lifecycle, Generative AI, AI use cases and applications and building secure, responsible AI.

Machine Learning Concepts

  • Exploratory Data Analysis
    • Feature selection and Engineering
      • remove features that are not related to training
      • remove features that have the same values, very low correlation, very little variance, or a lot of missing values
      • Apply techniques like Principal Component Analysis (PCA) for dimensionality reduction i.e. reduce the number of features.
      • Apply techniques such as One-hot encoding and label encoding to help convert strings to numeric values, which are easier to process.
      • Apply Normalization i.e. values between 0 and 1 to handle data with large variance.
      • Apply feature engineering for feature reduction e.g. using a single height/weight feature instead of both features.
    • Handle Missing data
      • remove the feature or rows with missing data
      • impute using Mean/Median values – valid only for Numeric values and not categorical features also does not factor correlation between features
      • impute using k-NN, Multivariate Imputation by Chained Equation (MICE), Deep Learning – more accurate and helps factors correlation between features
    • Handle unbalanced data
      • Source more data
      • Oversample minority or Undersample majority
      • Data augmentation using techniques like Synthetic Minority Oversampling Technique (SMOTE).
  • Modeling
    • Transfer learning (TL) is a machine learning (ML) technique where a model pre-trained on one task is fine-tuned for a new, related task.
    • Know about Algorithms – Supervised, Unsupervised and Reinforcement and which algorithm is best suitable based on the available data either labelled or unlabelled.
      • Supervised learning trains on labeled data e.g. Linear regression. Logistic regression, Decision trees, Random Forests
      • Unsupervised learning trains on unlabelled data e.g. PCA, SVD, K-means
      • Reinforcement learning trained based on actions and rewards e.g. Q-Learning
    • Hyperparameters
      • are parameters exposed by machine learning algorithms that control how the underlying algorithm operates and their values affect the quality of the trained models
      • some of the common hyperparameters are learning rate, batch, epoch (hint: If the learning rate is too large, the minimum slope might be missed and the graph would oscillate If the learning rate is too small, it requires too many steps which would take the process longer and is less efficient)
  • Evaluation
    • Know difference in evaluating model accuracy
      • Use Area Under the (Receiver Operating Characteristic) Curve (AUC) for Binary classification
      • Use root mean square error (RMSE) metric for regression
    • Understand Confusion matrix
      • A true positive is an outcome where the model correctly predicts the positive class. Similarly, a true negative is an outcome where the model correctly predicts the negative class.
      • A false positive is an outcome where the model incorrectly predicts the positive class. A false negative is an outcome where the model incorrectly predicts the negative class.
      • Recall or Sensitivity or TPR (True Positive Rate): Number of items correctly identified as positive out of total true positives- TP/(TP+FN) (hint: use this for cases like fraud detection, cost of marking non fraud as frauds is lower than marking fraud as non-frauds)
      • Specificity or TNR (True Negative Rate): Number of items correctly identified as negative out of total negatives- TN/(TN+FP) (hint: use this for cases like videos for kids, the cost of dropping few valid videos is lower than showing few bad ones)
    • Training Problems
      • Overfitting occurs when the machine learning model gives accurate predictions for training data but not for new data.
      • Underfitting occurs when the model cannot determine a meaningful relationship between the input and output data. You get underfit models if they have not trained for the appropriate length of time on a large number of data points.
      • Underfit models experience high bias—they give inaccurate results for both the training data and test set. On the other hand, overfit models experience high variance—they give accurate results for the training set but not for the test set. More model training results in less bias but variance can increase. Data scientists aim to find the sweet spot between underfitting and overfitting when fitting a model. A well-fitted model can quickly establish the dominant trend for seen and unseen data sets.
    • Handle Overfitting problems
      • Simplify the model, by reducing the number of layers
      • Early Stopping – form of regularization while training a model with an iterative method, such as gradient descent
      • Data Augmentation
      • Regularization – technique to reduce the complexity of the model
      • Dropout is a regularization technique that prevents overfitting
      • Never train on test data

Generative AI

  • Foundation Models:
    • Large, pre-trained models built on diverse data that can be fine-tuned for specific tasks like text, image, and speech generation. for e.g. GPT, BERT, and DALL·E.
  • Large Language Models (LLMs):
    • A subset of foundation models designed to understand and generate human-like text. Capable of answering questions, summarizing, translating, and more.
    • LLM Components
      • Tokens:
        • Basic units of text (words, subwords, or characters) that LLMs process.
      • Vectors
        • Numerical representations of tokens in high-dimensional space, enabling the model to perform mathematical operations on text.
        • Each token is converted into a vector for processing in the neural network.
      • Embeddings:
        • Pre-trained numerical vector representations of tokens that capture their semantic meaning.
  • Prompt Engineering:
    • Crafting effective input instructions to guide generative AI toward desired outputs. Key for improving performance without fine-tuning the model.
    • Techniques
      • Zero-Shot Prompting: Instructs the model to perform a task without providing examples.
      • Few-Shot Prompting: Provides a few examples of the task in the prompt to guide the model’s output.
      • Chain-of-Thought Prompting: Encourages the model to explain its reasoning step-by-step before giving the final answer.
      • Instruction Prompting: Provides explicit instructions to guide the model’s behavior.
      • Contextual Prompting: Includes additional context or background information in the prompt for better responses.
      • Iterative Refinement: Refines the prompt in multiple iterations based on model responses to improve accuracy.
      • Role-based Prompting: Assigns a role to the model to influence its tone or expertise.
  • Agentic AI:
    • AI systems that can autonomously plan, reason, and execute multi-step tasks with minimal human intervention.
    • Agents use tools, make decisions, and adapt based on intermediate results.
    • Key patterns include ReAct (Reasoning + Acting), tool use, and multi-agent orchestration.
    • AWS provides Amazon Bedrock AgentCore for building and deploying production-grade agents.
  • Retrieval-Augmented Generation (RAG):
    • Combines LLMs with external knowledge bases to retrieve accurate and up-to-date information during text generation. Useful for chatbots and domain-specific tasks.
  • Fine-Tuning:
    • Adjusting pre-trained models using domain-specific data to optimize performance for specific applications.
    • Reinforcement Fine-Tuning (RFT): Uses reward signals to align model outputs with desired behaviors, now supported on Amazon Bedrock for open-weight models.
  • Responsible AI Features:
    • Incorporates fairness, transparency, and bias mitigation techniques to ensure ethical AI outputs.
  • Multi-Modal Capabilities:
    • Models that process and generate outputs across multiple data types, such as text, images, and audio.
  • Vector database
    • provides the ability to store and retrieve vectors as high-dimensional points.
    • add additional capabilities for efficient and fast lookup of nearest-neighbors in the N-dimensional space.
    • Amazon natively supports vector search through OpenSearch, Aurora PostgreSQL with pgvector and Partner solutions like Pinecone, Weaviate, and Milvus.
  • Controls
    • Temperature: Adjusts randomness in the output; lower values (e.g., 0.2) produce focused and deterministic results, while higher values (e.g., 1.0 or above) generate creative and diverse outputs.
    • Top P (Nucleus Sampling): Determines the probability threshold for token selection. With Top P = 0.9, the model considers only the smallest set of tokens whose cumulative probability is 90%.
    • Top K: Limits the token selection to the top K most probable tokens. With Top K = 10, the model randomly chooses from the 10 most likely options.
    • Token Length (Max Tokens): Sets the maximum number of tokens the model can generate in a response.
  • Model Evaluation Metrics:
    • Techniques like BLEU, ROUGE, perplexity, and embeddings measure generative AI performance across different use cases.
    • ROUGE (Recall-Oriented Understudy for Gisting Evaluation): Commonly used for text summarization; compares overlap between generated and reference text.
    • BERTScore: Evaluates text generation by comparing contextual embeddings, capturing semantic similarity beyond n-gram overlap.
    • Perplexity: Used for language models to evaluate prediction quality. Lower perplexity indicates a better model.
    • BLEU (Bilingual Evaluation Understudy): Evaluates machine translation by comparing generated text against reference translations.
  • Limitations
    • Security: can be exploited to create malicious content, phishing attacks, or deepfakes.
    • Cost: Training and deploying large models require substantial computational resources.
    • Explainability: Decision-making process is often a “black box,” making models hard to interpret.
    • Hallucination: Models may confidently generate false or nonsensical outputs that appear accurate.
    • Toxicity: Without proper safeguards, AI can produce harmful, biased, or offensive content.
    • Creativity: AI-generated content often lacks true originality and may rely on existing patterns.
    • Data Dependency: Quality of outputs depends heavily on training data quality and diversity.
    • Regulation: Legal and ethical concerns surrounding misuse and intellectual property.
    • Latency: Real-time applications may experience delays due to high computational demands.

AI Services

Amazon Bedrock

  • is a fully managed service that offers a choice of industry leading foundation models (FMs) along with a broad set of capabilities needed to build generative AI applications, simplifying development with security, privacy, and responsible AI without the need to manage underlying infrastructure.
  • supports foundation models from Amazon (Nova), Anthropic (Claude), OpenAI (GPT-5.5, GPT-5.4), Meta (Llama), Mistral AI, Cohere, Stability AI, and others.
  • supports custom fine-tuning of FMs using tagged data or by using continued pre-train feature to customize the model using non-tagged data.
  • supports Reinforcement Fine-Tuning (RFT) for open-weight models using OpenAI-compatible APIs (February 2026).
  • supports Retrieval Augmented Generation (RAG) to enhance model responses with real-time, context-specific data retrieval from external knowledge bases.
  • Knowledge Bases
    • Integrate custom datasets to tailor models for specific use cases and improve accuracy.
    • provides access to additional data that helps the model generate more relevant, context-specific, and accurate responses without continually retraining the FM.
    • Managed Knowledge Base (GA June 2026) — a fully managed RAG service that abstracts storage, retrieval, embeddings, re-ranking, and FM selection into a single managed primitive. Includes six native data source connectors (S3, SharePoint, Confluence, Google Drive, OneDrive, Web Crawler), Smart Parsing for automatic multi-format data preparation, and an Agentic Retriever for complex multi-step queries.
    • Supports multimodal retrieval across text, images, audio, and video content.
  • Agents
    • are fully managed capabilities that can help build and deploy intelligent agents to automate workflows and enhance user interactions.
    • can complete complex tasks for a wide range of use cases and deliver up-to-date answers based on proprietary knowledge sources.
  • Amazon Bedrock AgentCore (GA June 2026)
    • Enterprise-grade infrastructure and operations layer for deploying and managing AI agents at scale.
    • Provides a managed harness — orchestration loop, tool execution, context window management, state persistence, failure recovery, and session isolation — all with just two API calls (CreateHarness and InvokeHarness).
    • Works with any framework: LangGraph, LlamaIndex, CrewAI, Strands Agents, and more.
    • Includes AgentCore Gateway for connecting agents to tools, other agents, and models.
    • Supports optimization capabilities that turn production traces into continuous improvement.
    • Integrates with Bedrock Guardrails for real-time evaluation of agent actions and tool calls.
    • Note: AgentCore is now included in the refreshed AIF-C01 exam content.
  • Guardrails
    • help implement safeguards for generative AI applications based on use cases and responsible AI policies.
    • Provides six safeguard types:
      • Content Filters — filter undesirable and harmful content
      • Denied Topics — block conversations on specified topics
      • Word Filters — block specific words and phrases
      • Sensitive Information Filters (PII Redaction) — redacts PII using predefined types or custom regex patterns, masking with placeholders (e.g., {NAME}, {EMAIL})
      • Contextual Grounding Checks — validates responses are grounded in provided context
      • Automated Reasoning Checks (GA August 2025) — uses formal verification methods (mathematical logic) to validate AI outputs against rules and constraints. Provides provably correct, auditable assessment for every request. Delivers up to 99% verification accuracy for hallucination prevention.
    • Prompt Attack Detection — detects prompt injection and jailbreak attempts.
    • InvokeGuardrailChecks API (June 2026) — a new resourceless API that lets you apply individual safeguards at any point in agentic AI applications without creating guardrail resources. Operates in detect-only mode and returns numeric scores.
    • Supports cross-account safeguards with centralized control via AWS Organizations.
  • Model Evaluation
    • Test and evaluate foundation models for performance and accuracy (GA April 2024).
    • Automatic evaluation with predefined metrics (accuracy, robustness, toxicity).
    • Human evaluation workflows for subjective quality assessment.
    • LLM-as-a-judge capability for scalable, human-like evaluation.
    • RAG evaluation capabilities.
    • Compare multiple foundation models side by side.
  • Pricing modes
    • On-Demand Throughput Mode: Automatically scales based on request traffic. Ideal for variable workloads.
    • Provisioned Throughput Mode: Pre-allocate capacity for consistent high-volume workloads. Required for customized fine-tuned models.
  • Responsible AI Support: Tools and guidance to monitor, mitigate, and reduce biases while ensuring fairness and ethical AI use.
  • Security
    • S3 allows storing and managing data securely with fine-grained access controls and encryption.
    • VPC PrivateLink allows operating Bedrock entirely within the VPC, ensuring secure communication without an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection.
  • Scalability and Cost Efficiency: Automatically scales to meet workload demands with a pay-as-you-go pricing model.
  • Model Invocation Logging
    • helps collect invocation logs, model input data, and model output data for all invocations.
    • includes full request data, response data, and metadata associated with all calls.
    • supported destinations include CloudWatch Logs and S3.
  • Redesigned Console (June 2026) — browse the full model catalog (Claude, GPT, open-weight models), compare side by side on capabilities, modality, context window, and quotas in a single view.

Amazon SageMaker

  • SageMaker Unified Studio (GA March 2025)
    • Next-generation unified development environment for data engineers, data scientists, ML developers, and analysts.
    • Breaks down silos by providing a single experience to discover data and AI assets, build analytics and AI artifacts, and collaborate in projects.
    • Includes serverless notebooks with a built-in AI agent and one-click onboarding.
    • Supports notebook scheduling, parameterization, and orchestration directly from the interface.
  • supports Model tracking capability to manage up to thousands of machine learning model experiments
  • supports automatic scaling for production variants dynamically adjusting instances in response to workload changes
  • provides pre-built Docker images for its built-in algorithms and the supported deep learning frameworks used for training & inference
  • SageMaker Inference options:
    • Real-time inference is ideal for online inferences with low latency or high throughput requirements.
    • Serverless Inference is ideal for intermittent or unpredictable traffic patterns.
    • Batch Transform is suitable for offline processing when large amounts of data are available upfront.
    • Asynchronous Inference is ideal for large payloads with long processing times.
  • SageMaker Model deployment allows deploying multiple variants of a model to the same endpoint to test new models.
  • SageMaker Managed Spot training can use spot instances to save cost; Checkpointing saves the state of ML models during training.
  • SageMaker Feature Store — centralized store for features and associated metadata for easy discovery and reuse.
  • SageMaker Debugger provides tools to debug training jobs and resolve problems such as overfitting, saturated activation functions, and vanishing gradients.
  • SageMaker Model Monitor monitors model quality in production and alerts when there are deviations.
  • SageMaker Automatic Model Tuning helps find optimal hyperparameters for an algorithm.
  • SageMaker Data Wrangler reduces time to aggregate and prepare tabular and image data for ML from weeks to minutes.
  • SageMaker Clarify helps detect potential bias and explain model predictions using SHAP analysis.
  • SageMaker Model Governance provides systematic visibility into ML model development, validation, and usage.
  • SageMaker Model Cards — document critical details about ML models for streamlined governance and reporting.
  • SageMaker Autopilot automates the end-to-end process of building, training, tuning, and deploying ML models.
  • SageMaker Neo enables ML models to train once and run anywhere in the cloud and at the edge.
  • SageMaker JumpStart — pre-trained foundation models hub with one-click deployment, fine-tuning, and support for both proprietary and open-source models.
  • SageMaker supports VPC interface endpoints powered by AWS PrivateLink for secure private connectivity.

SageMaker Ground Truth

  • provides automated data labeling using machine learning
  • helps build highly accurate training datasets quickly using Amazon Mechanical Turk
  • provides annotation consolidation to improve the accuracy of data labels by combining multiple workers’ results.
  • automated data labeling uses machine learning to label portions of the data automatically without sending them to human workers

AI Managed Services

  • Amazon Q Business
    • is a fully managed, generative-AI powered assistant that can answer questions, provide summaries, generate content, and complete tasks based on enterprise data.
    • connects to enterprise data sources with existing security and access controls.
  • AWS PartyRock
    • Amazon Bedrock Playground for learning generative AI.
    • No-code app building interface for hands-on experimentation with foundation models.
    • Build apps in minutes with natural language prompts.
    • Free to use for learning and prompt engineering practice.
  • Comprehend — natural language processing (NLP) service to find insights and relationships in text. Identifies language, extracts key phrases, people, brands, events; understands sentiment; organizes text by topic.
  • Lex — provides conversational interfaces using voice and text for building chatbots.
  • Polly — text-to-speech; supports SSML tags and pronunciation lexicons.
  • Rekognition — analyze images and video; identifies objects, people, text, scenes, activities, and inappropriate content.
  • Translate — natural and fluent language translation.
  • Transcribe — automatic speech recognition (ASR) speech-to-text.
  • Kendra — intelligent search service using NLP and ML to return specific answers from your data.
  • Panorama — brings computer vision to on-premises camera networks.
  • Augmented AI (Amazon A2I) — builds workflows for human review of ML predictions.
  • Forecast — highly accurate time-series forecasts.

Security, Identity & Compliance

  • AWS Artifact is a self-service portal for on-demand access to AWS compliance documentation and agreements.
  • SageMaker can read data from KMS-encrypted S3. Make sure KMS key policies include the role attached to SageMaker.
  • AWS Identity and Access Management (IAM) helps securely control access to AWS resources.
  • Amazon Inspector — vulnerability management service that continuously scans workloads for software vulnerabilities and unintended network exposure.

Management & Governance Tools

  • Understand AWS CloudWatch for Logs and Metrics. (hint: SageMaker & Bedrock are integrated with CloudWatch for logs and metrics)
  • CloudTrail records API events, the user who made the call, and the time of the call for monitoring and logging.

Whitepapers and articles

On the Exam Day

  • Make sure you are relaxed and get some good night’s sleep. The exam is not tough if you are well-prepared.
  • If you are taking the AWS Online exam
    • Try to join at least 30 minutes before the actual time as I have had issues with both PSI and Pearson with long wait times.
    • The online verification process does take some time and usually, there are glitches.
    • Remember, you would not be allowed to take the exam if you are late by more than 30 minutes.
    • Make sure you have your desk clear, no hand-watches, or external monitors, keep your phones away, and nobody can enter the room.

AWS AI Architecture & Deep Dives for AIF-C01

Practice Questions

  1. A company needs to deploy AI agents that can autonomously plan multi-step workflows, execute tools, and recover from failures at production scale. Which AWS service provides the infrastructure layer for this?
    1. Amazon Bedrock Agents
    2. Amazon Bedrock AgentCore
    3. Amazon SageMaker Unified Studio
    4. AWS Step Functions
    Show Answer

    Answer: B – Amazon Bedrock AgentCore provides enterprise-grade infrastructure for deploying and managing AI agents at scale, including orchestration, state persistence, and failure recovery.

  2. A financial services company needs mathematically verifiable accuracy for AI-generated compliance reports to prevent hallucinations. Which Amazon Bedrock Guardrails capability should they use?
    1. Content Filters
    2. Contextual Grounding Checks
    3. Automated Reasoning Checks
    4. Sensitive Information Filters
    Show Answer

    Answer: C – Automated Reasoning Checks use formal verification methods (mathematical logic) to validate AI outputs, delivering provably correct and auditable assessments with up to 99% verification accuracy.

  3. An organization wants to apply Bedrock Guardrails safety checks at individual steps in their agentic AI workflow without creating dedicated guardrail resources. Which API should they use?
    1. ApplyGuardrail
    2. InvokeGuardrailChecks
    3. CreateGuardrail
    4. InvokeModel
    Show Answer

    Answer: B – InvokeGuardrailChecks is a resourceless API (June 2026) that lets you apply individual safeguards at any point in agentic AI applications without creating guardrail resources.

  4. A development team wants to build a RAG application with enterprise data from SharePoint, Confluence, and S3 without managing vector storage or retrieval infrastructure. Which service should they use?
    1. Amazon OpenSearch with custom embeddings
    2. Amazon Bedrock Knowledge Bases with custom vector store
    3. Amazon Bedrock Managed Knowledge Base
    4. Amazon Kendra
    Show Answer

    Answer: C – Amazon Bedrock Managed Knowledge Base (GA June 2026) is a fully managed RAG service with native data connectors, managed vector storage, Smart Parsing, and an Agentic Retriever.

  5. Which of the following certifications has AWS retired as of March 31, 2026?
    1. AWS Certified AI Practitioner
    2. AWS Certified Machine Learning Engineer – Associate
    3. AWS Certified Machine Learning – Specialty
    4. AWS Certified Generative AI Developer – Professional
    Show Answer

    Answer: C – AWS Certified Machine Learning – Specialty was retired on March 31, 2026. It has been replaced by the expanded AI/ML certification portfolio including the Generative AI Developer – Professional.

  6. A beginner wants to learn generative AI through hands-on experimentation without writing code or managing infrastructure. Which AWS service should they use?
    1. SageMaker Unified Studio
    2. SageMaker Canvas
    3. AWS PartyRock
    4. Bedrock Console Playground
    Show Answer

    Answer: C – AWS PartyRock is a free, no-code platform for learning generative AI through hands-on experimentation with foundation models and prompt engineering.

Finally, All the Best 🙂