AWS

Prompt Engineering on AWS – Techniques & Best Practices

~ Last updated on : ~ Kiro Agent

What is Prompt Engineering?

Prompt engineering is the practice of designing and optimizing input instructions (prompts) to guide foundation models (FMs) toward generating desired outputs. On AWS, prompt engineering is the first and most cost-effective customization technique — it requires no training, no data labeling, and works with any Bedrock model immediately.

Well-crafted prompts can often achieve results comparable to fine-tuned models for many tasks, at a fraction of the cost and complexity.

Prompt Engineering — Customization Spectrum
Prompt Engineering
No training
Minutes to iterate
$0 upfront
Works with any model
RAG
No training
Hours to set up
Vector store cost
Dynamic knowledge
Fine-tuning
Labeled data needed
Hours-days training
$100s-$1000s
Style/behavior change
Pre-training
Massive data needed
Days-weeks training
$10K-$1M+
New knowledge domain
← Less effort/cost | More effort/cost →

Core Prompt Engineering Techniques

1. Zero-Shot Prompting

Provide only the task instruction without examples. Works best for tasks the model already understands well.

2. Few-Shot Prompting

Include examples of the desired input-output format. This is the most powerful general technique for steering model behavior.

3. Chain-of-Thought (CoT) Prompting

Instruct the model to reason step-by-step before providing a final answer. Critical for complex reasoning, math, and multi-step logic.

4. System Prompts (Persona/Role Assignment)

Define the model’s role, tone, constraints, and output format upfront. This sets consistent behavior across conversations.

5. Output Format Specification

Explicitly define the expected output structure — JSON, XML, markdown, tables, or specific field names.

6. Constraint-Based Prompting

Set explicit boundaries on what the model should and shouldn’t do.

Advanced Techniques

7. Self-Consistency

Generate multiple responses with higher temperature, then select the most common answer. Improves accuracy on reasoning tasks by 5-15%.

8. Retrieval-Augmented Prompting

Inject relevant context from a knowledge base directly into the prompt. This is how RAG works at the prompt level.

9. Tree of Thought (ToT)

Explore multiple reasoning paths and evaluate each before selecting the best one. Useful for complex planning and creative tasks.

10. Prompt Chaining

Break a complex task into sequential simpler prompts, where each step’s output feeds into the next. Bedrock Agents use this pattern automatically.

AWS Tools for Prompt Engineering

Tool Purpose Key Features
Bedrock Playground Interactive prompt testing Compare models side-by-side, adjust parameters, test prompts instantly
Bedrock Prompt Management Version control for prompts Create, version, and manage prompt templates with variables
Bedrock Prompt Flows Visual prompt chaining Build multi-step workflows connecting prompts, conditions, and data
Bedrock Model Evaluation Quantify prompt effectiveness Automatic scoring (ROUGE, BERTScore) + human evaluation workflows
Bedrock Guardrails Safety boundaries Enforce output constraints even when prompts don’t prevent violations

Prompt Engineering Best Practices

  • Be specific and explicit — Vague prompts get vague answers. Specify format, length, style, and constraints.
  • Provide context first — Place background information before the instruction for better comprehension.
  • Use delimiters — Separate instructions from content using XML tags, triple backticks, or markdown headers.
  • Iterate systematically — Change one variable at a time (temperature, examples, instructions) and measure impact.
  • Test across models — A prompt optimized for Claude may need adjustment for Nova or Llama.
  • Use Bedrock Prompt Management — Version your prompts like code; track what changed and why.
  • Set temperature appropriately — Low (0-0.3) for factual/deterministic tasks, higher (0.7-1.0) for creative tasks.
  • Include negative examples — Show the model what NOT to do, especially for edge cases.
  • Use XML tags for structure — Claude models respond particularly well to <context>, <instructions>, <examples> tags.

Model Parameters That Affect Prompt Behavior

Parameter Effect Typical Values
Temperature Controls randomness. Lower = more deterministic. 0 (factual) to 1 (creative)
Top-P Nucleus sampling — only considers tokens within top P% probability mass. 0.1 (focused) to 0.99 (diverse)
Top-K Only considers the top K most likely tokens at each step. 1 (greedy) to 250+
Max Tokens Maximum output length. Set to prevent overly long responses. 100-4096 (task-dependent)
Stop Sequences Strings that signal the model to stop generating. “\n\n”, “Human:”, custom markers

Common Prompt Engineering Patterns for AWS Exams

  • Classification tasks → Few-shot with labeled examples + constrained output (choose from list)
  • Summarization → System prompt with length constraint + “Summarize the following:” prefix
  • Code generation → Provide function signature, docstring, examples of input/output
  • Q&A over documents → RAG pattern — inject context + “Answer based only on the above context”
  • Data extraction → JSON output format specification + examples of desired structure
  • Reducing hallucinations → Add “If you don’t know, say so” + use low temperature + cite sources

AWS Certification Exam Practice Questions

Question 1:

A developer needs an FM to consistently output responses in a specific JSON format with exact field names. The model sometimes adds extra commentary outside the JSON. Which technique is MOST effective?

  1. Increase temperature to allow more creativity
  2. Use few-shot examples showing only JSON output + set a stop sequence after the closing brace
  3. Fine-tune the model on JSON examples
  4. Use Chain-of-Thought prompting
Show Answer

Answer: B – Few-shot examples demonstrate the exact expected format, and stop sequences prevent the model from generating text after the JSON is complete. This is the most effective prompt engineering approach. Fine-tuning would work but is far more expensive and time-consuming for this task. Higher temperature would make output LESS consistent.

Question 2:

A company’s FM gives inconsistent answers to complex math reasoning problems. Some attempts are correct, others are wrong. Without changing the model or fine-tuning, which technique improves accuracy?

  1. Zero-shot prompting with clearer instructions
  2. Self-consistency: generate multiple CoT responses and take majority vote
  3. Reduce temperature to 0
  4. Increase max tokens to allow longer responses
Show Answer

Answer: B – Self-consistency generates multiple reasoning paths (using CoT with moderate temperature) and selects the most common final answer. Research shows this improves accuracy by 5-15% on reasoning tasks. Temperature 0 would be deterministic (always same answer), which doesn’t help if that answer is sometimes wrong.

Question 3:

An enterprise wants to manage prompts across development, staging, and production environments with version control and the ability to roll back. Which AWS service provides this capability?

  1. AWS CodeCommit with prompt files
  2. Amazon Bedrock Prompt Management
  3. AWS Systems Manager Parameter Store
  4. Amazon S3 with versioning enabled
Show Answer

Answer: B – Bedrock Prompt Management provides native prompt versioning, template variables, and API integration. It’s purpose-built for managing prompts across environments with version history and the ability to deploy specific versions. While S3 versioning or CodeCommit could store prompts, they lack the native Bedrock integration and prompt-specific features.

Question 4:

A chatbot using Claude occasionally generates responses that violate company policies despite system prompt instructions. What should be added as a defense-in-depth measure?

  1. More detailed system prompts with explicit rules
  2. Amazon Bedrock Guardrails as a post-generation safety layer
  3. Switch to a different foundation model
  4. Reduce the context window size
Show Answer

Answer: B – Guardrails provide an independent safety layer that evaluates model output regardless of what the prompt says. They enforce denied topics, content filters, and word policies even if the model is manipulated through prompt injection. This is defense-in-depth — prompts guide the model, Guardrails enforce boundaries.

Question 5:

Which combination of inference parameters would be MOST appropriate for a customer support chatbot that needs consistent, factual responses?

  1. Temperature 0.9, Top-P 0.95, Max Tokens 4096
  2. Temperature 0.1, Top-P 0.25, Max Tokens 500
  3. Temperature 0.5, Top-P 0.5, Max Tokens 2048
  4. Temperature 0, Top-K 1, Max Tokens 1000
Show Answer

Answer: B – For factual customer support, low temperature (0.1) ensures consistent, deterministic responses. Low Top-P (0.25) further focuses on the most likely tokens. Limited max tokens prevents overly verbose answers. Temperature 0 with Top-K 1 (greedy decoding) is TOO deterministic and can lead to repetitive outputs; a small amount of randomness (0.1) often produces more natural language.

Related AWS AI Guides

Frequently Asked Questions

What is prompt engineering in AWS?

Prompt engineering on AWS involves crafting effective inputs for Amazon Bedrock foundation models using techniques like few-shot examples, chain-of-thought reasoning, system prompts, and output format specifications. AWS provides tools like Bedrock Playground, Prompt Management, and Prompt Flows for this purpose.

Is prompt engineering enough or do I need fine-tuning?

Start with prompt engineering — it solves 70-80% of use cases. Add RAG if you need domain-specific knowledge. Consider fine-tuning only if you need to change the model’s fundamental behavior, output style, or domain vocabulary in ways that prompting cannot achieve.

Which AWS exam covers prompt engineering?

The AIF-C01 (AI Practitioner) covers prompt engineering fundamentals. The AIP-C01 (Generative AI Developer – Professional) tests advanced prompt engineering extensively including prompt flows, evaluation, and optimization.

RAG Architecture on AWS – Bedrock Knowledge Bases Guide

~ Last updated on : ~ Kiro Agent

What is RAG (Retrieval-Augmented Generation)?

RAG is a technique that enhances Large Language Model (LLM) responses by retrieving relevant information from external data sources before generating an answer. Instead of relying solely on the model’s training data, RAG grounds responses in your actual documents, significantly reducing hallucinations and providing up-to-date, verifiable answers.

RAG solves three critical LLM limitations:

  • Knowledge cutoff — LLMs only know what they were trained on. RAG provides real-time access to current data.
  • Hallucinations — Without grounding, LLMs may generate plausible but incorrect information. RAG cites actual sources.
  • Domain specificity — General models lack your proprietary business knowledge. RAG connects them to your data.
RAG Architecture — End-to-End Flow
Ingestion Pipeline (Offline)
📄 Documents
(S3, Web, Confluence)
→
✂️ Chunking
(Fixed/Semantic/Hierarchical)
→
🔢 Embedding
(Titan/Cohere)
→
📊 Vector Store
(OpenSearch/Aurora/Pinecone)
Query Pipeline (Runtime)
❓ User Query
→
🔢 Embed Query
→
🔍 Vector Search
(Top-K similar)
→
📝 Context + Query
→ Prompt
→
🤖 FM Response
(with citations)

Amazon Bedrock Knowledge Bases — Managed RAG

Amazon Bedrock Knowledge Bases provides fully managed RAG that handles the entire pipeline automatically — ingestion, chunking, embedding, storage, retrieval, and augmented generation. You provide data sources and choose a model; Bedrock handles everything else.

Key Components

  • Data Sources — S3, Confluence, SharePoint, Salesforce, Web Crawler, or Custom via Lambda connector
  • Chunking Strategies — Fixed-size, semantic, hierarchical, or no chunking (for pre-processed data)
  • Parsing — Standard text extraction or Foundation Model parsing (uses Claude to interpret complex layouts, tables, images)
  • Embedding Models — Amazon Titan Embeddings V2, Cohere Embed, or bring your own
  • Vector Stores — Amazon OpenSearch Serverless (default), Aurora PostgreSQL, Pinecone, Redis Enterprise, MongoDB Atlas
  • Foundation Model — Any Bedrock FM for generation (Claude, Nova, Llama, Mistral)

Chunking Strategies Explained

Strategy How It Works Best For
Fixed-size Split at fixed token count (e.g., 512 tokens) with configurable overlap Simple documents, uniform content
Semantic Uses embedding similarity to detect natural topic boundaries Documents with distinct sections/topics
Hierarchical Creates parent (larger) and child (smaller) chunks; retrieves child, returns parent for context Long documents where context around a match matters
No chunking Treats each file as a single chunk Pre-processed data, short documents, FAQs
FM Parsing Uses a foundation model to interpret document layout before chunking Complex documents with tables, charts, images

Advanced RAG Techniques on AWS

Metadata Filtering

Attach metadata to documents (department, date, product, access level) and filter at query time to narrow the search space. This improves relevance and enables access control.

Hybrid Search

Combine vector similarity search (semantic) with keyword search (lexical) for better recall. Bedrock Knowledge Bases supports hybrid search with configurable weighting between semantic and keyword matches.

Query Decomposition

For complex multi-part questions, Bedrock can decompose the query into sub-queries, retrieve relevant chunks for each, and synthesize a comprehensive answer.

Reranking

After initial retrieval, a reranker model (e.g., Cohere Rerank or Amazon Rerank) scores and reorders results by relevance. This improves precision by filtering out semantically similar but contextually irrelevant chunks.

Guardrails Integration

Apply Bedrock Guardrails to RAG responses for content filtering, PII masking, and contextual grounding checks — which verify that the response is actually supported by the retrieved source documents.

RAG vs Fine-tuning vs Prompt Engineering

Approach When to Use Pros Cons
RAG Ground answers in specific documents, real-time data No training needed, data stays current, citable sources Retrieval quality depends on chunking, adds latency
Fine-tuning Teach model a specific style, domain vocabulary, or task format Better task-specific performance, lower inference cost Requires training data, expensive, can become stale
Prompt Engineering Guide model behavior with instructions and examples No training, instant iteration, works with any model Limited by context window, no persistent knowledge

Best practice: Start with prompt engineering, add RAG when you need domain-specific grounding, and fine-tune only when you need a specific output format or style that prompting can’t achieve.

Building RAG — Step by Step

  1. Prepare data — Upload documents to S3 (PDF, HTML, TXT, DOCX, CSV, MD, XLS)
  2. Create Knowledge Base — Choose embedding model, vector store, and chunking strategy
  3. Sync data source — Bedrock ingests, chunks, embeds, and stores vectors
  4. Test with Retrieve API — Verify relevance of retrieved chunks before full RAG
  5. Enable generation — Connect a foundation model for RetrieveAndGenerate API
  6. Add Guardrails — Apply contextual grounding checks to prevent hallucinations
  7. Integrate with Agent — Optionally connect to a Bedrock Agent for multi-step workflows

Cost Optimization

  • Embedding — Titan Embeddings V2 is ~$0.00002/1K tokens (one-time during ingestion + query time)
  • Vector Store — OpenSearch Serverless starts at ~$0.24/hr per OCU pair (consider Aurora PostgreSQL pgvector for lower cost at scale)
  • Generation — Depends on FM choice (Claude Haiku/Nova Micro are cheapest for RAG)
  • Tip: Use metadata filtering to reduce the number of chunks retrieved, lowering both retrieval cost and FM input token cost

AWS Certification Exam Practice Questions

Question 1:

A company’s RAG system retrieves relevant document chunks but the FM sometimes generates answers that contradict the retrieved information. Which Bedrock feature specifically addresses this?

  1. Content filters set to HIGH
  2. Contextual grounding check in Guardrails
  3. Automated Reasoning checks
  4. Denied topics configuration
Show Answer

Answer: B – Contextual grounding checks verify that the FM’s response is faithful to and supported by the retrieved source documents. It detects when the model “hallucinates” information not present in the context. Automated Reasoning uses formal logic for policy-based validation, which is different from source grounding.

Question 2:

A healthcare company has documents containing complex medical tables, embedded diagrams, and multi-column layouts. Standard chunking produces poor-quality chunks that miss table context. Which parsing approach should they use?

  1. Fixed-size chunking with 1024 token overlap
  2. Foundation Model parsing with a customized extraction prompt
  3. Semantic chunking with max tokens set to 2048
  4. No chunking with each page as a single chunk
Show Answer

Answer: B – Foundation Model parsing uses an FM (e.g., Claude) to interpret complex document layouts including tables, charts, and multi-column text before chunking. You can customize the extraction prompt to specify how tables should be serialized. This preserves structural information that standard text extraction would lose.

Question 3:

A legal firm needs their RAG system to only return answers from documents the requesting user has permission to access. Different users have access to different case files. How should they implement this?

  1. Create separate Knowledge Bases per user
  2. Use metadata filtering with user-specific access tags at query time
  3. Implement IAM policies on the vector store
  4. Use Guardrails to filter responses based on user role
Show Answer

Answer: B – Metadata filtering allows you to tag documents with access control metadata (e.g., case_id, department, clearance_level) during ingestion, then pass user-specific filters at query time. This ensures the vector search only returns chunks from documents the user is authorized to access, without duplicating data.

Question 4:

A company’s RAG system returns accurate but overly long answers because it retrieves too many chunks. They want to improve precision without reducing recall. Which technique helps?

  1. Reduce the Top-K parameter from 10 to 3
  2. Apply a reranker model after initial retrieval
  3. Switch from semantic to fixed-size chunking
  4. Increase the embedding model dimensions
Show Answer

Answer: B – A reranker scores and reorders retrieved chunks by contextual relevance. It retrieves broadly (high recall) then filters precisely (high precision). Reducing Top-K would reduce both recall and precision. The reranker keeps recall high while eliminating less-relevant results before they reach the FM.

Question 5:

An enterprise wants to implement RAG with their data in Confluence and SharePoint. They need the knowledge base to stay current as documents are updated. What is the MOST operationally efficient approach?

  1. Export documents to S3 nightly and sync the Knowledge Base on a schedule
  2. Use native Confluence and SharePoint connectors with incremental sync
  3. Build a custom Lambda pipeline to poll for changes and update the vector store
  4. Use Amazon Kendra with connectors and integrate with Bedrock via API
Show Answer

Answer: B – Bedrock Knowledge Bases has native connectors for Confluence, SharePoint, and other sources. These support incremental sync that only processes changed documents, keeping the knowledge base current without full re-ingestion. This is more operationally efficient than building custom pipelines or exporting to S3.

Related AWS AI Guides

Frequently Asked Questions

What is RAG in AWS?

RAG (Retrieval-Augmented Generation) on AWS is implemented through Amazon Bedrock Knowledge Bases. It retrieves relevant information from your data sources (S3, Confluence, SharePoint, web) and provides it as context to a foundation model, grounding responses in your actual data and reducing hallucinations.

How much does RAG cost on AWS?

RAG costs have three components: embedding ($0.00002/1K tokens for Titan V2), vector storage (OpenSearch Serverless from $0.24/hr/OCU pair or Aurora PostgreSQL pgvector), and FM generation (varies by model — Claude Haiku and Nova Micro are cheapest). For most workloads, the FM generation cost dominates.

RAG vs Fine-tuning — which should I use?

Use RAG when you need answers grounded in specific documents that change over time. Use fine-tuning when you need to change the model’s behavior, output format, or domain vocabulary. They can be combined: fine-tune for style, RAG for knowledge.

How do I prevent hallucinations in RAG?

Enable Bedrock Guardrails contextual grounding checks, which verify that the FM’s response is supported by the retrieved source chunks. Also: use higher Top-K for broader retrieval, add reranking for precision, and use hierarchical chunking to provide more context around matches.

Bedrock vs SageMaker – Key Differences, Use Cases & Decision Guide

~ Last updated on : ~ Kiro Agent

Amazon Bedrock vs SageMaker AI – Overview

Amazon Bedrock and Amazon SageMaker AI are AWS’s two primary AI/ML platforms, but they serve fundamentally different purposes. Bedrock is a fully managed generative AI service for building applications with foundation models (FMs), while SageMaker AI is a complete machine learning platform for training, tuning, and deploying custom models.

Bedrock vs SageMaker — Architecture Comparison
Amazon Bedrock
Your Application
↓ API Call
Foundation Models
(Claude, Nova, Titan, Llama)
Knowledge Bases
Agents
Guardrails
No infrastructure • Pay per token
Amazon SageMaker AI
Your Data + Model Code
↓ Training Pipeline
Custom Model
(Train / Fine-tune / Distill)
Endpoints
Pipelines
MLOps
Full control • Pay per compute hour

Key Differences — Bedrock vs SageMaker

Aspect Amazon Bedrock Amazon SageMaker AI
Primary Purpose Build GenAI apps with foundation models Train, tune & deploy custom ML models
Infrastructure Fully managed, serverless Managed compute (you choose instance types)
Models Pre-built FMs (Claude, Nova, Titan, Llama, Mistral) Bring your own model + JumpStart FMs
Customization Fine-tuning, continued pre-training, model distillation Full training from scratch, hyperparameter tuning, custom algorithms
Data Control Data stays in your account, not used for FM training Complete control — your VPC, your storage, your model artifacts
Pricing Pay-per-token (on-demand) or Provisioned Throughput Pay-per-hour for compute instances + storage
Scaling Auto-scales transparently Auto-scaling policies on endpoints
RAG Support Built-in Knowledge Bases with managed vector store Build your own with JumpStart + OpenSearch/Pinecone
Agents Managed Agents with tool use, memory, code interpreter Not built-in (use with LangChain/custom)
Safety Guardrails (content filters, PII, grounding checks, automated reasoning) Model Monitor, Clarify (bias detection, SHAP explainability, FM evaluation, regulatory compliance reports)
MLOps Limited — prompt management, model evaluation Full MLOps — Pipelines, Model Registry, Experiments, Feature Store
Latency Depends on model size and token count Controllable — choose instance type, optimize model
Skill Required Application developers, prompt engineers Data scientists, ML engineers
Unified Studio Access via SageMaker Unified Studio Access via SageMaker Unified Studio

When to Use Amazon Bedrock

  • GenAI applications — Chatbots, content generation, summarization, Q&A systems
  • RAG workloads — Ground FM responses in your enterprise data using Knowledge Bases
  • Agent-based automation — Multi-step workflows that call APIs, query databases, execute code
  • Rapid prototyping — No infrastructure setup, immediate access to state-of-the-art models
  • Content safety is critical — Guardrails provide built-in content filtering, PII masking, and hallucination checks
  • Multi-model strategy — Compare Claude, Nova, Llama, and Mistral without vendor lock-in
  • Serverless preference — No capacity planning, automatic scaling, zero idle costs on-demand

When to Use Amazon SageMaker AI

  • Custom model training — Your use case requires a model trained from scratch on proprietary data
  • High-volume inference — Predictable, high-throughput workloads where dedicated endpoints are cost-effective
  • Traditional ML — Classification, regression, forecasting, anomaly detection, recommendation engines
  • Full MLOps lifecycle — Experiment tracking, model versioning, A/B testing, automated retraining
  • Model optimization — Need quantization, compilation (Neo), or specific hardware (Inferentia, Trainium)
  • Complete data isolation — Compliance requires models running entirely within your VPC
  • Computer vision / NLP — Custom object detection, NER, sentiment models with your labeled data
  • AI is your core product — You’re building differentiated AI capabilities, not consuming generic ones

Using Both Together

Most mature AWS AI deployments use both services together:

  • Train on SageMaker, deploy on Bedrock — Fine-tune a custom model using SageMaker training jobs, then import it into Bedrock for serverless inference via Custom Model Import
  • SageMaker for data prep, Bedrock for generation — Use SageMaker Processing for feature engineering and data transformation, then feed results to Bedrock agents
  • Bedrock for GenAI, SageMaker for traditional ML — Use Bedrock for customer-facing chatbots while SageMaker handles fraud detection, recommendations, and forecasting
  • SageMaker Unified Studio — Both services are accessible from a single interface, making it easy to use them together

Decision Guide — Quick Reference

Your Scenario Choose
Build a chatbot using Claude or Nova Bedrock
Train a fraud detection model on transaction data SageMaker
Answer questions from internal documents (RAG) Bedrock Knowledge Bases
Deploy a custom image classification model SageMaker
Automate multi-step business workflows with AI Bedrock Agents
Run A/B tests between model versions in production SageMaker Endpoints
Generate marketing copy with brand-safe guardrails Bedrock + Guardrails
Build a recommendation engine for an e-commerce site SageMaker (or Personalize)
Process 10M+ inference requests/day at lowest cost SageMaker (dedicated endpoints)
Prototype a GenAI feature in <1 day Bedrock

Pricing Comparison

Model Bedrock (On-Demand) SageMaker (Equivalent)
Low volume (<100K requests/month) ✅ Cheaper — pay per token, zero idle cost ❌ Endpoint runs 24/7 even when idle
High volume (1M+ requests/month) Provisioned Throughput required (committed) ✅ Dedicated endpoints may be cheaper at scale
Batch processing ✅ Batch Inference (50% discount) ✅ Batch Transform jobs
Spiky/unpredictable traffic ✅ Auto-scales with no commitment Serverless Inference available but limited models

SageMaker Unified Studio — The Convergence

As of 2025, AWS introduced SageMaker Unified Studio, which provides a single interface to access both Bedrock and SageMaker capabilities. This includes:

  • Build — Access Bedrock FMs and SageMaker notebooks from one workspace
  • Evaluate — Compare FM performance using built-in evaluation tools
  • Deploy — Manage all model deployments (Bedrock + SageMaker) in one place
  • Govern — Unified model registry, lineage tracking, and access controls (end-to-end from data → model → endpoint, cross-account sharing via RAM, GenAI fine-tuning lineage)

This doesn’t replace either service — it provides a unified entry point. Bedrock remains the fastest path for GenAI, and SageMaker remains the platform for custom ML.

AWS Certification Exam Practice Questions

Question 1:

A startup needs to build a customer support chatbot that answers questions based on their product documentation stored in S3. They want the fastest time-to-production with minimal ML expertise. Which service should they use?

  1. Amazon SageMaker with a fine-tuned LLM
  2. Amazon Bedrock Knowledge Bases with Claude
  3. Amazon Kendra with Amazon Lex
  4. Amazon Comprehend with custom classification
Show Answer

Answer: B – Bedrock Knowledge Bases provides managed RAG with zero infrastructure. It automatically chunks documents from S3, embeds them, stores in a vector database, and retrieves relevant context for the FM to generate responses. This requires no ML expertise and can be production-ready in hours.

Question 2:

A financial services company needs to train a proprietary model on 5 years of transaction data to detect fraud patterns. The model must run within their VPC with no data leaving the account, and they need full control over the training algorithm. Which service is appropriate?

  1. Amazon Bedrock with fine-tuning
  2. Amazon Bedrock Custom Model Import
  3. Amazon SageMaker AI with a custom training job
  4. Amazon Personalize with custom recipes
Show Answer

Answer: C – SageMaker provides full control over training algorithms, runs within your VPC, and supports custom containers. Bedrock fine-tuning is limited to customizing existing FMs and doesn’t support training from scratch. This fraud detection use case requires a custom-trained model, not a fine-tuned FM.

Question 3:

An enterprise uses Amazon Bedrock for their GenAI chatbot but now wants to run A/B tests comparing Claude vs Nova performance in production with 80/20 traffic splits. Which approach should they use?

  1. Bedrock model evaluation with human feedback
  2. SageMaker endpoint with production variants
  3. Bedrock cross-region inference with model selection
  4. Application-level routing with CloudWatch metrics
Show Answer

Answer: D – Bedrock doesn’t natively support traffic splitting between models. The recommended approach is application-level routing (e.g., weighted random selection in your code) combined with CloudWatch custom metrics to compare latency, cost, and quality. SageMaker production variants work for SageMaker-deployed models, not Bedrock API calls.

Question 4:

A company has trained a custom LLM using SageMaker on their proprietary code repository. They now want to serve it through a serverless, pay-per-token API without managing infrastructure. What should they do?

  1. Deploy on SageMaker Serverless Inference
  2. Use Bedrock Custom Model Import
  3. Create a SageMaker Real-time Endpoint with auto-scaling to zero
  4. Use Lambda with the model packaged in a container image
Show Answer

Answer: B – Bedrock Custom Model Import allows you to bring SageMaker-trained models (or any compatible model) into Bedrock for serverless, pay-per-token inference. This gives you the training flexibility of SageMaker with the operational simplicity of Bedrock. SageMaker endpoints don’t scale to zero and require capacity management.

Question 5:

An organization is evaluating AWS AI services for multiple use cases: a customer chatbot, a product recommendation engine, and a document classification system. Which combination is MOST appropriate?

  1. Bedrock for all three use cases
  2. SageMaker for all three use cases
  3. Bedrock for chatbot, SageMaker for recommendations and classification
  4. Bedrock for chatbot and classification, Personalize for recommendations
Show Answer

Answer: D – Bedrock excels at generative tasks (chatbot) and can handle classification via prompt engineering. Amazon Personalize is purpose-built for recommendations with collaborative filtering, real-time personalization, and campaign management — it outperforms general-purpose models for this specific use case. SageMaker would be overkill for chatbot/classification when Bedrock handles them natively.

Related AWS AI Guides

Frequently Asked Questions

Can I use Bedrock and SageMaker together?

Yes. A common pattern is training custom models on SageMaker, then importing them into Bedrock via Custom Model Import for serverless inference. You can also use SageMaker for data processing and feature engineering while using Bedrock for generation tasks.

Is Bedrock replacing SageMaker?

No. They serve different purposes. Bedrock is for consuming foundation models (GenAI), while SageMaker is for building custom ML models. AWS is integrating them via SageMaker Unified Studio, but both services continue to evolve independently.

Which is cheaper — Bedrock or SageMaker?

It depends on volume. Bedrock is cheaper for low-to-moderate, unpredictable workloads (pay-per-token, no idle cost). SageMaker dedicated endpoints become cheaper at very high volumes where a reserved instance running 24/7 costs less than equivalent per-token pricing.

Which certification covers Bedrock vs SageMaker?

The AIF-C01 (AI Practitioner) covers both at a foundational level. The AIP-C01 (Generative AI Developer – Professional) goes deep on Bedrock. The MLA-C01 (Machine Learning Engineer – Associate) focuses on SageMaker. The SAA-C03 and SAP-C02 cover both at an architectural level.

AWS AI Professional (AIP-C01) Exam Learning Path

~ Last updated on : ~ Kiro Agent

AWS Certified Generative AI Developer – Professional (AIP-C01) Overview

The AWS Certified Generative AI Developer – Professional (AIP-C01) is AWS’s professional-level certification for developers who build and deploy production-ready Generative AI solutions. Launched in 2025, this certification validates your ability to integrate foundation models into applications, implement RAG architectures, design agentic AI systems, and operationalize GenAI solutions on AWS.

Exam Detail Information
Exam Code AIP-C01
Full Name AWS Certified Generative AI Developer – Professional
Level Professional
Number of Questions 75 (+ 10 unscored)
Duration 180 minutes
Passing Score 750 / 1000
Cost $300 USD
Format Multiple choice & multiple response
Testing Pearson VUE (center or online proctored)
Languages English, Japanese, Korean, Simplified Chinese
Validity 3 years

Target Candidate Profile

  • 2+ years building production-grade applications on AWS
  • 1+ year hands-on experience implementing Generative AI solutions
  • Experience with AWS compute, storage, networking, and security services
  • Understanding of AWS deployment, IaC tools, and monitoring services
  • Familiarity with AI/ML concepts and data engineering

Recommended prior certifications (not required): AWS Certified AI Practitioner (AIF-C01), AWS Solutions Architect Associate, AWS Machine Learning Engineer Associate

AIP-C01 Exam Domains & Weightings

Domain Weight Key Topics
Domain 1: Foundation Model Integration, Data Management & Compliance 31% RAG implementation, vector stores, prompt engineering, FM selection & customization, data pipelines
Domain 2: Implementation & Integration 26% Agentic AI, tool integrations, model deployment, enterprise integration, CI/CD, troubleshooting
Domain 3: AI Safety, Security & Governance 20% Data privacy, model security, Guardrails, responsible AI, compliance, access control
Domain 4: Operational Efficiency & Optimization 12% Cost optimization, performance tuning, scaling, monitoring, A/B testing
Domain 5: Testing, Validation & Troubleshooting 11% Model evaluation metrics, benchmarking, quality assurance, debugging

Domain 1: Foundation Model Integration, Data Management & Compliance (31%)

This is the largest domain and covers the core of building GenAI solutions on AWS.

Key Topics

  • Solution Design: Architecture design using FMs, proof-of-concept implementations, Well-Architected Framework GenAI Lens
  • FM Selection & Configuration: Model benchmarking, cross-region inference, fine-tuning (LoRA, adapters), model lifecycle management via SageMaker Model Registry
  • Data Pipelines: Data validation workflows (AWS Glue Data Quality), multimodal data processing, input formatting for FM inference
  • Vector Stores: Vector database architecture (OpenSearch, Aurora pgvector, Bedrock Knowledge Bases), metadata frameworks, embedding solutions (Amazon Titan Embeddings)
  • Retrieval Mechanisms (RAG): Document chunking strategies, hybrid search (keyword + vector), reranking models, query expansion & decomposition
  • Prompt Engineering & Governance: Amazon Bedrock Prompt Management, parameterized templates, prompt flows, chain-of-thought patterns, quality assurance

AWS Services to Study

Domain 2: Implementation & Integration (26%)

This domain focuses on building production systems with agentic AI and enterprise integrations.

Key Topics

  • Agentic AI: Bedrock Agents, Strands Agents, AWS Agent Squad, MCP (Model Context Protocol), ReAct patterns, multi-agent systems
  • Tool Integrations: Function calling, MCP servers (Lambda & ECS), custom tool behaviors, error handling
  • Model Deployment: Lambda for on-demand inference, Bedrock provisioned throughput, SageMaker endpoints, container-based deployment
  • Enterprise Integration: API Gateway, EventBridge event-driven architectures, CI/CD pipelines (CodePipeline, CodeBuild), GenAI gateway architectures
  • Troubleshooting: Context window overflow, prompt debugging, retrieval system diagnostics, embedding drift monitoring

AWS Services to Study

  • Amazon Bedrock Agents – Autonomous AI agents with tool use
  • Amazon Q Developer – AI-powered development assistant
  • AWS Step Functions – Workflow orchestration for AI pipelines
  • AWS Lambda – Serverless inference, MCP servers
  • Amazon API Gateway – Enterprise API integrations
  • AWS CodePipeline / CodeBuild – CI/CD for GenAI

Domain 3: AI Safety, Security & Governance (20%)

Security and responsible AI are critical at the professional level.

Key Topics

  • Data Privacy: Data encryption (at rest/in transit), PII detection and redaction, data residency compliance
  • Model Security: IAM least-privilege access to FMs, identity federation, role-based access control
  • Guardrails: Amazon Bedrock Guardrails – content filtering, topic denial, PII redaction, grounding checks
  • Responsible AI: Bias detection, fairness evaluation, transparency, human-in-the-loop workflows
  • Compliance: Cross-jurisdiction deployments (Outposts, Wavelength), audit logging (CloudTrail), governance frameworks

AWS Services to Study

  • Amazon Bedrock Guardrails – Content filtering, responsible AI controls
  • AWS IAM – Fine-grained access control for AI services
  • AWS CloudTrail – Audit logging for AI operations
  • AWS KMS – Encryption key management
  • Amazon Macie – PII detection in data stores

Domain 4: Operational Efficiency & Optimization (12%)

Key Topics

  • Cost Optimization: Model cascading (smaller models for simple tasks), provisioned throughput vs. on-demand, right-sizing
  • Performance Tuning: Latency optimization, token processing capacity, GPU utilization
  • Scaling: Auto-scaling SageMaker endpoints, Bedrock cross-region inference, load balancing
  • Monitoring: CloudWatch metrics for AI workloads, observability pipelines (X-Ray), drift detection

Domain 5: Testing, Validation & Troubleshooting (11%)

Key Topics

  • Model Evaluation: Relevance scoring, hallucination detection, semantic drift, RAGAS metrics
  • Agent Evaluation: Task completion rates, tool usage effectiveness, Amazon Bedrock Agent evaluations
  • Retrieval Quality: Context matching verification, retrieval latency, embedding quality diagnostics
  • Deployment Validation: A/B testing, canary deployments, synthetic user workflows, automated quality checks

Recommended Study Resources

Video Courses

Course Platform Notes
Ultimate AWS Certified Generative AI Developer Professional by Stephane Maarek Udemy Comprehensive course with hands-on labs and 75-question practice exam
AWS Certified Generative AI Developer Professional AIP-C01 Udemy Security, governance, cost optimization focus
Exam Prep: AWS Certified Generative AI Developer AWS Skill Builder Official AWS exam prep (free with subscription)
Generative AI Developer Professional KodeKloud Hands-on labs with AWS sandbox environments

Practice Tests

Resource Platform Questions
[Practice Exams] AWS Certified Generative AI Developer Pro by Stephane Maarek & Abhishek Singh Udemy Multiple full-length exams with explanations
AWS Certification Official Practice Question Set AWS Skill Builder 20 official questions (free)
AWS Certification Official Pretest AWS Skill Builder Full-length readiness assessment
Whizlabs AIP-C01 Practice Tests Whizlabs Multiple practice exams with explanations

Documentation & Reading

10-Week Study Plan

Week Focus Area Activities
Week 1 Exam Overview & Foundations Read exam guide, review AI Services Cheat Sheet, understand all 5 domains and weightings
Week 2 Amazon Bedrock Core Study Amazon Bedrock, FM selection, model invocation APIs, Nova models, Titan Embeddings
Week 3 RAG & Vector Stores Study Bedrock Knowledge Bases, chunking strategies, OpenSearch vector search, hybrid search, reranking
Week 4 Prompt Engineering & Fine-tuning Bedrock Prompt Management, Prompt Flows, chain-of-thought, LoRA fine-tuning, SageMaker model customization
Week 5 Agentic AI & Tool Integration Study Bedrock Agents, Strands Agents, MCP, function calling, multi-agent orchestration, ReAct patterns
Week 6 Enterprise Integration & Deployment API Gateway integration, Step Functions workflows, CI/CD for GenAI (CodePipeline), container deployment patterns, Q Developer
Week 7 Security, Governance & Responsible AI Bedrock Guardrails, IAM for AI services, data privacy, PII handling, compliance, responsible AI practices
Week 8 Optimization & Monitoring Cost optimization (model cascading, provisioned throughput), performance tuning, CloudWatch metrics, X-Ray observability
Week 9 Testing, Evaluation & Troubleshooting Model evaluation metrics, agent evaluations, retrieval quality testing, deployment validation, debugging GenAI apps
Week 10 Review & Practice Exams Take 2-3 full practice exams, review weak areas, re-read exam guide, focus on scenario-based questions

Study Tips

  • Hands-on practice is essential – This is a professional-level exam; build actual RAG pipelines and deploy agents on AWS
  • Focus on Domain 1 & 2 – Together they represent 57% of the exam
  • Understand scenario-based questions – Questions are long and test architectural decision-making, not memorization
  • Know the trade-offs – When to use Bedrock vs. SageMaker, on-demand vs. provisioned throughput, different chunking strategies
  • Practice with time management – 180 minutes for 75 complex questions means ~2.4 minutes per question

AIP-C01 Practice Questions

Question 1

A company is building a customer support chatbot using Amazon Bedrock. The chatbot needs to answer questions based on 50,000 internal product documents that are updated weekly. The solution must minimize hallucinations and provide source citations. Which architecture best meets these requirements?

  1. Fine-tune a foundation model on all product documents monthly
  2. Use Amazon Bedrock Knowledge Bases with automatic chunking, vector store synchronization, and source attribution enabled
  3. Include all product documents in the system prompt for each request
  4. Train a custom model using Amazon SageMaker with the product documents as training data
Show Answer

Answer: B – Amazon Bedrock Knowledge Bases provides managed RAG with automatic document chunking, scheduled sync for weekly updates, vector store management, and built-in source attribution. Fine-tuning (A/D) doesn’t provide up-to-date factual recall, and including all documents in the prompt (C) exceeds context window limits.

Question 2

A developer is implementing an agentic AI solution that needs to query a company’s internal database, call external APIs, and generate reports. The solution must handle failures gracefully and maintain conversation state. Which combination of services should be used? (Select TWO)

  1. Amazon Bedrock Agents with action groups and Lambda functions
  2. Amazon Comprehend with custom entity recognition
  3. Amazon DynamoDB for conversation history and session state
  4. Amazon Kinesis Data Streams for real-time processing
  5. Amazon Rekognition for document analysis
Show Answer

Answer: A, C – Bedrock Agents with action groups handle tool orchestration (database queries, API calls) with built-in error handling and ReAct reasoning. DynamoDB stores conversation history for state management. Comprehend (B), Kinesis (D), and Rekognition (E) don’t address the agentic workflow requirements.

Question 3

An organization needs to ensure their GenAI application does not generate responses about competitor products, does not reveal PII from training data, and stays within approved topic boundaries. Which approach provides the MOST comprehensive solution?

  1. Implement input validation using AWS Lambda functions
  2. Configure Amazon Bedrock Guardrails with denied topics, PII filters, and content filters
  3. Use system prompts to instruct the model to avoid certain topics
  4. Fine-tune the model to remove knowledge about competitors
Show Answer

Answer: B – Amazon Bedrock Guardrails provides configurable denied topics, automated PII detection/redaction, and content filters that work at both input and output levels. System prompts (C) can be bypassed through prompt injection. Lambda validation (A) only handles input. Fine-tuning (D) cannot reliably remove specific knowledge.

Question 4

A team has deployed a GenAI application using Amazon Bedrock. After launch, they notice that response latency increases during peak hours and costs are 3x their budget. The application handles both simple FAQ queries and complex analytical questions. What is the MOST cost-effective optimization strategy?

  1. Switch all requests to the largest available model for better performance
  2. Implement model cascading: route simple queries to a smaller/cheaper model and complex queries to a larger model using a classification layer
  3. Purchase provisioned throughput for the maximum expected load
  4. Cache all responses in Amazon ElastiCache and serve cached answers for all queries
Show Answer

Answer: B – Model cascading routes simple queries to smaller, faster, cheaper models while reserving larger models for complex tasks. This optimizes both cost and latency. Using only the largest model (A) increases cost. Maximum provisioned throughput (C) over-provisions for average load. Caching all responses (D) doesn’t work for analytical questions requiring unique answers.

Question 5

A developer is building a RAG application and notices that retrieved documents are often irrelevant, leading to poor response quality. The documents are technical manuals with hierarchical structure (chapters, sections, subsections). Which combination of improvements will MOST effectively address retrieval quality? (Select TWO)

  1. Increase the chunk size to 10,000 tokens to capture more context
  2. Implement hierarchical chunking that preserves document structure and parent-child relationships
  3. Use hybrid search combining semantic vector search with keyword-based BM25 scoring
  4. Reduce the number of retrieved documents to 1 to increase precision
  5. Switch from vector search to simple keyword search
Show Answer

Answer: B, C – Hierarchical chunking preserves the document structure, maintaining context relationships between sections. Hybrid search combines the semantic understanding of vector search with the precision of keyword matching, improving relevance for technical content. Very large chunks (A) reduce precision. Only 1 document (D) may miss relevant information. Keyword-only search (E) loses semantic understanding.

Related Posts

References

Frequently Asked Questions

What is the AIP-C01 exam?

The AWS Certified AI Practitioner Professional (AIP-C01) validates ability to build, deploy, and operationalize generative AI solutions on AWS. It covers RAG implementation, agent design, MLOps, model security, and evaluation — requiring hands-on experience with Bedrock, SageMaker, and related services.

How does AIP-C01 differ from AIF-C01?

AIF-C01 (AI Practitioner) is foundational — testing conceptual knowledge of AI/ML. AIP-C01 (AI Professional) is advanced — testing hands-on ability to implement Gen AI solutions, fine-tune models, build agents, deploy with MLOps pipelines, and secure AI applications.

What experience do I need for AIP-C01?

AWS recommends 2+ years of hands-on experience building ML/Gen AI solutions on AWS, including working with Bedrock, SageMaker, and implementing RAG, fine-tuning, and agent architectures in production.

S3 vs EBS vs EFS – AWS Storage Services Compared

~ Last updated on : ~ Kiro Agent

AWS S3 vs EBS vs EFS – Storage Services Compared

  • AWS provides three primary storage services: S3 (object storage), EBS (block storage), and EFS (file storage).
  • Each serves different use cases — choosing the right one depends on access patterns, performance requirements, and cost constraints.
  • Understanding the differences is critical for both architecture decisions and AWS certification exams (SAA-C03, SAP-C02).
AWS Storage — Access Pattern Comparison
S3 (Object)
App 1 → API →
App 2 → API →
Lambda → API →
S3 Bucket
(Unlimited)
Any # of clients via HTTP
EBS (Block)
EC2 Instance
↕ attached
EBS Volume
(1 GiB-64 TiB)
1 instance (same AZ)
EFS (File/NFS)
EC2 (AZ-1) →
EC2 (AZ-2) →
Lambda →
EFS Mount
(Auto-scales)
1000s clients (cross-AZ)

S3 vs EBS vs EFS Comparison Table

Feature Amazon S3 Amazon EBS Amazon EFS
Storage Type Object storage Block storage File storage (NFS)
Access Pattern HTTP/HTTPS API (any number of clients) Single EC2 instance (Multi-Attach for io1/io2 up to 16) Multiple EC2/ECS/Lambda (1000s concurrent)
Protocol REST API, S3 API Block device (like a hard drive) NFSv4.1
Capacity Unlimited (5 TB per object) 1 GiB – 64 TiB per volume Unlimited (automatic scaling)
Durability 99.999999999% (11 nines) 99.999% (within AZ) 99.999999999% (11 nines)
Availability 99.99% (Standard) 99.999% (io2 Block Express) 99.99% (Standard), 99.9% (One Zone)
Scope Regional (across AZs) Single AZ (snapshots are Regional) Regional (across AZs) or One Zone
Performance – Latency Milliseconds (first byte) Sub-millisecond (io2/gp3) Low milliseconds
Performance – IOPS 3,500+ PUT/s, 5,500+ GET/s per prefix Up to 256,000 (io2 Block Express) 500,000+ read IOPS (Elastic Throughput)
Performance – Throughput Aggregate scales with prefixes Up to 4,000 MiB/s (io2 Block Express) Up to 10+ GiB/s (Elastic Throughput)
Storage Classes/Types Standard, IA, One Zone-IA, Glacier IR, Glacier Flexible, Glacier Deep, Express One Zone gp3, gp2, io2 Block Express, io1, st1, sc1 Standard, Infrequent Access, Archive (with Intelligent-Tiering)
Pricing Model Per GB stored + requests + data transfer Per GB provisioned + IOPS (io1/io2) Per GB used (pay for what you store)
Cost (approx. US East) $0.023/GB (Standard) $0.08/GB (gp3) $0.30/GB (Standard), $0.016/GB (IA)
Encryption SSE-S3, SSE-KMS, SSE-C, client-side AES-256 (KMS or EBS-managed) At rest (KMS) + in transit (TLS)
Backup Versioning, Cross-Region Replication, S3 Batch Snapshots (incremental, to S3) AWS Backup, EFS-to-EFS replication
Cross-Region CRR, Multi-Region Access Points Snapshot copy to other Regions EFS Replication (async, RPO minutes)
OS Integration Not mountable as filesystem (use S3 Mountpoint for read-heavy) Mount as block device (format with ext4/xfs) Mount as NFS filesystem
Modify on Write No (replace entire object) Yes (modify bytes in place) Yes (modify files in place)
Use With Any AWS service, internet, on-premises EC2 only EC2, ECS, EKS, Lambda, on-premises (DataSync)

When to Use Each

Use S3 when:

  • Storing unlimited objects (media, logs, backups, data lakes)
  • Static website hosting
  • Data needs to be accessed by multiple services/applications via API
  • Long-term archival (Glacier classes)
  • Analytics/ML training data
Use EBS when:

  • Boot volumes for EC2 instances
  • Databases requiring low-latency block I/O (RDS, self-managed DBs)
  • Applications needing consistent sub-millisecond latency
  • High-IOPS transactional workloads
  • Single-instance access pattern
Use EFS when:

  • Shared filesystem across multiple EC2 instances/containers
  • Content management systems (WordPress, Drupal)
  • Home directories for development teams
  • Machine learning training data (shared across instances)
  • Container storage (ECS/EKS persistent volumes)
  • Lambda function storage (/mnt mount)

Pricing Comparison (US East-1)

Scenario S3 EBS EFS
1 TB stored (monthly) $23.55 (Standard) $81.92 (gp3) $307.20 (Standard) or $16.40 (IA)
1 TB infrequent access $12.50 (S3 IA) $45.00 (sc1) $16.40 (EFS IA)
1 TB archive $3.60 (Glacier IR) N/A $8.00 (EFS Archive)
High IOPS (50K) N/A $3,250/month (io2) Included (Elastic)

Common Architecture Patterns

  • Web Application: EBS for database, EFS for shared media/uploads, S3 for static assets via CloudFront
  • Data Lake: S3 for raw/processed data, EBS for compute nodes, EFS for shared notebooks
  • Containers (EKS/ECS): EFS for shared persistent volumes, EBS for StatefulSet per-pod storage, S3 for artifacts
  • Machine Learning: S3 for training data, EFS for shared model artifacts, EBS for GPU instance local storage

Key Differences Summary

  • S3 is cheapest for large-scale storage but has higher latency and no in-place modification
  • EBS is fastest (sub-ms latency) but limited to single AZ and single instance (unless Multi-Attach)
  • EFS is most flexible for shared access but most expensive per GB for frequently accessed data
  • All three support encryption at rest and in transit
  • S3 and EFS have 11 nines durability; EBS has 5 nines (use snapshots for DR)

Practice Questions

Question 1

A company runs a containerized application on EKS that requires a shared filesystem accessible by all pods across multiple Availability Zones. The data includes ML model artifacts that are written once and read frequently. Which storage solution is most appropriate?

Show Answer

Answer: – Amazon EFS with Infrequent Access lifecycle policy. EFS provides NFS-compatible shared storage across AZs, accessible by all pods. The lifecycle policy moves infrequently accessed files to IA tier automatically, reducing costs for write-once-read-occasionally patterns.

Question 2

An application requires 100,000 IOPS with sub-millisecond latency for a self-managed Oracle database running on a single EC2 instance. Which storage option should be used?

Show Answer

Answer: – Amazon EBS io2 Block Express. It provides up to 256,000 IOPS with sub-millisecond latency, designed for critical database workloads requiring consistent high performance on a single instance.

Question 3

A media company needs to store 500 TB of video files that are accessed via a web application and CDN. Files are never modified after upload. Which is the most cost-effective solution?

Show Answer

Answer: – Amazon S3 Standard with CloudFront distribution. S3 provides unlimited scalable object storage at $0.023/GB, supports direct CDN integration, and its immutable object model matches the write-once pattern. Cost: ~$11,750/month vs ~$40,000 (EBS) or $150,000 (EFS).

Question 4

A development team needs shared storage for home directories accessible from multiple EC2 instances. Storage usage varies between 100 GB and 2 TB monthly. Which option provides the best cost efficiency?

Show Answer

Answer: – Amazon EFS with Elastic Throughput and Intelligent-Tiering. EFS automatically scales capacity (no provisioning needed), and Intelligent-Tiering moves infrequently accessed files to cheaper tiers automatically. You only pay for what you use.

Question 5

An application stores user-uploaded images that must be accessible from any AWS Region with low latency. Which storage configuration provides this?

Show Answer

Answer: – Amazon S3 with Multi-Region Access Points (MRAP) or Cross-Region Replication. S3 MRAP routes requests to the nearest replicated bucket automatically, providing low-latency global access. EBS and EFS are regional services and cannot natively serve content globally.

Related Posts

What About Amazon FSx?

While S3, EBS, and EFS cover most use cases, Amazon FSx provides fully managed file systems for specialized workloads:

  • FSx for Lustre — High-performance parallel file system for HPC, ML training, and media processing (sub-ms latency, 100s of GB/s throughput)
  • FSx for Windows File Server — Fully managed Windows-native file shares with SMB protocol, Active Directory integration
  • FSx for NetApp ONTAP — Multi-protocol (NFS, SMB, iSCSI) enterprise storage with snapshots, cloning, and tiering
  • FSx for OpenZFS — High-performance file system with snapshots, compression, and up to 1M IOPS

When to choose FSx over EFS: Choose FSx when you need Windows compatibility (FSx for Windows), HPC-grade throughput (Lustre), or advanced enterprise features like data deduplication and multi-protocol access (ONTAP).

📖 For a detailed FSx comparison, see AWS S3 vs EBS vs EFS vs FSx – Complete Storage Guide.

Frequently Asked Questions

What is the difference between S3, EBS, and EFS?

S3 is object storage (unlimited, accessed via API). EBS is block storage (attached to single EC2, low-latency like a hard drive). EFS is file storage (NFS shared across multiple instances). Choose based on access pattern: API access → S3, single-instance database → EBS, shared filesystem → EFS.

Which AWS storage service is cheapest?

S3 Standard is cheapest at $0.023/GB/month for frequently accessed data. EBS gp3 costs $0.08/GB. EFS Standard costs $0.30/GB but with Intelligent-Tiering and IA classes, effective cost can drop to $0.016/GB for infrequently accessed files.

Can EBS be shared across multiple instances?

EBS Multi-Attach (io1/io2 only) allows up to 16 EC2 instances in the same AZ to access a single volume simultaneously. For true multi-AZ shared storage, use EFS instead.

Related Topics

References

AWS Security Specialty (SCS-C03) Exam Learning Path

~ Last updated on : ~ Kiro Agent

AWS Certified Security – Specialty (SCS-C03) Exam Learning Path

The AWS Certified Security – Specialty (SCS-C03) exam validates advanced security skills for designing and implementing AWS security solutions. This updated version went live on December 2, 2025, replacing the SCS-C02. This comprehensive learning path covers everything you need to pass the exam — domains, study resources, an 8-week study plan, exam topics with links, and practice questions.

SCS-C03 Exam Overview

Detail Value
Exam Code SCS-C03
Format 65 questions (multiple-choice, multiple-response, ordering, matching)
Duration 170 minutes
Passing Score 750 / 1000
Cost $300 USD
Delivery Pearson VUE (testing center or online)
Prerequisite None required (5+ years security experience recommended)
Live Since December 2, 2025

Refer to the AWS Certified Security – Specialty (SCS-C03) Exam Guide

SCS-C03 Exam Domains

Domain Weight Key Topics
Domain 1: Detection 16% GuardDuty, Security Hub, Detective, CloudTrail, VPC Flow Logs, Security Lake (OCSF)
Domain 2: Incident Response 14% Automated remediation, forensics, containment, AWS Security Incident Response
Domain 3: Infrastructure Security 18% VPC, Network Firewall, WAF, Verified Access, Firewall Manager, Shield
Domain 4: Identity and Access Management 20% IAM policies, Verified Permissions/Cedar, Identity Center, SCPs, RCPs, Cognito
Domain 5: Data Protection 18% KMS, CloudHSM, ACM, inter-node encryption, data masking, Bedrock Guardrails
Domain 6: Security Foundations & Governance 14% Organizations, Control Tower, Config, compliance frameworks, AWS Audit Manager

What’s New in SCS-C03 vs SCS-C02

Key Changes in SCS-C03

  • Generative AI Security — Amazon Bedrock Guardrails, OWASP LLM Top 10 protections, AgentCore security, and SageMaker AI model protection are now in scope.
  • OCSF & Security Lake — Open Cybersecurity Schema Framework (OCSF) normalization and Amazon Security Lake for centralized security data analytics.
  • IAM Weight Increased — Domain 4 (IAM) increased from 16% to 20%, reflecting identity as the new security perimeter.
  • SNS/CloudWatch Data Protection — Data masking policies for CloudWatch Logs and Amazon SNS message data protection.
  • Inter-node Encryption — Encryption in-transit between nodes for Amazon EMR, EKS, SageMaker AI, and Nitro enclaves.
  • AWS Verified Access — Zero-trust network access without VPNs now explicitly tested.
  • Amazon Verified Permissions & Cedar — Fine-grained authorization using Cedar policy language with RBAC and ABAC models.
  • Domain Restructuring — Detection and Incident Response are now separate domains; “Management and Security Governance” renamed to “Security Foundations & Governance.”
  • New Question Types — Ordering (arrange steps in sequence) and matching (match services to functions) alongside traditional multiple-choice.

Recommended Study Resources

Online Courses

Practice Tests

AWS Official Resources

Whitepapers & Cheat Sheets

8-Week Study Plan

This plan assumes 1.5–2 hours of study per day. Adjust timelines based on your existing AWS security experience.

Week Focus Area Activities
Week 1 IAM Foundations (Domain 4)
  • IAM policies (identity-based, resource-based, permission boundaries)
  • IAM Access Analyzer, policy evaluation logic
  • SCPs, RCPs, and Declarative Policies
  • Hands-on: Write and test IAM policies with conditions
Week 2 Advanced IAM & Identity (Domain 4)
  • IAM Identity Center (SSO), federation (SAML, OIDC)
  • Amazon Verified Permissions & Cedar policy language
  • Cognito User Pools & Identity Pools
  • Cross-account access patterns, role chaining
  • Hands-on: Configure Verified Permissions with Cognito
Week 3 Data Protection (Domain 5)
  • KMS (key policies, grants, multi-region keys, imported key material, XKS)
  • Envelope encryption, S3 encryption options
  • CloudHSM, ACM, Private CA
  • Inter-node encryption (EMR, EKS, SageMaker, Nitro)
  • Data masking: CloudWatch Logs data protection, SNS message data protection
  • Hands-on: Create KMS keys with custom policies, enable S3 default encryption
Week 4 Infrastructure Security (Domain 3)
  • VPC security: Security Groups, NACLs, VPC endpoints, Flow Logs
  • AWS Network Firewall (stateful/stateless rules, IDS/IPS)
  • AWS WAF (Web ACLs, rate-based rules, managed rule groups)
  • AWS Verified Access (zero-trust without VPN)
  • Firewall Manager for centralized management
  • Shield & Shield Advanced, DDoS mitigation
  • Hands-on: Deploy Network Firewall with custom rules
Week 5 Detection (Domain 1)
  • GuardDuty (runtime monitoring, extended threat detection, malware protection)
  • Amazon Detective (behavior graphs, investigation)
  • Amazon Security Lake & OCSF format
  • Security Hub (controls, standards, cross-region aggregation)
  • CloudTrail (Lake, Insights, organization trails)
  • CloudWatch alarms, metric filters, anomaly detection
  • Hands-on: Enable GuardDuty with EKS runtime monitoring, query Security Lake
Week 6 Incident Response & GenAI Security (Domains 2 & 5)
  • AWS Security Incident Response service
  • Automated remediation (EventBridge → Lambda/Step Functions)
  • Forensics: EBS snapshots, memory dumps, isolated VPCs
  • Amazon Bedrock Guardrails (content filters, denied topics, PII detection)
  • OWASP LLM Top 10 (prompt injection, data poisoning, model DoS)
  • AgentCore security controls
  • Hands-on: Build automated remediation for GuardDuty findings
Week 7 Governance & Review (Domain 6)
  • AWS Organizations, Control Tower, landing zones
  • AWS Config rules and remediation
  • AWS Audit Manager, Artifact
  • Well-Architected Security Pillar review
  • Multi-account security strategies
  • Review all domains — focus on weak areas identified in practice tests
  • Take first full-length practice exam (target: 70%+)
Week 8 Practice Exams & Final Review
  • Take 2–3 full-length practice exams (target: 80%+ consistently)
  • Review incorrect answers — identify knowledge gaps
  • Re-read AWS FAQs for GuardDuty, KMS, IAM, Security Hub
  • Review ordering/matching question formats
  • Light review on exam day — no cramming

Pro tip: Start with IAM and KMS because they appear across every domain. If you’re scoring below 75% on practice exams by Week 7, extend to 10 weeks.

Exam Topics & Related Posts

Domain 1: Detection (16%)

  • AWS ALB – Application Load Balancer Features & Routing Rules
  • Amazon GuardDuty — Threat detection using CloudTrail, VPC Flow Logs, DNS logs, EKS audit logs. Covers runtime monitoring, extended threat detection, and malware protection.
  • Amazon Detective — Security investigation using behavior graphs from CloudTrail, VPC Flow Logs, and GuardDuty findings.
  • AWS Security Hub — Centralized security posture management, automated compliance checks (CIS, PCI DSS, AWS Foundational), and cross-account/cross-region aggregation.
  • Amazon Security Lake — Centralizes security data in OCSF format from AWS services, SaaS providers, and on-premises sources for security analytics.
  • AWS CloudTrail — Audit logging, CloudTrail Lake for SQL-based event querying, Insights for anomaly detection, organization trails.
  • Amazon CloudWatch — Metric filters, alarms, anomaly detection, CloudWatch Logs with data protection policies for sensitive data masking.
  • Amazon Inspector — Automated vulnerability scanning for EC2, ECR containers, and Lambda functions.
  • Amazon Macie — ML-powered sensitive data discovery and classification in S3.

Domain 2: Incident Response (14%)

  • AWS Security Incident Response — Automated triage of GuardDuty and Security Hub findings, AI-powered investigation, containment, and 24/7 CIRT access.
  • Automated Remediation Patterns:
    • GuardDuty → EventBridge → Lambda (isolate instance, revoke credentials)
    • Config Rule → EventBridge → Systems Manager Automation (remediate non-compliant resources)
    • Security Hub → EventBridge → Step Functions (multi-step workflows)
  • Forensics: EBS snapshot isolation, memory acquisition, VPC isolation for compromised instances, CloudTrail Lake investigation.
  • AWS Config — Resource configuration history, compliance rules, and automated remediation.

Domain 3: Infrastructure Security (18%)

  • AWS VPC — Security Groups, NACLs, VPC endpoints (Gateway & Interface/PrivateLink), VPC Flow Logs, VPC peering, Transit Gateway.
  • AWS Network Firewall — Stateful/stateless inspection, IDS/IPS, Suricata-compatible rules, centralized deployment via Firewall Manager.
  • AWS WAF — Web ACLs, managed rule groups, rate-based rules, Bot Control, Fraud Control (Account Takeover/Creation), IP reputation lists.
  • Network Firewall vs WAF vs Security Groups vs NACLs — Understanding when to use each layer.
  • Network Firewall vs Gateway Load Balancer — Choosing between AWS-managed and third-party appliances.
  • AWS Verified Access — Zero-trust access to corporate applications without VPN, evaluating requests against security policies in real-time.
  • AWS Firewall Manager — Centrally configure WAF, Shield Advanced, Security Groups, Network Firewall, and DNS Firewall rules across Organizations.
  • AWS Shield & Shield Advanced — DDoS protection for CloudFront, Route 53, ALB, and Global Accelerator.
  • AWS VPN — Site-to-site VPN, IPSec encryption, VPN over Direct Connect.

Domain 4: Identity and Access Management (20%)

  • AWS IAM Overview — Users, groups, roles, and policy evaluation logic.
  • IAM Access Management — Identity-based policies, resource-based policies, permission boundaries, session policies.
  • IAM Roles — Cross-account access, service roles, role chaining, confused deputy protection.
  • IAM Federation — SAML 2.0, OIDC, custom identity brokers.
  • IAM Best Practices — Least privilege, MFA enforcement, credential rotation.
  • Amazon Verified Permissions — Fine-grained authorization using Cedar policy language, supporting RBAC and ABAC models, integrating with Cognito and API Gateway.
  • IAM Identity Center (formerly SSO) — Centralized workforce identity management for multi-account access with SAML 2.0 and SCIM provisioning.
  • Amazon Cognito — User Pools for authentication, Identity Pools for temporary AWS credentials.
  • AWS Organizations — SCPs, Resource Control Policies (RCPs), Declarative Policies, AI service opt-out policies.
  • IAM Access Analyzer — External access findings, unused access findings, custom policy checks, and policy generation based on access activity.

Domain 5: Data Protection (18%)

  • AWS KMS — Key policies, grants, multi-region keys, imported key material, External Key Store (XKS), ViaService conditions.
  • Envelope Encryption — Data keys encrypted by KMS CMKs for efficient large-data encryption.
  • S3 Encryption — SSE-S3, SSE-KMS, SSE-C, client-side encryption, bucket keys, default encryption.
  • S3 Security — Bucket policies, ACLs, Block Public Access, Access Points, Object Lock.
  • AWS Certificate Manager (ACM) — Public/private certificates, Private CA for internal resources, cross-region certificate management.
  • AWS Secrets Manager — Automatic rotation, cross-region replication, comparison with Parameter Store.
  • Inter-node Encryption — Amazon EMR (in-transit encryption), EKS (pod-to-pod with service mesh), SageMaker (inter-container training encryption), Nitro enclaves.
  • Data Masking — CloudWatch Logs data protection policies for masking PII/PHI, Amazon SNS message data protection for filtering sensitive data in messages.
  • Amazon Bedrock Guardrails — Content filters, denied topics, word filters, sensitive information filters (PII), contextual grounding checks for GenAI security.

Domain 6: Security Foundations & Governance (14%)

  • AWS Organizations — Multi-account strategy, OU structure, consolidated billing.
  • AWS Control Tower — Landing zone setup, guardrails (preventive, detective, proactive).
  • AWS Config — Configuration recording, managed/custom rules, conformance packs, remediation.
  • AWS RAM — Secure cross-account resource sharing within Organizations.
  • AWS Audit Manager — Automated evidence collection, prebuilt frameworks (SOC 2, PCI DSS, GDPR).
  • AWS Artifact — On-demand access to compliance reports and agreements.
  • CloudTrail — Organization trails, log file integrity validation, integration with Security Lake.

SCS-C03 Practice Questions

Test your readiness with these sample questions covering new SCS-C03 topics:

Question 1 — GenAI Security (Domain 5)

A company uses Amazon Bedrock to power a customer-facing chatbot. The security team needs to prevent the model from generating content about competitors, block personally identifiable information (PII) in responses, and log all denied requests. Which combination of actions should the security engineer take? (Choose TWO)

  1. Create a Bedrock Guardrail with denied topics for competitor names and enable the sensitive information filter for PII detection.
  2. Use an AWS WAF web ACL with custom rules to inspect Bedrock API request/response bodies.
  3. Configure CloudTrail data events for Bedrock model invocations and create a CloudWatch metric filter for guardrail interventions.
  4. Deploy a Lambda@Edge function on CloudFront to scan all responses for PII before delivery.
  5. Enable Bedrock model access logging to S3 and use Macie to scan the logs for PII.
Show Answer

Correct: A, C

Explanation: Bedrock Guardrails (A) provide native content filtering with denied topics and sensitive information filters for PII — this is the purpose-built solution for controlling model outputs. CloudTrail data events with CloudWatch metric filters (C) provide the logging and alerting for denied requests. WAF (B) operates at the HTTP layer and cannot inspect Bedrock model response content. Lambda@Edge (D) doesn’t have access to Bedrock API responses. Macie (E) discovers PII in S3 objects but doesn’t prevent PII in real-time responses.

Question 2 — Verified Permissions & Cedar (Domain 4)

A SaaS application needs fine-grained authorization where users can access only their own documents, and managers can access documents of all team members. The authorization decisions must be evaluated in under 10ms and support both role-based and attribute-based access control. Which solution meets these requirements?

  1. Write IAM policies with conditions for each user and attach them to Cognito Identity Pool roles.
  2. Use Amazon Verified Permissions with Cedar policies that define role-based rules for managers and attribute-based rules matching document owner to the requesting user.
  3. Deploy a custom authorization Lambda function that queries DynamoDB for user-document mappings on each request.
  4. Use API Gateway resource policies with IAM conditions to restrict document access based on the caller’s identity.
Show Answer

Correct: B

Explanation: Amazon Verified Permissions is purpose-built for fine-grained application authorization using the Cedar policy language. It supports both RBAC (role-based — managers can access team documents) and ABAC (attribute-based — users can access their own documents) in a single policy store with low-latency evaluation. IAM policies (A) are for AWS resource access, not application-level authorization. A custom Lambda (C) adds complexity and may not meet 10ms latency. API Gateway resource policies (D) are coarse-grained and don’t support per-document authorization.

Question 3 — Security Lake & OCSF (Domain 1)

A security operations team needs to centralize security findings from GuardDuty, Security Hub, CloudTrail, and VPC Flow Logs across 50 AWS accounts into a single queryable data store using a standardized schema. Third-party SIEM tools must be able to consume this data. Which approach meets these requirements with the LEAST operational overhead?

  1. Configure each account to send findings to a centralized S3 bucket using EventBridge rules, then use Athena for querying.
  2. Enable Amazon Security Lake as a delegated administrator in the Organizations management account, which automatically collects and normalizes data to OCSF format and provides subscriber access for third-party tools.
  3. Deploy a Kinesis Data Firehose in each account to stream logs to a central OpenSearch cluster with custom parsing rules.
  4. Use CloudTrail Lake with organization-level event data stores for all accounts and grant third-party tools direct query access.
Show Answer

Correct: B

Explanation: Amazon Security Lake automatically collects security data from multiple sources (GuardDuty, Security Hub, CloudTrail, VPC Flow Logs, Route 53, S3, Lambda, EKS), normalizes it to the Open Cybersecurity Schema Framework (OCSF), and stores it in a purpose-built data lake. It supports subscriber access for third-party SIEM tools with minimal operational overhead. Option A requires custom schema normalization. Option C adds significant operational complexity. Option D (CloudTrail Lake) only covers CloudTrail events, not all the required sources.

Question 4 — Inter-node Encryption (Domain 5)

A company runs distributed machine learning training jobs on Amazon SageMaker AI using multiple instances. The compliance team requires that all data transmitted between training instances during distributed training is encrypted in transit. How should the security engineer meet this requirement?

  1. Deploy the training instances in a private subnet with a security group that only allows HTTPS traffic between instances.
  2. Enable inter-container traffic encryption in the SageMaker training job configuration.
  3. Configure a VPN connection between each training instance using AWS Site-to-Site VPN.
  4. Use AWS PrivateLink endpoints for all communication between SageMaker training instances.
Show Answer

Correct: B

Explanation: SageMaker AI provides a native inter-container traffic encryption option that encrypts all data transmitted between training instances during distributed training. This is enabled via the EnableInterContainerTrafficEncryption parameter in the training job configuration. Security groups (A) control traffic flow but don’t encrypt it. Site-to-Site VPN (C) is for on-premises to AWS connectivity. PrivateLink (D) is for accessing AWS services privately, not for inter-instance communication within a training job.

Question 5 — Verified Access & Zero Trust (Domain 3)

A company wants to provide remote employees access to internal web applications without requiring a VPN. Access must be granted based on the user’s identity (from the corporate IdP), device security posture, and the specific application being accessed. All access decisions must be logged. Which solution meets these requirements?

  1. Deploy an Application Load Balancer with OIDC authentication action rules that validate tokens from the corporate IdP.
  2. Configure AWS Client VPN with certificate-based mutual authentication and posture assessment.
  3. Set up AWS Verified Access with trust providers for the corporate IdP and a device management solution, create access policies per application, and enable access logs.
  4. Use Amazon CloudFront with Lambda@Edge functions that validate JWT tokens and check device certificates.
Show Answer

Correct: C

Explanation: AWS Verified Access provides zero-trust network access to corporate applications without a VPN. It evaluates each request against access policies using trust providers (identity providers for user identity and device management solutions for device posture). Access logs capture all authorization decisions. ALB with OIDC (A) validates identity but doesn’t assess device posture or provide zero-trust per-request evaluation. Client VPN (B) contradicts the no-VPN requirement. CloudFront with Lambda@Edge (D) requires custom development and doesn’t natively integrate with device posture providers.

Exam Day Tips

  • Time management: 170 minutes for 65 questions = ~2.5 minutes per question. Ordering and matching questions take longer — budget 3–4 minutes for those.
  • Mark and move: Flag difficult questions and return after completing all others.
  • Elimination strategy: On multi-choice questions, eliminate 2 obviously wrong answers first, then focus on the remaining 2.
  • Read carefully: Questions have significant prose. Identify the key requirement (cost, security, least operational overhead) before evaluating answers.
  • Ordering questions: Think about logical dependencies — what must happen before what? E.g., you must isolate before you investigate.
  • Online exam: Join 30 minutes early. Clear your desk. No external monitors, phones, or watches.
  • ESL accommodation: Request 30 extra minutes if English is not your first language.

All the best! 🎯

AWS Architecture Patterns for SCS-C03

Frequently Asked Questions

What is the AWS SCS-C03 exam?

The AWS Certified Security – Specialty (SCS-C03) is an advanced certification for security professionals. It has 65 questions over 170 minutes, requires 750/1000 to pass, costs $300, and covers 6 domains: Detection, Incident Response, Infrastructure Security, IAM, Data Protection, and Security Foundations.

What changed from SCS-C02 to SCS-C03?

Key changes include: GenAI security topics (Bedrock Guardrails, OWASP LLM Top 10), OCSF/Security Lake integration, IAM weight increased from 16% to 20%, new services (Verified Access, Verified Permissions), inter-node encryption, SNS data protection, and domain restructuring (Detection + Incident Response split).

How long should I study for SCS-C03?

With 2+ years of AWS security experience, 8-10 weeks of dedicated study is recommended. Focus on hands-on labs with IAM policies, KMS, GuardDuty, Security Hub, and the new GenAI security features in Bedrock.

SCS-C03 Architecture Pattern Posts

Amazon Quick – Enterprise AI Productivity Assistant

~ Last updated on : ~ Kiro Agent

Amazon Quick – AI Assistant for Enterprise Productivity

Overview

Amazon Quick is AWS’s AI-powered enterprise productivity assistant, designed to work across all your business applications, tools, and data in one unified experience. Originally launched as Amazon Q Business (GA April 2024), it evolved into Amazon Quick Suite (October 2025) and received major autonomous agent capabilities at AWS Summit NYC in June 2026.

Unlike traditional AI assistants locked into a single vendor ecosystem, Amazon Quick breaks free from “walled gardens” — it connects to Slack, Microsoft Teams, Outlook, Gmail, Salesforce, ServiceNow, Jira, and dozens more applications seamlessly. It lives on your desktop, learns your work patterns, and gets smarter and more proactive the longer you use it.

Key Principles

  • Built for how you actually work — connects to every tool you use, not just one vendor’s ecosystem
  • Enterprise security your company will approve — no trade-off between capability and governance
  • Always learning, always improving — builds a personal knowledge graph from your interactions
  • Proactive, not reactive — runs continuously in the background, surfacing what needs attention
  • No coding required — accessible to every knowledge worker, not just developers

Key Features

Activity Feed (Redesigned June 2026)

The redesigned activity feed consolidates email, messaging, calendar, and tasks into a single prioritized view:

  • Unified inbox — see updates from email, Slack, Teams, calendar, and tasks in one place
  • Learns your patterns — knows which messages you always answer fast, which threads you skip, and what topics drive your week
  • Prioritization via feedback — use thumbs up/down to train Quick on what matters to you
  • Direct actions — reply to emails, respond to Slack messages, and approve requests without switching apps
  • Conversational interface — interact with your activity feed using natural language

Personal Knowledge Graph

Quick builds a persistent knowledge graph that understands:

  • Your preferences and communication style
  • Team contacts and organizational relationships
  • Key projects, brand guidelines, and business context
  • Work patterns — what you do, when, and with whom

This “long-term memory” means Quick remembers context across sessions. When drafting a customer win note, it pulls relevant stakeholders, references earlier conversations, and suggests actions based on historical patterns.

Proactive Recommendations

Unlike reactive AI tools that wait for prompts, Quick runs continuously in the background:

  • Meeting preparation — surfaces relevant Slack threads, documents, and briefing notes before your meetings
  • Conflict detection — catches double-bookings and urgent deadlines before they become problems
  • Follow-up nudges — reminds you of stalled conversations and pending actions
  • Context-aware suggestions — recommends next steps based on your current workflow

Content Creation

Generate deliverables directly from the chat interface:

  • Polished documents and presentations (PowerPoint)
  • Live dashboards and intelligent apps
  • Infographics and images
  • Custom web applications (no coding required)

Autonomous Agents (June 2026)

Announced at AWS Summit NYC 2026, autonomous agents are the marquee new capability that transforms Quick from an interactive assistant into a continuous automation platform.

How Autonomous Agents Work

  • Natural language creation — describe what you want the agent to do in plain English; no coding required
  • Granular autonomy levels — set agents from step-by-step approval to broad goal-based execution
  • Continuous operation — agents work in the background 24/7, not just when you’re actively using Quick
  • Specific expertise — configure each agent with domain knowledge, tone, and tool access

Example Agents

Agent Type What It Does
Finance Agent Processes purchase orders as they come in, flags anomalies, routes for approval
Sales Agent Monitors CRM, emails, and Slack; proactively drafts follow-ups, flags risks, recommends next steps
Deal Follow-up Agent Follows up on stalled business deals automatically
Compliance Agent Summarizes regulatory changes and flags relevant items to the legal team
Operations Agent Monitors dashboards and alerts teams when KPIs deviate from targets

Key Benefits

  • Eliminates manual repetitive work and notification overload
  • Accessible to business users — no developer involvement needed
  • Full audit trail and explainability for every action taken
  • Respects existing security permissions and data access controls

Integrations

Amazon Quick connects to 56+ applications and data sources, with 16 new built-in integrations announced at AWS Summit NYC 2026.

New Integrations (June 2026)

  • Adobe — Creative Cloud and Document Cloud workflows
  • Moody’s — Financial risk data and analytics
  • Snowflake — Data warehouse querying via natural language
  • Plus 13 additional enterprise integrations

Existing 40+ Connectors

  • Communication — Slack, Microsoft Teams, Zoom, Google Workspace
  • Email & Calendar — Microsoft Outlook, Gmail
  • Productivity — Microsoft 365 (Word, PowerPoint, Excel), Airtable, Dropbox
  • CRM & Sales — Salesforce, HubSpot
  • Project Management — Jira, Asana, ServiceNow
  • E-Commerce — Shopify
  • Finance — QuickBooks
  • Data Sources — Amazon S3, Amazon Redshift, PostgreSQL, MySQL, Oracle, AWS Glue, Databricks Unity Catalog, Collibra
  • Developer Tools — Kiro CLI, Claude Code, browser-based workflows
  • Document Stores — SharePoint, Confluence, Google Drive

Multi-Dataset Analytics

The new multi-dataset analytics feature (June 2026) enables:

  • Query across multiple data sources using natural language — no SQL required
  • Inherits semantic intelligence from existing data catalogs (AWS Glue, Databricks Unity Catalog, Collibra)
  • No pre-joining datasets or technical data preparation needed
  • Security enforced through identity propagation respecting existing permissions

Microsoft 365 Extensions

Quick embeds directly into Microsoft Office applications:

  • Available in Outlook, Word, PowerPoint, and Excel (preview)
  • Proactively surfaces insights, drafts content, and takes action within each app
  • No context switching required

Architecture

Knowledge Graph Technology (AWS Context)

Amazon Quick is built on the same knowledge graph technology that powers AWS Context, a new service announced at AWS Summit NYC 2026:

  • Automatic relationship inference — discovers connections between data assets, business rules, and domain knowledge
  • Organizational data connectivity — connects to all structured, unstructured, and domain data across the enterprise
  • Agentic search layer — enables agents to navigate organizational information and find the right answers
  • Continuous learning — learns which sources produce correct results, which paths get used, and which business rules matter
  • Metadata stored in Iceberg format on S3 Tables — build against it with existing tools

Desktop Architecture

  • Runs as a native desktop application (Windows and Mac)
  • Connects directly to local files on your machine
  • Stays connected to calendar, email, and apps in the background
  • Always-on — works whether you’re actively prompting or not
  • Can automate browser-based workflows and connect to developer tools

Shared Spaces

  • Team workspaces where dashboards, agents, automations, and knowledge compound across people
  • Share Quick applications as public websites for collaboration beyond the organization
  • Certified and published assets managed by Enterprise admins

Security

Amazon Quick addresses the fundamental security trade-off that plagues enterprise AI adoption:

The “Walled Garden” vs “Wild Garden” Problem

  • Walled Gardens (Microsoft Copilot, Google Gemini) — AI locked into one vendor ecosystem; can’t work across all your systems
  • Wild Gardens (standalone ChatGPT, open tools) — broad access but little concern for security and data governance
  • Amazon Quick — works across ALL your tools while maintaining enterprise-grade security

Enterprise Security Features

  • Data privacy — Quick never uses your data to train someone else’s model
  • Access control — respects existing ACL permissions from connected data sources
  • Identity propagation — user-level security enforced across all queries and actions
  • RBAC and SSO — enterprise identity management integration
  • Data sovereignty controls — available on Professional and Enterprise plans
  • Admin controls — centralized management, user provisioning, and audit capabilities
  • SAML 2.0 integration — works with Okta, Azure AD, Ping Identity
  • Built on AWS — inherits AWS security, compliance, and governance standards
  • HIPAA eligible — suitable for healthcare workloads

Governance for Agents

  • Granular autonomy levels — define exactly what agents can and cannot do
  • Full audit trail for all autonomous actions
  • Administrators can verify, approve, and remove published automations
  • Integration with Amazon Bedrock Guardrails for content safety

Pricing

Amazon Quick offers four tiers across two sign-up methods:

Sign Up with Email (No AWS Account Required)

Feature Free ($0/user/month) Plus ($20/user/month)
AI chat assistant ✓ ✓
Desktop app — ✓
Custom chat agents — ✓
Shared Spaces for teams — ✓
Quick Flows (automation) ✓ ✓
App integrations (Slack, M365, Google) ✓ ✓
Browser & M365 extensions — ✓

Sign Up with AWS Account (Enterprise)

Feature Professional ($20/user/month) Enterprise ($40/user/month)
All Plus features ✓ ✓
Quick Sight analytics View only Create & certify
Multi-step workflow automation (Quick Automate) — ✓
RBAC, SSO, admin controls ✓ ✓
Data sovereignty controls ✓ ✓
Index storage per user 25 GB 50 GB
Agent hours included/user/month 4 hours 8 hours
Infrastructure fee $250/account/month $250/account/month
24/7 AWS Support ✓ ✓

Additional costs: Agent hours beyond entitlement are $3/hour (metered to the second). Index storage overages are $5/GB/month. A 30-day free trial is available for up to 25 users on the Enterprise plan.

Evolution: Amazon Q Business → Amazon Quick

Timeline Product Key Milestone
Nov 2023 Amazon Q Business (Preview) Announced at re:Invent 2023 as enterprise AI assistant
Apr 2024 Amazon Q Business (GA) Generally available with 40+ connectors, plugins, Q Apps
Oct 2025 Amazon Quick (Suite) Rebrand and expansion; merges QuickSight BI capabilities; launched as “AI teammate for work”
Apr 2026 Amazon Quick Desktop Desktop app launch; M365 extensions; always-on proactive mode; content creation
Jun 2026 Amazon Quick (Autonomous Agents) Autonomous agents, multi-dataset analytics, redesigned activity feed, 16 new integrations

Migration path: Existing Q Business customers can continue using their current service or leverage their existing Q index with Quick Suite to access new agents for research, insights, and automation.

Competitive Positioning

Amazon Quick vs Microsoft Copilot vs Google Gemini vs ChatGPT Enterprise

Capability Amazon Quick Microsoft 365 Copilot Google Gemini for Workspace ChatGPT Enterprise
Pricing $0–$40/user/month $30/user/month (add-on) $20–$30/user/month (add-on) ~$60/user/month (custom)
Cross-platform integrations 56+ (vendor-agnostic) Microsoft ecosystem + connectors Google Workspace ecosystem Limited (API-based)
Autonomous agents ✓ (no-code, continuous) ✓ (Copilot Studio) Limited — (Codex for code only)
Always-on desktop app ✓ (proactive) Embedded in M365 apps Embedded in Workspace Desktop app (reactive)
Personal knowledge graph ✓ (learns over time) Work IQ (memory) Limited personalization Memory feature
BI & analytics built-in ✓ (Quick Sight) Excel/Power BI integration Looker integration —
Requires base subscription No (standalone) Yes (M365 license required) Yes (Workspace license) No (standalone)
Data stays in your environment ✓ (AWS infrastructure) ✓ (Microsoft cloud) ✓ (Google cloud) ✓ (OpenAI servers)
Multi-dataset NL analytics ✓ (cross-source) Limited to M365 data BigQuery integration —

Key Differentiators for Amazon Quick

  • Vendor-agnostic — doesn’t require you to be locked into Microsoft or Google ecosystems
  • Free tier available — no base subscription prerequisite (unlike M365 Copilot which requires M365 license)
  • Unified BI + AI — Quick Sight analytics natively integrated (not a separate tool)
  • Proactive by design — always-on desktop presence vs. app-embedded reactive AI
  • AWS ecosystem advantage — native integration with Bedrock, S3, Redshift, Glue for data-heavy enterprises

Use Cases

Prioritized Inbox

A product manager receives 200+ emails and 50+ Slack messages daily. Quick’s activity feed consolidates everything into a single prioritized view, learns which messages require immediate attention (from the CEO, from direct reports, from key customers), and surfaces them first. Low-priority notifications are batched for end-of-day review.

Proactive Follow-ups

A sales rep closes a deal and needs to notify multiple stakeholders. Quick’s autonomous agent monitors the CRM, detects the deal closure, drafts personalized follow-up emails to the manager, leadership, marketing, and customer success teams — pulling relevant details from prior conversations and suggesting next steps based on historical playbooks.

Order Processing

A finance team deploys a Quick autonomous agent that continuously monitors incoming purchase orders. The agent validates order details against inventory systems, flags anomalies (unusual quantities, pricing discrepancies), routes standard orders for automatic approval, and escalates exceptions to the appropriate reviewer — all without human initiation.

CRM Monitoring

A sales leader creates an agent that monitors all team interactions across email, Slack, and Salesforce. The agent identifies deals that haven’t had customer contact in 7+ days, drafts suggested follow-up messages, flags competitive mentions, and generates a weekly pipeline health report — delivered proactively every Monday morning.

Meeting Preparation

Before a customer meeting, Quick automatically surfaces: the customer’s recent support tickets, last quarter’s usage data from the BI dashboard, relevant product roadmap items discussed in internal Slack channels, and the sales engineer’s technical notes — all compiled into a pre-meeting briefing without being asked.

Customer Adoption

  • 3M — saves sales reps 5+ hours per week gathering information for customer meetings
  • Amazon Books — reduced time leaders spend developing coordination documents by 80%; engineering cut factory test times by 67%
  • New York Life — replaced multi-report manual processes with conversational agents for reconciliation, premium processing, and compliance reporting
  • Mondelēz International — employees complete tasks in minutes instead of hours; AI-powered analysis across complex data sets
  • Southwest Airlines — adopted Quick as part of their AWS cloud modernization, alongside 2,700 developers using Kiro
  • Other adopters: BMW, GoDaddy, AstraZeneca, NFL, Kitsa

Practice Questions

  1. A company uses Microsoft Teams for messaging, Salesforce for CRM, Jira for project management, and Snowflake for analytics. They want an AI assistant that works across ALL these tools without requiring them to migrate to a single vendor ecosystem. Which solution best meets this requirement?
    1. Microsoft 365 Copilot
    2. Google Gemini for Workspace
    3. Amazon Quick
    4. ChatGPT Enterprise
    Show Answer

    Answer: C. – Amazon Quick is designed to be vendor-agnostic with 56+ integrations spanning Microsoft, Google, Salesforce, Snowflake, and others. Microsoft Copilot and Google Gemini are primarily optimized for their own ecosystems. ChatGPT Enterprise has limited native enterprise integrations.

  2. A sales operations team wants to create an AI agent that continuously monitors their CRM for deals inactive for more than 7 days, automatically drafts follow-up suggestions, and flags risks — without any developer involvement. Which Amazon Quick capability should they use?
    1. Quick Flows
    2. Quick Sight scenarios
    3. Autonomous Agents
    4. Quick Automate
    Show Answer

    Answer: C. – Autonomous Agents (launched June 2026) allow users to create agents in natural language that work continuously in the background with specific expertise and tool access — no coding required. Quick Flows handle simpler daily automation. Quick Automate handles multi-step workflows but requires the Enterprise tier. Quick Sight is for BI analytics.

  3. An enterprise security team evaluates AI assistants and requires: (1) user data is never used to train external models, (2) existing data access permissions are respected, and (3) the solution works across tools from multiple vendors. Which statements about Amazon Quick’s security model are correct? (Select TWO)
    1. Quick uses customer data to improve its foundation models for other customers
    2. Quick enforces identity propagation that respects existing ACL permissions from connected data sources
    3. Quick requires all connected data sources to be migrated to AWS S3 first
    4. Quick never uses your data to train someone else’s model
    5. Quick only supports SSO through AWS IAM Identity Center
    Show Answer

    Answer: B, D – Amazon Quick enforces identity propagation and ACL permissions (B) and explicitly guarantees that customer data is never used to train other models (D). It connects to data sources in place without migration (eliminates C). It supports SAML 2.0 providers including Okta and Azure AD (eliminates E).

  4. A company is currently using Amazon Q Business with 40+ connectors configured. They want to take advantage of the new autonomous agents and activity feed features. What is the recommended migration path?
    1. Rebuild the entire configuration from scratch on Amazon Quick
    2. Leverage their existing Q index with Quick Suite to access new capabilities
    3. Wait for automatic migration scheduled for Q4 2026
    4. Deploy a separate Amazon Quick instance alongside Q Business
    Show Answer

    Answer: B. – AWS explicitly states that existing Q Business customers can continue using their current service or leverage their existing Q index with Quick Suite to access new agents for research, insights, and automation — no rebuild required.

  5. An organization needs Amazon Quick for 500 users with full governance, dashboard creation, multi-step workflow automation, and certified assets. They estimate each user will consume approximately 10 agent hours per month. What is the minimum monthly cost? (Select the correct calculation)
    1. 500 × $20 = $10,000/month
    2. 500 × $40 + $250 = $20,250/month
    3. 500 × $40 + $250 + (500 × 2 × $3) = $23,250/month
    4. 500 × $40 + $250 + (500 × 6 × $3) = $29,250/month
    Show Answer

    Answer: C. – Enterprise tier is required for dashboard creation, multi-step automation, and certified assets ($40/user/month × 500 = $20,000). Infrastructure fee is $250/account/month. Enterprise includes 8 agent hours/user/month, so overage is 2 hours/user × 500 users × $3/hour = $3,000. Total: $20,000 + $250 + $3,000 = $23,250/month.

Frequently Asked Questions

What is Amazon Quick?

Amazon Quick is AWS’s enterprise AI assistant that consolidates email, messaging, calendar, and tasks into a single AI-prioritized view. It creates autonomous agents for background work (finance, sales, HR) and connects to 56+ enterprise applications with full security controls.

How does Amazon Quick differ from Q Business?

Amazon Quick is the evolution of Q Business. While Q Business focuses on knowledge Q&A over company data, Quick adds an AI-powered activity feed, autonomous background agents, proactive recommendations, and a desktop application — becoming a full work productivity layer.

Can I create custom agents in Amazon Quick?

Yes. Quick’s autonomous agents require no coding — you define the agent’s expertise, tone, and tool access. Examples include a finance agent processing invoices, a sales agent monitoring CRM interactions, or an HR agent handling onboarding workflows.

References

AWS Transform – AI-Powered Code Modernization

~ Last updated on : ~ Kiro Agent

AWS Transform – AI-Powered Code Modernization

📢 AWS Transform – Launched May 2025

AWS Transform is a collaborative enterprise IT transformation workbench powered by agentic AI that accelerates cloud migration, application modernization, and continuous tech debt reduction. Built on 20 years of AWS migration expertise, it deploys specialized AI agents to automate complex tasks like assessments, code analysis, refactoring, dependency mapping, validation, and transformation planning.

Key Milestone (May 2026): 4.5+ billion lines of code processed, 1.6+ million hours of manual effort saved (equivalent to 929 developer years).

What is AWS Transform?

  • AWS Transform is an agentic AI-powered service that modernizes enterprise workloads at scale — including full-stack Windows/.NET applications, mainframe systems, VMware infrastructure, and custom code transformations.
  • It evolved from AWS’s migration and modernization tools (including AWS Migration Hub, AWS Schema Conversion Tool, and Porting Assistant for .NET) into a unified, AI-driven platform.
  • The service uses specialized task agents built on decades of migration experience combined with enterprise-specific context.
  • Agents use goal-driven orchestration ranging from deterministic execution to dynamic plans, with humans in the loop for oversight.
  • Learning capability is built-in at every level — agents continually self-debug, improve outcomes, and provide recommendations.
  • Available through a unified web experience, CLI, IDE integrations (Visual Studio, Kiro, Claude Code, Cursor), and MCP server.
  • Supports collaborative workspaces where architects define target states, developers execute, leads review, and partners deliver at scale.

AWS Transform Key Capabilities

1. AWS Transform for .NET

  • Purpose: Modernize .NET Framework applications to cross-platform .NET (e.g., .NET 8) that runs on Linux.
  • First agentic AI service for modernizing .NET applications at scale — launched GA in May 2025.
  • Ports entire applications including dependencies — handles MVC, WCF, Web APIs, and console applications.
  • Automates code analysis, dependency mapping, compatibility assessment, and refactoring tasks.
  • Accelerates .NET modernization by up to 4x compared to traditional manual approaches.
  • Reduces Windows licensing costs by up to 40% by enabling Linux deployment.
  • Applications run 1.5–2x faster with improved performance and 50% better scalability on Linux.
  • Includes a conversational AI assistant for Visual Studio for developer-level application work.
  • Supports deployment to Amazon EC2 Linux, Amazon ECS, Amazon EKS, and AWS Lambda.
  • Customer Example: Experian modernized 7 legacy .NET applications (687,600 lines of code), saving ~300 engineering days with ~40% developer effort reduction.
  • Customer Example: Signaturit Group cut Windows .NET to Linux migration from 6-8 months to a few days.

2. AWS Transform for Mainframe

  • Purpose: Modernize mainframe workloads (COBOL, PL/I, JCL) to cloud-native applications.
  • Supports multiple modernization patterns: Refactor (automated code conversion) and Reimagine (business logic extraction → cloud-native redesign).
  • Reimagine Capabilities:
    • Extracts business rules from legacy COBOL/PL/I code with full traceability
    • Converts to syntax-independent specifications
    • Generates cloud-native Java microservices with REST APIs and entity mappings
    • Every requirement traces back to source code for auditable transformation decisions
  • Automated Testing: Generates test cases, test data collection scripts, and test automation scripts for validation.
  • Supports IBM z/OS COBOL, VSAM, IMS, DB2, and expanded to PL/I (common in financial services and insurance).
  • Connected assessment-to-code-generation workflow compresses months of discovery into hours.
  • Native integration with Kiro IDE — developers steer forward engineering conversationally.
  • Automates analysis of mainframe codebases: JCL, BMS, COBOL programs, and copybooks.
  • Customer Example: BMW Group reduced test case creation from 10 days to hours, increased test coverage by 60%, and migrated 7 applications in 6 months — targeting 12-month reduction in overall transformation timeline.

3. AWS Transform for SQL Server

  • Purpose: Modernize SQL Server databases to Amazon Aurora PostgreSQL — the successor to AWS Schema Conversion Tool (SCT).
  • Accelerates SQL Server to Aurora PostgreSQL modernization by up to 5x through intelligent schema conversion.
  • Handles the complete migration lifecycle:
    • Schema analysis and conversion
    • Stored procedure transformation to PostgreSQL-compatible format
    • Application code refactoring (Entity Framework configs, connection strings)
    • Data migration
  • Three layers of validation: syntax validation, semantic equivalence, and functional verification with synthetic data.
  • Supports virtual sources so teams don’t need direct production database access to start.
  • Iterative workflow: get an assessment with level of effort → DBAs review and approve → Transform executes.
  • Coordinates database modernization with application code changes simultaneously.

4. AWS Transform Custom

  • Purpose: Learn your organization’s specific patterns and automate transformations across repositories at scale.
  • Transforms any code pattern — version upgrades, runtime migrations, framework transitions, language translations, and architecture decompositions.
  • Pre-built transformations include: Java upgrades, Node.js upgrades, Python upgrades, boto2→boto3, AWS SDK migrations, x86→Graviton, Spring Boot updates, Angular→React, Vue.js upgrades, Log4j→SLF4J, Progress 4GL→Java, ColdFusion→React/Java, and more.
  • Continual Learning: The agent automatically captures patterns, fixes, and edge cases as reusable knowledge items, so transformations get faster and more reliable with every run.
  • Define once, transform everywhere — capture transformation knowledge and execute repeatable tasks across your entire organization.
  • Up to 85% efficacy rate for out-of-the-box transformations (Java, Node.js upgrades).
  • Available via CLI, web experience, Kiro Power, Claude Code, VS Code, and can be embedded in any pipeline.
  • Customer Example: Air Canada achieved 90% efficacy rate and 80% reduction in expected time and costs upgrading thousands of Lambda functions from Node.js 16 to 20.
  • Customer Example: Twitch achieved 70% acceleration on AWS SDK v1→v2 Golang migration across 913 repositories, saving ~2,876 developer days (11 developer years).
  • Customer Example: Coupang transformed 70+ Java applications in 2 months with a team of 5 — a 90% timeline reduction.

5. AWS Transform – Continuous Modernization (Preview, June 2026)

  • Purpose: Always-on, autonomous portfolio management that continuously finds tech debt, fixes it, validates, and learns.
  • Announced at AWS Summit New York 2026 — shifts code transformation from periodic projects into an automated, pipeline-driven practice (CI/CD/CM — Continuous Modernization).
  • Continuous Analysis:
    • Automatically scans code repositories against configurable baselines
    • Generates findings in hours, not weeks
    • Detects end-of-life dependencies, deprecated frameworks, security vulnerabilities
    • Extend with organization-specific policies (approved libraries, internal coding standards)
    • Provides ground truth directly from code — no manual compliance tracking
  • Autonomous Remediation at Scale:
    • Generates pull requests for affected repositories automatically
    • Notifies owning teams with context and proposed fix
    • Teams review, merge, or remediate using their own approach
    • Detects when fixes are in place without manual confirmation
  • Integrations: GitHub organizations, GitLab groups, Bitbucket workspaces, local repositories, AWS CodePipeline, Jenkins, GitHub Actions.
  • Integrates with AWS Security Agent for source-code-level security vulnerability remediation.
  • Available through the AWS Transform web application, Kiro Power, or MCP for integration with existing coding agents.

6. AWS Transform for Full-Stack Windows Modernization

  • Purpose: Coordinated transformation across all layers — application code, UI framework, database, and deployment.
  • Accelerates full-stack Windows modernization by up to 5x using specialized domain-expert agents.
  • Reduces operating costs by up to 70% by moving away from costly Windows/SQL Server licenses.
  • Four Transformation Layers:
    • Application Layer: .NET Framework → cross-platform .NET (Linux-ready)
    • UI Layer: ASP.NET Web Forms → Blazor (modern, cross-platform)
    • Database Layer: SQL Server → Amazon Aurora PostgreSQL (schema + stored procedures + app code)
    • Deployment Layer: Automated CI/CD pipeline generation, CloudFormation templates, ECS/EC2 Linux deployment
  • Unified web experience with natural language interaction for coordinated modernization plans.
  • Agents assess complexity, sequence work into waves, and execute transformations end-to-end with human oversight.
  • Architects can step in at any point to steer decisions without breaking the autonomous flow.
  • Up to 40% better price-performance running modernized apps on AWS Graviton vs. x86 instances.

AWS Transform vs. Manual Refactoring vs. Third-Party Tools

Criteria Manual Refactoring Third-Party Tools (Snyk, SonarQube) AWS Transform
Scope Single app at a time Detection + limited auto-fix Full-stack transformation at scale (code + DB + UI + deployment)
Approach Developer-driven, line by line Rule-based scanning + suggestions Agentic AI with goal-driven orchestration
Speed Months to years per application Fast detection, manual remediation Up to 5x faster end-to-end transformation
Scale Limited by team size Portfolio scanning, per-repo fixes Hundreds of applications in parallel
Learning Tribal knowledge, inconsistent Static rule updates Continual learning from every execution (knowledge items)
Mainframe Support Specialist consulting required Not supported Full COBOL/PL/I → cloud-native with traceability
Database Migration Manual schema + stored proc conversion Not supported Intelligent schema conversion + coordinated app code changes
Continuous Tech Debt Periodic sprints, reactive Continuous detection, manual fix Autonomous detection + remediation + PR generation
Validation Manual testing Linting and SAST Multi-layer: syntax, semantic equivalence, functional verification
Cost Model Engineering headcount Per-developer licensing Pay per transformation job

Customer Results

  • Overall Impact: 4.5+ billion lines of code processed, 1.6+ million hours saved (929 developer years), hundreds of thousands of servers migrated in the first year.
  • BMW Group: Used AWS Transform for mainframe modernization — reduced test case creation from 10 days to hours, increased test coverage by 60%, migrated 7 applications in 6 months.
  • Experian: Modernized 7 .NET Framework applications (687,600 LOC) to .NET 8 using AWS Transform for .NET — saved ~300 engineering days with ~40% developer effort reduction.
  • Air Canada: Upgraded thousands of Lambda functions from Node.js 16 to 20 — achieved 90% efficacy rate and 80% reduction in time/costs. Made AWS Transform their internal standard.
  • Twitch: AWS SDK v1→v2 Golang migration across 913 repositories — 70% acceleration, saving ~2,876 developer days (11 developer years).
  • Coupang: Transformed 70+ Java applications in 2 months with 5 developers — 90% timeline reduction vs. traditional manual approaches.
  • CSL: Planned migrations for thousands of servers in days — a 10x acceleration over prior approaches.
  • ADP: Modernized complex mainframe using Transform’s mainframe and custom capabilities — now scaling for 1.1 million clients with results in weeks.
  • 4 out of 5 customers return to do additional projects; roughly half use multiple transformation capabilities.

How AWS Transform Works – Architecture

  • Expert Task Agents: Dozens of specialized agents for network generation, business rule extraction, .NET porting, schema conversion, etc.
  • Agentic Orchestration: Goal-driven orchestration that adapts per workload — deterministic where precision is needed, dynamic where flexibility is required.
  • Built-in Learning: Knowledge items captured from debugging steps, human input, and code observations improve future executions.
  • Human-in-the-Loop: Teams supervise, approve plans, override decisions, and step in/out of autonomous workflows.
  • Shared Context: Seamless handoffs between stages — no re-entry, no lost progress across web, CLI, and IDE surfaces.
  • Composability: Customers, partners, and ISVs can build custom agents using Agent Builder Toolkit and integrate with AWS Transform via MCP server.

AWS Transform Pricing

  • AWS Transform pricing is based on the specific capability used and transformation scope.
  • Custom transformations are priced per transformation job.
  • Continuous modernization pricing is based on repository connections and remediation volume.
  • Some capabilities (like model-to-model migration assessment) are available at no additional charge beyond standard pricing.
  • Refer to the AWS Transform Pricing page for current details.

AWS Certification Exam Practice Questions

1. A company wants to modernize 200 .NET Framework applications running on Windows Server to reduce licensing costs and improve performance. Which AWS service should they use to accelerate this transformation?

  1. AWS Migration Hub
  2. AWS App2Container
  3. AWS Transform for .NET
  4. AWS Elastic Beanstalk
Show Answer

Answer: C –

Explanation: AWS Transform for .NET is specifically designed to modernize .NET Framework applications to cross-platform .NET at scale, accelerating modernization by up to 4x and reducing Windows licensing costs by up to 40%.

2. An enterprise is modernizing a legacy COBOL mainframe system. They need to convert business logic into cloud-native microservices while maintaining full traceability from source to target. Which AWS Transform capability should they use?

  1. AWS Transform Custom
  2. AWS Transform for .NET
  3. AWS Transform for Mainframe – Reimagine
  4. AWS Transform – Continuous Modernization
Show Answer

Answer: C –

Explanation: AWS Transform for Mainframe’s Reimagine capability extracts business rules from COBOL/PL/I code with full traceability and generates cloud-native Java microservices with REST APIs, maintaining an audit trail from source to modernized code.

3. A platform engineering team manages 2,000+ repositories and wants to continuously detect and remediate tech debt (end-of-life dependencies, deprecated frameworks) without periodic maintenance sprints. Which capability best fits this requirement?

  1. AWS Transform Custom with CLI automation
  2. AWS Transform – Continuous Modernization
  3. Amazon CodeGuru Reviewer
  4. AWS Config Rules
Show Answer

Answer: B –

Explanation: AWS Transform – Continuous Modernization (Preview, June 2026) provides always-on, autonomous tech debt analysis and remediation at scale. It continuously scans repositories, generates prioritized findings, and autonomously creates pull requests for remediation — shifting from periodic projects to CI/CD/CM.

4. A company needs to upgrade Java versions, migrate AWS SDK v1 to v2, and convert Angular to React across hundreds of applications consistently. They want the transformation agent to learn from each execution and improve over time. Which capability should they use?

  1. AWS Transform for Full-Stack Windows Modernization
  2. Amazon Q Developer
  3. AWS Transform Custom
  4. AWS Transform for Mainframe
Show Answer

Answer: C –

Explanation: AWS Transform Custom provides pre-built and custom transformations for diverse code patterns (Java upgrades, SDK migrations, framework transitions). It features continual learning through knowledge items — capturing patterns, fixes, and edge cases from every execution to improve future transformations.

5. An organization is modernizing its Windows technology stack and needs coordinated transformation across .NET applications, ASP.NET Web Forms UI, SQL Server databases, and deployment processes. Which approach provides unified modernization across all layers?

  1. Use separate tools: AWS Transform for .NET + AWS DMS + manual UI rewrite
  2. AWS Transform for Full-Stack Windows Modernization
  3. AWS Elastic Beanstalk with Docker migration
  4. AWS Transform Custom with multiple transformation definitions
Show Answer

Answer: B –

Explanation: AWS Transform for Full-Stack Windows Modernization provides coordinated transformation across all four layers — application (.NET → cross-platform), UI (Web Forms → Blazor), database (SQL Server → Aurora PostgreSQL), and deployment (CI/CD pipeline generation). It uses domain-expert agents in a unified experience for cohesive modernization.

Frequently Asked Questions

What is AWS Transform?

AWS Transform is an agentic AI service for large-scale code modernization. It handles .NET Framework to cross-platform .NET, mainframe COBOL to cloud-native, SQL Server migrations, and custom transformations — having eliminated 1.6M+ hours of manual effort for customers like BMW and Experian.

What is Transform Continuous Modernization?

Launched in June 2026, Continuous Modernization is an always-on capability that autonomously monitors your code repositories, identifies tech debt as it accumulates, fixes it, validates the fix, and integrates with your existing CI/CD pipelines (GitHub Actions, Jenkins, GitLab, CodePipeline).

Can AWS Transform modernize mainframe applications?

Yes. Transform for Mainframe can convert COBOL, PL/I, and other legacy code to cloud-native Java or .NET using its Reimagine capability. It also provides automated testing to validate functional equivalence, reducing modernization timelines from years to months.

References

AWS Context – Knowledge Graph for AI Agents

~ Last updated on : ~ Kiro Agent

AWS Context Overview

  • AWS Context is a new service announced at AWS Summit New York City (June 17, 2026) that automatically builds a knowledge graph from your existing organizational data so AI agents can find the right information, provide correct answers, and take the right actions.
  • AWS Context maps the relationships across existing data into a knowledge graph and provides agentic search so AI agents can access governed data relationships, business rules, and domain knowledge at runtime.
  • It eliminates the need to build custom retrieval pipelines, provision infrastructure, or manually wire agents to individual data sources.
  • AWS Context is currently in “Coming Soon” status (as of June 2026).
  • The service is built on the same knowledge graph technology that powers Amazon Quick (formerly Amazon Q), where hundreds of thousands of users interact daily with a production knowledge graph processing millions of requests per day.

Key Features

Automatic Relationship Mapping

  • Automatically infers relationships between data assets, business rules, and domain knowledge across the organization.
  • Understands what tables exist, what’s stored in different columns, which sources are the most authoritative, and how they relate to each other.
  • Data stewards and curators manage the graph through an intuitive console experience, reviewing inferred relationships, promoting them to production, and attaching domain-specific knowledge.

Broad Data Source Connectivity

  • Connects to all organizational data including:
    • Databases (relational, NoSQL, data warehouses)
    • Slack messages and team communications
    • Documents and wikis
    • Emails
    • CRM systems
    • Data lakes, data warehouses, and lakehouses
    • Data streams
  • Designed to connect to third-party catalogs, so context from systems beyond AWS can be brought into the same graph.

Context That Learns (Continuous Learning Loop)

  • AWS Context gets smarter the more agents use it.
  • As agents query the graph, it observes:
    • Which sources produce correct results
    • Which join paths agents rely on
    • Which curated rules get applied
  • Ranks sources by actual usage and shares learnings across the organization.
  • When one agent discovers a correct join path or resolves a schema ambiguity, other agents pick it up automatically without requiring human re-curation.
  • Every agent improves based on the findings of a single query.

Open and Portable by Design

  • All key metadata from structured and unstructured sources is published into Apache Iceberg format in Amazon S3 Tables.
  • Context can be queried with Amazon Athena, Amazon Redshift, Apache Spark, or any Iceberg-compatible engine.
  • Build downstream systems on it, audit it, or migrate it — your context stays fully yours.
  • Agents query it through agentic search APIs and MCP tools, whether built on Amazon Bedrock AgentCore, deployed on Amazon EKS, or running on MCP-compatible frameworks.

Identity-Aware Governance

  • Every query is identity-aware — each call inherits the calling user’s IAM and Lake Formation permissions.
  • An agent can only see and traverse the relationships its identity is authorized to access.
  • Every interaction is auditable — security and compliance teams can verify what an agent accessed and under what authority.
  • Uses the same access controls organizations already rely on (IAM, Lake Formation).

Zero Infrastructure Management

  • No infrastructure to provision — fully managed service.
  • No retrieval pipeline to build — agents navigate the knowledge graph directly.
  • Begin gathering and curating context with just a few clicks in the AWS Management Console.

Architecture & How It Works

  • Knowledge Graph Foundation: Built on the same technology that powers Amazon Quick’s production knowledge graph (catalogs datasets, dashboards, and metadata at scale).
  • From Personal to Organizational: Extends what was a personal knowledge graph (Amazon Quick) into an organizational one — a shared, governed context layer for all agents and applications.
  • Integration Points:
    • AWS Glue Data Catalog
    • Amazon SageMaker Unified Studio
    • AWS Lake Formation
    • Amazon Bedrock AgentCore
    • Amazon Bedrock Managed Knowledge Base
  • Agent Access: Agents query through agentic search APIs and MCP tools — framework agnostic.
  • Data Flow:
    1. AWS Context connects to organizational data sources (databases, documents, Slack, CRMs, etc.)
    2. Automatically maps relationships and infers context
    3. Data stewards review, promote, and curate inferred relationships via console
    4. Metadata published in Iceberg format to S3 Tables
    5. Agents query the graph at runtime with identity-aware permissions
    6. Learning loop continuously improves source ranking and path resolution

Integration with AWS Services

  • Amazon Quick: When AWS Context is enabled, Quick’s agents gain access to the broader enterprise knowledge graph, including cross-system relationships, business rules, and curated context beyond any single user’s personal graph.
  • AWS Glue Data Catalog: Integrates with the knowledge graph; supports new business context, semantic search, and skill assets (preview).
  • Amazon Bedrock Managed Knowledge Base: Plugs into AWS Context to enable agentic search across all structured, unstructured, and domain data.
  • AWS Lake Formation: Provides permission governance layer — agents inherit Lake Formation permissions.
  • Amazon S3 Tables: Stores all metadata in Iceberg format for open, queryable access.
  • Amazon S3 Annotations (GA): Attach rich, queryable business context directly to S3 objects — up to 1 GB of context per object, mutable, and automatically queryable through S3 Metadata.

AWS Context vs. Bedrock Knowledge Bases vs. Neptune vs. Glue Data Catalog

Feature AWS Context Bedrock Knowledge Bases Amazon Neptune AWS Glue Data Catalog
Primary Purpose Organizational knowledge graph for AI agents RAG over unstructured documents General-purpose graph database Metadata catalog for data assets
Data Type Structured + unstructured + institutional knowledge Primarily unstructured (documents, PDFs, web pages) Structured graph data (nodes, edges, properties) Technical metadata (schemas, tables, partitions)
Relationship Handling Automatically infers and learns relationships No explicit relationships — vector similarity only Manually defined graph relationships (RDF/Property Graph) Catalog lineage only — no semantic relationships
Learning/Improvement Continuous learning from agent usage patterns No learning — static retrieval pipeline No learning — requires manual graph updates No learning — manual catalog maintenance
Governance Identity-aware (IAM + Lake Formation per query) Basic access control on knowledge base level IAM-based cluster access Lake Formation fine-grained access
Infrastructure Fully managed — no provisioning needed Managed — requires data ingestion setup Self-managed clusters or serverless (must provision) Managed catalog service
Agent Integration Native agentic search APIs + MCP tools Integrated with Bedrock agents via RAG retrieval Custom integration via query APIs (Gremlin/SPARQL) API-based catalog lookup
Data Sources Databases, Slack, emails, CRMs, documents, streams S3, SharePoint, Confluence, Google Drive, web crawlers Application-loaded graph data AWS data service schemas (S3, RDS, Redshift, etc.)
Metadata Format Apache Iceberg in S3 Tables (open, portable) Vector embeddings in managed/custom vector stores Property Graph / RDF triples Hive-compatible catalog format
Best For Enterprise agents needing cross-system business context QA over document collections (policies, manuals, docs) Complex graph traversal, fraud detection, social networks ETL pipeline management, schema discovery
Use with AI Agents Purpose-built for agents — agents navigate graph directly Agents retrieve relevant chunks via similarity search Agents query graph via custom code Agents discover table metadata only

When to Use Which Service

  • AWS Context: Use when you need agents to understand business relationships across multiple systems — understanding how customer data in your CRM relates to orders in your database and communications in Slack.
  • Bedrock Knowledge Bases: Use when agents need to answer questions from unstructured document collections (policy documents, product manuals, knowledge bases) via RAG.
  • Amazon Neptune: Use when you have complex, explicitly defined graph relationships requiring traversal queries — fraud detection rings, social networks, recommendation engines.
  • AWS Glue Data Catalog: Use for ETL pipeline management, schema discovery, and technical metadata governance across your data lake.
  • Combined Approach: AWS Context integrates with Bedrock Managed Knowledge Base to provide agentic search across all structured, unstructured, and domain data together.

Use Cases

Customer Support Agents

  • A customer support agent triaging an issue needs to pull up purchase history, shipping status, and return eligibility across multiple different sources.
  • With AWS Context, the agent navigates the knowledge graph to find all relevant data without custom integrations per data source.
  • The next time a similar issue arises, the agent knows exactly where to go, reducing resolution time.

Data Analyst Agents

  • Agents can discover authoritative data sources, understand join paths between tables, and know which filters and aggregation rules apply.
  • Business rules (like “always exclude test accounts from revenue calculations”) are captured in the knowledge graph and applied automatically.
  • Reduces time spent searching for the right data and understanding how to use it correctly.

Compliance & Audit Agents

  • Compliance agents can trace data lineage and access patterns across the organization.
  • Every agent interaction is auditable — security teams can verify what was accessed and under whose authority.
  • Identity-aware governance ensures agents only access data they’re authorized to see, maintaining regulatory compliance.

Sales & CRM Agents

  • Agents can see the latest interactions with a customer in the CRM and recommend the best follow-up actions.
  • Cross-referencing emails, Slack conversations, and deal history provides complete customer context.
  • Without context, agents confidently give recommendations that are wrong — AWS Context solves this.

Enterprise Knowledge Management

  • Captures institutional knowledge that has never been written down — business rules, domain expertise, tribal knowledge.
  • Makes organizational wisdom available to every agent, not just the humans who happen to know it.
  • New agents benefit immediately from the accumulated context of the entire organization.

Key Benefits

  • Faster Time to Value: No retrieval pipeline to build, no infrastructure to provision — start with a few clicks.
  • Compounding Intelligence: Gets smarter with every agent interaction across the organization.
  • Reduced Token Consumption: Agents navigate directly to the right information instead of processing large context windows.
  • Enterprise Governance: Built-in identity-aware access control using existing IAM and Lake Formation policies.
  • Open Standards: Iceberg format means no vendor lock-in for metadata — query with any compatible tool.
  • Cross-Agent Learning: One agent’s discovery benefits all agents in the organization.
  • Framework Agnostic: Works with Bedrock AgentCore, EKS-deployed agents, or any MCP-compatible framework.

AWS Certification Exam Practice Questions

Question 1: A company wants to enable its AI agents to access business context from multiple data sources including databases, Slack messages, and CRM systems, with automatic relationship inference and identity-aware governance. The solution should require no infrastructure provisioning. Which AWS service should they use?

  1. Amazon Neptune with GraphRAG
  2. AWS Context
  3. Amazon Bedrock Knowledge Bases
  4. AWS Glue Data Catalog with Lake Formation
Show Answer

Answer: B –

Explanation: AWS Context automatically builds a knowledge graph from existing organizational data (databases, Slack, CRMs, documents, emails), infers relationships, provides identity-aware governance, and requires no infrastructure provisioning. Neptune requires cluster management, Bedrock Knowledge Bases focus on unstructured RAG, and Glue Data Catalog only manages technical metadata.

Question 2: How does AWS Context store its metadata to ensure portability and avoid vendor lock-in?

  1. In Amazon DynamoDB tables with proprietary format
  2. In Amazon Neptune graph database clusters
  3. In Apache Iceberg format in Amazon S3 Tables
  4. In Amazon OpenSearch vector indexes
Show Answer

Answer: C –

Explanation: AWS Context publishes all key metadata from structured and unstructured sources into Apache Iceberg format in Amazon S3 Tables. This open format allows customers to query context with Amazon Athena, Amazon Redshift, Apache Spark, or any Iceberg-compatible engine, ensuring portability and no vendor lock-in.

Question 3: A customer support agent built with AWS Context discovered the correct join path between order data and shipping status. What happens when another agent in the organization faces a similar query?

  1. The other agent must independently discover the same join path
  2. A data engineer must manually configure the path for the other agent
  3. The other agent automatically benefits from the discovered path through the learning loop
  4. The organization must rebuild the knowledge graph to include the new path
Show Answer

Answer: C –

Explanation: AWS Context features a continuous learning loop. When one agent discovers a correct join path or resolves a schema ambiguity, it ranks sources by actual usage and shares what it learns across the organization. Other agents automatically pick up these discoveries without requiring human re-curation.

Question 4: Which of the following statements about AWS Context governance are correct? (Select TWO)

  1. Each query inherits the calling user’s IAM and Lake Formation permissions
  2. All agents have unrestricted access to the entire knowledge graph
  3. Every agent interaction is auditable by security and compliance teams
  4. Governance rules must be configured separately from existing AWS permissions
  5. Access control only applies at the knowledge graph level, not per-query
Show Answer

Answer: A, C

Explanation: AWS Context makes every query identity-aware. Each call inherits the calling user’s IAM and Lake Formation permissions, so an agent can only see relationships its identity is authorized to access. Because access runs through identity, every interaction is auditable — security teams can verify exactly what was accessed and under what authority.

Question 5: A company needs to ground its AI agents in both structured business relationships (from databases and CRMs) AND unstructured documents (policy manuals, product guides). Which approach provides the most comprehensive solution?

  1. Use Amazon Neptune for all data types
  2. Use AWS Context alone for both structured and unstructured data
  3. Use AWS Context integrated with Amazon Bedrock Managed Knowledge Base
  4. Use AWS Glue Data Catalog with Amazon Bedrock Knowledge Bases
Show Answer

Answer: C –

Explanation: AWS Context integrates with Amazon Bedrock Managed Knowledge Base to enable agentic search across all structured, unstructured, and domain data. AWS Context provides the knowledge graph for structured relationships and business rules, while Bedrock Managed Knowledge Base handles unstructured document retrieval — together they provide comprehensive coverage.

Frequently Asked Questions

What is AWS Context?

AWS Context is a service that automatically builds a knowledge graph from your organizational data — databases, documents, Slack messages, CRMs, emails. It infers relationships between data assets and makes them navigable by AI agents with built-in governance controls.

How does AWS Context differ from Bedrock Knowledge Bases?

Bedrock Knowledge Bases provide RAG over unstructured documents (PDFs, web pages). AWS Context builds a structured knowledge graph that understands relationships between entities, business rules, and data lineage across all your systems — giving agents navigational intelligence, not just text retrieval.

Does AWS Context require infrastructure setup?

No. AWS Context is fully managed with no infrastructure to provision and no retrieval pipeline to build. It stores metadata in Iceberg format in S3 Tables and learns continuously from agent interactions to improve accuracy over time.

References

AWS Continuum – AI-Native Security at Machine Speed

~ Last updated on : ~ Kiro Agent

AWS Continuum Overview

AWS Continuum is an AI-native security platform announced at AWS Summit New York City on June 17, 2026. It delivers full-lifecycle vulnerability management at machine speed — continuously discovering, prioritizing, validating, and remediating security risks across the software lifecycle, within guardrails you define.

Continuum represents a fundamental shift in how AWS approaches security. The traditional operating model — collect telemetry, store it, query it, build dashboards — can no longer keep pace with the speed at which vulnerabilities emerge. Frontier AI models like Claude Mythos can now autonomously discover zero-day vulnerabilities and reason through complex attack paths at machine speed, creating an exponentially growing backlog that human teams cannot manage alone.

AWS Continuum addresses this by moving from passive monitoring to active reasoning and automated action — telemetry → context → reasoning → actions.

Key Capabilities

1. Continuous Discovery

  • Ingests an organization’s existing vulnerability backlog from multiple sources and scanning tools
  • Performs its own comprehensive vulnerability scans across the full environment
  • Scans both first-party code (your own applications) and third-party dependencies (libraries, packages, containers)
  • Covers infrastructure, permissions, network topology, and application code
  • Creates a comprehensive view of vulnerabilities and associated attack paths
  • Operates continuously rather than on periodic scan schedules

2. Validation

  • Determines which vulnerabilities are genuinely exploitable — not just theoretically risky
  • Contextualizes vulnerabilities against the actual environment configuration
  • Constructs working exploit examples in a sandboxed environment
  • Provides concrete, reproducible evidence of exploitability
  • Surfaces false positives before they waste security team time
  • Dramatically reduces alert fatigue by proving what’s real vs. theoretical

3. Prioritization

  • Evaluates, enriches, and prioritizes every finding using deep environmental context
  • Considers whether the affected component is deployed, reachable, and in a production path
  • Assesses business impact if exploited — blast radius analysis
  • Uses both structured data (infrastructure, permissions, network topology) and unstructured data (documents, communications, business priorities)
  • Produces an evidence-backed priority list so teams focus on what matters most
  • Ranks by exploitability, business context, and blast radius — not just CVSS scores

4. Remediation

  • Assesses existing defenses including blocking controls, compensating controls, and detection mechanisms
  • Recommends mitigation or remediation via network changes, policy changes, or code patches
  • Patch recommendations are validated by the same system that confirmed the vulnerability
  • Provides blast radius visibility and rollback paths where feasible
  • Operates within guardrails you define — you control what actions Continuum can take autonomously
  • Supports graduated trust: starts with human-approved actions, scales to automated enforcement

5. Threat Modeling (Preview)

  • Automatically generates comprehensive threat models from design documents or source code
  • Outputs results in STRIDE format (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege)
  • Performs deep reasoning over architecture, data flows, and trust boundaries
  • Provides prioritized, actionable mitigations across all six STRIDE categories
  • Enables security-by-design before code ships to production
  • Eliminates the manual, time-intensive threat modeling process

6. Model Agnostic Architecture

  • Uses multiple frontier AI models depending on which performs best for each task
  • Built to incorporate the latest and most capable models as they emerge
  • Not locked into a single AI provider — leverages diverse model strengths
  • Different models may excel at code analysis, exploit construction, natural language reasoning, or pattern recognition
  • Ensures Continuum stays at the cutting edge as AI capabilities advance

7. Explainability & Auditability

  • Every recommendation includes the reasoning behind it
  • Every action is auditable with full decision trail
  • Outcomes feed back into the system for continuous improvement
  • Supports compliance and governance requirements with transparent decision-making
  • Enables trust graduation — teams can verify reasoning before expanding automation scope

Continuum Platform Components

Component Status Description
Continuum for Code Vulnerabilities Gated Preview Full lifecycle vulnerability management — discovery, prioritization, validation, remediation
Continuum for Penetration Testing Available On-demand AI-driven pen testing — transforms weeks into hours with reproducible proof
Continuum for Code Scanning Preview Deep security analysis against compliance requirements, exploit patterns, and emerging threat vectors
Continuum for Threat Modeling Preview Automated STRIDE threat models from design docs or source code

Trust Graduation Model

Continuum implements a graduated trust model that puts you in control:

  1. Learn Mode (Default): Continuum proposes actions and a human approves. Every recommendation includes full reasoning and evidence.
  2. Selective Enforcement: You define categories and risk profiles where Continuum can act autonomously (e.g., auto-patch low-risk dependencies).
  3. Full Enforce Mode: Increasingly automated remediation within guardrails you define and can change at any time.

This approach ensures organizations can build confidence incrementally while maintaining compliance with change management processes.

How Continuum Differs from Existing AWS Security Services

AWS Continuum complements rather than replaces existing security services. Here’s how they differ:

Capability Amazon Inspector Amazon GuardDuty AWS Security Hub AWS Continuum
Primary Function Vulnerability scanning Runtime threat detection Findings aggregation & compliance Full lifecycle vulnerability management
Approach Point-in-time scanning Continuous monitoring of runtime behavior Centralized dashboard & compliance checks AI-native continuous reasoning & action
Coverage EC2, ECR, Lambda packages & code VPC Flow Logs, DNS, CloudTrail, EKS, S3 Aggregates from 70+ AWS & partner services Full stack — code, infrastructure, design docs, business context
Validation CVE matching (no exploit proof) Threat intelligence correlation No — surfaces findings as-is Sandbox-based exploit proof (reproducible evidence)
Prioritization CVSS + network reachability Severity levels (Low/Med/High) Severity + compliance framework mapping Business context + exploitability + blast radius
Remediation Suggests patches (manual) None (detection only) Automated responses via EventBridge AI-generated fixes, validated & applied within guardrails
AI-Native No (rule-based) ML-based anomaly detection No Yes — multi-model AI architecture
Lifecycle Stage Pre-deployment & runtime scanning Runtime only Post-detection aggregation Design → Development → Deployment → Runtime

Key Differentiators

  • Inspector tells you what vulnerabilities exist (CVE matching) — Continuum proves which ones are exploitable and fixes them.
  • GuardDuty detects threats at runtime after they happen — Continuum prevents vulnerabilities from reaching production and remediates them when found.
  • Security Hub centralizes findings from multiple services — Continuum ingests those same findings, then reasons over them to prioritize, validate, and resolve.
  • Continuum can consume findings from Inspector, GuardDuty, and Security Hub as inputs to its own reasoning pipeline.

CI/CD Pipeline Integration

AWS Continuum integrates into the software development lifecycle at multiple stages:

Design Phase

  • Threat Modeling: Automatically generates STRIDE threat models from architecture design documents before any code is written
  • Identifies potential attack surfaces and recommends mitigations early in the process

Development Phase

  • Code Scanning: Analyzes code as it’s written against compliance requirements, known exploit patterns, and emerging threat vectors
  • Provides actionable remediation guidance with validated fixes during development

Pre-Deployment (CI Pipeline)

  • Penetration Testing: On-demand pen testing that transforms weeks of manual assessment into hours
  • Multi-step attack scenarios with reproducible proof and ready-to-implement fixes
  • Can be triggered as part of CI pipeline gates before deployment

Post-Deployment (CD Pipeline & Runtime)

  • Continuous Vulnerability Management: Ongoing discovery, prioritization, validation, and remediation of vulnerabilities in running systems
  • Monitors for new CVEs affecting deployed components
  • Automated remediation within defined guardrails (graduated trust)

Feedback Loop

  • Every outcome feeds back into the system — improving future recommendations
  • Findings from runtime inform development-time scanning patterns
  • Maintains security posture between scheduled reviews and audits

Machine Speed Security in an Agentic World

The shift to “machine speed” security is driven by a fundamental asymmetry:

The Problem

  • AI models like Claude Mythos (Anthropic) can autonomously discover zero-day vulnerabilities across every major OS and browser
  • Mythos identified 10,000+ high-severity zero-day vulnerabilities in controlled evaluations, including a 27-year-old bug in OpenBSD
  • These capabilities were not explicitly trained — they emerged from general improvements in code, reasoning, and autonomy
  • The same improvements that make models better at patching vulnerabilities make them better at exploiting them
  • Attackers with access to frontier models can discover and weaponize vulnerabilities in hours or minutes rather than days

Why Traditional Security Fails

  • Manual triage takes days to weeks — AI-discovered vulnerabilities can be exploited in hours
  • Security teams face exponentially growing backlogs they cannot process manually
  • Point-in-time scanning misses the continuous emergence of new threats
  • Dashboard-watching is reactive, not proactive
  • Cross-team coordination for remediation introduces weeks of delay

The Continuum Response

  • Matches attacker speed with defender speed — AI vs. AI
  • Continuous operation eliminates scan-gap exposure windows
  • Automated validation proves exploitability instantly rather than waiting for manual analysis
  • Graduated remediation eliminates coordination bottlenecks
  • Model-agnostic architecture ensures defensive capabilities evolve as fast as offensive ones

Specialized Security Models Changing the Threat Landscape

The emergence of specialized security-focused AI models is fundamentally reshaping cybersecurity:

  • Claude Mythos (Anthropic): Discovered 10,000+ zero-days autonomously; can chain multiple low-severity bugs into high-severity exploit paths; turns N-day vulnerabilities into N-hour exploits
  • Defensive applications: AWS partnered with Anthropic through Project Glasswing to use Mythos defensively — fixing vulnerabilities before they can be exploited
  • The dual-use challenge: Every advancement in AI reasoning benefits both attackers and defenders — making automated defense non-optional
  • AWS Continuum leverages these same frontier models defensively, using them to find and fix vulnerabilities before adversaries can exploit them

Architecture & Data Sources

Continuum reasons over the full environment using two categories of data:

Structured Data (Already in AWS)

  • Infrastructure configuration and topology
  • IAM permissions and access policies
  • Network topology and connectivity
  • Application code and dependencies
  • Existing security findings (Inspector, GuardDuty, Security Hub, third-party tools)

Unstructured Data (Organizational Context)

  • Documents and design specifications
  • Communications and business priorities
  • Risk profiles and compliance requirements
  • Organizational policies and change management processes

This dual-data approach allows Continuum to understand business context rather than applying generic rules uniformly — built on lessons from securing AWS and Amazon.com across different industries.

Design Partners & Availability

  • Status: Gated Preview (as of June 2026)
  • Design Partners: Capital One, MongoDB, Rivian, Robinhood
  • Industries: Financial services, automotive, technology
  • Initial Scope: First-party and third-party code vulnerabilities, expanding to other security domains

AWS Certification Exam Practice Questions

Question 1

A security team receives thousands of vulnerability findings weekly from multiple scanning tools. They spend 80% of their time triaging findings that turn out to be false positives or unexploitable in their environment. Which AWS service specifically addresses this problem by proving exploitability with reproducible evidence in a sandboxed environment?

  1. Amazon Inspector with enhanced scoring
  2. AWS Security Hub with automated workflows
  3. AWS Continuum for code vulnerabilities
  4. Amazon GuardDuty with threat intelligence
Show Answer

Answer: C –

Explanation: AWS Continuum validates findings by constructing working exploit examples in a sandboxed environment, providing concrete reproducible evidence of exploitability. This specifically addresses the false positive problem. Inspector provides CVE matching without exploit proof, Security Hub aggregates findings without validation, and GuardDuty detects runtime threats rather than validating code vulnerabilities.

Question 2

An organization wants to automatically generate threat models from their architecture design documents before development begins, with output in an industry-standard format. Which AWS Continuum capability should they use?

  1. Continuum for Code Scanning
  2. Continuum for Penetration Testing
  3. Continuum for Threat Modeling
  4. Continuum for Code Vulnerabilities
Show Answer

Answer: C –

Explanation: Continuum for Threat Modeling automatically generates comprehensive threat models from design documents or source code and outputs results in STRIDE format (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). This enables security-by-design in the earliest stages of development.

Question 3

A company wants to implement AWS Continuum but their compliance team requires that all automated remediation actions be explainable and auditable. They also want to start with human approval and gradually increase automation. How does Continuum address these requirements? (Choose TWO)

  1. Continuum operates only in fully automated mode for maximum speed
  2. Continuum starts in learn mode with human-in-the-loop approval
  3. Every recommendation includes the reasoning behind it for auditability
  4. Continuum requires manual configuration of AI model parameters
  5. Automated actions cannot be restricted once Continuum is deployed
Show Answer

Answer: B, C

Explanation: Continuum implements a graduated trust model. It starts in learn mode where a human approves every action, and every recommendation includes its full reasoning. Organizations can graduate to enforce mode over time, defining categories and risk profiles for autonomous action. Trust can be adjusted at any time, and all decisions remain auditable.

Question 4

How does AWS Continuum’s approach to vulnerability prioritization differ from Amazon Inspector’s prioritization? (Choose the BEST answer)

  1. Continuum uses CVSS scores while Inspector uses custom scoring
  2. Continuum prioritizes based on business context, exploitability proof, and blast radius analysis using both structured and unstructured organizational data
  3. Continuum only prioritizes based on network reachability
  4. Both services use identical prioritization algorithms
Show Answer

Answer: B –

Explanation: AWS Continuum prioritizes findings using deep environmental and business context — including structured data (infrastructure, permissions, network topology) and unstructured data (documents, business priorities, risk profiles). It considers whether components are deployed, reachable, in production paths, and what the business impact would be. Inspector uses CVSS scores enhanced with network reachability but doesn’t incorporate business context or prove exploitability.

Question 5

A DevSecOps team wants to integrate security checks at every stage of their CI/CD pipeline. Which combination of AWS Continuum capabilities covers the full pipeline from design through runtime? (Choose the BEST answer)

  1. Continuum for Code Scanning at all stages
  2. Threat Modeling (design) → Code Scanning (development) → Penetration Testing (pre-deployment) → Code Vulnerabilities (runtime)
  3. Penetration Testing only — it covers all stages
  4. Code Vulnerabilities at design phase, Threat Modeling at runtime
Show Answer

Answer: B –

Explanation: The full Continuum pipeline maps to the development lifecycle: Threat Modeling generates STRIDE models from design docs during architecture/design; Code Scanning analyzes code during development against compliance and exploit patterns; Penetration Testing validates security with multi-step attack scenarios pre-deployment; and Code Vulnerabilities provides continuous lifecycle management for deployed systems. Each capability feeds findings into the broader Continuum reasoning loop.

Frequently Asked Questions

What is AWS Continuum?

AWS Continuum is an AI-native security service announced at AWS Summit NYC 2026 that manages the full lifecycle of code vulnerabilities at machine speed — continuously discovering, validating exploitability, prioritizing by business context, and remediating within guardrails you define.

How does Continuum differ from AWS Inspector?

Inspector performs point-in-time vulnerability scanning and reports findings. Continuum goes further — it validates which vulnerabilities are genuinely exploitable, prioritizes by real business risk, and can autonomously remediate them within your defined guardrails using AI agents.

What is Continuum Threat Modeling?

Continuum Threat Modeling automatically generates comprehensive threat models from design documents or source code, outputting results in industry-standard formats. It replaces manual threat modeling sessions that typically take days with AI-generated models in minutes.

References