AWS

AWS Firewall Manager – Centralized Security Policies

~ Last updated on : ~ Kiro Agent

AWS Firewall Manager

  • AWS Firewall Manager is a security management service that simplifies administration and maintenance tasks across multiple accounts and resources for a variety of protections.
  • Firewall Manager enables centrally configuring and managing firewall rules across accounts and applications in an AWS Organization.
  • With Firewall Manager, protections are set up once and the service automatically applies them across accounts and resources, even as new accounts and resources are added.
  • Firewall Manager is particularly useful when protecting an entire organization rather than a small number of specific accounts, or when frequently adding new resources that need protection.
  • Firewall Manager provides centralized monitoring of DDoS attacks across the organization.
  • A Firewall Manager administrator account (delegated from the Organizations management account) manages all policies centrally.

AWS Firewall Manager Key Features

  • Centralized Security Policy Management
    • Create and enforce security policies across all accounts in an AWS Organization from a single administrator account.
    • Policies are applied automatically to existing resources and to new resources as they are created.
    • Supports hierarchical rule enforcement — centrally applied rules are constantly monitored for accidental removal or mishandling.
  • Auto-Remediation of Non-Compliant Resources
    • Automatically bring non-compliant resources into compliance by deploying protections (e.g., creating WAF Web ACLs, associating security groups, deploying Network Firewall endpoints).
    • Can be configured to either auto-remediate or notify only, allowing a phased rollout.
    • Best practice is to start without auto-remediation to identify resources requiring manual handling, then enable auto-remediation when confidence is established.
  • Cross-Account Protection Policies
    • Integrated with AWS Organizations to automatically discover all accounts.
    • Policies can be scoped to all accounts or specific OUs and accounts.
    • New in-scope accounts that join the organization are automatically protected.
  • Compliance Dashboard with Notifications
    • Visual dashboard to quickly view protected AWS resources, identify non-compliant resources, and take action.
    • SNS notification streams for configuration changes.
    • Reports non-compliant issues including VPCs and accounts missing protections.
  • Hierarchical Rule Enforcement
    • Allows applying protection policies hierarchically — centrally mandated rules can be enforced while delegating application-specific rule creation to individual accounts.
    • For WAF policies, first and last rule groups are enforced centrally, while account owners can add rules in between.
  • Third-Party Firewall Support
    • Centrally deploy and monitor AWS Marketplace subscribed third-party cloud firewalls (e.g., Palo Alto Networks Cloud NGFW, Fortinet) across all VPCs in the organization.
    • Automates cross-account deployment of firewalls, association of rules, and VPC route configuration.

AWS Firewall Manager Supported Policy Types

  • Firewall Manager supports multiple types of protection policies, similar to how Amazon RDS supports multiple database engines.

AWS WAF Policy

  • Centrally deploys AWS WAF Web ACLs with rule groups across Application Load Balancers, API Gateways, Amazon CloudFront distributions, AWS AppSync GraphQL APIs, Amazon Cognito user pools, AWS App Runner services, and AWS Verified Access instances.
  • Defines first and last rule groups that are enforced centrally — individual accounts can add rules between them.
  • Supports AWS Managed Rules and Marketplace managed rule groups.
  • Automatically creates Web ACLs in member accounts and associates them with in-scope resources.

AWS Shield Advanced Policy

  • Applies Shield Advanced protections across the organization for specified resource types.
  • Protects Application Load Balancers, Classic Load Balancers, Elastic IP addresses, CloudFront distributions, and Global Accelerator accelerators.
  • Automatically subscribes in-scope accounts to Shield Advanced.
  • Associates empty WAF Web ACLs with resources for DDoS mitigation layer.

Amazon VPC Security Group Policy

  • Three types of security group policies:
    • Common security groups — Creates and applies a baseline security group across EC2 instances, ENIs, and Elastic Load Balancers in VPCs.
    • Auditing security groups — Defines guardrails for what security group rules are allowed/disallowed, detects overly permissive rules.
    • Usage auditing security groups — Identifies unused and redundant security groups for cleanup.
  • Continuously monitors security groups for compliance and can auto-remediate violations.

Amazon VPC Network ACL (NACL) Policy

  • Centrally manages VPC network access control lists across the organization (added April 2024).
  • Defines first and last rules for inbound and outbound traffic — individual accounts can create custom rules in between.
  • Enforces presence and ordering of rules in network ACLs within policy scope.
  • Reports non-compliance for NACLs that don’t match the policy configuration.

AWS Network Firewall Policy

  • Centrally deploys AWS Network Firewall endpoints across VPCs in the organization.
  • Supports three deployment models:
    • Distributed — Firewall endpoints deployed in each VPC within policy scope.
    • Centralized — Single firewall in an inspection VPC.
    • Import existing firewalls — Import existing Network Firewalls for centralized management.
  • Automatically manages VPC route tables to route traffic through firewall endpoints.
  • Changes to centrally configured rules are automatically deployed to all accounts and VPCs.

Amazon Route 53 Resolver DNS Firewall Policy

  • Centrally associates VPCs with Route 53 Resolver DNS Firewall rule groups across the organization.
  • Filters DNS queries to block resolution of known malicious domains.
  • Supports shared domain lists for consistent DNS filtering across all accounts.
  • Prevents DNS exfiltration and C2 communications.

Palo Alto Networks Cloud NGFW Policy (Third-Party)

  • Centrally deploys Palo Alto Networks Cloud NGFW resources and rulestacks across all accounts.
  • Supports both distributed and centralized deployment models.
  • Provides advanced threat prevention capabilities including App-ID, URL filtering, DNS Security, WildFire, and Enterprise DLP.
  • Managed through either AWS Firewall Manager native policy or Panorama Cloud Device Groups.
  • Requires active Cloud NGFW subscription from AWS Marketplace.

Fortinet FortiGate Cloud Native Firewall Policy (Third-Party)

  • Centrally deploys Fortinet FortiGate firewalls across VPCs using Firewall Manager.
  • Available through AWS Marketplace subscription.

AWS Firewall Manager Prerequisites

  • AWS Organizations
    • Accounts must be part of an AWS Organization with all features enabled.
    • Organization management account designates a Firewall Manager administrator (delegated administrator).
  • AWS Config
    • AWS Config must be enabled in all accounts and Regions where Firewall Manager policies will be applied.
    • Config records resource configuration changes that Firewall Manager uses to track compliance.
    • Firewall Manager creates Config rules automatically per policy per account to monitor compliance.
  • Firewall Manager Administrator Account
    • Must be a member account in the organization (or management account).
    • Designated by the Organizations management account.
    • Uses a delegated administrator model — can be the management account or a dedicated security account.
    • Best practice: Use a dedicated security account (not the management account) as the Firewall Manager administrator.
  • AWS WAF (for WAF policies)
    • Must use AWS WAF (not WAF Classic) for new policies.
  • Shield Advanced Subscription (for Shield policies)
    • Required only if creating Shield Advanced policies.
    • Shield Advanced subscription fee applies ($3,000/month per organization).
  • Third-Party Marketplace Subscriptions (for third-party policies)
    • Active subscription to the third-party firewall product in AWS Marketplace is required in all target accounts.

Policy Scope and Auto-Remediation

Policy Scope

  • Firewall Manager policies can be scoped using:
    • Account scope — Include all accounts in the organization, specific OUs, or specific accounts. Exclude specific accounts or OUs.
    • Resource type — Target specific resource types (e.g., ALBs, CloudFront distributions, EC2 instances).
    • Resource tags — Include or exclude resources based on tags. Supports both inclusion and exclusion tag lists.
  • Specifying an OU is equivalent to specifying all accounts in that OU and any child OUs, including accounts added later.
  • Best practice: Exclude the Firewall Manager administrator account from security group policies.

Auto-Remediation

  • When enabled, Firewall Manager automatically applies protections to non-compliant resources:
    • WAF policies — Creates Web ACLs and associates them with unprotected resources.
    • Shield policies — Enables Shield Advanced protection and associates empty Web ACLs.
    • Security group policies — Creates and applies security groups, removes non-compliant rules.
    • Network Firewall policies — Creates firewall endpoints and configures VPC route tables.
    • DNS Firewall policies — Associates rule groups with VPCs.
    • NACL policies — Updates network ACLs to match policy rules.
  • When disabled, Firewall Manager reports non-compliance but does not make changes — useful for monitoring mode.
  • Recommended approach: Start with auto-remediation disabled to identify resources requiring manual handling, then enable it when confident in the policy scope.

Integration with AWS Security Hub

  • Firewall Manager integrates natively with AWS Security Hub to send compliance findings.
  • Findings are generated for:
    • Resources that are out of compliance with Firewall Manager policies.
    • Attacks detected by Shield Advanced.
    • Resources missing expected protections.
  • Security Hub aggregates findings across accounts and Regions for centralized visibility.
  • Enables SOC teams to track and respond to compliance drift from a single pane of glass.
  • Supports automated remediation workflows when combined with Security Hub custom actions and EventBridge.
  • Integration can be enabled/disabled from the Security Hub console under Integrations.

Cross-Account Management

  • Firewall Manager uses the delegated administrator model for cross-account management.
  • The Firewall Manager administrator can:
    • Create and apply policies across all member accounts.
    • View compliance status of all accounts.
    • Monitor DDoS events across the organization.
    • Manage WAF rule groups that are shared across accounts.
  • Individual account owners can:
    • Add their own rules between centrally managed first and last rule groups (WAF policies).
    • View compliance status for their own resources.
    • Cannot remove or modify centrally enforced rules.
  • Firewall Manager uses AWS Organizations service-linked roles to deploy resources in member accounts.
  • Multiple Firewall Manager administrators can be designated with different administrative scopes.

Firewall Manager vs Individual Service Management vs Control Tower Guardrails

Feature Individual Service Management AWS Firewall Manager AWS Control Tower Guardrails
Scope Single account, manual per-account setup Multi-account via Organizations, centralized policies Multi-account governance and compliance controls
Primary Purpose Configure individual firewall/security resources Centralized firewall policy deployment and enforcement Account governance, SCPs, and compliance baselines
Auto-Remediation Not built-in (requires custom automation) Yes — automatically deploys protections to non-compliant resources Preventive (SCPs block actions) and Detective (Config rules report violations)
New Account Handling Manual configuration required Automatic — policies applied to new accounts/resources immediately Automatic via Account Factory and enrolled OUs
Policy Types Depends on individual service (WAF rules, SGs, NACLs) WAF, Shield, Security Groups, NACLs, Network Firewall, DNS Firewall, Third-party SCPs, Config Rules (detective/proactive), CloudFormation Hooks
Focus Area Network/application layer protection configuration Network/application layer firewall policy enforcement at scale Broad governance (IAM, logging, networking, data residency)
Compliance Monitoring Must configure separately (Config, CloudWatch) Built-in dashboard + Security Hub integration Built-in Control Tower dashboard
Prerequisites None beyond IAM permissions Organizations (all features), AWS Config Organizations, Control Tower landing zone
Cost Only the underlying service charges $100/policy/Region/month + underlying service charges No additional charge (pays for underlying Config rules)
Best For Small environments, single account, simple setups Multi-account firewall/security policy enforcement at scale Overall account governance, compliance frameworks, landing zone management
Complementary Use Used alongside Firewall Manager as the underlying service Works with Control Tower — Firewall Manager handles network security while Control Tower handles governance Works with Firewall Manager — Control Tower handles governance while Firewall Manager handles firewall policies

When to Use Which

  • Individual Service Management — Single-account environments, proof of concepts, or when you need granular per-resource configuration without organizational overhead.
  • AWS Firewall Manager — Multi-account environments requiring consistent firewall policies, automatic protection of new resources, and centralized compliance monitoring for network security.
  • AWS Control Tower Guardrails — Broad organizational governance including IAM restrictions, logging requirements, data residency controls, and account baseline configurations.
  • Firewall Manager + Control Tower (Together) — Best practice for enterprises: Control Tower manages account governance and baselines, while Firewall Manager enforces network security policies. They are complementary, not competing services.

AWS Firewall Manager Pricing

  • Protection Policy Fee: $100 per policy per Region per month (prorated hourly).
  • Shield Advanced customers: Firewall Manager policy fee is included at no additional charge (only pays for Config rules).
  • AWS Config Rules: Firewall Manager creates 2 Config rules per policy per account — charged at standard Config pricing ($0.003/CI change + $0.001/rule evaluation).
  • Underlying service charges: WAF Web ACLs/rules, Network Firewall endpoints, Shield Advanced, DNS Firewall queries, and third-party firewall charges apply separately.
  • No minimum fees or upfront commitments — pay only for what is used.
  • Note: Some Regions have per-policy prices greater than $100. Check the AWS pricing page for Region-specific pricing.

Pricing Example

  • 1 WAF policy, 7 accounts, no Shield Advanced:
    • Firewall Manager: $100/month
    • WAF (7 Web ACLs + 7 rules): $42/month
    • Config rules: ~$40/month
    • Total: ~$182/month
  • Same scenario WITH Shield Advanced:
    • Firewall Manager: $0 (included with Shield Advanced)
    • WAF: $0 (included with Shield Advanced)
    • Config rules: ~$40/month
    • Total: ~$40/month (plus Shield Advanced subscription of $3,000/month)

AWS Certification Exam Practice Questions

Questions are based on this topic for the AWS Certified Security – Specialty (SCS-C02) and AWS Certified Solutions Architect – Professional (SAP-C02) exams.

  1. A security team wants to enforce a standard set of AWS WAF rules across all accounts in an AWS Organization. The rules should be applied automatically to any new Application Load Balancer created in any account. Individual teams should be able to add their own additional WAF rules. What is the most operationally efficient approach?
    1. Create a WAF Web ACL in each account using AWS CloudFormation StackSets
    2. Use AWS Firewall Manager to create a WAF policy with first and last rule groups scoped to the entire organization
    3. Use AWS Control Tower to create a preventive guardrail that blocks ALBs without WAF
    4. Create a Lambda function triggered by CloudTrail to attach WAF rules to new ALBs
Show Answer

Answer: b – AWS Firewall Manager WAF policies support first and last rule groups that are centrally enforced while allowing account owners to add rules between them. It automatically applies to new resources including ALBs created in new accounts.

  1. A company uses AWS Organizations with 50 accounts across 3 Regions. The security architect needs to ensure all VPCs have AWS Network Firewall endpoints deployed with a standard inspection rule set. New VPCs should be protected automatically without manual intervention. What combination of services achieves this with the LEAST operational overhead?
    1. AWS CloudFormation StackSets with drift detection
    2. AWS Firewall Manager with a Network Firewall policy in distributed mode with auto-remediation enabled
    3. AWS Control Tower with a custom Config rule and Systems Manager remediation
    4. AWS Service Catalog with an approved Network Firewall product
Show Answer

Answer: b – Firewall Manager Network Firewall policies in distributed mode automatically deploy firewall endpoints to all in-scope VPCs. With auto-remediation enabled, new VPCs are protected immediately. This requires the least operational overhead compared to custom automation approaches.

  1. An organization wants to audit all security groups across 100 accounts to identify rules that allow unrestricted SSH access (0.0.0.0/0 on port 22). Non-compliant security groups should be flagged but NOT automatically modified. Findings should appear in AWS Security Hub. Which approach meets these requirements?
    1. Create a Firewall Manager security group audit policy with auto-remediation disabled
    2. Create a Firewall Manager common security group policy
    3. Deploy a Config managed rule restricted-ssh using StackSets
    4. Use AWS Control Tower detective guardrail for open SSH
Show Answer

Answer: a – Firewall Manager security group audit policies define guardrails for allowed/disallowed security group rules and detect overly permissive rules. With auto-remediation disabled, it reports non-compliance without making changes. Findings are automatically sent to Security Hub.

  1. What are the mandatory prerequisites for deploying AWS Firewall Manager policies across an organization? (Select TWO)
    1. AWS Control Tower must be configured
    2. AWS Organizations must be enabled with all features
    3. AWS Config must be enabled in all accounts and Regions where policies apply
    4. AWS CloudTrail must have an organization trail configured
    5. AWS Shield Advanced must be subscribed
Show Answer

Answer: b, c – AWS Organizations (all features enabled) and AWS Config are mandatory prerequisites for Firewall Manager. Control Tower and CloudTrail are not required. Shield Advanced is only required for Shield policies specifically.

  • A company uses AWS Firewall Manager to enforce WAF policies across 20 accounts in us-east-1 and eu-west-1. They are NOT Shield Advanced subscribers. What is the monthly Firewall Manager policy fee alone (excluding WAF and Config charges)?
    1. $100 (one policy applies to both Regions)
    2. $200 (one policy, charged per Region)
    3. $2,000 (one policy per account per Region)
    4. $4,000 (charged per account per Region)
    • Show Answer

    Answer: b – Firewall Manager charges $100 per policy per Region per month. With one WAF policy applied in 2 Regions, the Firewall Manager fee is $200/month. The fee is per policy per Region, regardless of the number of accounts in scope.

    AWS Firewall Manager Certification Tips

    • SCS-C02 (Security Specialty) — Firewall Manager is heavily tested. Focus on:
      • Centralized WAF management across accounts
      • Auto-remediation capabilities and when to use monitoring-only mode
      • Prerequisites (Organizations + Config)
      • Security group auditing for compliance
      • Integration with Security Hub for findings
      • Shield Advanced policy management
    • SAP-C02 (Solutions Architect Professional) — Focus on:
      • Multi-account security architecture with Organizations
      • When to use Firewall Manager vs individual service management
      • Firewall Manager + Control Tower as complementary services
      • Cost optimization (Shield Advanced includes FM at no charge)
      • Operational efficiency — FM as the answer for “least operational overhead” in multi-account scenarios
      • Network Firewall deployment models (distributed vs centralized)
    • Common Exam Patterns:
      • “Centrally manage security policies across all accounts” → Firewall Manager
      • “Automatically protect new resources” → Firewall Manager with auto-remediation
      • “Enforce WAF rules while allowing teams flexibility” → FM WAF policy with first/last rule groups
      • “Audit security groups across organization” → FM security group audit policy
      • “Deploy Network Firewall across multiple VPCs with least effort” → FM Network Firewall policy

    Frequently Asked Questions

    What is AWS Firewall Manager?

    Firewall Manager centrally configures and manages security policies (WAF, Shield Advanced, Security Groups, Network Firewall, DNS Firewall) across all accounts in your AWS Organization. It auto-remediates non-compliant resources.

    What are the prerequisites for Firewall Manager?

    You need AWS Organizations with all features enabled, AWS Config enabled in all accounts/Regions you want to protect, and a designated Firewall Manager administrator account.

    How much does Firewall Manager cost?

    Firewall Manager charges $100 per policy per Region per month, plus the underlying service charges (WAF rules, Network Firewall endpoints, etc.). Shield Advanced customers get Firewall Manager at no additional charge for WAF and Shield policies.

    References

    AWS Resilience Hub – Resiliency Assessment & Testing

    ~ Last updated on : ~ Kiro Agent

    AWS Resilience Hub Overview

    • AWS Resilience Hub is a central location in the AWS Console to manage and improve the resilience of workloads on AWS.
    • It helps proactively prepare and protect applications from disruptions by providing expert-level analysis and actionable guidance to achieve resilience objectives.
    • Resilience Hub identifies gaps before they become incidents and provides centralized visibility into resilience posture.
    • It enables defining resilience goals, assessing resilience posture against those goals, and implementing recommendations for improvement based on the AWS Well-Architected Framework and the AWS Resilience Analysis Framework.
    • A built-in generative AI-driven assessment engine (multi-agent AI engine) evaluates the resilience of workloads against resilience policies, Well-Architected best practices, and the Resilience Analysis Framework to deliver actionable recommendations.
    • Resilience Hub can be integrated into CI/CD pipelines to validate every build before it is released into production.
    • It is part of the Management & Governance category of AWS services.

    Key Features

    Application/Service Definition

    • Resilience Hub allows defining applications (or services in the next-generation model) by importing resources from multiple sources:
      • AWS CloudFormation stacks
      • Terraform state files
      • Amazon EKS clusters and namespaces
      • AWS Service Catalog AppRegistry (myApplications)
      • AWS Resource Groups
      • Resource Tags
    • Each collection supports cross-Region and cross-account resources.
    • The next-generation model (launched May 2026) introduces a business-level understanding with:
      • Systems – represent a business application
      • User Journeys – describe critical business paths
      • Services – deployable units comprising AWS resources, code, and observability
    • Resilience Hub automatically discovers and maps resources into a topology showing how resources connect (data flow, containment, and permissions).

    Resiliency Policy with RTO/RPO Targets

    • Resiliency policies define the resilience expectations for applications through modular, composable requirements.
    • Policies can include:
      • Service Level Objective (SLO) – e.g., 99.95% or 99.99% availability
      • Recovery Time Objective (RTO) – maximum acceptable time to restore service after a disruption
      • Recovery Point Objective (RPO) – maximum acceptable data loss measured in time
      • Disaster Recovery strategy – aligned with RTO/RPO requirements
      • Data Recovery Time Objective – time for restoring from backups
    • Policies can be defined at different disruption levels:
      • Application disruption
      • Infrastructure disruption
      • Availability Zone (AZ) disruption
      • Region disruption
    • Policies are reusable and can be assigned to multiple services/applications across the organization.

    Assessment Against Targets

    • Resilience Hub runs failure mode assessments powered by a multi-agent AI engine to uncover potential failures before they occur in production.
    • The assessment engine:
      • Reads current resource state
      • Analyzes application topology
      • Evaluates architecture against five critical failure modes: Single Points of Failure, Excessive Load, Excessive Latency, Misconfiguration, and Shared Fate
      • Identifies potential failure modes and provides actionable recommendations
    • Assessments compare the estimated workload RTO and RPO against the targets defined in the resiliency policy.
    • Applications are rated as meeting or not meeting their policy targets.
    • Two failure mode assessments per month are included per service.

    Recommendations

    • Resilience Hub provides both Resiliency Recommendations and Operational Recommendations:
      • Resiliency Recommendations – architectural guidance for improving application resiliency (e.g., add Multi-AZ deployment, enable cross-Region replication)
      • Operational Recommendations – include:
        • Amazon CloudWatch Alarms – recommended alarms to monitor resilience
        • Standard Operating Procedures (SOPs) – utilizing AWS Systems Manager Documents
        • Chaos Experiments – using AWS Fault Injection Service (FIS)
    • Recommendations include code (CloudFormation templates) for implementing tests, alarms, and SOPs that can be deployed in CI/CD pipelines.
    • Each finding identifies what the failure mode is, why it matters, how to fix it, and which policy requirement it relates to.

    Drift Detection

    • Resilience Hub can detect drift when the actual application infrastructure deviates from the defined application description.
    • Drift detection identifies when resources have been added, removed, or modified outside of the defined infrastructure-as-code templates.
    • Helps ensure that the assessed state matches the deployed state, maintaining assessment accuracy.
    • Integrates with CloudFormation drift detection to identify configuration changes.

    Automated Dependency Discovery

    • Automatically discovers AWS services, internal endpoints, and third-party endpoints that services depend on.
    • Uses DNS query log analysis (VPC query logs) to identify dependencies, including:
      • Unexpected cross-Region calls
      • Critical third-party dependencies
      • Internal service-to-service dependencies
    • Provides a 35-day lookback for comprehensive dependency identification.
    • Continuous scanning keeps the dependency inventory always up to date, eliminating stale point-in-time snapshots.
    • Available as an optional add-on ($10 per service per month).

    Testing with FIS Integration

    • Resilience Hub integrates with AWS Fault Injection Service (FIS) to provide fault-injection simulations of real-world failures.
    • FIS experiments recommended by Resilience Hub include:
      • Network errors
      • Application processing errors
      • Database connection failures
      • AZ disruptions
      • Instance terminations
    • Resilience Hub generates FIS experiment templates as CloudFormation templates that can be deployed and executed.
    • Tests validate that the application meets its defined RTO/RPO targets under real failure conditions.
    • FIS provides guardrails (stop conditions) to automatically roll back experiments if specific thresholds are breached.

    Resiliency Score

    • AWS Resilience Hub calculates a resiliency score (0-100 points) for each application based on assessment results.
    • The score reflects how well the application meets its defined resiliency policy targets.
    • Score components consider:
      • Whether estimated RTO/RPO meets targets for each disruption type (Application, Infrastructure, AZ, Region)
      • Resource-level compliance with resilience best practices
      • Implementation status of recommended alarms, SOPs, and tests
    • A higher score indicates better alignment with the defined resiliency policy.
    • The score is visible in the Resilience Hub dashboard and can be tracked over time.
    • AWS Trusted Advisor integrates with Resilience Hub to alert when application resiliency scores fall below a specific threshold.

    Operational Recommendations

    • Operational recommendations provide actionable implementation guidance in three categories:

    Alarm Recommendations

    • Resilience Hub recommends Amazon CloudWatch alarms based on the resources and components of the application configuration.
    • Alarms monitor key resilience metrics and alert when thresholds are breached.
    • Provides CloudFormation templates to deploy recommended alarms.
    • Supports alarm detection – identifies existing CloudWatch alarms already monitoring the application and avoids duplicating them.
    • Alarm recommendations are tailored to each resource type (e.g., CPU utilization for EC2, throttle events for DynamoDB, error rates for Lambda).

    SOP Recommendations (Systems Manager Integration)

    • Recommends Standard Operating Procedures implemented as AWS Systems Manager Documents (SSM Documents).
    • SOPs cover recovery procedures such as:
      • Database failover procedures
      • Instance recovery steps
      • Scaling procedures
      • Backup restoration workflows
    • SOPs can be automated using Systems Manager Automation runbooks.
    • Provides code templates for immediate deployment.

    Testing Recommendations (FIS Integration)

    • Recommends AWS FIS experiments to validate resilience under failure conditions.
    • Experiments are provided as deployable CloudFormation templates.
    • Covers various failure scenarios: AZ failures, network disruptions, resource terminations.

    Supported Resources

    • AWS Resilience Hub supports resources from the following AWS services:
    Category Supported Services
    Compute Amazon EC2, AWS Lambda, Amazon EKS, Amazon ECS (including Fargate), AWS Step Functions
    Database Amazon RDS, Amazon DynamoDB, Amazon DocumentDB, Amazon ElastiCache (Redis OSS)
    Networking Amazon Route 53, Elastic Load Balancing, NAT Gateway
    Storage Amazon EBS, Amazon EFS, Amazon S3, Amazon FSx for Windows File Server
    Others Amazon API Gateway, Amazon ARC, Amazon SNS, Amazon SQS, AWS Auto Scaling, AWS Backup, AWS Elastic Disaster Recovery
    • Resources that do not affect estimated workload RTO or RPO (e.g., DB parameter groups) are ignored.
    • Only top-level resources are imported; child resources are derived from parent properties.
    • Amazon EKS assessments support Deployments, ReplicaSets, and Pods.

    Cross-Region and Cross-Account Support

    • Resilience Hub supports cross-Region resource assessment – resources in different Regions can be grouped under a single Application Component.
    • Supports cross-account assessment through:
      • AWS Organizations integration – enables organization-wide resilience management from a single delegated administrator account
      • Cross-account IAM roles – for environments not using Organizations, trust policies with ExternalId prevent confused deputy attacks
    • Organization-wide reporting provides:
      • Resilience posture across all AWS accounts, Regions, and organizational units
      • Centralized policy management
      • Assessment trends over time
      • Compliance status filtering
    • Eliminates the need to log in to individual accounts to assess resilience posture across the enterprise.

    Integration with Other AWS Services

    • AWS Fault Injection Service (FIS) – generates chaos engineering experiment templates to validate resilience
    • AWS Systems Manager – provides SOPs as SSM Documents/Automation runbooks for recovery procedures
    • Amazon CloudWatch – recommends and detects alarms for monitoring application resilience
    • AWS CloudFormation – imports application resources and provides implementation templates
    • AWS Organizations – enables multi-account, organization-wide resilience management
    • AWS Trusted Advisor – surfaces Resilience Hub scores and alerts when scores fall below thresholds
    • AWS Backup – assesses backup configurations as part of RPO evaluation
    • AWS Elastic Disaster Recovery – assesses DR configurations for recovery validation
    • Amazon Application Recovery Controller (ARC) – assesses readiness for DynamoDB global, ELB, RDS, and Auto Scaling groups
    • AWS Well-Architected Tool – assessments are based on Well-Architected best practices

    Comparison: Resilience Hub vs. Well-Architected Tool vs. Trusted Advisor

    Feature AWS Resilience Hub AWS Well-Architected Tool AWS Trusted Advisor
    Purpose Assess and improve application resilience (RTO/RPO) Review workloads against all 6 Well-Architected pillars Automated best practice checks across account
    Scope Application-level resilience focused Workload-level across all pillars (Reliability, Security, Performance, Cost, Operational Excellence, Sustainability) Account-level checks (Cost, Performance, Security, Fault Tolerance, Service Limits)
    Assessment Type Automated AI-powered failure mode analysis against defined RTO/RPO targets Manual questionnaire-based review with best practice guidance Automated checks against predefined rules
    Input Actual infrastructure (CloudFormation, Terraform, EKS, tags) Self-reported answers to framework questions Automated scanning of AWS account resources
    Output Resiliency score, failure modes, recommendations with implementation code (alarms, SOPs, FIS tests) Improvement plan, high/medium risk items, milestones Check results (OK, Warning, Error) with recommendations
    Resilience Focus Deep – RTO/RPO targets, multi-AZ/Region DR, failure mode analysis Broad – covers reliability pillar among other concerns Shallow – basic fault tolerance checks (ELB, RDS Multi-AZ, backups)
    Testing Generates FIS experiment templates for chaos engineering No testing capabilities No testing capabilities
    Dependency Discovery Yes – automated via DNS query log analysis No No
    Cross-Account Yes – via Organizations or cross-account roles Yes – supports multi-account via Organizations Yes – via Organizations (organizational view)
    CI/CD Integration Yes – can validate builds before release No No
    Pricing $15/service/month (includes 2 assessments); optional dependency discovery $10/service/month Free Free (basic); full checks require Business/Enterprise Support

    Pricing

    • Original Resilience Hub (legacy model):
      • Free for first 3 applications for 6 months
      • $15 per application per month after free period
    • Next-Generation Resilience Hub (launched May 28, 2026):
      • $15 per service per month – includes 2 failure mode assessments for services with ≤150 resources
      • Additional resources beyond 150 – $0.10 per resource during each failure mode assessment
      • Additional assessments (beyond 2 included) – $0.10 per assessed resource (minimum 50 resources billed)
      • Automated Dependency Discovery – optional add-on at $10 per service per month
    • Billing begins after the service is created and the first failure mode assessment is completed.
    • Billing stops when the service is removed from Resilience Hub.

    AWS Certification Relevance

    • AWS Solutions Architect Professional (SAP-C02):
      • Domain 1: Design Solutions for Organizational Complexity – multi-account resilience management
      • Domain 3: Design Solutions for Reliability – defining and validating RTO/RPO targets, DR strategy assessment
      • Understanding when to use Resilience Hub vs. Well-Architected Tool vs. Trusted Advisor
    • AWS Solutions Architect Associate (SAA-C03):
      • Domain 2: Design Resilient Architectures – understanding RTO/RPO concepts, high availability patterns
      • Knowing that Resilience Hub can assess and validate disaster recovery configurations
      • Understanding the integration between Resilience Hub and FIS for resilience testing
    • Resilience Hub may also appear in AWS DevOps Engineer Professional and AWS SysOps Administrator exams in the context of operational resilience and chaos engineering.

    AWS Resilience Hub Practice Questions

    Question 1:

    A company wants to validate that their multi-Region application can recover within 15 minutes (RTO) and lose no more than 5 minutes of data (RPO) during a Regional failure. They need automated assessment against these targets and recommendations for improvement. Which AWS service should they use?

    1. AWS Trusted Advisor
    2. AWS Well-Architected Tool
    3. AWS Resilience Hub
    4. AWS Config
    Show Answer

    Answer: 3

    Explanation: AWS Resilience Hub enables defining RTO/RPO targets as resiliency policies and running automated assessments to validate whether applications can meet those targets. It provides specific architectural recommendations when targets are not met. Trusted Advisor provides basic fault tolerance checks but cannot assess against custom RTO/RPO targets. The Well-Architected Tool is questionnaire-based and does not perform automated infrastructure assessment. AWS Config tracks configuration compliance but does not assess resilience against RTO/RPO targets.

    Question 2:

    A solutions architect wants to implement chaos engineering to test an application’s ability to handle AZ failures. They need the testing approach to align with their defined resiliency policies and generate appropriate experiment templates. Which combination of services should they use?

    1. AWS Resilience Hub with AWS Fault Injection Service (FIS)
    2. AWS CloudFormation with AWS Config
    3. AWS Well-Architected Tool with Amazon CloudWatch
    4. AWS Systems Manager with AWS Trusted Advisor
    Show Answer

    Answer: 1

    Explanation: AWS Resilience Hub integrates with AWS Fault Injection Service (FIS) to generate chaos engineering experiment templates based on the application’s defined resiliency policies. These templates can simulate AZ failures, network disruptions, and resource terminations. Resilience Hub provides the policy-aligned testing recommendations, while FIS executes the actual fault injection experiments with guardrails.

    Question 3:

    An enterprise runs 200+ applications across 15 AWS accounts. The SRE team needs to establish consistent resilience standards, assess all applications from a central location, and report compliance to stakeholders. Which approach provides centralized multi-account resilience management?

    1. Deploy AWS Config rules in each account with an aggregator
    2. Use AWS Resilience Hub with AWS Organizations integration
    3. Create Well-Architected reviews for each application in each account
    4. Use AWS Trusted Advisor organizational view
    Show Answer

    Answer: 2

    Explanation: AWS Resilience Hub integrates with AWS Organizations to enable organization-wide resilience management from a single delegated administrator account. This allows setting resilience policies once and applying them organization-wide, tracking assessment trends, and filtering by compliance status. This eliminates the need to log in to individual accounts. Trusted Advisor organizational view provides basic checks but lacks application-level resilience assessment with RTO/RPO targets.

    Question 4:

    A company discovers that their application has undocumented dependencies on third-party services and unexpected cross-Region API calls that could cause failures. Which AWS Resilience Hub feature helps identify these hidden dependencies automatically?

    1. Resiliency Score calculation
    2. Failure Mode Assessment
    3. Automated Dependency Discovery
    4. Drift Detection
    Show Answer

    Answer: 3

    Explanation: AWS Resilience Hub’s Automated Dependency Discovery uses DNS query log analysis to identify AWS services, internal endpoints, and third-party endpoints that services depend on—including unexpected cross-Region calls and integrations the team may not be aware of. It provides a 35-day lookback for comprehensive identification. Failure Mode Assessment evaluates architecture against failure scenarios but doesn’t specifically discover undocumented external dependencies through DNS analysis.

    Question 5:

    A team uses AWS Resilience Hub and wants to implement the recommended monitoring for their application. Resilience Hub has generated alarm recommendations. How should they deploy these alarms?

    1. Manually create each alarm in the CloudWatch console
    2. Deploy the CloudFormation templates provided by Resilience Hub’s operational recommendations
    3. Use AWS Config managed rules to create alarms
    4. Enable AWS Trusted Advisor alarm checks
    Show Answer

    Answer: 2

    Explanation: AWS Resilience Hub provides operational recommendations that include CloudFormation templates for recommended Amazon CloudWatch alarms. These templates can be deployed directly into the application’s infrastructure-as-code pipeline. This approach ensures alarms are version-controlled, repeatable, and aligned with the application’s resilience requirements. Resilience Hub also supports alarm detection to identify existing alarms and avoid duplication.

    Frequently Asked Questions

    What is AWS Resilience Hub?

    Resilience Hub assesses your applications against defined RTO/RPO targets, identifies resiliency gaps, and provides actionable recommendations. It discovers application components from CloudFormation, Terraform, or EKS and scores your resiliency posture.

    Is AWS Resilience Hub free?

    The legacy model charges $0.001 per resource per assessment. The next-gen model (2025) provides continuous monitoring at $3/month per application for up to 100 resources, with $0.03/month per additional resource.

    How does Resilience Hub differ from Well-Architected Tool?

    Well-Architected Tool provides manual questionnaire-based reviews across 6 pillars. Resilience Hub automatically discovers your architecture, runs automated assessments against specific RTO/RPO targets, and integrates with FIS for chaos testing.

    References

    Verified Permissions – Fine-Grained Auth with Cedar

    ~ Last updated on : ~ Kiro Agent

    Amazon Verified Permissions – Fine-Grained Authorization with Cedar

    Amazon Verified Permissions is a fully managed, scalable permissions management and fine-grained authorization service for custom applications. It uses the Cedar policy language — an open-source, expressive, and analyzable policy language — to define who can do what on which resources. Unlike AWS IAM (which controls access to AWS APIs), Verified Permissions is designed to be the externalized authorization engine for your own applications, enabling developers to decouple authorization logic from application code.

    📢 Key Updates (2024–2026):

    • April 2024: Cognito + API Gateway integration launched — secure APIs with fine-grained access control via Quick Start wizard
    • August 2024: Expanded OIDC identity provider support for API Gateway authorization
    • April 2026: Policy store aliases and named policies/policy templates support added
    • May 2026: Multiple namespaces support aligned with Cedar language
    • June 2025: Price reduction — single authorization requests reduced by up to 97% to $5 per million
    • 2025: avp-local-agent for local policy evaluation with zero network latency
    • 2025: ExpressJS integration for Node.js applications

    What is Amazon Verified Permissions?

    Amazon Verified Permissions serves as a Policy Decision Point (PDP) — a centralized service that evaluates authorization requests against Cedar policies and returns Allow or Deny decisions. Your application acts as the Policy Enforcement Point (PEP), calling Verified Permissions before allowing users to perform actions.

    Key Characteristics

    • Externalized authorization: Separates “who can do what” logic from application code, making policies auditable and manageable independently
    • Cedar policy language: Open-source (Apache 2.0), formally verified, human-readable policy language developed by AWS
    • Default deny: All actions are denied unless explicitly permitted — follows the principle of least privilege
    • Explicit deny wins: A single forbid policy always overrides any number of permit policies
    • Real-time evaluation: Sub-millisecond policy evaluation with single-digit millisecond API latency
    • Schema validation: Policies are validated against a schema to catch errors at authoring time
    • Supports RBAC and ABAC: Role-based and attribute-based access control models, or a combination of both
    • Identity provider agnostic: Works with Amazon Cognito, any OIDC provider, or custom identity solutions

    Cedar Policy Language

    Cedar is an open-source policy language designed for expressing authorization policies. It is human-readable, formally verified for correctness, and designed for fast evaluation. Cedar policies are built around four core concepts:

    Core Concepts

    Concept Description Example
    Principal The entity making the request (user, service, role) User::"alice", User::"a1b2c3d4-..."
    Action The operation being performed Action::"viewDocument", Action::"deleteOrder"
    Resource The target entity being acted upon Document::"doc-123", Photo::"vacation.jpg"
    Context Additional request-time attributes (IP, time, MFA status) context.ipAddress, context.authentication.usedMFA

    Policy Structure

    Every Cedar policy has:

    • Effect: Either permit (allow) or forbid (deny)
    • Scope: Specifies which principal, action, and resource the policy applies to (mandatory)
    • Conditions: Optional when (must be true) and unless (must be false) clauses
    • Annotations: Optional key-value metadata (e.g., @id, @advice)

    Cedar Policy Examples

    Example 1: Simple RBAC — Editors Can Edit Documents

    Example 2: ABAC — Owner-Based Access

    Example 3: Context-Based Restriction — MFA Required

    Example 4: Multi-Tenant SaaS — Tenant Isolation

    Example 5: Time-Based and IP Restriction

    Example 6: Forbid Policy — Block Suspended Users

    Policy Store Architecture

    A policy store is the top-level container in Verified Permissions that holds all policies, policy templates, and schema definitions. It is logically isolated from other policy stores.

    Key Characteristics

    • Logical isolation: Each policy store is independent — policies in one store cannot reference or affect another store
    • Application mapping: Typically one policy store per application, or one per tenant in multi-tenant architectures
    • Schema enforcement: Each policy store can have a schema that validates policies at creation time
    • Namespace support: As of May 2026, Verified Permissions supports multiple namespaces within a policy store (aligned with Cedar)
    • Policy store aliases: As of April 2026, you can assign human-readable aliases to policy stores for easier management
    • CloudFormation support: Policy stores can be provisioned as infrastructure-as-code

    Multi-Tenant Strategies

    • Shared policy store: All tenants share one policy store; tenant isolation enforced through when { principal.tenantId == resource.tenantId } conditions
    • Per-tenant policy store: Each tenant gets their own policy store — strongest isolation, but more management overhead
    • Hybrid: Shared store for common policies, per-tenant stores for custom permissions

    Schema Definition

    The schema defines the authorization model for your application — entity types, their attributes, valid actions, and which principals can perform which actions on which resources. It serves as a contract that validates policies.

    Schema Components

    • Entity types: Define principals (e.g., User, Group) and resources (e.g., Document, Folder) with their attributes
    • Actions: Define valid operations and which principal-resource combinations they apply to
    • Common types: Reusable type definitions shared across entity types
    • Hierarchy: Define parent-child relationships (e.g., a Document is in a Folder)

    Example Schema (JSON format)

    How Authorization Decisions Work

    When your application calls the IsAuthorized or IsAuthorizedWithToken API, Verified Permissions evaluates all relevant policies and returns an Allow or Deny decision.

    Evaluation Logic

    1. Collect relevant policies: Verified Permissions identifies all policies whose scope matches the request (principal, action, resource)
    2. Evaluate conditions: For each matching policy, evaluate when and unless conditions against the provided context and entity attributes
    3. Determine individual results:
      • A permit policy with matching scope and satisfied conditions → Allow
      • A forbid policy with matching scope and satisfied conditions → Deny
    4. Combine results:
      • If at least one Deny exists → Final decision is DENY (explicit deny always wins)
      • If at least one Allow and zero Denys → Final decision is ALLOW
      • If no matching policies → Final decision is DENY (implicit deny / default deny)

    Key Principles

    • Default deny: With an empty policy store (no policies), all requests are denied
    • Explicit deny overrides: A single matching forbid policy overrides any number of permit policies
    • No ordering dependency: Policy evaluation order does not matter — all policies are evaluated independently
    • Determining policies: The API response includes which policies contributed to the decision, enabling debugging and audit

    Authorization API Request Example

    Integration with Amazon Cognito

    Amazon Verified Permissions integrates natively with Amazon Cognito, enabling you to use Cognito tokens directly in authorization decisions without manual token parsing.

    How It Works

    • Identity source configuration: Connect a Cognito user pool as an identity source in your policy store
    • Token-based authorization: Use the IsAuthorizedWithToken API, passing the Cognito ID token or access token directly
    • Automatic attribute mapping: Verified Permissions extracts user attributes (groups, custom claims, email) from the token and makes them available in Cedar policies
    • Token validation: Verified Permissions validates token signature, expiration, and issuer automatically
    • Group membership: Cognito groups are mapped to Cedar group hierarchies for RBAC

    Policy Using Cognito Token Attributes

    Integration with API Gateway

    Amazon Verified Permissions can secure Amazon API Gateway REST APIs using a Lambda authorizer pattern, with a Quick Start wizard that automates the setup.

    Architecture Flow

    1. Client sends request to API Gateway with authentication token (Cognito JWT or OIDC token)
    2. API Gateway invokes the Lambda authorizer deployed by the Quick Start wizard
    3. Lambda authorizer extracts token claims, maps the API method and path to Cedar actions/resources
    4. Lambda authorizer calls Verified Permissions IsAuthorizedWithToken API
    5. Verified Permissions evaluates Cedar policies and returns Allow/Deny
    6. Lambda authorizer translates the response to API Gateway’s expected IAM policy format
    7. API Gateway allows or denies the request accordingly

    Key Features

    • Quick Start wizard: Creates the Lambda authorizer, policy store, and sample policies automatically
    • RBAC via groups: Control API access based on Cognito groups or OIDC claims
    • ABAC via attributes: Fine-grained control using user attributes, request parameters, and context
    • OIDC support: Works with any OpenID Connect-compatible identity provider (not just Cognito)
    • Caching: Lambda authorizer can cache authorization results to reduce latency and Verified Permissions API calls

    Policy Templates

    Policy templates are Cedar policies with placeholders for the principal, resource, or both. They enable you to create reusable permission patterns that can be instantiated for specific users and resources.

    How Templates Work

    • Define once: Create a template with ?principal and/or ?resource placeholders
    • Instantiate many: Create template-linked policies by filling in the placeholders with specific entity values
    • Centralized updates: Modify the template and all linked policies are updated automatically
    • Named templates: As of April 2026, templates can have human-readable names for easier management

    Template Example

    When you instantiate this template:

    • ?principal = User::"alice"
    • ?resource = Document::"project-plan-2025"

    This creates a policy that allows Alice to view, edit, and comment on the specific project plan document.

    Use Cases for Templates

    • Document sharing: Grant specific users access to specific documents (like Google Docs sharing)
    • Resource-specific roles: Assign users as “admin” or “viewer” on individual resources
    • Time-limited access: Templates with when { context.time < expiry } for temporary grants
    • Onboarding workflows: Automatically create policies when users are assigned to projects

    Batch Authorization

    The BatchIsAuthorized and BatchIsAuthorizedWithToken APIs allow you to evaluate multiple authorization decisions in a single API call, reducing latency and costs for UI rendering and bulk operations.

    Key Features

    • Up to 30 requests per batch: Each API call can contain up to 30 individual authorization requests
    • Shared principal or resource: Either the principal or the resource must be identical across all requests in a batch
    • Single metering: Each batch API call counts as one request for billing (regardless of the number of individual authorizations)
    • Individual results: Each authorization within the batch returns its own Allow/Deny decision

    Use Cases

    • UI permission rendering: Determine which buttons/actions to show a user across multiple resources (e.g., "Can this user edit, delete, share this document?")
    • Navigation menus: Check access to multiple pages/features in a single call
    • Bulk operations: Verify permissions before processing a batch of items
    • Dashboard rendering: Determine which widgets/data a user can see

    Local Authorization with avp-local-agent

    The avp-local-agent is an open-source Rust-based sidecar that caches policies locally and evaluates authorization decisions within your application, eliminating network round-trips to the Verified Permissions API.

    Key Benefits

    • Zero network latency: Decisions are made locally using the Cedar evaluation engine
    • No authorization API charges: Local evaluations are free — you only pay for policy management (cache refresh) calls
    • High throughput: Ideal for latency-sensitive, high-frequency authorization (e.g., financial trading systems)
    • Configurable cache refresh: Control how often the agent syncs policies from the Verified Permissions service
    • Consistent evaluation: Uses the same Cedar engine as the cloud service, ensuring identical results

    Audit Logging

    Amazon Verified Permissions integrates with AWS CloudTrail for comprehensive audit logging of all API activity.

    What Is Logged

    • Management events: Policy store creation/deletion, schema updates, policy creation/modification — logged by default in CloudTrail
    • Data events: Authorization requests (IsAuthorized, BatchIsAuthorized) — can be enabled for detailed authorization auditing
    • Determining policies: Each authorization response includes the policy IDs that led to the decision
    • Request context: Full details of who requested what, when, and the decision made

    Audit Capabilities

    • Policy querying: APIs to query which policies apply to specific principals or resources
    • Compliance reporting: Answer "who has access to what?" and "why was this access granted?" questions
    • Security investigation: Trace specific authorization decisions back to the policies that permitted them
    • Policy impact analysis: Understand which users/resources would be affected by a policy change before deploying it

    Comparison: Verified Permissions vs IAM Policies vs Cognito Groups vs Custom Authorization

    Feature Verified Permissions IAM Policies Cognito Groups Custom Auth Code
    Purpose Application-level authorization AWS API access control Coarse-grained user grouping Application-level authorization
    Granularity Fine-grained (RBAC + ABAC) Fine-grained for AWS resources Coarse (group membership only) Custom (depends on implementation)
    Policy Language Cedar (human-readable, formally verified) JSON-based IAM policy language None (group assignment only) Code (if/else, switch statements)
    Scope Your application's resources AWS services and resources only Token-based role hints Your application's resources
    Externalized Yes — policies managed separately from code Yes — managed via AWS console/CLI Partially (groups are external) No — embedded in application code
    Auditability High — policies are declarative, queryable High — IAM Access Analyzer Limited (group membership only) Low — requires code review
    Multi-Tenant Built-in (per-tenant policy stores) Not designed for app tenancy Not designed for multi-tenancy Must build from scratch
    Schema Validation Yes — catches policy errors at authoring time Yes — policy validation No No (unless you build it)
    Scalability Fully managed, auto-scaling Fully managed by AWS Fully managed by Cognito Scales with your application
    Performance Sub-ms evaluation; local agent option Evaluated per AWS API call Token parsed locally (fast) Depends on implementation
    Best For Application permissions at scale Controlling AWS resource access Simple role assignment Simple apps or prototypes

    Use Cases

    Multi-Tenant SaaS Applications

    • Enforce tenant data isolation using Cedar policies with tenant context
    • Per-tenant policy stores for strong isolation or shared stores with tenant-scoped policies
    • Tenant administrators can manage their own permissions without affecting other tenants
    • Example: A project management SaaS where each company (tenant) has its own roles, projects, and access rules

    Role-Based Access Control (RBAC)

    • Model roles as Cedar groups (e.g., Group::"admin", Group::"editor", Group::"viewer")
    • Assign users to groups and write policies that permit actions for group members
    • Use action groups to bundle related permissions (e.g., "editor" role gets view + edit + comment)
    • Policy templates for role-resource assignments

    Attribute-Based Access Control (ABAC)

    • Make authorization decisions based on attributes of principals, resources, and context
    • Examples: department matching, job level thresholds, classification levels, time-of-day restrictions
    • Combine with RBAC for layered security: "editors can edit, BUT only documents in their department"

    Document-Level Access Control

    • Model document sharing like Google Docs — individual users can be granted specific access to specific documents
    • Use policy templates: instantiate per user-document pair with specific permissions (view, edit, comment)
    • Hierarchical resources: grant access to a folder, and all documents within it inherit that access
    • Owner-based access: document creators automatically get full control

    Healthcare and Compliance

    • PHI/PII access controls with detailed audit trails for HIPAA compliance
    • Attribute-based filtering of sensitive data fields
    • Break-glass emergency access with logging

    Financial Services

    • Fine-grained API authorization for payment processing and trade execution
    • Segregation of duties enforcement
    • Transaction-level authorization with amount thresholds

    Pricing

    Amazon Verified Permissions follows a pay-per-use model with no upfront or minimum fees. Pricing is the same across all AWS Regions.

    💰 June 2025 Price Reduction: Single authorization request pricing was reduced by up to 97%, from previous pricing to $5 per million requests.
    Usage Type Price Notes
    Single Authorization (IsAuthorized, IsAuthorizedWithToken) $0.000005 per request ($5/million) Per API call
    Batch Authorization (first 40M/month) $0.00015 per request ($150/million) Per batch call (up to 30 authz each)
    Batch Authorization (next 60M/month) $0.000075 per request Volume discount tier
    Batch Authorization (100M+/month) $0.00004 per request Highest volume discount
    Policy Management (CRUD operations) $0.00004 per request Create, Update, Get, List policies
    Local Agent Evaluation $0 (free) Pay only for policy management (cache sync)

    Pricing Example

    A SaaS application with 250 vendors making 250,000 API calls/day × 20 working days = 5 million single authorization requests/month = 5M × $0.000005 = $25/month.

    AWS Certification Relevance

    🎓 Exam Relevance:

    • AWS Certified Developer – Associate (DVA-C02): Domain 3 — "Implement authentication and/or authorization for applications and AWS services." Understand how to externalize authorization using Verified Permissions with Cognito, API Gateway Lambda authorizers, and Cedar policies for application-level access control.
    • AWS Certified Security – Specialty (SCS-C02): Domain 2 — "Security Logging and Monitoring" and Domain 3 — "Infrastructure Security." Understand fine-grained authorization patterns, policy evaluation logic (default deny, explicit deny overrides), integration with identity providers, audit logging via CloudTrail, and when to use Verified Permissions vs IAM vs Cognito groups.

    Key Exam Concepts

    • Verified Permissions is for application-level authorization (not AWS resource access — that's IAM)
    • Cedar uses default deny — explicit permit required; explicit forbid always wins
    • Policy stores provide logical isolation between applications or tenants
    • Integration with Cognito + API Gateway via Lambda authorizer pattern
    • Supports both RBAC (groups/roles) and ABAC (attribute conditions) models
    • BatchIsAuthorized for multiple decisions in a single call (up to 30 requests)
    • Schema validates policies at authoring time (not runtime)
    • Policy templates for reusable permission patterns with placeholders

    Practice Questions

    Question 1

    A SaaS company needs to implement fine-grained access control for their multi-tenant document management application. Each tenant's users should only access documents within their own tenant, and document owners should have full control while team members get read-only access. The solution must be auditable and support real-time policy changes without code redeployment. Which approach best meets these requirements?

    1. Use IAM policies with condition keys to restrict access based on tenant tags
    2. Implement authorization logic in application code using if/else statements with Cognito group membership
    3. Use Amazon Verified Permissions with Cedar policies that evaluate tenant attributes and resource ownership
    4. Create separate Cognito user pools per tenant with custom Lambda triggers for authorization
    Show Answer

    Answer: C –

    Explanation: Amazon Verified Permissions with Cedar policies is designed for application-level fine-grained authorization. Cedar supports RBAC (owner/team member) and ABAC (tenant isolation via attribute matching), policies are externalized from code (real-time updates without redeployment), and all authorization decisions are auditable via CloudTrail. IAM (A) is for AWS resource access, not application authorization. Embedding auth in code (B) is not auditable and requires redeployment for changes. Separate Cognito pools per tenant (D) adds complexity without solving fine-grained document-level access.

    Question 2

    A developer is building a Cedar policy in Amazon Verified Permissions. The policy store has: a permit policy allowing users in the "editors" group to edit documents, AND a forbid policy denying all actions when principal.status == "suspended". A user who is in the "editors" group AND has status "suspended" requests to edit a document. What is the authorization decision?

    1. ALLOW — the permit policy matches and the user is in the editors group
    2. DENY — the forbid policy takes precedence because explicit deny always overrides permit
    3. ALLOW — permit policies are evaluated before forbid policies
    4. Error — conflicting policies cannot exist in the same policy store
    Show Answer

    Answer: B –

    Explanation: In Cedar's policy evaluation logic, an explicit deny (forbid policy) always overrides any number of permit policies. Both policies match the request — the permit matches because the user is in "editors", and the forbid matches because the user's status is "suspended". Since at least one forbid policy matches, the final decision is DENY. Policy evaluation order does not matter (C is wrong), and conflicting policies are perfectly valid (D is wrong).

    Question 3

    A company's application renders a dashboard where different UI elements (buttons, menus, data widgets) should be shown or hidden based on the user's permissions. The application needs to check 15 different permissions for the current user at page load time. What is the most cost-effective approach using Amazon Verified Permissions?

    1. Call the IsAuthorized API 15 times — once for each permission check
    2. Use the BatchIsAuthorized API to evaluate all 15 authorization requests in a single call
    3. Cache all policies locally and evaluate permissions in the browser using JavaScript
    4. Use Cognito groups to determine all permissions without calling Verified Permissions
    Show Answer

    Answer: B –

    Explanation: BatchIsAuthorized can evaluate up to 30 authorization requests in a single API call, and is metered as one request for billing. This is both faster (single round-trip) and more cost-effective than 15 individual calls. Individual calls (A) work but cost 15× more. Client-side evaluation (C) exposes policies to the browser — a security risk. Cognito groups (D) only support coarse-grained RBAC, not fine-grained attribute-based decisions.

    Question 4

    An organization wants to secure their REST APIs in Amazon API Gateway using Amazon Verified Permissions for fine-grained access control based on user attributes from Amazon Cognito. What is the correct architecture to achieve this?

    1. Configure API Gateway to call Verified Permissions directly as a native authorizer
    2. Use a Cognito authorizer on API Gateway and pass the authorization decision to Verified Permissions
    3. Deploy a Lambda authorizer that extracts token claims, calls Verified Permissions IsAuthorizedWithToken API, and returns an IAM policy to API Gateway
    4. Configure Verified Permissions as an identity source in API Gateway's resource policy
    Show Answer

    Answer: C –

    Explanation: The correct pattern uses a Lambda authorizer as the bridge between API Gateway and Verified Permissions. The Lambda function extracts claims from the Cognito token, calls the IsAuthorizedWithToken API, and translates the response into API Gateway's expected IAM policy format (Allow/Deny). API Gateway does not have native Verified Permissions integration (A, D are wrong). A Cognito authorizer (B) only validates tokens — it doesn't call Verified Permissions for fine-grained decisions.

    Question 5

    A financial services company needs to authorize 200 million trade decisions per month with the lowest possible latency. Policies change infrequently (updated a few times daily). Which Amazon Verified Permissions deployment pattern minimizes latency while ensuring policies stay current?

    1. Use the standard IsAuthorized API for each trade with caching enabled
    2. Deploy the avp-local-agent sidecar configured to refresh policies every few minutes, evaluating all decisions locally
    3. Use BatchIsAuthorized with 30 trade decisions per batch to reduce API calls
    4. Implement custom Cedar evaluation in the application code without using Verified Permissions
    Show Answer

    Answer: B –

    Explanation: The avp-local-agent evaluates Cedar policies locally with zero network latency, which is critical for high-frequency trading. Since local evaluations are free ($0), the cost is only for policy management API calls to refresh the cache. With policies changing infrequently, a refresh interval of a few minutes ensures policies stay current. The standard API (A) adds network latency to each decision. BatchIsAuthorized (C) reduces calls but still has network latency. Custom implementation (D) loses the managed service benefits and requires maintaining the Cedar engine yourself.

    Frequently Asked Questions

    What is Amazon Verified Permissions?

    Verified Permissions is a managed authorization service that uses the Cedar policy language to make fine-grained access decisions. It centralizes authorization logic outside your application code, supporting RBAC, ABAC, and relationship-based access control.

    What is Cedar policy language?

    Cedar is an open-source authorization policy language created by AWS. It uses a simple permit/forbid syntax with principals, actions, resources, and conditions. It's designed to be analyzable, auditable, and performant for real-time authorization decisions.

    How does Verified Permissions differ from IAM?

    IAM controls access to AWS resources (who can call AWS APIs). Verified Permissions controls access within your application (which users can see/edit which data). Use IAM for infrastructure; Verified Permissions for application-level authorization.

    References

    Amazon Nova Models – Capabilities, Pricing & Use Cases Compared

    ~ Last updated on : ~ Kiro Agent

    Amazon Nova Models Overview

    Amazon Nova is AWS’s family of foundation models (FMs) available exclusively through Amazon Bedrock. Launched at AWS re:Invent 2024 and significantly expanded at re:Invent 2025, the Nova family spans text generation, multimodal understanding, image generation, video generation, speech-to-speech conversation, browser automation, and custom model building.

    Nova models are designed to deliver frontier intelligence at industry-leading price performance, making them a compelling choice for enterprises looking to reduce costs while maintaining high-quality AI outputs.

    Amazon Nova Model Family

    The Nova family is organized into several categories:

    • Understanding Models – Process text, images, video, and/or speech to generate text (Nova Micro, Nova Lite, Nova Pro, Nova Premier, Nova 2 Lite, Nova 2 Pro)
    • Creative Content Generation – Generate images or video from text/image inputs (Nova Canvas, Nova Reel)
    • Speech Models – Real-time bidirectional voice conversation (Nova Sonic, Nova 2 Sonic)
    • Multimodal Generation – Unified input and output across modalities (Nova 2 Omni)
    • Agentic – Browser-based UI automation (Nova Act)
    • Custom Model Building – Build your own frontier model variants (Nova Forge)

    First Generation Nova Models (re:Invent 2024)

    Amazon Nova Micro

    • Text-only model delivering the lowest latency responses in the Nova family at very low cost.
    • Context window: 128K tokens
    • Input: Text only
    • Output: Text only
    • Optimized for speed and cost — excels at text summarization, translation, content classification, interactive chat, brainstorming, and simple mathematical reasoning and coding.
    • Supports customization via fine-tuning and model distillation.
    • Pricing: ~$0.035/1M input tokens, ~$0.14/1M output tokens (lowest in the Nova family)

    Amazon Nova Lite

    • Very low-cost multimodal model that is lightning fast for processing image, video, and text inputs.
    • Context window: 300K tokens
    • Input: Text, images, video (up to 30 minutes)
    • Output: Text
    • Handles real-time customer interactions, document analysis, and visual question-answering with high accuracy.
    • Supports text and multimodal fine-tuning and model distillation.
    • Pricing: ~$0.06/1M input tokens, ~$0.24/1M output tokens

    Amazon Nova Pro

    • Highly capable multimodal model with the best combination of accuracy, speed, and cost for a wide range of tasks.
    • Context window: 300K tokens
    • Input: Text, images, video
    • Output: Text
    • Sets standards in multimodal intelligence and agentic workflows requiring API/tool calling.
    • Excels at visual question answering, video understanding, financial document analysis, and processing code bases with over 15,000 lines.
    • Serves as a teacher model for distilling custom variants of Nova Micro and Lite.
    • Pricing: ~$0.80/1M input tokens, ~$3.20/1M output tokens

    Amazon Nova Premier

    • Most capable multimodal model for complex reasoning tasks and the best teacher for distilling custom models.
    • Context window: 1M tokens
    • Input: Text, images, video
    • Output: Text
    • Designed for the most demanding enterprise workloads requiring highest accuracy.
    • Best suited for complex multi-step reasoning, research, and as a distillation teacher.

    Amazon Nova Canvas

    • State-of-the-art image generation model producing studio-quality images.
    • Input: Text prompts, reference images
    • Output: Images (up to 2048×2048)
    • Features precise control over style and content with rich editing capabilities:
      • Inpainting and outpainting
      • Background removal
      • Color conditioning
      • Subject-consistent generation
    • Includes built-in watermarking for responsible AI use.
    • Pricing: Per-image pricing, varies by resolution

    Amazon Nova Reel

    • State-of-the-art video generation model for producing short videos.
    • Input: Text prompts, reference images
    • Output: Video (1280×720, 24fps, 6-second clips)
    • Supports camera control actions (zoom, pan, tilt, dolly) and visual style guidance.
    • Ideal for marketing, advertising, social media content, and entertainment.
    • Uses asynchronous API (StartAsyncInvoke) as video generation takes several minutes.
    • Includes digital watermarking on all generated videos.

    Amazon Nova Sonic

    • Speech-to-speech foundation model enabling real-time, human-like voice conversations with low latency.
    • Input: Speech (audio), text
    • Output: Speech (audio), text
    • Unifies speech understanding and generation into a single model architecture.
    • Supports natural turn-taking, interruption handling, and expressive voices (masculine and feminine).
    • Multilingual support: English, Spanish, French, Italian, and German.
    • Integrates with Amazon Connect, telephony providers (Vonage, Twilio, AudioCodes), and conversational AI frameworks (LiveKit, Pipecat).
    • Uses bidirectional streaming API for real-time interaction.

    Second Generation Nova Models (re:Invent 2025)

    At AWS re:Invent 2025, Amazon announced the Nova 2 family with four new models, plus Nova Forge and Nova Act.

    Amazon Nova 2 Lite

    • Fast, cost-effective reasoning model for everyday workloads.
    • Context window: 1M tokens (1 million)
    • Input: Text, images, video, documents
    • Output: Text (up to 65,536 tokens)
    • Features adjustable thinking effort — developers can control how much step-by-step reasoning the model performs before responding, balancing intelligence depth with speed and cost.
    • Built-in tools:
      • Web grounding — searches the web for current information with citations
      • Code interpreter — runs code directly within the workflow
      • Remote MCP tool support
    • Excels in document processing, video information extraction, code generation, grounded answers, and multi-step agentic workflows.
    • Competitive benchmarks: Equal or better on 13/15 benchmarks vs Claude Haiku 4.5, 11/17 vs GPT-5 Mini, 14/18 vs Gemini Flash 2.5.
    • Supports customization via Nova Forge.
    • Pricing: ~$0.30–0.33/1M input tokens, ~$2.50–2.75/1M output tokens

    Amazon Nova 2 Pro

    • Amazon’s most intelligent reasoning model for highly complex tasks.
    • Context window: 1M tokens
    • Input: Text, images, video, speech
    • Output: Text (up to 65,536 tokens)
    • Ideal for agentic coding, long-range planning, and sophisticated problem-solving where highest accuracy is essential.
    • Serves as a teacher model for knowledge distillation into smaller, more efficient student models.
    • Built-in web grounding and code execution capabilities.
    • Competitive benchmarks: Equal or better on 10/16 vs Claude Sonnet 4.5, 8/16 vs GPT-5.1, 15/19 vs Gemini 2.5 Pro.
    • Strengths: Multi-document analysis, video reasoning, complex instructions, advanced math, agentic and software engineering tasks.

    Amazon Nova 2 Sonic

    • Next-generation speech-to-speech model for real-time conversational AI.
    • Context window: 1M tokens
    • Input: Speech, text
    • Output: Speech, text
    • Key improvements over Nova Sonic:
      • Expanded multilingual support with native expressivity
      • Higher accuracy and more natural voices
      • Cross-modal interaction — seamless switching between voice and text in the same session
      • Asynchronous tool calling — handles tasks in the background without interrupting conversation
      • 1M token context window for sustained interactions
    • Integrates with Amazon Connect, Vonage, Twilio, AudioCodes, LiveKit, and Pipecat.
    • Industry-leading price performance vs OpenAI gpt-realtime and Gemini 2.5 Flash realtime APIs.

    Amazon Nova 2 Omni

    • Unified multimodal reasoning AND generation model — an industry first.
    • Context window: 1M tokens
    • Input: Text, images, video, speech, documents
    • Output: Text AND images
    • Can process up to 750,000 words, hours of audio, long videos, and hundred-page documents simultaneously.
    • Eliminates the need to connect multiple specialized models — handles understanding and generation in one workflow.
    • Supports 200+ languages for text processing, 10 languages for speech input.
    • Image generation capabilities include character consistency, text rendering within images, and object/background modification.
    • Use case example: Marketing teams can analyze product details across all formats and generate complete campaigns (headlines, copy, social posts, visuals) in one workflow.
    • Status: Preview (as of December 2025)

    Amazon Nova Act

    • AWS service for building and deploying highly reliable AI agents that automate browser-based UI workflows.
    • Powered by a custom Nova 2 Lite model trained through reinforcement learning on hundreds of simulated web environments.
    • Achieves 90% reliability on early customer workflows — outperforms competing models on relevant benchmarks.
    • Key capabilities:
      • No-code playground for prototyping agents with natural language prompts
      • IDE integration (VS Code) for refinement
      • Deploy to AWS with comprehensive management tools and monitoring via Nova Act console
      • What you build locally scales in production
    • Use cases:
      • Updating data in CRM systems
      • Testing website functionality (QA automation)
      • Submitting health insurance claims
      • Reconciling payments and coordinating shipments
      • End-to-end testing across platforms
    • Customer results:
      • Hertz: 5x faster software delivery, eliminated QA bottleneck
      • 1Password: Automated logins across hundreds of websites
      • Sola Systems: Hundreds of thousands of automated workflows per month
    • Status: Generally Available (December 2025)

    Amazon Nova Forge

    • First-of-its-kind service for organizations to build their own frontier AI model variants (“Novellas”).
    • Pioneers “open training” — gives exclusive access to pre-trained, mid-trained, and post-trained Nova model checkpoints.
    • Customers can mix proprietary data with Amazon Nova-curated datasets at every stage of model training.
    • Solves the three compromises of traditional model customization:
      • Surface-level customization of proprietary models
      • Open-weights models losing capabilities during continued training
      • Building from scratch at enormous expense
    • Key capabilities:
      • Open training checkpoints — blend proprietary data at pre-training, mid-training, and post-training stages
      • Reinforcement learning “gyms” — synthetic environments for training models on simulated real-world scenarios
      • Synthetic data-based distillation — create smaller, faster models that maintain intelligence
      • Responsible AI toolkit — implement safety controls
    • Currently available with Nova 2 Lite; early access to Nova 2 Pro and Nova 2 Omni for Forge customers.
    • Custom models deploy on Amazon Bedrock with enterprise-grade security, scalability, and data privacy.
    • Customers: Booking.com, Reddit, Sony, Cosine AI, Nimbus Therapeutics, Nomura Research Institute, OpenBabylon.

    Amazon Nova Model Comparison Table

    Model Input Types Output Types Context Window Latency Price Tier Best For
    Nova Micro Text Text 128K Lowest $ (Lowest) Chat, summarization, classification
    Nova Lite Text, Image, Video Text 300K Very Low $ Multimodal Q&A, document analysis
    Nova Pro Text, Image, Video Text 300K Low $$ Agentic workflows, complex analysis
    Nova Premier Text, Image, Video Text 1M Medium $$$ Complex reasoning, model distillation
    Nova Canvas Text, Image Image N/A Medium Per image Image generation, editing
    Nova Reel Text, Image Video N/A High (async) Per video Video content creation
    Nova Sonic Speech, Text Speech, Text N/A Real-time $$ Voice assistants, IVR
    Nova 2 Lite Text, Image, Video, Docs Text 1M Low $$ Reasoning, coding, agentic tasks
    Nova 2 Pro Text, Image, Video, Speech Text 1M Medium $$$ Complex reasoning, agentic coding
    Nova 2 Sonic Speech, Text Speech, Text 1M Real-time $$ Conversational AI, async tool use
    Nova 2 Omni Text, Image, Video, Speech Text, Image 1M Medium $$$ Unified multimodal workflows
    Nova Act Natural language prompts Browser actions N/A Variable Per workflow UI automation, QA testing
    Nova Forge Training data + checkpoints Custom model N/A N/A (training) Custom Building domain-specific models

    When to Use Each Nova Model

    Scenario Recommended Model Why
    High-volume chatbot with lowest cost Nova Micro / Nova 2 Lite Lowest per-token cost, fast response times
    Document/image analysis at scale Nova 2 Lite 1M context, multimodal, cost-effective reasoning
    Complex multi-step agentic coding Nova 2 Pro Highest intelligence, built-in tools
    Building custom domain model Nova Forge + Nova 2 Lite/Pro Open training with proprietary data
    Marketing image generation Nova Canvas Studio-quality with precise controls
    Social media video creation Nova Reel Professional video from text/image prompts
    Voice-based customer service Nova 2 Sonic Real-time, natural conversation with tool use
    Unified content generation pipeline Nova 2 Omni Single model for text + image generation from any input
    Browser-based QA testing Nova Act 90% reliability, production-ready UI automation
    Knowledge distillation Nova Premier / Nova 2 Pro Best teacher models for creating efficient custom variants

    Amazon Nova vs Competitors

    Capability Amazon Nova Anthropic Claude OpenAI GPT Meta Llama
    Model range Micro to Premier + specialized (Canvas, Reel, Sonic, Act) Haiku, Sonnet, Opus GPT-4o mini, GPT-4o, GPT-5 8B, 70B, 405B (open weights)
    Multimodal input Text, image, video, speech, documents Text, image, documents Text, image, audio Text, image
    Image generation Nova Canvas, Nova 2 Omni No DALL-E (separate) No
    Video generation Nova Reel No Sora (separate) No
    Speech-to-speech Nova Sonic / Nova 2 Sonic No GPT Realtime API No
    Context window Up to 1M tokens 200K tokens 128K–1M tokens 128K tokens
    Browser automation Nova Act Computer Use (beta) Operator No
    Custom model building Nova Forge (open training) No Fine-tuning only Full open weights
    Price performance Industry-leading (75% less than comparable models) Premium pricing Premium pricing Free weights (self-host costs)
    AWS integration Native (Bedrock, Connect, S3) Via Bedrock Via Bedrock (select models) Via Bedrock

    Key Differentiators for Amazon Nova

    • Breadth of modalities: No other single model family covers text, image, video, speech generation + browser automation + custom model building.
    • Price performance: Nova models consistently offer 3-5x better cost efficiency than comparable alternatives.
    • Nova Forge uniqueness: Only platform offering “open training” with access to model checkpoints at pre/mid/post-training stages.
    • Native AWS ecosystem: Deep integration with Bedrock, Knowledge Bases, Agents, Guardrails, Connect, and S3.
    • Built-in safety: All models include safety controls; creative models include watermarking.

    Amazon Bedrock Integration

    All Nova models are accessed through Amazon Bedrock, providing:

    • Unified API: Single Converse API for all text/multimodal models; async invoke for creative models.
    • Amazon Bedrock Knowledge Bases: Enhance Nova models with proprietary information via RAG.
    • Amazon Bedrock Agents: Build multi-step agentic workflows with Nova models.
    • Amazon Bedrock Guardrails: Apply content filters, PII detection, and grounding checks.
    • Cross-Region Inference: Available for Nova Micro, Lite, Pro, and Nova 2 models across multiple regions.
    • Intelligent Prompt Routing: Automatically route between Nova Pro and Nova Lite based on prompt complexity (up to 30% cost savings).
    • Model Customization: Fine-tuning, continued pre-training, and distillation support.
    • Batch Inference: 50% lower price for high-volume offline workloads.
    • Provisioned Throughput: Guaranteed capacity for production workloads.

    Bedrock Model IDs

    • amazon.nova-micro-v1:0 – Nova Micro
    • amazon.nova-lite-v1:0 – Nova Lite
    • amazon.nova-pro-v1:0 – Nova Pro
    • amazon.nova-premier-v1:0 – Nova Premier
    • amazon.nova-canvas-v1:0 – Nova Canvas
    • amazon.nova-reel-v1:0 – Nova Reel
    • amazon.nova-sonic-v1:0 – Nova Sonic
    • amazon.nova-2-lite-v1:0 – Nova 2 Lite
    • amazon.nova-2-pro-v1:0 – Nova 2 Pro

    AWS Certification – AIF-C01 Relevance

    Amazon Nova models are highly relevant for the AWS Certified AI Practitioner (AIF-C01) exam:

    • Domain 1 – Fundamentals of AI and ML: Understanding foundation model types, model selection criteria, multimodal capabilities.
    • Domain 2 – Fundamentals of Generative AI: Foundation model families, model selection based on use case requirements (cost, latency, accuracy), understanding of text/image/video/speech generation.
    • Domain 3 – Applications of Foundation Models: RAG integration, agentic workflows, model customization (fine-tuning vs distillation vs continued pre-training vs open training).
    • Domain 4 – Guidelines for Responsible AI: Built-in safety controls, watermarking, Bedrock Guardrails integration.

    Key exam concepts related to Nova:

    • Difference between understanding models and generative models
    • Model selection based on latency, cost, and capability requirements
    • Customization methods: fine-tuning, distillation, continued pre-training, Nova Forge open training
    • Responsible AI: watermarking, safety controls, content moderation
    • Bedrock features: Guardrails, Knowledge Bases, Agents, cross-region inference
    • Agentic AI capabilities and Nova Act for UI automation

    Amazon Nova Models – Practice Questions

    1. A company needs to build a high-volume customer service chatbot that must respond to text queries with the lowest possible latency and minimal cost. Which Amazon Nova model should they choose?

    1. Amazon Nova Pro
    2. Amazon Nova Micro
    3. Amazon Nova 2 Lite
    4. Amazon Nova Premier
    Show Answer

    Answer: B –

    Explanation: Amazon Nova Micro is a text-only model designed specifically for the lowest latency responses at the lowest cost in the Nova family. It is optimized for tasks like interactive chat, text summarization, and content classification. While Nova 2 Lite also offers good performance, Nova Micro provides the absolute lowest latency for text-only use cases.

    2. A media company wants to use a single AI model to analyze product videos, customer testimonials (audio), brand guidelines (documents), and product images — then generate marketing copy AND promotional images in one unified workflow. Which Amazon Nova model enables this?

    1. Amazon Nova Pro
    2. Amazon Nova Canvas
    3. Amazon Nova 2 Omni
    4. Amazon Nova 2 Pro + Nova Canvas (pipeline)
    Show Answer

    Answer: C –

    Explanation: Amazon Nova 2 Omni is the industry’s first unified multimodal reasoning and generation model that can process text, images, video, and speech inputs while generating BOTH text AND images. This eliminates the need to chain multiple specialized models. Nova Pro and Nova 2 Pro only output text, and Nova Canvas only generates images from text/image prompts without the multimodal understanding capability.

    3. An organization wants to build a custom AI model that deeply integrates their proprietary medical research data while maintaining frontier-level reasoning capabilities. They need access to model training checkpoints to mix their data at multiple training stages. Which Amazon service should they use?

    1. Amazon Bedrock Fine-tuning
    2. Amazon SageMaker Training
    3. Amazon Nova Forge
    4. Amazon Nova 2 Pro with RAG
    Show Answer

    Answer: C –

    Explanation: Amazon Nova Forge is the only service that provides “open training” — giving organizations access to pre-trained, mid-trained, and post-trained Nova model checkpoints so they can blend their proprietary data with Nova-curated datasets at every stage of model training. Standard fine-tuning only adjusts a model’s behavior at the post-training stage. RAG augments responses but doesn’t deeply integrate knowledge into model weights.

    4. A company wants to automate end-to-end testing of their web application, including navigating pages, filling forms, and verifying UI elements. They need a solution that achieves high reliability and can scale in production on AWS. Which Amazon Nova offering should they use?

    1. Amazon Nova 2 Pro with Bedrock Agents
    2. Amazon Nova Act
    3. Amazon Nova 2 Lite with custom prompts
    4. Amazon Nova Forge
    Show Answer

    Answer: B –

    Explanation: Amazon Nova Act is specifically designed for building and deploying AI agents that automate browser-based UI workflows. It achieves 90% reliability through reinforcement learning training on hundreds of simulated web environments. It provides a no-code playground for prototyping, IDE integration for development, and production deployment on AWS with monitoring. Hertz used Nova Act to accelerate software delivery 5x by automating end-to-end testing.

    5. A developer is building a voice-based AI assistant that needs to handle real-time conversations, switch between voice and text seamlessly, execute background tasks (like booking flights) without interrupting the conversation, and maintain context over long interactions. Which Amazon Nova model is best suited? (Select TWO capabilities that make it ideal)

    1. Amazon Nova Sonic — because it supports bidirectional streaming
    2. Amazon Nova 2 Sonic — because it supports asynchronous tool calling and 1M token context window
    3. Amazon Nova 2 Lite — because it has web grounding and code interpreter
    4. Amazon Nova 2 Omni — because it generates text and images
    5. Amazon Nova 2 Sonic — because it supports cross-modal interaction (voice/text switching)
    Show Answer

    Answer: B, E

    Explanation: Amazon Nova 2 Sonic is the ideal model for this use case. It features: (1) asynchronous tool calling that lets users continue natural conversations while background tasks complete, (2) cross-modal interaction allowing seamless switching between voice and text, and (3) a 1M token context window for sustained interactions. While Nova Sonic (v1) supports real-time streaming, it lacks the async tool calling, cross-modal switching, and extended context window that Nova 2 Sonic provides.

    Frequently Asked Questions

    What are Amazon Nova models?

    Amazon Nova is AWS’s own family of foundation models available through Bedrock. It includes text models (Micro, Lite, Pro, Premier), creative models (Canvas for images, Reel for video, Sonic for speech), and agent models (Act for browser automation, Forge for custom training).

    Which Nova model should I use?

    Use Nova Micro for fast text tasks (lowest cost). Nova Lite for multimodal with budget constraints. Nova Pro for balanced performance. Nova Premier for complex reasoning. Nova 2 Lite for extended thinking with 1M token context. Nova Act for browser-based agent automation.

    How does Nova compare to Claude and GPT?

    Nova Pro offers competitive performance at lower cost than Claude 3.5 Sonnet or GPT-4o for many tasks. Nova’s key advantages are native AWS integration, lower pricing, and specialized models (Canvas, Reel, Sonic) that competitors don’t offer as integrated options.

    References

    Lambda Durable Functions – Stateful Serverless

    ~ Last updated on : ~ Kiro Agent

    📢 New Service – Announced at re:Invent 2025

    AWS Lambda Durable Functions were announced at re:Invent 2025 (December 2025) and are now generally available across ~31 AWS Regions as of mid-2026. They support Python, JavaScript/TypeScript, and Java runtimes.

    Certification Relevance: DVA-C02 (Developer Associate), SAA-C03 (Solutions Architect Associate) — expect questions on choosing between Durable Functions, Step Functions, and SQS+Lambda patterns.

    What are AWS Lambda Durable Functions?

    • Lambda Durable Functions extend the Lambda programming model to build fault-tolerant, multi-step, stateful applications and AI workflows using familiar programming languages.
    • They enable multi-step coordination without idle compute costs — functions can suspend execution (wait) for up to one year without incurring compute charges.
    • Durable Functions use a checkpoint and replay mechanism (durable execution) to track progress, automatically recover from failures, and resume from where they left off.
    • You write sequential code in your preferred language (Python, JavaScript/TypeScript, Java), and the SDK handles state management, retries, and orchestration transparently.
    • Durable execution must be enabled at function creation time — it cannot be added to existing Lambda functions.
    • The open-source AWS Durable Execution SDK provides the primitives (steps, waits, callbacks, parallel, map) needed to build resilient workflows.
    Lambda Durable Functions — Checkpoint/Replay
    Step 1
    Validate Order
    →
    Step 2
    Charge Payment
    →
    ⏸ Wait
    Human Approval
    (up to 1 year)
    →
    Step 3
    Ship Order
    →
    ✅ Done
    💾 State checkpointed after each step —
    💰 No charge during waits

    Architecture – Checkpoint and Replay Pattern

    • Orchestrator Pattern: A durable function acts as an orchestrator that coordinates multiple steps in a workflow using sequential code.
    • Durable Execution: The complete lifecycle of a durable function run — from start to completion — is called a durable execution.
    • Checkpointing: Each durable operation (step, wait) creates a checkpoint that records the result. Progress is persisted automatically.
    • Replay: When execution resumes after a pause or failure, the function replays from the beginning, skipping completed checkpoints using stored results instead of re-executing them.
    • Sub-invocations: A single durable execution may involve multiple Lambda invocations (sub-invocations) — the initial invocation plus resumptions after waits, retries, or infrastructure failures.
    • Determinism Requirement: Code between durable operations must be deterministic — the replay mechanism depends on consistent execution paths across replays.

    Core Primitives (Durable Operations)

    • Steps (context.step()) — Execute business logic with built-in retries and automatic checkpointing. Once completed, steps are skipped during replay.
    • Waits (context.wait()) — Suspend execution for a specified duration (seconds to one year). The function terminates and does not incur compute charges during the wait.
    • Callbacks (context.create_callback()) — Pause execution until an external event (API call, human approval) signals completion via the Lambda API.
    • Wait for Condition (context.wait_for_condition()) — Suspend until a specific condition is met, such as polling a REST API for process completion.
    • Parallel (context.parallel()) — Execute different independent operations concurrently.
    • Map (context.map()) — Apply the same operation to every item in a collection concurrently (fan-out/fan-in).

    How It Works – Flow

    1. Create a Lambda function with durable execution enabled at creation time.
    2. Add the Durable Execution SDK to your function code.
    3. Wrap your handler with @durable_execution decorator (Python) or equivalent.
    4. Use context.step() for business logic with automatic checkpointing and retries.
    5. Use context.wait() or context.create_callback() to suspend execution without compute charges.
    6. On resume, the SDK replays from the beginning, skipping completed steps using stored results.
    7. Monitor execution progress in the Lambda console Durable executions tab.

    Key Features

    Automatic State Persistence

    • Every durable operation automatically checkpoints its result to durable storage.
    • No need to manually manage state in DynamoDB, S3, or external databases.
    • State is retained for a configurable period (1–90 days, default 14 days) after execution completes.
    • Execution history is available via the GetDurableExecutionHistory API for debugging and auditing.

    Exactly-Once Execution Semantics

    • Steps that complete successfully are never re-executed during replay — their stored results are used instead.
    • Built-in idempotency: invoking a function twice with the same execution name returns the existing execution result instead of creating a duplicate.
    • Configurable retry strategies with max attempts, backoff rate, and custom error handling per step.

    Timer and Wait Support

    • Waits can suspend execution from seconds up to one year (max ExecutionTimeout: 31,622,400 seconds).
    • During wait operations, on-demand functions do not incur compute charges — you only pay for storage.
    • Ideal for scheduled delays, polling intervals, and time-based business rules.

    Human Approval Workflows

    • Callbacks allow execution to pause until an external system (or human) signals completion.
    • External systems call SendDurableExecutionCallbackSuccess or SendDurableExecutionCallbackFailure APIs.
    • Callbacks support configurable timeouts — if no response within the timeout, execution can handle the timeout gracefully.
    • Can be sent directly from the Lambda console for testing.

    Sub-Orchestrations and Concurrency

    • Parallel: Execute different independent tasks concurrently and collect results.
    • Map: Fan-out the same operation across a collection of items and fan-in the results.
    • Child contexts: Compose complex workflows from smaller, reusable durable function patterns.
    • All concurrent operations are checkpointed and replayed correctly.

    EventBridge Integration

    • Lambda automatically sends Durable Execution Status Change events to the default EventBridge bus.
    • Build downstream workflows, notifications, or monitoring based on execution state changes.
    • Event source: aws.lambda, detail-type: Durable Execution Status Change.

    Lambda Versions for Safe Deployments

    • Use Lambda versions to ensure replay always happens on the same code version that started the execution.
    • Prevents inconsistencies from code changes during long-running workflows.
    • Critical for production deployments where executions may be suspended for days or weeks.

    Lambda Durable Functions vs Step Functions

    Feature Lambda Durable Functions AWS Step Functions
    Primary Focus Application development within Lambda Workflow orchestration across AWS services
    Service Type Runs within Lambda Standalone, dedicated workflow service
    Programming Model Standard languages (Python, JS/TS, Java) Amazon States Language (ASL) / Visual Designer
    Development Tools IDE, LLM agents, unit test frameworks, SAM, CDK Visual Workflow Builder, CDK, Toolkit
    AWS Integrations Lambda event sources 220+ AWS services, 16,000+ APIs natively
    Max Execution Duration Up to 1 year Up to 1 year (Standard Workflows)
    Pricing Model Lambda compute + $8/million durable operations + data written + data retention $25/million state transitions (Standard) or per-request (Express)
    Wait Cost No compute charges during waits (storage only) No charges during waits
    Visual Design No — code-first approach Yes — Workflow Studio visual designer
    Stakeholder Visibility Requires code reading Visual graph for non-technical stakeholders
    Infrastructure Management Managed within Lambda (SDK updates needed) Fully managed, zero maintenance
    Best For Distributed transactions, stateful app logic, AI workflows Business process automation, multi-service orchestration

    When to Use Lambda Durable Functions

    • Your team prefers writing workflows in standard programming languages.
    • Application logic is primarily within Lambda functions (Lambda-centric).
    • You want fine-grained control over execution state in code.
    • Business logic and workflow are tightly coupled.
    • You want to iterate quickly without switching between code and visual/JSON designers.
    • You’re building AI agent orchestration that requires code-level control.

    When to Use Step Functions

    • You need visual workflow representation for cross-team visibility.
    • You’re orchestrating multiple AWS services and want native integrations without custom SDK code.
    • Non-technical stakeholders need to understand and validate workflow logic.
    • You want fully managed, zero-maintenance infrastructure (no patching, runtime updates, SDK bundling).
    • You need integration with 220+ AWS services without writing Lambda functions for each.

    Hybrid Architectures

    • Many applications benefit from using both services together.
    • Common pattern: Use durable functions for application-level logic within Lambda, while Step Functions coordinates high-level workflows across multiple AWS services.
    • Start with durable functions for Lambda-centric workflows; add Step Functions when multi-service orchestration is needed.

    Lambda Durable Functions vs SQS + Lambda Pattern

    Aspect Lambda Durable Functions SQS + Lambda
    State Management Automatic via SDK checkpoints Manual (DynamoDB, S3, or message attributes)
    Error Handling Built-in retries, automatic recovery Dead-letter queues, manual retry logic
    Workflow Visibility Execution history in Lambda console CloudWatch logs, custom tracing
    Long Waits Native wait up to 1 year, no compute cost SQS delay (max 15 min), needs workarounds
    Ordering Sequential by default, parallel when needed FIFO queues or custom ordering
    Code Complexity Single function, sequential code Multiple functions, queue config, DLQ setup
    Idempotency Built-in via execution names Must implement manually
    Best For Multi-step workflows, long-running processes Decoupled event-driven processing, high throughput message processing

    Use Cases

    Saga Pattern (Distributed Transactions)

    • Coordinate payments, inventory, and shipping across multiple services with automatic rollback on failures.
    • Each step is checkpointed — if a later step fails, compensating actions can be triggered for earlier steps.
    • Example: Order processing → Payment authorization → Inventory allocation → Fulfillment, with compensation logic.

    Human Approval Workflows

    • Suspend execution waiting for human decisions (loan approvals, expense reports, content moderation).
    • Use callbacks to pause for days or weeks without compute charges.
    • External approval systems call the Lambda API to resume execution with approval/rejection results.

    Fan-Out / Fan-In

    • Use map() to process a collection of items concurrently (e.g., batch image processing, parallel API calls).
    • Use parallel() for different independent tasks that must all complete before proceeding.
    • Results are automatically collected and available after all concurrent operations complete.

    Long-Running Processes

    • Employee onboarding workflows spanning days or weeks (account creation → training assignments → equipment provisioning → check-ins).
    • Insurance claim processing with document analysis, human review (7+ days), and payment processing.
    • Compliance workflows with scheduled checks and waiting periods.

    AI Agent Orchestration

    • Chain multiple LLM calls with intermediate processing, human feedback loops, and tool use.
    • Build multi-agent workflows where agents collaborate asynchronously.
    • Integrate with Amazon Bedrock for AI-powered analysis steps within durable workflows.
    • Handle long-running AI tasks (model training jobs, batch inference) with wait-and-resume patterns.

    Polling and Condition-Based Workflows

    • Poll external APIs or systems until a condition is met (e.g., payment settlement, third-party processing).
    • Use wait_for_condition() to efficiently check conditions at intervals without continuous compute.

    Pricing

    • Pay only for active compute: During wait operations, on-demand functions suspend and do not incur duration charges.
    • Standard Lambda charges apply: Requests ($0.20/million) and compute duration (per GB-second) for active execution time, including sub-invocations from replays.
    • Durable Operations: $8.00 per million operations (start execution, complete step, create wait, etc.).
    • Data Written: $0.25 per GB of data written by durable operations (step results, invocation payloads).
    • Data Retention: $0.15 per GB-month for data stored during execution and after completion (configurable 1–90 days, default 14 days, prorated).
    • Free Tier: Standard Lambda free tier (1M requests + 400,000 GB-seconds) applies to the compute portion.

    Pricing Example

    • 1 million claims processed/month, each with: 30s analysis step + 7-day human review wait + 2s payment step.
    • Compute: ~$421 (32M GB-seconds at 1GB memory).
    • Durable Operations: $32 (4M operations — 1 start + 2 steps + 1 wait per execution).
    • Data Written: $26 (104GB at $0.25/GB).
    • Data Retention: ~$11 (during wait + 14-day post-completion retention).
    • Total: ~$490/month for 1M executions with 7-day waits — no compute charges during the wait period.

    Limitations

    • Immutable configuration: Durable execution can only be enabled at function creation time — cannot be added to or removed from existing functions.
    • Language support: Currently supports Python (3.13/3.14), JavaScript/TypeScript (Node.js 22/24), and Java. No support for Go, .NET, or Ruby as of mid-2026.
    • Determinism requirement: Code between durable operations must be deterministic — no random values, timestamps, or non-deterministic API calls outside of steps.
    • SDK dependency: Requires bundling the open-source Durable Execution SDK with your function code and managing SDK version updates.
    • Max execution timeout: 31,622,400 seconds (~1 year). Executions exceeding this are terminated.
    • Retention period: Execution history retained 1–90 days after completion (default 14 days).
    • State size: Large state objects increase storage costs and can impact replay performance. Keep state minimal.
    • Replay overhead: On resume, the entire handler replays from the beginning (skipping completed steps). Complex workflows with many steps incur replay compute costs.
    • No visual designer: Unlike Step Functions, there is no graphical workflow builder — code-only approach.
    • Cold starts: Each sub-invocation (resume) is subject to normal Lambda cold start behavior.

    Supported Runtimes and Availability

    • Languages: Python 3.13/3.14, Node.js 22/24 (JavaScript/TypeScript), Java (bundled SDK).
    • Regions: Available in ~31 AWS Regions as of mid-2026.
    • SDK: Open source — Python SDK, JavaScript/TypeScript SDK.
    • IaC Support: AWS CloudFormation, AWS SAM, AWS CDK.
    • Testing: Local testing SDK available (pytest integration) + AWS SAM CLI for integration testing.

    AWS Certification Exam Relevance

    DVA-C02 (Developer Associate)

    • Understand when to use Durable Functions vs Step Functions vs SQS+Lambda.
    • Know the checkpoint/replay mechanism and determinism requirements.
    • Understand durable operations: steps, waits, callbacks, parallel, map.
    • Know that durable execution must be enabled at creation time.
    • Understand idempotency via execution names.

    SAA-C03 (Solutions Architect Associate)

    • Architecture decisions: choosing the right orchestration service for workflow requirements.
    • Cost optimization: no compute charges during waits vs Step Functions pricing model.
    • Use case mapping: saga pattern, approval workflows, long-running processes.
    • Hybrid architectures: combining Durable Functions with Step Functions.

    Practice Questions

    Question 1

    A company needs to build an order processing workflow that coordinates payment authorization, inventory allocation, and shipping across three microservices. The workflow must automatically roll back completed steps if a later step fails. The development team prefers writing workflow logic in Python rather than using a visual designer. Which solution meets these requirements with the LEAST operational overhead?

    1. AWS Step Functions with Lambda tasks and error handling states
    2. AWS Lambda durable functions with steps and compensation logic
    3. Amazon SQS queues between Lambda functions with DynamoDB for state tracking
    4. Amazon EventBridge with Lambda targets and Step Functions for rollback
    Show Answer

    Answer: B –

    Lambda durable functions provide automatic state management, built-in retries, and a code-first approach in Python. The saga pattern with compensation logic can be implemented as sequential code with steps and error handling, meeting the requirement for Python-based workflow logic with minimal operational overhead.

    Question 2

    A healthcare company is building a patient referral system where a referral is submitted, requires physician approval (which may take up to 2 weeks), and then triggers appointment scheduling. The solution must minimize costs during the waiting period. Which approach is MOST cost-effective?

    1. AWS Step Functions Standard Workflow with a Wait state
    2. Lambda function polling DynamoDB every hour using EventBridge Scheduler
    3. AWS Lambda durable functions with a callback that suspends execution until approval
    4. Amazon SQS with a delay queue and Lambda consumer
    Show Answer

    Answer: C –

    Lambda durable functions with callbacks suspend execution without incurring compute charges during the wait. The function resumes only when the physician approval triggers the callback API. This is the most cost-effective approach as there are no compute charges during the 2-week wait — only minimal data retention costs. Step Functions Standard Workflows also don’t charge during waits, but durable functions eliminate the per-state-transition cost for simple workflows.

    Question 3

    A solutions architect is designing a workflow that coordinates image processing across 10 AWS services including S3, Rekognition, DynamoDB, SNS, and SQS. The workflow needs to be understood by non-technical business stakeholders and must require minimal custom code. Which service is MOST appropriate?

    1. AWS Lambda durable functions with parallel and map operations
    2. AWS Step Functions with native service integrations
    3. Amazon EventBridge Pipes connecting the services
    4. AWS Lambda durable functions with AWS SDK calls in steps
    Show Answer

    Answer: B –

    AWS Step Functions provides native integrations with 220+ AWS services without requiring custom Lambda code, and offers a visual workflow designer that non-technical stakeholders can understand. Lambda durable functions would require writing SDK calls for each service integration and doesn’t provide a visual representation.

    Question 4

    A developer is implementing a Lambda durable function that processes financial transactions. During testing, the function occasionally produces different results when replayed. What is the MOST likely cause?

    1. The function’s memory configuration is too low for replay operations
    2. The function contains non-deterministic code (random values, timestamps) outside of durable steps
    3. The ExecutionTimeout is configured incorrectly
    4. The function is using an unsupported runtime version
    Show Answer

    Answer: B –

    Lambda durable functions use a replay mechanism that re-executes code from the beginning on resume. Code between durable operations must be deterministic — any non-deterministic operations (random number generation, current timestamps, external API calls) must be wrapped inside context.step() to be checkpointed and skipped during replay.

    Question 5

    A company wants to add durable execution capabilities to their existing production Lambda function that processes insurance claims. The function currently runs on Python 3.13 and handles 500,000 invocations per day. What should the developer do?

    1. Update the function configuration to enable DurableConfig with the appropriate ExecutionTimeout
    2. Create a new Lambda function with durable execution enabled, migrate the code, and redirect traffic
    3. Add the Durable Execution SDK to the existing function and use the @durable_execution decorator
    4. Enable durable execution on the existing function using the UpdateFunctionConfiguration API
    Show Answer

    Answer: B –

    Durable execution can only be enabled at function creation time — it cannot be added to or modified on existing Lambda functions. The developer must create a new function with durable execution enabled in the DurableConfig, migrate the code to use the Durable Execution SDK, and redirect traffic to the new function.

    Frequently Asked Questions

    What are AWS Lambda Durable Functions?

    Lambda Durable Functions let you build multi-step stateful workflows directly in Lambda code. They automatically checkpoint state, can wait for up to one year for external events, and you only pay for active compute time — not idle waiting.

    How do Durable Functions differ from Step Functions?

    Durable Functions define workflows in code (Python/Node.js) with inline orchestration logic. Step Functions use a visual designer with JSON/YAML state machine definitions. Use Durable Functions for code-first teams; Step Functions for visual workflows with 200+ service integrations.

    Do Durable Functions charge for wait time?

    No. Unlike Step Functions which charge per state transition including waits, Durable Functions only charge for active compute. Waiting for a human approval or external event costs nothing beyond state storage.

    References

    AWS Verified Access – Zero Trust Application Access

    ~ Last updated on : ~ Kiro Agent

    AWS Verified Access – Zero Trust Application Access

    AWS Verified Access provides secure access to corporate applications and resources without requiring a virtual private network (VPN). It implements Zero Trust security principles by evaluating each access request in real time against fine-grained policies based on user identity and device security posture, ensuring that only authenticated and authorized users on compliant devices can reach your applications.

    📢 Key Updates (2024–2025):

    • December 2024: Non-HTTP(S) protocol support (SSH, RDP, TCP) launched in preview
    • February 2025: Non-HTTP(S) support became generally available
    • March 2025: Achieved FedRAMP High and Moderate authorization
    • 2025: RDS endpoint type added for direct database access
    • 2025: Network CIDR endpoint type for IP-range-based access
    • 2025: AWS Connectivity Client for non-HTTP resources
    AWS Verified Access — Zero Trust Flow
    User
    (Browser/Device)
    →
    Verified Access
    1. Check Identity (Okta/IdC)
    2. Check Device (CrowdStrike)
    3. Evaluate Cedar Policy
    → Allow/Deny →
    Application
    (ALB / NI / RDS)
    ❌ No VPN needed • Per-request evaluation • Never trust, always verify

    Zero Trust Principles

    AWS Verified Access is built on the “never trust, always verify” model. Traditional perimeter-based security grants broad network access once a user connects via VPN. Zero Trust eliminates implicit trust by:

    • Verifying every request: Each application access request is evaluated independently — no persistent trust based on network location
    • Least-privilege access: Users get access only to specific applications they need, not the entire network
    • Continuous validation: Identity and device posture are checked on every request, not just at initial connection
    • Assume breach: The architecture limits lateral movement — compromising one application doesn’t grant access to others
    • Context-aware decisions: Access decisions combine multiple signals: user identity, group membership, device health, and security posture

    Architecture Components

    AWS Verified Access consists of four core components that work together to enforce zero trust access:

    Verified Access Instance

    • The top-level container that evaluates access requests and enforces policies
    • Each instance is associated with one or more trust providers
    • Supports AWS WAF integration for additional web security (SQL injection, XSS protection)
    • Logging is configured at the instance level (S3, CloudWatch Logs, Kinesis Data Firehose)
    • Can be shared across AWS accounts using AWS Resource Access Manager (RAM)

    Verified Access Trust Providers

    • External services that supply user identity and device security posture data
    • Two categories: Identity trust providers (who the user is) and Device trust providers (device health status)
    • Each Verified Access instance can have one identity provider and multiple device trust providers
    • Trust data is passed to Cedar policies for access evaluation

    Verified Access Groups

    • Logical groupings of endpoints with similar security requirements
    • Group-level access policies apply to all endpoints in the group
    • Simplifies policy management — define once, apply to many applications
    • Each group is associated with a Verified Access instance

    Verified Access Endpoints

    • Represent individual applications or resources that users access
    • Each endpoint belongs to a Verified Access group and inherits its policy
    • Optional endpoint-level policy for additional application-specific controls
    • Four endpoint types:
      • Load Balancer: Routes requests to ALB or NLB for application distribution
      • Network Interface: Sends requests to a specific ENI with protocol and port
      • Network CIDR: Routes requests to a specified IP address range
      • Amazon RDS: Provides access to RDS instances, clusters, or DB proxies

    How AWS Verified Access Works

    AWS Verified Access evaluates every access request using a combination of user identity verification and device posture assessment, eliminating the need for a VPN:

    1. User requests access to a corporate application via its Verified Access endpoint URL (e.g., app.example.com)
    2. Authentication: The user is redirected to the configured identity provider (IAM Identity Center or OIDC-compatible IdP) for authentication
    3. Device posture check: The device trust provider assesses the device’s security state (OS patch level, firewall status, disk encryption, malware protection)
    4. Policy evaluation: Verified Access evaluates Cedar policies using the identity and device trust data against group-level and endpoint-level policies
    5. Access decision: If both policies return Allow, the request is forwarded to the application; otherwise, access is denied
    6. Logging: Every access attempt (allowed or denied) is logged for audit and security analysis

    For non-HTTP(S) applications (SSH, RDP, TCP), users install the AWS Verified Access Connectivity Client on their devices. The client encrypts traffic, attaches user identity and device context, and routes it to Verified Access for policy enforcement before forwarding to the target resource.

    Trust Providers

    Identity Trust Providers

    Identity trust providers authenticate users and supply identity claims (email, groups, roles) to Cedar policies:

    Provider Type Details
    AWS IAM Identity Center Native Direct integration; supports SAML 2.0 federation with external IdPs; provides user/group attributes
    Okta OIDC OpenID Connect integration; supplies user identity, group membership, and custom claims
    Ping Identity OIDC OpenID Connect integration; enterprise identity verification and SSO
    Any OIDC Provider OIDC Any standards-compliant OIDC identity provider (Azure AD, Google Workspace, Auth0, etc.)

    Device Trust Providers

    Device trust providers assess the security posture of the user’s device and provide device health signals:

    Provider Supported Platforms Trust Signals
    CrowdStrike Windows 10, Windows 11 Zero Trust Assessment (ZTA) score, OS version, sensor status, policy compliance
    Jamf macOS Device compliance, risk score, OS patch level, FileVault encryption, firewall status
    JumpCloud Windows, macOS Device compliance status, disk encryption, OS version, screen lock, firewall
    💡 Important: You can configure one identity trust provider and multiple device trust providers per Verified Access instance. Verified Access currently supports Google Chrome and Mozilla Firefox browsers for device trust context collection.

    Cedar Policy Language

    Access policies in AWS Verified Access are written in Cedar, an open-source policy language developed by AWS. Cedar provides:

    • Human-readable syntax: Policies resemble natural language — easy to write and audit
    • Provably correct evaluation: Uses automated reasoning to ensure deterministic results
    • RBAC and ABAC support: Role-based and attribute-based access control in a single policy
    • Principal/Action/Resource model: Defines who can do what on which resource under which conditions

    Example Cedar Policy — Allow engineering team on compliant devices:

    Example Cedar Policy — Deny access from non-compliant devices:

    Integration with Application Load Balancer (ALB)

    AWS Verified Access integrates with Application Load Balancers as a primary endpoint type for HTTP(S) applications:

    • Load Balancer endpoint type: Verified Access forwards authenticated and authorized requests to an internal ALB or NLB
    • No public exposure needed: The ALB remains in a private subnet — only Verified Access endpoints are internet-facing
    • Health checks maintained: ALB continues to perform health checks on target applications
    • WAF at both layers: AWS WAF can be attached to both the Verified Access instance and the ALB for defense-in-depth
    • Signed identity headers: Verified Access injects signed user identity information into HTTP headers forwarded to the ALB, allowing applications to identify the authenticated user without separate authentication logic
    • On-premises applications: By pointing a Verified Access endpoint at an NLB with IP targets, you can provide zero trust access to on-premises applications connected via Direct Connect or VPN

    Architecture Pattern: Verified Access + ALB

    AWS WAF Integration

    • Associate an AWS WAF Web ACL with a Verified Access instance for additional protection
    • Provides protection against common exploits: SQL injection, XSS, known bad IPs
    • With IAM Identity Center: WAF inspects traffic before user authentication
    • With OIDC providers: WAF inspects traffic after user authentication
    • Rate limiting and geo-blocking rules apply at the Verified Access level

    Use Cases

    1. Replacing Traditional VPN

    • Eliminate VPN infrastructure management, licensing costs, and scalability issues
    • Remove broad network access — users access only the applications they need
    • Reduce VPN-related support tickets (connectivity issues, split tunneling, performance)
    • No client software needed for HTTP(S) applications (browser-only access)
    • Gradual migration: run Verified Access alongside Client VPN during transition

    2. BYOD (Bring Your Own Device) Access

    • Enable personal device access to corporate applications without VPN tunnel to corporate network
    • Device trust providers verify minimum security posture (encryption, patches, antivirus)
    • Conditional access: allow browser-based apps from BYOD but restrict sensitive resources to managed devices
    • No corporate certificates or VPN profiles needed on personal devices

    3. Contractor and Third-Party Access

    • Grant time-limited, application-specific access to external contractors
    • Federate contractor identities through OIDC without creating AWS or corporate accounts
    • Apply stricter device posture requirements or limit to specific applications
    • Easy revocation: update group policy or remove contractor from IdP group

    4. Multi-Account Application Access

    • Share Verified Access instances across accounts using AWS Resource Access Manager
    • Centralize access policies while applications remain in separate AWS accounts
    • Consistent security posture across organizational units

    5. Securing Non-HTTP Resources

    • Provide zero trust access to SSH sessions, RDP desktops, and TCP-based applications
    • Uses AWS Verified Access Connectivity Client on user devices
    • Supports access to RDS databases without exposing them publicly
    • Apply same identity and device trust policies to infrastructure access

    AWS Verified Access vs Client VPN vs Direct Connect vs PrivateLink

    Feature Verified Access AWS Client VPN AWS Direct Connect AWS PrivateLink
    Primary Purpose Zero trust application access without VPN Remote user VPN connectivity to VPC Dedicated private network connection from on-premises Private connectivity between VPCs and services
    Access Model Per-application, per-request Network-level (full VPC access via tunnel) Network-level (Layer 2/3) Service-specific (endpoint to service)
    Client Required No (browser for HTTP); Yes (Connectivity Client for non-HTTP) Yes (OpenVPN-compatible client) No (hardware router at on-premises) No
    Identity Verification Every request (IdP + device posture) At connection time (certificate + optional MFA) None (network-level only) None (relies on VPC security)
    Device Posture Yes (CrowdStrike, Jamf, JumpCloud) No No No
    Zero Trust Yes — core design principle No — perimeter-based once connected No — dedicated circuit Partial — limits service exposure
    Lateral Movement Risk Minimal (app-level isolation) High (VPC network access) Medium (depends on routing) Low (service-specific)
    Protocol Support HTTP(S), SSH, RDP, TCP All TCP/UDP (tunnel) All protocols (Layer 2/3) TCP (NLB-based)
    Scalability Fully managed, auto-scales Scales with VPN endpoints Fixed bandwidth (1/10/100 Gbps) Scales automatically
    Best For Remote workforce, BYOD, contractors, zero trust Full network access for remote employees Hybrid cloud, high-bandwidth on-premises connectivity Service-to-service private connectivity, SaaS delivery

    Pricing

    AWS Verified Access uses a pay-as-you-go model with no upfront commitment or minimum fees:

    HTTP(S) Applications

    Dimension Rate (US East – Ohio)
    Application hours (first 200 apps × 744 hrs) $0.27 per app-hour
    Application hours (above 148,800 app-hours/month) $0.20 per app-hour
    Data processed $0.02 per GB

    Non-HTTP(S) Applications

    Dimension Rate (US East – Ohio)
    Non-HTTP endpoint hours $0.20 per endpoint-hour
    Connections (above 100 free per endpoint/hour) $0.001 per connection-hour
    💰 Cost Example: 10 HTTP(S) applications running 24/7 for a month with 5 GB total data processed: (10 × 744 × $0.27) + (5 × $0.02) = $2,008.90/month. Additional standard AWS data transfer charges apply.

    Logging and Observability

    AWS Verified Access logs every access attempt (both allowed and denied), providing centralized visibility for security audits and incident response:

    Log Destinations

    • Amazon S3: Long-term archival, Athena queries, and compliance retention
    • Amazon CloudWatch Logs: Real-time monitoring, alarms, and dashboards
    • Amazon Kinesis Data Firehose: Stream to SIEM tools, Splunk, Datadog, or OpenSearch

    Log Contents

    • Timestamp and request ID
    • Source IP address and port
    • Verified Access instance, group, and endpoint IDs
    • Access decision (Allow or Deny)
    • User identity information (from trust provider)
    • Device trust data (optionally included)
    • HTTP method, URI, status code (for HTTP requests)
    • Policy evaluation details
    💡 Tip: Enable trust data inclusion in logs to capture the full identity and device context for each request. This aids forensic investigation but increases log volume and storage costs.

    AWS Certification Exam Relevance

    Exam Relevance Key Topics
    AWS Security Specialty (SCS-C02) ⭐⭐⭐ High Zero trust architecture, identity-based access, device posture, policy evaluation, WAF integration, logging for compliance
    Solutions Architect Professional (SAP-C02) ⭐⭐⭐ High VPN replacement patterns, hybrid access architecture, multi-account access, choosing between connectivity options
    Solutions Architect Associate (SAA-C03) ⭐⭐ Medium Understanding when to use Verified Access vs VPN vs PrivateLink; basic zero trust concepts
    Advanced Networking Specialty (ANS-C01) ⭐⭐⭐ High Endpoint types, ALB/NLB integration, DNS configuration, non-HTTP protocol support, Network Firewall integration

    AWS Verified Access Practice Questions

    1. A company wants to provide secure access to internal web applications for remote employees without deploying VPN infrastructure. They require per-request identity verification and device compliance checks. Which AWS service should they use?

      1. AWS Client VPN with MFA
      2. AWS PrivateLink with VPC endpoints
      3. AWS Verified Access
      4. Amazon CloudFront with signed URLs
      Show Answer

      Answer: C –

      Explanation: AWS Verified Access provides secure application access without VPN by evaluating each request against identity and device posture policies. Client VPN provides network-level access, not per-application zero trust. PrivateLink is for service-to-service connectivity within AWS. CloudFront signed URLs don’t provide identity/device verification.

    2. An organization is configuring AWS Verified Access and needs to enforce that users can only access applications from devices with disk encryption enabled and an up-to-date OS. Which combination of trust providers should they configure? (Choose TWO)

      1. AWS IAM Identity Center as an identity trust provider
      2. CrowdStrike as a device trust provider
      3. Amazon Cognito as an identity trust provider
      4. AWS Config as a device trust provider
      5. Amazon Inspector as a device posture provider
      Show Answer

      Answer: A, B

      Explanation: Verified Access requires an identity trust provider (IAM Identity Center or OIDC) and a device trust provider (CrowdStrike, Jamf, or JumpCloud). CrowdStrike provides device posture signals including disk encryption and OS version. Amazon Cognito, AWS Config, and Inspector are not supported as Verified Access trust providers.

    3. A security engineer is writing a Cedar policy for AWS Verified Access that should allow access only to users in the “finance” group who have a CrowdStrike ZTA assessment of “pass”. Which policy correctly implements this requirement?

      1. allow(principal in Group::"finance", action, resource) when { context.device.crowdstrike.overall_assessment == "pass" };
      2. permit(principal, action, resource) when { context.identity.groups.contains("finance") && context.device.crowdstrike.overall_assessment == "pass" };
      3. grant(principal, action, resource) when { identity.group == "finance" AND device.assessment == "pass" };
      4. permit(principal, action, resource) when { context.identity.email.endsWith("@finance.com") };
      Show Answer

      Answer: B –

      Explanation: Cedar policies use permit or forbid keywords (not “allow” or “grant”). The trust data is accessed via the context object, with identity data under context.identity and device data under context.device.[provider]. Option B correctly checks both group membership and device assessment.

    4. A company currently uses AWS Client VPN but wants to migrate to AWS Verified Access for their web applications. During the transition, they need to maintain access for applications that use SSH and RDP. What should the solutions architect recommend?

      1. Use Verified Access for all applications immediately — it supports all protocols
      2. Use Verified Access for HTTP(S) applications and deploy the AWS Verified Access Connectivity Client for SSH/RDP access to non-HTTP endpoints
      3. Continue using Client VPN for SSH/RDP; Verified Access only supports HTTP(S)
      4. Use AWS Systems Manager Session Manager for SSH/RDP and Verified Access for HTTP(S) only
      Show Answer

      Answer: B –

      Explanation: Since February 2025, AWS Verified Access supports non-HTTP(S) protocols (SSH, RDP, TCP) through the AWS Verified Access Connectivity Client. Users install the client on their devices to access non-HTTP resources with the same zero trust policy enforcement. This eliminates the need for Client VPN for these protocols.

    5. An organization needs to log all Verified Access requests for compliance auditing, including the identity claims and device posture data used in each access decision. Where can they send these logs? (Choose THREE)

      1. Amazon S3
      2. Amazon CloudWatch Logs
      3. Amazon Kinesis Data Firehose
      4. AWS CloudTrail
      5. Amazon DynamoDB
      6. Amazon SQS
      Show Answer

      Answer: A, B, C

      Explanation: AWS Verified Access supports three log destinations: Amazon S3, CloudWatch Logs, and Kinesis Data Firehose. Trust data (identity and device context) can optionally be included in these logs. CloudTrail records API calls for Verified Access management operations but does not capture per-request access logs. DynamoDB and SQS are not supported log destinations.

    Frequently Asked Questions

    What is AWS Verified Access?

    AWS Verified Access provides secure access to corporate applications without a VPN. It evaluates each request against identity and device posture policies using Cedar policy language, following zero trust principles of ‘never trust, always verify’.

    How does Verified Access replace VPN?

    Instead of granting broad network access via VPN, Verified Access grants per-application access based on user identity and device security posture. Users connect directly to applications through their browser without installing VPN clients.

    What trust providers does Verified Access support?

    For identity: IAM Identity Center, Okta, Ping Identity, and any OIDC provider. For device posture: CrowdStrike, Jamf, and JumpCloud. You can combine identity + device trust for stronger security.

    Related Posts

    References

    Amazon Q Developer & Q Business – AI Assistants

    ~ Last updated on : ~ Kiro Agent

    Amazon Q – Overview

    • Amazon Q is AWS’s family of generative AI-powered assistants designed for both software development and enterprise business use cases.
    • Amazon Q encompasses two primary products: Amazon Q Developer (for builders) and Amazon Q Business (for enterprises).
    • Amazon Q is built on Amazon Bedrock and leverages foundation models including Anthropic Claude to deliver intelligent, context-aware responses.
    • Amazon Q is available across multiple interfaces: IDEs, CLI, AWS Management Console, and web applications.
    • Amazon Q respects existing identity, roles, and permissions — providing personalized, secure interactions.

    Amazon Q Developer

    • Amazon Q Developer is an AI-powered coding assistant that reimagines the entire software development lifecycle (SDLC).
    • Previously known as Amazon CodeWhisperer, it was rebranded and significantly expanded as Amazon Q Developer in April 2024.
    • Supports code generation, debugging, optimization, security scanning, code transformation, documentation generation, and operational troubleshooting.
    • Available in Visual Studio Code, JetBrains IDEs, Visual Studio, Eclipse, and from the command line (CLI).
    • Offers an agentic coding experience — can autonomously read/write files, run shell commands, generate code diffs, and execute multi-step workflows through natural language.
    • Supports Model Context Protocol (MCP) for connecting external tools and MCP servers for context-aware workflows.
    ⚠️ Important Update (May 2026): AWS announced that Amazon Q Developer IDE plugins and paid subscriptions will reach end-of-support on April 30, 2027. New signups were blocked as of May 15, 2026. The official successor is Kiro — AWS’s spec-driven agentic IDE. Amazon Q Developer continues to be available in the AWS Console, CLI, and through APIs. Existing subscribers retain access until end-of-support.

    Code Generation & Inline Completions

    • Provides real-time code suggestions as you type — completing lines, functions, doc strings, and code blocks.
    • Supports 15+ programming languages including Python, Java, JavaScript, TypeScript, C#, Go, Rust, PHP, Ruby, Kotlin, and more.
    • Generates complete functions, classes, and algorithms from natural language comments or partial code.
    • Context-aware: analyzes open files, imports, and project structure for relevant suggestions.
    • Supports up to 200,000 tokens of context with automatic @workspace indexing (Pro tier).
    • Reference tracking — flags when suggestions resemble open-source training data and provides repository/license attribution.
    • Option to suppress public code suggestions to avoid IP concerns.

    Agentic Coding

    • Amazon Q Developer agent autonomously performs multi-step software development tasks from natural language instructions.
    • Can implement features, write tests, generate documentation, refactor code, and perform code reviews.
    • Maintains real-time connection with developers — providing updates throughout the process.
    • Reads and writes files locally, generates code diffs, and runs shell commands.
    • Available in VS Code, JetBrains, Visual Studio, and CLI environments.
    • Incorporates developer feedback iteratively to deliver polished implementations.

    Debugging & Troubleshooting

    • Identifies bugs, explains error messages, and suggests fixes through conversational chat.
    • Analyzes stack traces, logs, and error patterns to pinpoint root causes.
    • In the AWS Console, the “Diagnose with Amazon Q” feature helps troubleshoot common service errors directly.
    • Accelerates CloudWatch investigations — looks for anomalies in telemetry, surfaces related signals, identifies root-cause hypotheses, and suggests remediation steps.

    Code Transformation (Upgrade Agent)

    • Amazon Q Developer agent for code transformation automates language and framework upgrades.
    • Supports Java upgrades from Java 8/11 to Java 17 and Java 21 (added Feb 2025).
    • Supports .NET upgrades and Angular upgrades for modernization.
    • Analyzes existing code, generates a transformation plan, applies code changes, updates libraries/frameworks, and runs tests.
    • Replaces deprecated API calls, upgrades libraries to latest compatible versions.
    • Selective transformation feature allows upgrading specific modules rather than entire applications.
    • Free tier: 1,000 lines of code (LOC) per month; Pro tier: 4,000 LOC per user per month (pooled at account level).
    • AWS internal teams upgraded 1,000+ applications using this capability.

    Security Scanning

    • Built-in security vulnerability scanning analyzes code for security issues, secrets exposure, and coding best practice violations.
    • Detects vulnerabilities aligned with OWASP Top 10, CWE, and AWS security best practices.
    • Scans for hardcoded credentials, injection flaws, insecure cryptography, and misconfigurations.
    • Provides remediation suggestions with one-click fix capability.
    • Supports Infrastructure as Code (IaC) analysis for CloudFormation, Terraform, and CDK templates.
    • Integrated into the development workflow — scans run automatically or on-demand.

    CLI Integration

    • Amazon Q Developer CLI brings AI assistance directly to the terminal/command line.
    • Provides natural language to command translation — describe what you want in English and get the correct CLI command.
    • Offers inline completions for shell commands (bash, zsh, fish, PowerShell).
    • Supports agentic coding directly from the command line — same capabilities as IDE agents.
    • Console-to-Code feature: record AWS Console actions and generate equivalent CLI commands, CDK, or CloudFormation code.
    • Supported on macOS (Intel/Apple Silicon), Linux, and Windows (WSL).
    • Works in VS Code terminal, JetBrains terminals, iTerm2, Terminal.app, and AWS CloudShell.

    IDE Support

    • Visual Studio Code — Full support including agentic coding, inline completions, chat, and MCP.
    • JetBrains IDEs — IntelliJ IDEA, PyCharm, WebStorm, GoLand, CLion, Rider, and more. Agentic coding added June 2025.
    • Visual Studio 2022 — All editions supported with agentic coding capabilities.
    • Eclipse — Available in Preview.
    • GitLab Duo with Amazon Q — Integrated experience for GitLab users.
    • Amazon SageMaker Studio — Native integration for ML development.

    Amazon Q Developer Free vs. Pro Tier

    Feature Free Tier Pro Tier ($19/user/month)
    Agentic Requests (Chat + Coding) 50 per month Increased limits
    Code Transformation (Java/.NET) 1,000 LOC/month 4,000 LOC/user/month (pooled)
    Admin Dashboard & Controls No Yes (user & policy management)
    IP Indemnity No Yes
    Reference Tracking Yes Yes
    Suppress Public Code Yes Yes
    Data Collection Opt-out available Automatically opted out
    Identity Center Support IAM / Builder ID IAM Identity Center + Builder ID
    Foundation Models Latest Claude models Latest Claude models
    Overage (Transformation) N/A $0.003 per LOC beyond allocation

    Amazon Q in the AWS Console

    • Amazon Q Developer is embedded directly in the AWS Management Console as a chat assistant.
    • Helps answer questions about AWS services, architecture, best practices, and billing.
    • Provides agentic capabilities (added June 2025) — functions as a resource analysis and operational troubleshooting assistant.
    • Can consult multiple information sources to resolve complex queries about your AWS environment.
    • Diagnose with Amazon Q — click button next to console errors to get AI-powered diagnosis and resolution steps.
    • Supports table and chart visualizations in responses.
    • Available in the Console, AWS Console Mobile Application, AWS Chatbot (Slack/Teams), and AWS documentation pages.
    • FinOps capabilities — answers cost-related questions, analyzes spending patterns, and provides optimization recommendations (50 queries/month free).
    • Console chat interactions are governed by Free Tier limits for all users; no Pro subscription required for console Q&A.

    Amazon Q Business

    • Amazon Q Business is a fully managed generative AI-powered assistant for enterprise knowledge management, content generation, and workflow automation.
    • Delivers quick, accurate, and relevant answers to business questions by connecting to enterprise data sources.
    • Uses Retrieval Augmented Generation (RAG) over company data — synthesizes information from multiple sources with citations.
    • Respects existing access control lists (ACLs) — provides permission-aware responses based on user identity.
    • Requires AWS IAM Identity Center for user authentication and access management.

    Data Source Connectors

    • Amazon Q Business supports over 40 data source connectors to popular enterprise applications:
    • Collaboration & Productivity: Microsoft SharePoint (Cloud/Server), OneDrive, Teams, Google Drive, Gmail, Google Calendar, Dropbox, Box
    • Knowledge Management: Confluence (Cloud/Server), Notion, Zendesk
    • Project Management: Jira, Asana (Preview)
    • Developer Tools: GitHub (Cloud/Server)
    • Databases & Storage: Amazon S3, Amazon FSx Windows, Amazon RDS, Amazon Aurora
    • CRM & Service: Salesforce, ServiceNow
    • Communication: Slack, Microsoft Exchange
    • Web: Amazon Q Web Crawler (crawl any website)
    • Custom: Amazon Q Business Custom Data Source Connector for any proprietary source
    • Connectors index ACL information along with documents — ensuring users only see data they’re authorized to access.
    • Supports configurable sync schedules, field mappings, and VPC connectivity for on-premises sources.

    Plugins & Actions

    • Amazon Q Business provides a library of over 50 built-in actions across popular business applications.
    • Plugins enable employees to take direct actions within enterprise applications through the Q Business interface.
    • Examples: create/update Jira tickets, change ServiceNow ticket priorities, move issues to sprint, manage calendar events.
    • Eliminates context-switching between different enterprise systems.
    • Administrators install and configure plugins; actions are automatically orchestrated during user chat.
    • Built-in plugins include: Jira, ServiceNow, Salesforce, Zendesk, PagerDuty, and more.
    • Custom plugins can be created using OpenAPI specifications.

    Admin Controls & Guardrails

    • Topic blocking — administrators can define topics that Amazon Q should not respond to.
    • Content guardrails — filter harmful/inappropriate responses, control response generation behavior.
    • Global controls — configure whether Q automatically orchestrates across plugins and data sources or requires explicit user selection.
    • Blocked phrases — specify exact phrases that should never appear in responses.
    • PII redaction — automatically redact sensitive personal information from responses.
    • Response scope — limit responses to only information found in connected enterprise data (no general knowledge).
    • User and group management — control access at user/group level through IAM Identity Center integration.
    • All data remains within the customer’s AWS account; Amazon Q Business does not use customer data to train models.

    Amazon Q Apps

    • Amazon Q Apps is a no-code/low-code capability that lets business users create custom generative AI applications.
    • Users can create apps from natural language descriptions or conversation prompts — no coding required.
    • Apps leverage the same enterprise data connections and permissions as the parent Q Business environment.
    • Use cases: automated report generators, knowledge Q&A bots, content creation tools, data summarizers.
    • Apps can be shared across the organization through an internal app library.
    • Available exclusively to Amazon Q Business Pro subscribers ($20/user/month).
    • Administrators control which users can create and publish Q Apps.

    Amazon Q Business Pricing

    Feature Lite ($3/user/month) Pro ($20/user/month)
    Q&A / Chat Yes (permission-aware) Yes (full suite)
    Content Generation Basic Full (summaries, reports, emails)
    Amazon Q Apps No Yes
    Amazon Q in QuickSight No Yes (Reader Pro)
    Plugins & Actions No Yes (50+ actions)
    Admin Controls & Guardrails Basic Full
    Data Source Connectors Yes (40+ connectors) Yes (40+ connectors)
    Index Types Starter & Enterprise Starter & Enterprise

    Note: Index units are charged separately based on data storage and processing capacity needs.

    Amazon Q vs. Competitors

    Feature Amazon Q Developer GitHub Copilot ChatGPT Enterprise
    Primary Focus AWS-native development & operations Universal code completion & generation General-purpose AI (coding + business)
    Pricing (Individual) Free / $19/user/month Pro Free / $10/month Pro / $39/month Pro+ Custom enterprise pricing
    Pricing (Team/Business) $19/user/month $19/user/month Business / $39 Enterprise Volume-based (contact sales)
    IDE Support VS Code, JetBrains, Visual Studio, Eclipse VS Code, JetBrains, Neovim, Xcode, Eclipse+ Web-based (no IDE plugin)
    CLI Support Yes (native terminal integration) Yes (Copilot CLI) No
    Security Scanning Built-in (code + IaC) Via GitHub Advanced Security (separate) No built-in scanning
    Code Transformation Yes (Java, .NET, Angular upgrades) No dedicated transformation agent No
    Cloud Integration Deep AWS (Console, CloudWatch, IAM) GitHub ecosystem, multi-cloud Plugins/GPTs for various services
    IP Indemnity Yes (Pro tier) Yes (Business/Enterprise) Yes (Enterprise)
    Foundation Models Anthropic Claude (via Bedrock) GPT-4o, Claude 3.5, Gemini 1.5 Pro GPT-4o, GPT-4 Turbo
    Context Window Up to 200,000 tokens Up to 128,000 tokens 128,000 tokens
    Enterprise Data RAG Yes (Q Business — separate product) Knowledge bases (Enterprise tier) Yes (company knowledge, GPTs)
    Best For AWS-centric teams, cloud operations Multi-cloud/multi-language teams General business + coding tasks

    Key Differentiators for Amazon Q

    • AWS-native integration — deep integration with Console, CloudWatch, IAM, and 200+ AWS services. No other tool offers built-in IAM policy generation.
    • Code transformation agents — unique capability for automated Java/.NET upgrades at scale.
    • Built-in security scanning — IaC analysis and vulnerability detection included in the same tool.
    • Operational troubleshooting — can diagnose AWS infrastructure issues directly in the Console.
    • Cost: competitive at $19/month — same as GitHub Copilot Business with AWS-specific features included.
    • Lowest latency in-region — 212ms p95 latency for AWS-hosted workloads.

    Amazon Q — Complete Pricing Summary

    Product Tier Price Key Inclusions
    Q Developer Free $0 50 agentic requests/month, 1K LOC transformation, Claude models
    Q Developer Pro $19/user/month Increased limits, 4K LOC, IP indemnity, admin controls
    Q Business Lite $3/user/month Q&A, permission-aware responses, 40+ connectors
    Q Business Pro $20/user/month Full suite, Q Apps, QuickSight, plugins, guardrails
    Q in Connect — $40/agent/month Contact center AI assistant (Amazon Connect)

    AWS Certification Exam Relevance

    • AWS Certified AI Practitioner (AIF-C01) — Amazon Q is a key service. Understand Q Developer vs Q Business positioning, RAG concepts, and how Q Business connects to enterprise data.
    • AWS Certified Machine Learning Engineer – Associate (MLA-C01) — Know Amazon Q Developer’s role in ML development workflows, integration with SageMaker Studio.
    • AWS Certified Solutions Architect – Associate/Professional — Understand Q Business architecture: connectors, RAG pattern, IAM Identity Center requirement, data security model.
    • AWS Certified Developer – Associate — Q Developer capabilities for code generation, security scanning, debugging, and CI/CD integration.
    • AWS Certified DevOps Engineer – Professional — Code transformation agents, operational troubleshooting, CloudWatch integration, Console-to-Code.
    • Key Exam Concepts:
      • Amazon Q Business uses RAG (Retrieval Augmented Generation) over enterprise data
      • Access controls are inherited from source systems (ACL-aware)
      • IAM Identity Center is required for Q Business
      • Q Developer Free tier uses Builder ID; Pro tier supports Identity Center
      • Q Business does NOT use customer data to train foundation models
      • Q Developer provides IP indemnity only in Pro tier

    Amazon Q — Evolution & Roadmap

    • 2023 (Preview) — Amazon Q announced at re:Invent 2023 as a unified AI assistant for AWS.
    • April 2024 (GA) — Amazon Q generally available; CodeWhisperer rebranded to Amazon Q Developer.
    • 2024-2025 — Added agentic coding, MCP support, .NET/Angular transformation, Console-to-Code, GitLab integration.
    • Feb 2025 — Java 21 upgrade support added to transformation agent.
    • June 2025 — Agentic capabilities in AWS Console; agentic coding in JetBrains and Visual Studio.
    • May 2026 — IDE plugin end-of-support announced (April 2027). Kiro announced as successor for IDE/agentic coding.
    • Going forward — Q Developer continues in Console, CLI, and APIs. Kiro takes over IDE-based development. Q Business continues expanding enterprise capabilities.

    AWS Certification Exam Practice Questions

    • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
    • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
    • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
    • Open to further feedback, discussion and correction.
    1. A company wants to deploy a generative AI assistant that can answer employee questions using internal documentation stored in Confluence, SharePoint, and Amazon S3. The assistant must respect existing document-level permissions. Which AWS service should be used?
      1. Amazon Q Developer
      2. Amazon Q Business
      3. Amazon Bedrock Knowledge Bases
      4. Amazon Kendra

      Explanation: Amazon Q Business is designed for enterprise knowledge retrieval with RAG over company data. It supports 40+ connectors including Confluence, SharePoint, and S3, and respects document-level ACL permissions. Amazon Q Developer is for coding assistance. While Bedrock Knowledge Bases can also do RAG, Q Business provides the fully managed enterprise assistant experience with built-in connectors and permission awareness.

    2. A development team is evaluating Amazon Q Developer Pro for their organization. Which of the following features are available ONLY in the Pro tier and NOT in the Free tier? (Choose TWO)
      1. Reference tracking for code suggestions
      2. IP indemnity for generated code
      3. Security vulnerability scanning
      4. Administrative dashboard with user and policy management
      5. Ability to suppress public code suggestions

      Explanation: IP indemnity and admin dashboard/policy management are Pro-tier only features. Reference tracking and suppressing public code suggestions are available in both Free and Pro tiers. Security scanning is available in both tiers.

    3. A Solutions Architect needs to understand the authentication requirements for Amazon Q Business. Which statement is correct?
      1. Amazon Q Business supports IAM users directly for end-user access.
      2. Amazon Q Business requires Amazon Cognito User Pools for authentication.
      3. Amazon Q Business requires AWS IAM Identity Center for user authentication and access management.
      4. Amazon Q Business can use any SAML 2.0 identity provider directly without IAM Identity Center.

      Explanation: Amazon Q Business requires AWS IAM Identity Center for managing user authentication and access. IAM Identity Center can federate with external identity providers (Okta, Azure AD, etc.) via SAML 2.0, but the integration point for Q Business is always through IAM Identity Center.

    4. A company is using Amazon Q Developer to modernize their Java applications. They have 50 Pro tier subscriptions and need to upgrade 250,000 lines of code this month. What will be the transformation overage charge?
      1. $0 — all within allocation
      2. $50
      3. $150
      4. $750

      Explanation: With 50 Pro subscriptions, the pooled allocation is 50 × 4,000 = 200,000 LOC/month. Usage is 250,000 LOC, so overage is 50,000 LOC. At $0.003/LOC: 50,000 × $0.003 = $150.

    5. Which Amazon Q product allows business users to create custom generative AI applications without writing code, using natural language descriptions?
      1. Amazon Q Developer agents
      2. Amazon Q in QuickSight
      3. Amazon Q Apps
      4. Amazon Bedrock Agents

      Explanation: Amazon Q Apps is a no-code capability within Amazon Q Business (Pro tier) that allows business users to create custom GenAI applications from natural language descriptions. These apps leverage the same enterprise data connections and permissions. Q Developer agents are for software development tasks. Bedrock Agents require developer setup.

    Frequently Asked Questions

    What is Amazon Q Developer?

    Amazon Q Developer is an AI-powered coding assistant that generates code, debugs issues, transforms legacy applications (Java 8→17, .NET to cross-platform), scans for security vulnerabilities, and provides CLI assistance — available in IDEs and the AWS Console.

    What is the difference between Q Developer and Q Business?

    Q Developer is for software development tasks (coding, debugging, AWS CLI help). Q Business is an enterprise AI assistant for business users that answers questions using company data via 40+ connectors to internal systems like SharePoint, Confluence, and Salesforce.

    How much does Amazon Q cost?

    Q Developer Free tier includes limited code suggestions. Q Developer Pro is $19/user/month with full agentic capabilities. Q Business Lite is $3/user/month (Q&A only) and Q Business Pro is $20/user/month (with plugins and actions).

    Related Posts

    References

    S3 Vectors & S3 Tables – AI-Native Storage

    ~ Last updated on : ~ Kiro Agent

    Amazon S3 Vectors & S3 Tables Overview

    Amazon S3 has evolved beyond simple object storage into an AI-native and analytics-native storage platform with two groundbreaking services: Amazon S3 Vectors and Amazon S3 Tables. These services bring purpose-built capabilities directly into S3, eliminating the need for separate specialized databases while maintaining S3’s legendary durability, scalability, and cost efficiency.

    • S3 Vectors (GA December 2025) – The first cloud object storage with native vector support for AI workloads, semantic search, and RAG applications
    • S3 Tables (GA December 2024) – Fully managed Apache Iceberg tables optimized for analytics workloads with automatic maintenance

    Amazon S3 Vectors

    What is Amazon S3 Vectors?

    Amazon S3 Vectors is the first cloud object store with native support to store and query vector embeddings, providing purpose-built, cost-optimized vector storage for AI agents, AI inference, and semantic search. It reduces the total cost of uploading, storing, and querying vectors by up to 90% compared to specialized vector database solutions.

    Key Features

    • Massive Scale – Store up to 2 billion vectors per index, 10,000 indexes per bucket (up to 20 trillion vectors total)
    • Sub-second Performance – Warm query latency as low as 100ms; infrequent queries return in under 1 second
    • 90% Cost Reduction – Dramatically lower costs compared to specialized vector databases
    • Fully Serverless – No infrastructure to provision or manage; pay only for what you use
    • Strong Consistency – Subsequent queries always include the most recently added data
    • Metadata Filtering – Up to 50 metadata keys per vector (10 non-filterable) for combined similarity + attribute filtering
    • Distance Metrics – Supports Cosine and Euclidean distance metrics
    • Encryption – SSE-S3 (default) or SSE-KMS with custom keys at bucket or index level
    • High Write Throughput – Up to 1,000 PUT transactions per second for streaming updates
    • Top-K Results – Return up to 100 search results per query

    Architecture Components

    Component Description
    Vector Bucket A new S3 bucket type dedicated to vector storage with vector-specific APIs
    Vector Index Container for vectors within a bucket; defines dimensionality and distance metric
    Vectors Individual embeddings with key, data (float32), and optional metadata
    Metadata Key-value pairs attached to vectors; filterable and non-filterable types

    AWS Service Integrations

    • Amazon Bedrock Knowledge Bases – Native integration for cost-effective RAG applications; select S3 Vectors as the vector store when creating a knowledge base
    • Amazon OpenSearch Service – Tiered strategy: store long-term vectors in S3 Vectors and export high-priority vectors to OpenSearch for real-time, low-latency search
    • Amazon SageMaker Unified Studio – Create and manage knowledge bases with S3 Vectors within the unified AI development environment
    • AWS CloudFormation – Deploy and manage vector resources as infrastructure as code
    • AWS PrivateLink – Private network connectivity for secure access

    S3 Vectors Use Cases

    • Semantic Search – Search across millions of documents, images, videos, and audio based on meaning rather than keywords
    • Retrieval Augmented Generation (RAG) – Provide contextual information to LLMs from large document collections at reduced cost
    • AI Agent Memory – Give AI agents lasting memory by storing every interaction and insight across petabytes of vector data
    • Media Intelligence – Index video content at frame level (e.g., 5,400+ embeddings per hour of video) for instant scene retrieval
    • Personalization Engines – Store user preference embeddings for recommendation systems
    • Medical Image Similarity – Compare medical images (radiology, pathology) against vast databases for diagnosis assistance
    • Code Search – Navigate large codebases using semantic similarity

    S3 Vectors Pricing (US East – N. Virginia)

    Dimension Rate
    Storage $0.06 per GB/month
    PUT (Upload) $0.20 per GB uploaded (min 128KB per PUT)
    Query – API Fee $2.50 per million queries
    Query – Data Processed (first 100K vectors) $0.004 per TB
    Query – Data Processed (100K–10M vectors) $0.002 per TB
    Query – Data Processed (10M+ vectors) $0.0004 per TB
    Query – Data Returned $0.01 per GB (first 512KB/query free)
    Vector Bucket Free to create

    Pricing Example: 10 million vectors (6.17 KB each) across 40 indexes, with 1M queries/month returning top 100 results = approximately $11.38/month. This demonstrates the dramatic cost savings compared to traditional vector databases.

    Amazon S3 Tables

    What are Amazon S3 Tables?

    Amazon S3 Tables are fully managed Apache Iceberg tables that automate the operational burden of managing data lakes and lakehouses. They deliver storage specifically optimized for analytics workloads with automatic table maintenance, delivering up to 3x faster query performance and 10x higher transactions per second compared to self-managed Iceberg tables in general purpose S3 buckets.

    Key Features

    • Fully Managed Apache Iceberg – Automatic compaction, snapshot management, and unreferenced file removal
    • Advanced Compaction Strategies – Binpack (default), sort compaction, and z-order compaction for multi-dimensional queries
    • S3 Tables Intelligent-Tiering – Automatically moves data to the most cost-effective tier, reducing storage costs by up to 80%
    • Automatic Replication – Cross-region table replication for reduced query latency and disaster recovery
    • Iceberg REST Catalog API – Compatible with any Iceberg engine (Spark, Trino, Flink, Athena, Redshift, Snowflake)
    • Apache Iceberg V3 Support – Deletion vectors for efficient batch updates, reducing write amplification
    • Table-Level Security – Built-in access control, encryption, and lifecycle management per table
    • AWS Analytics Integration – Native integration with AWS Glue Data Catalog, Lake Formation, Athena, EMR, and Redshift
    • MCP Support – AI agents and LLMs can interact with S3 Tables via Model Context Protocol
    • 11 Nines Durability – 99.999999999% durability with 99.99% availability

    How S3 Tables Work

    1. Create a Table Bucket – A new S3 bucket type purpose-built for tabular data
    2. Create Tables – Define Apache Iceberg tables using SQL (via Athena) or Iceberg REST Catalog API
    3. Ingest Data – Write data using Spark, Flink, Firehose, or any Iceberg-compatible engine
    4. Automatic Maintenance – S3 continuously compacts, manages snapshots, and removes orphan files
    5. Query with Any Engine – Use Athena, Redshift, Spark, Trino, DuckDB, or Snowflake

    S3 Tables Use Cases

    • Data Lake Modernization – Migrate from Parquet/Hive/Hadoop to managed Iceberg tables with reduced complexity
    • Streaming Analytics – Stream data from IoT sensors, transactions, and application logs with near real-time queryability
    • Big Data Analytics – High-throughput workloads benefiting from 10x higher TPS
    • AI-Powered Analytics – Query data using natural language through MCP for ad-hoc exploration
    • Transactional Data Lakes – ACID transactions with time-travel and schema evolution
    • Compliance & Audit – Immutable audit trails with snapshot history and data versioning

    S3 Tables Pricing (US West – Oregon)

    Dimension Rate
    Storage (Standard) $0.0265 per GB/month (first 50TB)
    PUT Requests $0.005 per 1,000 requests
    GET Requests $0.0004 per 1,000 requests
    Object Monitoring $0.025 per 1,000 objects
    Compaction – Objects Processed $0.002 per 1,000 objects
    Compaction – Data Processed $0.005 per GB
    Replication – Table Updates $0.010 per 1,000 table updates
    Table Bucket Free to create

    Pricing Example: 1 TB table with 30,000 new files/month, 500K GET requests, and automatic compaction = approximately $28.54/month (storage + requests + monitoring + compaction).

    Vector Database Comparison: S3 Vectors vs OpenSearch vs Pinecone vs pgvector

    Feature S3 Vectors OpenSearch Service Pinecone pgvector (Aurora/RDS)
    Max Vectors 2B per index (20T per bucket) Billions (distributed) Billions (serverless) Millions (instance-bound)
    Query Latency ~100ms (warm), <1s (cold) Single-digit ms ~10-50ms ~10-100ms (depends on index)
    QPS (Queries/Second) Low-Medium (optimized for infrequent) Very High (thousands) High (thousands) Medium (hundreds)
    Cost at Scale Very Low (90% cheaper) High (compute + storage) High (pod/serverless units) Medium (instance cost)
    Infrastructure Fully Serverless Managed (Serverless option) Fully Serverless Managed instances
    Hybrid Search Metadata filtering only Full (keyword + vector + filters) Metadata filtering Full SQL + vector
    Real-time Updates Strong consistency, 1K TPS writes Near real-time Near real-time Immediate (ACID)
    AWS Integration Native (Bedrock, OpenSearch, SageMaker) Native AWS service Third-party (API) Native (Aurora/RDS)
    Best For Large-scale, cost-sensitive, infrequent queries Real-time search, high QPS Quick start, managed vector DB Existing PostgreSQL apps, ACID needs

    When to Use Each Vector Solution

    • Choose S3 Vectors when:
      • You have large vector datasets (millions to billions) with infrequent query patterns
      • Cost optimization is the primary concern
      • You need long-term durable storage for vector embeddings
      • Building RAG applications with Amazon Bedrock Knowledge Bases
      • Implementing a tiered strategy (cold vectors in S3, hot vectors in OpenSearch)
      • Query latency of 100ms–1s is acceptable
    • Choose OpenSearch Service when:
      • You need single-digit millisecond latency
      • High query throughput (thousands of QPS) is required
      • You need hybrid search combining keyword, vector, and structured filters
      • Real-time applications like product recommendations or fraud detection
    • Choose Pinecone when:
      • You want a fully managed vector-only database with minimal setup
      • Multi-cloud or vendor-neutral strategy is important
      • You don’t need tight AWS service integration
    • Choose pgvector when:
      • You already use PostgreSQL and want to add vector search to existing data
      • You need ACID transactions combining relational and vector data
      • Vector dataset is relatively small (millions, not billions)
      • You prefer a single database for both structured queries and similarity search

    Analytics Storage Comparison: S3 Tables vs Athena vs Redshift

    Feature S3 Tables Amazon Athena Amazon Redshift
    Type Managed Storage Layer (Iceberg) Serverless Query Engine Data Warehouse
    Infrastructure No compute to manage Serverless (no provisioning) Provisioned clusters or Serverless
    Table Format Apache Iceberg (managed) Reads Iceberg, Hive, Delta, Parquet, CSV, JSON Native columnar + Spectrum for S3/Iceberg
    Table Maintenance Automatic (compaction, snapshots, cleanup) None (user-managed) Automatic (VACUUM, ANALYZE)
    Query Performance Depends on engine (Athena, Spark, etc.) Seconds to minutes (scan-based) Sub-second to seconds (optimized)
    Concurrency 10x higher TPS than self-managed Iceberg Limited concurrent queries High (hundreds of concurrent queries)
    Pricing Model Storage + requests + compaction $5 per TB scanned Per-node-hour or RPU-hour (Serverless)
    Best For Managed lakehouse storage at scale Ad-hoc queries, exploration Complex analytics, dashboards, BI

    Understanding the Relationship

    S3 Tables is a storage layer, not a query engine. It complements Athena and Redshift rather than replacing them:

    • S3 Tables + Athena – Best for serverless data lake analytics with automatic table optimization. Athena queries S3 Tables directly with improved performance from automatic compaction.
    • S3 Tables + Redshift – Best for high-concurrency BI dashboards and complex joins. Redshift reads S3 Tables through Spectrum or direct Iceberg integration.
    • S3 Tables + Spark (EMR/Glue) – Best for large-scale ETL, streaming ingestion, and ML feature engineering.

    When to Use Each Analytics Approach

    • Choose S3 Tables when:
      • You want managed Iceberg tables without maintaining compaction jobs
      • Data lake with multiple query engines (Athena + Redshift + Spark)
      • Streaming data that needs to be queryable in near real-time
      • You want Intelligent-Tiering to automatically optimize storage costs
      • Multi-region data access with automatic replication
    • Choose Athena (with S3 Tables or general purpose S3) when:
      • Ad-hoc exploration of data in S3
      • Pay-per-query model is preferred (no idle costs)
      • Simple queries that don’t require complex joins across large datasets
      • Infrequent querying where provisioned resources would be wasteful
    • Choose Redshift when:
      • High-concurrency BI dashboards with sub-second response times
      • Complex analytical queries with many joins across large tables
      • Predictable, heavy workloads that justify provisioned compute
      • Advanced features like materialized views, stored procedures, and ML integration

    S3 Vectors vs S3 Tables – Quick Comparison

    Aspect S3 Vectors S3 Tables
    Data Type Vector embeddings (unstructured → vectors) Tabular/structured data (rows and columns)
    Query Type Similarity search (nearest neighbor) SQL analytics (filter, aggregate, join)
    Primary Use Case AI/ML, RAG, semantic search Data lakes, analytics, BI
    Bucket Type Vector Bucket Table Bucket
    Open Standard Proprietary S3 Vectors API Apache Iceberg (open)
    GA Date December 2025 December 2024
    Complementary Use Store embeddings for AI agents and search Store structured data for analytics queries

    Together: S3 Vectors and S3 Tables can work in tandem. For example, store product catalog data in S3 Tables for analytical queries while storing product description embeddings in S3 Vectors for semantic search. Both share S3’s durability, security model, and operational simplicity.

    AWS Certification Exam Practice Questions

    Question 1

    A company needs to store 500 million vector embeddings for a semantic search application. The application receives approximately 100 queries per minute and requires results within 1 second. Cost optimization is the highest priority. Which solution best meets these requirements?

    1. Amazon OpenSearch Service with vector engine
    2. Amazon S3 Vectors
    3. Amazon Aurora PostgreSQL with pgvector extension
    4. Self-managed Pinecone on Amazon EC2
    Show Answer

    Answer: B –

    Explanation: S3 Vectors is designed for large-scale vector storage (up to 2B per index) with sub-second query performance at up to 90% lower cost than specialized vector databases. With 100 queries/minute (infrequent pattern) and cost as the primary concern, S3 Vectors is the ideal choice. OpenSearch would provide faster latency but at significantly higher cost. pgvector would struggle at 500M vectors. Pinecone on EC2 is not a valid deployment model.

    Question 2

    A data engineering team manages an Apache Iceberg data lake on Amazon S3. They spend significant time running compaction jobs, managing snapshots, and cleaning orphan files. Queries are becoming slower as the data grows. Which solution would reduce their operational overhead while improving query performance?

    1. Move data to Amazon Redshift
    2. Use Amazon S3 Tables with automatic table maintenance
    3. Implement S3 Lifecycle policies to delete old files
    4. Add more partitions to the existing Iceberg tables
    Show Answer

    Answer: B –

    Explanation: Amazon S3 Tables provides fully managed Apache Iceberg tables with automatic compaction, snapshot management, and unreferenced file removal. This eliminates the operational burden while delivering up to 3x faster query performance. Moving to Redshift changes the architecture entirely. Lifecycle policies don’t understand Iceberg metadata. Adding partitions doesn’t address compaction issues.

    Question 3

    An AI team is building a RAG application using Amazon Bedrock Knowledge Bases. They need to store vector embeddings for 50 million documents with the lowest possible cost. The application will query the knowledge base approximately 10,000 times per day. Which vector store should they select in the Bedrock Knowledge Bases configuration? (Select TWO benefits of this choice)

    1. Amazon OpenSearch Serverless – provides lowest latency
    2. Amazon S3 Vectors – reduces vector storage and query costs by up to 90%
    3. Amazon S3 Vectors – provides native integration with Bedrock Knowledge Bases
    4. Amazon Aurora PostgreSQL – provides ACID transactions for vectors
    5. Amazon OpenSearch Serverless – provides automatic scaling with no minimum charges
    Show Answer

    Answer: B, C

    Explanation: S3 Vectors is natively integrated with Amazon Bedrock Knowledge Bases and reduces the cost of vector storage and querying by up to 90%. With 10,000 queries/day (~7 per minute), the infrequent query pattern is ideal for S3 Vectors. While OpenSearch provides lower latency, the question prioritizes cost. Aurora pgvector is not a native Bedrock Knowledge Bases vector store option.

    Question 4

    A company has Apache Iceberg tables stored in general purpose S3 buckets. They want to improve query performance, reduce storage costs with automatic tiering, and replicate tables to a second region for disaster recovery. Which combination of features is available with Amazon S3 Tables? (Select THREE)

    1. Automatic compaction with sort and z-order strategies
    2. S3 Glacier Deep Archive storage for table data
    3. S3 Tables Intelligent-Tiering for automatic storage cost optimization
    4. Cross-region table replication
    5. Real-time CDC (Change Data Capture) to Amazon DynamoDB
    6. Native integration with Amazon Kinesis Data Streams
    Show Answer

    Answer: A, C, D

    Explanation: S3 Tables supports automatic compaction (including sort and z-order), Intelligent-Tiering that reduces storage costs by up to 80%, and automatic cross-region table replication. S3 Tables does not support Glacier storage classes, CDC to DynamoDB, or native Kinesis integration.

    Question 5

    A solutions architect is designing a tiered vector search architecture. Real-time product recommendations need single-digit millisecond latency, while a historical document search (accessed a few times per hour) needs to be cost-optimized. Which architecture should the architect implement?

    1. Use Amazon OpenSearch Service for all vector workloads with auto-scaling
    2. Store all vectors in Amazon S3 Vectors and optimize with metadata filtering
    3. Store hot vectors in Amazon OpenSearch Service for real-time queries and cold vectors in Amazon S3 Vectors for infrequent historical search
    4. Use Amazon Aurora pgvector for product recommendations and Pinecone for document search
    Show Answer

    Answer: C –

    Explanation: The tiered strategy combining OpenSearch (for hot, real-time queries requiring single-digit ms latency) and S3 Vectors (for cold, infrequent queries where sub-second latency is acceptable) provides the optimal balance of performance and cost. S3 Vectors natively integrates with OpenSearch, allowing vectors to be exported from S3 to OpenSearch when demand increases. Using OpenSearch for everything would be costly; using S3 Vectors for everything wouldn’t meet the real-time latency requirement.

    Frequently Asked Questions

    What is Amazon S3 Vectors?

    S3 Vectors is a purpose-built storage service for AI embeddings. It stores up to 2 billion vectors per index, supports 100ms query latencies, and costs up to 90% less than specialized vector databases — integrating natively with Bedrock and SageMaker.

    What is Amazon S3 Tables?

    S3 Tables provides first-class Apache Iceberg table support in S3. It manages compaction, snapshot management, and schema evolution automatically, enabling analytics queries via Athena, Redshift, and EMR with built-in Intelligent-Tiering.

    When should I use S3 Vectors vs OpenSearch?

    Use S3 Vectors for cost-optimized vector storage at scale (billions of embeddings) with simple similarity search. Use OpenSearch when you need hybrid search (vector + keyword), complex filtering, or real-time indexing with sub-10ms latency.

    Related Posts

    References

    Aurora DSQL – Serverless Distributed SQL Database

    ~ Last updated on : ~ Kiro Agent

    Amazon Aurora DSQL

    • Amazon Aurora DSQL is a serverless, distributed relational database service optimized for transactional (OLTP) workloads.
    • Aurora DSQL was previewed at AWS re:Invent 2024 and became generally available on May 27, 2025.
    • It offers virtually unlimited scale, the highest availability, and zero infrastructure management.
    • Aurora DSQL is PostgreSQL-compatible (currently PostgreSQL 16), enabling developers to use familiar drivers, ORMs, tools, and SQL features.
    • It is designed for 99.99% availability in single-Region configuration and 99.999% availability in multi-Region configuration.
    • Aurora DSQL uses Optimistic Concurrency Control (OCC) instead of traditional pessimistic locking, eliminating deadlocks and lock contention.
    • It supports active-active multi-Region deployments with strongly consistent reads and writes from any Region.
    • Aurora DSQL scales to zero when idle — no compute charges when no queries are running.
    • It eliminates all operational burden including patching, upgrades, maintenance downtime, capacity planning, and database sharding.

    Aurora DSQL Architecture

    • Aurora DSQL uses a disaggregated architecture where the database is separated into four independent, multi-tenant components that scale independently:
      • Query Processors (Firecracker MicroVMs) – Stateless compute units that handle SQL parsing, query planning, and execution. They run in AWS Firecracker MicroVMs (same technology as AWS Lambda), enabling true scale-to-zero behavior.
      • Adjudicators – The conflict detection layer that validates write transactions at commit time using Optimistic Concurrency Control. If conflicts are detected, the transaction is rejected with SQLSTATE 40001.
      • Journal (Paxos-Based Log) – A distributed write-ahead log using Paxos consensus that provides cross-AZ durability. Every committed transaction is written to the Journal before being acknowledged.
      • MVCC Storage Replicas – Multi-Version Concurrency Control storage that maintains table data across three Availability Zones in each active Region.
    • A control plane coordinates all components, providing redundancy across three AZs with automatic scaling and self-healing.
    • Each component scales independently — query processing, commit, and storage layers adapt to workloads of any shape including different read/write ratios, data sizes, and query complexities.

    Single-Region Clusters

    • Active-active across three Availability Zones, minimizing replication lag and eliminating traditional failover operations.
    • All write transactions are committed to a distributed transaction log and synchronously replicated to storage replicas in three AZs.
    • Designed for 99.99% availability.
    • When a component or AZ becomes impaired, requests are automatically redirected to healthy infrastructure without manual intervention.

    Multi-Region Clusters

    • Provides 99.999% availability with active-active multi-Region deployment.
    • Two Regional endpoints present a single logical database, both available for concurrent read and write operations with strong data consistency.
    • Aurora DSQL synchronously replicates writes across Regions, enabling strongly consistent reads and writes from any linked cluster.
    • A third Region acts as a witness Region — stores only encrypted transaction logs for Paxos quorum, not full data copies.
    • Multi-Region clusters must be created within the same Region set (same continent):
      • US Regions: US East (N. Virginia), US East (Ohio), US West (Oregon)
      • Asia Pacific: Asia Pacific (Osaka), Asia Pacific (Seoul), Asia Pacific (Tokyo)
      • Europe: Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris)
    • Cross-continent multi-Region clusters are not currently supported.

    Aurora DSQL Key Features

    • Serverless & Zero Infrastructure Management
      • No servers to provision, patch, upgrade, or manage.
      • No maintenance downtime — eliminates traditional database failover.
      • Automatically manages storage optimization, statistics collection, and performance tuning.
      • Scales to zero when idle with no compute charges.
    • Active-Active Multi-Region
      • Both Regions accept concurrent reads and writes.
      • Single logical database across Regions with strong consistency.
      • No eventual consistency or missing data during failovers.
    • Strongly Consistent Reads
      • Provides strong read-after-write consistency.
      • Readers always see the same data regardless of which Region they connect to.
      • Zero data loss for both single and multi-Region clusters due to synchronous replication.
    • Optimistic Concurrency Control (OCC)
      • Transactions execute without acquiring locks.
      • Conflicts are detected at commit time, not during execution.
      • Eliminates deadlocks and prevents slow transactions from blocking others.
      • If conflicts occur, the later transaction receives SQLSTATE 40001 and must be retried by the application.
      • Read-only transactions are conflict-free and never fail due to OCC.
    • Auto-Scaling
      • Scales compute, I/O, and storage automatically based on workload.
      • No database sharding or instance upgrades required.
      • Query processing, commit, and storage layers scale independently.
    • 99.999% Multi-Region Availability
      • Active-active architecture with automatic failure recovery.
      • No manual failover or switchover operations.
      • Multi-AZ and multi-Region availability built-in.
    • PostgreSQL Compatibility
      • Compatible with PostgreSQL 16 wire protocol.
      • Supports standard drivers: psycopg2, asyncpg, node-postgres, JDBC.
      • Supports ACID transactions, SQL queries, secondary indexes, joins, CTEs, window functions, aggregations.
      • IAM-based token authentication (no password-based authentication).
    • ACID Transactions
      • Full ACID properties even across multiple Regions.
      • Strong snapshot isolation (equivalent to PostgreSQL REPEATABLE READ).
      • Cross-AZ and cross-Region durability.
    • Change Data Capture (CDC)
      • Supports streaming changes to Amazon Kinesis Data Streams.
      • Billed as StreamDPU — scales with volume of changes captured.
    • Security
      • Full integration with AWS IAM and AWS CloudTrail.
      • Token-based authentication using IAM (blocks standard password-based auth).
      • Encrypted transaction logs in witness Region.

    Aurora DSQL Pricing

    • Aurora DSQL uses a pay-per-use pricing model with no upfront costs.
    • Billing is based on two primary components:
      • Database Activity (DPUs) – Distributed Processing Units measure all work done by the system including compute, I/O reads, I/O writes, and CDC streaming.
      • Storage (GB-month) – Based on total data stored, replicated across 3 AZs (you pay for one logical copy per Region).
    • DPU Rate: $8.00 per million DPUs (in US East regions).
    • Storage Rate: $0.33 per GB-month.
    • Free Tier (permanent, no 12-month expiry):
      • 100,000 DPUs per month (~700,000 TPC-C transactions)
      • 1 GB of storage per month
    • Multi-Region Write Replication: Incurs extra DPU charges equal to the cost of originating writes (approximately 50% premium on write DPUs). No separate data transfer charges.
    • Scale to Zero: When the cluster is idle, DPU usage scales to zero — $0.00 compute charges. Only storage is billed continuously.
    • DPU Sub-components (visible in CloudWatch, all billed at same rate):
      • ComputeDPU – SQL query execution (joins, functions, aggregations)
      • ReadDPU – Data read from storage
      • WriteDPU – Data written to storage
      • MultiRegionWriteDPU – Replication to peered clusters
      • StreamDPU – Change data capture streaming
    • Aurora DSQL usage may be eligible for Database Savings Plans.
    • Inter-AZ replication within a Region is included at no additional charge.

    Aurora DSQL vs Aurora Serverless v2 vs Aurora Global Database vs DynamoDB Global Tables

    Feature Aurora DSQL Aurora Serverless v2 Aurora Global Database DynamoDB Global Tables
    Architecture Disaggregated, distributed, OCC Standard Aurora engine, ACU-based scaling Provisioned/Serverless instances with cross-Region replication Fully managed NoSQL, partitioned
    Data Model Relational (SQL) Relational (SQL) Relational (SQL) Key-Value / Document (NoSQL)
    Multi-Region Writes Active-Active (built-in) Not supported (single-Region only) Active-Passive (single writer, read replicas in other Regions) Active-Active (all Regions accept writes)
    Consistency Strong consistency (reads and writes) Strong consistency (single-Region) Eventual consistency for cross-Region reads; strong in primary Eventual consistency (cross-Region); strong consistency for single-Region reads
    Availability SLA 99.99% (single-Region), 99.999% (multi-Region) 99.99% 99.99% with <1 min RTO for cross-Region failover 99.999%
    Scaling Serverless, scales to zero, virtually unlimited Serverless, 0.5-128 ACUs, scales to zero Provisioned instances or Serverless v2; manual scaling On-demand or provisioned; auto-scaling
    PostgreSQL Compatibility Subset (no FK, triggers, sequences, stored procs, views) Full Aurora PostgreSQL/MySQL Full Aurora PostgreSQL/MySQL Not applicable (NoSQL)
    Concurrency Control Optimistic (OCC) — no locks, retry on conflict Pessimistic locking (traditional) Pessimistic locking (traditional) Last-writer-wins or conditional writes
    Infrastructure Management Zero (fully serverless) Minimal (serverless but cluster management needed) Moderate (instance sizing, replica management, failover config) Zero (fully serverless)
    Pricing Model Per DPU ($8/million) + storage ($0.33/GB-month) Per ACU-hour ($0.12/hr) + storage + I/O Instance hours + storage + I/O + data transfer Per WRU/RRU (on-demand) or provisioned WCU/RCU + storage
    Free Tier 100K DPUs + 1 GB/month (permanent) None (beyond general AWS Free Tier) None 25 GB storage + 25 WCU/RCU (provisioned, 12-month)
    Transaction Limits 3,000 rows per transaction Standard PostgreSQL limits Standard PostgreSQL limits 25 items / 4 MB per transaction
    Best For Global OLTP, low-contention writes, serverless backends, new apps Variable workloads, existing PostgreSQL apps, single-Region Disaster recovery, read scaling, cross-Region with single writer High-throughput key-value access, global apps not needing SQL

    Aurora DSQL Limitations

    • PostgreSQL Feature Gaps:
      • No foreign keys (referential integrity must be enforced in application code)
      • No triggers
      • No views or materialized views
      • No sequences or SERIAL/IDENTITY columns (use UUIDs via gen_random_uuid())
      • No stored procedures (PL/pgSQL not supported; SQL functions are supported)
      • No PostgreSQL extensions (PostGIS, pgvector, etc.)
      • No explicit locking (SELECT FOR UPDATE not supported)
      • No temporary tables (use CTEs or regular tables with unique naming)
    • Transaction Constraints:
      • Maximum of 3,000 rows modified per transaction (INSERT, UPDATE, DELETE)
      • DDL and DML operations require separate transactions
      • Only 1 DDL statement per transaction
      • Fixed isolation level: REPEATABLE READ only (no SERIALIZABLE, no READ COMMITTED)
    • Operational Constraints:
      • Single database per cluster (named postgres) — use schemas for logical separation
      • Database connections time out after 1 hour
      • UTF-8 encoding only with C collation only
      • UTC system timezone
      • No password-based authentication (IAM token-based only)
    • Multi-Region Constraints:
      • Cross-continent multi-Region clusters not supported
      • Multi-Region clusters must be within the same Region set
      • Multi-Region writes incur additional DPU charges (~50% premium)
    • OCC Requirements:
      • Applications must implement retry logic for write transactions (handle SQLSTATE 40001)
      • Not suitable for high write-contention workloads (inventory counters, hot-row updates)
      • Each retry attempt consumes additional DPUs

    Aurora DSQL Use Cases

    Financial Transactions

    • Global-scale financial transaction processing across multiple AWS Regions.
    • Core banking systems requiring strong consistency without choosing between consistency and low latency.
    • Spend management systems and digital currency infrastructure.
    • Payment processing with ACID guarantees across Regions.
    • The low-contention nature of financial transactions (each transaction typically touches unique records) makes OCC highly effective.

    Global Applications

    • Multi-Region SaaS applications requiring active-active writes with strong consistency.
    • Global scheduling and booking systems (e.g., Frontdoor home services marketplace).
    • Collaborative tools where users in different Regions need consistent data views.
    • Multi-Region authentication and session management services.
    • Microservices and event-driven architectures with serverless backends (Lambda + API Gateway + DSQL).

    Gaming

    • Global game state — maintaining consistent world state across geographically distributed players.
    • Player inventory — managing in-game items and purchases with ACID guarantees preventing duplication exploits.
    • In-game purchases — transactional integrity for virtual currency and item transactions.
    • Live events — consistent event state across all Regions simultaneously.
    • Real-time player interactions — ensuring consistent data for trades, gifts, and cooperative actions.
    • Note: For high-contention leaderboard updates (many players updating the same row), DynamoDB or Aurora with pessimistic locking may be more appropriate. DSQL works well for leaderboards designed with per-player rows.

    Other Use Cases

    • Order management systems and e-commerce transaction processing.
    • User profile and account management (low-contention per-user updates).
    • Appointment and resource scheduling systems.
    • Event logging and audit trail systems (append-only patterns).
    • Development and testing environments (leveraging permanent free tier).

    Aurora DSQL Region Availability

    • GA Regions (May 2025 launch): US East (N. Virginia), US East (Ohio), US West (Oregon), Asia Pacific (Osaka), Asia Pacific (Tokyo), Europe (Ireland), Europe (London), Europe (Paris)
    • Added July 2025: Asia Pacific (Seoul)
    • Added October 2025: Europe (Frankfurt)
    • Added February 2026: Additional Regions
    • Added May 2026: Asia Pacific (Hong Kong), Asia Pacific (Mumbai), Asia Pacific (Singapore), Europe (Stockholm), South America (São Paulo)
    • Region expansion continues through 2026.

    AWS Certification Exam Relevance

    • AWS Solutions Architect Associate (SAA-C03)
      • Understanding when to choose Aurora DSQL vs Aurora Serverless v2 vs DynamoDB Global Tables for multi-Region architectures.
      • Knowing the availability SLAs (99.99% single-Region, 99.999% multi-Region).
      • Understanding serverless database options and their trade-offs.
    • AWS Solutions Architect Professional (SAP-C02)
      • Designing global, active-active architectures with strong consistency.
      • Understanding OCC implications for application design.
      • Comparing multi-Region database strategies: Aurora DSQL vs Aurora Global Database vs DynamoDB Global Tables.
      • Cost optimization for global database architectures.
    • AWS Database Specialty (DBS-C01)
      • Deep understanding of Aurora DSQL architecture (disaggregated components, Paxos journal, Adjudicators).
      • PostgreSQL compatibility limitations and migration considerations.
      • OCC conflict resolution and retry patterns.
      • DPU pricing model and cost estimation.
      • When to use DSQL vs other Aurora variants vs DynamoDB.

    Amazon Aurora DSQL Practice Questions

    Question 1:

    A company is building a global financial application that requires active-active writes in multiple AWS Regions with strong consistency for all reads. The application uses a relational data model with SQL queries and ACID transactions. Which database service is MOST appropriate?

    1. Amazon Aurora Global Database
    2. Amazon DynamoDB Global Tables
    3. Amazon Aurora DSQL multi-Region cluster
    4. Amazon Aurora Serverless v2 with cross-Region read replicas
    Show Answer

    Answer: C –

    • Aurora DSQL multi-Region clusters provide active-active writes with strong consistency across Regions using a relational/SQL data model — exactly what this scenario requires.
    • Aurora Global Database (Option A) supports only active-passive (single writer Region with read replicas in other Regions).
    • DynamoDB Global Tables (Option B) provides active-active but with eventual consistency and a NoSQL data model, not relational SQL.
    • Aurora Serverless v2 (Option D) is single-Region only and does not support cross-Region writes.

    Question 2:

    A development team is migrating an existing PostgreSQL application to Aurora DSQL. The application heavily uses foreign keys, database triggers for audit logging, and stored procedures for business logic. What should the team do?

    1. Migrate directly — Aurora DSQL supports all PostgreSQL features
    2. Refactor the application to enforce referential integrity in application code, move trigger logic to EventBridge/application layer, and move stored procedure logic to the application or Lambda functions
    3. Use Aurora DSQL with PostgreSQL extensions to enable missing features
    4. Use Aurora Serverless v2 instead, which provides full PostgreSQL compatibility without requiring application changes
    Show Answer

    Answer: B (if DSQL is required) or D (if full PG compatibility is the priority) –

  • Aurora DSQL does not support foreign keys, triggers, or stored procedures (PL/pgSQL). These are architectural limitations of the distributed design.
  • Option B is correct if the team must use DSQL — all these features need application-level workarounds.
  • Option D is the simpler path if the requirement is just serverless PostgreSQL without application refactoring.
  • Option A is incorrect — DSQL is a PostgreSQL-compatible subset, not full PostgreSQL.
  • Option C is incorrect — Aurora DSQL does not support PostgreSQL extensions.

    • Question 3:

    An e-commerce company uses Aurora DSQL for its order processing system. During peak sales events, they notice increased transaction failures with SQLSTATE 40001 errors on their inventory update operations where multiple customers try to purchase the last few items simultaneously. What is the MOST likely cause and solution?

    1. The database is running out of capacity; increase the provisioned instances
    2. Aurora DSQL’s Optimistic Concurrency Control is detecting write conflicts on the same inventory rows; redesign to reduce contention or switch to Aurora Serverless v2 with pessimistic locking for the inventory service
    3. The database connection pool is exhausted; increase the connection limit
    4. The transaction isolation level needs to be changed to READ COMMITTED
    Show Answer

    Answer: B –

    • SQLSTATE 40001 is the serialization failure error returned by Aurora DSQL’s OCC when concurrent transactions conflict on the same data.
    • High-contention inventory updates (many writers to the same row) are a known poor fit for OCC — they generate high retry rates.
    • Solutions include redesigning the schema to reduce contention, or using Aurora Serverless v2 with traditional pessimistic locking for high-contention workloads.
    • Option A is incorrect — Aurora DSQL is serverless with no provisioned instances.
    • Option D is incorrect — Aurora DSQL only supports REPEATABLE READ isolation; it cannot be changed.

    Question 4:

    A startup wants to minimize database costs for their development environment while building a globally distributed application. They need a PostgreSQL-compatible database that costs nothing when idle and has a permanent free tier. Which option BEST meets these requirements?

    1. Amazon RDS PostgreSQL with a db.t3.micro instance (free tier)
    2. Amazon Aurora Serverless v2 (scales to zero)
    3. Amazon Aurora DSQL (scales to zero with permanent free tier)
    4. Amazon DynamoDB with on-demand capacity
    Show Answer

    Answer: C –

    • Aurora DSQL has a permanent free tier (100,000 DPUs + 1 GB storage/month with no 12-month expiry) and scales to zero when idle — $0 compute charges when not in use.
    • RDS free tier (Option A) expires after 12 months and the instance runs continuously (always has charges after free tier expires).
    • Aurora Serverless v2 (Option B) can scale to zero but does not have a permanent free tier for compute.
    • DynamoDB (Option D) has a free tier but is NoSQL, not PostgreSQL-compatible.

    Question 5:

    A solutions architect is designing a multi-Region active-active database architecture using Aurora DSQL. The application serves users in the US and Europe. What is a key constraint the architect must consider?

    1. Multi-Region clusters can span any two AWS Regions globally
    2. Multi-Region clusters must be within the same continent/Region set — cross-continent clusters are not supported
    3. Only one Region can accept writes at a time; the other Region is read-only
    4. Multi-Region clusters require manual failover configuration
    Show Answer

    Answer: B –

    • Aurora DSQL multi-Region clusters must be created within the same Region set (US Regions, Asia Pacific Regions, or European Regions). Cross-continent multi-Region clusters are not currently supported.
    • The architect cannot create a cluster spanning US East and Europe — they would need separate single-Region clusters or a different approach for cross-continent active-active.
    • Option A is incorrect — cross-continent is not supported.
    • Option C is incorrect — both Regions accept concurrent reads AND writes (active-active).
    • Option D is incorrect — Aurora DSQL provides automatic failure recovery with no manual failover.

    Frequently Asked Questions

    What is Amazon Aurora DSQL?

    Aurora DSQL is a serverless, distributed SQL database that provides PostgreSQL compatibility with active-active multi-Region replication, strong consistency, and 99.999% availability — all without managing infrastructure.

    How does Aurora DSQL differ from Aurora Global Database?

    Aurora Global Database uses a primary-secondary model with async replication (1-second lag). DSQL provides active-active multi-Region writes with strong consistency and optimistic concurrency control, meaning both Regions can accept writes simultaneously.

    Is Aurora DSQL compatible with PostgreSQL?

    Yes, DSQL is wire-compatible with PostgreSQL and supports standard SQL. However, it has some limitations — it doesn’t support stored procedures, triggers, sequences, or advisory locks due to its distributed architecture.

    Related Posts

    References

    AWS Security Lake – Centralized Security Data Lake

    ~ Last updated on : ~ Kiro Agent

    AWS Security Lake – Centralized Security Data Lake

    • AWS Security Lake is a fully managed security data lake service that automatically centralizes security data from AWS environments, SaaS providers, on-premises, and cloud sources into a purpose-built data lake stored in your AWS account.
    • Security Lake normalizes and consolidates security data into the Open Cybersecurity Schema Framework (OCSF) format, enabling faster threat detection, investigation, and response.
    • The data lake is backed by Amazon S3 buckets, and you retain full ownership and control over your data.
    • Security Lake uses Apache Iceberg open table format and Apache Parquet columnar storage for optimized query performance and cost-efficient storage.
    • It integrates with AWS Organizations for multi-account management and supports cross-Region data aggregation through rollup Regions.
    • Security Lake provides a subscriber model to grant third-party SIEM tools, analytics platforms, and custom applications access to the centralized security data.
    • The service is highly relevant for the AWS Certified Security – Specialty (SCS-C02) exam, particularly in the domains of Security Logging and Monitoring, and Threat Detection and Incident Response.

    Security Lake Architecture

    • Security Lake creates a purpose-built security data lake in your account using Amazon S3 as the storage layer.
    • Key architectural components include:
      • Data Collection Layer – Automatically collects log and event data from natively supported AWS services and allows ingestion of custom/third-party sources.
      • Data Normalization Layer – Converts all ingested data into OCSF format and Apache Parquet columnar format for consistency.
      • Storage Layer – Data stored in S3 buckets using Apache Iceberg table format, registered in AWS Glue Data Catalog.
      • Access Control Layer – AWS Lake Formation provides fine-grained access control to the data lake tables.
      • Subscriber Layer – Managed access for SIEM tools, analytics platforms, and custom consumers.

    Open Cybersecurity Schema Framework (OCSF)

    • OCSF is a collaborative, open-source schema framework developed by AWS and leading cybersecurity partners (including Splunk, IBM, and others).
    • It provides a vendor-agnostic taxonomy for security events, eliminating the need for custom parsers for each data source.
    • OCSF defines standardized event classes such as:
      • Network Activity (VPC Flow Logs, DNS queries)
      • API Activity (CloudTrail events)
      • Security Findings (GuardDuty, Security Hub)
      • Authentication events
      • File Activity and Process Activity
    • By normalizing to OCSF, Security Lake enables correlation across disparate sources without custom ETL pipelines.
    • Third-party sources must be converted to OCSF format before ingestion (no charge for third-party data ingestion).

    Apache Iceberg Tables

    • Security Lake stores data in Apache Iceberg open table format on top of Amazon S3.
    • Iceberg provides:
      • ACID transactions – Ensures data consistency during concurrent writes.
      • Schema evolution – Supports adding/removing columns without rewriting data.
      • Partition evolution – Optimizes query patterns without data migration.
      • Time travel – Query historical snapshots of data.
      • Hidden partitioning – Automatic partition pruning for faster queries.
    • Tables are registered in AWS Glue Data Catalog, enabling query access via Amazon Athena, Amazon Redshift Spectrum, and Amazon OpenSearch Service.
    • The combination of Parquet format + Iceberg tables provides storage-efficient and query-optimized access to security data.

    Data Lifecycle Management

    • Security Lake provides customizable retention settings to manage data lifecycle.
    • Supports automated storage tiering to transition data to cost-effective storage classes (S3 Standard → S3 Standard-IA → S3 Glacier).
    • Data is automatically partitioned by source, Region, account, and time for efficient querying.
    • Retention policies can be configured per source and per Region.

    Security Lake Data Sources

    • Security Lake supports natively integrated AWS sources and custom/third-party sources.
    • AWS sources are automatically normalized to OCSF format and converted to Apache Parquet.

    Natively Supported AWS Sources

    Source Data Type OCSF Event Class
    AWS CloudTrail (Management Events) API calls, console sign-ins API Activity
    AWS CloudTrail (S3 Data Events) S3 object-level operations API Activity
    AWS CloudTrail (Lambda Data Events) Lambda invocation activity API Activity
    Amazon VPC Flow Logs Network traffic metadata Network Activity
    Amazon Route 53 Resolver DNS query logs DNS Activity
    Amazon S3 Data Events Object access activity API Activity
    AWS Lambda Execution activity API Activity
    Amazon EKS Audit Logs Kubernetes API server audit logs API Activity
    AWS WAF Web request logs HTTP Activity
    AWS Security Hub Aggregated security findings Security Finding

    Security Hub Integrated Findings Sources

    • Security Lake ingests findings from Security Hub, which aggregates from:
      • Amazon GuardDuty – Threat detection findings (malicious IPs, compromised instances, anomalous behavior)
      • Amazon Inspector – Vulnerability assessment findings
      • Amazon Macie – Sensitive data discovery findings
      • AWS Config – Configuration compliance findings
      • AWS Firewall Manager – Firewall policy compliance findings
      • IAM Access Analyzer – External access findings
      • AWS Health – Service health events
      • AWS Systems Manager Patch Manager – Patch compliance findings

    Custom and Third-Party Sources

    • Security Lake allows ingestion of custom sources from on-premises, other cloud providers, or SaaS applications.
    • Custom sources must convert data to OCSF format before ingestion.
    • There is no Security Lake charge for ingesting third-party or custom data (standard S3 storage charges apply).
    • AWS AppFabric automatically normalizes SaaS application audit logs (Microsoft 365, Google Workspace, Salesforce, etc.) into OCSF and delivers to Security Lake.
    • Custom sources can deliver data via:
      • Direct S3 writes to the Security Lake bucket
      • AWS Glue ETL pipelines for format conversion
      • Partner integrations (CrowdStrike, Palo Alto Networks, etc.)

    Default vs. Optional Sources

    • When enabling Security Lake, the default sources include: CloudTrail management events, VPC Flow Logs, Route 53 DNS logs, and Security Hub findings.
    • CloudTrail S3 Data Events and AWS WAF logs are NOT included by default due to potentially high volume and cost – they must be explicitly enabled.
    • EKS Audit Logs and Lambda Data Events are optional and can be enabled separately.

    Security Lake Subscriber Model

    • Security Lake uses a subscriber model to provide controlled access to the security data lake.
    • Subscribers are external or internal consumers (SIEM tools, analytics platforms, custom applications) that need access to the centralized security data.
    • Two types of subscriber access are available:

    Data Access Subscribers

    • Data access subscribers receive notifications when new objects are written to the data lake and can directly access the S3 objects.
    • Subscribers are notified via:
      • HTTPS endpoint (default) – Security Lake sends notifications to a subscriber-provided endpoint.
      • Amazon SQS queue – Subscriber polls an SQS queue for new object notifications.
    • Data access uses AWS Resource Access Manager (RAM) to share S3 resources cross-account.
    • Best suited for SIEM tools that need to ingest raw data into their own systems (e.g., Splunk, Datadog).
    • Subscriber specifies which log sources they are authorized to consume.

    Query Access Subscribers

    • Query access subscribers can directly query the data in place using AWS Lake Formation tables.
    • Subscribers query data through services like Amazon Athena without needing to copy or move the data.
    • Uses AWS Lake Formation permissions for fine-grained access control.
    • Requires creation of an AmazonSecurityLakeMetaStoreManager role to manage AWS Glue partitions and table updates.
    • Best suited for analytics tools that support federated queries or organizations that want to avoid data duplication.
    • A query access subscriber can only query data in the AWS Region where it was created.

    Subscriber Configuration

    • When creating a subscriber, you specify:
      • Subscriber name and description
      • Log and event sources the subscriber can access
      • Data access method (S3 data access or Lake Formation query access)
      • Subscriber credentials (AWS account ID and external ID)
      • Notification method (SQS queue or subscription endpoint) for data access subscribers

    SIEM Tool Integration

    • Security Lake integrates with major SIEM and security analytics platforms through the subscriber model.
    • OCSF normalization eliminates the need for custom parsers in each SIEM tool.

    Splunk Integration

    • Splunk integrates with Security Lake as a data access subscriber.
    • Uses the Splunk Add-on for Amazon Security Lake to ingest OCSF-normalized data.
    • Splunk polls SQS notifications and ingests new Parquet files from S3.
    • Supports building SOC workflows with Security Lake as the centralized data source.
    • Siemens uses this integration to centralize security data across 800+ AWS accounts.

    Datadog Integration

    • Datadog integrates with Security Lake for Cloud SIEM use cases.
    • Datadog Observability Pipelines can send standardized OCSF-formatted logs to Security Lake.
    • Supports bidirectional integration – ingest from Security Lake into Datadog Cloud SIEM, or route logs to Security Lake for long-term retention.
    • Enables unified security monitoring across AWS and hybrid environments.

    IBM QRadar Integration

    • IBM QRadar integrates with Security Lake as a subscriber to ingest normalized security events.
    • QRadar uses the Amazon Security Lake DSM (Device Support Module) to parse OCSF data.
    • Enables centralized threat detection combining AWS security data with on-premises sources in QRadar.

    Other Supported Integrations

    • Amazon OpenSearch Service – Direct integration for interactive log analytics, real-time monitoring, pre-built OCSF dashboards, and on-demand indexing.
    • Amazon Detective – Subscribes to Security Lake for enhanced investigation workflows.
    • CrowdStrike – Sends endpoint detection data to Security Lake; consumes Security Lake data for correlation.
    • Palo Alto Networks (Cortex XSIAM) – Ingests Security Lake data for extended detection and response.
    • SentinelOne – Integrates for unified cloud and endpoint security analytics.
    • Rapid7 – Consumes Security Lake data for managed detection and response.

    Lake Formation Access Control

    • AWS Lake Formation provides the access control layer for Security Lake data.
    • Lake Formation manages permissions for the Glue Data Catalog tables that point to Security Lake S3 data.
    • Key capabilities:
      • Table-level permissions – Control which subscribers can access which log source tables.
      • Column-level permissions – Restrict access to specific fields within a table (e.g., mask IP addresses).
      • Row-level security – Filter data based on attributes (e.g., only show data from specific accounts).
      • Cell-level security – Combine row and column filters for granular control.
    • Lake Formation supports cross-account sharing via AWS Resource Access Manager (RAM), enabling subscribers in different accounts to query Security Lake data.
    • The delegated administrator manages Lake Formation permissions for the organization’s security data lake.
    • Lake Formation permissions are provided at no additional charge – you only pay for the underlying services (Glue, S3, Athena queries).

    Cross-Account and Cross-Region Support

    Multi-Account with AWS Organizations

    • Security Lake integrates with AWS Organizations for centralized multi-account management.
    • The Organizations management account designates a delegated Security Lake administrator.
    • The delegated administrator can:
      • Enable Security Lake for all member accounts
      • Configure log sources for the entire organization
      • Automatically collect data from new organization accounts
      • Grant subscriber permissions to consume data from member accounts
    • The management account cannot be set as the delegated administrator (security best practice).
    • Each account sees its own usage on its bill, but consolidated billing applies through the organization management account.
    • The delegated account is NOT billed for all accounts – each account incurs its own log collection charges.

    Cross-Region with Rollup Regions

    • Security Lake supports enabling across multiple AWS Regions simultaneously.
    • Rollup Regions consolidate data from one or more contributing Regions into a central Region.
    • Use cases for rollup Regions:
      • Compliance – Consolidate data into a Region that meets data residency requirements.
      • Centralized analysis – Query all security data from a single Region.
      • Reduced complexity – Subscribers only need to access one Region.
    • Standard data transfer costs apply for cross-Region replication.
    • Data in contributing Regions remains available locally – rollup creates a consolidated copy.

    Security Lake Pricing

    • Security Lake uses pay-as-you-go pricing with no upfront costs.
    • Pricing is based on two dimensions:

    Pricing Dimensions

    Dimension Description Cost (US East)
    CloudTrail Log Ingestion Per GB of CloudTrail data (management + data events) $0.75 per GB
    Other AWS Log Ingestion Per GB of VPC Flow Logs, Route 53, Security Hub, WAF, EKS, Lambda $0.25 per GB
    Data Normalization Per GB for OCSF conversion and Parquet formatting $0.035 per GB
    Third-Party Data Ingestion Custom/third-party source ingestion $0 (no charge)
    S3 Storage Standard Amazon S3 storage charges Standard S3 pricing
    Lake Formation Permissions Access control management $0 (no charge)

    Additional Costs

    • AWS Glue – Orchestration costs for data catalog management.
    • Amazon EventBridge – Event routing for subscriber notifications.
    • AWS Lambda – Custom processing functions.
    • Amazon SQS/SNS – Subscriber notification delivery.
    • Amazon Athena – Per-query charges for query access subscribers.
    • Data Transfer – Cross-Region replication for rollup Regions.

    Cost Optimization

    • Security Lake can offset existing costs by replacing duplicate CloudTrail trails or individual VPC Flow Log configurations.
    • Use automated storage tiering to move older data to S3 Glacier.
    • Carefully evaluate enabling CloudTrail S3 Data Events and WAF logs – these high-volume sources can significantly impact costs.
    • A 15-day free trial is available with full feature access and a usage estimation tab in the console.

    Security Lake vs. CloudWatch Logs vs. S3 Manual Aggregation

    Feature AWS Security Lake CloudWatch Logs S3 Manual Aggregation
    Purpose Centralized security data lake Operational log monitoring Custom data lake (DIY)
    Data Normalization Automatic OCSF normalization No normalization (raw logs) Manual ETL required
    Schema OCSF (standardized, open-source) Source-specific formats Custom schema (self-managed)
    Storage Format Apache Parquet + Iceberg tables CloudWatch proprietary format Any format (JSON, CSV, Parquet)
    Multi-Account Built-in via Organizations Cross-account log subscriptions Custom cross-account S3 policies
    Multi-Region Rollup Regions (built-in) Per-Region (no native aggregation) Custom S3 replication rules
    Access Control Lake Formation (fine-grained) IAM policies + Log Groups S3 bucket policies + IAM
    Query Engine Athena, OpenSearch, Redshift Spectrum CloudWatch Logs Insights Athena, custom tools
    SIEM Integration Native subscriber model Log subscriptions to Kinesis/Lambda Custom integration required
    Retention Management Automated tiering + custom retention Log group retention policies S3 Lifecycle policies (manual)
    Setup Complexity Low (managed service) Low (per-service) High (custom infrastructure)
    Cost Model Per-GB ingestion + normalization + S3 Per-GB ingestion + storage + queries S3 + Glue + Athena + custom ETL
    Best For Security analytics, SIEM feeding, compliance Real-time operational monitoring Full customization, non-security data lakes

    When to Use Each

    • Security Lake – When you need centralized, normalized security data across multiple accounts/Regions for threat detection, incident response, and SIEM integration.
    • CloudWatch Logs – When you need real-time operational monitoring, metric-based alarms, and log analysis for application debugging.
    • S3 Manual Aggregation – When you have custom requirements, non-security data, or need complete control over the ETL pipeline and schema design.
    • These solutions are complementary, not mutually exclusive – many organizations use CloudWatch Logs for real-time operations while using Security Lake for security analytics and long-term retention.

    AWS Certification Relevance (SCS-C02)

    • Security Lake is highly relevant for the AWS Certified Security – Specialty (SCS-C02) exam.
    • Key exam domains where Security Lake appears:
      • Domain 2: Security Logging and Monitoring – Centralized log management, log aggregation across accounts/Regions, OCSF normalization.
      • Domain 1: Threat Detection and Incident Response – SIEM integration, threat detection workflows, subscriber model for security tools.
      • Domain 6: Management and Security Governance – Multi-account security management, Organizations integration, delegated administrator.
    • Key concepts to understand for the exam:
      • How Security Lake differs from CloudWatch Logs and CloudTrail Lake
      • The subscriber model (data access vs. query access)
      • OCSF as the normalization standard
      • Cross-account and cross-Region data aggregation
      • Lake Formation for access control
      • Integration with Security Hub and GuardDuty

    AWS Security Lake Practice Questions

    1. A security team needs to centralize security logs from 50 AWS accounts across 4 Regions into a single data lake for their SIEM tool. The solution must normalize data from VPC Flow Logs, CloudTrail, GuardDuty findings, and third-party endpoint agents into a common schema. Which solution meets these requirements with the LEAST operational overhead?
      1. Create a centralized S3 bucket with cross-account bucket policies and use AWS Glue ETL jobs to normalize all log formats
      2. Enable Amazon Security Lake with AWS Organizations, configure rollup Regions, and use the OCSF schema for normalization
      3. Set up CloudWatch Logs cross-account subscriptions with Kinesis Data Firehose to deliver to a centralized S3 bucket
      4. Deploy AWS CloudTrail Lake with organization-wide event data stores in each Region
      Show Answer

      Answer: B –

      Explanation: Security Lake is purpose-built for this use case – it natively integrates with Organizations for multi-account collection, supports rollup Regions for cross-Region aggregation, automatically normalizes AWS sources to OCSF, and provides a subscriber model for SIEM tools. Third-party sources can also be ingested in OCSF format. Options A and C require significant custom engineering. Option D only covers CloudTrail events, not VPC Flow Logs or third-party sources.

    2. A company uses Amazon Security Lake and wants their Splunk deployment to ingest new security events as soon as they arrive. The Splunk instance runs in a separate AWS account. Which subscriber configuration should be used?
      1. Create a query access subscriber and configure Splunk to run periodic Athena queries
      2. Create a data access subscriber with SQS queue notification and provide the Splunk account credentials
      3. Share the S3 bucket directly with the Splunk account using a bucket policy
      4. Configure CloudWatch Logs subscription filters to forward to the Splunk account
      Show Answer

      Answer: B –

      Explanation: For SIEM tools like Splunk that need to ingest raw data as it arrives, a data access subscriber with SQS notification is the correct approach. Splunk polls the SQS queue for new object notifications and ingests the Parquet files from S3. AWS Resource Access Manager handles cross-account S3 access. Option A (query access) is for in-place querying, not data ingestion. Options C and D bypass Security Lake’s managed subscriber model.

    3. An organization enabled Security Lake but is concerned about costs. They notice that CloudTrail S3 Data Events and WAF logs account for 80% of their bill. What is the MOST cost-effective approach while maintaining security visibility?
      1. Disable Security Lake entirely and use CloudWatch Logs instead
      2. Remove CloudTrail S3 Data Events and WAF from Security Lake sources, and selectively enable them only for critical accounts or buckets
      3. Move all data to S3 Glacier immediately after ingestion
      4. Switch all subscribers from data access to query access
      Show Answer

      Answer: B –

      Explanation: CloudTrail S3 Data Events and WAF logs are high-volume sources that are NOT enabled by default in Security Lake for this exact reason. The recommended approach is to selectively enable these sources only where critical visibility is needed. Disabling Security Lake entirely (A) loses all centralized security data. Moving to Glacier immediately (C) makes data unavailable for real-time analysis. Subscriber type (D) doesn’t affect ingestion costs.

    4. A security analyst with query access to Security Lake needs to investigate suspicious network traffic from a specific source IP across all Regions. Security Lake is enabled in 3 Regions with a rollup Region configured. How should the analyst run this investigation?
      1. Run separate Athena queries in each of the 3 contributing Regions
      2. Query the rollup Region using Amazon Athena, which contains consolidated data from all contributing Regions
      3. Use CloudWatch Logs Insights to search across all Regions simultaneously
      4. Create a new subscriber in each Region and aggregate results manually
      Show Answer

      Answer: B –

      Explanation: Rollup Regions consolidate data from contributing Regions into a central location. The analyst only needs to query the rollup Region using Athena to search across all Regional data. This eliminates the need for separate queries in each Region. Note that a query access subscriber can only query data in the Region where it was created, so querying the rollup Region provides the consolidated view.

    5. A company wants to provide their managed security service provider (MSSP) access to Security Lake data. The MSSP needs to run custom threat hunting queries using Amazon Athena but should only see VPC Flow Logs and GuardDuty findings – not CloudTrail events. Which approach provides the required access with least privilege?
      1. Create a data access subscriber for the MSSP and filter notifications to only include VPC Flow Logs and GuardDuty
      2. Create a query access subscriber for the MSSP, specifying only VPC Flow Logs and Security Hub (GuardDuty findings) as authorized sources, with Lake Formation permissions
      3. Share the entire S3 bucket with the MSSP account and rely on IAM policies for filtering
      4. Export VPC Flow Logs and GuardDuty findings to a separate S3 bucket and share that with the MSSP
      Show Answer

      Answer: B –

      Explanation: A query access subscriber with specific source authorization is the correct approach. When creating a subscriber, you specify which log and event sources the subscriber can access. Lake Formation provides fine-grained access control to the specific tables. The MSSP uses Athena to query in place without data duplication. Option A (data access) would send raw data rather than enabling Athena queries. Options C and D bypass Security Lake’s managed access control model.

    Frequently Asked Questions

    What is AWS Security Lake?

    AWS Security Lake automatically centralizes security data from AWS services, SaaS providers, and custom sources into a purpose-built data lake in your account. It normalizes data to the Open Cybersecurity Schema Framework (OCSF) and stores it as Apache Iceberg tables.

    How does Security Lake differ from CloudWatch Logs?

    CloudWatch Logs stores operational logs for monitoring and alerting. Security Lake normalizes security-specific data to OCSF format for long-term storage, cross-account aggregation, and integration with SIEM/analytics tools like Splunk and Datadog.

    What data sources does Security Lake support?

    Native sources include CloudTrail, VPC Flow Logs, Route 53 DNS, Security Hub findings, Lambda, EKS audit logs, WAF, and S3 data events. It also supports custom sources via OCSF-formatted Parquet files and third-party integrations.

    Related Posts

    References