Google Gemini API & AI Studio – Developer Guide

• Google Gemini is Google’s family of multimodal AI models that can process text, images, video, audio, and code.
• Gemini models are available through the Gemini Developer API (via Google AI Studio) and through Google Cloud’s Vertex AI (now Gemini Enterprise Agent Platform).
• Gemini 2.5 Pro and 2.5 Flash became generally available (GA) in June 2025, providing production-ready stability and scalability.
• The model family spans from Gemini 2.5 Pro (most capable) to Gemini Nano (on-device), covering cloud API, enterprise, and edge use cases.
• Gemini supports a 1M+ token context window, the largest among frontier models, enabling processing of entire codebases, long documents, and hours of video in a single prompt.

Gemini Model Family

• Gemini 2.5 Pro – Google’s most capable model for complex reasoning, coding, and multimodal tasks.
  • 1M token context window (input), up to 66K output tokens
  • Excels at coding, mathematical reasoning, scientific analysis, and multi-step problem solving
  • Supports “thinking” mode with configurable thinking budgets for chain-of-thought reasoning
  • Natively multimodal – processes text, images, audio, video, and PDFs
  • Supports function calling, structured output (JSON mode), grounding with Google Search, and code execution
  • GA since June 2025; model ID: gemini-2.5-pro
• Gemini 2.5 Flash – Hybrid reasoning model optimized for speed and cost-efficiency.
  • 1M token context window with thinking capabilities (first Flash model with thinking)
  • Configurable thinking budgets – control reasoning depth vs latency tradeoff
  • Excellent for production workloads needing fast responses at lower cost
  • Supports all Pro capabilities: multimodal input, function calling, grounding, JSON mode
  • ~4x cheaper than Pro for input tokens, ~4x cheaper for output tokens
  • GA since June 2025; model ID: gemini-2.5-flash
• Gemini 2.5 Flash-Lite – Most cost-efficient cloud model for high-volume tasks.
  • 1M token context window
  • Optimized for high-throughput, cost-sensitive workloads: classification, translation, simple data processing
  • Pricing starts at $0.10/1M input tokens and $0.40/1M output tokens
  • Supports grounding with Google Search and Google Maps
  • Model ID: gemini-2.5-flash-lite
• Gemini Nano – On-device model for Android and Chrome.
  • Runs natively on device hardware (NPU/GPU) without cloud connectivity
  • Available on Pixel 8 Pro, Pixel 9/10 series, Samsung Galaxy S24+ and later
  • Supports summarization, smart reply, proofreading, rewriting, and image description
  • Available in Chrome via the Prompt API (downloaded automatically with browser updates)
  • Privacy-preserving – all processing stays on device
  • Accessible via ML Kit GenAI APIs on Android and AICore
  • Supports hybrid inference – dynamically switches between on-device Nano and cloud-hosted Gemini models

Google AI Studio vs Vertex AI Studio

• Google AI Studio (aistudio.google.com) – Free, web-based IDE for prototyping with Gemini.
  • Quick experimentation with prompts, no Google Cloud account required
  • Get an API key instantly for development
  • Supports prompt testing, side-by-side model comparison, and code export
  • Build mode for vibe-coding full-stack applications directly in the browser
  • One-click deployment to Google Cloud Run (up to 2 apps free via Starter Tier)
  • Free tier available with generous rate limits
  • Content on free tier may be used to improve Google products
  • Best for: rapid prototyping, learning, hackathons, individual developers
• Vertex AI Studio / Gemini Enterprise Agent Platform (Google Cloud Console) – Enterprise-grade AI platform.
  • Requires Google Cloud project with billing enabled
  • Full IAM, VPC, audit logging, and enterprise security controls
  • Model fine-tuning (SFT), RAG Engine, model evaluation, and ML pipelines
  • Access to Model Garden with 200+ models (not just Gemini)
  • Provisioned throughput for guaranteed capacity
  • Data residency and compliance (HIPAA, SOC 2, FedRAMP)
  • Agent Builder for no-code conversational agent development
  • Content is never used to improve Google products
  • Best for: production enterprise deployments, regulated industries, multi-model workflows

Gemini API Capabilities

Multimodal Input & Output

• Text – Natural language understanding, generation, summarization, translation, and Q&A
• Images – Image understanding (describe, analyze, OCR) and native image generation (Gemini 2.5 Flash Image)
• Video – Process and understand video content up to hours in length; video generation via Veo models
• Audio – Audio understanding, speech-to-text, native audio output, and text-to-speech (TTS)
• Code – Code generation, debugging, explanation, refactoring across 20+ programming languages
• Documents/PDFs – Process entire PDF documents natively with layout understanding

Function Calling

• Connect Gemini to external tools, APIs, and databases
• Model determines when to call a function and provides structured parameters
• Supports parallel function calling (multiple functions in one turn)
• Automatic function calling mode available in SDKs
• Gemini 3+ models generate unique IDs for each function call for tracing
• Works with both Google AI Studio and Vertex AI endpoints

Grounding with Google Search

• Connects Gemini to real-time, publicly available web content
• Provides accurate, up-to-date answers with cited verifiable sources beyond model’s training cutoff
• Returns grounding metadata with source URLs and support chunks
• Supports dynamic retrieval – only charges when grounding actually contributes to response
• Works with all available languages
• Rate limits: Free tier gets 500 RPD (requests per day); Paid tier gets 1,500 RPD free then $35/1,000 grounded prompts
• Limit of 1M queries per day (contact support for higher)
• Respects robots.txt Google-Extended directives from web publishers

Structured Output (JSON Mode)

• Force Gemini to output valid JSON conforming to a provided schema
• Specify response schema using JSON Schema format
• Guarantees parseable output for programmatic consumption
• Supports enums, nested objects, arrays, and optional fields
• Set response_mime_type: "application/json" in generation config

System Instructions

• Set persistent behavioral guidelines that apply across all turns in a conversation
• Define persona, tone, output format, safety constraints, and domain expertise
• System instructions are separate from user messages and persist throughout the session
• Supports multi-part system instructions for complex configurations

Context Caching

• Cache large input contexts (documents, code repos) and reuse across multiple requests
• Reduces latency and cost for repeated context (up to 90% cheaper for cached tokens)
• Minimum cache size: 32,768 tokens
• Storage price: $1.00–$4.50 per 1M tokens per hour depending on model
• Available on paid tier only

Additional Capabilities

• Code Execution – Model can write and run Python code in a sandboxed environment to solve problems
• URL Context – Fetch and process content from URLs as part of the prompt
• Computer Use – Build browser control agents that automate tasks (Preview)
• File Search – Upload documents and perform semantic search across them
• Live API – Real-time, low-latency bidirectional streaming for voice/video applications
• Batch API – Process large volumes asynchronously at 50% cost reduction
• Thinking/Reasoning – Configurable chain-of-thought with thinking budgets and thought signatures

Context Window – 1M+ Tokens

• Gemini 2.5 Pro and Flash support a 1,000,000 token context window
• This is equivalent to approximately:
  • ~750,000 words (longer than the entire Lord of the Rings trilogy)
  • ~1.5 hours of video
  • ~11 hours of audio
  • ~30,000 lines of code
• Enables processing entire codebases, lengthy legal documents, research papers, or video content in a single prompt
• Output token limits: up to 66K for Pro, 65K for Flash
• Pricing tiers differ based on prompt length (≤200K tokens vs >200K tokens for Pro)
• Context caching available to reduce costs for repeated large-context queries

Gemini in Google Cloud (Vertex AI / Gemini Enterprise Agent Platform)

• Gemini models are available through Google Cloud’s enterprise AI platform (formerly Vertex AI, now Gemini Enterprise Agent Platform as of Cloud Next 2026)
• Provides enterprise-grade features beyond the Developer API:
  • Fine-tuning (SFT) – Supervised fine-tuning on custom datasets
  • RAG Engine – Built-in Retrieval-Augmented Generation with managed vector stores
  • Model Evaluation – Automated evaluation pipelines with custom metrics
  • Provisioned Throughput – Guaranteed capacity for latency-sensitive applications
  • VPC Service Controls – Network isolation and data exfiltration prevention
  • CMEK – Customer-managed encryption keys for data at rest
  • Agent Builder – No-code platform for building conversational agents with grounding
• Same Gemini models as the Developer API but with enterprise SLAs and compliance certifications
• Supports HIPAA, SOC 1/2/3, ISO 27001, FedRAMP, PCI DSS compliance
• Data is never used to train or improve Google models
• Pricing may differ from Developer API; check Gemini Enterprise Agent Platform pricing page

Gemini Code Assist (IDE Integration)

• AI-powered coding assistant integrated directly into IDEs (VS Code and JetBrains IDEs)
• Key Capabilities:
  • Inline code completions while typing
  • Code generation from natural language prompts and comments
  • Code transformation and refactoring via chat
  • Smart actions (explain code, generate tests, fix bugs)
  • Full-project context awareness with file/folder specification
  • Agent mode for multi-step autonomous coding tasks (since Oct 2025)
  • Custom commands and rules configuration
  • Source citations for generated code
• Editions:
  • Free tier – Available for individual developers via Google AI (Individual, Pro, Ultra tiers since June 2026)
  • Standard – For teams, includes features beyond the IDE
  • Enterprise – Large-context analysis (up to 1M tokens) across indexed repositories, integration with Google Cloud services, code customization
• Enterprise edition integrates with Google Cloud services: Cloud Build, Cloud Run, Cloud Logging
• Supports large-context analysis across entire repositories

Pricing Tiers (Free vs Paid)

Free Tier

• Available through Google AI Studio – no billing account required
• Access to Gemini 2.5 Pro, 2.5 Flash, and Flash-Lite models
• Free input and output tokens within rate limits
• Grounding with Google Search: up to 500 RPD (Flash/Flash-Lite)
• Content may be used to improve Google products
• Lower rate limits (5–15 RPM depending on model)
• No access to context caching, Batch API, or some advanced features

Paid Tier

• Link a billing account and prepay minimum $10 to upgrade
• Higher rate limits (150–300+ RPM at Tier 1)
• Access to context caching, Batch API (50% cost reduction), Flex and Priority inference
• Content NOT used to improve Google products (enterprise-grade data privacy)
• Tiered system based on cumulative spend: Tier 1 → Tier 2 → Tier 3 (postpay option)

Key Pricing (per 1M tokens, Standard tier)

• Gemini 2.5 Pro: $1.25 input (≤200K) / $2.50 (>200K) | $10.00 output (≤200K) / $15.00 (>200K)
• Gemini 2.5 Flash: $0.30 input (text/image/video) | $2.50 output
• Gemini 2.5 Flash-Lite: $0.10 input (text/image/video) | $0.40 output
• Grounding with Google Search: 1,500 RPD free, then $35/1,000 grounded prompts (2.5 models)
• Batch API: 50% discount on standard pricing across all models
• Context Caching: ~10% of input price per cached token read + storage fee per hour

Enterprise Tier (Gemini Enterprise Agent Platform)

• Custom pricing based on usage volume
• Dedicated support channels, advanced security, compliance certifications
• Provisioned throughput and volume-based discounts
• Contact Google Cloud sales for pricing

Rate Limits

• Rate limits are determined at the billing account level and vary by tier and model
• Free Tier:
  • Gemini 2.5 Pro: ~5 RPM (requests per minute)
  • Gemini 2.5 Flash: ~15 RPM
  • Gemini 2.5 Flash-Lite: ~15 RPM
  • Up to 250,000 tokens per minute
  • Up to 1,000 requests per day
• Paid Tier 1:
  • 150–300 RPM depending on model
  • Higher token per minute limits
  • Higher daily request limits
• Paid Tier 2–3: Progressively higher limits based on cumulative spend and account age
• Rate limit dimensions: RPM (requests/minute), TPM (tokens/minute), RPD (requests/day)
• Grounding with Google Search: 500 RPD (free) / 1,500 RPD free then pay-per-use (paid)
• Exceeding limits returns HTTP 429 (Resource Exhausted) – implement exponential backoff

Safety Settings

• Gemini API includes configurable content safety filters across multiple harm categories
• Harm Categories:
  • HARM_CATEGORY_HARASSMENT – Harassment and bullying content
  • HARM_CATEGORY_HATE_SPEECH – Hate speech targeting protected groups
  • HARM_CATEGORY_SEXUALLY_EXPLICIT – Sexual content
  • HARM_CATEGORY_DANGEROUS_CONTENT – Dangerous or harmful activities
  • HARM_CATEGORY_CIVIC_INTEGRITY – Election/civic misinformation
• Blocking Thresholds:
  • BLOCK_NONE – No blocking (may still have some restrictions)
  • BLOCK_ONLY_HIGH – Block only high-probability unsafe content
  • BLOCK_MEDIUM_AND_ABOVE – Block medium and high (default)
  • BLOCK_LOW_AND_ABOVE – Most restrictive setting
• Safety ratings are provided for each response with probability levels: HIGH, MEDIUM, LOW, NEGLIGIBLE
• Filters are configurable (default off for paid tier) – can be adjusted per request
• System instructions can add additional safety guardrails on top of content filters
• Image generation has additional responsible AI filters (no violent extremism, no CSAM, no non-consensual imagery)

Comparison: Gemini vs OpenAI GPT vs Anthropic Claude

• All three platforms (Gemini, GPT, Claude) offer near-parity on general reasoning and coding benchmarks as of 2026
• Context Window:
  • Gemini 2.5 Pro: 1,000,000 tokens (largest)
  • Claude Opus 4: 200,000 tokens
  • GPT-4o / GPT-5: 128,000–256,000 tokens
• Multimodal:
  • Gemini: Native multimodal (text, image, video, audio, code, PDF) – strongest video/audio understanding
  • GPT-4o: Text, image, audio (limited video)
  • Claude: Text, image (no native audio/video)
• Coding:
  • Claude Opus dominates SWE-bench Verified (~80-88% scores) – best for complex agentic coding
  • Gemini 2.5 Pro: Strong coding with unique large-context advantage for full-repo understanding
  • GPT-5: Strong general coding with excellent structured output
• Pricing (per 1M tokens, approximate):
  • Gemini 2.5 Pro: $1.25 / $10.00 (input/output)
  • Claude Opus 4: $5.00 / $25.00 (input/output)
  • GPT-4o: $2.50 / $10.00 (input/output)
  • Gemini 2.5 Flash: $0.30 / $2.50 – significantly cheaper than competitors’ mid-tier models
• Unique Strengths:
  • Gemini: Largest context window, best multimodal (especially video/audio), native Google Search grounding, most cost-efficient at scale
  • Claude: Best coding assistant, strongest safety/alignment, excellent for agentic multi-step tasks
  • GPT: Strongest general reasoning and math, best ecosystem/plugin support, excellent structured output
• Integration:
  • Gemini: Google Cloud, Android, Chrome, Google Workspace
  • GPT: Azure OpenAI, Microsoft ecosystem
  • Claude: AWS Bedrock, direct API

When to Use Which Gemini Model Size

• Use Gemini 2.5 Pro when:
  • Complex multi-step reasoning is required
  • Processing very large codebases or documents (full-repo analysis)
  • Highest quality output is more important than cost/latency
  • Advanced coding tasks: architecture decisions, complex refactoring, multi-file changes
  • Scientific research, mathematical proofs, legal analysis
• Use Gemini 2.5 Flash when:
  • Production applications needing balance of quality and speed
  • Real-time user-facing applications (chatbots, assistants)
  • Tasks requiring reasoning but with latency constraints
  • General-purpose coding assistance, summarization, Q&A
  • Budget-conscious applications that still need thinking capabilities
• Use Gemini 2.5 Flash-Lite when:
  • High-volume, cost-sensitive workloads at scale
  • Simple classification, entity extraction, sentiment analysis
  • Translation and localization tasks
  • Data processing pipelines with thousands of requests
  • Tasks where speed and cost matter more than reasoning depth
• Use Gemini Nano when:
  • On-device processing with no internet connectivity
  • Privacy-sensitive applications (data never leaves device)
  • Low-latency responses on mobile devices
  • Smart replies, text summarization, image descriptions on Android
  • Hybrid inference (Nano for simple queries, cloud for complex ones)

Google Gemini API & AI Studio – Practice Questions

1. A developer needs to build a prototype chatbot using Gemini models with no Google Cloud account setup. Which service should they use?
   • A. Vertex AI Studio
   • B. Google AI Studio
   • C. Cloud Run
   • D. Firebase ML
   Show Answer

   Answer: B – Google AI Studio provides free access to Gemini models for prototyping without requiring a GCP account.

2. Which Gemini model offers the largest context window for processing entire codebases in a single prompt?
   • A. Gemini Nano
   • B. Gemini 2.5 Flash-Lite
   • C. Gemini 2.5 Pro
   • D. GPT-4o
   Show Answer

   Answer: C – Gemini 2.5 Pro supports a 1M token context window, the largest among frontier models.

3. A company requires enterprise security controls, HIPAA compliance, and fine-tuning capabilities for their Gemini deployment. Which platform should they choose?
   • A. Google AI Studio Free Tier
   • B. Google AI Studio Paid Tier
   • C. Gemini Enterprise Agent Platform (Vertex AI)
   • D. Gemini Code Assist
   Show Answer

   Answer: C – Gemini Enterprise Agent Platform provides enterprise security, compliance, fine-tuning, and VPC controls.

4. Which Gemini API feature allows the model to access real-time information beyond its training data cutoff?
   • A. Function Calling
   • B. Context Caching
   • C. Grounding with Google Search
   • D. System Instructions
   Show Answer

   Answer: C – Grounding with Google Search connects Gemini to real-time web content and provides cited sources.

5. A mobile app developer needs AI summarization that works offline on Android devices with no data leaving the device. Which model is appropriate?
   • A. Gemini 2.5 Flash via API
   • B. Gemini 2.5 Pro via Vertex AI
   • C. Gemini Nano via ML Kit GenAI APIs
   • D. Gemini 2.5 Flash-Lite via Batch API
   Show Answer

   Answer: C – Gemini Nano runs on-device without cloud connectivity, providing privacy-preserving AI processing.

6. Which configuration ensures Gemini API always returns valid JSON that conforms to a specific schema? (Select TWO)
   • A. Set response_mime_type to “application/json”
   • B. Include a JSON example in the prompt
   • C. Provide a response_schema in the generation config
   • D. Use grounding with Google Search
   • E. Enable function calling
   Show Answer

   Answer: A, C – Setting response_mime_type to “application/json” and providing a response_schema guarantees structured JSON output.

7. A startup wants to minimize API costs while processing 100,000 classification requests daily. Which combination offers the lowest cost?
   • A. Gemini 2.5 Pro with Standard inference
   • B. Gemini 2.5 Flash with Priority inference
   • C. Gemini 2.5 Flash-Lite with Batch API
   • D. Gemini 2.5 Flash with context caching
   Show Answer

   Answer: C – Flash-Lite ($0.10/$0.40) with Batch API (50% discount) gives the lowest cost for high-volume simple tasks.

8. What is the primary difference between the Free and Paid tiers of the Gemini Developer API regarding data usage?
   • A. Free tier has no rate limits; Paid tier has rate limits
   • B. Free tier content may be used to improve Google products; Paid tier content is not used
   • C. Free tier only supports text; Paid tier supports multimodal
   • D. Free tier uses older models; Paid tier uses newer models
   Show Answer

   Answer: B – Free tier content may be used to improve Google products, while paid tier provides enterprise-grade data privacy.

9. Which safety setting category in the Gemini API is used to filter content related to election misinformation?
   • A. HARM_CATEGORY_HARASSMENT
   • B. HARM_CATEGORY_HATE_SPEECH
   • C. HARM_CATEGORY_CIVIC_INTEGRITY
   • D. HARM_CATEGORY_DANGEROUS_CONTENT
   Show Answer

   Answer: C – HARM_CATEGORY_CIVIC_INTEGRITY covers election and civic misinformation content.

10. A developer is hitting rate limits (HTTP 429) on the free tier of Gemini API. What are valid options to increase throughput? (Select TWO)
    • A. Implement exponential backoff retry logic
    • B. Upgrade to paid tier by linking a billing account
    • C. Switch from Pro to Nano model
    • D. Disable safety settings
    • E. Use system instructions to request faster processing
    Show Answer

    Answer: A, B – Exponential backoff handles transient limits; upgrading to paid tier increases RPM from 5-15 to 150-300+.

References

• Gemini API Documentation
• Gemini API Pricing
• Gemini Models Overview
• Gemini API Rate Limits
• Gemini Safety Settings
• Gemini Code Assist Overview
• Gemini 2.5 Pro on Vertex AI
• Gemini Nano – ML Kit GenAI APIs

AWS S3 vs EFS vs FSx – Storage Service Comparison

Overview

AWS offers multiple storage services designed for different workloads. Amazon S3 provides object storage accessed via API, Amazon EFS delivers managed NFS file storage, and the Amazon FSx family offers four purpose-built file systems (Lustre, Windows File Server, NetApp ONTAP, and OpenZFS). Choosing the right storage service depends on access patterns, performance requirements, protocol needs, and cost considerations.

Amazon S3 – Object Storage

• Amazon S3 is a highly durable object storage service with a simple key-value design for storing any amount of data.
• Accessed via REST API (PUT, GET, DELETE) — not a file system by default.
• Provides 11 9’s (99.999999999%) durability by replicating data across at least 3 AZs.
• Offers unlimited storage — stores over 500 trillion objects across hundreds of exabytes (as of 2026).
• Supports multiple storage classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Express One Zone, Glacier Instant Retrieval, Glacier Flexible Retrieval, and Glacier Deep Archive.
• S3 Express One Zone provides single-digit millisecond latency with 10x faster access than S3 Standard.
• 🆕 S3 Files (April 2026) — enables mounting S3 buckets as NFS v4.2 file systems on EC2, Lambda, EKS, and ECS with ~1ms latency and POSIX semantics.
• 🆕 S3 Access Points for FSx — allows accessing FSx for NetApp ONTAP and FSx for OpenZFS data via the S3 API without copying data.
• Best for: data lakes, backups, static website hosting, archive, big data analytics, content distribution.

Amazon EFS – Elastic File System

• Amazon EFS is a fully managed, elastic NFS file system for Linux-based workloads.
• Accessed via NFS v4.0/v4.1 protocol — mount as a standard file system on EC2, ECS, EKS, Lambda, and on-premises servers.
• Provides Regional (Multi-AZ) durability by replicating data across multiple AZs, or One Zone for lower-cost single-AZ storage.
• Elastic scaling — grows and shrinks automatically with no provisioning required. Pay only for storage used.
• Supports up to 60 GiB/s read throughput, 2.5 million read IOPS, and 500,000 write IOPS (2024 enhancements).
• Three storage classes: EFS Standard ($0.30/GB-month, sub-ms latency), EFS Infrequent Access ($0.016/GB-month), and EFS Archive ($0.008/GB-month — up to 97% lower than Standard).
• Supports Lifecycle Management to automatically tier data between Standard, IA, and Archive based on access patterns.
• Supports up to 10,000 access points per file system for multi-tenant and containerized applications.
• Best for: shared home directories, CMS, development environments, containerized applications, machine learning training data.

Amazon FSx Family

FSx for Lustre

• Fully managed high-performance parallel file system based on open-source Lustre.
• Delivers sub-millisecond latency, up to 1,000 GB/s throughput, and millions of IOPS.
• Uses a custom POSIX-compliant protocol optimized for performance (Linux clients only).
• Native S3 integration via Data Repository Associations (DRA) — automatically imports/exports data between FSx and S3.
• Deployment types: Persistent (long-term storage with data replicated within AZ) and Scratch (temporary high-burst workloads, no replication).
• Storage options: SSD, HDD, and Intelligent-Tiering (elastic, starting at $0.004/GB-month for Archive tier).
• Best for: HPC, machine learning training, financial modeling, genomics, video rendering, EDA.

FSx for Windows File Server

• Fully managed Windows-native file system built on Windows Server with full SMB protocol support.
• Accessed via SMB 2.0/2.1/3.0/3.1.1 protocol — supports Windows, Linux, and macOS clients.
• Integrates with Microsoft Active Directory for authentication and Windows ACLs for access control.
• Supports Multi-AZ deployment for 99.99% availability with automatic failover.
• Up to 20 GB/s throughput and hundreds of thousands of IOPS per file system.
• Maximum file system size: 64 TiB.
• Supports DFS Namespaces, DFS Replication, shadow copies, user quotas, and data deduplication.
• Best for: Windows application workloads, home directories, .NET applications, SQL Server, SharePoint, IIS.

FSx for NetApp ONTAP

• Fully managed NetApp ONTAP file system providing enterprise-grade multi-protocol storage.
• Supports NFS, SMB, and iSCSI protocols simultaneously — the only FSx option with block storage (iSCSI).
• Up to 72-80 GB/s throughput and millions of IOPS with virtually unlimited storage (tens of PBs).
• Automatic storage tiering moves cold data to lower-cost capacity pool storage.
• Supports Multi-AZ deployment (99.99% SLA), snapshots, cloning, SnapMirror replication, and FlexCache.
• Integrates with Active Directory for SMB access and supports NFS ACLs.
• 🆕 S3 Access Points (2025) — access file data stored in ONTAP volumes via the S3 API for AI/analytics workloads without data movement.
• Best for: enterprise NAS migration, multi-protocol workloads, Oracle/SAP, DevOps (cloning), hybrid cloud.

FSx for OpenZFS

• Fully managed OpenZFS file system optimized for low-latency workloads.
• Accessed via NFS v3/v4.0/v4.1/v4.2 — supports Linux, Windows, and macOS clients.
• Delivers sub-0.5ms latency, up to 21 GB/s throughput (cached) / 10 GB/s (disk), and up to 2 million IOPS.
• Maximum file system size: 512 TiB.
• Supports instant snapshots, data cloning (space-efficient copies), and point-in-time recovery.
• Supports Multi-AZ deployment (99.99% SLA) and Single-AZ (99.5% SLA).
• 🆕 S3 Access Points (June 2025) — access OpenZFS file data via S3 API.
• Best for: development/test (fast cloning), Linux workloads migrating from on-premises ZFS, databases, CI/CD pipelines.

Access Patterns Comparison

Performance Tiers Comparison

Pricing Model Comparison

Key Pricing Insights:

• S3 is the cheapest for raw storage ($0.023/GB) but charges per API request — ideal for infrequent access or bulk data.
• EFS is the most expensive per GB ($0.30) but offers elastic scaling with no provisioning — use Lifecycle policies to move data to IA/Archive for savings.
• FSx for Lustre Intelligent-Tiering starts at $0.004/GB-month for archive data — lowest-cost managed Lustre option.
• FSx for NetApp ONTAP automatic tiering to capacity pool ($0.0125/GB) provides significant savings for mixed workloads.
• FSx for Windows HDD at $0.013/GB-month is cost-effective for large Windows file shares with infrequent access.

Durability and Availability

Encryption

Access Control

Use Cases – When to Use Which

EFS vs EBS Multi-Attach

Both EFS and EBS Multi-Attach provide shared storage across multiple EC2 instances, but they are fundamentally different:

Exam Tip: Choose EFS when you need a simple shared file system across multiple instances and AZs. Choose EBS Multi-Attach only for specialized clustered applications (Oracle RAC, clustered databases) that require block-level access with application-managed I/O coordination within a single AZ.

FSx for Lustre with S3 Integration

FSx for Lustre provides native, bi-directional integration with Amazon S3 through Data Repository Associations (DRA):

• Automatic Import: When a client accesses a file, FSx for Lustre automatically imports the file metadata (and optionally data) from the linked S3 bucket. New/changed objects in S3 are automatically reflected in the file system.
• Automatic Export: New or modified files in the FSx file system are automatically exported back to the linked S3 bucket, keeping S3 as the durable long-term store.
• Lazy Loading: Only metadata is loaded initially; actual file data is fetched from S3 on first access (lazy load) or can be preloaded using hsm_restore.
• Data Tiering: With Intelligent-Tiering storage class, infrequently accessed data is automatically tiered to S3 (IA and Archive tiers) while maintaining file system visibility.
• Multiple DRAs: A single file system can be linked to multiple S3 buckets/prefixes, enabling consolidated access to distributed datasets.
• Cross-Account Access: FSx for Lustre can be linked to S3 buckets in different AWS accounts for shared data access.

Architecture Pattern — HPC/ML with S3 Data Lake:

• Store raw data durably in S3 (lowest cost, 11 9’s durability).
• Create a FSx for Lustre file system linked to the S3 bucket via DRA.
• Compute instances mount FSx for Lustre and process data at hundreds of GB/s throughput.
• Results are automatically exported back to S3.
• Delete the FSx file system after processing to save costs (scratch deployments).

Exam Tip: When a question mentions HPC or ML workloads that need to process data stored in S3 with high throughput and POSIX file system access, FSx for Lustre with DRA is the answer. FSx for Lustre acts as a high-speed processing layer on top of S3.

Detailed Comparison Table – All Storage Types

AWS Certification Exam Relevance

• SAA-C03 (Solutions Architect Associate): Frequently tests storage service selection based on access patterns, performance needs, cost optimization, and durability requirements. Know when to choose S3 vs EFS vs FSx.
• SAP-C02 (Solutions Architect Professional): Tests complex architectures combining S3 data lakes with FSx for Lustre processing, hybrid storage with ONTAP, and multi-protocol requirements.
• DEA-C01 (Data Engineer Associate): Tests FSx for Lustre with S3 integration for ETL pipelines, data lake architectures, and high-performance analytics.
• Key Exam Themes:
  • S3 = object storage, unlimited, cheapest, API access, data lake.
  • EFS = shared NFS file system, elastic, Linux, multi-AZ, POSIX.
  • FSx for Lustre = HPC, ML, highest throughput, S3 integration, Linux only.
  • FSx for Windows = Windows workloads, SMB, Active Directory, NTFS ACLs.
  • FSx for NetApp ONTAP = multi-protocol (NFS+SMB+iSCSI), enterprise NAS, auto-tiering.
  • FSx for OpenZFS = lowest latency, instant clones, dev/test, Linux NFS migration.
  • EBS Multi-Attach ≠ EFS — block vs file, single-AZ vs multi-AZ, requires cluster-aware FS.

AWS Certification Exam Practice Questions

• Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
• AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
• AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
• Open to further feedback, discussion and correction.

1. A genomics research company stores 500 TB of sequencing data in Amazon S3. Their HPC cluster needs to process this data with sub-millisecond latency and hundreds of GB/s throughput using a POSIX-compliant file system. The processed results must be stored back in S3 for long-term retention. Which solution meets these requirements with MINIMUM operational overhead?
   1. Copy data from S3 to Amazon EFS, process on EC2, copy results back to S3
   2. Create an FSx for Lustre file system with a Data Repository Association linked to the S3 bucket
   3. Mount S3 using S3 Files on the HPC cluster instances
   4. Use AWS DataSync to copy data from S3 to FSx for OpenZFS
   Show Answer

   Answer: b. – FSx for Lustre provides native S3 integration via Data Repository Associations, delivering sub-ms latency and up to 1,000 GB/s throughput. Data is automatically imported from and exported back to S3 without manual copy operations.

2. A company is migrating an on-premises Windows file server to AWS. The application requires SMB protocol access, Active Directory authentication, Windows ACLs, DFS Namespaces, and shadow copies for end-user file restore. Which AWS storage service should they use?
   1. Amazon EFS with Windows clients
   2. Amazon S3 with AWS Transfer Family
   3. Amazon FSx for Windows File Server
   4. Amazon FSx for NetApp ONTAP with SMB
   Show Answer

   Answer: c. – FSx for Windows File Server is purpose-built for Windows workloads with native SMB support, Active Directory integration, NTFS ACLs, DFS Namespaces, DFS Replication, and shadow copies. While FSx for NetApp ONTAP also supports SMB, it doesn’t provide native DFS Namespaces or Windows shadow copies.

3. A media company needs shared file storage accessible from both Linux-based video rendering instances (using NFS) and Windows-based editing workstations (using SMB) simultaneously. They also need automatic tiering of cold data to lower-cost storage. Which solution provides this capability with a SINGLE file system?
   1. Amazon EFS with SMB gateway
   2. Amazon FSx for Windows File Server with NFS
   3. Amazon S3 with Transfer Family for NFS and SMB
   4. Amazon FSx for NetApp ONTAP
   Show Answer

   Answer: d. – FSx for NetApp ONTAP is the only AWS file service that supports NFS, SMB, and iSCSI simultaneously on the same file system, with automatic storage tiering that moves cold data to a lower-cost capacity pool.

4. A development team wants to create multiple test environments by cloning a 10 TB production database file system. They need the clones to be created instantly without consuming additional storage for unchanged data. The file system uses NFS protocol on Linux. Which AWS service provides this capability MOST cost-effectively?
   1. Amazon EFS with AWS Backup restore
   2. Amazon FSx for Lustre with multiple file systems
   3. Amazon FSx for OpenZFS with instant cloning
   4. Amazon EBS snapshots with volume restore
   Show Answer

   Answer: c. – FSx for OpenZFS supports instant, space-efficient cloning using copy-on-write. Clones are created instantly regardless of data size and consume no additional storage for unchanged data. This is ideal for development/test environments.

5. A solutions architect needs to choose a storage solution for a containerized application running on Amazon EKS. The application requires shared persistent storage across multiple pods in different Availability Zones, POSIX file permissions, and automatic scaling without capacity planning. Which storage service is MOST appropriate?
   1. Amazon EBS with CSI driver
   2. Amazon S3 with CSI driver
   3. Amazon EFS with EFS CSI driver
   4. Amazon FSx for Lustre with CSI driver
   Show Answer

   Answer: c. – Amazon EFS provides multi-AZ shared file storage with POSIX permissions and elastic scaling (no capacity planning needed). The EFS CSI driver enables EKS pods to mount EFS as persistent volumes. EBS is single-AZ and cannot be shared across AZs; S3 is not a file system; FSx for Lustre requires capacity provisioning.

6. A company has a data pipeline where raw data lands in S3, needs high-performance file processing, and the results are used by AI services through the S3 API. They currently copy data between S3 and their file system, creating data duplication. Which AWS feature eliminates this data movement while allowing both file and S3 API access to the SAME data? (Select TWO)
   1. S3 Object Lambda
   2. FSx for Lustre Data Repository Association
   3. AWS DataSync with S3 as destination
   4. S3 Access Points for FSx for NetApp ONTAP
   5. S3 Transfer Acceleration
   Show Answer

   Answer: b, d – FSx for Lustre DRA provides automatic bi-directional sync between the file system and S3. S3 Access Points for FSx for NetApp ONTAP allow accessing file data stored in ONTAP volumes directly via the S3 API without copying data, enabling AI/analytics services to work with file data natively.

7. An organization needs to store compliance data for 7 years with the lowest possible storage cost. The data is written once and rarely accessed (less than once per year). Retrieval time of 12 hours is acceptable. Which storage option provides the LOWEST cost?
   1. Amazon EFS Archive storage class
   2. Amazon S3 Glacier Flexible Retrieval
   3. Amazon S3 Glacier Deep Archive
   4. Amazon FSx for Lustre Intelligent-Tiering Archive tier
   Show Answer

   Answer: c. – S3 Glacier Deep Archive is the lowest-cost storage in AWS at $0.00099/GB-month (~$1/TB/month) with 12-48 hour retrieval time, specifically designed for data retained 7+ years with rare access. EFS Archive ($0.008/GB) is 8x more expensive.

Related Posts

• AWS S3 vs EBS vs EFS
• AWS EFS vs EBS Multi-Attach
• AWS Elastic File Store – EFS
• AWS FSx for Lustre
• AWS FSx for Windows File Server
• AWS S3 Security
• AWS S3 Encryption
• AWS Storage & Content Delivery – Cheat Sheet

References

• Choosing an Amazon FSx File System
• When to Choose Amazon EFS
• Amazon S3 Overview
• Amazon EFS Pricing
• Amazon FSx for Lustre Pricing
• Amazon FSx for Windows File Server Pricing
• Amazon FSx for NetApp ONTAP Pricing
• Amazon FSx for OpenZFS Pricing
• S3 Access Points for Amazon FSx
• FSx for Lustre Data Repository Associations

AWS CloudFormation vs CDK vs Terraform – IaC Comparison

Infrastructure as Code (IaC) enables teams to define, provision, and manage cloud resources through machine-readable configuration files rather than manual console operations. The three dominant IaC tools for AWS are AWS CloudFormation, AWS CDK (Cloud Development Kit), and HashiCorp Terraform. Each takes a fundamentally different approach to solving the same problem — this post provides a comprehensive comparison to help you choose the right tool.

AWS CloudFormation Overview

• AWS CloudFormation is AWS’s native IaC service that provisions and manages AWS resources using declarative JSON or YAML templates.
• CloudFormation templates define the desired state of infrastructure — AWS handles the creation, update, and deletion of resources in the correct order.
• Resources are organized into Stacks, which are the unit of deployment, update, and deletion.
• CloudFormation supports 1,100+ AWS resource types and is tightly integrated with all AWS services.
• Key features include Change Sets (preview changes before applying), Drift Detection, StackSets (multi-account/multi-region deployments), and Nested Stacks.
• IaC Generator (launched Feb 2024) can scan existing AWS resources and generate CloudFormation templates or CDK apps automatically, eliminating weeks of manual effort for brownfield adoption.
• CloudFormation Language Extensions add transforms like AWS::LanguageExtensions for looping, conditionals, and JSON/YAML manipulation — reducing template verbosity.
• CloudFormation is free to use — you only pay for the AWS resources provisioned.

AWS CDK Overview

• AWS Cloud Development Kit (CDK) is an open-source framework that lets you define AWS infrastructure using familiar programming languages — TypeScript, JavaScript, Python, Java, C#/.NET, and Go.
• CDK synthesizes your code into CloudFormation templates, then deploys them via CloudFormation — it is an abstraction layer on top of CloudFormation, not a replacement.
• CDK uses a layered construct model:
  • L1 (Layer 1) Constructs — Direct 1:1 mapping to CloudFormation resources (prefixed with Cfn). Verbose but complete.
  • L2 (Layer 2) Constructs — Curated, high-level abstractions with sensible defaults, helper methods, and security best practices built in. Reduce boilerplate significantly.
  • L3 (Layer 3) Constructs / Patterns — Opinionated combinations of multiple resources solving specific use cases (e.g., ApplicationLoadBalancedFargateService).
• CDK v2 consolidates all stable constructs into a single package (aws-cdk-lib), simplifying dependency management.
• CDK Mixins (2026) — Composable abstractions that decouple capabilities from monolithic L2 constructs, allowing you to compose exactly the features you need.
• CDK Refactor (Preview, Sep 2025) — Enables safe infrastructure refactoring (rename constructs, move resources between stacks) while preserving deployed resources.
• CDK Toolkit Library — Programmatic access to CDK operations (synth, deploy, destroy) for advanced CI/CD integration.
• CDK supports unit testing with the assertions module and compliance checking with cdk-nag.

Terraform Overview

• Terraform by HashiCorp (now IBM) is a multi-cloud IaC tool that uses HashiCorp Configuration Language (HCL) — a declarative language designed specifically for infrastructure.
• Terraform works with providers — plugins that interact with cloud platforms, SaaS tools, and other APIs. The AWS provider covers all AWS services; 4,000+ providers exist in the Terraform Registry.
• Terraform uses a plan → apply workflow: terraform plan shows what will change, terraform apply executes the changes.
• Terraform maintains its own state file that maps configuration to real-world resources, enabling dependency tracking and change detection.
• Terraform is the only tool of the three that natively supports multi-cloud deployments (AWS, Azure, GCP, etc.) in a single configuration.
• Terraform Stacks (GA late 2025) — Deploy multiple Terraform configurations as a single orchestrated unit with native dependency resolution and progressive rollouts.
• Licensing: In August 2023, HashiCorp changed Terraform’s license from MPL 2.0 to Business Source License (BSL 1.1). IBM acquired HashiCorp in 2024 for $6.4B. This led to OpenTofu, an MPL 2.0-licensed fork maintained by the Linux Foundation (CNCF Sandbox project as of April 2025).
• Terraform Test Framework (native since v1.6) enables unit and integration testing for modules using HCL-based test files.

CDK for Terraform (CDKTF) – Deprecated

• CDKTF (CDK for Terraform) allowed writing Terraform configurations using programming languages (TypeScript, Python, Java, C#, Go) via the CDK construct model, combining CDK’s developer experience with Terraform’s multi-cloud providers.
• ⚠️ CDKTF was deprecated on December 10, 2025. HashiCorp/IBM no longer supports or maintains it. The GitHub repository has been archived.
• Migration options for CDKTF users:
  • Terraform HCL — Convert back to native HCL for continued Terraform provider access.
  • AWS CDK — If AWS-only, CDK provides a superior programming language experience with active development.
  • Pulumi — Multi-cloud IaC with programming language support and Terraform provider compatibility. Offers migration tooling from CDKTF.
  • OpenTofu — Open-source Terraform fork (no CDKTF equivalent, HCL only).
• The deprecation of CDKTF eliminated the “best of both worlds” option and forces teams to choose between language flexibility (CDK/Pulumi) and multi-cloud (Terraform HCL).

State Management

• CloudFormation — State is managed entirely by AWS within the CloudFormation service. Each Stack maintains its own state internally. You never manage state files directly — AWS handles consistency, locking, and rollback. State cannot be corrupted or lost by users.
• AWS CDK — Since CDK deploys via CloudFormation, state management is identical to CloudFormation. CDK also maintains a cdk.context.json file for caching environment lookups. No separate state file to manage.
• Terraform — Maintains an explicit state file (terraform.tfstate) that maps configuration to real infrastructure. State must be stored securely and shared across teams:
  • Local state — Default; stored on the operator’s filesystem. Not suitable for teams.
  • Remote backends — S3 + DynamoDB (locking), Terraform Cloud/Enterprise, GCS, Azure Blob, Consul, etc.
  • State file contains sensitive data (resource IDs, outputs) and must be encrypted at rest.
  • State locking prevents concurrent modifications that could corrupt state.
  • State can be split across workspaces or state files for blast-radius management.

Language Support

Multi-Cloud Support

• CloudFormation — AWS-only. No support for other cloud providers.
• AWS CDK — Primarily AWS-only. CDK synthesizes to CloudFormation, which only manages AWS resources. Third-party constructs exist for limited non-AWS use cases (e.g., Custom Resources calling external APIs).
• Terraform — True multi-cloud support. A single Terraform configuration can manage resources across AWS, Azure, GCP, Kubernetes, Datadog, GitHub, Cloudflare, and 4,000+ providers simultaneously. This is Terraform’s primary differentiator.
  • Organizations with multi-cloud strategies benefit from a unified workflow, language, and state management approach.
  • The same HCL language, plan/apply workflow, and module system work identically across all providers.
• OpenTofu — Same multi-cloud capabilities as Terraform (same provider ecosystem) under an open-source license.

Drift Detection

• CloudFormation — Built-in Drift Detection feature. Detects when resource properties differ from the stack template. Can be run on individual resources or entire stacks. Shows IN_SYNC, DRIFTED, or NOT_CHECKED status. Limitation: not all resource properties are checked; only properties defined in the template are compared.
• AWS CDK — Inherits CloudFormation’s drift detection capabilities since CDK deploys via CloudFormation stacks. Use aws cloudformation detect-stack-drift on synthesized stacks.
• Terraform — Drift detection occurs automatically on every terraform plan. Terraform refreshes the real-world state and compares it to the configuration, showing exactly what has drifted and what changes would be made to remediate. More comprehensive than CloudFormation because:
  • Detects all property changes, not just template-defined ones.
  • Shows the remediation plan immediately.
  • Can be automated in CI/CD with scheduled plans.
  • Terraform Cloud/Enterprise supports automated drift detection with notifications.

Modules, Constructs, and Nested Stacks

• CloudFormation — Nested Stacks
  • Use AWS::CloudFormation::Stack to embed child stacks within parent stacks.
  • Templates must be stored in S3 and referenced by URL.
  • Useful for reusing common patterns (VPC, security groups) across stacks.
  • Outputs from nested stacks can be referenced by parent stacks.
  • Limitation: Nested stacks create tight coupling; updates must be initiated from the root stack.
  • Stack Exports/Imports — Cross-stack references using Export and Fn::ImportValue for loose coupling.
• AWS CDK — Constructs
  • The fundamental building block. Every CDK element is a construct, organized in a tree structure.
  • Constructs are composable — you create higher-level constructs from lower-level ones.
  • Share constructs via npm, PyPI, Maven, or NuGet packages.
  • Construct Hub (construct.dev) — Community registry with 1,500+ published constructs.
  • Constructs leverage full programming language capabilities — generics, inheritance, interfaces.
  • CDK Mixins (2026) add composable behavior without monolithic construct hierarchies.
• Terraform — Modules
  • Modules are reusable packages of Terraform configuration (a directory with .tf files).
  • Terraform Registry — 15,000+ published modules for common patterns.
  • Modules support versioning, input variables, and output values.
  • Can be sourced from local paths, Git repos, S3, GCS, or the Registry.
  • Module composition is declarative — modules call other modules.
  • Terraform Stacks (GA 2025) orchestrate multiple root modules as a coordinated deployment unit.

Importing Existing Resources

• CloudFormation
  • Resource Import — Import existing resources into a stack using --import-existing-resources flag or the console. Must define the resource in the template first, then import.
  • IaC Generator (2024) — Scans your AWS account, discovers existing resources, identifies relationships, and generates complete CloudFormation templates or CDK apps. Supports targeted resource type scanning. Dramatically simplifies brownfield adoption.
  • Supports importing entire applications with resource relationships preserved.
• AWS CDK
  • CDK Migrate — Works with IaC Generator to create CDK apps from existing resources.
  • Import existing resources by adding them to the stack with the importValue mechanism or by using L1 constructs with CloudFormation import.
  • Can generate CDK code from existing CloudFormation templates using cdk migrate.
• Terraform
  • terraform import — Imports existing resources into Terraform state. Requires manually writing the configuration first (or using import blocks since v1.5).
  • Import Blocks (v1.5+) — Declarative import in configuration files. Can generate configuration with terraform plan -generate-config-out.
  • Third-party tools like Terraformer can bulk-import resources and generate HCL.
  • Import is per-resource — no automatic relationship detection like CloudFormation’s IaC Generator.

Testing Capabilities

• CloudFormation
  • cfn-lint — Linting tool that validates templates against resource specifications.
  • TaskCat — Automated testing tool that deploys templates across regions and validates.
  • cfn-guard — Policy-as-code tool for validating templates against organizational rules.
  • No native unit testing framework — relies on third-party tools or deploying to test accounts.
• AWS CDK
  • Assertions module (aws-cdk-lib/assertions) — Fine-grained unit testing against synthesized CloudFormation templates. Test specific resource properties without deploying.
  • Snapshot testing — Compare entire synthesized templates against stored snapshots to detect unintended changes.
  • cdk-nag — Compliance and security rule packs (AWS Solutions, HIPAA, NIST 800-53) validated at synthesis time using CDK Aspects.
  • Uses standard testing frameworks (Jest, pytest, JUnit) — familiar to developers.
  • Integration testing — integ-runner and integ-tests constructs for deploying and validating real infrastructure.
• Terraform
  • Terraform Test Framework (native since v1.6) — Write test files (.tftest.hcl) for unit and integration testing of modules. Can create real infrastructure for validation.
  • terraform validate — Syntax and configuration validation without accessing providers.
  • terraform plan — Preview changes; can be used as a validation step in CI.
  • Terratest (Go library) — Deploy real infrastructure, validate it, then destroy. Popular for integration testing.
  • OPA/Sentinel — Policy-as-code for governance (Sentinel is Terraform Enterprise only; OPA works with any plan output).
  • tflint — Pluggable linting framework for Terraform.

CI/CD Integration

• CloudFormation
  • Native integration with AWS CodePipeline — deploy/update stacks as pipeline actions.
  • Supports StackSets for multi-account/multi-region deployments from a single template.
  • Change Sets can be created in a pipeline stage for review before execution.
  • Integrates with AWS Service Catalog for standardized deployments.
  • Supports Git-based workflows via CodeCommit, CodeBuild, or any CI tool that can call AWS APIs.
• AWS CDK
  • CDK Pipelines — High-level construct that defines a self-mutating CI/CD pipeline (pipeline updates itself when you change the pipeline code).
  • CDK Toolkit Library enables programmatic deployment from any CI system.
  • Synthesized CloudFormation templates can be stored as artifacts and deployed via CodePipeline.
  • Standard build tools (npm, pip, Maven) handle compilation and synthesis in CI.
  • cdk diff in pull requests shows planned infrastructure changes.
• Terraform
  • Terraform Cloud/Enterprise — Built-in CI/CD with VCS integration, plan-on-PR, cost estimation, Sentinel policies, and run triggers.
  • Integrates with any CI system (GitHub Actions, GitLab CI, Jenkins, CircleCI) via CLI.
  • terraform plan output can be posted as PR comments for review.
  • Atlantis — Popular open-source tool for Terraform PR automation.
  • Spacelift, env0, Scalr — Third-party platforms for Terraform CI/CD and governance.
  • Remote state and locking enable safe concurrent CI/CD executions.

When to Use Which – Decision Matrix

Detailed Comparison Table

AWS Certification Exam Practice Questions

• Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
• AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
• Open to further feedback, discussion and correction.

1. A company has AWS infrastructure deployed across multiple accounts and regions using manual console operations. They want to bring all existing resources under IaC management with minimal effort. Which approach provides the fastest path to IaC adoption?
   1. Use Terraform import blocks to import each resource individually and write HCL configuration.
   2. Use AWS CloudFormation IaC Generator to scan the accounts, discover resources and relationships, and generate CloudFormation templates automatically.
   3. Write AWS CDK code manually for each resource after documenting the current state.
   4. Use AWS Config to export resource configurations and convert them to Terraform modules.
2. A development team wants to define AWS infrastructure using TypeScript with full IDE support, unit testing, and the ability to use loops and conditionals for dynamic resource creation. They are AWS-only. Which tool best meets their requirements?
   1. AWS CloudFormation with Language Extensions.
   2. Terraform with HCL dynamic blocks.
   3. AWS CDK with TypeScript, using L2 constructs and the assertions module for testing.
   4. AWS SAM with YAML templates.
3. An organization operates across AWS, Azure, and GCP. They need a single IaC tool that can manage resources across all three cloud providers with a unified workflow and state management. Which tool should they use?
   1. AWS CloudFormation with Custom Resources for Azure and GCP.
   2. AWS CDK with third-party constructs.
   3. Separate tools for each cloud provider.
   4. Terraform (or OpenTofu) with provider configurations for AWS, Azure, and GCP.
4. A team using AWS CDK wants to reorganize their infrastructure code by moving resources between stacks and renaming constructs, without replacing the deployed resources. Which CDK feature enables this safe refactoring?
   1. CDK Pipelines with approval stages.
   2. CloudFormation Change Sets with manual review.
   3. CDK Refactor command, which computes mappings between current code and deployed state to preserve resources.
   4. Export/Import values between stacks with deletion protection.
5. A security team needs to ensure all CDK-deployed infrastructure complies with HIPAA requirements before resources are provisioned. Which approach validates compliance at synthesis time without deploying infrastructure?
   1. Deploy to a test account and run AWS Config rules.
   2. Use cdk-nag with the HIPAA Security rule pack as a CDK Aspect to validate constructs during synthesis.
   3. Use CloudFormation drift detection after deployment.
   4. Write Terraform Sentinel policies.
6. A company is evaluating IaC tools and needs automatic rollback capability when a deployment fails partway through creating resources. Which tools provide this natively? (Select TWO)
   1. AWS CloudFormation
   2. AWS CDK (via CloudFormation)
   3. Terraform
   4. OpenTofu
   5. Ansible
7. An operations team wants continuous drift detection that automatically identifies when infrastructure configuration differs from the declared state. The detection should be comprehensive (all properties, not just template-defined ones) and run on a schedule. Which approach provides the most comprehensive drift detection?
   1. CloudFormation drift detection on all stacks.
   2. AWS Config rules for resource compliance.
   3. Terraform Cloud with scheduled plan-only runs that compare actual state against configuration for all managed properties.
   4. AWS CDK with snapshot testing in CI/CD.

Related Posts

• AWS CloudFormation
• AWS CloudFormation Best Practices
• AWS CloudFormation Helper Scripts
• AWS Elastic Beanstalk vs OpsWorks vs CloudFormation
• Terraform Cheat Sheet
• HashiCorp Certified Terraform Associate Learning Path
• AWS Management Tools Cheat Sheet

References

• AWS CloudFormation User Guide
• AWS CDK v2 Developer Guide
• Terraform Documentation
• CloudFormation IaC Generator
• OpenTofu

AWS Lambda vs Step Functions vs EventBridge

Overview

• AWS Lambda is a serverless compute service that runs code in response to events without provisioning or managing servers. It automatically scales from zero to thousands of concurrent executions and charges only for actual compute time consumed.
• AWS Step Functions is a serverless workflow orchestration service that coordinates multiple AWS services into visual workflows. It manages state, handles retries, error handling, and parallel execution using a declarative state machine model (Amazon States Language or visual Workflow Studio).
• Amazon EventBridge is a serverless event bus service that makes it easy to connect applications using events. It routes events from AWS services, SaaS applications, and custom sources to targets based on content-based filtering rules, enabling loosely-coupled event-driven architectures.

Key Concepts

• Lambda = Compute (execute code)
• Step Functions = Orchestration (coordinate services)
• EventBridge = Routing (connect event producers and consumers)

These three services are complementary and are frequently used together in modern serverless architectures. Lambda provides the compute, Step Functions coordinates the workflow, and EventBridge routes events between decoupled components.

Detailed Comparison Table

When to Use Which — Decision Guide

Decision Framework

• Start with Lambda if you have a single task triggered by an event that completes within 15 minutes.
• Add Step Functions when your logic requires multiple steps, conditional branching, parallel execution, error recovery, or human-in-the-loop approvals.
• Add EventBridge when you need to decouple producers from consumers, route events to multiple targets based on content, or integrate with SaaS partners.
• Use Lambda Durable Functions (instead of Step Functions) when you prefer code-first orchestration within a single Lambda function and don’t need cross-service visual orchestration.

Architecture Patterns Combining All Three

Pattern 1: Event-Driven Microservices

Multiple microservices communicate through EventBridge. Each service publishes domain events, and EventBridge routes them to interested consumers (Lambda functions or Step Functions workflows).

• EventBridge — Central event bus for inter-service communication
• Lambda — Individual microservice handlers (order processing, notification, inventory)
• Step Functions — Complex business processes spanning multiple services (order fulfillment saga)

Pattern 2: Saga Pattern for Distributed Transactions

Step Functions orchestrates a saga where each step has a compensating action. EventBridge decouples the saga from downstream services.

• Step Functions — Orchestrates the saga with Retry/Catch for each step
• Lambda — Executes each transaction step and its compensation
• EventBridge — Publishes saga completion/failure events to notify other bounded contexts

Pattern 3: Scheduled ETL with Event Notifications

• EventBridge Scheduler — Triggers the ETL workflow on a cron schedule
• Step Functions — Orchestrates extract → transform → load with error handling
• Lambda — Executes each ETL stage
• EventBridge — Publishes ETLComplete/ETLFailed events for downstream consumers

Pattern 4: AI/ML Pipeline with Human-in-the-Loop

• EventBridge — Receives document upload events from S3
• Step Functions — Orchestrates the pipeline: classify → extract → validate → approve
• Lambda — Calls Bedrock/Textract for AI processing
• Step Functions Wait — Pauses for human review via callback token
• EventBridge — Publishes ProcessingComplete event to downstream systems

Pattern 5: Fan-Out/Fan-In Processing

• EventBridge — Receives incoming event and triggers Step Functions
• Step Functions Distributed Map — Fans out to process thousands of items in parallel
• Lambda — Processes each individual item
• Step Functions — Aggregates results after all items complete
• EventBridge — Publishes aggregated results to interested consumers

Integration Points

Lambda ↔ Step Functions

• Step Functions can invoke Lambda functions directly using optimized integrations (no additional charges for Lambda invocation from Step Functions)
• Step Functions passes input/output data between Lambda steps automatically
• Lambda can start Step Functions executions via the AWS SDK
• Callback pattern — Step Functions sends a task token to Lambda; Lambda calls back when async work completes
• Activity tasks — Step Functions waits for external workers (Lambda or other compute) to poll and complete work
• Lambda Durable Functions (Dec 2025) — Provides Step Functions-like orchestration directly within Lambda code, blurring the boundary

Lambda ↔ EventBridge

• EventBridge can invoke Lambda as a target for matched rules (asynchronous invocation)
• Lambda can publish events to EventBridge via the SDK (PutEvents API)
• EventBridge Pipes — Connects event sources (SQS, Kinesis, DynamoDB Streams) to Lambda with built-in filtering and enrichment
• EventBridge Scheduler — Invokes Lambda on cron/rate/one-time schedules with 619+ SDK API actions (May 2026)
• Lambda Destinations — On success/failure, Lambda can route results to EventBridge

Step Functions ↔ EventBridge

• Step Functions can publish events to EventBridge directly from a workflow step (EventBridge PutEvents integration)
• EventBridge rules can start Step Functions executions as a target
• Step Functions emits execution status change events to EventBridge (RUNNING, SUCCEEDED, FAILED, TIMED_OUT, ABORTED)
• EventBridge Scheduler can trigger Step Functions workflows on a schedule
• Wait for Callback — Step Functions pauses and waits for an external event (potentially routed via EventBridge) to resume

All Three Together

• EventBridge routes an incoming event → triggers Step Functions workflow → Step Functions orchestrates multiple Lambda functions → publishes completion event back to EventBridge
• EventBridge Pipes can enrich events using Lambda before delivering to Step Functions
• Step Functions 1,100+ SDK integrations (Mar 2026) include direct EventBridge and Lambda actions without writing code

Pricing Comparison

Cost Optimization Tips

• Lambda — Use ARM/Graviton2 for 20% savings; right-size memory; use Provisioned Concurrency only for latency-sensitive paths
• Step Functions — Use Express Workflows for high-volume, short-duration workflows (up to 90% cheaper than Standard); minimize state transitions by combining logic in single Lambda functions
• EventBridge — Keep event payloads under 64 KB to avoid chunk-based billing; use input transformers to reduce payload size before delivery; AWS service events are always free
• Combined — Use Step Functions SDK integrations directly (DynamoDB, S3, SQS) instead of Lambda wrappers to save Lambda costs

Recent Updates (2025-2026)

AWS Lambda

• Lambda Durable Functions (Dec 2025) — Multi-step orchestration within Lambda code using steps and waits; auto-checkpoint, suspend up to 1 year, and recover from failures without Step Functions
• Lambda Managed Instances (Dec 2025) — Dedicated compute with EC2 flexibility; multi-request processing per execution environment; supports tag propagation (Jun 2026)
• Lambda MicroVMs (Jun 2026) — Container-based Firecracker snapshots with up to 8-hour runtime for long-running workloads
• 1 MB Async Payload (Oct 2025) — Asynchronous invocation payload increased from 256 KB to 1 MB
• ARC Region Switch ESM Block (May 2026) — Event source mapping execution block during regional failovers

AWS Step Functions

• 28 New Service Integrations + 1,100 API Actions (Mar 2026) — Including Amazon Bedrock AgentCore and Amazon S3 Vectors
• 100,000 State Machines per Account (Feb 2025) — 10x increase from previous 10,000 limit
• 137 Additional APIs + Backup Search (Apr 2025) — Expanded SDK integrations
• Distributed Map Enhancements (Sep 2025) — Additional data sources and observability metrics
• API-based Local Testing (May 2026) — Validate workflows before deploying to AWS

Amazon EventBridge

• 1 MB Event Payload (Jan 2026) — Maximum event size increased from 256 KB to 1 MB
• Cross-Account Direct Delivery (Jan 2025) — Deliver events to targets in another account without intermediate default bus
• Enhanced Visual Rule Builder (Nov 2025) — Intuitive console with event catalog for 200+ AWS services
• Enhanced Logging (Jul 2025) — Logging to CloudWatch Logs, S3, and Kinesis Data Firehose for event lifecycle tracking
• Scheduler 619 New SDK Actions (May 2026) — Including Lambda Managed Instances, 13 additional services
• MWAA Serverless Integration (Jun 2026) — EventBridge notifications for Airflow workflow state transitions

AWS Certification Exam Relevance

SAA-C03 (Solutions Architect Associate)

• Understand when to use Lambda vs Step Functions vs EventBridge for decoupling and orchestration
• Know EventBridge for event-driven architecture design and cross-account event routing
• Know Step Functions for workflow coordination with error handling
• Understand the Saga pattern using Step Functions for distributed transactions
• Know Lambda limits (15-min timeout, 6 MB sync payload, concurrency)

DVA-C02 (Developer Associate)

• Deeper knowledge of Lambda event source mappings, destinations, and error handling
• Step Functions Amazon States Language (ASL), Wait/Callback patterns, SDK integrations
• EventBridge rule patterns, input transformers, Pipes, and Scheduler
• Lambda Durable Functions vs Step Functions trade-offs
• Testing and debugging workflows (Step Functions local testing, EventBridge logging)

SAP-C02 (Solutions Architect Professional)

• Multi-account event routing with EventBridge (cross-account, cross-region)
• Complex workflow patterns: Saga, fan-out/fan-in, human-in-the-loop with Step Functions
• Cost optimization: Step Functions Standard vs Express, Lambda Provisioned Concurrency decisions
• Hybrid architectures combining all three services for enterprise event-driven systems
• Disaster recovery with Lambda ARC Region Switch and Step Functions execution history

AWS Certification Exam Practice Questions

• Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
• AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
• AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
• Open to further feedback, discussion and correction.

1. A company has an e-commerce application where placing an order requires inventory reservation, payment processing, and shipping initiation. If any step fails, previous steps must be compensated (rolled back). Which architecture BEST implements this?
   1. Lambda function that calls each service sequentially with try/catch
   2. EventBridge rules that route events between each service
   3. Step Functions workflow implementing the Saga pattern with Catch and compensating states
   4. SQS queues between each service for reliability
   Show Answer

   Answer: C – Step Functions is ideal for the Saga pattern because it provides built-in Retry and Catch states, maintains execution history, and allows defining compensating actions for each step. EventBridge is for decoupling, not orchestrating sequential transactions with compensation.

2. A company needs to route customer feedback events to different processing Lambda functions based on the sentiment (positive, negative, neutral) contained in the event payload. Which service should they use?
   1. AWS Step Functions with Choice state
   2. Amazon EventBridge with content-based filtering rules
   3. Amazon SQS with message filtering
   4. AWS Lambda with conditional logic
   Show Answer

   Answer: B – EventBridge excels at content-based routing where events are routed to different targets based on event payload content. Each rule can match specific patterns in the event JSON and route to different Lambda targets. This keeps services decoupled.

3. A developer is building a document processing pipeline that takes 45 minutes to complete. The pipeline extracts text, classifies the document, and stores results. Which approach is MOST cost-effective?
   1. Single Lambda function with maximum 15-minute timeout chained via SQS
   2. Step Functions Standard Workflow orchestrating Lambda functions for each step
   3. Step Functions Express Workflow with Lambda functions
   4. EventBridge Pipes connecting each processing stage
   Show Answer

   Answer: B – Step Functions Standard Workflow supports executions up to 1 year and is appropriate for a 45-minute pipeline. Express Workflows are limited to 5 minutes. Chaining Lambda via SQS adds operational complexity. EventBridge Pipes is for point-to-point event streaming, not multi-step orchestration.

4. A solutions architect needs to design a system where multiple microservices react to a single business event (e.g., “UserRegistered”) without the producing service knowing about the consumers. Which approach provides the MOST decoupled architecture?
   1. Lambda function invoking each consumer directly
   2. SNS topic with subscriptions for each consumer
   3. EventBridge custom event bus with content-based rules for each consumer
   4. Step Functions parallel state invoking each consumer
   Show Answer

   Answer: C – EventBridge provides the most decoupled architecture because producers publish events without knowing about consumers. Each consumer creates their own rule with content-based filtering. Unlike SNS, EventBridge supports schema discovery, event replay, and more sophisticated filtering. Step Functions and direct Lambda invocation create tight coupling.

5. An application processes 500,000 short-lived events per hour, each requiring 3 state transitions. The team wants to minimize costs. Which Step Functions workflow type should they use?
   1. Standard Workflow
   2. Express Workflow
   3. Standard Workflow with Activity Tasks
   4. Lambda Durable Functions instead
   Show Answer

   Answer: B – Express Workflows are designed for high-volume, short-duration workloads and cost approximately $1.00 per million executions vs $25.00 per million state transitions for Standard. With 500K events × 3 transitions = 1.5M transitions/hour, Express saves significantly. Express supports up to 100,000 state transitions per second.

6. A company operates in multiple AWS accounts and needs Service A in Account 1 to trigger a Lambda function in Account 2 when an order is placed. Which is the simplest approach with EventBridge?
   1. Send event to Account 2’s default bus, then create a rule targeting Lambda
   2. Use EventBridge cross-account direct delivery to invoke the Lambda in Account 2
   3. Use SNS cross-account subscription
   4. Use SQS cross-account queue
   Show Answer

   Answer: B – EventBridge now supports direct cross-account delivery (Jan 2025), eliminating the need to send events to the target account’s default bus first. This simplifies the architecture by allowing a rule in Account 1 to directly target a Lambda function in Account 2.

7. A developer wants to build a multi-step AI workflow within a single Lambda function that checkpoints progress and can suspend execution while waiting for a human review. The workflow only involves Lambda logic (no other AWS service orchestration). Which feature should they use?
   1. Step Functions Standard Workflow
   2. Step Functions Express Workflow
   3. Lambda Durable Functions
   4. EventBridge with Lambda Destinations
   Show Answer

   Answer: C – Lambda Durable Functions (Dec 2025) provide code-first orchestration with steps and waits directly within Lambda. They’re ideal when the workflow logic stays within Lambda and doesn’t need visual cross-service orchestration. Durable functions automatically checkpoint progress and can suspend execution for up to 1 year.

8. A team needs to process 10 million S3 objects in parallel, with each object requiring a Lambda function for transformation. Which Step Functions feature is BEST suited?
   1. Map state with MaxConcurrency
   2. Parallel state with multiple branches
   3. Distributed Map with up to 10,000 parallel child executions
   4. EventBridge with Lambda targets
   Show Answer

   Answer: C – Step Functions Distributed Map is specifically designed for large-scale parallel processing of items from S3 datasets. It supports up to 10,000 parallel child executions and can process millions of objects. The standard Map state is limited to 40 concurrent iterations.

9. A company wants to trigger different processing pipelines based on the type of file uploaded to S3 — images go to a Rekognition pipeline, documents go to Textract, and videos go to MediaConvert. Which combination provides content-based routing? (Select TWO)
   1. S3 Event Notifications directly to each Lambda
   2. S3 → EventBridge rule with event pattern matching on object key suffix → different Step Functions targets
   3. S3 → Lambda → conditional invocation of each pipeline
   4. S3 → EventBridge rule with event pattern matching → different Lambda targets
   5. S3 → SQS → Lambda routing
   Show Answer

   Answer: B, D – EventBridge can receive S3 events and apply content-based filtering rules on the object key (suffix pattern matching) to route to different targets. Both Step Functions and Lambda can be valid targets depending on pipeline complexity. S3 Event Notifications lack content-based filtering on file type.

10. Which statement BEST describes the relationship between Lambda, Step Functions, and EventBridge in a serverless architecture?
    1. They are competing services — choose one for your architecture
    2. Lambda handles compute, Step Functions handles orchestration, EventBridge handles event routing — they are complementary
    3. Step Functions replaces the need for both Lambda and EventBridge
    4. EventBridge replaces Step Functions for all workflow orchestration needs
    Show Answer

    Answer: B – These three services are complementary, not competing. Lambda provides serverless compute (executing code), Step Functions provides workflow orchestration (coordinating multiple services), and EventBridge provides event routing (connecting producers and consumers). Most serverless architectures use all three together.

References

• AWS Lambda Documentation
• AWS Step Functions Documentation
• Amazon EventBridge Documentation
• Lambda Durable Functions vs Step Functions
• Serverless Services Now Support Payloads up to 1 MB
• AWS Lambda Managed Instances
• Step Functions 28 New Service Integrations (Mar 2026)
• EventBridge Enhanced Visual Rule Builder
• EventBridge Enhanced Logging
• AWS Lambda Pricing
• AWS Step Functions Pricing
• Amazon EventBridge Pricing

Related Posts

• AWS Lambda
• AWS Lambda Functions
• AWS Lambda Event Source
• Amazon EventBridge
• AWS Simple Queue Service – SQS
• AWS Simple Notification Service – SNS
• AWS API Gateway
• CloudFront Functions vs Lambda@Edge
• AWS Kinesis Data Streams vs SQS
• AWS SWF – Simple Workflow Overview

AWS Certified Generative AI Developer – Professional (AIP-C01) Exam Learning Path

• The AWS Certified Generative AI Developer – Professional (AIP-C01) is AWS’s newest professional-level certification, validating the ability to integrate foundation models (FMs) into applications and business workflows using AWS technologies.
• This is a hands-on certification focused on building and deploying GenAI solutions — not just theory, but production-ready implementations.
• Target audience: Developers with 2+ years of AWS experience and 1+ year of hands-on GenAI solution implementation.

AIP-C01 Exam Content

• Validates ability to design and implement solutions using vector stores, RAG, knowledge bases, and GenAI architectures
• Tests integration of foundation models into applications and business workflows
• Covers prompt engineering and management techniques
• Tests implementation of agentic AI solutions
• Validates optimization for cost, performance, and business value
• Covers security, governance, and Responsible AI practices
• Tests troubleshooting, monitoring, and optimization of GenAI applications

Refer AWS Certified Generative AI Developer – Professional (AIP-C01) Exam Guide

AIP-C01 Exam Summary

• AIP-C01 consists of 65 scored questions + 10 unscored in 170 minutes
• Question types: multiple-choice and multiple-response
• Scaled score between 100 and 1,000. Minimum passing score: 750
• Professional-level exam costs $300 + tax
• Certification valid for 3 years
• No prerequisite certification required (but AIF-C01 recommended as foundation)

AIP-C01 Exam Domains

• Domain 1: Foundation Model Integration, Data Management & Compliance — 31%
  • Select and configure FMs for specific use cases
  • Design data pipelines for GenAI (vector stores, embeddings, chunking strategies)
  • Implement RAG architectures with Amazon Bedrock Knowledge Bases
  • Ensure data compliance and governance
• Domain 2: Implementation and Integration — 26%
  • Implement GenAI solutions using Amazon Bedrock, SageMaker, and open-source models
  • Design and implement agentic workflows (Bedrock Agents, AgentCore)
  • Apply prompt engineering techniques (few-shot, chain-of-thought, system prompts)
  • Integrate FMs into existing applications and workflows
• Domain 3: AI Safety, Security & Governance — 20%
  • Implement Bedrock Guardrails for content filtering
  • Apply Responsible AI practices (bias detection, toxicity filtering)
  • Secure GenAI workloads (IAM, VPC, encryption, data isolation)
  • Implement model governance and versioning
• Domain 4: Operational Efficiency & Optimization — 12%
  • Optimize inference costs (model selection, caching, batch inference)
  • Implement performance optimization (provisioned throughput, model distillation)
  • Design for scalability and reliability
• Domain 5: Testing, Validation & Troubleshooting — 11%
  • Evaluate FM outputs (BLEU, ROUGE, human evaluation)
  • Implement testing strategies for GenAI applications
  • Monitor and troubleshoot GenAI workloads
  • Implement feedback loops and continuous improvement

Key AWS Services for AIP-C01

• Amazon Bedrock — Primary service for FM access, Knowledge Bases, Agents, Guardrails, Model Evaluation
• Amazon Bedrock Agents — Agentic AI workflows with tool use and multi-step reasoning
• Amazon Bedrock Knowledge Bases — Managed RAG with vector stores (OpenSearch Serverless, Aurora, Pinecone)
• Amazon Bedrock Guardrails — Content filtering, PII redaction, topic denial
• Amazon SageMaker — Custom model training, fine-tuning, hosting
• Amazon Q Developer — AI coding assistant
• Amazon Q Business — Enterprise AI assistant with data connectors
• AWS Lambda — Serverless inference triggers, agent action groups
• Amazon OpenSearch Serverless — Vector search for RAG
• Amazon DynamoDB — Session state, conversation history
• Amazon S3 — Data sources for knowledge bases
• AWS Step Functions — Orchestrate multi-model workflows
• Amazon CloudWatch — Monitoring GenAI workloads, model invocation metrics

Key Concepts for AIP-C01

• RAG (Retrieval Augmented Generation) — Grounding FM responses with external data
• Vector Databases & Embeddings — Semantic search, chunking strategies, embedding models
• Prompt Engineering — System prompts, few-shot learning, chain-of-thought, temperature/top-p
• Agentic AI — Tool use, function calling, multi-step reasoning, ReAct pattern
• Fine-tuning vs RAG — When to customize the model vs augment with external data
• Model Evaluation — Automated metrics (BLEU, ROUGE, BERTScore), human evaluation, LLM-as-judge
• Responsible AI — Bias detection, hallucination mitigation, content safety, model cards
• Inference Optimization — Provisioned throughput, caching, batch inference, model distillation
• Guardrails — Content filters, denied topics, word filters, PII redaction, contextual grounding

AIP-C01 Preparation Strategy

• Hands-on with Bedrock is highly recommended — While the exam is multiple-choice, questions are scenario-based and require practical understanding of Bedrock configurations
• Build at least 2-3 RAG applications using Bedrock Knowledge Bases
• Create Bedrock Agents with action groups and Lambda functions
• Implement Guardrails with different filter configurations
• Understand the differences between FM families (Claude, Titan, Llama, Mistral)
• Practice prompt engineering with different techniques
• Understand cost optimization: on-demand vs provisioned vs batch inference
• Focus on Domain 1 (31%) and Domain 2 (26%) — they cover 57% of the exam

Recommended Resources

• Courses
  • Stephane Maarek – AWS Generative AI Developer Professional
  • Coursera – Generative AI with LLMs
  • AWS Skill Builder – Generative AI on AWS (Free)
• Practice Tests
  • Braincert – AWS Certified AI Practitioner (AIP-C01) Practice Exams
  • Whizlabs – AIP-C01 Practice Tests
• AWS Documentation
  • Amazon Bedrock User Guide
  • Official AIP-C01 Exam Guide
  • Bedrock Resources & Workshops

Related Posts

• Amazon Bedrock
• Amazon Q Business
• AWS AI Practitioner (AIF-C01) Learning Path
• AWS ML Engineer Associate (MLA-C01) Learning Path
• AWS ML Services Cheat Sheet

References

• AWS Certified Generative AI Developer – Professional
• AIP-C01 Exam Guide
• Amazon Bedrock Documentation

AWS WAF vs Shield vs Firewall Manager

• AWS provides three complementary security services for protecting web applications and AWS resources from attacks.
• WAF filters web traffic at Layer 7, Shield protects against DDoS attacks at Layer 3/4, and Firewall Manager centrally manages security policies across accounts.
• These services work together — Shield protects the infrastructure, WAF filters application-layer attacks, and Firewall Manager enforces policies at scale.

WAF vs Shield vs Firewall Manager Comparison

AWS WAF (Web Application Firewall)

• Layer 7 firewall that filters HTTP/HTTPS requests based on configurable rules.
• Web ACLs contain rules that inspect requests (headers, body, URI, query strings, IP).
• Rule types:
  • Rate-based rules – block IPs exceeding request threshold (per 5-min window)
  • IP set rules – allow/block specific IP ranges
  • Geo match – allow/block by country
  • String/regex match – inspect request components
  • SQL injection / XSS detection – built-in detection statements
  • Size constraints – block oversized requests
• Managed Rule Groups:
  • AWS Managed Rules – Core Rule Set, Known Bad Inputs, SQL/Linux/Windows/PHP, Bot Control, Account Takeover Prevention, Account Creation Fraud Prevention
  • Marketplace rules – Fortinet, F5, Imperva, Trend Micro
• Bot Control – identify and manage bot traffic (common bots, targeted bots, AI scrapers).
• Account Takeover Prevention (ATP) – detect credential stuffing on login pages.
• Account Creation Fraud Prevention (ACFP) – prevent fake account creation.
• CAPTCHA and Challenge – silent browser challenges or visible CAPTCHA.
• Applies to: CloudFront, ALB, API Gateway, AppSync, Cognito User Pools, App Runner, Verified Access.
• Best for: Protecting web applications from SQL injection, XSS, bot abuse, brute force, and application-layer attacks.

AWS Shield

• DDoS protection service – defends against volumetric, protocol, and application-layer attacks.
• Shield Standard (free, automatic):
  • Automatically protects ALL AWS customers at no extra cost
  • Protects against common Layer 3/4 DDoS attacks (SYN/UDP floods, reflection attacks)
  • Applied to CloudFront, Route 53, and Global Accelerator automatically
• Shield Advanced ($3,000/month):
  • Enhanced detection for EC2, ELB, CloudFront, Global Accelerator, Route 53
  • DDoS cost protection – credits for Auto Scaling, CloudFront, ELB scaling costs during attacks
  • Shield Response Team (SRT) – 24/7 expert team to assist during attacks
  • Advanced metrics and reporting – real-time visibility into attacks
  • Automatic application-layer mitigation – creates WAF rules automatically during L7 attacks
  • Health-based detection – uses Route 53 health checks for faster detection
  • Proactive engagement – SRT contacts you when health checks trigger
  • Protection applies to all resources in the account (and org with Firewall Manager)
• Best for: High-profile applications needing DDoS protection guarantees, SLA credits, and 24/7 expert support.

AWS Firewall Manager

• Central security policy management across AWS Organizations accounts and resources.
• Manages policies for:
  • AWS WAF – deploy WAF rules across all accounts/resources
  • AWS Shield Advanced – enable protection organization-wide
  • Security Groups – audit and enforce SG rules
  • AWS Network Firewall – deploy firewall rules across VPCs
  • Route 53 Resolver DNS Firewall – enforce DNS filtering
  • Third-party firewalls – Palo Alto, Fortigate via Marketplace
• Auto-remediation – automatically applies policies to new resources/accounts as they’re created.
• Compliance dashboard – view which resources are non-compliant across the organization.
• Prerequisites: AWS Organizations, AWS Config enabled in all accounts.
• Best for: Multi-account organizations needing consistent security policies, compliance auditing, and automatic enforcement.

How They Work Together

• Shield Standard (always on) protects infrastructure from volumetric L3/4 DDoS.
• Shield Advanced adds L7 protection and automatically creates WAF rules during application-layer attacks.
• WAF handles ongoing application-layer threats (bots, injections, rate limiting).
• Firewall Manager ensures WAF + Shield Advanced policies are consistently deployed across all accounts and resources.
• Typical stack: Firewall Manager → Shield Advanced → WAF → Application.

When to Choose Which

• Every application gets Shield Standard – it’s free and automatic.
• Add WAF when – you need to filter application-layer traffic (SQL injection, bot management, rate limiting, geo-blocking).
• Add Shield Advanced when – you need DDoS cost protection, 24/7 SRT support, enhanced detection, and SLA guarantees for business-critical applications.
• Add Firewall Manager when – you manage multiple AWS accounts and need consistent security policies automatically applied across the organization.

AWS Certification Exam Practice Questions

1. A company experiences a sudden spike in traffic that appears to be a DDoS attack targeting their ALB. They want AWS experts to help mitigate the attack in real-time. Which service provides this?
   1. AWS WAF with rate-based rules
   2. AWS Shield Advanced (Shield Response Team)
   3. AWS Firewall Manager
   4. AWS Network Firewall
2. An e-commerce site needs to block SQL injection attacks and limit login attempts to 100 per IP per 5 minutes. Which service provides these capabilities?
   1. AWS Shield Advanced
   2. Security Groups
   3. AWS WAF (SQL injection rule + rate-based rule)
   4. Network ACLs
3. A large enterprise with 50 AWS accounts needs to ensure every ALB in every account has the same WAF rules applied, including new ALBs created in the future. Which service automates this?
   1. AWS WAF with central web ACL
   2. AWS Shield Advanced
   3. AWS Config Rules
   4. AWS Firewall Manager
4. After a DDoS attack, a company’s CloudFront and Auto Scaling costs spiked significantly due to the attack traffic. Which service provides credits for these scaling costs?
   1. AWS WAF
   2. AWS Shield Advanced (DDoS cost protection)
   3. AWS Firewall Manager
   4. AWS Trusted Advisor
5. A company wants to detect and block AI web scrapers from crawling their content while allowing legitimate search engine bots. Which WAF feature addresses this?
   1. Rate-based rules
   2. Geo match rules
   3. AWS WAF Bot Control (AI Content Scraper category)
   4. IP reputation lists

Related Posts

• AWS Network Firewall vs WAF vs Security Groups vs NACLs
• AWS KMS vs CloudHSM vs Secrets Manager vs Parameter Store
• AWS Security Services Cheat Sheet
• AWS Certified Security – Specialty Exam Learning Path

References

AWS WAF Developer Guide

AWS Shield Developer Guide

AWS Firewall Manager Developer Guide