Practice Questions

AWS Data Pipeline – ETL Workflow Orchestration

~ Last updated on : ~ jayendrapatil ~ 4 Comments

⚠️ AWS Data Pipeline – Maintenance Mode (No Longer Available to New Customers)

AWS closed new customer access to AWS Data Pipeline effective July 25, 2024. The service is now in maintenance mode — no new features or region expansions are planned.

Existing customers can continue to use the service as normal, but AWS recommends migrating to modern alternatives.

Recommended Migration Alternatives:

  • AWS Glue – Serverless data integration service for ETL, Apache Spark applications, and data orchestration with visual editors and notebooks.
  • AWS Step Functions – Serverless orchestration service for building workflows integrating 250+ AWS services with visual designer and JSON-based workflow definitions.
  • Amazon MWAA – Managed Apache Airflow service for end-to-end data pipeline orchestration with Python-based DAGs and 1,000+ pre-built operators.

See Migrating workloads from AWS Data Pipeline for detailed migration guidance.

AWS Data Pipeline

  • AWS Data Pipeline is a web service that makes it easy to automate and schedule regular data movement and data processing activities in AWS
  • helps define data-driven workflows
  • integrates with on-premises and cloud-based storage systems
  • helps quickly define a pipeline, which defines a dependent chain of data sources, destinations, and predefined or custom data processing activities
  • supports scheduling where the pipeline regularly performs processing activities such as distributed data copy, SQL transforms, EMR applications, or custom scripts against destinations such as S3, RDS, or DynamoDB.
  • ensures that the pipelines are robust and highly available by executing the scheduling, retry, and failure logic for the workflows as a highly scalable and fully managed service.

AWS Data Pipeline features

  • Distributed, fault-tolerant, and highly available
  • Managed workflow orchestration service for data-driven workflows
  • Infrastructure management service, as it will provision and terminate resources as required
  • Provides dependency resolution
  • Can be scheduled
  • Supports Preconditions for readiness checks.
  • Grants control over retries, including frequency and number
  • Native integration with S3, DynamoDB, RDS, EMR, EC2 and Redshift
  • Support for both AWS based and external on-premise resources

AWS Data Pipeline Concepts

Pipeline Definition

  • Pipeline definition helps the business logic to be communicated to the AWS Data Pipeline
  • Pipeline definition defines the location of data (Data Nodes), activities to be performed, the schedule, resources to run the activities, per-conditions, and actions to be performed

Pipeline Components, Instances, and Attempts

  • Pipeline components represent the business logic of the pipeline and are represented by the different sections of a pipeline definition.
  • Pipeline components specify the data sources, activities, schedule, and preconditions of the workflow
  • When AWS Data Pipeline runs a pipeline, it compiles the pipeline components to create a set of actionable instances and contains all the information needed to perform a specific task
  • Data Pipeline provides durable and robust data management as it retries a failed operation depending on frequency & defined number of retries

Task Runners

  • A task runner is an application that polls AWS Data Pipeline for tasks and then performs those tasks
  • When Task Runner is installed and configured,
    • it polls AWS Data Pipeline for tasks associated with activated pipelines
    • after a task is assigned to Task Runner, it performs that task and reports its status back to Pipeline.
  • A task is a discreet unit of work that the Pipeline service shares with a task runner and differs from a pipeline, which defines activities and resources that usually yields several tasks
  • Tasks can be executed either on the AWS Data Pipeline managed or user-managed resources.

Data Nodes

  • Data Node defines the location and type of data that a pipeline activity uses as source (input) or destination (output)
  • supports S3, Redshift, DynamoDB, and SQL data nodes

Databases

  • supports JDBC, RDS, and Redshift database

Activities

  • An activity is a pipeline component that defines the work to perform
  • Data Pipeline provides pre-defined activities for common scenarios like sql transformation, data movement, hive queries, etc
  • Activities are extensible and can be used to run own custom scripts to support endless combinations

Preconditions

  • Precondition is a pipeline component containing conditional statements that must be satisfied (evaluated to True) before an activity can run
  • A pipeline supports
    • System-managed preconditions
      • are run by the AWS Data Pipeline web service on your behalf and do not require a computational resource
      • Includes source data and keys check for e.g. DynamoDB data, table exists or S3 key exists or prefix not empty
    • User-managed preconditions
      • run on user defined and managed computational resources
      • Can be defined as Exists check or Shell command

Resources

  • A resource is a computational resource that performs the work that a pipeline activity specifies
  • supports AWS Data Pipeline-managed and self-managed resources
  • AWS Data Pipeline-managed resources include EC2 and EMR, which are launched by the Data Pipeline service only when they’re needed
  • Self managed on-premises resources can also be used, where a Task Runner package is installed which continuously polls the AWS Data Pipeline service for work to perform
  • Resources can run in the same region as their working data set or even on a region different than AWS Data Pipeline
  • Resources launched by AWS Data Pipeline are counted within the resource limits and should be taken into account

Actions

  • Actions are steps that a pipeline takes when a certain event like success, or failure occurs.
  • Pipeline supports SNS notifications and termination action on resources

Migration to Modern Alternatives

AWS recommends migrating existing Data Pipeline workloads to one of the following services based on your use case:

Migrate to AWS Glue

  • Best for serverless ETL workloads, Apache Spark-based processing, and data integration
  • Supports visual editors, notebooks, and crawlers for data discovery
  • Natively supports DynamoDB export/import (common Data Pipeline use case)
  • Includes data quality, sensitive data detection, and Data Catalog capabilities
  • Ideal when migrating pipelines built from pre-defined Data Pipeline templates (e.g., DynamoDB to S3 export)

Migrate to AWS Step Functions

  • Best for orchestrating multi-service workflows with visual designer
  • Integrates with 250+ AWS services and 11,000+ actions out-of-the-box
  • Uses Amazon States Language (JSON-based), similar to Data Pipeline’s JSON definitions
  • Cost-effective with per-task granularity pricing
  • Supports on-premises resources via AWS Systems Manager Run Command
  • Ideal for workloads requiring EC2, EMR, or Lambda orchestration

Migrate to Amazon MWAA (Managed Apache Airflow)

  • Best for complex workflow orchestration using Python-based DAGs
  • Provides 1,000+ pre-built operators covering AWS and non-AWS services
  • Rich UI for observability, restarts, backfills, and lineage tracking
  • Fully managed, open source (Apache Airflow) for maximum portability
  • Ideal for teams already using Airflow or needing advanced orchestration features

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  • Note: AWS Data Pipeline is in maintenance mode and unlikely to appear on newer exam versions. However, questions about data orchestration concepts may reference modern alternatives like AWS Glue, Step Functions, or Amazon MWAA.
  1. An International company has deployed a multi-tier web application that relies on DynamoDB in a single region. For regulatory reasons they need disaster recovery capability in a separate region with a Recovery Time Objective of 2 hours and a Recovery Point Objective of 24 hours. They should synchronize their data on a regular basis and be able to provision the web application rapidly using CloudFormation. The objective is to minimize changes to the existing web application, control the throughput of DynamoDB used for the synchronization of data and synchronize only the modified elements. Which design would you choose to meet these requirements?
    1. Use AWS data Pipeline to schedule a DynamoDB cross region copy once a day. Create a ‘Lastupdated’ attribute in your DynamoDB table that would represent the timestamp of the last update and use it as a filter. (Refer Blog Post)
    2. Use EMR and write a custom script to retrieve data from DynamoDB in the current region using a SCAN operation and push it to DynamoDB in the second region. (No Schedule and throughput control)
    3. Use AWS data Pipeline to schedule an export of the DynamoDB table to S3 in the current region once a day then schedule another task immediately after it that will import data from S3 to DynamoDB in the other region. (With AWS Data pipeline the data can be copied directly to other DynamoDB table)
    4. Send each item into an SQS queue in the second region; use an auto-scaling group behind the SQS queue to replay the write in the second region. (Not Automated to replay the write)

    Note: For new implementations, consider DynamoDB Global Tables for cross-region replication, or AWS Glue for scheduled ETL workloads.

  2. Your company produces customer commissioned one-of-a-kind skiing helmets combining nigh fashion with custom technical enhancements. Customers can show off their Individuality on the ski slopes and have access to head-up-displays, GPS rear-view cams and any other technical innovation they wish to embed in the helmet. The current manufacturing process is data rich and complex including assessments to ensure that the custom electronics and materials used to assemble the helmets are to the highest standards. Assessments are a mixture of human and automated assessments you need to add a new set of assessment to model the failure modes of the custom electronics using GPUs with CUD across a cluster of servers with low latency networking. What architecture would allow you to automate the existing process using a hybrid approach and ensure that the architecture can support the evolution of processes over time?
    1. Use AWS Data Pipeline to manage movement of data & meta-data and assessments. Use an auto-scaling group of G2 instances in a placement group. (Involves mixture of human assessments)
    2. Use Amazon Simple Workflow (SWF) to manage assessments, movement of data & meta-data. Use an autoscaling group of G2 instances in a placement group. (Human and automated assessments with GPU and low latency networking)
    3. Use Amazon Simple Workflow (SWF) to manage assessments movement of data & meta-data. Use an autoscaling group of C3 instances with SR-IOV (Single Root I/O Virtualization). (C3 and SR-IOV won’t provide GPU as well as Enhanced networking needs to be enabled)
    4. Use AWS data Pipeline to manage movement of data & meta-data and assessments use auto-scaling group of C3 with SR-IOV (Single Root I/O virtualization). (Involves mixture of human assessments)

    Note: For modern implementations, AWS Step Functions has largely replaced SWF for workflow orchestration including human-in-the-loop tasks. Current GPU instances include P4, P5, and G5 families.

References

IAM Roles vs Resource-Based Policies – Comparison

~ Last updated on : ~ jayendrapatil ~ 5 Comments

AWS IAM Roles vs Resource-Based Policies

AWS allows granting cross-account access to AWS resources, which can be done using IAM Roles or Resource-Based Policies. Understanding the differences between these two mechanisms is critical for designing secure, multi-account architectures.

Cross-Account Access Methods

  • AWS provides four primary ways to grant cross-account access using resource-based policies:
    • Method 1: Grant access to a specific IAM role using the Principal element (most granular, but role deletion breaks access)
    • Method 2: Grant access to an entire account using the Principal element (delegates access control to the other account)
    • Method 3: Grant access to a specific IAM role using the aws:PrincipalArn condition key (balanced approach — survives role recreation)
    • Method 4: Grant access to an entire AWS Organizations organization using aws:PrincipalOrgId condition key
  • AWS recommends using IAM roles with temporary credentials for cross-account access instead of IAM users with long-term credentials (access keys).

IAM Roles

  • Roles can be created to act as a proxy to allow users or services to access resources.
  • Roles support
    • trust policy which helps determine who can access the resources and
    • permission policy which helps to determine what they can access.
  • Users who assume a role temporarily give up their own permissions and instead take on the permissions of the role. The original user permissions are restored when the user exits or stops using the role.
  • Roles can be used to provide access to almost all the AWS resources.
  • Permissions provided to the User through the Role can be further restricted per user by passing an optional session policy to the STS request. This session policy cannot be used to elevate privileges beyond what the assumed role is allowed to access.
  • When a role ARN is specified in a resource-based policy’s Principal element, AWS maps it to the role’s unique ID. If the role is deleted and recreated with the same name, the new role will have a different unique ID and will not have access — this is an intentional security feature.
  • Using the aws:PrincipalArn condition key in resource-based policies (instead of specifying the role in the Principal element) allows access to survive role recreation, as the condition compares by ARN string rather than unique ID.

IAM Roles Anywhere

  • IAM Roles Anywhere extends the short-term credential model beyond the cloud, allowing on-premises and multi-cloud workloads to authenticate using X.509 certificates issued by your existing PKI (Public Key Infrastructure).
  • Eliminates the need for long-term access keys for on-premises workloads.
  • Supports credentials valid for up to 12 hours (extended from the original shorter duration).
  • Integrates with enterprise PKI so non-AWS workloads can use the same IAM policies and roles as AWS workloads.
  • Use cases include on-premises Kubernetes clusters, CI/CD pipelines running outside AWS, and hybrid cloud environments.

Confused Deputy Prevention

  • The confused deputy problem is a security issue where a less-privileged entity coerces a more-privileged service to perform actions on its behalf.
  • AWS recommends using the following global condition context keys in role trust policies and resource-based policies:
    • aws:SourceArn — restrict to a specific resource ARN (most effective)
    • aws:SourceAccount — restrict to a specific AWS account
    • aws:SourceOrgID — restrict to an AWS Organizations organization
    • aws:SourceOrgPaths — restrict to specific organizational units
  • These condition keys should always be used when granting service principals access to your resources.

Resource-based Policies

  • Resource-based policy allows you to attach a policy directly to the resource you want to share, instead of using a role as a proxy.
  • Resource-based policy specifies the Principal, in the form of a list of AWS account ID numbers, IAM role ARNs, or IAM user ARNs, that can access that resource and what actions they can perform.
  • Using cross-account access with a resource-based policy, the User still works in the trusted account and does not have to give up their permissions in place of the role permissions.
  • Users can work on the resources from both accounts at the same time and this can be useful for scenarios e.g. copying objects from one bucket to the other bucket in a different AWS account.
  • For same-account access, policy evaluation requires either the identity-based policy or the resource-based policy (but not both) to allow the request. For cross-account access, both an identity-based policy in the principal’s account and the resource-based policy on the resource must allow the request.
  • Resources that support resource-based policies include (but are not limited to):
    • Amazon S3 — Bucket policies for bucket and object access
    • Amazon SNS (Simple Notification Service)
    • Amazon SQS (Simple Queue Service)
    • Amazon S3 Glacier — Vault access policies
    • AWS Lambda — Function policies
    • AWS KMS — Key policies (required for KMS, every key must have one)
    • Amazon DynamoDB — Table, index, and stream policies (added 2024)
    • AWS Secrets Manager — Secret resource policies
    • Amazon EventBridge — Event bus policies
    • AWS Backup — Vault access policies
    • Amazon ECR — Repository policies
    • AWS CodeArtifact — Domain and repository policies
    • Amazon Bedrock AgentCore — Runtime and endpoint policies
  • Resource-based policies need the trusted account to create users with permissions to be able to access the resources from the trusted account.
  • Only permissions equivalent to, or less than, the permissions granted to your account by the resource owning account can be delegated.

Resource Control Policies (RCPs)

  • Resource Control Policies (RCPs) are a new type of authorization policy in AWS Organizations, launched at re:Invent 2024.
  • RCPs provide central control over the maximum available permissions on AWS resources across your entire organization.
  • RCPs complement Service Control Policies (SCPs):
    • SCPs — set maximum permissions for IAM principals (users and roles)
    • RCPs — set maximum permissions for AWS resources
  • RCPs help establish a data perimeter by centrally restricting external access to your resources at scale.
  • Supported services include: Amazon S3, AWS STS, AWS KMS, Amazon SQS, AWS Secrets Manager, Amazon Cognito, and Amazon CloudWatch Logs (expanding).
  • RCPs are applied organization-wide through AWS Organizations and can be attached to the organization root, OUs, or individual accounts.
  • AWS Sign-in now supports both resource-based policies and RCPs for the AWS Management Console, enabling restriction of console sign-in to expected networks.

AWS Resource Access Manager (RAM)

  • AWS RAM enables you to share resources with other AWS accounts or within your AWS Organization without using resource-based policies directly.
  • RAM eliminates the need to provision and manage duplicate resources in every account.
  • When sharing a resource, the receiving account’s IAM policies and permissions apply to the shared resource.
  • Supported resources include: VPC subnets, Transit Gateway, Route 53 Resolver rules, License Manager configurations, Aurora DB clusters, and many more.
  • RAM integrates with AWS Organizations to enable sharing without requiring individual account acceptance.

IAM Roles vs Resource-Based Policies – Key Differences

  • Permission Delegation: With IAM roles, the user gives up their original permissions and takes on role permissions. With resource-based policies, the user retains their original permissions.
  • Simultaneous Access: Resource-based policies allow users to work with resources in both accounts simultaneously. Roles do not.
  • Coverage: IAM roles can provide access to almost all AWS resources. Resource-based policies are limited to services that support them.
  • Session Policies: IAM roles support session policies for further restricting permissions. Resource-based policies do not support this concept.
  • Policy Evaluation: For cross-account access via roles, only the role’s identity-based policy determines effective permissions. For cross-account access via resource-based policies, both the caller’s identity-based policy and the resource policy must allow the action.

Best Practices for Cross-Account Access

  • Use IAM roles with temporary credentials instead of IAM users with long-term access keys.
  • Use the aws:PrincipalArn condition key in resource-based policies for a balance of security and availability.
  • Use the aws:PrincipalOrgId condition key to restrict access to your AWS Organization.
  • Use External ID in trust policies when granting access to third parties to prevent confused deputy attacks.
  • Implement the principle of least privilege in all cross-account policies.
  • Use RCPs to enforce organization-wide data perimeters on resources.
  • Regularly audit cross-account access using IAM Access Analyzer.
  • Consider using IAM Identity Center (formerly AWS SSO) with permission sets for centralized multi-account access management.

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. What are the two permission types used by AWS?
    1. Resource-based and Product-based
    2. Product-based and Service-based
    3. Service-based
    4. User-based and Resource-based
  2. What’s the policy used for cross-account access? (Choose 2)
    1. Trust policy
    2. Permissions Policy
    3. Key policy
  3. A company has two AWS accounts – Account A and Account B. Account A has an S3 bucket that Account B needs to access. The security team wants to ensure that if the IAM role in Account B is accidentally deleted and recreated, access is maintained. Which approach should be used in the bucket policy?
    1. Specify the IAM role ARN in the Principal element
    2. Specify the account number in the Principal element with an aws:PrincipalArn condition
    3. Specify the account number in the Principal element without any condition
    4. Use a service control policy
  4. An organization wants to centrally restrict external access to their AWS resources across all accounts. Which policy type should they use?
    1. Service Control Policies (SCPs)
    2. Identity-based policies
    3. Resource Control Policies (RCPs)
    4. Permission boundaries
  5. A developer needs to copy objects from an S3 bucket in Account A to an S3 bucket in Account B, and needs to access both buckets simultaneously. Which cross-account access method should be used?
    1. IAM Role in Account A
    2. IAM Role in Account B
    3. Resource-based policy on the S3 bucket in Account A
    4. AWS Resource Access Manager
  6. Which condition keys should be used to prevent the confused deputy problem when granting a service principal access to your resources? (Choose 2)
    1. aws:SourceArn
    2. aws:SourceAccount
    3. aws:PrincipalOrgId
    4. aws:RequestedRegion
  7. An on-premises server needs to access AWS resources using temporary credentials without managing long-term access keys. Which service should be used?
    1. AWS STS AssumeRole
    2. IAM User with MFA
    3. IAM Roles Anywhere
    4. AWS Directory Service

References

AWS Simple Notification Service – SNS

SNS Delivery Protocols
~ Last updated on : ~ jayendrapatil ~ 8 Comments

Simple Notification Service – SNS

  • Simple Notification Service – SNS is a web service that coordinates and manages the delivery or sending of messages to subscribing endpoints or clients.
  • SNS provides the ability to create a Topic which is a logical access point and communication channel.
  • Each topic has a unique name that identifies the SNS endpoint for publishers to post messages and subscribers to register for notifications.
  • Producers and Consumers communicate asynchronously with subscribers by producing and sending a message on a topic.
  • Producers push messages to the topic, they created or have access to, and SNS matches the topic to a list of subscribers who have subscribed to that topic and delivers the message to each of those subscribers.
  • Subscribers receive all messages published to the topics to which they subscribe, and all subscribers to a topic receive the same messages.
  • Subscribers (i.e., web servers, email addresses, SQS queues, AWS Lambda functions) consume or receive the message or notification over one of the supported protocols (i.e., SQS, HTTP/S, email, SMS, Lambda) when they are subscribed to the topic.
  • SNS supports two types of topics:
    • Standard topics – provide best-effort message ordering and at-least-once delivery. Support up to 100,000 topics and 12.5 million subscriptions per topic.
    • FIFO topics – provide strict message ordering, exactly-once message delivery, and message deduplication. Support up to 1,000 topics and 100 subscriptions per topic.

SNS Delivery Protocols

Accessing SNS

  • Amazon Management console
    • Amazon Management console is the web-based user interface that can be used to manage SNS
  • AWS Command-line Interface (CLI)
    • Provides commands for a broad set of AWS products, and is supported on Windows, Mac, and Linux.
  • AWS Tools for Windows Powershell
    • Provides commands for a broad set of AWS products for those who script in the PowerShell environment
  • AWS SNS Query API
    • Query API allows for requests are HTTP or HTTPS requests that use the HTTP verbs GET or POST and a Query parameter named Action
  • AWS SDK libraries
    • AWS provides libraries in various languages which provide basic functions that automate tasks such as cryptographically signing your requests, retrying requests, and handling error responses

SNS Supported Transport Protocols

  • HTTP, HTTPS – Subscribers specify a URL as part of the subscription registration; notifications will be delivered through an HTTP POST to the specified URL.
  • Email, Email-JSON – Messages are sent to registered addresses as email. Email-JSON sends notifications as a JSON object, while Email sends text-based email.
  • SQS – Users can specify an SQS queue as the endpoint; SNS will enqueue a notification message to the specified queue (which subscribers can then process using SQS APIs such as ReceiveMessage, DeleteMessage, etc.)
  • SMS – Messages are sent to registered phone numbers as SMS text messages.
    • Note: As of September 2024, Amazon SNS delivers SMS text messages via AWS End User Messaging. Existing SNS SMS APIs continue to work, but new phone numbers requested after Sept 24, 2024 require explicit permissions to be granted to Amazon SNS.
  • Lambda – SNS can invoke Lambda functions with the payload of the published message.
  • Amazon Data Firehose – Deliver events to delivery streams for archiving and analysis purposes (formerly known as Kinesis Data Firehose, renamed Feb 2024).

SNS Supported Endpoints

  • Email Notifications
    • SNS provides the ability to send Email notifications
  • Mobile Push Notifications
    • SNS provides an ability to send push notification messages directly to apps on mobile devices. Push notification messages sent to a mobile endpoint can appear in the mobile app as message alerts, badge updates, or even sound alerts
    • Supported push notification services
      • Amazon Device Messaging (ADM)
      • Apple Push Notification Service (APNs)
      • Firebase Cloud Messaging (FCM) – previously Google Cloud Messaging (GCM), which was deprecated April 2019. SNS added FCM HTTP v1 API support in January 2024. The legacy FCM API was removed by Google in June 2024.
      • Windows Push Notification Service (WNS) for Windows 8+ and Windows Phone 8.1+
      • Baidu Cloud Push for Android devices in China
    • Note: Microsoft Push Notification Service (MPNS) for Windows Phone 7+ has been deprecated and is no longer supported.
  • SQS Queues
    • SNS with SQS provides the ability for messages to be delivered to applications that require immediate notification of an event, and also persist in an SQS queue for other applications to process at a later time
    • SNS allows applications to send time-critical messages to multiple subscribers through a “push” mechanism, eliminating the need to periodically check or “poll” for updates.
    • SQS can be used by distributed applications to exchange messages through a polling model, and can be used to decouple sending and receiving components, without requiring each component to be concurrently available.
  • SMS Notifications
    • SNS provides the ability to send and receive Short Message Service (SMS) notifications to SMS-enabled mobile phones and smart phones
    • SMS delivery is now handled through AWS End User Messaging, providing enhanced features like SMS resource management, two-way messaging, granular resource permissions, and country block rules.
  • HTTP/HTTPS Endpoints
    • SNS provides the ability to send notification messages to one or more HTTP or HTTPS endpoints. When you subscribe an endpoint to a topic, you can publish a notification to the topic and Amazon SNS sends an HTTP POST request delivering the contents of the notification to the subscribed endpoint
  • Lambda
    • SNS and Lambda are integrated so Lambda functions can be invoked with SNS notifications.
    • When a message is published to an SNS topic that has a Lambda function subscribed to it, the Lambda function is invoked with the payload of the published message
  • Amazon Data Firehose
    • Deliver events to delivery streams for archiving and analysis purposes.
    • Through delivery streams, events can be delivered to AWS destinations like S3, Redshift, and OpenSearch Service, or to third-party destinations such as Datadog, New Relic, MongoDB, and Splunk.
    • Note: Amazon Kinesis Data Firehose was renamed to Amazon Data Firehose in February 2024.

SNS FIFO Topics

  • SNS FIFO (First-In-First-Out) topics provide strict message ordering and exactly-once message delivery combined with deduplication.
  • Message Ordering – Messages are delivered in the exact order in which they are published to the topic, using message group IDs.
  • Message Deduplication – Prevents duplicate messages from being delivered within a 5-minute deduplication interval using either content-based deduplication or a deduplication ID.
  • Supported Subscriptions – FIFO topics can only deliver messages to SQS FIFO queues.
  • Message Filtering – FIFO topics support the same subscription filter policies as standard topics.
  • Message Archiving and Replay (launched Oct 2023) – Topic owners can set an archive policy with retention up to 365 days. Subscribers can set a replay policy to retrieve and redeliver archived messages using timestamps.
  • High Throughput Mode – Supports higher message throughput per message group with the FifoThroughputScope attribute.
  • Use Cases – Bank transaction logging, stock monitoring, flight tracking, inventory management, price update applications.

SNS Message Filtering

  • SNS message filtering allows subscribers to receive only a subset of messages published to a topic by setting subscription filter policies.
  • Attribute-based filtering – Filter messages based on message attributes (original capability).
  • Payload-based filtering (launched Nov 2022) – Filter messages based on message body content, enabling filtering of events from 60+ AWS services that publish to SNS without message attributes.
  • Filter policy scope can be set to MessageAttributes or MessageBody.
  • Total combination of values in a filter policy must not exceed 150.
  • If no filter policy is set, the subscriber receives all messages published to the topic.

SNS Message Security and Encryption

  • Server-Side Encryption (SSE) – SNS supports encryption at rest using AWS KMS. Messages are stored in encrypted form and only decrypted when delivered.
  • Only the message body is encrypted; message attributes, resource metadata, and metrics remain unencrypted.
  • All requests to SNS topics with SSE activated must use HTTPS and Signature Version 4.
  • In-transit encryption – All SNS API requests use HTTPS with TLS 1.2 or later recommended.

SNS Dead-Letter Queues

  • SNS supports dead-letter queues (DLQ) for capturing messages that cannot be delivered to subscribed endpoints.
  • Messages that fail delivery due to client errors or server errors are held in the DLQ for further analysis or reprocessing.
  • A DLQ is an Amazon SQS queue attached to an SNS subscription (not the topic itself).
  • Useful for debugging and recovering from delivery failures.

SNS Message Batching

  • The PublishBatch API allows publishing up to 10 messages in a single API request.
  • Reduces the number of API calls required for high-volume publishers.
  • Supports both standard and FIFO topics.

SNS Cross-Region Delivery

  • SNS supports cross-region delivery of messages to SQS queues and Lambda functions in other AWS Regions.
  • As of July 2025, SNS enhanced cross-region delivery capabilities to support delivery from default-enabled Regions to opt-in Regions.

SNS Message Data Protection

⚠️ Feature No Longer Available to New Customers

Amazon SNS message data protection is no longer available to new customers effective April 30, 2026.

Existing customers with configured data protection policies can continue to use the feature, but no new enhancements will be introduced.

Recommended Alternative: An AWS Lambda-based architecture using Amazon Bedrock Guardrails for real-time sensitive data detection and protection. See the AWS Samples repository for implementation guidance.

  • SNS message data protection could scan messages in real time for PII/PHI data and provide audit reports.
  • Supported operations: Audit (log sensitive data findings), Deny (block messages with sensitive data), and Redact (mask sensitive data).

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. Which of the following notification endpoints or clients does Amazon Simple Notification Service support? Choose 2 answers
    1. Email
    2. CloudFront distribution
    3. File Transfer Protocol
    4. Short Message Service
    5. Simple Network Management Protocol
  2. What happens when you create a topic on Amazon SNS?
    1. The topic is created, and it has the name you specified for it.
    2. An ARN (Amazon Resource Name) is created
    3. You can create a topic on Amazon SQS, not on Amazon SNS.
    4. This question doesn’t make sense.
  3. A user has deployed an application on his private cloud. The user is using his own monitoring tool. He wants to configure that whenever there is an error, the monitoring tool should notify him via SMS. Which of the below mentioned AWS services will help in this scenario?
    1. None because the user infrastructure is in the private cloud/
    2. AWS SNS
    3. AWS SES
    4. AWS SMS
  4. A user wants to make so that whenever the CPU utilization of the AWS EC2 instance is above 90%, the redlight of his bedroom turns on. Which of the below mentioned AWS services is helpful for this purpose?
    1. AWS CloudWatch + AWS SES
    2. AWS CloudWatch + AWS SNS
    3. It is not possible to configure the light with the AWS infrastructure services
    4. AWS CloudWatch and a dedicated software turning on the light
  5. A user is trying to understand AWS SNS. To which of the below mentioned end points is SNS unable to send a notification?
    1. Email JSON
    2. HTTP
    3. AWS SQS
    4. AWS SES
  6. A user is running a webserver on EC2. The user wants to receive the SMS when the EC2 instance utilization is above the threshold limit. Which AWS services should the user configure in this case?
    1. AWS CloudWatch + AWS SES
    2. AWS CloudWatch + AWS SNS
    3. AWS CloudWatch + AWS SQS
    4. AWS EC2 + AWS CloudWatch
  7. A user is planning to host a mobile game on EC2 which sends notifications to active users on either high score or the addition of new features. The user should get this notification when he is online on his mobile device. Which of the below mentioned AWS services can help achieve this functionality?
    1. AWS Simple Notification Service
    2. AWS Simple Queue Service
    3. AWS Mobile Communication Service
    4. AWS Simple Email Service
  8. You are providing AWS consulting service for a company developing a new mobile application that will be leveraging amazon SNS push for push notifications. In order to send direct notification messages to individual devices each device registration identifier or token needs to be registered with SNS, however the developers are not sure of the best way to do this. You advise them to: –
    1. Bulk upload the device tokens contained in a CSV file via the AWS Management Console
    2. Let the push notification service (e.g. Amazon Device messaging) handle the registration
    3. Implement a token vending service to handle the registration
    4. Call the CreatePlatformEndpoint API function to register multiple device tokens. (Refer documentation)
  9. A company is running a batch analysis every hour on their main transactional DB running on an RDS MySQL instance to populate their central Data Warehouse running on Redshift. During the execution of the batch their transactional applications are very slow. When the batch completes they need to update the top management dashboard with the new data. The dashboard is produced by another system running on-premises that is currently started when a manually-sent email notifies that an update is required The on-premises system cannot be modified because is managed by another team. How would you optimize this scenario to solve performance issues and automate the process as much as possible?
    1. Replace RDS with Redshift for the batch analysis and SNS to notify the on-premises system to update the dashboard
    2. Replace RDS with Redshift for the batch analysis and SQS to send a message to the on-premises system to update the dashboard
    3. Create an RDS Read Replica for the batch analysis and SNS to notify the on-premises system to update the dashboard
    4. Create an RDS Read Replica for the batch analysis and SQS to send a message to the on-premises system to update the dashboard.
  10. Which of the following are valid SNS delivery transports? Choose 2 answers.
    1. HTTP
    2. UDP
    3. SMS
    4. DynamoDB
    5. Named Pipes
  11. What is the format of structured notification messages sent by Amazon SNS?
    1. An XML object containing MessageId, UnsubscribeURL, Subject, Message and other values
    2. An JSON object containing MessageId, DuplicateFlag, Message and other values
    3. An XML object containing MessageId, DuplicateFlag, Message and other values
    4. An JSON object containing MessageId, unsubscribeURL, Subject, Message and other values
  12. Which of the following are valid arguments for an SNS Publish request? Choose 3 answers.
    1. TopicArn
    2. Subject
    3. Destination
    4. Format
    5. Message
    6. Language
  13. A company requires strict message ordering for their financial transaction processing system. Which SNS feature should they use?
    1. Standard topics with message attributes
    2. FIFO topics with message group IDs
    3. Standard topics with delivery policies
    4. FIFO topics with dead-letter queues only
  14. An application publishes thousands of events per second to an SNS topic. Subscribers only need to process events matching specific criteria. What is the most efficient approach?
    1. Have each subscriber receive all messages and filter locally
    2. Create separate topics for each message type
    3. Use SNS subscription filter policies to deliver only matching messages
    4. Use SQS queues with consumer-side filtering
  15. Which of the following statements about SNS FIFO topics are correct? Choose 2 answers.
    1. FIFO topics provide exactly-once message delivery
    2. FIFO topics support delivery to HTTP/HTTPS endpoints
    3. FIFO topics can deliver to up to 12.5 million subscriptions
    4. FIFO topics support message archiving and replay
    5. FIFO topics can deliver to Lambda functions directly
  16. A development team needs to filter SNS messages based on message body content from S3 event notifications. Which feature should they use?
    1. Message attributes filtering with attribute-based scope
    2. Payload-based message filtering with MessageBody scope
    3. Lambda function to filter before forwarding
    4. SQS message filtering

References

AWS Simple Email Service – SES

~ Last updated on : ~ jayendrapatil

AWS Simple Email Service – SES

  • SES is a fully managed, cloud-based email service that provides an easy, cost-effective way to send and receive email using your own email addresses and domains.
  • can be used to send both transactional and marketing emails securely, and globally at scale.
  • processes over a trillion emails each year for customers worldwide across various industries.
  • acts as an outbound email server and eliminates the need to support its own software or applications to do the heavy lifting of email transport.
  • acts as an inbound email server to receive emails that can help develop software solutions such as email autoresponders, email unsubscribe systems, and applications that generate customer support tickets from incoming emails.
  • existing email server can also be configured to send outgoing emails through SES with no change in any settings in the email clients.
  • Maximum message size including attachments is 40 MB per message (after base64 encoding) when using the SESv2 API or SMTP.
  • integrated with CloudWatch, CloudTrail, Amazon EventBridge, and Amazon SNS for monitoring and notifications.
  • available in 24 AWS Regions, including AWS GovCloud (US) Regions.

SES Key Features

  • Compatible with SMTP
  • Applications can send email using the SES API (v2 recommended), AWS SDKs in many supported languages (Java, .NET, PHP, Python, Ruby, Go, JavaScript), or the AWS CLI.
  • Optimized for the highest levels of uptime, availability, and scales as per the demand.
  • Provides sandbox environment for testing.
  • provides Reputation dashboard, performance insights, anti-spam feedback.
  • provides statistics on email deliveries, bounces, feedback loop results, emails opened, clicks, etc.
  • supports DomainKeys Identified Mail (DKIM), Sender Policy Framework (SPF), and Domain-based Message Authentication, Reporting and Conformance (DMARC).
  • supports flexible deployment: shared, dedicated, and managed dedicated IPs (M-DIPs).
  • supports attachments with many popular content formats, including documents, images, audio, and video, and scans every attachment for viruses and malware.
  • integrates with KMS to provide the ability to encrypt the mail that it writes to the S3 bucket.
  • uses client-side encryption to encrypt the mail before it sends the email to S3.
  • supports inline email templates directly within API requests, eliminating the need to manage template resources separately.
  • supports HTTPS custom tracking domains for open and click tracking.
  • supports configurable maximum delivery time for time-sensitive messages.
  • enables customers to connect an SES SMTP endpoint to a VPC through a VPC endpoint powered by AWS PrivateLink.

SES v2 API

  • AWS recommends using the SESv2 API for all new implementations.
  • While SESv1 API continues to be supported, all new features and capabilities are only available through the SESv2 API.
  • SESv2 API supports email size of up to 40 MB for both inbound and outbound emails by default.
  • Migrating to SESv2 API provides access to features like Virtual Deliverability Manager, Mail Manager, Tenants, and Global Endpoints.

Virtual Deliverability Manager (VDM)

  • VDM is an SES feature that helps enhance email deliverability by providing insights into sending and delivery data.
  • provides three core components:
    • Deliverability Insights – view at-a-glance reports on sending and delivery data (bounce rates, opens, clicks) broken down by ISP, sender identity, and configuration set.
    • Recommendations – notifies senders of deliverability issues and provides actionable recommendations (e.g., DKIM, DMARC configuration issues, BIMI gap detection).
    • Automatic Implementation – option to allow SES to automatically implement email deliverability improvements like optimizing delivery patterns.
  • includes automated complaint rate insights as an early warning system to protect sender reputation.
  • tracks every email’s journey, uncovering opportunities to improve delivery and engagement rates.

Mail Manager

  • Mail Manager (launched May 2024) provides comprehensive tools to simplify managing large volumes of email communications.
  • acts as a centralized email gateway for routing, filtering, archiving, and compliance across inbound, outbound, and internal email.
  • Key capabilities include:
    • Ingress Endpoints – dedicated email ingress points with IP filtering, TLS, and mutual TLS (mTLS) authentication support.
    • Rules Engine – powerful rule-based email processing with conditions and actions for routing, archiving, and security enforcement.
    • Traffic Policies – enforce sophisticated email traffic filtering policies.
    • SMTP Relay – relay emails to Google Workspace, Microsoft 365, or other email destinations.
    • Email Archiving – flexible archiving features to meet compliance and record-keeping requirements.
    • Full Lifecycle Logging – end-to-end logging to CloudWatch, S3, and Firehose.
  • integrates with Amazon Q Business for email indexing and queries.
  • supports email journaling and echo spoofing prevention.
  • available in 17+ AWS Regions including AWS GovCloud (US).
  • supports Lambda function invocation and Bounce actions directly in rules (added April 2026).

Global Endpoints

  • Global Endpoints (launched December 2024) provides multi-region resilience for email sending.
  • allows customers to add a secondary Region, dividing workloads equally in a load-balanced state.
  • if either Region suffers an outage, traffic automatically shifts to the healthy Region with no customer intervention.
  • both Regions develop warmed-up IPs in parallel, ensuring both are ready to support 100% of workload at any time.
  • synchronizes critical parameters between chosen Regions automatically.
  • compatible with Virtual Deliverability Manager (VDM) and Dedicated IPs (DIPs/M-DIPs).

Tenant Management

  • SES Tenant Management (launched August 2025) enables isolation and reputation management at the individual tenant level.
  • allows creation of up to 10,000 isolated tenants within a single AWS account (increasable to 300,000 on request).
  • each tenant can have its own email identities, configuration sets, templates, and independent reputation metrics.
  • addresses the challenge where one tenant’s poor email practices could previously pause an entire SES account.
  • includes automated pause mechanism to limit damage from problematic senders.
  • enables organizations to manage multiple email streams independently while maintaining centralized oversight.

Dedicated IPs

  • SES supports three types of IP deployment:
    • Shared IPs – default, cost-effective option; reputation determined by all emails sent from the shared pool.
    • Dedicated IPs (Standard) – customer leases dedicated IPs for sole sending reputation control; requires manual warm-up.
    • Dedicated IPs (Managed / M-DIPs) – AWS automates provisioning, warming up, and scaling of dedicated IPs; pool automatically scales based on usage and ISP policies.
  • Managed Dedicated IPs eliminate manual support cases and handle IP warmup per ISP individually.

Email Authentication & Bulk Sender Requirements

  • Gmail and Yahoo implemented new requirements for bulk senders (5,000+ messages/day) effective February 2024, with Microsoft following in May 2025.
  • Requirements include:
    • Domain Authentication – SPF, DKIM passing; DMARC record with at least p=none.
    • One-Click Unsubscribe – RFC 8058 List-Unsubscribe and List-Unsubscribe-Post headers required for bulk/marketing mail.
    • Low Complaint Rates – spam complaint rates must stay under 0.3% threshold.
  • SES supports one-click unsubscribe through the subscription management feature and List-Unsubscribe headers.
  • SES supports BIMI (Brand Indicators for Message Identification) with VDM gap detection.

Event Publishing & Monitoring

  • SES can publish email sending events to multiple destinations:
    • Amazon CloudWatch
    • Amazon Data Firehose
    • Amazon SNS
    • Amazon EventBridge (added June 2024) – enables routing events to any EventBridge-supported service.
  • Supported event types include: Send, Delivery, Bounce, Complaint, Open, Click, Rendering Failure, Delivery Delay, Subscription.
  • VDM Advisor recommendations are also published to EventBridge.
  • supports custom values in feedback headers for better tracking transparency.
  • TLS version auto-tagging for outgoing messages provides visibility into connection security.

Sending Limits

  • Production SES has a set of sending limits which include:
    • Sending Quota – max number of emails in a 24-hour period.
    • Maximum Send Rate – max number of emails per second.
  • SES automatically adjusts the limits upward as long as emails are of high quality and they are sent in a controlled manner, as any spike in the email sent might be considered to be spam.
  • Limits can also be raised by submitting a Quota increase request.

Email Receiving

  • SES provides complete control over which emails are accepted and what to do with them.
  • Accept or reject mail based on email address, IP address, or domain of the sender.
  • After accepting email, actions include:
    • Store in an Amazon S3 bucket
    • Execute custom code using AWS Lambda
    • Publish notifications to Amazon SNS
    • Route through Mail Manager rules for advanced processing
  • Mail Manager extends receiving capabilities with SMTP relay to Google Workspace, Microsoft 365, or Amazon Connect.

SES Best Practices

  • Send high-quality and real production content that the recipients want.
  • Only send to those who have signed up for the mail.
  • Implement one-click unsubscribe (RFC 8058) for bulk/marketing emails to comply with Gmail/Yahoo/Microsoft requirements.
  • Unsubscribe recipients who have not interacted with the business recently.
  • Have low bounce and complaint rates and remove bounced or complained addresses, using SNS or EventBridge to monitor bounces and complaints, treating them as an opt-out.
  • Implement SPF, DKIM, and DMARC authentication for all sending domains.
  • Monitor the sending activity using VDM dashboards and reputation metrics.
  • Keep spam complaint rates below 0.3%.
  • Use Global Endpoints for multi-region resilience for critical email workloads.
  • Use Tenant Management to isolate reputation for multi-tenant email platforms.

Amazon Pinpoint Migration Note

  • Amazon Pinpoint will reach end of support on October 30, 2026 (no new customers accepted since May 20, 2025).
  • For email capabilities, customers should migrate to Amazon SES with:
    • SES for transactional and bulk email sending
    • SES Tenant Management for multi-tenant isolation
    • SES Mail Manager for routing and compliance
    • AWS End User Messaging for SMS/push notification channels

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. What does Amazon SES stand for?
    1. Simple Elastic Server
    2. Simple Email Service
    3. Software Email Solution
    4. Software Enabled Server
  2. Your startup wants to implement an order fulfillment process for selling a personalized gadget that needs an average of 3-4 days to produce with some orders taking up to 6 months you expect 10 orders per day on your first day. 1000 orders per day after 6 months and 10,000 orders after 12 months. Orders coming in are checked for consistency then dispatched to your manufacturing plant for production quality control packaging shipment and payment processing. If the product does not meet the quality standards at any stage of the process employees may force the process to repeat a step. Customers are notified via email about order status and any critical issues with their orders such as payment failure. Your case architecture includes AWS Elastic Beanstalk for your website with an RDS MySQL instance for customer data and orders. How can you implement the order fulfillment process while making sure that the emails are delivered reliably? [PROFESSIONAL]
    1. Add a business process management application to your Elastic Beanstalk app servers and re-use the RDS database for tracking order status use one of the Elastic Beanstalk instances to send emails to customers.
    2. Use SWF with an Auto Scaling group of activity workers and a decider instance in another Auto Scaling group with min/max=1 Use the decider instance to send emails to customers.
    3. Use SWF with an Auto Scaling group of activity workers and a decider instance in another Auto Scaling group with min/max=1 use SES to send emails to customers.
    4. Use an SQS queue to manage all process tasks Use an Auto Scaling group of EC2 Instances that poll the tasks and execute them. Use SES to send emails to customers.
  3. A company sends millions of marketing emails daily using Amazon SES. They need to ensure emails continue to be delivered even if one AWS Region experiences an outage. What SES feature should they use?
    1. Virtual Deliverability Manager with automatic recommendations
    2. Dedicated IPs (Managed) with automatic warmup
    3. Global Endpoints with a primary and secondary Region configuration
    4. Mail Manager with SMTP relay to multiple regions
  4. A SaaS company uses Amazon SES to send emails on behalf of hundreds of customers. They want to ensure that one customer’s poor email practices do not affect the sending reputation of other customers. What is the MOST appropriate solution?
    1. Create separate AWS accounts for each customer
    2. Use separate configuration sets for each customer
    3. Use dedicated IPs for each customer
    4. Use SES Tenant Management to create isolated tenants with independent reputation metrics
  5. A company needs to process incoming emails, archive them for compliance, apply security filtering, and route them to different internal systems based on recipient addresses. Which Amazon SES feature provides this capability?
    1. SES receipt rules with S3 actions
    2. Virtual Deliverability Manager
    3. SES Mail Manager with ingress endpoints, traffic policies, and rules engine
    4. SES event publishing with EventBridge
  6. A company sending bulk marketing emails through Amazon SES notices that their inbox placement rate has dropped. They want SES to automatically optimize email delivery patterns without manual intervention. Which feature should they enable?
    1. Dedicated IPs (Managed)
    2. Mail Manager traffic policies
    3. Virtual Deliverability Manager with automatic implementation enabled
    4. Global Endpoints with load balancing
  7. Which of the following are requirements that Gmail and Yahoo enforce for bulk email senders since February 2024? (Select THREE)
    1. SPF and DKIM authentication with a DMARC record
    2. Use of dedicated IP addresses
    3. One-click unsubscribe support (RFC 8058)
    4. Use of the SESv2 API
    5. Spam complaint rate below 0.3%
    6. Mandatory use of VPC endpoints

References

AWS Services Overview – Whitepaper – Certification

~ Last updated on : ~ jayendrapatil ~ 9 Comments

AWS Services Overview

AWS consists of many cloud services that can be used in combinations tailored to meet business or organizational needs. This section introduces the major AWS services by category.

NOTE – This post provides a brief overview of AWS services. It is a good introduction to start all certifications. However, it is most relevant and important for the AWS Cloud Practitioner Certification Exam.

Last updated: June 2026. Reflects current AWS service names, deprecations, and new services launched through 2024-2026.

Common Features

  • Almost all features can be access-controlled through AWS Identity and Access Management (IAM)
  • Services managed by AWS are all made Scalable and Highly Available, without any changes needed from the user
  • Most services support encryption at rest and in transit by default

AWS Access

AWS allows accessing its services through unified tools using

  • AWS Management Console – a simple and intuitive user interface
  • AWS Command Line Interface (CLI) – programmatic access through scripts
  • AWS Software Development Kits (SDKs) – programmatic access through Application Program Interface (API) tailored for programming languages (Java, .NET, Node.js, PHP, Python, Ruby, Go, C++, Rust, Kotlin, Swift) or platforms (Android, Browser, iOS)
  • AWS CloudShell – a browser-based shell environment pre-authenticated with console credentials
  • Infrastructure as Code (IaC) – AWS CloudFormation, AWS CDK, or Terraform for declarative resource provisioning

Security, Identity, and Compliance

AWS Identity and Access Management (IAM)

  • enables you to securely control access to AWS services and resources for the users.
  • allows creation of AWS users, groups and roles, and use permissions to allow and deny their access to AWS resources
  • helps manage IAM users and their access with individual security credentials like access keys, passwords, and multi-factor authentication devices, or request temporary security credentials
  • helps role creation & manage permissions to control which operations can be performed by which entity, or AWS service, that assumes the role
  • enables identity federation to allow existing identities in the enterprise to access AWS without the need to create an IAM user for each identity.
  • IAM Identity Center (formerly AWS SSO) provides centralized workforce identity management and single sign-on access to multiple AWS accounts and applications.

Amazon Inspector

  • is an automated vulnerability management service that continually scans workloads for software vulnerabilities and unintended network exposure.
  • automatically discovers and scans EC2 instances, container images in Amazon ECR, and AWS Lambda functions.
  • supports both agent-based and agentless scanning for EC2 instances.
  • produces a detailed list of security findings prioritized by a contextualized risk score that correlates CVE information with network access and exploitability factors.
  • integrates with AWS Security Hub for centralized findings management.

AWS Certificate Manager

  • helps provision, manage, and deploy Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services like ELB, CloudFront, and API Gateway
  • removes the time-consuming manual process of purchasing, uploading, and renewing SSL/TLS certificates.

AWS CloudHSM

  • helps meet corporate, contractual, and regulatory compliance requirements for data security by using dedicated Hardware Security Module (HSM) appliances within the AWS Cloud.
  • allows protection of encryption keys within HSMs, designed and validated to government standards for secure key management.
  • helps comply with strict key management requirements without sacrificing application performance.

AWS Directory Service

  • provides Microsoft Active Directory (Enterprise Edition), also known as AWS Managed Microsoft AD, that enables directory-aware workloads and AWS resources to use managed Active Directory in the AWS Cloud.

AWS Key Management Service (KMS)

  • is a managed service that makes it easy to create and control the encryption keys used to encrypt your data.
  • uses HSMs to protect the security of your keys.
  • integrates with most AWS services for seamless encryption of data at rest.

AWS Organizations

  • allows creation of AWS account groups, to more easily manage security and automation settings collectively
  • helps centrally manage multiple accounts to help scale.
  • helps control which AWS services are available to individual accounts using Service Control Policies (SCPs), automate new account creation, and simplify billing.

AWS Shield

  • is a managed Distributed Denial of Service (DDoS) protection service that safeguards web applications running on AWS.
  • provides always-on detection and automatic inline mitigations that minimize application downtime and latency.
  • provides two tiers: Shield Standard (free, automatic) and Shield Advanced (paid, enhanced protection with 24/7 DDoS Response Team access).

AWS WAF

  • is a web application firewall that helps protect web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources.
  • gives complete control over which traffic to allow or block to web application by defining customizable web security rules.
  • integrates with CloudFront, Application Load Balancer, API Gateway, and AWS AppSync.

Amazon GuardDuty

  • is a threat detection service that continuously monitors AWS accounts, workloads, and data for malicious activity and anomalous behavior.
  • analyzes events from AWS CloudTrail, VPC Flow Logs, DNS logs, and other sources using machine learning and threat intelligence.
  • provides actionable security findings with severity levels for prioritized response.

Amazon Macie

  • is a data security service that discovers sensitive data using machine learning and pattern matching.
  • automatically discovers and protects sensitive data stored in Amazon S3, such as personally identifiable information (PII) and financial data.
  • provides visibility into data security risks and enables automated protection.

AWS Security Hub

  • provides a comprehensive view of your security posture across AWS accounts.
  • aggregates, organizes, and prioritizes security findings from multiple AWS services (GuardDuty, Inspector, Macie) and AWS Partner solutions.
  • automates security checks against best practices and industry standards.

Amazon Security Lake

  • automatically centralizes security data from AWS environments, SaaS providers, and on-premises sources into a purpose-built data lake.
  • normalizes data using the Open Cybersecurity Schema Framework (OCSF) for easier analysis.
  • stores data in your account using S3, giving you full control and ownership.

AWS Compute Services

Amazon Elastic Compute Cloud (EC2)

  • provides secure, resizable compute capacity
  • provides complete control of the computing resources (root access, ability to start, stop, terminate instances etc.)
  • reduces the time required to obtain and boot new instances to minutes
  • allows quick scaling of capacity, both up and down, as computing requirements change
  • provides developers and sysadmins tools to build failure-resilient applications and isolate themselves from common failure scenarios.
  • Benefits
    • Elastic Web-Scale Computing – enables scaling to increase or decrease capacity within minutes.
    • Flexible Cloud Hosting Services – flexibility to choose from multiple instance types (including AWS Graviton-based ARM instances for better price-performance), operating systems, and software packages.
    • Reliable – offers a highly reliable environment where replacement instances can be rapidly commissioned. EC2 SLA commitment is 99.99% availability for each Region.
    • Secure – works in conjunction with VPC to provide security and robust networking functionality. Allows control of IP address, exposure to Internet (using subnets), inbound and outbound access (using Security groups and NACLs).
    • Inexpensive – pay only for the capacity actually used
  • EC2 Purchasing Options
    • On-Demand Instances – pay for compute capacity by the hour or second with no long-term commitments.
    • Savings Plans – flexible pricing model offering up to 72% savings in exchange for a commitment to a consistent amount of usage (measured in $/hour) for a 1 or 3-year term. Available as Compute Savings Plans or EC2 Instance Savings Plans.
    • Reserved Instances – provides significant discount (up to 72%) compared to On-Demand pricing for a 1 or 3-year commitment to a specific instance type.
    • Spot Instances – allows use of spare EC2 computing capacity at up to 90% discount compared to On-Demand pricing. Instances can be interrupted by AWS with a 2-minute warning.
    • Dedicated Instances – run on hardware dedicated to a single customer for additional isolation.
    • Dedicated Hosts – physical servers with EC2 instance capacity fully dedicated to your use, allowing use of existing server-bound software licenses.

Amazon Elastic Container Service (ECS)

  • is a fully managed container orchestration service that supports Docker containers.
  • allows running applications on a managed cluster of EC2 instances or serverlessly with AWS Fargate.
  • eliminates the need to install, operate, and scale cluster management infrastructure.
  • can schedule the placement of containers across the cluster based on resource needs and availability requirements.
  • integrates with Elastic Load Balancing, VPC, IAM, CloudWatch, and other AWS services.

Amazon Elastic Kubernetes Service (EKS)

  • is a managed Kubernetes service that makes it easy to run Kubernetes on AWS without needing to install and operate your own Kubernetes control plane.
  • runs upstream Kubernetes, ensuring compatibility with existing Kubernetes applications and tools.
  • automatically manages the availability and scalability of the Kubernetes control plane nodes.
  • supports running pods on EC2 instances, AWS Fargate (serverless), or on-premises with EKS Anywhere.
  • EKS Auto Mode automatically provisions and manages compute, networking, and storage for Kubernetes clusters.

Amazon Elastic Container Registry (ECR)

  • is a fully managed Docker container registry that makes it easy to store, manage, and deploy Docker container images.
  • is integrated with Amazon ECS and EKS, simplifying development to production workflow.
  • eliminates the need to operate container repositories or worry about scaling the underlying infrastructure.
  • supports OCI images and artifacts, private and public repositories.

AWS Fargate

  • is a serverless compute engine for containers that works with both Amazon ECS and Amazon EKS.
  • removes the need to provision, configure, or scale clusters of virtual machines to run containers.
  • allocates the right amount of compute resources, eliminating the need to choose instance types or manage scaling.
  • each task or pod runs in its own isolated environment for workload isolation by design.

Amazon Lightsail

  • is designed to be the easiest way to launch and manage a virtual private server with AWS.
  • plans include everything needed to jumpstart a project – a virtual machine, SSD-based storage, data transfer, DNS management, and a static IP address – for a low, predictable price.

AWS Batch

  • enables developers, scientists, and engineers to easily and efficiently run hundreds of thousands of batch computing jobs on AWS.
  • dynamically provisions the optimal quantity and type of compute resources based on the volume and specific resource requirements of the batch jobs submitted.
  • plans, schedules, and executes the batch computing workloads across the full range of AWS compute services and features.

AWS Elastic Beanstalk

  • is an easy-to-use service for deploying and scaling web applications and services developed with Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker on familiar servers such as Apache, Nginx, Passenger, and IIS.
  • automatically handles the deployment, from capacity provisioning, load balancing, and auto scaling to application health monitoring.
  • provides full control over the AWS resources with access to the underlying resources at any time.

AWS Lambda

  • enables running code without provisioning or managing servers, with automatic scaling for high availability.
  • pay only for the compute time consumed – there is no charge when the code is not running.
  • can be triggered from other AWS services or called directly from any web or mobile app.
  • supports container images up to 10 GB, up to 10 GB of memory, and execution durations up to 15 minutes.
  • supports multiple runtimes including Node.js, Python, Java, .NET, Go, Ruby, and custom runtimes.

AWS App Runner

  • is a fully managed service for building, deploying, and running containerized web applications and APIs at scale.
  • automatically builds and deploys from source code or container images with no infrastructure management required.
  • handles load balancing, scaling, and TLS certificate management automatically.

Auto Scaling

  • helps maintain application availability
  • allows scaling EC2 capacity up or down automatically according to defined conditions or demand spikes to reduce cost
  • helps ensure desired number of EC2 instances are running always
  • AWS Auto Scaling provides unified scaling for multiple resources (EC2, ECS, DynamoDB, Aurora) through scaling plans.
  • supports target tracking, step scaling, and predictive scaling policies.

Storage

Amazon Simple Storage Service (S3)

  • is object storage with a simple web service interface to store and retrieve any amount of data from anywhere on the web.
  • S3 Features
    • Durable – designed for durability of 99.999999999% (11 nines) of objects. Data is redundantly stored across multiple facilities and multiple devices in each facility.
    • Available – designed for up to 99.99% availability (Standard) of objects over a given year.
    • Scalable – can store virtually unlimited data
    • Secure – supports data in transit over SSL and data at rest encryption. Bucket policies, ACLs, and IAM can manage object permissions. S3 Block Public Access provides account-level settings to prevent unintended public access.
    • Storage Classes – multiple classes for different use cases:
      • S3 Standard – frequently accessed data
      • S3 Intelligent-Tiering – automatically moves data between access tiers based on usage patterns
      • S3 Standard-IA – infrequently accessed data
      • S3 One Zone-IA – infrequently accessed, single-AZ
      • S3 Glacier Instant Retrieval – archive with millisecond retrieval
      • S3 Glacier Flexible Retrieval (formerly Glacier) – archive with minutes to hours retrieval
      • S3 Glacier Deep Archive – lowest-cost archive with 12-48 hour retrieval
    • Lifecycle Policies – automatically transition data between storage classes

Amazon Elastic Block Store (EBS)

  • provides persistent block storage volumes for use with EC2 instances
  • offers the consistent and low-latency performance needed to run workloads.
  • allows scaling up or down within minutes
  • EBS Features
    • High Performance Volumes – Choose between SSD-backed (gp3, io2 Block Express) or HDD-backed (st1, sc1) volumes for performance needs.
    • Availability – designed for 99.999% availability, automatically replicates within its Availability Zone.
    • Encryption – provides seamless support for data-at-rest and data-in-transit between EC2 instances and EBS volumes.
    • Snapshots – create point-in-time snapshots backed up to S3 for long-term durability. Supports EBS Snapshots Archive for low-cost long-term retention.

Amazon Elastic File System (EFS)

  • provides simple, scalable, elastic file storage for use with AWS compute services and on-premises resources.
  • storage capacity is elastic, growing and shrinking automatically as files are added and removed.
  • works in shared mode, where multiple compute instances can access an EFS file system at the same time (NFS protocol).
  • can be mounted on on-premises servers via AWS Direct Connect or VPN.
  • is designed for high availability and durability across multiple AZs.
  • offers Standard and One Zone storage classes, each with Infrequent Access tiers.

Amazon FSx

  • provides fully managed third-party file systems with native compatibility for various workloads.
  • FSx for Windows File Server – fully managed Windows native file system with SMB protocol support, Active Directory integration.
  • FSx for Lustre – high-performance file system for compute-intensive workloads (ML, HPC, media processing).
  • FSx for NetApp ONTAP – fully managed NetApp ONTAP file system with multi-protocol access.
  • FSx for OpenZFS – fully managed OpenZFS file system for Linux workloads.

AWS Storage Gateway

  • seamlessly enables hybrid storage between on-premises storage environments and the AWS Cloud
  • combines a multi-protocol storage appliance with highly efficient network connectivity to AWS cloud storage services.
  • provides three gateway types: S3 File Gateway, FSx File Gateway, Volume Gateway, and Tape Gateway.

AWS Backup

  • is a fully managed backup service that centralizes and automates the backup of data across AWS services.
  • supports EC2, EBS, RDS, DynamoDB, EFS, FSx, Storage Gateway, and more.
  • provides a central backup console, backup policies, and cross-Region/cross-account backup capabilities.

Databases

Amazon Aurora

  • is a MySQL and PostgreSQL compatible relational database engine
  • provides the speed and availability of high-end commercial databases with the simplicity and cost-effectiveness of open source databases.
  • Benefits
    • Highly Secure – provides network isolation using VPC, encryption at rest using KMS, and encryption of data in transit using SSL.
    • Highly Scalable – automatically grows storage as needed, up to 128 TB.
    • High Availability and Durability – designed for greater than 99.99% availability. Six copies of data replicated across three AZs. Instance failover typically requires less than 30 seconds.
    • Fully Managed – database management tasks like provisioning, patching, backup, recovery, and failover are automated.
    • Aurora Serverless v2 – automatically scales capacity up and down based on application demand, ideal for variable or unpredictable workloads.

Amazon Relational Database Service (RDS)

  • makes it easy to set up, operate, and scale a relational database
  • provides cost-efficient and resizable capacity while managing time-consuming database administration tasks
  • supports Amazon Aurora, PostgreSQL, MySQL, MariaDB, Oracle, and Microsoft SQL Server
  • Benefits
    • Fast and Easy to Administer – no need for infrastructure provisioning or database software installation and maintenance.
    • Highly Scalable – allows quick scaling of compute and storage resources. Read Replicas available to offload read traffic.
    • Available and Durable – Multi-AZ deployments synchronously replicate data to a standby instance in a different AZ. Automated backups, snapshots, and automatic host replacement.
    • Secure – network isolation using VPC, encryption at rest with KMS, encryption in transit with SSL.
    • Inexpensive – pay low rates with On-Demand or Reserved Instance pricing.
    • RDS Proxy – a fully managed database proxy that makes applications more scalable and resilient to database failures.

Amazon DynamoDB

  • is a fully managed, serverless, key-value and document NoSQL database designed for single-digit millisecond performance at any scale.
  • supports both document and key-value data models.
  • Benefits
    • Fast, Consistent Performance – designed to deliver consistent, fast performance at any scale using SSD storage and automatic partitioning.
    • Highly Scalable – manages all scaling to achieve specified throughput capacity. Supports on-demand and provisioned capacity modes.
    • Event-Driven Programming – DynamoDB Streams and integration with Lambda enable applications that automatically react to data changes.
    • Global Tables – provides fully managed multi-Region, multi-active replication for globally distributed applications.
    • DAX (DynamoDB Accelerator) – in-memory caching for DynamoDB delivering microsecond read latency.

Amazon ElastiCache

  • is a web service that makes it easy to deploy, operate, and scale an in-memory cache in the cloud.
  • helps improve the performance of web applications by allowing retrieval from fast, managed, in-memory caches instead of slower disk-based databases.
  • supports two open-source in-memory caching engines: Redis (now Valkey-compatible) and Memcached.

Amazon MemoryDB

  • is a durable, Redis/Valkey-compatible, in-memory database service for ultra-fast performance.
  • delivers microsecond reads and single-digit millisecond writes with Multi-AZ durability.
  • can be used as a primary database for applications requiring both high performance and data durability.

Amazon DocumentDB

  • is a fully managed document database service that supports MongoDB workloads.
  • designed for JSON data management at scale with automatic scaling storage.

Amazon Neptune

  • is a fully managed graph database service for building applications that work with highly connected datasets.
  • supports Property Graph and RDF models with Apache TinkerPop Gremlin and SPARQL query languages.

Amazon Keyspaces

  • is a scalable, highly available, and fully managed Apache Cassandra-compatible database service.
  • serverless – pay only for the resources you use and the table automatically scales up and down.

Migration

AWS Application Discovery Service

  • helps plan application migration projects by automatically identifying applications running in on-premises data centers, their associated dependencies, and performance profiles.
  • automatically collects configuration and usage data from servers, storage, and networking equipment.
  • information is retained in encrypted format and can be exported for use with visualization tools or cloud migration solutions.

AWS Database Migration Service (DMS)

  • helps migrate databases to AWS easily and securely
  • source database remains fully operational during the migration, minimizing downtime.
  • supports homogeneous migrations (e.g., Oracle to Oracle) and heterogeneous migrations (e.g., Oracle to Aurora, SQL Server to MySQL).
  • allows streaming data to Redshift, S3, and other targets from supported sources.
  • can also be used for continuous data replication with high availability.
  • AWS Schema Conversion Tool (SCT) helps convert database schemas between different database engines.

AWS Application Migration Service (AWS MGN / AWS Transform MGN)

  • is the recommended service for lift-and-shift (rehost) migrations to AWS, replacing the deprecated AWS Server Migration Service.
  • automates the conversion of source servers (physical, virtual, or cloud) into native Amazon EC2 instances.
  • provides continuous block-level replication, short cutover windows, and automated testing.
  • Note: Previously called AWS Application Migration Service (MGN), now rebranded as AWS Transform MGN (June 2026).

AWS Snow Family

⚠️ Note: The AWS Snow Family is being wound down. As of November 2025, Snowball Edge devices are only available to existing customers. New customers should use AWS DataSync, AWS Data Transfer Terminal, or AWS Partner solutions.

  • AWS Snowball Edge (existing customers only) – a data transfer and edge computing device with on-board storage and compute capabilities. Can move large amounts of data and support local workloads.
  • AWS Snowmobile – Retired (March 2024). No longer available.
  • Migration Alternatives:
    • AWS DataSync – online data transfer service for automated transfer between on-premises and AWS storage.
    • AWS Data Transfer Terminal – secure physical location for transferring data to AWS.
    • AWS Transfer Family – fully managed SFTP, FTPS, FTP, and AS2 service for file transfers to S3 or EFS.

Networking and Content Delivery

Amazon Virtual Private Cloud (VPC)

  • helps provision a logically isolated section of the AWS Cloud where AWS resources can be launched in a virtual network that you define.
  • provides complete control over the virtual networking environment, including selection of IP address range, creation of subnets (public and private), and configuration of route tables and network gateways.
  • allows use of both IPv4 and IPv6 for secure and easy access to resources.
  • allows multiple layers of security, including security groups and network access control lists (NACLs).
  • allows creation of VPN connections between corporate data center and VPC.
  • VPC Peering enables private connectivity between VPCs. Transit Gateway provides a hub for connecting multiple VPCs and on-premises networks.

Amazon CloudFront

  • is a global content delivery network (CDN) service that accelerates delivery of websites, APIs, video content, or other web assets.
  • can deliver entire website, including dynamic, static, streaming, and interactive content using a global network of edge locations.
  • requests for content are automatically routed to the nearest edge location for best possible performance.
  • is optimized to work with S3, EC2, ELB, Route 53, and API Gateway as well as non-AWS origin servers.
  • supports edge functions via CloudFront Functions and Lambda@Edge for customizing content at the edge.

Amazon Route 53

  • is a highly available and scalable Domain Name System (DNS) web service.
  • connects user requests to infrastructure running in AWS or outside of AWS.
  • helps configure DNS health checks to route traffic to healthy endpoints.
  • allows traffic management globally through latency-based routing, Geo DNS, geoproximity, weighted round robin, multivalue answer, and IP-based routing – all combinable with DNS Failover.
  • is fully compliant with IPv6 and offers Domain Name Registration service.

AWS Direct Connect

  • makes it easy to establish a dedicated network connection from on-premises to AWS.
  • helps establish private connectivity between AWS and data center, office, or co-location environment.
  • helps increase bandwidth throughput, reduce network costs, and provide a more consistent network experience than Internet-based connections.

Elastic Load Balancing (ELB)

  • automatically distributes incoming application traffic across multiple targets (EC2 instances, containers, IP addresses, Lambda functions).
  • enables greater levels of fault tolerance by seamlessly providing the required amount of load balancing capacity.
  • offers four types of load balancers:
    • Application Load Balancer (ALB) – operates at Layer 7 (HTTP/HTTPS). Routes traffic based on content of the request. Ideal for microservices, container-based architectures, and advanced routing needs.
    • Network Load Balancer (NLB) – operates at Layer 4 (TCP/UDP/TLS). Handles millions of requests per second with ultra-low latency. Ideal for TCP/UDP traffic and extreme performance requirements.
    • Gateway Load Balancer (GWLB) – operates at Layer 3 (IP). Makes it easy to deploy, scale, and manage third-party virtual appliances (firewalls, IDS/IPS). Combines transparent network gateway with load balancing.
    • Classic Load Balancer (CLB) – previous generation, operates at both Layer 4 and Layer 7. Recommended to migrate to ALB or NLB.

AWS Global Accelerator

  • is a networking service that improves the availability and performance of applications by using the AWS global network.
  • provides two static anycast IP addresses that serve as a fixed entry point to applications hosted in one or more AWS Regions.
  • continuously monitors endpoints and instantly routes traffic to the closest healthy endpoint.

AWS PrivateLink

  • provides private connectivity between VPCs, AWS services, and on-premises applications without exposing traffic to the public internet.
  • simplifies security of data shared between cloud-based applications and on-premises services.

Management and Governance

Amazon CloudWatch

  • is a monitoring and observability service for AWS Cloud resources and the applications running on AWS.
  • can collect and track metrics, collect and monitor log files, set alarms, and automatically react to changes in AWS resources.
  • provides CloudWatch Logs, Metrics, Alarms, Dashboards, and Events (now EventBridge) for comprehensive monitoring.
  • supports custom metrics, anomaly detection, and cross-account observability.

AWS CloudFormation

  • allows developers and systems administrators to implement “Infrastructure as Code”
  • provides an easy way to create and manage a collection of related AWS resources, provisioning and updating them in an orderly and predictable fashion.
  • handles the order for provisioning AWS services and the subtleties of making those dependencies work.
  • allows applying version control to AWS infrastructure the same way it’s done with software.
  • AWS CDK (Cloud Development Kit) allows defining infrastructure using familiar programming languages (TypeScript, Python, Java, etc.) that synthesize to CloudFormation templates.

AWS CloudTrail

  • records AWS API calls for the account and delivers log files.
  • includes API calls made via the Console, CLI, SDKs, and higher-level AWS services.
  • recorded information includes the identity of the API caller, time, source IP address, request parameters, and response elements.
  • enables security analysis, resource change tracking, compliance auditing, and operational troubleshooting.
  • supports CloudTrail Lake for SQL-based querying and long-term retention of events.

AWS Config

  • provides an AWS resource inventory, configuration history, and configuration change notifications to enable security and governance.
  • provides Config Rules feature that enables creation of rules to automatically check the configuration of AWS resources.
  • helps discover existing and deleted AWS resources, determine overall compliance against rules, and dive into configuration details at any point in time.
  • supports Conformance Packs for packaging multiple Config Rules and remediation actions together.

AWS Systems Manager

  • provides a unified user interface to view operational data from multiple AWS services and automate operational tasks across AWS resources.
  • includes capabilities for patch management, configuration management, session management, parameter store, and run command.
  • helps maintain security and compliance by scanning managed instances for patch compliance and configuration inconsistencies.

AWS Service Catalog

  • allows organizations to create and manage catalogs of IT services approved for use on AWS.
  • helps centrally manage commonly deployed IT services and helps achieve consistent governance and compliance requirements.

AWS Trusted Advisor

  • is an online resource that inspects your AWS environment and provides recommendations across five categories: cost optimization, performance, security, fault tolerance, and service limits.
  • provides real-time guidance to help provision resources following AWS best practices.

AWS Health Dashboard

  • provides alerts and remediation guidance when AWS is experiencing events that might affect you (formerly Personal Health Dashboard).
  • displays relevant information to help manage events in progress and provides proactive notification for scheduled activities.
  • provides a personalized view into the performance and availability of AWS services underlying your resources.

AWS Control Tower

  • provides the easiest way to set up and govern a secure, multi-account AWS environment (landing zone).
  • establishes a well-architected multi-account baseline with guardrails (preventive and detective) for governance.
  • automates account provisioning and applies best practices for identity management, federated access, and logging.

Developer Tools

AWS CodeCommit

  • is a fully managed source control service that hosts secure and highly scalable private Git repositories.
  • ⚠️ Note: CodeCommit is no longer available to new customers (July 2024). Existing customers can continue using it. Consider GitHub, GitLab, or Bitbucket as alternatives.

AWS CodeBuild

  • is a fully managed build service that compiles source code, runs tests, and produces software packages that are ready to deploy.
  • scales continuously and processes multiple builds concurrently.

AWS CodeDeploy

  • is a service that automates code deployments to any instance, including EC2 instances, Lambda functions, ECS services, and on-premises servers.
  • helps rapidly release new features, avoid downtime during deployment, and handles the complexity of updating applications.

AWS CodePipeline

  • is a continuous integration and continuous delivery (CI/CD) service for fast and reliable application and infrastructure updates.
  • builds, tests, and deploys code every time there is a code change, based on defined release process models.

AWS X-Ray

  • helps developers analyze and debug distributed applications in production, such as those built using microservices architectures.
  • provides an end-to-end view of requests as they travel through the application, and shows a map of its underlying components.
  • helps identify and troubleshoot the root cause of performance issues and errors.

Amazon Q Developer

  • is a generative AI-powered assistant for software development (formerly Amazon CodeWhisperer).
  • provides AI-powered code suggestions, security scanning, code transformation, and natural language chat for development tasks.
  • supports multiple IDEs and programming languages.

Messaging and Application Integration

Amazon SQS

  • is a fast, reliable, scalable, fully managed message queuing service.
  • makes it simple and cost-effective to decouple the components of a cloud application.
  • includes Standard queues with high throughput and at-least-once processing, and FIFO queues with exactly-once processing and ordered delivery.

Amazon SNS

  • is a fast, flexible, fully managed pub/sub messaging and mobile notification service.
  • can send notifications to Apple, Google, Windows, and other mobile platforms, email, SMS, HTTP endpoints, SQS queues, and Lambda functions.
  • supports message filtering, FIFO topics, and message archiving.

Amazon SES

  • is a cost-effective, scalable email service for sending transactional email, marketing messages, or any other type of high-quality content.
  • can also receive messages and deliver them to S3, trigger Lambda functions, or publish to SNS.

Amazon EventBridge

  • is a serverless event bus that makes it easy to connect applications using data from your own apps, SaaS apps, and AWS services.
  • delivers a stream of real-time data from event sources and routes that data to targets like Lambda, Step Functions, SQS, and more.
  • replaces CloudWatch Events with additional capabilities including schema registry and third-party integrations.

AWS Step Functions

  • makes it easy to coordinate the components of distributed applications and microservices using visual workflows.
  • automatically triggers and tracks each step, and retries when there are errors.
  • supports Standard Workflows (long-running) and Express Workflows (high-volume, short-duration).

Amazon API Gateway

  • is a fully managed service for creating, publishing, maintaining, monitoring, and securing APIs at any scale.
  • handles traffic management, authorization, access control, monitoring, and API version management.
  • supports REST APIs, HTTP APIs, and WebSocket APIs.

Analytics

Amazon Athena

  • is an interactive query service that helps analyze data in S3 using standard SQL.
  • is serverless – no infrastructure to manage, pay only for queries run.
  • supports querying data in multiple formats including CSV, JSON, ORC, Avro, and Parquet.
  • integrates with AWS Glue Data Catalog for schema management.

Amazon EMR

  • provides a managed big data platform that makes it easy, fast, and cost-effective to process vast amounts of data.
  • supports Apache Spark, Hive, HBase, Presto, Flink, and other popular frameworks.
  • can run on EC2, EKS, or serverlessly with EMR Serverless.
  • handles big data use cases including log analysis, ETL, machine learning, and scientific simulation.

Amazon OpenSearch Service

  • makes it easy to deploy, operate, and scale OpenSearch (and legacy Elasticsearch) for log analytics, full-text search, application monitoring, and more.
  • Note: Renamed from Amazon Elasticsearch Service in September 2021.
  • is a fully managed service delivering real-time search and analytics capabilities along with availability, scalability, and security for production workloads.
  • supports OpenSearch Dashboards (successor to Kibana) for data visualization.

Amazon Kinesis

  • is a platform for streaming data on AWS, offering services to collect, process, and analyze real-time streaming data.
  • offers:
    • Amazon Kinesis Data Streams – enables building custom applications that process or analyze streaming data for specialized needs.
    • Amazon Data Firehose (formerly Kinesis Data Firehose) – easiest way to capture, transform, and load streaming data into S3, Redshift, OpenSearch, and third-party services like Splunk and Snowflake.
    • Amazon Managed Service for Apache Flink (formerly Kinesis Data Analytics) – process and analyze streaming data in real time using Apache Flink.
    • Amazon Kinesis Video Streams – capture, process, and store video streams for analytics and machine learning.

Amazon Redshift

  • provides a fast, fully managed, petabyte-scale cloud data warehouse.
  • uses massively parallel processing (MPP) architecture, parallelizing and distributing SQL operations across nodes.
  • supports Redshift Serverless for running analytics without managing infrastructure.
  • provides Redshift Spectrum to query data directly in S3 without loading it.

Amazon QuickSight

  • is a fast, cloud-powered business intelligence (BI) service for building visualizations, performing ad-hoc analysis, and getting business insights from data.
  • supports ML-powered insights with Amazon Q in QuickSight for natural language querying.

AWS Glue

  • is a serverless data integration service that makes it easy to discover, prepare, move, and integrate data from multiple sources.
  • provides the Glue Data Catalog as a central metadata repository.
  • simplifies and automates data discovery, ETL job authoring, and job scheduling.
  • scales automatically and provisions resources as needed.

AWS Lake Formation

  • makes it easy to set up a secure data lake in days instead of months.
  • provides centralized governance and security for data lake access using fine-grained permissions.

Machine Learning and Artificial Intelligence

Amazon Bedrock

  • is a fully managed service offering access to leading foundation models (FMs) from AI companies (Anthropic, Meta, Mistral, Amazon, and others) through a single API.
  • provides capabilities to build generative AI applications with security, privacy, and responsible AI features.
  • supports use cases like text generation, summarization, image generation, chatbots, and AI agents.
  • offers Bedrock Agents for building autonomous AI agents and Bedrock Knowledge Bases for RAG (Retrieval Augmented Generation).

Amazon SageMaker

  • is a fully managed machine learning service to build, train, and deploy ML models at scale.
  • provides SageMaker Studio as a unified IDE for ML development.
  • supports the entire ML workflow: data preparation, model building, training, tuning, and deployment.
  • includes built-in algorithms, pre-built ML frameworks, and AutoML capabilities.

Amazon Rekognition

  • makes it easy to add image and video analysis to applications using deep learning technology.
  • can identify objects, people, text, scenes, and activities, and detect inappropriate content.

Amazon Comprehend

  • is a natural language processing (NLP) service that uses machine learning to find insights and relationships in text.
  • can identify the language, extract key phrases, sentiment, entities, and topics.

Amazon Lex

  • is a service for building conversational interfaces using voice and text (same technology that powers Alexa).
  • provides automatic speech recognition (ASR) and natural language understanding (NLU).

Amazon Polly

  • is a text-to-speech service that turns text into lifelike speech using deep learning.
  • supports multiple languages and provides a variety of natural-sounding voices.

Amazon Transcribe

  • is an automatic speech recognition (ASR) service that converts speech to text.
  • supports real-time transcription and batch transcription of audio files.

Amazon Translate

  • is a neural machine translation service for fast, high-quality language translation.
  • supports translation between supported languages for applications and content.

Cloud Financial Management

AWS Cost Explorer

  • provides an easy-to-use interface to visualize, understand, and manage AWS costs and usage over time.
  • offers forecasting, savings recommendations, and detailed filtering/grouping of cost data.

AWS Budgets

  • allows setting custom budgets that alert when costs or usage exceed (or are forecasted to exceed) the budgeted amount.
  • supports cost, usage, reservation, and savings plans budgets.

AWS Pricing Calculator

  • helps estimate the cost of using AWS services before deployment.
  • allows creating cost estimates for various architectures and configurations.

Deprecated Services (Historical Reference)

The following services mentioned in the original AWS Overview Whitepaper have been deprecated or discontinued. They are listed here for reference and certification context.

  • Amazon Cloud Directory – No longer open to new customers (November 2025). Alternatives: DynamoDB, Neptune.
  • AWS OpsWorks – Reached End of Life on May 26, 2024. Disabled for all customers. Alternatives: AWS Systems Manager, CloudFormation, CodeDeploy.
  • Amazon Elastic Transcoder – Discontinued November 13, 2025. Replaced by AWS Elemental MediaConvert.
  • AWS Server Migration Service (SMS) – Deprecated. Replaced by AWS Application Migration Service (MGN / Transform MGN).
  • AWS Data Pipeline – No longer available to new customers (July 2024). Alternatives: AWS Glue, Step Functions, Amazon MWAA (Managed Workflows for Apache Airflow).
  • Amazon SWF (Simple Workflow Service) – Still operational but superseded by AWS Step Functions for new workloads.
  • AWS Snowmobile – Retired March 2024. No longer available.
  • Amazon CodeCatalyst – No longer open to new customers (November 2025).

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. Which AWS services belong to the Compute services? Choose 2 answers
    1. Lambda
    2. EC2
    3. S3
    4. EMR
    5. CloudFront
  2. Which AWS service provides low cost storage option for archival and long-term backup?
    1. S3 Glacier
    2. S3 Standard
    3. EBS
    4. CloudFront
  3. Which AWS services belong to the Storage services? Choose 2 answers
    1. EFS
    2. IAM
    3. EMR
    4. S3
    5. CloudFront
  4. A Company allows users to upload videos on its platform. They want to convert the videos to multiple formats supported on multiple devices and platforms. Which AWS service can they leverage for the requirement?
    1. AWS SWF
    2. AWS Video Converter
    3. AWS Elemental MediaConvert
    4. AWS Data Pipeline
  5. Which analytic service helps analyze data in S3 using standard SQL?
    1. Athena
    2. EMR
    3. OpenSearch
    4. Kinesis
  6. What features does AWS’s Route 53 service provide? Choose the 2 correct answers:
    1. Content Caching
    2. Domain Name System (DNS) service
    3. Database Management
    4. Domain Registration
  7. You are trying to organize and import (to AWS) gigabytes of data that are currently structured in JSON-like, name-value documents. What AWS service would best fit your needs?
    1. Lambda
    2. DynamoDB
    3. RDS
    4. Aurora
  8. What AWS database is primarily used to analyze data using standard SQL formatting with compatibility for your existing business intelligence tools? Choose the correct answer:
    1. Redshift
    2. RDS
    3. DynamoDB
    4. ElastiCache
  9. A company wants their application to use pre-configured machine image with software installed and configured. Which AWS feature can help for the same?
    1. Amazon Machine Image (AMI)
    2. AWS CloudFormation
    3. AWS Lambda
    4. AWS Lightsail
  10. What AWS service can be used to track API event calls for security analysis and resource change tracking?
    1. AWS CloudWatch
    2. AWS CloudFormation
    3. AWS CloudTrail
    4. AWS Systems Manager
  11. Which AWS service can help offload the read traffic from your database in order to reduce latency caused by read-heavy workload?
    1. ElastiCache
    2. DynamoDB
    3. S3
    4. EFS
  12. What service allows system administrators to run “Infrastructure as Code”?
    1. CloudFormation
    2. CloudWatch
    3. CloudTrail
    4. CodeDeploy
  13. Which AWS service is a fully managed container orchestration service?
    1. EC2
    2. Amazon ECS
    3. AWS Lambda
    4. Amazon S3
  14. A company wants to run containers without managing servers or clusters. Which AWS service should they use?
    1. Amazon EC2
    2. Amazon EKS on EC2
    3. AWS Fargate
    4. AWS Batch
  15. Which AWS service provides a fully managed generative AI service with access to foundation models?
    1. Amazon SageMaker
    2. Amazon Bedrock
    3. Amazon Comprehend
    4. Amazon Rekognition
  16. Which Elastic Load Balancer type operates at Layer 4 and is best suited for ultra-low latency TCP/UDP traffic?
    1. Application Load Balancer
    2. Network Load Balancer
    3. Gateway Load Balancer
    4. Classic Load Balancer
  17. Which AWS service provides centralized threat detection by continuously monitoring AWS accounts and workloads for malicious activity?
    1. AWS WAF
    2. Amazon Inspector
    3. Amazon GuardDuty
    4. AWS Shield
  18. A company wants to save costs on EC2 by committing to a consistent usage amount ($/hour) for 1-3 years with flexibility across instance families, regions, and services. What should they use?
    1. Reserved Instances
    2. Spot Instances
    3. Compute Savings Plans
    4. Dedicated Hosts

References

AWS Support Plans

~ Last updated on : ~ jayendrapatil ~ 2 Comments

AWS Support Plans

⚠️ Major Update: AWS Support Plans Transformation (Dec 2025)

At AWS re:Invent 2025, AWS announced a fundamental restructuring of Support Plans. The legacy Developer, Business, and Enterprise On-Ramp plans will be discontinued on January 1, 2027.

New plan structure (effective 2026):

  • Basic (Free) — included for all AWS customers
  • Business Support+ — replaces Developer and Business (starts at $29/month)
  • Enterprise Support — enhanced with AI capabilities (starts at $5,000/month)
  • Unified Operations — new highest tier (starts at $50,000/month)

Legacy plan customers can transition anytime before Jan 1, 2027. Enterprise On-Ramp customers are being automatically upgraded to Enterprise Support throughout 2026.

NOTE – This post is relevant for AWS Cloud Practitioner Certification and AWS Solutions Architect Associate Certification

Current AWS Support Plans (2026+)

AWS now offers three paid support plans plus the free Basic tier. Each plan combines AI-powered capabilities with AWS expert guidance, representing a shift from reactive problem-solving to proactive issue prevention.

Basic (Free)

  • Included for all AWS customers at no cost
  • 24×7 access to customer service, documentation, whitepapers, and re:Post community forums
  • Access to AWS Health Dashboard (formerly Personal Health Dashboard) for service health notifications
  • Access to limited AWS Trusted Advisor checks (core security checks)
  • Access to AWS Support Automation Workflows for self-service troubleshooting

Business Support+

Replaces the legacy Developer and Business Support plans. Starts at $29/month per account.

  • 24×7 access to AWS Cloud Support Engineers via email, chat & phone
  • AI-powered contextual troubleshooting that understands your specific AWS environment
  • Allows Unlimited contacts/Unlimited cases (IAM supported)
  • Access to full set of AWS Trusted Advisor checks
  • Access to AWS Health Dashboard & Health API
  • Access to AWS DevOps Agent for automated incident investigation and prevention
  • Access to AWS Support App in Slack
  • Proactive health checks with actionable recommendations across security, performance, cost, and reliability
  • Case Severity/Response times SLA:
    • General guidance < 24 hours
    • System impaired < 12 hours
    • Production system impaired < 4 hours
    • Business-critical system down < 30 minutes
  • Pricing: Greater of $29/month per account OR tiered % of monthly AWS charges (9% up to $10K, 7% $10K-$80K, 5% $80K-$250K, 3% over $250K)

Enterprise Support

Enhanced with AI capabilities. Starts at $5,000/month (reduced from previous $15,000 minimum).

  • 24×7 access to Sr. Cloud Support Engineers via email, chat & phone
  • Designated Technical Account Manager (TAM) for strategic guidance and proactive engagement
  • AI-powered intelligent troubleshooting with personalized context delivery to support engineers
  • AWS Security Incident Response — automated security monitoring, triage, and 24/7 access to security engineers (included at no additional cost)
  • Access to AWS DevOps Agent with 75% credits of monthly support charge
  • TAM-led Well-Architected Reviews and architectural assessments
  • Access to AWS Trusted Advisor Priority with 465+ best practice checks across 56+ services
  • Account assistance by Support Concierge
  • Access to online self-paced labs and TAM-led workshops
  • AWS Countdown Premium available as add-on ($10K/project/month) for critical launches, migrations, and peak events
  • Case Severity/Response times SLA:
    • General guidance < 24 hours
    • System impaired < 12 hours
    • Production system impaired < 4 hours
    • Production system down < 1 hour
    • Business-critical system down < 15 minutes
  • Pricing: Greater of $5,000/month OR tiered % of monthly AWS charges (10% up to $150K, 7% $150K-$500K, 5% $500K-$1M, 3% over $1M)

Unified Operations

New highest-tier plan for mission-critical enterprise operations. Starts at $50,000/month.

  • Designated core team: Technical Account Manager (TAM), Domain Specialist Engineers (DSE), and Senior Billing & Account Specialist
  • On-demand experts for migrations, incident management, and security
  • 24/7 proactive security and performance monitoring with early incident detection
  • AWS Security Incident Response with AI-powered investigation included
  • AWS DevOps Agent with 100% credits of monthly support charge
  • AWS Countdown Premium included at no additional cost
  • AWS Incident Detection and Response included at no additional cost
  • Expert-led resilience reviews, GameDay exercises, and chaos engineering
  • Critical Workload Reviews and comprehensive architecture assessments
  • Support via preferred collaboration channels (follow-the-sun model)
  • Case Severity/Response times SLA:
    • General guidance < 24 hours
    • System impaired < 12 hours
    • Production system impaired < 4 hours
    • Production system down < 1 hour
    • Business-critical system down < 5 minutes
  • Pricing: Greater of $50,000/month OR tiered % of monthly AWS charges (10% up to $1M, 6% $1M-$5M, 5% over $5M). Minimum 90-day commitment.

Legacy Plans (Discontinued January 1, 2027)

⚠️ The following plans are being discontinued on January 1, 2027. Existing customers can continue using them until that date or transition to new plans anytime.

Developer (Legacy)

Migrates to → Business Support+

  • Business hours access to Cloud Support Associates via email
  • One primary contact can open Unlimited cases
  • Case Severity/Response times SLA (in business hours):
    • General guidance < 24 business hours
    • System impaired < 12 business hours
  • General Guidance on Architecture support

Business (Legacy)

Migrates to → Business Support+

  • 24×7 access to Cloud Support Engineers via email, chat & phone
  • Unlimited contacts/Unlimited cases (IAM supported)
  • Full set of Trusted Advisor checks
  • Case Severity/Response times:
    • General guidance < 24 hours
    • System impaired < 12 hours
    • Production system impaired < 4 hours
    • Production system down < 1 hour

Enterprise On-Ramp (Legacy)

Automatically upgrading to → Enterprise Support throughout 2026

  • Access to a pool of Technical Account Managers (not designated)
  • Consultative architectural guidance
  • Case Severity/Response times:
    • Business-critical system down < 30 minutes

Key Features Comparison

Feature Basic Business Support+ Enterprise Unified Operations
Critical response time — 30 min 15 min 5 min
24×7 expert access — ✓ ✓ ✓
Technical Account Manager — — Designated Designated + DSE team
AI-powered troubleshooting — ✓ ✓ ✓
AWS Security Incident Response — — Included Included
AWS DevOps Agent — 30% credits 75% credits 100% credits
Trusted Advisor Core checks Full checks Priority (465+ checks) Priority (465+ checks)
Well-Architected Reviews — — TAM-led Expert-led (comprehensive)
Minimum monthly cost Free $29/account $5,000 $50,000

AWS Support Plan Key Services

AWS Health Dashboard

  • Previously known as Personal Health Dashboard (PHD) and Service Health Dashboard (SHD)
  • Unified dashboard combining service health and account-specific health events
  • Provides personalized notifications about AWS service events affecting your resources
  • Available to all AWS customers (Basic and above)
  • Programmatic access via AWS Health API available with Business Support+ and above

AWS Trusted Advisor

  • Provides real-time recommendations across cost optimization, performance, security, fault tolerance, service limits, and operational excellence
  • Basic/Free: Core security checks only
  • Business Support+: Full set of Trusted Advisor checks
  • Enterprise/Unified Operations: Trusted Advisor Priority with 465+ checks across 56+ services, curated by TAM

AWS DevOps Agent

  • AI-powered operations teammate that autonomously investigates incidents 24/7
  • Provides proactive recommendations to prevent future outages
  • One-click case creation with full investigation context for AWS Support Engineers
  • Available to Business Support+ (30% credits), Enterprise (75% credits), Unified Operations (100% credits)

AWS Security Incident Response

  • Automated security finding monitoring and triage across GuardDuty and Security Hub
  • AI-powered investigation and containment capabilities
  • 24/7 access to AWS Security Incident Response engineers
  • Included with Enterprise and Unified Operations at no additional cost

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. Which AWS support plan has a designated technical account manager assigned for proactive guidance?
    1. AWS Basic support plan
    2. AWS Business Support+ plan
    3. AWS Enterprise Support plan
    4. AWS Unified Operations plan

    Note: Both Enterprise and Unified Operations have a designated TAM, but Enterprise is the first tier to include one.

  2. Which feature is available for all the AWS support plans?
    1. Technical Account Manager
    2. AWS DevOps Agent
    3. 24×7 access to customer service and AWS Health Dashboard
    4. AI-powered troubleshooting
  3. A company needs 24/7 access to AWS Support Engineers and AI-powered contextual troubleshooting at the lowest cost. Which AWS Support plan should they choose?
    1. Basic
    2. Business Support+
    3. Enterprise Support
    4. Unified Operations
  4. Which AWS Support plan provides a 5-minute response time for business-critical system failures?
    1. Business Support+
    2. Enterprise Support
    3. Unified Operations
    4. Basic
  5. What happens to customers on the legacy AWS Developer Support plan after January 1, 2027?
    1. They are automatically upgraded to Enterprise Support
    2. They lose all support access
    3. The plan is discontinued; they should upgrade to Business Support+ before that date
    4. They are moved to Basic support
  6. Which AWS Support plan includes AWS Security Incident Response at no additional cost?
    1. Basic
    2. Business Support+
    3. Enterprise Support
    4. Developer (Legacy)
  7. A startup needs AWS Support with expert access and the lowest minimum monthly cost. Which plan should they choose?
    1. Enterprise Support ($5,000/month minimum)
    2. Business Support+ ($29/month per account minimum)
    3. Unified Operations ($50,000/month minimum)
    4. Basic (free, no expert access)
  8. Which team members are included as part of the designated core team in the AWS Unified Operations plan? (Select TWO)
    1. Technical Account Manager (TAM)
    2. Solutions Architect
    3. Domain Specialist Engineers (DSE)
    4. AWS Account Executive

References

Architecting for the Cloud – AWS Best Practices – Whitepaper – Certification

~ Last updated on : ~ jayendrapatil ~ 5 Comments

Architecting for the Cloud – AWS Best Practices

📋 Important Note: Whitepaper Superseded

The original “Architecting for the Cloud: AWS Best Practices” whitepaper (last updated October 2018) has been superseded by the AWS Well-Architected Framework.

The Well-Architected Framework is now organized into six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability (added in 2021). It receives continuous updates — most recently in November 2024 and April 2025.

This post is maintained for certification study purposes as the core architectural principles remain relevant.

Architecting for the Cloud – AWS Best Practices whitepaper provides architectural patterns and advice on how to design systems that are secure, reliable, high performing, and cost efficient

AWS Design Principles

Scalability

  • While AWS provides virtually unlimited on-demand capacity, the architecture should be designed to take advantage of those resources
  • There are two ways to scale an IT architecture
    • Vertical Scaling
      • takes place through increasing specifications of an individual resource for e.g. updating EC2 instance type with increasing RAM, CPU, IOPS, or networking capabilities
      • will eventually hit a limit, and is not always a cost effective or highly available approach
      • AWS Graviton-based instances (Graviton4 as of 2024) offer up to 40% better price-performance, making vertical scaling more cost-effective
    • Horizontal Scaling
      • takes place through increasing number of resources for e.g. adding more EC2 instances or EBS volumes
      • can help leverage the elasticity of cloud computing
      • not all the architectures can be designed to distribute their workload to multiple resources
      • applications designed should be stateless,
        • that needs no knowledge of previous interactions and stores no session information
        • capacity can be increased and decreased, after running tasks have been drained
      • State, if needed, can be implemented using
        • Low latency external store, for e.g. DynamoDB, ElastiCache (Redis or Memcached), to maintain state information
        • Session affinity, for e.g. ELB sticky sessions, to bind all the transactions of a session to a specific compute resource. However, it cannot be guaranteed or take advantage of newly added resources for existing sessions
      • Load can be distributed across multiple resources using
        • Push model, for e.g. through ELB where it distributes the load across multiple EC2 instances
        • Pull model, for e.g. through SQS or Kinesis where multiple consumers subscribe and consume
      • Distributed processing, for e.g. using EMR or Kinesis, helps process large amounts of data by dividing task and its data into many small fragments of works

Disposable Resources Instead of Fixed Servers

  • Resources need to be treated as temporary disposable resources rather than fixed permanent on-premises resources before
  • AWS focuses on the concept of Immutable infrastructure
    • servers once launched, is never updated throughout its lifetime.
    • updates can be performed on a new server with latest configurations,
    • this ensures resources are always in a consistent (and tested) state and easier rollbacks
  • AWS provides multiple ways to instantiate compute resources in an automated and repeatable way
    • Bootstrapping
      • scripts to configure and setup for e.g. using EC2 user data scripts and cloud-init to install software or copy resources and code
    • Golden Images
      • a snapshot of a particular state of that resource,
      • faster start times and removes dependencies to configuration services or third-party repositories
      • EC2 Image Builder can automate creation, testing, and distribution of golden AMIs
    • Containers
      • AWS supports container workloads through Amazon ECS, Amazon EKS, and AWS Fargate (serverless containers)
      • Docker allows packaging a piece of software in a Docker Image, which is a standardized unit for software development, containing everything the software needs to run: code, runtime, system tools, system libraries, etc
      • AWS Fargate provides serverless compute for containers, eliminating the need to manage underlying EC2 instances
  • Infrastructure as Code
    • AWS assets are programmable, techniques, practices, and tools from software development can be applied to make the whole infrastructure reusable, maintainable, extensible, and testable.
    • AWS provides services for IaC deployment:
      • AWS CloudFormation – declarative JSON/YAML templates for provisioning AWS resources
      • AWS CDK (Cloud Development Kit) – define infrastructure using familiar programming languages (TypeScript, Python, Java, Go, C#) that synthesize to CloudFormation
      • AWS SAM (Serverless Application Model) – simplified CloudFormation for serverless applications
    • Note: AWS OpsWorks reached End of Life on May 26, 2024 and is no longer available. Use AWS Systems Manager, CloudFormation, or CDK as alternatives.

Automation

  • AWS provides various automation tools and services which help improve system’s stability, efficiency and time to market.
    • Elastic Beanstalk
      • a PaaS that allows quick application deployment while handling resource provisioning, load balancing, auto scaling, monitoring etc
    • EC2 Auto Recovery
      • creates CloudWatch alarm that monitors an EC2 instance and automatically recovers it if it becomes impaired.
      • A recovered instance is identical to the original instance, including the instance ID, private & Elastic IP addresses, and all instance metadata.
      • Instance is migrated through reboot, in memory contents are lost.
    • Auto Scaling
      • allows maintain application availability and scale the capacity up or down automatically as per defined conditions
      • supports predictive scaling that uses machine learning to forecast traffic and proactively scale capacity
    • CloudWatch Alarms
      • allows SNS triggers to be configured when a particular metric goes beyond a specified threshold for a specified number of periods
    • Amazon EventBridge (formerly CloudWatch Events)
      • allows real-time stream of system events that describe changes in AWS resources
      • extends capabilities with partner event sources, Schema Registry, and EventBridge Pipes for point-to-point integrations
      • EventBridge Scheduler supports one-time and recurring schedules with built-in retry policies
    • AWS Systems Manager
      • provides operational management for AWS resources including patch management, configuration compliance, and automated runbooks
      • replaces the need for OpsWorks with features like State Manager, Automation, and Run Command
    • Lambda Scheduled Events
      • allows Lambda function creation and direct AWS Lambda to execute it on a regular schedule via EventBridge Scheduler.

Loose Coupling

  • AWS helps loose coupled architecture that reduces interdependencies, a change or failure in a component does not cascade to other components
    • Asynchronous Integration
      • does not involve direct point-to-point interaction but usually through an intermediate durable storage layer for e.g. SQS, Kinesis, EventBridge
      • decouples the components and introduces additional resiliency
      • suitable for any interaction that doesn’t need an immediate response and an ack that a request has been registered will suffice
    • Service Discovery
      • allows new resources to be launched or terminated at any point in time and discovered as well for e.g. using ELB as a single point of contact with hiding the underlying instance details or Route 53 zones to abstract load balancer’s endpoint
      • AWS Cloud Map provides service discovery for cloud resources, allowing applications to discover services via API calls, DNS queries, or directly through the SDK
    • Well-Defined Interfaces
      • allows various components to interact with each other through specific, technology agnostic interfaces for e.g. RESTful APIs with API Gateway
      • Amazon API Gateway supports REST APIs, HTTP APIs, and WebSocket APIs for real-time communication

Services, Not Servers

  • AWS encourages leveraging managed services and serverless architectures to reduce operational overhead
    • Serverless compute – AWS Lambda for event-driven functions, AWS Fargate for serverless containers
    • Managed databases – Amazon RDS, DynamoDB, Aurora Serverless for auto-scaling relational databases
    • Application integration – SQS, SNS, EventBridge, Step Functions for workflow orchestration
    • API management – API Gateway for creating, publishing, and managing APIs at scale

Databases

  • AWS provides different categories of database technologies
    • Relational Databases (RDS)
      • normalizes data into well-defined tabular structures known as tables, which consist of rows and columns
      • provide a powerful query language, flexible indexing capabilities, strong integrity controls, and the ability to combine data from multiple tables in a fast and efficient manner
      • allows vertical scalability by increasing resources and horizontal scalability using Read Replicas for read capacity and sharding or data partitioning for write capacity
      • provides High Availability using Multi-AZ deployment, where data is synchronously replicated
      • Amazon Aurora provides MySQL and PostgreSQL-compatible databases with up to 5x and 3x better throughput respectively, with automatic storage scaling up to 128 TB
      • Aurora Serverless v2 scales capacity automatically based on application demand, ideal for variable workloads
    • NoSQL Databases (DynamoDB)
      • provides databases that trade some of the query and transaction capabilities of relational databases for a more flexible data model that seamlessly scales horizontally
      • perform data partitioning and replication to scale both the reads and writes in a horizontal fashion
      • DynamoDB service synchronously replicates data across three facilities in an AWS region to provide fault tolerance in the event of a server failure or Availability Zone disruption
      • DynamoDB Global Tables provide multi-region, active-active replication for globally distributed applications
      • DynamoDB On-Demand mode eliminates capacity planning by automatically scaling to accommodate workloads
    • Data Warehouse (Redshift)
      • Specialized type of relational database, optimized for analysis and reporting of large amounts of data
      • Redshift achieves efficient storage and optimum query performance through a combination of massively parallel processing (MPP), columnar data storage, and targeted data compression encoding schemes
      • Redshift MPP architecture enables increasing performance by increasing the number of nodes in the data warehouse cluster
      • Redshift Serverless automatically provisions and scales capacity, allowing analytics without cluster management
    • Purpose-Built Databases
      • Amazon ElastiCache – in-memory caching (Redis, Memcached) for sub-millisecond latency
      • Amazon Neptune – graph database for highly connected datasets
      • Amazon Timestream – time series database for IoT and operational applications
      • Amazon MemoryDB for Redis – Redis-compatible, durable, in-memory database
  • For more details refer to AWS Storage Options Whitepaper

Removing Single Points of Failure

  • AWS provides ways to implement redundancy, automate recovery and reduce disruption at every layer of the architecture
  • AWS supports redundancy in the following ways
    • Standby Redundancy
      • When a resource fails, functionality is recovered on a secondary resource using a process called failover.
      • Failover will typically require some time before it completes, and during that period the resource remains unavailable.
      • Secondary resource can either be launched automatically only when needed (to reduce cost), or it can be already running idle (to accelerate failover and minimize disruption).
      • Standby redundancy is often used for stateful components such as relational databases.
    • Active Redundancy
      • requests are distributed to multiple redundant compute resources, if one fails, the rest can simply absorb a larger share of the workload.
      • Compared to standby redundancy, it can achieve better utilization and affect a smaller population when there is a failure.
  • AWS supports replication
    • Synchronous replication
      • acknowledges a transaction after it has been durably stored in both the primary location and its replicas.
      • protects data integrity from the event of a primary node failure
      • used to scale read capacity for queries that require the most up-to-date data (strong consistency).
      • compromises performance and availability
    • Asynchronous replication
      • decouples the primary node from its replicas at the expense of introducing replication lag
      • used to horizontally scale the system’s read capacity for queries that can tolerate that replication lag.
    • Quorum-based replication
      • combines synchronous and asynchronous replication to overcome the challenges of large-scale distributed database systems
      • Replication to multiple nodes can be managed by defining a minimum number of nodes that must participate in a successful write operation
  • AWS provide services to reduce or remove single point of failure
    • Regions, Availability Zones with multiple data centers
    • ELB or Route 53 to configure health checks and mask failure by routing traffic to healthy endpoints
    • Auto Scaling to automatically replace unhealthy nodes
    • EC2 auto-recovery to recover unhealthy impaired nodes
    • S3, DynamoDB with data redundantly stored across multiple facilities
    • Multi-AZ RDS, Aurora (6 copies across 3 AZs), and Read Replicas
    • ElastiCache Redis engine supports replication with automatic failover
    • AWS Elastic Disaster Recovery (DRS) for continuous replication and automated recovery of on-premises and cloud-based applications
  • For more details refer to AWS Disaster Recovery Whitepaper

Optimize for Cost

  • AWS can help organizations reduce capital expenses and drive savings as a result of the AWS economies of scale
  • AWS provides different options which should be utilized as per use case –
    • EC2 pricing models:
      • On-Demand – pay per second/hour with no commitment
      • Savings Plans – commit to a consistent amount of usage (measured in $/hr) for 1 or 3 years; Compute Savings Plans (up to 66% savings) and EC2 Instance Savings Plans (up to 72% savings)
      • Reserved Instances – capacity reservation with up to 72% discount for 1 or 3 year terms
      • Spot Instances – up to 90% discount for fault-tolerant, flexible workloads using spare capacity
      • Dedicated Hosts – single-tenant hardware for compliance and BYOL licensing
    • AWS Graviton instances for up to 40% better price-performance over comparable x86 instances
    • AWS Cost Optimization Hub, Trusted Advisor, and AWS Compute Optimizer to identify cost savings opportunities
    • S3 storage classes:
      • S3 Standard – frequently accessed data
      • S3 Intelligent-Tiering – automatic cost optimization for data with unknown or changing access patterns
      • S3 Standard-Infrequent Access (S3 Standard-IA) – infrequently accessed data
      • S3 One Zone-IA – infrequently accessed data not requiring multi-AZ resilience
      • S3 Glacier Instant Retrieval, Flexible Retrieval, and Deep Archive – long-term archive storage
      • S3 Express One Zone – single-digit millisecond latency for most frequently accessed data (up to 10x faster than S3 Standard)
    • EBS volumes – General Purpose SSD (gp3), Provisioned IOPS SSD (io2 Block Express), Throughput Optimized HDD (st1), Cold HDD (sc1). Note: Magnetic (standard) is a previous-generation volume type; gp3 is recommended as default.
    • Cost Allocation tags to identify costs based on tags
    • Auto Scaling to horizontally scale the capacity up or down based on demand
    • Lambda and Fargate based serverless architectures to never pay for idle or redundant resources
    • Utilize managed services where scaling is handled by AWS for e.g. ELB, CloudFront, Kinesis, SQS, Amazon OpenSearch Service etc.

Caching

  • Caching improves application performance and increases the cost efficiency of an implementation
    • Application Data Caching
      • provides services that help store and retrieve information from fast, managed, in-memory caches
      • Amazon ElastiCache is a web service that makes it easy to deploy, operate, and scale an in-memory cache in the cloud and supports two open-source in-memory caching engines: Memcached and Redis
      • Amazon DynamoDB Accelerator (DAX) provides a fully managed, in-memory cache for DynamoDB with microsecond response times
    • Edge Caching
      • allows content to be served by infrastructure that is closer to viewers, lowering latency and giving high, sustained data transfer rates needed to deliver large popular objects to end users at scale.
      • Amazon CloudFront is Content Delivery Network (CDN) consisting of 600+ Points of Presence (edge locations and regional caches), that allows copies of static and dynamic content to be cached
      • CloudFront Functions and Lambda@Edge enable running code at edge locations for request/response manipulation

Security

  • AWS works on shared security responsibility model
    • AWS is responsible for the security of the underlying cloud infrastructure
    • you are responsible for securing the workloads you deploy in AWS
  • AWS also provides ample security features
    • IAM to define a granular set of policies and assign them to users, groups, and AWS resources
    • IAM roles to assign short term credentials to resources, which are automatically distributed and rotated
    • AWS IAM Identity Center (formerly AWS SSO) for centralized workforce identity management and single sign-on across AWS accounts and applications
    • Amazon Cognito, for mobile and web applications, which allows client devices to get controlled access to AWS resources via temporary tokens
    • VPC to isolate parts of infrastructure through the use of subnets, security groups, and routing controls
    • AWS WAF to help protect web applications from SQL injection, cross-site scripting, and other common exploits with managed rule groups
    • CloudWatch logs to collect logs centrally as the servers are temporary
    • CloudTrail for auditing AWS API calls, which delivers a log file to S3 bucket. Logs can then be stored in an immutable manner and automatically processed to either notify or even take action on your behalf, protecting your organization from non-compliance
    • AWS Security Hub – unified security posture management that aggregates findings from GuardDuty, Inspector, Macie, and partner tools with automated compliance checks
    • Amazon GuardDuty – intelligent threat detection using machine learning, anomaly detection, and integrated threat intelligence to identify malicious activity
    • Amazon Inspector – automated vulnerability management that continuously scans EC2 instances, container images (ECR), Lambda functions, and code repositories for software vulnerabilities
    • AWS Config for continuous compliance monitoring, and AWS Trusted Advisor for best practice recommendations across cost, performance, security, fault tolerance, and service limits
  • For more details refer to AWS Security Whitepaper

AWS Well-Architected Framework

  • The AWS Well-Architected Framework is the successor to this whitepaper and provides comprehensive guidance for building secure, high-performing, resilient, and efficient infrastructure
  • The Framework is built on six pillars:
    • Operational Excellence – running and monitoring systems to deliver business value and continually improve processes and procedures
    • Security – protecting information and systems through risk assessments, mitigation strategies, and security best practices
    • Reliability – ensuring workloads perform correctly and consistently, with ability to recover from failures and meet demand
    • Performance Efficiency – using computing resources efficiently to meet requirements and maintain efficiency as demand changes
    • Cost Optimization – avoiding unnecessary costs through understanding spending, selecting the right resources, and scaling to meet needs without overspending
    • Sustainability (added 2021) – minimizing environmental impacts by reducing energy consumption and increasing efficiency of cloud workloads
  • The AWS Well-Architected Tool in the AWS Management Console allows workload reviews against framework best practices
  • AWS also provides Well-Architected Lenses for specific workload types (Serverless, SaaS, Machine Learning, Data Analytics, IoT, etc.)

References

 

AWS Pricing – Whitepaper – Certification

~ Last updated on : ~ jayendrapatil

AWS Pricing Overview

📌 Note: This post has been updated to reflect current AWS pricing models, tools, and features as of 2025. The original AWS Pricing Whitepaper (2016) has been superseded by the How AWS Pricing Works whitepaper (last revised December 2024).

AWS pricing features include

  • Pay as you go
    • No minimum contracts/commitments or long-term contracts required
    • Pay only for services you use that can be stopped when not needed
    • Each service is charged independently, providing flexibility to choose services as needed
  • Pay less when you reserve
    • Services like EC2 and RDS provide Reserved Instances, which offer significantly discounted rates (up to 72% off On-Demand)
    • Savings Plans offer flexible commitment-based pricing with up to 72% savings on compute (EC2, Lambda, Fargate) and database usage
  • Pay even less by using more
    • Services like storage and data transfer offer tiered pricing — the more the usage, the less you pay per gigabyte
    • Consolidated billing to consolidate multiple accounts and get tiering benefits across the organization
  • Pay even less as AWS grows
    • AWS works continuously to reduce costs by reducing data center hardware costs, improving operational efficiencies, lowering power consumption, and generally lowering the cost of doing business
    • AWS has announced over 130 price reductions since launch
  • Free services
    • AWS offers many services free of charge including VPC, Elastic Beanstalk, CloudFormation, IAM, Auto Scaling, OpsWorks, and Organizations (Consolidated Billing)
    • Note: While these services are free, resources provisioned by them (e.g., EC2 instances launched via Elastic Beanstalk) are charged at standard rates
  • AWS Free Tier
    • AWS Free Tier for customers to explore AWS services at no cost
    • ⚠️ Updated July 2025: For new accounts created after July 15, 2025, AWS replaced the traditional 12-month Free Tier with a credit-based model offering up to $200 in credits ($100 at sign-up + $100 earned through activities). Customers choose between a Free plan (6 months) and a Paid plan.
    • Existing accounts (created before July 15, 2025) retain the original 12-month Free Tier structure
    • Always Free offerings remain available (e.g., Lambda 1M requests/month, DynamoDB 25GB, CloudWatch 10 metrics)

AWS Pricing & Cost Management Tools

  • AWS Pricing Calculator — the current tool to estimate costs for AWS services. Provides per-service cost breakdown and aggregate monthly/annual estimates. Supports authenticated in-console mode (GA 2025) that incorporates your discounts and commitments.
    • Note: The AWS Simple Monthly Calculator was retired on March 31, 2023. The AWS TCO Calculator has also been retired. Use the AWS Pricing Calculator for all new estimates.
  • AWS Cost Explorer — visualize, understand, and manage AWS costs and usage over time with custom reports, forecasting, and Savings Plans/RI recommendations.
  • AWS Budgets — set custom budgets and receive alerts when costs or usage exceed thresholds.
  • AWS Cost and Usage Reports (CUR) — comprehensive and customizable reporting on AWS costs with granular line-item data.
  • AWS Billing and Cost Management Console — view current charges, account activity, itemized by service and usage type. Previous months’ billing statements are available.

AWS Pricing Fundamental Characteristics

  • AWS basically charges for
    • Compute
    • Storage
    • Data Transfer Out — aggregated across services (EC2, S3, RDS, DynamoDB, etc.) and charged at the outbound data transfer rate
  • AWS does not charge for
    • Inbound data transfer across all AWS services in all regions
    • Outbound data transfer between AWS services within the same region (in most cases)
  • ⚠️ Public IPv4 Address Charges (Effective Feb 1, 2024):
    • All public IPv4 addresses are charged at $0.005 per IP per hour (~$3.65/month), whether attached to a service or not
    • Applies to EC2, RDS, EKS, NAT Gateway, Load Balancers, VPN, and all services with public IPv4
    • Free Tier includes 750 hours of public IPv4 usage per month for the first 12 months
    • BYOIP (Bring Your Own IP) addresses are not charged
    • AWS recommends adopting IPv6 to reduce costs

AWS Savings Plans

Savings Plans are a flexible pricing model offering savings of up to 72% on AWS compute and database usage in exchange for a commitment to a consistent amount of usage (measured in $/hour) for a 1 or 3-year term.

  • Compute Savings Plans
    • Most flexible — automatically applies to EC2, Lambda, and Fargate usage
    • Up to 66% savings regardless of instance family, size, AZ, Region, OS, or tenancy
  • EC2 Instance Savings Plans
    • Up to 72% savings, applies to a specific instance family in a Region
    • Flexible across size, OS, and tenancy within the committed family
  • SageMaker Savings Plans
    • Up to 64% savings on SageMaker usage
  • Database Savings Plans (launched 2024)
    • Applies to RDS, Aurora, Redshift, Neptune, and other database services
    • 1-year term commitment with flexible coverage across database engines and instance types
  • Payment Options: All Upfront (best discount), Partial Upfront, or No Upfront

AWS Elastic Cloud Compute – EC2

EC2 provides resizable compute capacity in the cloud and the cost depends on –

  • Clock Hours of Server Time
    • Resources are charged for the time they are running
    • EC2 uses per-second billing (minimum 60 seconds) for Linux, Windows, and Ubuntu instances. Some commercial OS instances still use hourly billing.
  • Machine Configuration
    • Depends on the physical capacity — pricing varies with the AWS Region, OS, number of cores, memory, and processor architecture
    • AWS Graviton (Arm-based) instances offer up to 40% better price-performance compared to x86 instances
  • Machine Purchase Type
    • On-Demand Instances — pay for compute capacity per second/hour with no commitments
    • Reserved Instances — 1 or 3-year commitment for up to 72% discount (Standard and Convertible types)
    • Savings Plans — flexible commitment-based pricing (Compute or EC2 Instance plans) for up to 72% savings
    • Spot Instances — use spare EC2 capacity at up to 90% discount compared to On-Demand. Instances can be interrupted with 2-minute notice when capacity is needed back.
    • Dedicated Hosts — physical servers dedicated to your use, useful for licensing compliance
    • Capacity Reservations — reserve capacity in a specific AZ without commitment discount
  • Auto Scaling & Number of Instances
    • Auto Scaling automatically adjusts the number of EC2 instances based on demand
    • No additional charge for Auto Scaling — you pay only for the EC2 instances launched
  • Load Balancing
    • Elastic Load Balancing (ELB) distributes traffic among EC2 instances
    • Charged per Load Balancer Capacity Unit (LCU) per hour for ALB/NLB/GWLB, or per hour + data processed for CLB
  • CloudWatch Monitoring
    • Basic monitoring (5-minute intervals) is available at no additional cost
    • Detailed monitoring (1-minute intervals) is charged per metric per month
  • Elastic IP Addresses
    • ⚠️ Updated Feb 2024: All public IPv4 addresses (including Elastic IPs) are now charged at $0.005/hour whether in-use or idle
    • Previously, only unattached Elastic IPs were charged — this is no longer the case
    • Additional Elastic IPs on a running instance continue to be charged at $0.005/hour
  • Operating Systems and Software Packages
    • OS prices are included in the instance prices for Amazon Linux, Ubuntu, Windows, RHEL, SUSE, and other commercial OS options
    • Commercial software from AWS Marketplace incurs additional licensing costs

AWS Lambda

AWS Lambda lets you run code without provisioning or managing servers and the cost depends on

  • Number of Requests
    • Lambda registers a request each time it starts executing in response to an event notification or invoke call
    • Charges are for the total number of requests across all functions
    • Free Tier: 1 million requests per month (always free)
  • Duration
    • Calculated from the time code begins executing until it returns or terminates, rounded up to the nearest 1 millisecond (updated from 100ms in Dec 2020)
    • Price depends on the amount of memory allocated to the function (128 MB to 10,240 MB)
    • Free Tier: 400,000 GB-seconds per month (always free)
  • Processor Architecture
    • Functions running on ARM/Graviton2 architecture get 20% lower duration charges compared to x86, delivering up to 34% better price-performance
  • Tiered Pricing (introduced 2022)
    • Duration charges are tiered — higher usage tiers get lower per-GB-second rates
    • Applied separately for x86 and Arm architectures
  • Provisioned Concurrency
    • Optional feature to keep functions initialized — charged for provisioned concurrency amount plus duration and requests
  • INIT Phase Billing (effective August 1, 2025)
    • AWS standardized billing for the initialization (INIT) phase across all Lambda configurations
    • Previously, INIT phase for ZIP-packaged functions with managed runtimes was unbilled

AWS Simple Storage Service – S3

S3 provides object storage and the cost depends on

  • Storage Class
    • S3 Standard — frequently accessed data; 99.999999999% durability and 99.99% availability
    • S3 Intelligent-Tiering — automatically moves data between access tiers based on usage patterns; no retrieval charges; small monthly monitoring fee per object
    • S3 Express One Zone (launched Nov 2023) — single-digit millisecond latency, up to 10x faster than S3 Standard, 80% lower request costs; single AZ
    • S3 Standard-IA (Infrequent Access) — lower storage cost, retrieval fee applies; 99.9% availability
    • S3 One Zone-IA — lower cost than Standard-IA, stored in a single AZ; 99.5% availability
    • S3 Glacier Instant Retrieval — archive storage with millisecond retrieval
    • S3 Glacier Flexible Retrieval (formerly S3 Glacier) — minutes to hours retrieval
    • S3 Glacier Deep Archive — lowest cost storage with 12-48 hour retrieval
  • Storage
    • Number and size of objects stored and the storage class selected
  • Requests & Data Retrievals
    • Number and type of requests (GET, PUT, COPY, LIST, etc.) — rates vary by request type and storage class
    • Retrieval fees apply for IA and Glacier classes
  • Data Transfer Out
    • Amount of data transferred out of S3 to the internet (tiered pricing)
    • Data transfer from S3 to CloudFront within the same Region is free (since 2024)
  • Management & Analytics
    • S3 Inventory, S3 Analytics, S3 Storage Lens, and Object Tagging have separate charges

AWS Elastic Block Store – EBS

EBS provides block level storage volumes and the cost depends on

  • Volumes
    • EBS provides multiple volume types:
      • General Purpose SSD (gp3, gp2) — gp3 is the latest generation, 20% lower cost per GB than gp2, with independently configurable IOPS and throughput
      • Provisioned IOPS SSD (io2 Block Express, io2, io1) — for I/O-intensive workloads; io2 Block Express supports up to 256,000 IOPS
      • Throughput Optimized HDD (st1) — for frequently accessed, throughput-intensive workloads
      • Cold HDD (sc1) — lowest cost for infrequently accessed data
    • Charged by the amount provisioned in GB per month until released
  • IOPS
    • gp3: 3,000 IOPS and 125 MiB/s included free; additional IOPS/throughput provisioned separately
    • gp2: IOPS scales with volume size (3 IOPS per GB)
    • io1/io2: Charged per provisioned IOPS per month
    • st1/sc1: No IOPS charges
  • Snapshots
    • Snapshots are stored incrementally in S3, charged per GB-month of data stored
    • EBS Snapshots Archive offers up to 75% lower snapshot storage cost for long-term retention
  • Data Transfer Out
    • Outbound data transfer charges are tiered

AWS Relational Database Service – RDS

RDS provides an easy-to-set-up, operate, and scale relational database in the cloud and the cost depends on

  • Clock Hours of Server Time
    • Resources are charged for the time they are running, from DB instance launch until termination
    • Stopped DB instances still incur storage costs (and are automatically restarted after 7 days)
  • Database Characteristics
    • Pricing varies with the database engine (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, or Aurora), instance size, memory class, and processor (x86 vs. Graviton)
    • Graviton-based instances (r6g, r7g, r8g families) offer better price-performance than x86 equivalents
  • Database Purchase Type
    • On-Demand — pay per hour/second with no commitment
    • Reserved Instances — 1 or 3-year term for significant discounts
    • Database Savings Plans (launched 2024) — flexible commitment-based pricing across RDS, Aurora, Redshift, and Neptune
    • Aurora Serverless — pay per Aurora Capacity Unit (ACU) per second; scales to zero when idle
  • Provisioned Storage
    • Backup storage of up to 100% of provisioned database storage for an active DB Instance is not charged
    • After termination, backup storage is billed per GB per month
  • Additional Storage
    • Backup storage exceeding the free allocation is billed per GB per month
  • Requests (I/O)
    • Number of input and output requests to the database
    • Aurora I/O-Optimized configuration eliminates I/O charges in exchange for ~30% higher compute/storage cost
  • Deployment Type
    • Multi-AZ deployments cost approximately 2x Single-AZ for high availability
    • Multi-AZ with readable standbys (2 replicas) available for Aurora and RDS
  • Data Transfer Out
    • Outbound data transfer costs are tiered
    • Inbound data transfer is free
    • Data transfer between RDS and EC2 in the same AZ is free

AWS CloudFront

CloudFront is a web service for content delivery, distributing content to end users with low latency and high data transfer speeds with no minimum commitments.

  • Traffic Distribution
    • Data transfer and request pricing vary across geographic regions, based on the edge location through which content is served
  • Requests
    • Number and type of requests (HTTP or HTTPS) and the geographic region
  • Data Transfer Out
    • Amount of data transferred out of CloudFront edge locations to the internet
    • Data transfer from S3 origin to CloudFront is free (within the same Region)
  • Flat-Rate Pricing Plans (launched Nov 2025)
    • Fixed monthly fee bundling data transfer, requests, AWS WAF, Shield, DNS (Route 53), logging, and serverless edge compute
    • Includes monthly S3 storage credits
    • No overage charges — predictable pricing for website delivery and security
  • CloudFront Security Savings Bundle
    • Up to 30% savings on CloudFront charges in exchange for a monthly commit (1-year term)
    • Includes AWS WAF charges covered within the commitment

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. How does AWS charge for AWS Lambda?
    1. Users bid on the maximum price they are willing to pay per hour.
    2. Users choose a 1-, 3- or 5-year upfront payment term.
    3. Users pay for the required permanent storage on a file system or in a database.
    4. Users pay based on the number of requests and consumed compute resources.
  2. Which AWS pricing model provides the MOST flexibility without long-term commitment?
    1. Reserved Instances
    2. Savings Plans
    3. On-Demand
    4. Spot Instances
  3. Which tool should be used to estimate costs for a new AWS architecture?
    1. AWS Simple Monthly Calculator
    2. AWS Pricing Calculator
    3. AWS Cost Explorer
    4. AWS Budgets

    Note: The Simple Monthly Calculator was retired in March 2023. AWS Pricing Calculator is the current tool.

  4. Starting February 2024, which statement about AWS public IPv4 addresses is correct?
    1. Only idle Elastic IP addresses are charged
    2. All public IPv4 addresses are charged at $0.005/hour whether in-use or idle
    3. Public IPv4 addresses are free for the first 12 months only
    4. Only addresses not associated with EC2 instances are charged
  5. Which AWS Savings Plan type offers the MOST flexibility?
    1. EC2 Instance Savings Plans
    2. Compute Savings Plans
    3. SageMaker Savings Plans
    4. Database Savings Plans

    Explanation: Compute Savings Plans automatically apply across EC2, Lambda, and Fargate regardless of instance family, size, Region, or OS.

  6. A company wants to reduce EC2 costs by up to 90% but can tolerate interruptions. Which purchase option should they use?
    1. Reserved Instances
    2. On-Demand Instances
    3. Spot Instances
    4. Savings Plans
  7. Which S3 storage class automatically moves objects between access tiers to optimize costs?
    1. S3 Standard
    2. S3 Standard-IA
    3. S3 Intelligent-Tiering
    4. S3 Glacier Flexible Retrieval

References

AWS Automated Backups

~ Last updated on : ~ jayendrapatil ~ 9 Comments

AWS Automated Backups

  • AWS provides automated backup capabilities across multiple services, either natively or through AWS Backup — a fully managed, centralized backup service.
  • Services with native automated backups include:
  • Amazon Data Lifecycle Manager helps automate EC2 EBS volume snapshots and AMI management
  • AWS Backup provides centralized, policy-based backup across 20+ AWS services including EC2, EBS, RDS, Aurora, DynamoDB, EFS, S3, FSx, EKS, Redshift Serverless, DocumentDB, Neptune, Timestream, and more.
  • AWS stores the backups and snapshots in S3

AWS Backup (Centralized Backup Service)

  • AWS Backup is a fully managed service that centralizes and automates data protection across AWS services and hybrid workloads.
  • Supports 20+ AWS services: EC2, EBS, RDS, Aurora, Aurora DSQL, DynamoDB, EFS, S3, FSx, Storage Gateway, DocumentDB, Neptune, Redshift (Provisioned and Serverless), Timestream, EKS, CloudFormation, SAP HANA, and VMware VMs.
  • Key Features:
    • Backup Plans — define schedules, retention rules, and lifecycle policies; supports frequencies as often as every hour.
    • Cross-Region and Cross-Account Copy — automatically replicate backups for disaster recovery.
    • Logically Air-Gapped Vaults (2024) — immutable, deletion-protected backup storage for ransomware recovery. Supports multi-party approval and direct restore.
    • Backup Audit Manager — audit and report on compliance of data protection policies.
    • Restore Testing — validate recoverability by scheduling automated restore tests.
    • GuardDuty Integration — automated malware scanning of recovery points for EC2, EBS, and S3 backups.
    • Cold Storage Tiering — transition backups to lower-cost cold storage (DynamoDB, EBS, EFS).
  • 2025 Updates:
    • Support for Amazon Redshift Serverless (April 2025)
    • Support for Amazon EKS clusters including persistent storage
    • Single-action cross-Region database snapshot copies to logically air-gapped vaults (Aurora, Neptune, DocumentDB)
    • Enhanced resource selection with tag-based exclusions in Organizations policies
    • Primary backup support directly in logically air-gapped vaults (reduces costs vs. copy-based approach)

RDS Backups

  • RDS supports automated backups as well as manual snapshots
  • Automated Backups
    • enable point-in-time recovery of the DB Instance
    • perform a full daily backup and capture transaction logs (as updates to your DB instance are made)
    • are performed during the defined preferred backup window and retained for a user-specified retention period (default 1 day, max 35 days)
    • When a point-in-time recovery is initiated, transaction logs are applied to the most appropriate daily backup to restore the DB instance to the specific requested time.
    • allows a point-in-time restore to any second during the retention period, up to the Latest Restorable Time (typically within the last 5 minutes)
    • are deleted when the DB instance is deleted
    • Cross-Region Automated Backup Replication — replicates snapshots and transaction logs to a destination AWS Region for disaster recovery. Supports point-in-time recovery in the secondary region.
  • Snapshots
    • are user-initiated and enable backing up the DB instance in a known state as frequently as needed, and can be restored to that specific state at any time.
    • can be created with the AWS Management Console or by using the CreateDBSnapshot API call.
    • are not deleted when the DB instance is deleted
    • can be copied across regions and shared with other AWS accounts
  • Automated backups and snapshots can result in a performance hit, if Multi-AZ is not enabled
  • AWS Backup can manage both RDS and Aurora backups centrally with cross-account and cross-Region copy capabilities.

DynamoDB Backups

  • DynamoDB Point-in-Time Recovery (PITR) provides continuous backups of table data.
  • When enabled, allows restore to any second within the configured recovery period.
  • Configurable recovery period (Jan 2025) — PITR period can now be set between 1–35 days per table (previously fixed at 35 days), allowing cost optimization for tables needing shorter retention.
  • PITR pricing is based on table size and local secondary indexes, not the recovery period duration.
  • DynamoDB also supports on-demand manual backups that are retained until explicitly deleted.
  • AWS Backup provides advanced DynamoDB features: cross-Region/cross-account copy, cold storage tiering, and tag-based cost management.

ElastiCache Automated Backups

  • ElastiCache supports automated backups (snapshots) for Valkey, Redis OSS, and Serverless Memcached caches.
  • Note: AWS recommends Valkey as the preferred engine — an open-source, vendor-neutral alternative to Redis OSS maintained by the Linux Foundation. Valkey 9.0 is available as of May 2026.
  • ElastiCache creates a daily backup of the cache during the configured backup window.
  • Snapshot operations may degrade performance, so backups should be scheduled during the least busy part of the day.
  • Backups are retained for the backup retention limit defined, with a maximum of 35 days.
  • ElastiCache also allows manual snapshots of the cache.
  • ElastiCache Serverless supports backups via RDB files compatible with Valkey 7.2+ and Redis OSS 5.0+.
  • Memcached (non-serverless) does NOT support backups.

Redshift Automated Backups

  • Amazon Redshift enables automated backups by default.
  • Redshift continuously backs up data to S3 and retains automated backups for 1 day (extendable to max 35 days).
  • Backups are incremental — only changed data since the last snapshot is backed up, minimizing storage usage.
  • Redshift also allows manual snapshots of the data warehouse.
  • Cross-Region Snapshot Replication — automated snapshots can be replicated to another AWS Region for disaster recovery.
  • Redshift Serverless — supports both automated recovery points and manual snapshots. Recovery points are created approximately every 30 minutes and retained for 24 hours.
  • AWS Backup Integration (April 2025) — AWS Backup now supports Redshift Serverless, enabling centralized backup management alongside provisioned clusters.
  • Incremental Snapshot Billing (June 2026) — new billing model for manual snapshots on Redshift Serverless and Redshift RG charges only for unique data blocks across active snapshots, reducing costs.
  • Default security enhancements (2025): newly created clusters and restored snapshots now have encryption enabled by default and public accessibility disabled.

EC2 EBS Backups

  • EBS volume snapshots can be automated using Amazon Data Lifecycle Manager (DLM)
  • DLM supports:
    • Scheduled snapshot creation with custom cron expressions or preset frequencies
    • Automated retention and deletion policies
    • Cross-Region and cross-account snapshot copy
    • Application-consistent snapshots — uses pre/post scripts via AWS Systems Manager documents for database-consistent backups (e.g., SAP HANA, SQL Server)
    • AMI lifecycle management (creation and deregistration)
  • EBS snapshots can also be created manually via the AWS Console, CLI, or APIs
  • EBS Snapshots are incremental and block-based — they consume space only for changed data after the initial snapshot
  • Data can be restored from snapshots by creating a new volume from the snapshot
  • EBS snapshots are region-specific and can be copied between AWS regions
  • EBS Snapshot Archive — move infrequently accessed snapshots to archive tier for up to 75% cost savings (minimum 90-day archive period)
  • Recycle Bin — protects against accidental deletion by retaining deleted snapshots, AMIs, and EBS volumes for a configured period. Supports tag-based exclusions (Nov 2024) and EBS volume recovery (Nov 2025).
  • Stored on S3 (managed by AWS, not visible in customer S3 buckets)
  • AWS Backup can also manage EBS snapshots centrally as an alternative to DLM.

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. Which two AWS services provide out-of-the-box user configurable automatic backup-as-a-service and backup rotation options? Choose 2 answers
    1. Amazon S3
    2. Amazon RDS
    3. Amazon EBS
    4. Amazon Redshift
  2. You have been asked to automate many routine systems administrator backup and recovery activities. Your current plan is to leverage AWS-managed solutions as much as possible and automate the rest with the AWS CLI and scripts. Which task would be best accomplished with a script?
    1. Creating daily EBS snapshots with a monthly rotation of snapshots
    2. Creating daily RDS snapshots with a monthly rotation of snapshots
    3. Automatically detect and stop unused or underutilized EC2 instances
    4. Automatically add Auto Scaled EC2 instances to an Amazon Elastic Load Balancer

    Note: This question is outdated. Amazon Data Lifecycle Manager and AWS Backup now automate EBS snapshot creation and rotation without custom scripts.

  3. A company wants to centrally manage backups across multiple AWS services including EC2, RDS, DynamoDB, and EFS. Which AWS service should they use?
    1. Amazon Data Lifecycle Manager
    2. AWS Storage Gateway
    3. AWS Backup
    4. Amazon S3 Lifecycle Policies
  4. Which feature of AWS Backup helps protect against ransomware by providing immutable, deletion-protected backup storage?
    1. Backup Vault Lock
    2. Logically Air-Gapped Vault
    3. Cross-Region Copy
    4. Cold Storage Tiering
  5. A company needs to protect EBS snapshots from accidental deletion while keeping costs optimized for infrequently accessed snapshots. Which combination of features should they use? (Choose 2)
    1. EBS Snapshot Archive
    2. S3 Glacier Deep Archive
    3. Recycle Bin
    4. EBS Fast Snapshot Restore
  6. A company wants to replicate their RDS automated backups to another AWS Region for disaster recovery purposes. Which feature should they enable?
    1. Read Replica in the target Region
    2. Cross-Region Automated Backup Replication
    3. AWS Backup with cross-Region copy rule
    4. Manual snapshot copy via Lambda

    Note: Both options B and C are valid approaches. Cross-Region Automated Backup Replication is the native RDS feature, while AWS Backup provides centralized management.

AWS Billing and Cost Management – Certification

~ Last updated on : ~ jayendrapatil ~ 7 Comments

AWS Billing and Cost Management

  • AWS Billing and Cost Management is the service that you use to pay your AWS bill, monitor your usage, and budget your costs.
  • It provides a comprehensive suite of tools for cost visualization, budgeting, anomaly detection, optimization recommendations, and financial governance across single or multiple AWS Organizations.

Analyzing Costs with Cost Explorer

  • AWS Cost Explorer allows you to visualize, understand, and manage your AWS costs and usage over time.
  • Cost Explorer provides filters by API operations, Availability Zones, AWS service, custom cost allocation tags, EC2 instance type, purchase options, region, usage type, usage type groups, or, if Consolidated Billing is used, by linked account.
  • Cost Explorer supports multiple cost metrics including unblended, blended, amortized, net unblended, and net amortized costs.
  • Cost Comparison (2025) – automatically detects significant cost changes between two months and surfaces the key factors driving these changes, enabling quick month-over-month analysis.
  • 18-Month Forecasting (2025) – extends the forecasting horizon from 12 to 18 months using improved ML models that analyze up to 36 months of historical data.
  • AI-Powered Cost Analysis (2025-2026) – integrates with Amazon Q Developer to deliver intelligent cost explanations. You can ask natural language questions directly in Cost Explorer, which automatically configures charts and reports to reflect the analysis.
  • Historical Data Retention (2026) – accounts in billing groups retain access to their historical billing data at original billable rates.

Cost Anomaly Detection

  • AWS Cost Anomaly Detection uses machine learning to continuously monitor your cost and usage to detect unusual spends.
  • You can create monitors for AWS services, linked accounts, cost allocation tags, or cost categories.
  • Monitors evaluate your spending patterns and alert you when anomalies are detected.
  • You can configure SNS topics or email notifications for alerts.
  • Multi-dimensional Root Cause Analysis (2024) – surfaces up to 10 root causes per anomaly across service, account, region, and usage type dimensions.
  • Accelerated Detection (2025) – improved algorithm uses rolling 24-hour windows, comparing current costs against equivalent time periods from previous days for faster identification.
  • AWS Managed Monitors (2025) – automatically monitor all linked accounts, cost allocation tags, or cost categories with a single managed monitor without manual configuration.
  • AI-Powered Cost Investigations (2026) – uses Amazon Q to analyze root causes by correlating cost data with CloudTrail events and resource activity automatically.

Budgets

  • AWS Budgets can be used to track AWS costs and usage and to set custom alerts when thresholds are exceeded.
  • Budgets use the cost visualization provided by Cost Explorer to show the status of the budgets and to provide forecasts of estimated costs.
  • Budgets can create notifications via SNS topics and email addresses when you go over your budgeted amounts or when estimated costs exceed budgets.
  • Supports budget types: Cost budgets, Usage budgets, Reservation budgets, and Savings Plans budgets.
  • Budgets can trigger automated actions (e.g., apply an IAM policy to restrict further provisioning) via Budget Actions.
  • Net Unblended and Net Amortized Cost Metrics (2025) – allows creating budgets that align precisely with actual spend including all applicable discounts.
  • Enhanced Filtering (2025) – provides more granular control over cost tracking, allowing you to exclude shared services or monitor specific spending areas.
  • AWS Budgets automatically monitors Free Tier usage to help track spending.

Cost Allocation Tags

  • Tags can be used to organize AWS resources, and cost allocation tags to track AWS costs on a detailed level.
  • Upon cost allocation tags activation, AWS uses the cost allocation tags to organize resource costs on the cost allocation report, making it easier to categorize and track costs.
  • AWS provides two types of cost allocation tags:
    • AWS-generated tags – AWS defines, creates, and applies these tags for you (e.g., aws:createdBy).
    • User-defined tags – you define, create, and apply these tags to resources.
  • Both types of tags must be activated separately before they can appear in Cost Explorer or on a cost allocation report.
  • Tags can take up to 24 hours to appear in the Billing and Cost Management console after activation.

Cost Categories

  • AWS Cost Categories enables you to group cost and usage information into meaningful categories based on your organizational needs (e.g., by team, project, environment).
  • You can define rules using dimensions such as account, service, tag, charge type, or even other cost categories (inherited value).
  • Split Charge Rules allow equitable allocation of shared costs (e.g., Enterprise Support, shared infrastructure) across Cost Category values using proportional, fixed, or even splits.
  • Cost Categories appear as a filter and grouping option in Cost Explorer, Budgets, and Cost and Usage Reports.
  • Supports hierarchical structures for complex organizational cost allocation.

Cost Optimization Hub

  • AWS Cost Optimization Hub (launched 2023) consolidates over 18 types of cost optimization recommendations across all accounts and Regions in your organization.
  • Recommendations include EC2 rightsizing, Graviton migration, idle resource detection, Aurora/RDS recommendations, and Reservation/Savings Plans opportunities.
  • Quantifies estimated savings incorporating your specific pricing, discounts, Reserved Instances, and Savings Plans.
  • Integrates with AWS Compute Optimizer for rightsizing and idle resource recommendations.
  • Cost Efficiency Metric (2025) – automatically generated measure of cloud spend efficiency to track optimization progress over time.
  • Savings Plans/Reservations Preferences (2025) – configure preferred term and payment options to see recommendations based on your preferred commitments.
  • Aurora Recommendations (2025) – expanded support for Amazon Aurora database optimization.
  • Free of charge (unless configuring extended 93-day lookback periods for EC2/RDS rightsizing).

Savings Plans

  • Savings Plans offer flexible pricing models providing up to 72% savings in exchange for a commitment to a consistent amount of usage ($/hour) over a 1 or 3-year term.
  • Four types of Savings Plans:
    • Compute Savings Plans – most flexible, up to 66% savings, applies to EC2, Fargate, and Lambda regardless of instance family, size, AZ, region, OS, or tenancy.
    • EC2 Instance Savings Plans – up to 72% savings, commitment to an instance family in a specific Region.
    • SageMaker Savings Plans – applies to SageMaker usage.
    • Database Savings Plans (2025) – up to 35% savings on RDS, Aurora, ElastiCache, and other database services with 1-year term, no upfront payment.
  • RISP Group Sharing (2025) – provides granular control over how commitments (Reserved Instances and Savings Plans) are shared across your organization.

Data Exports and Cost & Usage Reports

  • AWS Data Exports is the recommended way to receive detailed cost and usage data, replacing the legacy CUR creation method.
  • Supports multiple export formats:
    • CUR 2.0 – most granular cost and usage data with fixed schema, queryable nested structures, and column selection/filtering.
    • FOCUS 1.2 with AWS Columns – open-source FinOps Open Cost and Usage Specification for multi-cloud cost reporting standardization.
    • Cost and Usage Dashboard – summary view with pre-built Amazon QuickSight visuals.
  • Exports can be delivered to S3 and queried with Athena, Redshift, or QuickSight.
  • Data can be broken down by hour, day, or month, by product, resource, or custom tags.

AWS Pricing Calculator

  • Authenticated In-Console Pricing Calculator (GA 2025) – allows you to estimate costs while incorporating your specific discounts and commitments.
  • Key capabilities:
    • Estimate costs for specific workloads incorporating applicable discounts.
    • Model cost changes to existing workloads (e.g., instance type changes, region migrations).
    • Build cost projections for new workloads and apply results to budgets.
    • Simulate an entire bill computation including cost impact analysis for workload and purchase option changes.
  • Available to management and all member accounts from the Billing and Cost Management Console or via API/SDK.
  • Requires Cost Explorer enabled to import historical usage of existing workloads.

Billing Views

  • Custom Billing Views (2024) enable you to scope and securely share exact cost and usage data with stakeholders within or outside your organization.
  • Management accounts can create filtered views of cost data and share them with specific member accounts.
  • Multi-Source Custom Billing Views (2025) – combine multiple custom billing views from different organizations to create consolidated views, enabling centralized cost monitoring across your entire enterprise.
  • Shared views integrate with Cost Explorer and AWS Budgets for seamless analysis.

Billing Transfer

  • AWS Billing Transfer (2025) enables centralized invoice management and payment responsibilities across multiple AWS Organizations.
  • A single management account (billing owner) can manage billing—including invoice collection, payment processing, and cost analysis—for multiple organizations.
  • Maintains decentralized administrative controls while centralizing billing operations.
  • Useful for Managed Service Providers (MSPs), resellers, and enterprises with multiple AWS Organizations.
  • Works with AWS Billing Conductor for custom pricing plans.

Amazon Q Developer for Cost Management

  • Amazon Q Developer provides AI-powered conversational cost analysis capabilities.
  • Analyze historical and forecasted costs, discover cost-saving recommendations, understand Savings Plans/reservation opportunities, and get instant answers about pricing.
  • Available in Cost Explorer with natural language queries that auto-configure charts and reports.
  • AWS Billing and Cost Management MCP Server (2025) – enables AI agents and assistants to analyze spending, find optimization opportunities, and estimate costs programmatically.
  • Free Tier includes 50 queries per month; Pro Tier at $19/user/month for higher usage.

Consolidated Billing

  • Consolidated Billing is a feature of AWS Organizations that consolidates payment for multiple AWS accounts.
  • Benefits include a single bill, easy tracking, combined usage for volume discounts, and no extra charge for the feature.
  • Refer to Consolidated Billing for detailed information.

Alerts on Cost Limits

  • CloudWatch Billing Alarms can be used to monitor estimated AWS charges and trigger notifications when thresholds are exceeded.
  • Billing alerts must be enabled first in the Billing Preferences (Account Settings).
  • Billing metric data is stored in US East (N. Virginia) region and represents worldwide charges.
  • For more advanced monitoring, use AWS Budgets which provides forecasting and automated actions.

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. An organization is using AWS since a few months. The finance team wants to visualize the pattern of AWS spending. Which of the below AWS tool will help for this requirement?
    • AWS Cost Manager
    • AWS Cost Explorer (Check Cost Explorer)
    • AWS CloudWatch
    • AWS Consolidated Billing (Will not help visualize)
  2. Your company wants to understand where cost is coming from in the company’s production AWS account. There are a number of applications and services running at any given time. Without expending too much initial development time, how best can you give the business a good understanding of which applications cost the most per month to operate?
    1. Create an automation script, which periodically creates AWS Support tickets requesting detailed intra-month information about your bill.
    2. Use custom CloudWatch Metrics in your system, and put a metric data point whenever cost is incurred.
    3. Use AWS Cost Allocation Tagging for all resources, which support it. Use the Cost Explorer to analyze costs throughout the month. (Refer link)
    4. Use the AWS Price API and constantly running resource inventory scripts to calculate total price based on multiplication of consumed resources over time.
  3. You need to know when you spend $1000 or more on AWS. What’s the easy way for you to see that notification?
    1. AWS CloudWatch Events tied to API calls, when certain thresholds are exceeded, publish to SNS.
    2. Scrape the billing page periodically and pump into Kinesis.
    3. AWS Budgets with a cost budget set to $1000 threshold and email/SNS notification.
    4. Scrape the billing page periodically and publish to SNS.
  4. A user is planning to use AWS services for his web application. If the user is trying to set up his own billing management system for AWS, how can he configure it?
    1. Set up programmatic billing access. Download and parse the bill as per the requirement
    2. It is not possible for the user to create his own billing management service with AWS
    3. Enable the AWS CloudWatch alarm which will provide APIs to download the alarm data
    4. Use AWS billing APIs to download the usage report of each service from the AWS billing console
  5. An organization is setting up programmatic billing access for their AWS account. Which of the below mentioned services is not required or enabled when the organization wants to use programmatic access?
    1. Programmatic access
    2. AWS bucket to hold the billing report
    3. AWS billing alerts
    4. Monthly Billing report
  6. A user has setup a billing alarm using CloudWatch for $200. The usage of AWS exceeded $200 after some days. The user wants to increase the limit from $200 to $400? What should the user do?
    1. Create a new alarm of $400 and link it with the first alarm
    2. It is not possible to modify the alarm once it has crossed the usage limit
    3. Update the alarm to set the limit at $400 instead of $200 (Refer link)
    4. Create a new alarm for the additional $200 amount
  7. A user is trying to configure the CloudWatch billing alarm. Which of the below mentioned steps should be performed by the user for the first time alarm creation in the AWS Account Management section?
    1. Enable Receiving Billing Reports
    2. Enable Receiving Billing Alerts
    3. Enable AWS billing utility
    4. Enable CloudWatch Billing Threshold
  8. A company wants to consolidate cost optimization recommendations across all AWS accounts and Regions. Which AWS service should they use?
    1. AWS Trusted Advisor
    2. AWS Compute Optimizer
    3. AWS Cost Optimization Hub
    4. AWS Cost Explorer
  9. An organization uses multiple AWS accounts and wants to detect unexpected spending increases automatically. Which service uses machine learning to identify cost anomalies and provide root cause analysis?
    1. AWS Budgets with alerts
    2. CloudWatch Billing Alarms
    3. AWS Cost Anomaly Detection
    4. AWS Cost Explorer forecasting
  10. A company wants to provide their finance team with a filtered view of cost data for specific business units without giving them full billing access. Which feature should they use?
    1. AWS Cost Categories
    2. IAM billing permissions
    3. Custom Billing Views
    4. Cost Allocation Tags
  11. Which AWS service enables you to define custom groupings of costs based on your organizational structure and supports split charge rules for shared costs?
    1. Cost Allocation Tags
    2. AWS Cost Categories
    3. AWS Budgets
    4. AWS Cost Explorer
  12. A company wants to receive detailed cost and usage data formatted with an open-source specification that supports multi-cloud cost reporting. Which export format should they choose?
    1. CUR 2.0
    2. FOCUS 1.2 with AWS Columns
    3. Cost and Usage Dashboard
    4. Legacy Cost and Usage Report

References