Sample Questions

AWS Blue/Green Deployment – Zero Downtime Release

~ Last updated on : ~ jayendrapatil ~ 7 Comments

AWS Blue Green Deployment

  • Blue/green deployments provide near zero-downtime release and rollback capabilities.
  • Blue/green deployment works by shifting traffic between two identical environments that are running different versions of the application
    • Blue environment represents the current application version serving production traffic.
    • In parallel, the green environment is staged running a different version of your application.
    • After the green environment is ready and tested, production traffic is redirected from blue to green.
    • If any problems are identified, you can roll back by reverting traffic back to the blue environment.

NOTE: Advanced Topic required for DevOps Professional Exam Only

AWS Services

Route 53

  • Route 53 is a highly available and scalable authoritative DNS service that routes user requests
  • Route 53 with its DNS service allows administrators to direct traffic by simply updating DNS records in the hosted zone
  • TTL can be adjusted for resource records to be shorter which allows record changes to propagate faster to clients

Elastic Load Balancing

  • Elastic Load Balancing distributes incoming application traffic across EC2 instances
  • Elastic Load Balancing scales in response to incoming requests, performs health checking against Amazon EC2 resources, and naturally integrates with other AWS tools, such as Auto Scaling.
  • ELB also helps perform health checks of EC2 instances to route traffic only to the healthy instances
  • Application Load Balancer (ALB) supports weighted target groups, enabling gradual traffic shifting between blue and green environments at the load balancer level.

Auto Scaling

  • Auto Scaling groups use launch templates (which replaced the now-deprecated launch configurations) to define templates for launching EC2 instances, enabling blue/green deployment.
  • Auto Scaling’s termination policies and Standby state enable blue/green deployment
    • Termination policies in Auto Scaling groups determine which EC2 instances to remove during a scaling action.
    • Auto Scaling also allows instances to be placed in Standby state, instead of termination, which helps with quick rollback when required
  • Auto Scaling with Elastic Load Balancing can be used to balance and scale the traffic
⚠️ Note: AWS deprecated Launch Configurations as of October 1, 2024. New AWS accounts cannot create launch configurations. Use Launch Templates instead, which offer versioning, mixed instance types, and support for all new EC2 features. Existing accounts with launch configurations should migrate to launch templates.

Elastic Beanstalk

  • Elastic Beanstalk makes it easy to run multiple versions of the application and provides capabilities to swap the environment URLs, facilitating blue/green deployment.
  • Elastic Beanstalk supports Auto Scaling and Elastic Load Balancing, both of which enable blue/green deployment

AWS CodeDeploy

  • AWS CodeDeploy is a fully managed deployment service that automates software deployments to EC2 instances, on-premises servers, Lambda functions, and ECS services.
  • CodeDeploy supports blue/green deployments for EC2/On-Premises, Lambda, and ECS compute platforms.
  • For EC2/On-Premises, CodeDeploy provisions a replacement (green) set of instances, installs the new application revision, and reroutes traffic from the original (blue) instances.
  • For Lambda, CodeDeploy shifts traffic between two Lambda function versions using aliases with configurable traffic-shifting strategies (Canary, Linear, or All-at-once).
  • For ECS, CodeDeploy shifts traffic between two task sets behind a load balancer using blue/green, canary, or linear strategies with lifecycle hooks for validation.
  • CodeDeploy integrates with CloudWatch Alarms for automatic rollback on deployment failure or alarm breach.

Amazon ECS Native Blue/Green Deployments

  • In July 2025, Amazon ECS launched built-in blue/green deployments, removing the dependency on AWS CodeDeploy for containerized workloads.
  • ECS native blue/green creates a new task set (green) alongside the existing task set (blue) and shifts traffic after validation.
  • Supports deployment lifecycle hooks to run validation tests before and after traffic shifting.
  • In October 2025, Amazon ECS added support for canary and linear deployment strategies natively, achieving feature parity with CodeDeploy.
  • ECS-native blue/green is now the recommended default for new ECS deployments (as of March 2026).
  • Supports Application Load Balancer, Network Load Balancer, and Service Connect for managed traffic shifting.

OpsWorks

⚠️ AWS OpsWorks Stacks reached End of Life (EOL) on May 26, 2024. The service has been disabled for both new and existing customers. The OpsWorks console, API, CLI, and CloudFormation resources have been discontinued. Migrate to AWS Systems Manager, AWS CloudFormation, or AWS CodeDeploy for deployment management.
  • OpsWorks had the concept of stacks, which were logical groupings of AWS resources with a common purpose that should be logically managed together
  • Stacks were made of one or more layers with each layer representing a set of EC2 instances that serve a particular purpose, such as serving applications or hosting a database server.
  • OpsWorks simplified cloning entire stacks when preparing for blue/green environments.

CloudFormation

  • CloudFormation helps describe the AWS resources through JSON or YAML formatted templates and provides automation capabilities for provisioning blue/green environments and facilitating updates to switch traffic, whether through Route 53 DNS, Elastic Load Balancing, etc.
  • CloudFormation provides infrastructure as code strategy, where infrastructure is provisioned and managed using code and software development techniques, such as version control and continuous integration, in a manner similar to how application code is treated
  • CloudFormation natively supports performing blue/green deployments on ECS using a CodeDeploy Blue/Green hook (AWS::CodeDeploy::BlueGreen).
  • AWS CDK and SAM can be used to define and deploy blue/green infrastructure with higher-level abstractions.

CloudWatch

  • CloudWatch monitoring can provide early detection of application health in blue/green deployments
  • CloudWatch Alarms integrate with CodeDeploy and ECS deployments to trigger automatic rollbacks when metrics breach thresholds during traffic shifting.

Amazon RDS/Aurora Blue/Green Deployments

  • Amazon RDS and Aurora support managed blue/green deployments for database changes such as major version upgrades, schema changes, and parameter group modifications.
  • RDS Blue/Green creates a staging (green) environment that is a topological copy of the production (blue) environment, kept in sync using logical replication.
  • Switchover from blue to green typically completes in under a minute for most workloads.
  • In November 2025, Amazon RDS Blue/Green Deployments added support for Aurora Global Database, including primary and all secondary regions.
  • Supported engines include Aurora MySQL, Aurora PostgreSQL, RDS for MySQL, RDS for MariaDB, and RDS for PostgreSQL.

Deployment Techniques

DNS Routing using Route 53

  • Route 53 DNS service can help switch traffic from the blue environment to the green and vice versa, if rollback is necessary
  • Route 53 can help either switch the traffic completely or through a weighted distribution
  • Weighted distribution
    • helps distribute percentage of traffic to go to the green environment and gradually update the weights until the green environment carries the full production traffic
    • provides the ability to perform canary analysis where a small percentage of production traffic is introduced to a new environment
    • helps manage cost by using auto scaling for instances to scale based on the actual demand
  • Route 53 can handle Public or Elastic IP address, Elastic Load Balancer, Elastic Beanstalk environment web tiers etc.
DNS Routing with Amazon Route 53

Auto Scaling Group Swap Behind Elastic Load Balancer

AWS Blue Green Deployment - Auto Scaling Group
  • Elastic Load Balancing with Auto Scaling to manage EC2 resources as per the demand can be used for Blue Green deployments
  • Multiple Auto Scaling groups can be attached to the Elastic Load Balancer
  • Green ASG can be attached to an existing ELB while Blue ASG is already attached to the ELB to serve traffic
  • ELB would start routing requests to the Green Group as for HTTP/S listener it uses a least outstanding requests routing algorithm
  • Green group capacity can be increased to process more traffic while the Blue group capacity can be reduced either by terminating the instances or by putting the instances in a standby mode
  • Standby is a good option because if roll back to the blue environment needed, blue server instances can be put back in service and they’re ready to go
  • If no issues with the Green group, the blue group can be decommissioned by adjusting the group size to zero

Update Auto Scaling Group Launch Templates

AWS Blue Green Deployment - Auto Scaling Launch
  • Auto Scaling groups have their own launch templates which define templates for EC2 instances to be launched
  • Launch templates support versioning — a new version can be created and the Auto Scaling Group updated to use the new version.
  • After a new launch template version is in place, any new instances that are launched use the new version parameters, but existing instances are not affected.
  • When Auto Scaling removes instances (referred to as scaling in) from the group, the default termination policy is to remove instances with the oldest launch template version
  • To deploy the new version of the application in the green environment, create a new launch template version and update the Auto Scaling group, then scale the Auto Scaling group to twice its original size.
  • Then, shrink the Auto Scaling group back to the original size
  • To perform a rollback, update the Auto Scaling group to use the previous launch template version. Then, do the preceding steps in reverse

Elastic Beanstalk Application Environment Swap

AWS Blue Green Deployment - Elastic Beanstalk
  • Elastic Beanstalk multiple environment and environment url swap feature helps enable Blue Green deployment
  • Elastic Beanstalk can be used to host the blue environment exposed via URL to access the environment
  • Elastic Beanstalk provides several deployment policies, ranging from policies that perform an in-place update on existing instances, to immutable deployment using a set of new instances.
  • Elastic Beanstalk performs an in-place update when the application versions are updated, however application may become unavailable to users for a short period of time.
  • To avoid the downtime, a new version can be deployed to a separate Green environment with its own URL, launched with the existing environment’s configuration
  • Elastic Beanstalk’s Swap Environment URLs feature can be used to promote the green environment to serve production traffic
  • Elastic Beanstalk performs a DNS switch, which typically takes a few minutes
  • To perform a rollback, invoke Swap Environment URL again.

Clone a Stack in AWS OpsWorks and Update DNS (Deprecated)

⚠️ Note: AWS OpsWorks Stacks reached End of Life on May 26, 2024. This section is maintained for historical reference only. Use AWS CloudFormation, CodeDeploy, or ECS for blue/green deployments instead.
  • OpsWorks could be used to create
    • Blue environment stack with the current version of the application and serving production traffic
    • Green environment stack with the newer version of the application and is not receiving any traffic
  • To promote to the green environment/stack into production, update DNS records to point to the green environment/stack’s load balancer

CodeDeploy Blue/Green for EC2 Instances

  • CodeDeploy automates the blue/green deployment process for EC2 instances by provisioning a new set of instances (green), deploying the application revision, and shifting traffic from the original instances (blue).
  • Traffic is rerouted through Elastic Load Balancing — instances are deregistered from the blue target group and registered to the green target group.
  • Supports configurable wait times before terminating blue instances, allowing for quick rollback.
  • Integrates with Auto Scaling groups to automatically provision green instances matching the blue group configuration.

Amazon ECS Blue/Green Deployments

  • ECS supports blue/green deployments using either ECS-native (recommended for new deployments) or CodeDeploy-based approaches.
  • ECS-native blue/green (July 2025): Creates a new task set, validates using lifecycle hooks, and shifts traffic — all managed directly by the ECS service without external dependencies.
  • CodeDeploy-based: Uses CodeDeploy to manage traffic shifting between two ECS task sets behind a load balancer with test listener support for validation.
  • Both approaches support automatic rollback on CloudWatch alarm breach or deployment failure.
  • ECS native deployments support blue/green (all-at-once shift), canary (percentage-based initial shift), and linear (incremental shift) strategies.

Lambda Traffic Shifting with CodeDeploy

  • Lambda deployments via CodeDeploy are always blue/green — traffic is shifted between two Lambda function versions using aliases.
  • Supports deployment configurations:
    • Canary — shifts a percentage (e.g., 10%) initially, then the remainder after a wait period
    • Linear — shifts traffic in equal increments at regular intervals
    • All-at-once — shifts all traffic immediately
  • Pre-traffic and post-traffic lifecycle hooks allow validation Lambda functions to run before and after traffic shifting.

Amazon RDS/Aurora Blue/Green Deployments

  • RDS Blue/Green Deployments enable safe database updates (engine upgrades, schema changes, parameter modifications) with minimal downtime.
  • Creates a fully managed staging (green) environment that mirrors production (blue) using logical replication to keep them in sync.
  • Switchover promotes the green environment to production, updating endpoints to point to the new instances — typically completes in under a minute.
  • Supports rollback by reverting the switchover if issues are detected.
  • Ideal for major version upgrades, maintenance operations, and schema migrations where traditional blue/green at the application layer alone is insufficient.
AWS Blue Green deployment patterns

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. What is server immutability?
    1. Not updating a server after creation. (During the new release, a new set of EC2 instances are rolled out by terminating older instances and are disposable. EC2 instance usage is considered temporary or ephemeral in nature for the period of deployment until the current release is active)
    2. The ability to change server counts.
    3. Updating a server after creation.
    4. The inability to change server counts.
  2. You need to deploy a new application version to production. Because the deployment is high-risk, you need to roll the new version out to users over a number of hours, to make sure everything is working correctly. You need to be able to control the proportion of users seeing the new version of the application down to the percentage point. You use ELB and EC2 with Auto Scaling Groups and custom AMIs with your code pre-installed assigned to Launch Configurations. There are no database-level changes during your deployment. You have been told you cannot spend too much money, so you must not increase the number of EC2 instances much at all during the deployment, but you also need to be able to switch back to the original version of code quickly if something goes wrong. What is the best way to meet these requirements?
    1. Create a second ELB, Auto Scaling Launch Configuration, and Auto Scaling Group using the Launch Configuration. Create AMIs with all code pre-installed. Assign the new AMI to the second Auto Scaling Launch Configuration. Use Route53 Weighted Round Robin Records to adjust the proportion of traffic hitting the two ELBs. (Use Weighted Round Robin DNS Records and reverse proxies allow such fine-grained tuning of traffic splits. Blue-Green option does not meet the requirement that we mitigate costs and keep overall EC2 fleet size consistent, so we must select the 2 ELB and ASG option with WRR DNS tuning)
    2. Use the Blue-Green deployment method to enable the fastest possible rollback if needed. Create a full second stack of instances and cut the DNS over to the new stack of instances, and change the DNS back if a rollback is needed. (Full second stack is expensive)
    3. Create AMIs with all code pre-installed. Assign the new AMI to the Auto Scaling Launch Configuration, to replace the old one. Gradually terminate instances running the old code (launched with the old Launch Configuration) and allow the new AMIs to boot to adjust the traffic balance to the new code. On rollback, reverse the process by doing the same thing, but changing the AMI on the Launch Config back to the original code. (Cannot modify the existing launch config)
    4. Migrate to use AWS Elastic Beanstalk. Use the established and well-tested Rolling Deployment setting AWS provides on the new Application Environment, publishing a zip bundle of the new code and adjusting the wait period to spread the deployment over time. Re-deploy the old code bundle to rollback if needed.
  3. When thinking of AWS Elastic Beanstalk, the ‘Swap Environment URLs’ feature most directly aids in what?
    1. Immutable Rolling Deployments
    2. Mutable Rolling Deployments
    3. Canary Deployments
    4. Blue-Green Deployments (Complete switch from one environment to other)
  4. You were just hired as a DevOps Engineer for a startup. Your startup uses AWS for 100% of their infrastructure. They currently have no automation at all for deployment, and they have had many failures while trying to deploy to production. The company has told you deployment process risk mitigation is the most important thing now, and you have a lot of budget for tools and AWS resources. Their stack: 2-tier API Data stored in DynamoDB or S3, depending on type, Compute layer is EC2 in Auto Scaling Groups, They use Route53 for DNS pointing to an ELB, An ELB balances load across the EC2 instances. The scaling group properly varies between 4 and 12 EC2 servers. Which of the following approaches, given this company’s stack and their priorities, best meets the company’s needs?
    1. Model the stack in AWS Elastic Beanstalk as a single Application with multiple Environments. Use Elastic Beanstalk’s Rolling Deploy option to progressively roll out application code changes when promoting across environments. (Does not support DynamoDB also need Blue Green deployment for zero downtime deployment as cost is not a constraint)
    2. Model the stack in 3 CloudFormation templates: Data layer, compute layer, and networking layer. Write stack deployment and integration testing automation following Blue-Green methodologies.
    3. Model the stack in AWS OpsWorks as a single Stack, with 1 compute layer and its associated ELB. Use Chef and App Deployments to automate Rolling Deployment. (Does not support DynamoDB also need Blue Green deployment for zero downtime deployment as cost is not a constraint. Additionally, OpsWorks reached EOL on May 26, 2024.)
    4. Model the stack in 1 CloudFormation template, to ensure consistency and dependency graph resolution. Write deployment and integration testing automation following Rolling Deployment methodologies. (Need Blue Green deployment for zero downtime deployment as cost is not a constraint)
  5. You are building out a layer in a software stack on AWS that needs to be able to scale out to react to increased demand as fast as possible. You are running the code on EC2 instances in an Auto Scaling Group behind an ELB. Which application code deployment method should you use?
    1. SSH into new instances those come online, and deploy new code onto the system by pulling it from an S3 bucket, which is populated by code that you refresh from source control on new pushes. (is slow and manual)
    2. Bake an AMI when deploying new versions of code, and use that AMI for the Auto Scaling Launch Configuration. (Pre baked AMIs can help to get started quickly)
    3. Create a Dockerfile when preparing to deploy a new version to production and publish it to S3. Use UserData in the Auto Scaling Launch configuration to pull down the Dockerfile from S3 and run it when new instances launch. (is slow)
    4. Create a new Auto Scaling Launch Configuration with UserData scripts configured to pull the latest code at all times. (is slow)
  6. You company runs a complex customer relations management system that consists of around 10 different software components all backed by the same Amazon Relational Database (RDS) database. You adopted AWS OpsWorks to simplify management and deployment of that application and created an AWS OpsWorks stack with layers for each of the individual components. An internal security policy requires that all instances should run on the latest Amazon Linux AMI and that instances must be replaced within one month after the latest Amazon Linux AMI has been released. AMI replacements should be done without incurring application downtime or capacity problems. You decide to write a script to be run as soon as a new Amazon Linux AMI is released. Which solutions support the security policy and meet your requirements? Choose 2 answers
    1. Assign a custom recipe to each layer, which replaces the underlying AMI. Use AWS OpsWorks life-cycle events to incrementally execute this custom recipe and update the instances with the new AMI.
    2. Create a new stack and layers with identical configuration, add instances with the latest Amazon Linux AMI specified as a custom AMI to the new layer, switch DNS to the new stack, and tear down the old stack. (Blue-Green Deployment)
    3. Identify all Amazon Elastic Compute Cloud (EC2) instances of your AWS OpsWorks stack, stop each instance, replace the AMI ID property with the ID of the latest Amazon Linux AMI ID, and restart the instance. To avoid downtime, make sure not more than one instance is stopped at the same time.
    4. Specify the latest Amazon Linux AMI as a custom AMI at the stack level, terminate instances of the stack and let AWS OpsWorks launch new instances with the new AMI.
    5. Add new instances with the latest Amazon Linux AMI specified as a custom AMI to all AWS OpsWorks layers of your stack, and terminate the old ones.
  7. Your company runs an event management SaaS application that uses Amazon EC2, Auto Scaling, Elastic Load Balancing, and Amazon RDS. Your software is installed on instances at first boot, using a tool such as Puppet or Chef, which you also use to deploy small software updates multiple times per week. After a major overhaul of your software, you roll out version 2.0 new, much larger version of the software of your running instances. Some of the instances are terminated during the update process. What actions could you take to prevent instances from being terminated in the future? (Choose two)
    1. Use the zero downtime feature of Elastic Beanstalk to deploy new software releases to your existing instances. (No such feature, you can perform environment url swap)
    2. Use AWS CodeDeploy. Create an application and a deployment targeting the Auto Scaling group. Use CodeDeploy to deploy and update the application in the future. (Refer link)
    3. Run “aws autoscaling suspend-processes” before updating your application. (Refer link)
    4. Use the AWS Console to enable termination protection for the current instances. (Termination protection does not work with Auto Scaling)
    5. Run “aws autoscaling detach-load-balancers” before updating your application. (Does not prevent Auto Scaling to terminate the instances)
  8. A company runs a containerized application on Amazon ECS with Fargate. They want to implement blue/green deployments with the ability to test the new version using a small percentage of traffic before full cutover. They also want automatic rollback if CloudWatch alarms trigger. What is the recommended approach? [2025 Updated]
    1. Use ECS rolling updates with circuit breaker enabled
    2. Use Elastic Beanstalk with Swap Environment URLs
    3. Use Amazon ECS native blue/green deployment with canary strategy (ECS native blue/green with canary strategy (October 2025) allows percentage-based traffic shifting with automatic rollback on alarm breach, without requiring CodeDeploy)
    4. Use AWS CodePipeline with manual approval before traffic shift
  9. A team wants to perform a major version upgrade on their Aurora PostgreSQL database with minimal downtime. The database handles production traffic and they need the ability to quickly rollback if the upgrade causes issues. What AWS feature should they use?
    1. Create a manual snapshot, upgrade, and restore from snapshot if issues occur
    2. Use Aurora cloning to create a copy and upgrade the clone
    3. Use Amazon RDS Blue/Green Deployments to create a green environment, perform the upgrade, and switchover (RDS Blue/Green Deployments create a staging environment kept in sync via logical replication, switchover completes in under a minute, and supports rollback)
    4. Set up Aurora read replica, promote it, and switch the application connection string

References

AWS Elastic Transcoder – Certification

~ Last updated on : ~ jayendrapatil ~ 4 Comments

⚠️ SERVICE DEPRECATED — End of Life November 13, 2025

Amazon Elastic Transcoder was discontinued on November 13, 2025. The service console and all Elastic Transcoder resources are no longer accessible.

This content is maintained for historical reference and certification exam context.

Migration:

  • AWS Elemental MediaConvert — The direct replacement. Offers full feature parity plus advanced capabilities including AV1, HEVC, HDR, DRM, 8K resolution, and broadcast-grade features at lower cost.
  • Migration Guide — AWS provides a migration script and detailed guide for converting Elastic Transcoder presets and jobs to MediaConvert.

AWS Elastic Transcoder

  • Amazon Elastic Transcoder was a highly scalable, easy-to-use and cost-effective way for developers and businesses to convert (or “transcode”) video files from their source format into versions that will play back on multiple devices like smartphones, tablets and PCs.
  • Elastic Transcoder was for any customer with media assets stored in S3 for e.g. developers creating apps or websites that publish user-generated content, enterprises and educational establishments converting training and communication videos, and content owners and broadcasters needing to convert media assets into web-friendly formats.
  • Elastic Transcoder features
    • can be used to convert files from different media formats into H.264/AAC/MP4 files at different resolutions, bitrates, and frame rates, and set up transcoding pipelines to transcode files in parallel.
    • can be configured to overlay up to four graphics, known as watermarks, over a video during transcoding
    • can be configured to transcode captions, or subtitles, from one format to another and supports embedded and sidebar caption types
    • provides clip stitching ability to stitch together parts, or clips, from multiple input files to create a single output
    • can be configured to create Thumbnails
  • Elastic Transcoder is integrated with CloudTrail, an AWS service that captures information about every request that is sent to the Elastic Transcoder API by your AWS account, including your IAM users

Elastic Transcoder Components

  • Presets
    • are templates that contain most of the settings for transcoding media files from one format to another.
    • Elastic Transcoder includes some default presets for common formats and ability to create customized presets
  • Jobs
    • do the work of transcoding and converts a file into up to 30 formats.
    • takes the input file to be transcoded, names of the transcoded files and several other settings as input
    • For each transcoded format a preset needs to be specified
  • Pipelines
    • are queues that manage the transcoding jobs.
    • Elastic Transcoder starts processing the jobs and transcoding into format (for multiple formats) in the order they are added.
    • can be paused to temporarily stop processing jobs
  • Notifications
    • help keep you apprised of the status of a job, i.e. started, completed, encounters warning or error
    • eliminate the need for polling to determine when a job has finished and can be configured during pipeline creation

AWS Elemental MediaConvert (Replacement Service)

  • AWS Elemental MediaConvert is the direct replacement for Elastic Transcoder, offering file-based video transcoding with broadcast-grade features.
  • MediaConvert provides all Elastic Transcoder capabilities plus significantly more advanced features at lower cost.

Key MediaConvert Features (Beyond Elastic Transcoder)

  • Codec Support — AVC (H.264), HEVC (H.265), AV1, Apple ProRes, MPEG-2, Dolby Audio, and Dolby Atmos
  • Resolution & Frame Rate — Up to 8K resolution and 120 FPS
  • HDR Support — HDR10, HDR10+, HLG (Hybrid Log Gamma), and Dolby Vision
  • Adaptive Bitrate Streaming — CMAF, Apple HLS, DASH ISO, and Microsoft Smooth Streaming
  • DRM & Encryption — Google Widevine, Microsoft PlayReady, Apple FairPlay with SPEKE v2 integration
  • Quality Optimization — Multi-pass encoding, Quality-Defined Variable Bitrate (QVBR) for bandwidth and storage savings
  • Image Processing — Noise reduction, color correction, cropping, image insertion, frame rate conversion
  • Advanced Features — Ad avail blanking, ad insertion (ESAM), Nielsen configuration, audio normalization, video overlays, video padding, video rotation
  • Captions — Wide range of caption and subtitle format conversion
  • IMF Ingest — Interoperable Master Format with JPEG-2000 video support

Key Differences from Elastic Transcoder

  • Pipelines → Queues — MediaConvert uses queues instead of pipelines. Queues are not tied to a specific S3 bucket, providing more flexibility.
  • Presets + Job Templates — MediaConvert presets can be overridden per-job. Job templates save complete job configurations for reuse.
  • Notifications — Uses Amazon CloudWatch Events and EventBridge instead of SNS-based pipeline notifications. Enables richer automation with Lambda, SQS, and Step Functions.
  • Pricing — On-demand Basic tier starts at $0.0075/min (lower than Elastic Transcoder). Reserved pricing available for steady workloads with 12-month commitment.
  • Scalability — Automatically provisions resources, scales elastically with built-in redundancy across Availability Zones.

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. Your website is serving on-demand training videos to your workforce. Videos are uploaded monthly in high resolution MP4 format. Your workforce is distributed globally often on the move and using company-provided tablets that require the HTTP Live Streaming (HLS) protocol to watch a video. Your company has no video transcoding expertise and it required you might need to pay for a consultant. How do you implement the most cost-efficient architecture without compromising high availability and quality of video delivery?
    1. Elastic Transcoder to transcode original high-resolution MP4 videos to HLS. S3 to host videos with lifecycle Management to archive original flies to Glacier after a few days. CloudFront to serve HLS transcoded videos from S3 [Note: For current implementations, use AWS Elemental MediaConvert instead of Elastic Transcoder. The architecture pattern remains the same.]
    2. A video transcoding pipeline running on EC2 using SQS to distribute tasks and Auto Scaling to adjust the number or nodes depending on the length of the queue S3 to host videos with Lifecycle Management to archive all files to Glacier after a few days CloudFront to serve HLS transcoding videos from Glacier
    3. Elastic Transcoder to transcode original high-resolution MP4 videos to HLS EBS volumes to host videos and EBS snapshots to incrementally backup original rues after a few days. CloudFront to serve HLS transcoded videos from EC2.
    4. A video transcoding pipeline running on EC2 using SQS to distribute tasks and Auto Scaling to adjust the number of nodes depending on the length of the queue. EBS volumes to host videos and EBS snapshots to incrementally backup original files after a few days. CloudFront to serve HLS transcoded videos from EC2
  2. [New] A media company needs to transcode user-uploaded videos into multiple adaptive bitrate formats (HLS and DASH) with DRM protection. The solution should scale automatically, support HDR content, and minimize operational overhead. Which approach is most appropriate?
    1. Use Amazon EC2 instances with FFmpeg in an Auto Scaling group triggered by SQS messages
    2. Use AWS Elemental MediaConvert with job templates configured for HLS and DASH outputs with DRM encryption using SPEKE
    3. Use AWS Lambda with a custom transcoding library triggered by S3 upload events
    4. Use Amazon ECS with Fargate running containerized FFmpeg workers
  3. [New] An organization is migrating their video processing workflow from Elastic Transcoder to MediaConvert. They currently use SNS notifications from Elastic Transcoder pipelines to trigger downstream processing. What is the equivalent notification mechanism in MediaConvert?
    1. Configure SNS topics in MediaConvert queue settings
    2. Use Amazon CloudWatch Events (EventBridge) rules to capture MediaConvert job status changes
    3. Enable S3 event notifications on the output bucket
    4. Use AWS Step Functions to poll MediaConvert job status

References

AWS CloudSearch – Certification

~ Last updated on : ~ jayendrapatil

⚠️ AWS CloudSearch — No Longer Available to New Customers

As of July 25, 2024, AWS closed new customer access to Amazon CloudSearch. Existing customers can continue using the service, but AWS will not introduce new features — only security, availability, and performance improvements.

Recommended Alternatives:

  • Amazon OpenSearch Service (managed clusters) — Full-featured search and analytics engine with fine-grained access control, dashboards, alerting, and vector/semantic search.
  • Amazon OpenSearch Serverless — Hands-free, auto-scaling serverless option (closest to CloudSearch’s ease of use). Next-gen version (GA May 2026) scales from zero to thousands of RPS.
  • Amazon Kendra — ML-powered intelligent enterprise search with natural language understanding and FAQ matching.

For migration guidance, see: Transition from Amazon CloudSearch to Amazon OpenSearch Service

AWS CloudSearch

  • CloudSearch is a fully-managed, full-featured search service in the AWS Cloud that makes it easy to set up, manage, and scale a search solution
  • CloudSearch
    • automatically provisions the required resources
    • deploys a highly tuned search index
    • easy configuration and can be up & running in less than one hour
    • search and ability to upload searchable data
    • automatically scales for data and traffic
    • self-healing clusters, and
    • high availability with Multi-AZ
  • CloudSearch uses Apache Solr as the underlying text search engine and
    • can be used to index and search both structured and unstructured data.
    • content can come from multiple sources and can include database fields along with files in a variety of formats, web pages, and so on.
    • supports indexing features like algorithmic stemming, dictionary stemming, stopword dictionary
    • can support customizable result ranking i.e. relevancy
    • supports search features for text search, different query types (range, boolean etc), sorting, facets for filtering, grouping etc
    • supports enhanced features for auto suggestions, highlighting, spatial search, fuzzy search etc
  • CloudSearch supports Multi-AZ option and it deploys additional instances in a second AZ in the same region.
  • CloudSearch can offer significantly lower total cost of ownership compared to operating and managing your own search environment
  • CloudSearch supports 34 languages and popular search features such as highlighting, autocomplete, and geospatial search

CloudSearch Search Domains, Data & Indexing

CloudSearch Architecture

  • Search domain is a data container and a set of services that make the data searchable
    • Document service that allows data uploading to domain for indexing
    • Search service that enables search requests against the indexed data
    • Configuration service for controlling the domains behavior (include relevance ranking)
  • Search domain can’t be automatically migrated from one region to another. New domain in the target region needs to be created, configured and data uploaded, and then the original domain deleted
  • Indexed data to be made searchable
    • can be submitted through a REST based web service url
    • has to be in JSON or XML format
    • is represented as a document with a unique document ID and multiple fields either to be search on to needed to be just retrieved
  • CloudSearch generates a search index from the document data according to the index fields configured for the domain
  • Data updates can be submitted by to add, update and delete documents
  • Data can be uploaded using secure and encrypted SSL HTTPS connection
  • All requests to CloudSearch domains can be required to arrive over HTTPS (enforced via domain configuration)

CloudSearch Auto Scaling

CloudSearch Scaling

  • Search domains scale in two dimensions: data and traffic
  • A search instance is a single search engine in the cloud that indexes documents and responds to search requests with a finite amount of RAM and CPU resources for indexing data and processing requests.
  • Search domain can have one or more search partitions, portion of the data which fits on a single search instance, and the number of search partitions can change as the documents are indexed
  • CloudSearch can determine the size and number of search instances required to deliver low latency, high throughput search performance
  • When a search domain is created , a single instance is deployed
  • CloudSearch automatically scales the domain by adding instances as the volume of data or traffic increases
  • Scaling for data
    • CloudSearch handles scaling for data by
      • Vertical scaling by increasing the size of the instance, when the amount of data exceeds a single search instance
      • Horizontal scaling using search partitions, when the amount of data exceeds the capacity of the largest search instance type
    • Number of search instances required to hold the index partitions is sometimes referred to as the domain’s width.
    • CloudSearch reduces the number of partitions and size of search instances if the amount of data reduces
  • Scaling for traffic
    • CloudSearch handles Scaling for traffic by
      • Vertical scaling by increasing the size of the instance, when the amount of traffic exceeds a single search instance
      • Horizontal scaling by deploying a duplicate search instance to provide additional processing power i.e. the complete number of partitions are duplicated
    • CloudSearch reduces the number of partitions and size of search instances if the traffic reduces
    • Number of duplicate search instances is sometimes referred to as the domain’s depth.

CloudSearch Search Features

  • CloudSearch provides features to index and search both structured data and plain text as well as unstructured data like pdf, word documents
  • CloudSearch provides near real-time indexing for document updates
  • Indexing features include
    • tokenization,
    • stopwords,
    • stemming and
    • synonyms
  • Search features include
    • faceted search, free text search, Boolean search expressions,
    • customizable relevance ranking, query time rank expressions,
    • grouping
    • field weighting, searching and sorting
    • Other features like
      • Autocomplete suggestions
      • Highlighting
      • Geospatial search
      • New data types: date, double, 64 bit signed int, LatLon
      • Dynamic fields
      • Index field statistics
      • Sloppy phrase search
      • Term boosting
      • Enhanced range searching for all field types
      • Search filters that don’t affect relevance
      • Support for multiple query parsers: simple, structured, lucene, dismax
      • Query parser configuration options

CloudSearch vs. OpenSearch Service

  • Both are fully managed AWS search services, but OpenSearch Service is the recommended path forward
    • CloudSearch — simpler setup, auto-scaling, Apache Solr-based, no new features being added
    • OpenSearch Service (Managed Clusters) — full control over instances, sharding strategy, and cost optimization; supports vector/semantic search, fine-grained access control, dashboards, alerting, and observability
    • OpenSearch Serverless — hands-free operation similar to CloudSearch, scales automatically (including scale-to-zero with next-gen), REST API-based indexing and search
  • OpenSearch Service provides all CloudSearch search capabilities plus:
    • Vector search engine supporting semantic search with dense and sparse vectors
    • Hybrid search combining lexical and vector approaches
    • Fine-grained access control and advanced security
    • Log analytics and observability features
    • OpenSearch Dashboards for visualization
    • Alerting and anomaly detection
    • ML-powered auto-optimization (OpenSearch 3.x)
    • Agentic search for multi-step retrieval workflows
  • Migration from CloudSearch to OpenSearch requires re-ingesting and indexing data
    • Amazon OpenSearch Ingestion is recommended for data migration — serverless data pipeline that auto-scales
    • CloudSearch uses Solr query syntax; OpenSearch uses JSON Query DSL — query translation is required
    • AWS provides guidance for migrating from Apache Solr to OpenSearch

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. A newspaper organization has an on-premises application which allows the public to search its back catalogue and retrieve individual newspaper pages via a website written in Java. They have scanned the old newspapers into JPEGs (approx. 17TB) and used Optical Character Recognition (OCR) to populate a commercial search product. The hosting platform and software is now end of life and the organization wants to migrate its archive to AWS and produce a cost efficient architecture and still be designed for availability and durability. Which is the most appropriate?
    1. Use S3 with reduced redundancy to store and serve the scanned files, install the commercial search application on EC2 Instances and configure with auto-scaling and an Elastic Load Balancer. (Reusing Commercial search application which is nearing end of life not a good option for cost)
    2. Model the environment using CloudFormation. Use an EC2 instance running Apache webserver and an open source search application, stripe multiple standard EBS volumes together to store the JPEGs and search index. (storing JPEGs on EBS volumes not cost effective also answer does not address Open source solution availability)
    3. Use S3 with standard redundancy to store and serve the scanned files, use CloudSearch for query processing, and use Elastic Beanstalk to host the website across multiple availability zones. (Cost effective S3 storage, CloudSearch for Search and Highly available and durable web application. Note: For new implementations, Amazon OpenSearch Service or OpenSearch Serverless would be the recommended choice as CloudSearch is no longer available to new customers.)
    4. Use a single-AZ RDS MySQL instance to store the search index and the JPEG images use an EC2 instance to serve the website and translate user queries into SQL. (MySQL not an ideal solution to sore index and JPEG images for cost and performance)
    5. Use a CloudFront download distribution to serve the JPEGs to the end users and Install the current commercial search product, along with a Java Container for the website on EC2 instances and use Route53 with DNS round-robin. (Web Application not scalable, whats the source for JPEGs files through CloudFront)
  2. A company needs to implement a full-text search solution for their e-commerce product catalog with auto-complete suggestions, faceted navigation, and geospatial search capabilities. The solution must scale automatically and require minimal operational overhead. Which combination of AWS services best meets these requirements? [Select TWO]
    1. Amazon OpenSearch Serverless with a search collection type (Correct — OpenSearch Serverless provides auto-scaling, minimal operational overhead, and supports full-text search, facets, and geospatial queries)
    2. Amazon RDS with full-text indexing enabled
    3. Amazon OpenSearch Service managed cluster with UltraWarm and Auto-Tune enabled (Correct — Managed clusters with Auto-Tune reduce operational overhead while providing full search capabilities)
    4. Amazon DynamoDB with Global Secondary Indexes
    5. Amazon Kendra with custom data sources (Kendra is designed for enterprise document/knowledge search with NLU, not product catalog search with faceted navigation)
  3. A solutions architect is planning the migration of a legacy search application that currently uses Amazon CloudSearch. The application processes 500 search queries per second during peak hours but has near-zero traffic during off-hours. Cost optimization is a priority. What is the recommended migration approach?
    1. Continue using Amazon CloudSearch since it auto-scales for traffic
    2. Migrate to Amazon OpenSearch Serverless, which scales from zero to thousands of requests per second and back to zero when idle (Correct — Next-gen OpenSearch Serverless (GA 2026) offers scale-to-zero capability, providing up to 60% cost savings compared to provisioned clusters and ideal for variable traffic patterns)
    3. Migrate to an Amazon OpenSearch Service managed cluster with a single data node
    4. Migrate to Amazon Kendra for intelligent search (Kendra is designed for enterprise document search with NLU, not necessarily a replacement for general search workloads)

References

Beanstalk vs OpsWorks vs CloudFormation

~ Last updated on : ~ jayendrapatil ~ 14 Comments

⚠️ PARTIAL DEPRECATION NOTICE

AWS OpsWorks (all variants) reached End of Life (EOL) in 2024.

  • AWS OpsWorks for Puppet Enterprise – EOL March 31, 2024
  • AWS OpsWorks for Chef Automate – EOL May 5, 2024
  • AWS OpsWorks Stacks – EOL May 26, 2024

The OpsWorks services have been disabled for both new and existing customers. The comparison sections involving OpsWorks are maintained for historical reference.

Current Deployment & Management Options:

  • AWS CloudFormation – Infrastructure as Code (still actively supported and enhanced)
  • AWS Elastic Beanstalk – Simplified application deployment (still actively supported)
  • AWS CDK – Programmatic infrastructure definition using familiar languages
  • AWS Systems Manager – Configuration management and automation (OpsWorks replacement)
  • AWS CodeDeploy – Application deployment automation
  • AWS App Runner – Fully managed container application service

For OpsWorks migration guidance, refer to: AWS OpsWorks EOL Documentation

AWS Elastic Beanstalk vs CloudFormation vs CDK – Deployment & Management Services Comparison

AWS offers multiple options for provisioning IT infrastructure and application deployment and management, varying from convenience & ease of setup to low-level granular control.
Deployment and Management - Elastic Beanstalk vs CloudFormation vs CDK

AWS Elastic Beanstalk

  • AWS Elastic Beanstalk is a higher-level service which allows you to quickly deploy with minimum management effort a web or worker-based environment using EC2, Docker using ECS, Elastic Load Balancing, Auto Scaling, RDS, CloudWatch, etc.
  • Elastic Beanstalk is the fastest and simplest way to get an application up and running on AWS, perfect for developers who want to deploy code and not worry about underlying infrastructure.
  • Elastic Beanstalk provides an environment to easily deploy and run applications in the cloud. It is integrated with developer tools and provides a one-stop experience for application lifecycle management.
  • Elastic Beanstalk requires minimal configuration and will help deploy, monitor, and handle the elasticity/scalability of the application.
  • A user doesn’t need to do much more than write application code and configure some settings on Elastic Beanstalk.
  • Supports platforms including Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker on Amazon Linux 2 and Amazon Linux 2023.
  • AI-Powered Environment Analysis (2026) – Elastic Beanstalk now offers AI-powered analysis that automatically diagnoses environment health issues, identifies root causes, and provides recommended solutions when health status is Warning, Degraded, or Severe.
  • Dual-Stack IPv6 Support (2025) – Supports dual-stack configuration for Application Load Balancers and Network Load Balancers, allowing environments to serve both IPv4 and IPv6 traffic.

AWS OpsWorks (Deprecated – EOL 2024)

⚠️ All AWS OpsWorks services reached End of Life in 2024 and have been disabled for all customers.
  • AWS OpsWorks was an application management service that simplified software configuration, application deployment, scaling, and monitoring using Chef or Puppet.
  • OpsWorks was recommended for managing infrastructure with a configuration management system such as Chef.
  • OpsWorks enabled writing custom Chef recipes, utilized self-healing, and worked with layers.
  • Although OpsWorks was a deployment management service that helped deploy applications with Chef recipes, it was not primarily meant to manage scaling out of the box and needed to be handled explicitly.
  • Migration Paths:
    • AWS Systems Manager – For configuration management and automation (recommended by AWS)
    • Chef SaaS – For customers who want to continue using Chef recipes
    • Puppet Enterprise – Self-hosted Puppet for existing Puppet users
    • AWS CodeDeploy – For application deployment workflows
    • Amazon ECS/EKS – For containerized workloads

AWS CloudFormation

  • AWS CloudFormation enables modeling, provisioning, and version-controlling of a wide range of AWS resources ranging from a single EC2 instance to a complex multi-tier, multi-region application.
  • CloudFormation is a low-level service and provides granular control to provision and manage stacks of AWS resources based on templates (JSON or YAML).
  • CloudFormation templates enable version control of the infrastructure and make deployment of environments easy and repeatable.
  • CloudFormation supports infrastructure needs of many different types of applications such as existing enterprise applications, legacy applications, applications built using a variety of AWS resources, and container-based solutions (including those built using AWS Elastic Beanstalk).
  • CloudFormation is not just an application deployment tool but can provision any kind of AWS resource.
  • CloudFormation is designed to complement Elastic Beanstalk and other AWS services.
  • CloudFormation with Elastic Beanstalk
    • CloudFormation supports Elastic Beanstalk application environments as one of the AWS resource types.
    • This allows you, for example, to create and manage an AWS Elastic Beanstalk–hosted application along with an RDS database to store the application data. In addition to RDS instances, any other supported AWS resource can be added to the group as well.
  • Key Updates (2024-2025):
    • Stack Refactoring (2025) – Move resources between stacks, rename logical IDs, and decompose monolithic templates into focused components without disrupting running infrastructure.
    • 40% Faster Deployments (2024) – Optimistic stabilization with CONFIGURATION_COMPLETE event enables parallel creation of dependent resources.
    • IaC Generator – Generate CloudFormation templates from existing AWS resources (reverse-engineer existing infrastructure into IaC).
    • Configuration Drift Management – Improved drift detection and remediation capabilities.
    • AI Integration – IaC context integrated with AI-powered development tools.

AWS Cloud Development Kit (AWS CDK)

  • AWS CDK is an open-source software development framework that allows you to define cloud infrastructure using familiar programming languages (TypeScript, JavaScript, Python, Java, C#/.NET, Go).
  • CDK synthesizes into CloudFormation templates, providing the reliability of CloudFormation with the expressiveness of general-purpose programming languages.
  • CDK provides high-level constructs (L2/L3) that encapsulate AWS best practices and reduce the amount of boilerplate code needed.
  • CDK is ideal for teams who prefer imperative programming over declarative YAML/JSON templates.
  • Same infrastructure that takes 500+ lines of CloudFormation YAML can be expressed in ~15 lines of CDK TypeScript.
  • CDK Refactoring (2025) – Refactor CDK code (rename constructs, move resources between stacks) while preserving deployed resources.
  • CDK Mixins (2026) – Add composable, reusable abstractions to any construct (L1, L2, or custom) without rebuilding existing infrastructure code.
  • CDK Aspects – Apply organization-wide policies (security rules, tagging standards, compliance requirements) across entire infrastructure.

AWS Serverless Application Model (AWS SAM)

  • AWS SAM is an open-source framework specifically designed for building serverless applications using infrastructure as code.
  • SAM extends CloudFormation with shorthand syntax to express Lambda functions, APIs, databases, and event source mappings with fewer lines of code.
  • During deployment, SAM transforms the SAM syntax into CloudFormation syntax, then CloudFormation provisions the resources.
  • SAM CLI provides local testing, debugging, packaging, and deployment capabilities.
  • SAM Accelerate – Speeds up local development and cloud testing.
  • WebSocket API Support (2026) – Define complete WebSocket APIs for API Gateway with minimal configuration.
  • SAM CLI integrates with AWS CDK and Terraform.

AWS App Runner

  • AWS App Runner is a fully managed container application service that lets you build, deploy, and run containerized web applications and API services without prior infrastructure or container experience.
  • App Runner connects directly to your code or image repository and provides an automatic CI/CD pipeline with fully managed operations, high performance, scalability, and security.
  • App Runner automatically handles load balancing, auto-scaling (including scale to zero), encryption, and health monitoring.
  • Ideal for web applications and APIs that need to deploy quickly from source code or container images without managing infrastructure.
  • Supports deployment from GitHub, Bitbucket, or Amazon ECR.

AWS Proton (Deprecated – EOL October 7, 2026)

⚠️ AWS Proton will reach End of Life on October 7, 2026. Plan migration accordingly.
  • AWS Proton was a fully managed deployment service that standardized how organizations deploy microservices and infrastructure from approved templates.
  • Proton sat on top of CloudFormation (or Terraform) and added self-service deployment, versioning, parameter validation, and standardization.
  • Designed for platform teams to provide standardized templates while giving developers self-service deployment speed.
  • After EOL, the Proton console, API, and pipeline management will be permanently unavailable, though deployed infrastructure will remain intact.

Comparison Summary

Service Level Best For Status
Elastic Beanstalk High-level PaaS Developers who want to deploy code without managing infrastructure ✅ Active
CloudFormation Low-level IaC Granular control over all AWS resources via declarative templates ✅ Active
AWS CDK High-level IaC Teams who prefer defining infrastructure in programming languages ✅ Active
AWS SAM Serverless IaC Serverless applications (Lambda, API Gateway, DynamoDB) ✅ Active
App Runner Fully Managed Container web apps/APIs without any infrastructure management ✅ Active
OpsWorks Configuration Mgmt Chef/Puppet based configuration management ❌ EOL (2024)
AWS Proton Template Orchestration Standardized microservice deployment templates ⚠️ EOL Oct 2026

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. Your team is excited about the use of AWS because now they have access to programmable infrastructure. You have been asked to manage your AWS infrastructure in a manner similar to the way you might manage application code. You want to be able to deploy exact copies of different versions of your infrastructure, stage changes into different environments, revert back to previous versions, and identify what versions are running at any particular time (development, test, QA, production). Which approach addresses this requirement?
    1. Use cost allocation reports and AWS OpsWorks to deploy and manage your infrastructure.
    2. Use AWS CloudWatch metrics and alerts along with resource tagging to deploy and manage your infrastructure.
    3. Use AWS Elastic Beanstalk and a version control system like GIT to deploy and manage your infrastructure.
    4. Use AWS CloudFormation and a version control system like GIT to deploy and manage your infrastructure.
  2. An organization is planning to use AWS for their production roll out. The organization wants to implement automation for deployment such that it will automatically create a LAMP stack, download the latest PHP installable from S3 and setup the ELB. Which of the below mentioned AWS services meets the requirement for making an orderly deployment of the software?
    1. AWS Elastic Beanstalk
    2. AWS CloudFront
    3. AWS CloudFormation
    4. AWS DevOps
  3. You are working with a customer who is using Chef configuration management in their data center. Which service is designed to let the customer leverage existing Chef recipes in AWS?
    Note: AWS OpsWorks reached EOL in 2024. For Chef-based configuration management on AWS, customers should now use Chef SaaS or AWS Systems Manager with Chef recipes via Application Manager.
    1. Amazon Simple Workflow Service
    2. AWS Elastic Beanstalk
    3. AWS CloudFormation
    4. AWS OpsWorks (Historical answer – service now deprecated)
  4. A company wants to define their infrastructure using a programming language like TypeScript instead of writing YAML templates. They want the same reliability as CloudFormation but with less boilerplate code. Which AWS service should they use?
    1. AWS Elastic Beanstalk
    2. AWS Cloud Development Kit (CDK)
    3. AWS SAM
    4. AWS App Runner
  5. A startup wants to deploy a containerized web application with minimal infrastructure management. They want automatic scaling, load balancing, and a CI/CD pipeline connected to their GitHub repository. Which AWS service provides the simplest solution?
    1. Amazon ECS with Fargate
    2. AWS Elastic Beanstalk
    3. AWS App Runner
    4. AWS CloudFormation
  6. A team is building a serverless application using Lambda functions, API Gateway, and DynamoDB. They want to define their infrastructure using a simplified template syntax with built-in local testing capabilities. Which tool is most appropriate?
    1. AWS CloudFormation
    2. AWS CDK
    3. AWS SAM
    4. AWS Elastic Beanstalk
  7. An organization has a large monolithic CloudFormation stack that they want to split into smaller, focused stacks without recreating their existing infrastructure. Which CloudFormation feature enables this?
    1. CloudFormation StackSets
    2. CloudFormation Change Sets
    3. CloudFormation Stack Refactoring
    4. CloudFormation Nested Stacks

References

AWS High Availability & Fault Tolerance Architecture

~ Last updated on : ~ jayendrapatil ~ 40 Comments

AWS High Availability & Fault Tolerance Architecture

📅 Content Update – June 2025

This post has been updated to reflect modern AWS HA/FT services and best practices including AWS Resilience Hub, Application Recovery Controller (ARC), Fault Injection Service (FIS), Multi-AZ DB Clusters, DynamoDB Global Tables with Multi-Region Strong Consistency (MRSC), and current ELB types (ALB/NLB/GWLB).

  • Amazon Web Services provides services and infrastructure to build reliable, fault-tolerant, and highly available systems in the cloud.
  • Fault-tolerance defines the ability for a system to remain in operation even if some of the components used to build the system fail.
  • Most of the higher-level services, such as S3, DynamoDB, SQS, and ELB, have been built with fault tolerance and high availability in mind.
  • Services that provide basic infrastructure, such as EC2 and EBS, provide specific features, such as availability zones, elastic IP addresses, and snapshots, that a fault-tolerant and highly available system must take advantage of and use correctly.

AWS High Availability and Fault Tolerance

NOTE: Topic mainly for Professional Exam Only

Regions & Availability Zones

  • Amazon Web Services are available in geographic Regions and with multiple Availability Zones (AZs) within a region, which provide easy access to redundant deployment locations.
  • AZs are distinct geographical locations that are engineered to be insulated from failures in other AZs.
  • Regions and AZs help achieve greater fault tolerance by distributing the application geographically and help build multi-site solutions.
  • AZs provide inexpensive, low latency network connectivity to other Availability Zones in the same Region. All traffic between AZs is encrypted.
  • By placing EC2 instances in multiple AZs, an application can be protected from failure at a single data center.
  • It is important to run independent application stacks in more than one AZ, either in the same region or in another region, so that if one zone fails, the application in the other zone can continue to run.
  • AWS recommends deploying production workloads across at least 3 AZs for optimal fault isolation and static stability.

Amazon Machine Image – AMIs

  • EC2 is a web service within Amazon Web Services that provides computing resources.
  • Amazon Machine Image (AMI) provides a Template that can be used to define the service instances.
  • Template basically contains a software configuration (i.e., OS, application server, and applications) and is applied to an instance type.
  • AMI can either contain all the softwares, applications and the code bundled or can be configured to have a bootstrap script (user data) to install the same on startup.
  • A single AMI can be used to create server resources of different instance types and start creating new instances or replacing failed instances.
  • EC2 Image Builder can automate the creation, testing, and distribution of AMIs across regions, enabling faster recovery through pre-built golden images.

Auto Scaling

  • Auto Scaling helps to automatically scale EC2 capacity up or down based on defined rules.
  • Auto Scaling also enables addition of more instances in response to an increasing load; and when those instances are no longer needed, they will be automatically terminated.
  • Auto Scaling enables terminating server instances at will, knowing that replacement instances will be automatically launched.
  • Auto Scaling can work across multiple AZs within an AWS Region.
  • Predictive Scaling uses machine learning to proactively scale out ASGs ahead of anticipated demand spikes, improving availability and reducing the need for over-provisioning.
  • Target Tracking Scaling policies provide a simplified way to configure dynamic scaling based on a specific metric target (e.g., average CPU utilization at 50%).
  • Auto Scaling groups support warm pools to pre-initialize instances for faster scaling, reducing cold-start times during demand surges.
  • Amazon Application Recovery Controller (ARC) supports zonal autoshift with EC2 Auto Scaling, automatically shifting traffic away from impaired AZs.

Elastic Load Balancing – ELB

  • Elastic Load Balancing is an effective way to increase the availability of a system and distributes incoming traffic to applications across several EC2 instances.
  • ELB supports health checks on hosts, distribution of traffic to EC2 instances across multiple availability zones, and dynamic addition and removal of EC2 hosts from the load-balancing rotation.
  • Elastic Load Balancing detects unhealthy instances within its pool and automatically reroutes traffic to healthy instances, until the unhealthy instances have been restored seamlessly using Auto Scaling.
  • Auto Scaling and Elastic Load Balancing are an ideal combination – while ELB gives a single DNS name for addressing, Auto Scaling ensures there is always the right number of healthy EC2 instances to accept requests.
  • ELB can be used to balance across instances in multiple AZs of a region.

ELB Types

  • Application Load Balancer (ALB) – Layer 7 (HTTP/HTTPS); supports path-based routing, host-based routing, mutual TLS authentication (2023), one-click AWS WAF integration, URL and host header rewrites (2025), Automatic Target Weights, and LCU Capacity Reservation for handling sharp traffic spikes.
  • Network Load Balancer (NLB) – Layer 4 (TCP/UDP/TLS); ultra-low latency, static IPs per AZ, weighted target groups for blue/green deployments, and subnet removal/addition capability (2025).
  • Gateway Load Balancer (GWLB) – Layer 3 gateway + Layer 4 load balancer; used to deploy, scale, and manage third-party virtual network appliances (firewalls, IDS/IPS).
  • Classic Load Balancer (CLB) – Previous generation; deprecated for new workloads. AWS recommends migrating to ALB or NLB. CLBs in EC2-Classic were retired in August 2022.

Elastic IPs – EIPs

  • Elastic IP addresses are public static IP addresses that can be mapped programmatically between instances within a region.
  • EIPs are associated with the AWS account and not with a specific instance or lifetime of an instance.
  • Elastic IP addresses can be used for instances and services that require consistent endpoints, such as master databases, central file servers, and EC2-hosted load balancers.
  • Elastic IP addresses can be used to work around host or availability zone failures by quickly remapping the address to another running instance or a replacement instance that was just started.

Reserved Instances & Savings Plans

  • Reserved Instances help reserve and guarantee computing capacity is available at a lower cost always.
  • Savings Plans provide a more flexible pricing model with up to 72% savings in exchange for committing to a consistent amount of compute usage (measured in $/hour) over a 1 or 3-year term.
  • On-Demand Capacity Reservations (ODCRs) ensure EC2 capacity is available in a specific AZ when needed for HA without requiring a term commitment.

Elastic Block Store – EBS

  • Elastic Block Store (EBS) offers persistent off-instance storage volumes that persist independently from the life of an instance and are about an order of magnitude more durable than on-instance storage.
  • EBS volumes store data redundantly and are automatically replicated within a single availability zone.
  • EBS helps in failover scenarios where if an EC2 instance fails and needs to be replaced, the EBS volume can be attached to the new EC2 instance.
  • Valuable data should never be stored only on instance (ephemeral) storage without proper backups, replication, or the ability to re-create the data.
  • EBS Multi-Attach (for io1/io2 volumes) allows a single volume to be attached to up to 16 Nitro-based instances within the same AZ for shared storage HA scenarios.

EBS Snapshots

  • EBS volumes are highly reliable, but to further mitigate the possibility of a failure and increase durability, point-in-time Snapshots can be created to store data on volumes in S3, which is then replicated to multiple AZs.
  • Snapshots can be used to create new EBS volumes, which are an exact replica of the original volume at the time the snapshot was taken.
  • Snapshots provide an effective way to deal with disk failures or other host-level issues, as well as with problems affecting an AZ.
  • Snapshots are incremental and back up only changes since the previous snapshot, so it is advisable to hold on to recent snapshots.
  • Snapshots are tied to the region, while EBS volumes are tied to a single AZ.
  • EBS Snapshots Archive provides up to 75% lower storage costs for snapshots stored 90+ days and rarely accessed.
  • Fast Snapshot Restore (FSR) eliminates the need for initializing volumes from snapshots, enabling full-performance volumes immediately upon creation for faster failover.

Relational Database Service – RDS

  • RDS makes it easy to run relational databases in the cloud.
  • RDS Multi-AZ instance deployments provision a synchronous standby replica in a different AZ, providing high availability and automatic failover protection.
  • In case of a failover scenario, the standby is promoted to be the primary seamlessly and will handle the database operations.
  • RDS Multi-AZ DB Cluster deployments (for MySQL and PostgreSQL) provide a primary instance and two readable standby instances across 3 AZs. This offers improved write latency, faster failover (typically under 35 seconds), and the standby instances can serve read traffic.
  • Automated backups, enabled by default, provide point-in-time recovery for the database instance.
  • RDS will back up your database and transaction logs and store both for a user-specified retention period.
  • In addition to the automated backups, manual RDS backups can also be performed which are retained until explicitly deleted.
  • Backups help recover from higher-level faults such as unintentional data modification, either by operator error or by bugs in the application.
  • RDS Read Replicas provide read-only replicas of the database and the ability to scale out beyond the capacity of a single database deployment for read-heavy database workloads.
  • RDS Read Replicas is a scalability and not a High Availability solution. However, cross-region Read Replicas can be manually promoted for disaster recovery.
  • Amazon RDS now supports ENA Express for Multi-AZ replication (2026), using Scalable Reliable Datagram (SRD) to improve replication performance by distributing traffic across multiple network paths.

Simple Storage Service – S3

  • S3 provides highly durable (99.999999999% / 11 9s), fault-tolerant and redundant object store.
  • S3 stores objects redundantly on multiple devices across multiple facilities in an S3 Region.
  • S3 is a great storage solution for somewhat static or slow-changing objects, such as images, videos, and other static media.
  • S3 also supports edge caching and streaming of these assets by interacting with the Amazon CloudFront service.
  • S3 Cross-Region Replication (CRR) automatically replicates objects to a bucket in another region, enabling disaster recovery and low-latency access for globally distributed users.
  • S3 Express One Zone delivers up to 10x faster performance with single-digit millisecond latency for frequently accessed data, but note it stores data in a single AZ (not suitable as the sole copy for fault tolerance).

Simple Queue Service – SQS

  • Simple Queue Service (SQS) is a highly reliable distributed messaging system that can serve as the backbone of a fault-tolerant application.
  • SQS is engineered to provide “at least once” delivery of all messages in standard queues. FIFO queues provide exactly-once processing and strict message ordering.
  • Messages sent to a queue are retained for up to 4 days (by default, can be extended up to 14 days) or until they are read and deleted by the application.
  • Messages can be polled by multiple workers and processed, while SQS takes care that a request is processed by only one worker at a time using a configurable time interval called visibility timeout.
  • If the number of messages in a queue starts to grow or if the average time to process a message becomes too high, workers can be scaled upwards by simply adding additional EC2 instances.
  • Dead-letter queues (DLQs) capture messages that cannot be processed successfully. DLQ redrive allows moving messages back to source queues for reprocessing.
  • FIFO queues support up to 70,000 messages per second with high throughput mode and up to 120K in-flight messages (increased from 20K in November 2024).

Route 53

  • Amazon Route 53 is a highly available and scalable DNS web service.
  • Queries for the domain are automatically routed to the nearest DNS server and thus are answered with the best possible performance.
  • Route 53 resolves requests for your domain name (for example, www.example.com) to your Elastic Load Balancer, as well as your zone apex record (example.com).
  • Route 53 supports multiple routing policies for HA: Failover (active-passive), Latency-based, Weighted, Geolocation, Geoproximity (expanded to public/private hosted zones in 2024), and Multivalue Answer.
  • Route 53 health checks can monitor endpoint health and trigger DNS failover automatically.
  • Route 53 Accelerated Recovery (2026) ensures customers can continue making DNS changes even during regional AWS outages, providing greater predictability for mission-critical applications.

CloudFront

  • CloudFront can be used to deliver website content, including dynamic, static and streaming content using a global network of edge locations.
  • Requests for your content are automatically routed to the nearest edge location, so content is delivered with the best possible performance.
  • CloudFront is optimized to work with other Amazon Web Services, like S3 and EC2.
  • CloudFront also works seamlessly with any non-AWS origin server, which stores the original, definitive versions of your files.
  • CloudFront Functions run lightweight JavaScript at edge locations for request/response customization. Lambda@Edge provides full compute capabilities at Regional Edge Caches.
  • VPC Origins allow CloudFront to fetch content directly from private resources within a VPC without exposing them to the public internet.
  • Origin Shield acts as an additional caching layer to reduce the load on origins and improve cache hit ratios for multi-region architectures.

DynamoDB Global Tables

  • DynamoDB Global Tables provide a fully managed, multi-Region, multi-active database solution for globally distributed applications.
  • Global Tables automatically replicate data across your choice of AWS Regions. Every replica table in every Region can accept both reads and writes.
  • Changes made to an item in one Region are typically replicated to all other replica Regions within a second.
  • Multi-Region Strong Consistency (MRSC), generally available since June 2025, provides zero RPO (Recovery Point Objective) by enabling strongly consistent reads from any Region. This is the highest level of application resilience for DynamoDB.
  • Global Tables now support cross-account replication (2026), enabling multi-account multi-region architectures.
  • Global Tables replace the previous cross-region replication approach (DynamoDB Streams-based) with a fully managed, zero-administration solution.

AWS Resilience Hub

  • AWS Resilience Hub is a central location to define, track, and manage the resilience of applications.
  • It enables you to define resilience goals (RTO/RPO), assess your resilience posture against those goals, and implement recommendations based on the AWS Well-Architected Framework.
  • Resilience Hub performs automated resilience assessments and identifies gaps in your architecture, such as missing Multi-AZ deployments or lack of backup strategies.
  • Integrates with AWS Fault Injection Service (FIS) to run chaos experiments directly from the Resilience Hub console.
  • The next generation of Resilience Hub (GA May 2026) uses generative AI to provide a structured resilience journey for SRE and development teams.

AWS Fault Injection Service (FIS)

  • AWS FIS is a managed chaos engineering service that enables you to perform controlled fault injection experiments on your AWS workloads.
  • FIS helps simulate real-world failures (AZ disruptions, instance failures, network degradation, API throttling) to validate fault tolerance of your architecture.
  • Supports actions targeting EC2, ECS, EKS, RDS, Lambda functions (native integration since October 2024), and more.
  • Amazon.com ran 733 AWS FIS experiments to prepare for Prime Day 2024.
  • Experiments can be generated using natural language through Amazon Bedrock integration (2025).

Amazon Application Recovery Controller (ARC)

  • ARC helps manage and coordinate recovery for applications across AWS Regions and Availability Zones.
  • Zonal Shift allows you to quickly shift traffic for a resource (ALB, NLB, EKS, Auto Scaling group) away from an impaired AZ to healthy AZs.
  • Zonal Autoshift enables AWS to automatically shift traffic away from an AZ when internal telemetry detects a potential impairment — without manual intervention.
  • Routing Controls provide manual override capabilities for cross-region failover of applications.
  • Zonal shift and zonal autoshift are available at no additional cost.
  • Supported resources include ALB, NLB, EC2 Auto Scaling groups, EKS clusters, and Karpenter (2026).

AWS Certification Exam Practice Questions

  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated.
  • Open to further feedback, discussion and correction.
  1. You are moving an existing traditional system to AWS, and during the migration discover that there is a master server which is a single point of failure. Having examined the implementation of the master server you realize there is not enough time during migration to re-engineer it to be highly available, though you do discover that it stores its state in a local MySQL database. In order to minimize down-time you select RDS to replace the local database and configure master to use it, what steps would best allow you to create a self-healing architecture[PROFESSIONAL]
    1. Migrate the local database into multi-AZ RDS database. Place master node into a multi-AZ auto-scaling group with a minimum of one and maximum of one with health checks.
    2. Replicate the local database into a RDS read replica. Place master node into a Cross-Zone ELB with a minimum of one and maximum of one with health checks. (Read Replica does not provide HA and write capability and ELB does not have feature for Min and Max 1 and Cross Zone allows just the equal distribution of load across instances)
    3. Migrate the local database into multi-AZ RDS database. Place master node into a Cross-Zone ELB with a minimum of one and maximum of one with health checks. (ELB does not have feature for Min and Max 1 and Cross Zone allows just the equal distribution of load across instances)
    4. Replicate the local database into a RDS read replica. Place master node into a multi-AZ auto-scaling group with a minimum of one and maximum of one with health checks. (Read Replica does not provide HA and write capability)
  2. You are designing Internet connectivity for your VPC. The Web servers must be available on the Internet. The application must have a highly available architecture. Which alternatives should you consider? (Choose 2 answers)
    1. Configure a NAT instance in your VPC. Create a default route via the NAT instance and associate it with all subnets. Configure a DNS A record that points to the NAT instance public IP address (NAT is for internet connectivity for instances in private subnet)
    2. Configure a CloudFront distribution and configure the origin to point to the private IP addresses of your Web servers. Configure a Route53 CNAME record to your CloudFront distribution.
    3. Place all your web servers behind ELB. Configure a Route53 CNAME to point to the ELB DNS name.
    4. Assign EIPs to all web servers. Configure a Route53 record set with all EIPs. With health checks and DNS failover.
  3. When deploying a highly available 2-tier web application on AWS, which combination of AWS services meets the requirements? 1. AWS Direct Connect 2. Amazon Route 53 3. AWS Storage Gateway 4. Elastic Load Balancing 4. Amazon EC2 5. Auto scaling 6. Amazon VPC 7. AWS Cloud Trail [PROFESSIONAL]
    1. 2,4,5 and 6
    2. 3,4,5 and 8
    3. 1 through 8
    4. 1,3,5 and 7
    5. 1,2,5 and 6
  4. Company A has hired you to assist with the migration of an interactive website that allows registered users to rate local restaurants. Updates to the ratings are displayed on the home page, and ratings are updated in real time. Although the website is not very popular today, the company anticipates that It will grow rapidly over the next few weeks. They want the site to be highly available. The current architecture consists of a single Windows Server 2008 R2 web server and a MySQL database running on Linux. Both reside inside an on-premises hypervisor. What would be the most efficient way to transfer the application to AWS, ensuring performance and high-availability? [PROFESSIONAL]
    1. Export web files to an Amazon S3 bucket in us-west-1. Run the website directly out of Amazon S3. Launch a multi-AZ MySQL Amazon RDS instance in us-west-1a. Import the data into Amazon RDS from the latest MySQL backup. Use Route 53 and create an alias record pointing to the elastic load balancer. (Its an Interactive website, although it can be implemented using Javascript SDK, its a migration and the application would need changes. Also no use of ELB if hosted on S3)
    2. Launch two Windows Server 2008 R2 instances in us-west-1b and two in us-west-1a. Copy the web files from on premises web server to each Amazon EC2 web server, using Amazon S3 as the repository. Launch a multi-AZ MySQL Amazon RDS instance in us-west-2a. Import the data into Amazon RDS from the latest MySQL backup. Create an elastic load balancer to front your web servers. Use Route 53 and create an alias record pointing to the elastic load balancer. (Although RDS instance is in a different region which will impact performance, this is the only option that works.)
    3. Use AWS VM Import/Export to create an Amazon Elastic Compute Cloud (EC2) Amazon Machine Image (AMI) of the web server. Configure Auto Scaling to launch two web servers in us-west-1a and two in us-west-1b. Launch a Multi-AZ MySQL Amazon Relational Database Service (RDS) instance in us-west-1b. Import the data into Amazon RDS from the latest MySQL backup. Use Amazon Route 53 to create a hosted zone and point an A record to the elastic load balancer. (does not create a load balancer)
    4. Use AWS VM Import/Export to create an Amazon EC2 AMI of the web server. Configure auto-scaling to launch two web servers in us-west-1a and two in us-west-1b. Launch a multi-AZ MySQL Amazon RDS instance in us-west-1a. Import the data into Amazon RDS from the latest MySQL backup. Create an elastic load balancer to front your web servers. Use Amazon Route 53 and create an A record pointing to the elastic load balancer. (Need to create an aliased record without which the Route 53 pointing to ELB would not work)
  5. Your company runs a customer facing event registration site. This site is built with a 3-tier architecture with web and application tier servers and a MySQL database. The application requires 6 web tier servers and 6 application tier servers for normal operation, but can run on a minimum of 65% server capacity and a single MySQL database. When deploying this application in a region with three availability zones (AZs) which architecture provides high availability? [PROFESSIONAL]
    1. A web tier deployed across 2 AZs with 3 EC2 (Elastic Compute Cloud) instances in each AZ inside an Auto Scaling Group behind an ELB (elastic load balancer), and an application tier deployed across 2 AZs with 3 EC2 instances in each AZ inside an Auto Scaling Group behind an ELB. and one RDS (Relational Database Service) instance deployed with read replicas in the other AZ.
    2. A web tier deployed across 3 AZs with 2 EC2 (Elastic Compute Cloud) instances in each AZ inside an Auto Scaling Group behind an ELB (elastic load balancer) and an application tier deployed across 3 AZs with 2 EC2 instances in each AZ inside an Auto Scaling Group behind an ELB and one RDS (Relational Database Service) Instance deployed with read replicas in the two other AZs.
    3. A web tier deployed across 2 AZs with 3 EC2 (Elastic Compute Cloud) instances in each AZ inside an Auto Scaling Group behind an ELB (elastic load balancer) and an application tier deployed across 2 AZs with 3 EC2 instances m each AZ inside an Auto Scaling Group behind an ELB and a Multi-AZ RDS (Relational Database Service) deployment.
    4. A web tier deployed across 3 AZs with 2 EC2 (Elastic Compute Cloud) instances in each AZ Inside an Auto Scaling Group behind an ELB (elastic load balancer). And an application tier deployed across 3 AZs with 2 EC2 instances in each AZ inside an Auto Scaling Group behind an ELB. And a Multi-AZ RDS (Relational Database services) deployment.
  6. For a 3-tier, customer facing, inclement weather site utilizing a MySQL database running in a Region which has two AZs which architecture provides fault tolerance within the region for the application that minimally requires 6 web tier servers and 6 application tier servers running in the web and application tiers and one MySQL database? [PROFESSIONAL]
    1. A web tier deployed across 2 AZs with 6 EC2 (Elastic Compute Cloud) instances in each AZ inside an Auto Scaling Group behind an ELB (elastic load balancer), and an application tier deployed across 2 AZs with 6 EC2 instances in each AZ inside an Auto Scaling Group behind an ELB. and a Multi-AZ RDS (Relational Database Service) deployment. (As it needs Fault Tolerance with minimal 6 servers always available)
    2. A web tier deployed across 2 AZs with 3 EC2 (Elastic Compute Cloud) instances in each A2 inside an Auto Scaling Group behind an ELB (elastic load balancer) and an application tier deployed across 2 AZs with 3 EC2 instances in each AZ inside an Auto Scaling Group behind an ELB and a Multi-AZ RDS (Relational Database Service) deployment.
    3. A web tier deployed across 2 AZs with 3 EC2 (Elastic Compute Cloud) instances in each AZ inside an Auto Scaling Group behind an ELB (elastic load balancer) and an application tier deployed across 2 AZs with 6 EC2 instances in each AZ inside an Auto Scaling Group behind an ELB and one RDS (Relational Database Service) Instance deployed with read replicas in the other AZs.
    4. A web tier deployed across 1 AZs with 6 EC2 (Elastic Compute Cloud) instances in each AZ Inside an Auto Scaling Group behind an ELB (elastic load balancer). And an application tier deployed in the same AZs with 6 EC2 instances inside an Auto scaling group behind an ELB and a Multi-AZ RDS (Relational Database services) deployment, with 6 stopped web tier EC2 instances and 6 stopped application tier EC2 instances all in the other AZ ready to be started if any of the running instances in the first AZ fails.
  7. You are designing a system which needs, at minimum, 8 m4.large instances operating to service traffic. When designing a system for high availability in the us-east-1 region, which has 6 Availability Zones, you company needs to be able to handle death of a full availability zone. How should you distribute the servers, to save as much cost as possible, assuming all of the EC2 nodes are properly linked to an ELB? Your VPC account can utilize us-east-1’s AZ’s a through f, inclusive.
    1. 3 servers in each of AZ’s a through d, inclusive.
    2. 8 servers in each of AZ’s a and b.
    3. 2 servers in each of AZ’s a through e, inclusive. (You need to design for N+1 redundancy on Availability Zones. ZONE_COUNT = (REQUIRED_INSTANCES / INSTANCE_COUNT_PER_ZONE) + 1. To minimize cost, spread the instances across as many possible zones as you can. By using a though e, you are allocating 5 zones. Using 2 instances, you have 10 total instances. If a single zone fails, you have 4 zones left, with 2 instances each, for a total of 8 instances. By spreading out as much as possible, you have increased cost by only 25% and significantly de-risked an availability zone failure. Refer link)
    4. 4 servers in each of AZ’s a through c, inclusive.
  8. You need your API backed by DynamoDB to stay online during a total regional AWS failure. You can tolerate a couple minutes of lag or slowness during a large failure event, but the system should recover with normal operation after those few minutes. What is a good approach? [PROFESSIONAL]
    1. Set up DynamoDB Global Tables in a multi-active configuration across two regions. Create an Auto Scaling Group behind an ELB in each of the two regions. Add a Route53 Latency DNS Record with DNS Failover, using the ELBs in the two regions as the resource records. (Use DynamoDB Global Tables (multi-active replication) with two ELBs and ASGs with Route53 Failover and Latency DNS. Note: DynamoDB Global Tables now also support Multi-Region Strong Consistency (MRSC) for zero RPO since June 2025.)
    2. Set up a DynamoDB Multi-Region table. Create an Auto Scaling Group behind an ELB in each of the two regions DynamoDB is running in. Add a Route53 Latency DNS Record with DNS Failover, using the ELBs in the two regions as the resource records. (This is now essentially correct with DynamoDB Global Tables being the multi-region solution. However at the time of the question, this option was considered incorrect.)
    3. Set up a DynamoDB Multi-Region table. Create a cross-region ELB pointing to a cross-region Auto Scaling Group, and direct a Route53 Latency DNS Record with DNS Failover to the cross-region ELB. (No such thing as Cross Region ELB or cross-region ASG)
    4. Set up DynamoDB cross-region replication in a master-standby configuration, with a single standby in another region. Create a cross-region ELB pointing to a cross-region Auto Scaling Group, and direct a Route53 Latency DNS Record with DNS Failover to the cross-region ELB. (No such thing as cross-region ELB or cross-region ASG)
  9. You are putting together a WordPress site for a local charity and you are using a combination of Route53, Elastic Load Balancers, EC2 & RDS. You launch your EC2 instance, download WordPress and setup the configuration files connection string so that it can communicate to RDS. When you browse to your URL however, nothing happens. Which of the following could NOT be the cause of this.
    1. You have forgotten to open port 80/443 on your security group in which the EC2 instance is placed.
    2. Your elastic load balancer has a health check, which is checking a webpage that does not exist; therefore your EC2 instance is not in service.
    3. You have not configured an ALIAS for your A record to point to your elastic load balancer
    4. You have locked port 22 down to your specific IP address therefore users cannot access your site using HTTP/HTTPS
  10. A development team that is currently doing a nightly six-hour build which is lengthening over time on-premises with a large and mostly under utilized server would like to transition to a continuous integration model of development on AWS with multiple builds triggered within the same day. However, they are concerned about cost, security and how to integrate with existing on-premises applications such as their LDAP and email servers, which cannot move off-premises. The development environment needs a source code repository; a project management system with a MySQL database resources for performing the builds and a storage location for QA to pick up builds from. What AWS services combination would you recommend to meet the development team’s requirements? [PROFESSIONAL]
    1. A Bastion host Amazon EC2 instance running a VPN server for access from on-premises, Amazon EC2 for the source code repository with attached Amazon EBS volumes, Amazon EC2 and Amazon RDS MySQL for the project management system, EIP for the source code repository and project management system, Amazon SQS for a build queue, An Amazon Auto Scaling group of Amazon EC2 instances for performing builds and Amazon Simple Email Service for sending the build output. (Bastion is not for VPN connectivity also SES should not be used)
    2. An AWS Storage Gateway for connecting on-premises software applications with cloud-based storage securely, Amazon EC2 for the resource code repository with attached Amazon EBS volumes, Amazon EC2 and Amazon RDS MySQL for the project management system, EIPs for the source code repository and project management system, Amazon Simple Notification Service for a notification initiated build, An Auto Scaling group of Amazon EC2 instances for performing builds and Amazon S3 for the build output. (Storage Gateway does not provide secure connectivity, still needs VPN. SNS alone cannot handle builds)
    3. An AWS Storage Gateway for connecting on-premises software applications with cloud-based storage securely, Amazon EC2 for the resource code repository with attached Amazon EBS volumes, Amazon EC2 and Amazon RDS MySQL for the project management system, EIPs for the source code repository and project management system, Amazon SQS for a build queue, An Amazon Elastic Map Reduce (EMR) cluster of Amazon EC2 instances for performing builds and Amazon CloudFront for the build output. (Storage Gateway does not provide secure connectivity, still needs VPN. EMR is not ideal for performing builds as it needs normal EC2 instances)
    4. A VPC with a VPN Gateway back to their on-premises servers, Amazon EC2 for the source-code repository with attached Amazon EBS volumes, Amazon EC2 and Amazon RDS MySQL for the project management system, EIPs for the source code repository and project management system, SQS for a build queue, An Auto Scaling group of EC2 instances for performing builds and S3 for the build output. (VPN gateway is required for secure connectivity. SQS for build queue and EC2 for builds)
  11. Which of the following AWS services and features are essential for building a modern, highly available fault-tolerant architecture? (Choose 3) [NEW – 2025]
    1. Amazon Application Recovery Controller (ARC) with zonal autoshift
    2. AWS CloudTrail
    3. AWS Fault Injection Service (FIS) for resilience testing
    4. RDS Multi-AZ DB Cluster with readable standbys
    5. Amazon Inspector
  12. A company needs its DynamoDB-backed application to survive a complete regional failure with zero data loss (zero RPO). Which approach best achieves this requirement? [NEW – 2025]
    1. Use DynamoDB Streams to replicate data to another region manually.
    2. Use DynamoDB point-in-time recovery (PITR) with cross-region backups.
    3. Use DynamoDB Global Tables with Multi-Region Strong Consistency (MRSC). (MRSC, GA since June 2025, enables zero RPO with strongly consistent reads from any region.)
    4. Use DynamoDB On-Demand backup and restore to a secondary region.
  13. An application runs behind an Application Load Balancer across 3 AZs. During an AZ impairment detected by AWS, what feature can automatically redirect traffic away from the affected AZ without manual intervention? [NEW – 2025]
    1. Route 53 health check failover
    2. ALB Cross-Zone load balancing
    3. Amazon Application Recovery Controller (ARC) zonal autoshift (ARC zonal autoshift automatically shifts traffic away from an impaired AZ when AWS internal telemetry detects issues, without requiring manual intervention.)
    4. Auto Scaling AZ rebalancing

References

AWS IDS/IPS – Intrusion Detection & Prevention

~ Last updated on : ~ jayendrapatil ~ 13 Comments

AWS Intrusion Detection & Prevention System IDS/IPS

  • An Intrusion Prevention System (IPS)
    • is an appliance that monitors and analyzes network traffic to detect malicious patterns and potentially harmful packets and prevent vulnerability exploits
    • Most IPS offer firewall, unified threat management and routing capabilities
  • An Intrusion Detection System (IDS) is
    • an appliance or capability that continuously monitors the environment
    • sends alerts when it detects malicious activity, policy violations or network & system attack from someone attempting to break into or compromise the system
    • produces reports for analysis.

AWS Native IDS/IPS Services

AWS now provides several native managed services that deliver IDS/IPS capabilities without requiring third-party appliances:

AWS Network Firewall

  • AWS Network Firewall is a managed, stateful network firewall and intrusion detection and prevention service for VPCs.
  • Uses the open-source Suricata IPS engine for stateful inspection, supporting Suricata-compatible rules.
  • Provides deep packet inspection (DPI), examining packet payloads beyond just header information.
  • Supports both stateless and stateful rule engines:
    • Stateless engine – inspects each packet in isolation, evaluating against standard network attributes.
    • Stateful engine – maintains connection state, performs protocol detection, and applies IPS signatures.
  • Key IDS/IPS capabilities:
    • Active Threat Defense – AWS-managed rules that automatically block traffic to malicious IPs, domains, and URLs including C2 channels, malware staging hosts, sinkholes, and mining pools.
    • Managed Threat Signatures – rule groups protecting against malware, exploits, botnets, web attacks, credential phishing, scanning tools, and DoS attempts.
    • TLS Inspection – decrypts and inspects encrypted SSL/TLS traffic (both inbound and outbound) for hidden threats.
    • Domain Filtering – allows/denies traffic based on domain names.
    • Geographic IP Filtering – filters traffic based on country codes (added Dec 2024).
    • Automated Domain Lists – analyzes HTTP/HTTPS traffic patterns and simplifies outbound traffic control.
  • Supports thousands of custom rules based on domain, port, protocol, IP addresses, and pattern matching.
  • Auto-scales based on traffic load and provides built-in redundancy across Availability Zones.
  • Filters traffic at VPC perimeter – internet gateway, NAT gateway, VPN, or Direct Connect.
  • In April 2026, AWS expanded support for Marketplace partner managed rules with up to 10 million domain indicators and 1 million IP addresses per rule group.

Amazon GuardDuty

  • Amazon GuardDuty is an intelligent threat detection service providing continuous monitoring and intrusion detection for AWS accounts, workloads, and data.
  • Analyzes multiple data sources: VPC Flow Logs, CloudTrail events, DNS logs, EKS audit logs, S3 data events, and runtime activity.
  • Uses machine learning, anomaly detection, and integrated threat intelligence to identify threats.
  • Protection plans extend detection to:
    • S3 Protection – monitors S3 data access patterns
    • EKS Protection – monitors Kubernetes audit logs and runtime
    • Runtime Monitoring – monitors OS-level activity on EC2 and containers
    • Malware Protection – scans EBS volumes for malware
    • RDS Protection – monitors login activity for databases
    • Lambda Protection – monitors serverless function network activity
  • Extended Threat Detection (Dec 2024) – uses AI/ML to identify multi-stage attack sequences across accounts, correlating related activities like credential misuse, unusual S3 access, and network anomalies.
  • Extended Threat Detection for EC2 and ECS (Dec 2025) – expands sequence-level detection to virtual machine and container environments.
  • Extended Threat Detection for EKS (Jun 2025) – covers Kubernetes cluster compromise sequences.
  • Custom Entity Lists (Sep 2025) – allows incorporating custom domain-based and IP-based threat intelligence.
  • Integrates with AWS Security Hub for centralized findings management.

VPC Traffic Mirroring

  • VPC Traffic Mirroring copies network traffic from EC2 elastic network interfaces to out-of-band security and monitoring appliances.
  • Enables deployment of network-based IDS/IPS, NDR (Network Detection and Response), SIEM, and network forensics tools without agents.
  • Supports sending mirrored traffic to:
    • Individual EC2 instances running IDS/IPS software
    • A fleet behind a Network Load Balancer
    • A fleet behind a Gateway Load Balancer (UDP listener)
    • Amazon S3 (via Mountpoint) for offline packet capture and analysis
  • Supports traffic filters to capture only relevant traffic (reducing costs and noise).
  • Supports packet truncation to extract only headers or specific payload portions.
  • Replaces the traditional need for network TAPs or SPAN ports that are not available in AWS.
  • Use cases: content inspection, threat monitoring, troubleshooting, network performance monitoring.

Gateway Load Balancer (GWLB)

  • Gateway Load Balancer enables transparent insertion of third-party virtual IDS/IPS appliances into the traffic path.
  • Operates at Layer 3 (network layer), listening on all IP packets across all ports.
  • Uses GENEVE encapsulation (port 6081) to forward original packets to appliances – appliances see unmodified traffic.
  • Provides a single entry and exit point for all traffic while distributing load across a fleet of virtual appliances.
  • Supports flow stickiness using 5-tuple (default), 3-tuple, or 2-tuple.
  • Auto-scales appliance capacity based on demand.
  • Supports target failover for existing flows, ensuring continuity if an appliance becomes unhealthy.
  • Works with third-party IDS/IPS solutions from AWS Marketplace (Palo Alto, Fortinet, Check Point, etc.).
  • Integrates with AWS PrivateLink via Gateway Load Balancer Endpoints for cross-VPC inspection architectures.

AWS Shield & Shield Advanced

  • AWS Shield Standard – automatic DDoS protection at layers 3 and 4 for all AWS resources at no additional cost.
  • AWS Shield Advanced – enhanced DDoS protection with detection and mitigation at layers 3, 4, and 7, plus access to the DDoS Response Team (DRT).
  • Network Security Director (Preview, Jun 2025) – a new Shield capability that:
    • Discovers resources across AWS accounts and identifies connectivity
    • Identifies missing or misconfigured network security services (WAF, security groups, NACLs, Network Firewall)
    • Provides severity-prioritized findings with actionable remediation recommendations
    • Supports multi-account analysis (Dec 2025)
    • Findings integrate with AWS Security Hub (Mar 2026)

AWS Security Hub

  • Aggregates and prioritizes security findings from GuardDuty, Network Firewall, Inspector, Shield, and third-party tools.
  • Provides centralized dashboard for IDS/IPS findings across all services.
  • Runs compliance checks against CIS, PCI DSS, and AWS Foundational Security Best Practices.
  • Near Real-Time Risk Analytics (Dec 2025) – correlates signals from GuardDuty, Inspector, and CSPM to surface active risks.
  • Exposure Findings (Jun 2025) – helps prioritize security issues based on resource exposure.

Traditional Approaches for AWS IDS/IPS

Network Tap or SPAN

  • Traditional approach involves using a network Test Access Point (TAP) or Switch Port Analyzer (SPAN) to access & monitor all network traffic.
  • Connection between the AWS Internet Gateway (IGW) and the Elastic Load Balancer would be an ideal place to capture all network traffic.
  • However, there is no place to plug this in between IGW and ELB as there are no SPAN ports, network taps, or a concept of Layer 2 bridging.
  • Modern Alternative: Use VPC Traffic Mirroring to copy network traffic from ENIs to IDS/IPS appliances, or use AWS Network Firewall for inline inspection.

Packet Sniffing

  • It is not possible for a virtual instance running in promiscuous mode to receive or sniff traffic that is intended for a different virtual instance.
  • While interfaces can be placed into promiscuous mode, the hypervisor will not deliver any traffic to an instance that is not addressed to it.
  • Even two virtual instances that are owned by the same customer located on the same physical host cannot listen to each other’s traffic.
  • Promiscuous mode is not allowed in AWS.
  • Modern Alternative: Use VPC Traffic Mirroring which provides an authorized, AWS-native mechanism to copy and inspect network traffic.

Host Based Firewall – Forward Deployed IDS

  • Deploy a network-based IDS on every instance – IDS workload scales with your infrastructure.
  • Host-based security software works well with highly distributed and scalable application architectures because network packet inspection is distributed across the entire software fleet.
  • However, CPU-intensive process is deployed onto every single machine.
  • Modern Alternative: Use GuardDuty Runtime Monitoring for lightweight agent-based threat detection, or AWS Network Firewall for centralized inline inspection.

Host Based Firewall – Traffic Replication

  • An Agent is deployed on every instance to capture & replicate traffic for centralized analysis.
  • Actual workload of network traffic analysis is not performed on the instance but on a separate server.
  • Traffic capture and replication is still CPU-intensive (particularly on Windows machines).
  • It significantly increases the internal network traffic in the environment as every inbound packet is duplicated.
  • Modern Alternative: Use VPC Traffic Mirroring which performs traffic replication at the hypervisor level without consuming instance CPU, and sends traffic to a Gateway Load Balancer backed fleet of IDS/IPS appliances.

In-Line Firewall – Inbound IDS Tier

  • Add another tier to the application architecture where a load balancer sends all inbound traffic to a tier of instances that performs the network analysis.
  • IDS workload is now isolated to a horizontally scalable tier in the architecture.
  • You have to maintain and manage another mission-critical elastic tier in the architecture.
  • Modern Alternative: Use AWS Network Firewall (fully managed inline IPS) or Gateway Load Balancer with third-party appliances (Fortinet, Palo Alto, Check Point) for a scalable, managed inline inspection tier.

Recommended Modern IDS/IPS Architecture

  • Inline Network Protection: Deploy AWS Network Firewall in your VPC for managed IPS with Suricata rules, TLS inspection, and AWS-managed threat intelligence.
  • Threat Detection & Monitoring: Enable Amazon GuardDuty across all accounts for continuous AI/ML-based threat detection.
  • Third-Party Appliances: Use Gateway Load Balancer to transparently insert third-party IDS/IPS appliances (if advanced DPI or specific vendor features are required).
  • Network Visibility: Use VPC Traffic Mirroring for deep packet capture and out-of-band analysis with NDR/SIEM tools.
  • DNS-Level Protection: Use Route 53 Resolver DNS Firewall with managed domain lists to block DNS queries to known malicious domains.
  • Centralized Management: Use AWS Security Hub to aggregate findings from all security services and AWS Firewall Manager for centralized policy management.
  • Posture Assessment: Use AWS Shield Network Security Director to continuously identify missing or misconfigured network security controls.

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. A web company is looking to implement an intrusion detection and prevention system into their deployed VPC. This platform should have the ability to scale to thousands of instances running inside of the VPC. How should they architect their solution to achieve these goals?
    1. Configure an instance with monitoring software and the elastic network interface (ENI) set to promiscuous mode packet sniffing to see all traffic across the VPC. (virtual instance running in promiscuous mode to receive or “sniff” traffic is not allowed)
    2. Create a second VPC and route all traffic from the primary application VPC through the second VPC where the scalable virtualized IDS/IPS platform resides.
    3. Configure servers running in the VPC using the host-based ‘route’ commands to send all traffic through the platform to a scalable virtualized IDS/IPS (host based routing is not allowed)
    4. Configure each host with an agent that collects all network traffic and sends that traffic to the IDS/IPS platform for inspection.
  2. You are designing an intrusion detection prevention (IDS/IPS) solution for a customer web application in a single VPC. You are considering the options for implementing IDS/IPS protection for traffic coming from the Internet. Which of the following options would you consider? (Choose 2 answers)
    1. Implement IDS/IPS agents on each Instance running in VPC
    2. Configure an instance in each subnet to switch its network interface card to promiscuous mode and analyze network traffic. (virtual instance running in promiscuous mode to receive or “sniff” traffic is not allowed)
    3. Implement Elastic Load Balancing with SSL listeners in front of the web applications (ELB with SSL does not serve as IDS/IPS)
    4. Implement a reverse proxy layer in front of web servers and configure IDS/IPS agents on each reverse proxy server
  3. A company wants to implement a managed intrusion prevention system that can inspect all traffic entering and leaving their VPC, including encrypted HTTPS traffic. They want to minimize operational overhead. Which AWS service should they use?
    1. Amazon GuardDuty with VPC Flow Logs analysis
    2. AWS Network Firewall with TLS inspection and managed threat signature rule groups
    3. VPC Traffic Mirroring with third-party IDS appliances on EC2
    4. AWS WAF with AWS Shield Advanced

    AWS Network Firewall provides managed inline IPS with Suricata rules, TLS inspection for encrypted traffic, and managed threat signatures – all fully managed with minimal operational overhead.

  4. An organization needs to deploy third-party IDS/IPS virtual appliances to inspect all traffic flowing through their VPC transparently, without modifying application configurations. Which AWS service enables this architecture?
    1. Application Load Balancer with target groups
    2. Network Load Balancer with pass-through routing
    3. Gateway Load Balancer with GENEVE encapsulation
    4. VPC Traffic Mirroring with Network Load Balancer targets

    Gateway Load Balancer operates at Layer 3, transparently routing traffic through appliance fleets using GENEVE encapsulation. Applications never know the appliances are there.

  5. A security team wants to capture network packets from specific EC2 instances for forensic analysis without installing agents on the instances. Which AWS feature should they use?
    1. VPC Flow Logs with CloudWatch Logs
    2. GuardDuty Runtime Monitoring
    3. VPC Traffic Mirroring
    4. AWS Network Firewall logging

    VPC Traffic Mirroring copies actual network packets (not just metadata like Flow Logs) from ENIs without requiring any agents on the source instances.

  6. Which AWS service uses AI/ML to detect multi-stage attack sequences by correlating signals across IAM credential misuse, unusual S3 access, and network anomalies?
    1. AWS Network Firewall with managed threat signatures
    2. AWS Security Hub with compliance checks
    3. Amazon GuardDuty Extended Threat Detection
    4. VPC Traffic Mirroring with third-party SIEM

    GuardDuty Extended Threat Detection (launched Dec 2024) uses AI/ML to identify sophisticated multi-stage attacks by correlating related activities across AWS services.

  7. A company wants to block network traffic to known malicious command-and-control (C2) servers and malware staging hosts automatically, without manually managing threat intelligence feeds. Which feature should they enable?
    1. GuardDuty with custom threat lists
    2. AWS WAF managed rule groups
    3. VPC Network ACLs with deny rules
    4. AWS Network Firewall Active Threat Defense managed rule groups

    AWS Network Firewall Active Threat Defense managed rules automatically block traffic to malicious IPs, domains, and URLs using AWS threat intelligence, with no manual management required.

References

AWS Risk and Compliance – Whitepaper – Certification

~ Last updated on : ~ jayendrapatil ~ 2 Comments

AWS Risk and Compliance Whitepaper Overview

⚠️ Note: The original AWS Risk and Compliance Whitepaper (last updated March 2021) is now marked as “for historical reference only” by AWS. However, the core concepts of Shared Responsibility, Risk Governance, and Compliance Programs remain fully applicable. This post has been updated to reflect current AWS compliance practices, tools, and programs as of 2025.

  • AWS Risk and Compliance Whitepaper is intended to provide information to assist AWS customers with integrating AWS into their existing control framework supporting their IT environment.
  • AWS does communicate its security and control environment relevant to customers. AWS does this by doing the following:
    • Obtaining industry certifications and independent third-party attestations described in this document
    • Publishing information about the AWS security and control practices in whitepapers and web site content
    • Providing certificates, reports, and other documentation directly to AWS customers under NDA (as required)
    • Providing on-demand access to compliance reports through AWS Artifact — a self-service portal in the AWS Management Console

Shared Responsibility Model

  • AWS’ part in the shared responsibility includes
    • providing its services on a highly secure and controlled platform and providing a wide array of security features customers can use
    • relieves the customer’s operational burden as AWS operates, manages and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates
    • Security “of” the Cloud — AWS is responsible for protecting the infrastructure that runs all services offered in the AWS Cloud, including hardware, software, networking, and facilities
  • Customers’ responsibility includes
    • configuring their IT environments in a secure and controlled manner for their purposes
    • Security “in” the Cloud — responsibility and management of the guest operating system (including updates and security patches), other associated application software as well as the configuration of the AWS provided security group firewall
    • stringent compliance requirements by leveraging technology such as host based firewalls, host based intrusion detection/prevention, encryption and key management
    • relieve customer burden of operating controls by managing those controls associated with the physical infrastructure deployed in the AWS environment
  • The Shared Responsibility Model also extends to IT controls — management, operation, and verification of IT controls is a shared responsibility
  • Responsibility varies depending on the services used:
    • Infrastructure Services (e.g., EC2) — Customer manages OS, firewall, network configuration, identity management
    • Container Services (e.g., RDS, ECS) — AWS manages OS and platform; customer manages network access, firewall rules, identity
    • Abstract Services (e.g., S3, DynamoDB, Lambda) — AWS manages platform, OS, server, networking; customer manages data, client-side encryption, access policies

Risk and Compliance Governance

  • AWS provides a wide range of information regarding its IT control environment to customers through white papers, reports, certifications, and other third-party attestations
  • AWS customers are required to continue to maintain adequate governance over the entire IT control environment regardless of how IT is deployed.
  • Leading practices include
    • an understanding of required compliance objectives and requirements (from relevant sources),
    • establishment of a control environment that meets those objectives and requirements,
    • an understanding of the validation required based on the organization’s risk tolerance,
    • and verification of the operating effectiveness of their control environment.
  • Strong customer compliance and governance might include the following basic approach:
    • Review information available from AWS together with other information to understand as much of the entire IT environment as possible, and then document all compliance requirements.
    • Design and implement control objectives to meet the enterprise compliance requirements.
    • Identify and document controls owned by outside parties.
    • Verify that all control objectives are met and all key controls are designed and operating effectively.
  • Approaching compliance governance in this manner helps companies gain a better understanding of their control environment and will help clearly delineate the verification activities to be performed.

AWS Compliance Programs, Certifications, and Third-Party Attestations

  • AWS engages with external certifying bodies and independent auditors to provide customers with considerable information regarding the policies, processes, and controls established and operated by AWS.
  • AWS provides third-party attestations, certifications, Service Organization Controls (SOC) reports and other relevant compliance reports directly to customers through AWS Artifact.
  • Key Compliance Programs include:
    • SOC 1, 2, and 3 Reports — Covers 188 services (as of Spring 2026), available in machine-readable OSCAL format
    • PCI DSS — Updated to PCI DSS v4.0; accessible through AWS Artifact
    • ISO Certifications — ISO 27001, 27017, 27018, 27701, 22301, 9001, and CSA STAR CCM v4
    • FedRAMP — Federal Risk and Authorization Management Program (Moderate and High baselines)
    • HIPAA — Healthcare compliance through Business Associate Addendum (BAA)
    • C5 — Cloud Computing Compliance Criteria Catalogue (183 services in scope)
    • NIST SP 800-53 — National Institute of Standards and Technology framework
    • NIST CSF 2.0 — Updated whitepaper aligning AWS services to the six Core Functions (Govern, Identify, Protect, Detect, Respond, Recover)
    • NIST SP 800-171 Rev. 2 — Protecting Controlled Unclassified Information (CUI)

AWS Compliance Tools and Services

  • AWS Artifact
    • Self-service portal providing on-demand access to AWS compliance reports
    • Download SOC reports, PCI DSS certifications, ISO certificates, and other attestations
    • Access previous versions of compliance reports without contacting AWS Support
    • Accept and manage agreements (e.g., BAA for HIPAA) on behalf of your account or organization
  • AWS Audit Manager
    • Continuously audit AWS usage to simplify risk and compliance assessment
    • Automates evidence collection mapped to specific compliance controls
    • Prebuilt frameworks for SOC 2, PCI DSS, GDPR, HIPAA, NIST, CIS, and more
    • Common control library with predefined and pre-mapped AWS data sources
    • Custom frameworks and controls creation capability
  • AWS Security Hub
    • Cloud Security Posture Management (CSPM) with automated security checks
    • Supported standards: AWS Foundational Security Best Practices, CIS AWS Foundations Benchmark, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, PCI DSS
    • Security scores for each enabled standard
    • Central configuration for multi-account deployments
  • AWS Control Tower
    • Governance and compliance controls for multi-account AWS environments
    • Supports frameworks: CIS v8.0, FedRAMP r4, ISO 27001:2013, NIST CSF v1.1, NIST SP 800-171 r2, PCI DSS v4.0, SOC 2
    • Guardrails (preventive, detective, proactive) for compliance enforcement

Key Risk and Compliance Questions

  • Shared Responsibility
    • AWS controls the physical components of that technology.
    • Customer owns and controls everything else, including control over connection points and transmissions
  • Auditing IT
    • Auditing for most layers and controls above the physical controls remains the responsibility of the customer
    • AWS ISO 27001 and other certifications are available for auditors review
    • AWS-defined logical and physical controls is documented in the SOC 1 Type II report and available for review by audit and compliance teams
    • AWS Audit Manager automates evidence collection and maps it to compliance controls for streamlined audit preparation
  • Data location
    • AWS customers control which physical region their data and their servers will be located
    • AWS replicates the data only within the region
    • AWS will not move customers’ content from the selected Regions without notifying the customer, unless required to comply with the law or requests of governmental entities
    • Data Sovereignty Options: AWS Dedicated Local Zones, AWS Outposts, and Local Zones provide additional data residency controls for regulated workloads
  • Data center tours
    • As AWS host multiple customers, AWS does not allow data center tours by customers, as this exposes a wide range of customers to physical access of a third party.
    • An independent and competent auditor validates the presence and operation of controls as part of our SOC 1 Type II report.
    • This third-party validation provides customers with the independent perspective of the effectiveness of controls in place.
    • AWS customers can access SOC reports and other attestations directly through AWS Artifact without signing a separate NDA.
  • Third-party access
    • AWS strictly controls access to data centers, even for internal employees.
    • Third parties are not provided access to AWS data centers except when explicitly approved by the appropriate AWS data center manager per the AWS access policy
  • Multi-tenancy
    • AWS environment is a virtualized, multi-tenant environment.
    • AWS has implemented security management processes, PCI controls, and other security controls designed to isolate each customer from other customers.
    • AWS systems are designed to prevent customers from accessing physical hosts or instances not assigned to them by filtering through the virtualization software.
  • Hypervisor
    • Amazon EC2 utilized a highly customized version of Xen hypervisor.
    • Update (2025): Modern EC2 instance types (C5, M5, and newer) use the AWS Nitro System, which replaces the traditional Xen hypervisor with purpose-built hardware and a lightweight hypervisor. Legacy instance types (T2, M3, C3) still use Xen.
    • The Nitro System provides stronger security isolation through dedicated hardware for networking, storage, and security functions, reducing the attack surface
    • The Nitro hypervisor is a minimal, firmware-level component that provides memory and CPU isolation but has no network access, no persistent storage, and no interactive login
  • Vulnerability management
    • AWS is responsible for patching systems supporting the delivery of service to customers, such as the hypervisor and networking services
  • Encryption
    • AWS allows customers to use their own encryption mechanisms for nearly all the services, including S3, EBS, and EC2.
    • IPSec tunnels to VPC are also encrypted
    • AWS Key Management Service (KMS) provides centralized key management with FIPS 140-3 Security Level 3 validated hardware security modules (HSMs)
    • AWS KMS supports post-quantum cryptography (ML-KEM for key agreement, ML-DSA for digital signatures) for future-proof encryption
    • AWS CloudHSM provides dedicated FIPS 140-3 validated hardware security modules for customers needing full control over keys
    • Most AWS services now offer encryption at rest by default using AWS-owned or customer-managed KMS keys
  • Data isolation
    • All data stored by AWS on behalf of customers has strong tenant isolation security and control capabilities
  • Composite services
    • AWS does not leverage any third-party cloud providers to deliver AWS services to customers.
  • Distributed Denial Of Service (DDoS) attacks
    • AWS network provides significant protection against traditional network security issues and the customer can implement further protection
    • AWS Shield Standard — Free, automatic protection against common Layer 3/4 DDoS attacks for all AWS customers
    • AWS Shield Advanced — Managed DDoS protection with 24/7 access to AWS Shield Response Team (SRT), DDoS cost protection, and automatic application layer (L7) DDoS mitigation
  • Data portability
    • AWS allows customers to move data as needed on and off AWS storage
  • Service & Customer provider business continuity
    • AWS does operate a business continuity program
    • AWS data centers incorporate physical protection against environmental risks.
    • AWS’ physical protection against environmental risks has been validated by an independent auditor and has been certified
    • AWS provides customers with the capability to implement a robust continuity plan with multi region/AZ deployment architectures, backups, data redundancy replication
  • Capability to scale
    • AWS cloud is distributed, highly secure and resilient, giving customers massive scale potential.
    • Customers may scale up or down, paying for only what they use
  • Service availability
    • AWS does commit to high levels of availability in its service level agreements (SLA) for e.g. S3 99.99% availability
  • Application Security
    • AWS system development lifecycle incorporates industry best practices which include formal design reviews by the AWS Security Team, source code analysis, threat modeling and completion of a risk assessment
    • AWS does not generally outsource development of software.
  • Threat and Vulnerability Management
    • AWS Security regularly engages independent security firms to perform external vulnerability threat assessments
    • AWS Security regularly scans all Internet facing service endpoint IP addresses for vulnerabilities, but do not include customer instances
    • AWS Security notifies the appropriate parties to remediate any identified vulnerabilities.
    • Updated Penetration Testing Policy: AWS no longer requires advance approval for penetration testing against customer-owned resources for the following services: EC2, NAT Gateways, Elastic Load Balancers, RDS, CloudFront, Aurora, API Gateway, Lambda, Lambda@Edge, Lightsail, and Elastic Beanstalk
    • Prohibited Activities still include: DNS zone walking, DoS/DDoS attacks, port flooding, protocol flooding, and request flooding (unless using approved AWS services like Shield Advanced testing)
  • Data Security
    • Customers retain full ownership and control of their data
    • AWS provides multiple encryption options for data at rest and data in transit
    • AWS KMS provides centralized key management with audit trails via AWS CloudTrail

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. When preparing for a compliance assessment of your system built inside of AWS. What are three best practices for you to prepare for an audit? Choose 3 answers
    1. Gather evidence of your IT operational controls (Customer still needs to gather all the IT operation controls inline with their environment)
    2. Request and obtain applicable third-party audited AWS compliance reports and certifications (Customers can request the reports and certifications produced by our third-party auditors or can request more information about AWS Compliance via AWS Artifact)
    3. Request and obtain a compliance and security tour of an AWS data center for a pre-assessment security review (AWS does not allow data center tour)
    4. Request and obtain approval from AWS to perform relevant network scans and in-depth penetration tests of your system’s Instances and endpoints (Note: AWS no longer requires prior approval for pen testing on permitted services (EC2, RDS, CloudFront, etc.), but the answer remains valid in exam context as it was the original requirement)
    5. Schedule meetings with AWS’s third-party auditors to provide evidence of AWS compliance that maps to your control objectives (Customers can request the reports and certifications produced by our third-party auditors or can request more information about AWS Compliance)
  2. In the shared security model, AWS is responsible for which of the following security best practices (check all that apply) :
    1. Penetration testing
    2. Operating system account security management
    3. Threat modeling
    4. User group access management
    5. Static code analysis
  3. You are running a web-application on AWS consisting of the following components an Elastic Load Balancer (ELB) an Auto-Scaling Group of EC2 instances running Linux/PHP/Apache, and Relational DataBase Service (RDS) MySQL. Which security measures fall into AWS’s responsibility?
    1. Protect the EC2 instances against unsolicited access by enforcing the principle of least-privilege access (Customer owned)
    2. Protect against IP spoofing or packet sniffing
    3. Assure all communication between EC2 instances and ELB is encrypted (Customer owned)
    4. Install latest security patches on ELB, RDS and EC2 instances (Customer owned for EC2 instances; AWS owned for ELB and RDS infrastructure)
  4. Which of the following statements is true about achieving PCI certification on the AWS platform? (Choose 2)
    1. Your organization owns the compliance initiatives related to anything placed on the AWS infrastructure
    2. Amazon EC2 instances must run on a single-tenancy environment (dedicated instance)
    3. AWS manages card-holder environments
    4. AWS Compliance provides assurance related to the underlying infrastructure
  5. A company needs to continuously audit its AWS usage to ensure compliance with internal policies and regulatory standards. Which AWS service should they use?
    1. AWS Config
    2. AWS Audit Manager (AWS Audit Manager continuously audits AWS usage and automates evidence collection for compliance assessments)
    3. AWS CloudTrail
    4. Amazon Inspector
  6. Which AWS service provides a centralized view of security alerts and compliance status across multiple AWS accounts?
    1. Amazon GuardDuty
    2. AWS Config
    3. AWS Security Hub (Security Hub provides centralized security posture management with automated compliance checks against standards like CIS, NIST, and PCI DSS)
    4. AWS CloudTrail
  7. A company needs to download AWS SOC 2 and PCI DSS compliance reports for their auditors. Which AWS service provides on-demand access to these reports?
    1. AWS Config
    2. AWS Security Hub
    3. AWS Trusted Advisor
    4. AWS Artifact (AWS Artifact is the self-service portal for on-demand access to AWS compliance reports, certifications, and agreements)
  8. Under the AWS Shared Responsibility Model, which of the following is the customer’s responsibility for Amazon RDS? (Choose 2)
    1. Patching the database engine
    2. Managing database users and permissions
    3. Replacing failed hardware
    4. Configuring security groups to control network access
    5. OS-level patching of the underlying instance

References

AWS Import/Export – Certification

~ Last updated on : ~ jayendrapatil ~ 11 Comments

⚠️ AWS Import/Export Disk – LEGACY SERVICE

AWS Import/Export Disk has been effectively replaced by the AWS Snow Family and newer data transfer services.

AWS has not accepted new Import/Export Disk jobs for several years. This content is maintained for historical reference and certification exam context.

Current Alternatives (2025-2026):

AWS Import/Export Disk

  • AWS Import/Export accelerates moving large amounts of data into and out of AWS using portable storage devices for transport
  • AWS transfers the data directly onto and off of storage devices using Amazon’s high-speed internal network, bypassing the Internet, and can be much faster and more cost effective than upgrading connectivity.
  • AWS Import/Export can be implemented in two different ways
    • AWS Import/Export Disk (Disk)
      • originally the only service offered by AWS for data transfer by mail
      • Disk supports transfers data directly onto and off of storage devices you own using the Amazon high-speed internal network
    • AWS Snowball
      • is generally faster and cheaper to use than Disk for importing data into Amazon S3
      • Note: AWS Snowball Edge is now only available to existing customers (as of November 7, 2025). New customers should use AWS DataSync or AWS Data Transfer Terminal.
  • AWS Import/Export supports
    • importing data to several types of AWS storage, including EBS snapshots, S3 buckets, and Glacier vaults.
    • exporting data out from S3 only
  • Data load typically begins the next business day after the storage device arrives at AWS and after the data export or import completes, the storage device is returned

Ideal Usage Patterns

  • AWS Import/Export is ideal for transferring large amounts of data in and out of the AWS cloud, especially in cases where transferring the data over the Internet would be too slow (a week or more) or too costly.
  • Common use cases include
    • first time migration – initial data upload to AWS
    • content distribution or regular data interchange to/from your customers or business associates,
    • off-site backup – transfer to Amazon S3 or Amazon Glacier for off-site backup and archival storage, and
    • disaster recovery – quick retrieval (export) of large backups from Amazon S3 or Amazon Glacier

AWS Import/Export Disk Jobs

  • AWS Import/Export jobs can be created in 2 steps
    • Submit a Job request to AWS where each job corresponds to exactly one storage device
    • Send your storage device to AWS, which after the data is uploaded or downloaded is returned back
  • AWS Import/Export jobs can be created
    • using a command line tool, which requires no programming or
    • programmatically using the AWS SDK for Java or the REST API to send requests to AWS or
    • even through third party tools
  • AWS Import/Export Data Encrption
    • supports data encryption methods
      • PIN-code encryption, Hardware-based device encryption that uses a physical PIN pad for access to the data.
      • TrueCrypt software encryption, Disk encryption using TrueCrypt, which is an open-source encryption application.
    • Creating an import or export job with encryption requires providing the PIN code or password for the selected encryption method
    • Although is is not mandatory for the data to be encrypted for import jobs, it is highly recommended
    • All export jobs require data encryption can use either hardware encryption or software encryption or both methods.
  • AWS Import/Export supported Job Types
    • Import to S3
    • Import to Glacier (Import to Glacier is no longer supported by AWS. Refer Updates)
    • Import to EBS
    • Export to S3
  • AWS erases the device after every import job prior to return shipping.

Guidelines and Limitations

  • AWS Import/Export does not support Server-Side Encryption (SSE) when importing data.
  • Maximum file size of a single file or object to be imported is 5 TB. Files and objects larger than 5 TB won’t be imported.
  • Maximum device capacity is 16 TB for Amazon Simple Storage Service (Amazon S3) and Amazon EBS jobs.
  • Maximum device capacity is 4 TB for Amazon Glacier jobs.
  • AWS Import/Export exports only the latest version from an Amazon S3 bucket that has versioning turned on.

Current AWS Data Transfer Alternatives (2025-2026)

AWS has significantly evolved its data transfer portfolio. The original Import/Export Disk service has been superseded by multiple modern options:

AWS DataSync (Recommended for Online Transfers)

  • Online data movement service that simplifies and accelerates data migrations to AWS
  • Moves data securely between on-premises storage, edge locations, other cloud providers, and AWS Storage
  • Automates scheduling, monitoring, encryption, and data integrity validation
  • Supports transfers to/from Amazon S3, Amazon EFS, Amazon FSx, and more
  • Enhanced mode (2025) enables cross-cloud transfers without requiring a DataSync agent
  • Integrates with Amazon CloudWatch and Amazon EventBridge for monitoring
  • Best for: Most data migration workloads where network connectivity is available

AWS Data Transfer Terminal (Physical Transfer)

  • Secure, physical locations where you bring your storage devices to upload data to AWS
  • Each terminal provides at least two 100 Gigabit Ethernet (100 GbE) ports
  • Reserve a time slot, bring your devices, and transfer data at high speed
  • Supports uploads to any AWS endpoint including Amazon S3, Amazon EFS, and others
  • You retain custody of your devices throughout the process
  • Available at multiple locations worldwide (expanding in 2026)
  • Best for: Large data sets where you want to retain device custody and need faster turnaround than shipping

AWS Snow Family (Limited Availability)

  • ⚠️ AWS Snowcone – Discontinued November 12, 2024. Support ended November 12, 2025.
  • ⚠️ AWS Snowmobile – Retired March 2024. No longer available.
  • ⚠️ Previous Generation Snowball Devices (80TB Storage Optimized, 52 vCPU Compute Optimized, GPU) – Discontinued November 12, 2024.
  • AWS Snowball Edge – Only available to existing customers as of November 7, 2025
    • Snowball Edge Storage Optimized 210TB – NVMe storage, up to 1.5 GB/s transfer speed
    • Snowball Edge Compute Optimized 104 vCPU – 416GB RAM, 28TB NVMe SSD storage
  • New customers should use AWS DataSync for online transfers or AWS Data Transfer Terminal for physical transfers
  • For edge computing needs, consider AWS Outposts

AWS Direct Connect

  • Dedicated network connection from on-premises to AWS
  • Consistent, low-latency performance for ongoing data transfers
  • Available in 1 Gbps, 10 Gbps, and 100 Gbps port speeds
  • Best for: Ongoing, high-volume data transfers with dedicated bandwidth requirements

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. You are working with a customer who has 10 TB of archival data that they want to migrate to Amazon Glacier. The customer has a 1-Mbps connection to the Internet. Which service or feature provides the fastest method of getting the data into Amazon Glacier?
    1. Amazon Glacier multipart upload
    2. AWS Storage Gateway
    3. VM Import/Export
    4. AWS Import/Export (Normal upload will take ~900 days as the internet max speed is capped)

    Note: This is a legacy exam question. In current exams, the recommended answer for offline data transfer would be AWS Snowball Edge (for existing customers) or AWS Data Transfer Terminal (for new customers). AWS DataSync would be recommended if network bandwidth is available.

  2. A company needs to migrate 50 TB of data from an on-premises data center to AWS. The company has a 100 Mbps internet connection but cannot wait for a multi-week transfer. Which is the MOST appropriate current solution?
    1. Use AWS DataSync over the internet connection
    2. Use AWS Direct Connect with a dedicated 1 Gbps connection
    3. Reserve a session at an AWS Data Transfer Terminal and bring the storage devices (Data Transfer Terminal provides 100 GbE connectivity and you retain custody of devices. Fastest physical option for new customers.)
    4. Use Amazon S3 Transfer Acceleration
  3. Which AWS service is the PRIMARY recommended method for online data migration to AWS storage services? (Choose one)
    1. AWS Import/Export Disk
    2. AWS Snowball Edge
    3. AWS DataSync (DataSync is the primary online data transfer service, automating scheduling, encryption, and validation)
    4. AWS Data Transfer Terminal
  4. A media company frequently generates 20 TB of video content at remote filming locations with limited internet connectivity. They need to get this data into Amazon S3 within 24 hours for post-production. Which solution is MOST suitable?
    1. Use AWS DataSync over a satellite internet link
    2. Reserve an AWS Data Transfer Terminal session near the filming location (Data Transfer Terminal provides secure physical locations with 100 GbE ports for rapid upload, ideal for remote content production)
    3. Set up AWS Direct Connect at the filming location
    4. Ship data using AWS Import/Export Disk

References

AWS Associate Certification Exams – Preparation – Sample Questions

~ Last updated on : ~ jayendrapatil ~ 181 Comments

AWS Associate Certification Exams – Preparation & Study Guide

📋 2026 Certification Update

AWS certifications have undergone significant changes since this post was originally written. Key updates include:

  • AWS Certified SysOps Administrator – Associate (SOA-C02) was retired on September 29, 2025 and replaced by the AWS Certified CloudOps Engineer – Associate (SOA-C03)
  • AWS Certified Solutions Architect – Associate is now on exam version SAA-C03 (updated August 2022)
  • AWS now offers 12+ active certifications including new AI/ML certifications
  • AWS Skill Builder is now the primary official training platform with 900+ free courses

This guide has been updated to reflect current exam versions, resources, and preparation strategies.

AWS Certification Landscape (2026)

AWS currently offers certifications across four levels:

Foundational (No prerequisite experience)

  • AWS Certified Cloud Practitioner (CLF-C02) – Cloud concepts, billing, security – $100, 90 mins, 65 questions
  • AWS Certified AI Practitioner (AIF-C01) – AI/ML/GenAI concepts and use cases – $100, 90 mins, 65 questions

Associate (1+ year hands-on experience recommended)

  • AWS Certified Solutions Architect – Associate (SAA-C03) – Architecture design – $150, 130 mins, 65 questions
  • AWS Certified Developer – Associate (DVA-C02) – Application development – $150, 130 mins, 65 questions
  • AWS Certified CloudOps Engineer – Associate (SOA-C03) – Cloud operations (formerly SysOps Administrator) – $150, 130 mins, 65 questions
  • AWS Certified Data Engineer – Associate (DEA-C01) – Data pipelines and analytics – $150, 130 mins, 65 questions
  • AWS Certified Machine Learning Engineer – Associate (MLA-C01) – ML solutions and pipelines – $150, 130 mins, 65 questions

Professional (2+ years experience recommended)

  • AWS Certified Solutions Architect – Professional (SAP-C02) – $300, 180 mins, 75 questions
  • AWS Certified DevOps Engineer – Professional (DOP-C02) – $300, 180 mins, 75 questions
  • AWS Certified Generative AI Developer – Professional – Foundation models, RAG, responsible AI – $300

Specialty

  • AWS Certified Security – Specialty (SCS-C02) – $300, 170 mins, 65 questions
  • AWS Certified Advanced Networking – Specialty (ANS-C01) – $300, 170 mins, 65 questions

Note: AWS Certified Machine Learning – Specialty was retired March 31, 2026, replaced by the ML Engineer Associate certification.

AWS Associate Certification Exam Preparation (2026 Guide)

AWS Associate certifications remain the most popular entry point for cloud professionals. Here is a comprehensive preparation strategy based on the current exam formats:

Recommended Preparation Resources

Exam Preparation Tips

  • AWS Associate certifications cover a broad range of services but focus heavily on architectural decision-making rather than memorization
  • The SAA-C03 exam emphasizes the Well-Architected Framework pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability
  • Hands-on experience is highly recommended – use the AWS Free Tier to practice with core services
  • AWS services are updated continuously; the exam tests current best practices and service capabilities
  • Focus on understanding when to use which service rather than deep implementation details for Associate-level exams
  • All Associate exams are 65 questions in 130 minutes (approximately 2 minutes per question)
  • A scaled score of 720 out of 1000 is required to pass
  • Exam Time Tip: Only mark questions you genuinely doubt as “Mark for Review.” Marking too many wastes valuable review time
  • After passing, you receive a 50% discount voucher for your next AWS certification exam and a free official practice exam

AWS Solutions Architect Associate (SAA-C03) – Exam Domains

The SAA-C03 exam (current version since August 2022) covers four domains:

  • Domain 1: Design Secure Architectures (30%)
    • Secure access to AWS resources
    • Secure workloads and applications
    • Determine appropriate data security controls
  • Domain 2: Design Resilient Architectures (26%)
    • Scalable and loosely coupled architectures
    • Highly available and fault-tolerant architectures
  • Domain 3: Design High-Performing Architectures (24%)
    • Storage, compute, database, and networking solutions for performance
  • Domain 4: Design Cost-Optimized Architectures (20%)
    • Cost-effective storage, compute, and database solutions
    • Cost-effective network architectures

AWS CloudOps Engineer Associate (SOA-C03) – Formerly SysOps Administrator

⚠️ Important: The AWS Certified SysOps Administrator – Associate (SOA-C02) was retired on September 29, 2025. It has been replaced by the AWS Certified CloudOps Engineer – Associate (SOA-C03). The new exam reflects modern cloud operations practices including automation, observability, and infrastructure as code.

The CloudOps Engineer exam focuses on:

  • Monitoring, logging, and observability
  • Automation and infrastructure as code
  • Security and compliance operations
  • Reliability and business continuity
  • Cost and performance optimization
  • Networking and content delivery operations

AWS Associate Certification – Important Topics

💡 Note: AWS SWF (Simple Workflow Service) is a legacy service rarely tested in current exams. AWS Step Functions is the modern replacement and is heavily tested in SAA-C03 and DVA-C02.

Preparation Strategy – Week-by-Week Plan

For candidates with some AWS hands-on experience, a 4-8 week study plan works well:

  • Weeks 1-2: Complete a video course (Stéphane Maarek or Adrian Cantrill) covering all domains
  • Weeks 3-4: Read AWS documentation for key services, practice with the Free Tier, review FAQs
  • Weeks 5-6: Take practice exams (Tutorials Dojo, Whizlabs, or AWS official), review incorrect answers thoroughly
  • Weeks 7-8: Focus on weak areas, retake practice exams targeting 80%+, review whitepapers

Target Score: Aim for consistently scoring 80%+ on practice exams before scheduling your real exam.

Related Posts

References

AWS SWF – Simple Workflow Overview – Certification

~ Last updated on : ~ jayendrapatil ~ 11 Comments

⚠️ AWS Recommends Step Functions for New Applications

AWS SWF remains available and supported, but AWS officially recommends AWS Step Functions for most new workflow and orchestration use cases.

SWF is still used in legacy and specialized systems requiring the SWF programming model (deciders/workers, long-lived workflows, and explicit control over scheduling and retries).

Modern Alternatives:

AWS SWF – Simple Workflow

  • AWS SWF makes it easy to build applications that coordinate work across distributed components
  • SWF makes it easier to develop asynchronous and distributed applications by providing a programming model and infrastructure for coordinating distributed components, tracking and maintaining their execution state in a reliable way
  • SWF does the following
    • stores metadata about a workflow and its component parts.
    • stores task for workers and queues them until a Worker needs them.
    • assigns task to workers, which can run either on cloud or on-premises
    • routes information between executions of a workflow and the associated Workers.
    • tracks the progress of workers on Tasks, with configurable timeouts.
    • maintains workflow state in a durable fashion
  • SWF helps coordinating tasks across the application which involves managing intertask dependencies, scheduling, and concurrency in accordance with the logical flow of the application.
  • SWF gives full control over implementing tasks and coordinating them without worrying about underlying complexities such as tracking their progress and maintaining their state.
  • SWF tracks and maintains the workflow state in a durable fashion, so that the application is resilient to failures in individual components, which can be implemented, deployed, scaled, and modified independently
  • SWF offers capabilities to support a variety of application requirements and is suitable for a range of use cases that require coordination of tasks, including media processing, web application back-ends, business process workflows, and analytics pipelines.

Simple Workflow Concepts

AWS SWF Components

  • Workflow
    • Fundamental concept in SWF is the Workflow, which is the automation of a business process
    • A workflow is a set of activities that carry out some objective, together with logic that coordinates the activities.
  • Workflow Execution
    • A workflow execution is a running instance of a workflow
  • Workflow History
    • SWF maintains the state and progress of each workflow execution in its Workflow History, which saves the application from having to store the state in a durable way.
    • It enables applications to be stateless as all information about a workflow execution is stored in its workflow history.
    • For each workflow execution, the history provides a record of which activities were scheduled, their current status, and their results. The workflow execution uses this information to determine next steps.
    • History provides a detailed audit trail that can be used to monitor running workflow executions and verify completed workflow executions.
    • Operations that do not change the state of the workflow for e.g. polling execution do not typically appear in the workflow history
    • Markers can be used to record information in the workflow history of a workflow execution that is specific to the use case
  • Domain
    • Each workflow runs in an AWS resource called a Domain, which controls the workflow’s scope
    • An AWS account can have multiple domains, with each containing multiple workflows
    • Workflows in different domains cannot interact with each other
  • Activities
    • Designing an SWF workflow, Activities need to be precisely defined and then registered with SWF as an activity type with information such as name, version and timeout
  • Activity Task & Activity Worker
    • An Activity Worker is a program that receives activity tasks, performs them, and provides results back. An activity worker can be a program or even a person who performs the task using an activity worker software
    • Activity tasks—and the activity workers that perform them can
      • run synchronously or asynchronously, can be distributed across multiple computers, potentially in different geographic regions, or run on the same computer,
      • be written in different programming languages and run on different operating systems
      • be created that are long-running, or that may fail, time out require restarts or that may complete with varying throughput & latency
  • Decider
    • A Decider implements a Workflow’s coordination logic.
    • Decider schedules activity tasks, provides input data to the activity workers, processes events that arrive while the workflow is in progress, and ends (or closes) the workflow when the objective has been completed.
    • Decider directs the workflow by receiving decision tasks from SWF and responding back to SWF with decisions. A decision represents an action or set of actions which are the next steps in the workflow which can either be to schedule an activity task, set timers to delay the execution of an activity task, to request cancellation of activity tasks already in progress, and to complete or close the workflow.
  • Workers and Deciders are both stateless, and can respond to increased traffic by simply adding additional Workers and Deciders as needed
  • Role of SWF service is to function as a reliable central hub through which data is exchanged between the decider, the activity workers, and other relevant entities such as the person administering the workflow.
  • Mechanism by which both the activity workers and the decider receive their tasks (activity tasks and decision tasks resp.) is by polling the SWF
  • SWF allows “long polling”, requests will be held open for up to 60 seconds if necessary, to reduce network traffic and unnecessary processing
  • SWF informs the decider of the state of the workflow by including with each decision task, a copy of the current workflow execution history. The workflow execution history is composed of events, where an event represents a significant change in the state of the workflow execution for e.g events would be the completion of a task, notification that a task has timed out, or the expiration of a timer that was set earlier in the workflow execution. The history is a complete, consistent, and authoritative record of the workflow’s progress

Workflow Implementation & Execution

  1. Implement Activity workers with the processing steps in the Workflow.
  2. Implement Decider with the coordination logic of the Workflow.
  3. Register the Activities and workflow with SWF.
  4. Start the Activity workers and Decider. Once started, the decider and activity workers should start polling Amazon SWF for tasks.
  5. Start one or more executions of the Workflow. Each execution runs independently and can be provided with its own set of input data.
  6. When an execution is started, SWF schedules the initial decision task. In response, the decider begins generating decisions which initiate activity tasks. Execution continues until your decider makes a decision to close the execution.
  7. View and Track workflow executions

SWF vs. Step Functions

Feature AWS SWF AWS Step Functions
Orchestration Model Decider + Activity Workers (code-driven) State machines defined in JSON/YAML (Amazon States Language)
Infrastructure Must manage worker/decider infrastructure Fully serverless
Max Execution Duration Up to 1 year Standard: up to 1 year; Express: up to 5 minutes
Service Integrations None (custom code only) 200+ native AWS service integrations + HTTPS endpoints
Visual Workflow No Yes – visual designer and execution visualization
Human Tasks Built-in support via manual activity workers Supported via callback patterns and task tokens
Error Handling Custom logic in decider Built-in Retry and Catch per state + Redrive from failure
External Signals Signal events Callback patterns, EventBridge integration
AI/ML Integration None native Native Bedrock, SageMaker, AgentCore integration
Pricing Per workflow execution Per state transition (Standard) or per execution (Express)
Use Case Legacy/specialized workflows needing full control Recommended for all new workflow applications

AWS Step Functions – Modern Workflow Orchestration

  • AWS Step Functions is a fully managed, serverless workflow service that coordinates multiple AWS services using visual state machines.
  • Step Functions uses Amazon States Language (ASL) – a JSON-based language for defining state machines with states like Task, Choice, Parallel, Map, Wait, Pass, Succeed, and Fail.
  • Offers two workflow types:
    • Standard Workflows – long-running (up to 1 year), exactly-once execution, durable and auditable
    • Express Workflows – high-volume, short-duration (up to 5 minutes), at-least-once execution
  • Provides 200+ native service integrations including Lambda, DynamoDB, ECS, Bedrock, SQS, SNS, and third-party HTTPS APIs
  • Built-in error handling with Retry (automatic retry with exponential backoff) and Catch (fallback states)

Key Step Functions Features (2024-2025)

  • Variables and JSONata (Nov 2024) – Assign data in one state and reference it in any subsequent step; JSONata provides powerful query and transformation capabilities replacing complex JSONPath expressions
  • Redrive (2023-2024) – Restart failed Standard Workflow executions from the point of failure rather than restarting the entire workflow; available for failed executions within 14 days
  • HTTPS Endpoints / HTTP Task – Call third-party APIs directly from workflows without Lambda; supports EventBridge connections for authentication
  • Private API Integration (Dec 2024) – Integrate with private APIs using AWS PrivateLink and VPC Lattice for secure cross-network communication
  • Amazon Bedrock Integration – Native integration for invoking foundation models, creating fine-tuning jobs, and orchestrating AI/ML pipelines
  • Distributed Map – Process large-scale datasets in parallel with support for S3 data sources, Athena manifests, and Parquet files
  • AgentCore Integration (2026) – Add AI agent reasoning steps directly in workflows through Amazon Bedrock AgentCore

AWS Lambda Durable Functions (Dec 2025)

  • Lambda Durable Functions is a newer alternative for building multi-step, long-running workflows directly within Lambda code
  • Extends the Lambda programming model with new primitives:
    • Steps – checkpoint progress automatically; recover from failures without losing completed work
    • Waits – suspend execution (up to 1 year) for human approvals, external callbacks, or long-running tasks without incurring compute charges
  • Key benefits:
    • Write workflow logic as regular code in familiar programming languages
    • No need to learn a separate DSL (like Amazon States Language)
    • Automatic checkpointing and failure recovery
    • Ideal for developers who prefer code-first approach over visual state machines
  • Best suited for AI agent workflows, human-in-the-loop processes, and multi-step applications

When to Use SWF vs. Step Functions vs. Lambda Durable Functions

  • Use AWS SWF when:
    • You have existing SWF workflows and migration isn’t justified
    • You need explicit control over scheduling, retries, and task routing
    • Your workflow requires the specific decider/worker programming model
  • Use AWS Step Functions when:
    • Building new workflow applications (AWS recommended)
    • You need visual workflow design and monitoring
    • You require native AWS service integrations
    • You need built-in error handling, parallel execution, and branching logic
    • Orchestrating AI/ML pipelines with Bedrock
  • Use Lambda Durable Functions when:
    • You prefer writing workflow logic as code rather than declarative state machines
    • Building AI agent workflows with complex decision logic
    • You want automatic checkpointing without managing external state
    • Your team is familiar with Lambda but not ASL

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. What does Amazon SWF stand for?
    1. Simple Web Flow
    2. Simple Work Flow
    3. Simple Wireless Forms
    4. Simple Web Form
  2. Regarding Amazon SWF, the coordination logic in a workflow is contained in a software program called a ____.
    1. Handler
    2. Decider
    3. Coordinator
    4. Worker
  3. For which of the following use cases are Simple Workflow Service (SWF) and Amazon EC2 an appropriate solution? Choose 2 answers
    1. Using as an endpoint to collect thousands of data points per hour from a distributed fleet of sensors
    2. Managing a multi-step and multi-decision checkout process of an e-commerce website
    3. Orchestrating the execution of distributed and auditable business processes
    4. Using as an SNS (Simple Notification Service) endpoint to trigger execution of video transcoding jobs
    5. Using as a distributed session store for your web application
  4. Amazon SWF is designed to help users…
    1. … Design graphical user interface interactions
    2. … Manage user identification and authorization
    3. … Store Web content
    4. … Coordinate synchronous and asynchronous tasks which are distributed and fault tolerant.
  5. What does a “Domain” refer to in Amazon SWF?
    1. A security group in which only tasks inside can communicate with each other
    2. A special type of worker
    3. A collection of related Workflows
    4. The DNS record for the Amazon SWF service
  6. Your company produces customer commissioned one-of-a-kind skiing helmets combining nigh fashion with custom technical enhancements Customers can show oft their Individuality on the ski slopes and have access to head-up-displays. GPS rear-view cams and any other technical innovation they wish to embed in the helmet. The current manufacturing process is data rich and complex including assessments to ensure that the custom electronics and materials used to assemble the helmets are to the highest standards Assessments are a mixture of human and automated assessments you need to add a new set of assessment to model the failure modes of the custom electronics using GPUs with CUD across a cluster of servers with low latency networking. What architecture would allow you to automate the existing process using a hybrid approach and ensure that the architecture can support the evolution of processes over time? [PROFESSIONAL]
    1. Use AWS Data Pipeline to manage movement of data & meta-data and assessments. Use an auto-scaling group of G2 instances in a placement group. (Involves mixture of human assessments)
    2. Use Amazon Simple Workflow (SWF) to manage assessments, movement of data & meta-data. Use an autoscaling group of G2 instances in a placement group. (Human and automated assessments with GPU and low latency networking)
    3. Use Amazon Simple Workflow (SWF) to manage assessments movement of data & meta-data. Use an autoscaling group of C3 instances with SR-IOV (Single Root I/O Virtualization). (C3 and SR-IOV won’t provide GPU as well as Enhanced networking needs to be enabled)
    4. Use AWS data Pipeline to manage movement of data & meta-data and assessments use auto-scaling group of C3 with SR-IOV (Single Root I/O virtualization). (Involves mixture of human assessments)
  7. Your startup wants to implement an order fulfillment process for selling a personalized gadget that needs an average of 3-4 days to produce with some orders taking up to 6 months you expect 10 orders per day on your first day. 1000 orders per day after 6 months and 10,000 orders after 12 months. Orders coming in are checked for consistency men dispatched to your manufacturing plant for production quality control packaging shipment and payment processing. If the product does not meet the quality standards at any stage of the process employees may force the process to repeat a step Customers are notified via email about order status and any critical issues with their orders such as payment failure. Your case architecture includes AWS Elastic Beanstalk for your website with an RDS MySQL instance for customer data and orders. How can you implement the order fulfillment process while making sure that the emails are delivered reliably? [PROFESSIONAL]
    1. Add a business process management application to your Elastic Beanstalk app servers and re-use the ROS database for tracking order status use one of the Elastic Beanstalk instances to send emails to customers. (Would use a SWF instead of BPM)
    2. Use SWF with an Auto Scaling group of activity workers and a decider instance in another Auto Scaling group with min/max=1. Use the decider instance to send emails to customers. (Decider sending emails might not be reliable)
    3. Use SWF with an Auto Scaling group of activity workers and a decider instance in another Auto Scaling group with min/max=1. Use SES to send emails to customers.
    4. Use an SQS queue to manage all process tasks. Use an Auto Scaling group of EC2 Instances that poll the tasks and execute them. Use SES to send emails to customers. (Does not provide an ability to repeat a step)
  8. Select appropriate use cases for SWF with Amazon EC2? (Choose 2)
    1. Video encoding using Amazon S3 and Amazon EC2. In this use case, large videos are uploaded to Amazon S3 in chunks. Application is built as a workflow where each video file is handled as one workflow execution.
    2. Processing large product catalogs using Amazon Mechanical Turk. While validating data in large catalogs, the products in the catalog are processed in batches. Different batches can be processed concurrently.
    3. Order processing system with Amazon EC2, SQS, and SimpleDB. Use SWF notifications to orchestrate an order processing system running on EC2, where notifications sent over HTTP can trigger real-time processing in related components such as an inventory system or a shipping service.
    4. Using as an SQS (Simple Queue Service) endpoint to trigger execution of video transcoding jobs.
  9. When you register an activity in Amazon SWF, you provide the following information, except:
    1. a name
    2. timeout values
    3. a domain
    4. version
  10. Regarding Amazon SWF, at times you might want to record information in the workflow history of a workflow execution that is specific to your use case. ____ enable you to record information in the workflow execution history that you can use for any custom or scenario-specific purpose.
    1. Markers
    2. Tags
    3. Hash keys
    4. Events
  11. Which of the following statements about SWF are true? Choose 3 answers.
    1. SWF tasks are assigned once and never duplicated
    2. SWF requires an S3 bucket for workflow storage
    3. SWF workflow executions can last up to a year
    4. SWF triggers SNS notifications on task assignment
    5. SWF uses deciders and workers to complete tasks
    6. SWF requires at least 1 EC2 instance per domain
  12. A company needs to orchestrate a multi-step order processing workflow. The workflow involves Lambda functions, requires visual monitoring, and must handle errors with automatic retries. Which AWS service should they use?
    1. Amazon SWF with deciders and activity workers
    2. Amazon SQS with dead-letter queues
    3. AWS Step Functions with Standard Workflows
    4. Amazon EventBridge with rules and targets
  13. A development team is building an AI-powered document processing pipeline that invokes Amazon Bedrock models, stores results in DynamoDB, and notifies users via SNS. The workflow needs to handle failures gracefully and restart from the point of failure. Which combination provides the MOST operationally efficient solution?
    1. AWS SWF with custom decider logic for error handling
    2. Lambda functions orchestrated with SQS queues and DLQ
    3. AWS Step Functions with native service integrations, Retry/Catch blocks, and Redrive
    4. Amazon MWAA (Managed Airflow) with custom operators
  14. A developer needs to build a workflow that coordinates multiple steps, includes human approval, and can pause execution for days while waiting. The developer wants to write the workflow logic as regular code without learning a separate workflow language. Which service is MOST appropriate?
    1. AWS SWF with activity workers
    2. AWS Step Functions with callback patterns
    3. AWS Lambda Durable Functions with waits
    4. Amazon SQS with visibility timeout

References