[{"data":1,"prerenderedAt":2107},["ShallowReactive",2],{"practiceExams":3,"courses-\u002Fcourses\u002Faws-certified-cloud-practitioner":153,"practice-exams-\u002Fcourses\u002Faws-certified-cloud-practitioner":202,"course-\u002Fcourses\u002Faws-certified-cloud-practitioner":245},[4,17,28,39,49,59,70,80,90,101,111,122,134,145],{"id":5,"slug":6,"description":7,"questionCount":8,"isActive":9,"datePublicModified":10,"difficulty":11,"examVersion":16},1,"aws-certified-solutions-architect-associate-saa-c03","Unlock your potential with the AWS Certified Solutions Architect - Associate Practice Exam Simulator. This comprehensive tool is designed to prepare you thoroughly and assess your readiness for the most sought-after AWS associate certification.",1203,true,"2026-10-30T00:00:00.000Z",{"title":12,"subtitle":13,"slug":14,"coverImageUrl":15},"AWS Certified Solutions Architect - Associate","SAA-C03","aws-certified-solutions-architect-associate","\u002Fimages\u002Fdifficulties\u002Faws-certified-solutions-architect-associatesaa-c03\u002Fcovers\u002Faws-SAA-C03.png",{"slug":6,"pageSlug":14},{"id":18,"slug":19,"description":20,"questionCount":21,"isActive":9,"datePublicModified":10,"difficulty":22,"examVersion":27},5,"aws-certified-cloud-practitioner-clf-c02","Master your AWS Certified Cloud Practitioner exam with our Practice Exam Simulator. Prepare effectively and assess your readiness with realistic practice exams designed to mirror the most popular official AWS exam.",937,{"title":23,"subtitle":24,"slug":25,"coverImageUrl":26},"AWS Certified Cloud Practitioner","CLF-C02","aws-certified-cloud-practitioner","\u002Fimages\u002Fdifficulties\u002Faws-certified-cloud-practitionerclf-c02\u002Fcovers\u002Faws-CLF-C02.png",{"slug":19,"pageSlug":25},{"id":29,"slug":30,"description":31,"questionCount":32,"isActive":9,"datePublicModified":10,"difficulty":33,"examVersion":38},8,"aws-certified-devops-engineer-professional-dop-c02","Boost your readiness for the AWS Certified DevOps Engineer - Professional (DOP-C02) exam with our practice exam simulator. Featuring realistic questions and detailed explanations, it helps you identify knowledge gaps and improve your skills.",1040,{"title":34,"subtitle":35,"slug":36,"coverImageUrl":37},"AWS Certified DevOps Engineer - Professional","DOP-C02","aws-certified-devops-engineer-professional","",{"slug":30,"pageSlug":36},{"id":40,"slug":41,"description":42,"questionCount":43,"isActive":9,"datePublicModified":10,"difficulty":44,"examVersion":48},9,"aws-certified-data-engineer-associate-dea-c01","Prepare for your AWS Certified Data Engineer - Associate exam with our practice exam simulator. Featuring real exam scenarios, detailed explanations, and instant feedback to boost your confidence and success rate.",891,{"title":45,"subtitle":46,"slug":47,"coverImageUrl":37},"AWS Certified Data Engineer - Associate","DEA-C01","aws-certified-data-engineer-associate",{"slug":41,"pageSlug":47},{"id":50,"slug":51,"description":52,"questionCount":53,"isActive":9,"datePublicModified":10,"difficulty":54,"examVersion":58},11,"aws-certified-ai-practitioner-aif-c01","Prepare for the AWS Certified AI Practitioner exam with our practice exam simulator. Realistic questions on AI, machine learning and generative AI fundamentals, with detailed explanations, help you find your knowledge gaps and assess your readiness.",928,{"title":55,"subtitle":56,"slug":57,"coverImageUrl":37},"AWS Certified AI Practitioner","AIF-C01","aws-certified-ai-practitioner",{"slug":51,"pageSlug":57},{"id":60,"slug":61,"description":62,"questionCount":63,"isActive":9,"datePublicModified":64,"difficulty":65,"examVersion":69},17,"aws-certified-generative-ai-developer-professional-aip-c01","Get ready for the AWS Certified Generative AI Developer - Professional exam with our practice exam simulator. Realistic scenario-based questions with detailed explanations help you assess your readiness to build generative AI solutions on AWS.",982,"2026-10-29T00:00:00.000Z",{"title":66,"subtitle":67,"slug":68,"coverImageUrl":37},"AWS Certified Generative AI Developer - Professional","AIP-C01","aws-certified-generative-ai-developer-professional",{"slug":61,"pageSlug":68},{"id":71,"slug":72,"description":73,"questionCount":74,"isActive":9,"datePublicModified":64,"difficulty":75,"examVersion":79},19,"aws-certified-machine-learning-engineer-associate-mla-c02","Prepare for the AWS Certified Machine Learning Engineer - Associate exam with our practice exam simulator. Realistic questions with detailed explanations help you find your knowledge gaps and assess your readiness to build and run ML workloads on AWS.",861,{"title":76,"subtitle":77,"slug":78,"coverImageUrl":37},"AWS Certified Machine Learning Engineer - Associate","MLA-C02","aws-certified-machine-learning-engineer-associate",{"slug":72,"pageSlug":78},{"id":81,"slug":82,"description":83,"questionCount":84,"isActive":9,"datePublicModified":64,"difficulty":85,"examVersion":89},21,"aws-certified-cloudops-engineer-associate-soa-c03","Prepare for the AWS Certified CloudOps Engineer - Associate exam with our practice exam simulator. Realistic questions with detailed explanations help you assess your readiness to deploy, operate and troubleshoot workloads on AWS.",862,{"title":86,"subtitle":87,"slug":88,"coverImageUrl":37},"AWS Certified CloudOps Engineer - Associate","SOA-C03","aws-certified-cloudops-engineer-associate",{"slug":82,"pageSlug":88},{"id":91,"slug":92,"description":93,"questionCount":94,"isActive":9,"datePublicModified":64,"difficulty":95,"examVersion":100},13,"aws-certified-security-specialty-scs-c03","Advance your career in cloud security with the AWS Certified Security - Specialty (SCS-C03) Exam Simulator. Realistic, scenario-based practice exams mirror the official exam, with detailed explanations to close your knowledge gaps.",864,{"title":96,"subtitle":97,"slug":98,"coverImageUrl":99},"AWS Certified Security - Specialty","SCS-C03","aws-certified-security-specialty","\u002Fimages\u002Fdifficulties\u002Faws-certified-security-specialtyscs-c02\u002Fcovers\u002Faws_SCS_c02.png",{"slug":92,"pageSlug":98},{"id":102,"slug":103,"description":104,"questionCount":105,"isActive":9,"datePublicModified":64,"difficulty":106,"examVersion":110},15,"aws-certified-ai-business-strategist-aib-c01","Prepare for the AWS Certified AI Business Strategist exam with our practice exam simulator. Realistic, scenario-based questions with detailed explanations help you assess your readiness to lead AI adoption on AWS and close your knowledge gaps.",848,{"title":107,"subtitle":108,"slug":109,"coverImageUrl":37},"AWS Certified AI Business Strategist","AIB-C01","aws-certified-ai-business-strategist",{"slug":103,"pageSlug":109},{"id":112,"slug":113,"description":114,"questionCount":115,"isActive":9,"datePublicModified":116,"difficulty":117,"examVersion":121},10,"aws-certified-advanced-networking-specialty-ans-c01","The AWS Certified Advanced Networking - Specialty practice exam simulates the real test, offering scenario-based questions that assess your ability to design, implement, and troubleshoot complex AWS networking solutions. ",681,"2024-11-13T00:00:00.000Z",{"title":118,"subtitle":119,"slug":120,"coverImageUrl":37},"AWS Certified Advanced Networking - Specialty","ANS-C01","aws-certified-advanced-networking-specialty",{"slug":113,"pageSlug":120},{"id":123,"slug":124,"description":125,"questionCount":126,"isActive":9,"datePublicModified":127,"difficulty":128,"examVersion":133},4,"aws-certified-developer-associate-dva-c02","Unlock your potential as a software developer with the AWS Certified Developer - Associate Exam Simulator! Prepare thoroughly with realistic practice exams designed to mirror the official exam.",399,"2024-06-06T00:00:00.000Z",{"title":129,"subtitle":130,"slug":131,"coverImageUrl":132},"AWS Certified Developer - Associate","DVA-C02","aws-certified-developer-associate","\u002Fimages\u002Fdifficulties\u002Faws-certified-developer-associatedva-c02\u002Fcovers\u002Faws-DVA-C02.png",{"slug":124,"pageSlug":131},{"id":135,"slug":136,"description":137,"questionCount":138,"isActive":9,"datePublicModified":127,"difficulty":139,"examVersion":144},6,"aws-certified-solutions-architect-professional-sap-c02","Elevate your career with the AWS Certified Solutions Architect - Professional Exam Simulator. Get ready to ace the most popular Professional AWS exam with our realistic practice exams. Assess your readiness, boost your confidence, and ensure your success.",789,{"title":140,"subtitle":141,"slug":142,"coverImageUrl":143},"AWS Certified Solutions Architect - Professional","SAP-C02","aws-certified-solutions-architect-professional","\u002Fimages\u002Fdifficulties\u002Faws-certified-solutions-architect-professionalsap-c02\u002Fcovers\u002Faws-SAP-C02.png",{"slug":136,"pageSlug":142},{"id":146,"slug":147,"description":148,"questionCount":149,"isActive":9,"datePublicModified":127,"difficulty":150,"examVersion":151},7,"aws-certified-security-specialty-scs-c02","Advance your career in cloud cybersecurity with the AWS Certified Security - Specialty Exam Simulator! Tailored for professionals, this tool offers realistic practice exams to mirror the official exam.",5431,{"title":96,"subtitle":97,"slug":98,"coverImageUrl":99},{"slug":147,"pageSlug":152},null,[154,160,166,171,176,180,184,188,192,197],{"id":5,"slug":19,"examVersionId":155,"description":156,"difficulty":157,"examVersion":158,"lessonsCount":159},3,"Unlock your cloud computing potential with our interactive AWS course designed for the AWS Certified Cloud Practitioner exam. Gain hands-on experience, understand core AWS services, and confidently ace your certification.",{"id":155,"title":23,"subtitle":24,"slug":25},{"slug":19,"pageSlug":25},353,{"id":161,"slug":6,"examVersionId":5,"description":162,"difficulty":163,"examVersion":164,"lessonsCount":165},2,"Master cloud architecture with our comprehensive interactive course tailored for the AWS Certified Solutions Architect - Associate exam. Learn to design scalable, cost-effective AWS solutions.",{"id":5,"title":12,"subtitle":13,"slug":14},{"slug":6,"pageSlug":14},495,{"id":135,"slug":30,"examVersionId":135,"description":167,"difficulty":168,"examVersion":169,"lessonsCount":170},"Master the AWS Certified DevOps Engineer - Professional (DOP-C02) exam with our interactive course. Engage with hands-on labs, real-world scenarios, and expert guidance to enhance your skills. Learn at your own pace and ensure exam success.",{"id":135,"title":34,"subtitle":35,"slug":36},{"slug":30,"pageSlug":36},381,{"id":146,"slug":41,"examVersionId":146,"description":172,"difficulty":173,"examVersion":174,"lessonsCount":175},"Master the AWS Certified Data Engineer - Associate exam with our interactive course. Explore real-world scenarios and expert guidance to build your skills and pass with confidence. Start your certification journey now!",{"id":146,"title":45,"subtitle":46,"slug":47},{"slug":41,"pageSlug":47},341,{"id":40,"slug":51,"examVersionId":40,"description":37,"difficulty":177,"examVersion":178,"lessonsCount":179},{"id":40,"title":55,"subtitle":56,"slug":57},{"slug":51,"pageSlug":57},246,{"id":50,"slug":92,"examVersionId":60,"description":152,"difficulty":181,"examVersion":182,"lessonsCount":183},{"id":18,"title":96,"subtitle":97,"slug":98},{"slug":92,"pageSlug":98},272,{"id":91,"slug":103,"examVersionId":71,"description":152,"difficulty":185,"examVersion":186,"lessonsCount":187},{"id":50,"title":107,"subtitle":108,"slug":109},{"slug":103,"pageSlug":109},221,{"id":102,"slug":61,"examVersionId":81,"description":152,"difficulty":189,"examVersion":190,"lessonsCount":191},{"id":91,"title":66,"subtitle":67,"slug":68},{"slug":61,"pageSlug":68},368,{"id":60,"slug":72,"examVersionId":193,"description":152,"difficulty":194,"examVersion":195,"lessonsCount":196},23,{"id":102,"title":76,"subtitle":77,"slug":78},{"slug":72,"pageSlug":78},391,{"id":71,"slug":82,"examVersionId":198,"description":152,"difficulty":199,"examVersion":200,"lessonsCount":201},25,{"id":60,"title":86,"subtitle":87,"slug":88},{"slug":82,"pageSlug":88},218,[203,206,209,212,215,218,221,224,227,230,233,236,239,242],{"id":50,"slug":51,"description":52,"questionCount":53,"isActive":9,"datePublicModified":10,"difficulty":204,"examVersion":205},{"title":55,"subtitle":56,"slug":57,"coverImageUrl":37},{"slug":51,"pageSlug":57},{"id":5,"slug":6,"description":7,"questionCount":8,"isActive":9,"datePublicModified":10,"difficulty":207,"examVersion":208},{"title":12,"subtitle":13,"slug":14,"coverImageUrl":15},{"slug":6,"pageSlug":14},{"id":18,"slug":19,"description":20,"questionCount":21,"isActive":9,"datePublicModified":10,"difficulty":210,"examVersion":211},{"title":23,"subtitle":24,"slug":25,"coverImageUrl":26},{"slug":19,"pageSlug":25},{"id":29,"slug":30,"description":31,"questionCount":32,"isActive":9,"datePublicModified":10,"difficulty":213,"examVersion":214},{"title":34,"subtitle":35,"slug":36,"coverImageUrl":37},{"slug":30,"pageSlug":36},{"id":40,"slug":41,"description":42,"questionCount":43,"isActive":9,"datePublicModified":10,"difficulty":216,"examVersion":217},{"title":45,"subtitle":46,"slug":47,"coverImageUrl":37},{"slug":41,"pageSlug":47},{"id":91,"slug":92,"description":93,"questionCount":94,"isActive":9,"datePublicModified":64,"difficulty":219,"examVersion":220},{"title":96,"subtitle":97,"slug":98,"coverImageUrl":99},{"slug":92,"pageSlug":98},{"id":102,"slug":103,"description":104,"questionCount":105,"isActive":9,"datePublicModified":64,"difficulty":222,"examVersion":223},{"title":107,"subtitle":108,"slug":109,"coverImageUrl":37},{"slug":103,"pageSlug":109},{"id":60,"slug":61,"description":62,"questionCount":63,"isActive":9,"datePublicModified":64,"difficulty":225,"examVersion":226},{"title":66,"subtitle":67,"slug":68,"coverImageUrl":37},{"slug":61,"pageSlug":68},{"id":71,"slug":72,"description":73,"questionCount":74,"isActive":9,"datePublicModified":64,"difficulty":228,"examVersion":229},{"title":76,"subtitle":77,"slug":78,"coverImageUrl":37},{"slug":72,"pageSlug":78},{"id":81,"slug":82,"description":83,"questionCount":84,"isActive":9,"datePublicModified":64,"difficulty":231,"examVersion":232},{"title":86,"subtitle":87,"slug":88,"coverImageUrl":37},{"slug":82,"pageSlug":88},{"id":112,"slug":113,"description":114,"questionCount":115,"isActive":9,"datePublicModified":116,"difficulty":234,"examVersion":235},{"title":118,"subtitle":119,"slug":120,"coverImageUrl":37},{"slug":113,"pageSlug":120},{"id":123,"slug":124,"description":125,"questionCount":126,"isActive":9,"datePublicModified":127,"difficulty":237,"examVersion":238},{"title":129,"subtitle":130,"slug":131,"coverImageUrl":132},{"slug":124,"pageSlug":131},{"id":135,"slug":136,"description":137,"questionCount":138,"isActive":9,"datePublicModified":127,"difficulty":240,"examVersion":241},{"title":140,"subtitle":141,"slug":142,"coverImageUrl":143},{"slug":136,"pageSlug":142},{"id":146,"slug":147,"description":148,"questionCount":149,"isActive":9,"datePublicModified":127,"difficulty":243,"examVersion":244},{"title":96,"subtitle":97,"slug":98,"coverImageUrl":99},{"slug":147,"pageSlug":152},{"id":5,"slug":19,"description":156,"datePublicModified":10,"difficulty":246,"examVersion":2106,"lessonsCount":159,"previousExamVersion":152,"newerExamVersion":152},{"id":155,"title":23,"subtitle":24,"rating":161,"slug":25,"guideUrl":247,"categories":248},"https:\u002F\u002Fd1.awsstatic.com\u002Ftraining-and-certification\u002Fdocs-cloud-practitioner\u002FAWS-Certified-Cloud-Practitioner_Exam-Guide.pdf",[249,619,1034,1930],{"id":250,"title":251,"subtitle":152,"subcategories":252},46,"Cloud Concepts",[253,362,396,500],{"id":254,"title":255,"subtitle":152,"lessons":256},183,"Define the benefits of the AWS Cloud",[257,262,267,272,277,282,287,292,297,302,307,312,317,322,327,332,337,342,347,352,357],{"slug":258,"title":259,"focus":260,"teaser":261},"pay-as-you-go-pricing-usage-based-charges-clf-c02","Pay-as-You-Go Pricing: usage-based charges","How metered resource consumption turns upfront infrastructure spending into variable expenses, with charges for allocated resources even when they are idle.","Pay-as-you-go pricing means paying for cloud resources according to measured billing units instead of buying infrastructure in advance. Units can include virtual machine runtime, storage kept over time, requests processed, and data transferred. Each service defines what it measures.",{"slug":263,"title":264,"focus":265,"teaser":266},"aws-cloud-migration-benefits-cloud-economics-clf-c02","AWS Cloud migration benefits: cloud economics","How replacing owned infrastructure with on-demand services changes total cost of ownership, including economies of scale, reduced hardware operations, and why savings are not guaranteed.","Total cost of ownership (TCO) is the full cost of providing and operating a workload over a chosen period. Owned infrastructure costs more than its purchase price: facilities, electricity, cooling, hardware replacement, software licenses, and staff time all contribute.",{"slug":268,"title":269,"focus":270,"teaser":271},"aws-cloud-migration-benefits-elastic-capacity-clf-c02","AWS Cloud migration benefits: elastic capacity","How matching capacity to changing demand reduces peak-capacity guesswork and idle spending, subject to application design and scaling limits.","Capacity is the amount of work your computing resources can handle. Demand often changes: an online store may be busy during a promotion and quiet afterward. With fixed capacity, buying enough servers for the expected peak leaves spare resources idle during quieter periods. Buying too little can leave the application unable to keep up.",{"slug":273,"title":274,"focus":275,"teaser":276},"aws-cloud-migration-benefits-delivery-agility-clf-c02","AWS Cloud migration benefits: delivery agility","How on-demand provisioning and repeatable automation shorten experimentation and delivery cycles while reducing manual effort and configuration errors.","Delivery agility means shortening the time between an idea and a working deployment. A team can try a change, learn whether it works, and use that feedback to improve the next version. Less time spent waiting for infrastructure means more time available for learning and delivery.",{"slug":278,"title":279,"focus":280,"teaser":281},"aws-cloud-migration-benefits-global-reach-clf-c02","AWS Cloud migration benefits: global reach","How regional deployments and edge delivery bring workloads closer to users without building local facilities, while placement constraints determine the benefits.","An AWS Region is a separate geographic area where AWS provides infrastructure. You can deploy an application in a suitable Region without building and operating your own data center there. This makes entering a new market easier than first establishing local facilities.",{"slug":283,"title":284,"focus":285,"teaser":286},"aws-cloud-migration-benefits-high-availability-clf-c02","AWS Cloud migration benefits: high availability","How redundant deployments across isolated infrastructure can reduce downtime, and why migration alone does not make an application highly available.","High availability means keeping an application usable despite component failures. Moving an application to AWS gives you access to infrastructure for building this resilience, but migration alone does not create it. One virtual machine can still be a single point of failure: if it stops, the application stops.",{"slug":288,"title":289,"focus":290,"teaser":291},"aws-global-infrastructure-regions-availability-zones-and-edge-locations-clf-c02","AWS global infrastructure: Regions, Availability Zones, and edge locations","How AWS infrastructure locations relate to one another and enable rapid global deployment and delivery closer to users.","AWS global infrastructure provides places around the world to run applications and deliver content. Two of its building blocks are Regions and Availability Zones. They describe different levels of the infrastructure, not interchangeable names for a location.",{"slug":293,"title":294,"focus":295,"teaser":296},"aws-global-infrastructure-regional-workload-placement-clf-c02","AWS global infrastructure: Regional workload placement","How to choose deployment Regions for user proximity, data sovereignty, and recovery from regional disruptions, recognizing that cross-Region deployment and replication are not automatic.","A Region is a geographic area where you deploy AWS resources. For user-facing applications, placing the workload near its users can reduce latency, the time requests take to travel and receive a response. Geographic distance is a useful starting point, but measure response times rather than assuming the nearest Region is always fastest.",{"slug":298,"title":299,"focus":300,"teaser":301},"amazon-cloudfront-global-delivery-through-edge-caching-clf-c02","Amazon CloudFront: global delivery through edge caching","How CloudFront serves content from edge locations near viewers to reduce latency and origin traffic without deploying origins in every Region.","Amazon CloudFront is a content delivery network (CDN): a service that delivers content through a worldwide network of locations. A viewer is someone requesting content, such as an image, a video, or a web page.",{"slug":303,"title":304,"focus":305,"teaser":306},"aws-global-accelerator-global-traffic-acceleration-clf-c02","AWS Global Accelerator: global traffic acceleration","How static anycast IP addresses bring traffic onto the AWS global network and route it to healthy application endpoints to improve global performance and availability.","AWS Global Accelerator improves the performance and availability of applications used around the world. This lesson follows a standard accelerator, which routes traffic to application endpoints based on factors including health and network performance.",{"slug":308,"title":309,"focus":310,"teaser":311},"amazon-cloudfront-and-aws-global-accelerator-choosing-global-delivery-clf-c02","Amazon CloudFront and AWS Global Accelerator: choosing global delivery","When to choose CloudFront for HTTP content delivery versus Global Accelerator for network acceleration with static anycast IP addresses.","Amazon CloudFront is a content delivery network, or CDN, for HTTP and HTTPS content. Choose it when your main goal is delivering websites, images, downloads, videos, or APIs to users around the world.",{"slug":313,"title":314,"focus":315,"teaser":316},"failover-and-high-availability-mechanism-versus-objective-clf-c02","Failover and high availability: mechanism versus objective","Why high availability is an availability objective while failover is one mechanism for achieving it, not a guarantee of uninterrupted service.","High availability is the objective of keeping a service usable for the required proportion of time, including when failures occur. It describes the outcome users need: being able to sign in, read information, or complete a purchase. It does not mean that interruptions are impossible.",{"slug":318,"title":319,"focus":320,"teaser":321},"high-availability-redundancy-across-availability-zones-clf-c02","High availability: redundancy across Availability Zones","How redundant components in separate Availability Zones, health checks, and automated recovery keep an application usable when infrastructure fails.","High availability means keeping an application usable, including when infrastructure fails. A running server is not enough: users must still be able to complete the actions they need. Redundancy provides additional components that can do the same job if one fails.",{"slug":323,"title":324,"focus":325,"teaser":326},"elastic-load-balancing-elb-distributing-traffic-to-healthy-targets-clf-c02","Elastic Load Balancing (ELB): distributing traffic to healthy targets","How ELB distributes incoming traffic across targets and uses health checks to keep applications available when individual targets fail.","Elastic Load Balancing (ELB) distributes incoming application traffic across registered targets: resources that handle the traffic. Instead of choosing a server, users connect to the load balancer, which selects a target for each request.",{"slug":328,"title":329,"focus":330,"teaser":331},"high-availability-and-disaster-recovery-continuity-versus-restoration-clf-c02","High availability and disaster recovery: continuity versus restoration","How maintaining service availability differs from restoring service after a disaster, and why using multiple Regions can support either goal.","High availability means keeping a service usable for the required proportion of time, including when failures occur. The emphasis is continuity: users should still be able to do useful work despite a disruption. Availability is judged from the user's perspective, not just by whether a server is running.",{"slug":333,"title":334,"focus":335,"teaser":336},"high-availability-protection-across-regions-clf-c02","High availability: protection across Regions","How active or standby deployments in separate Regions protect availability against regional disruptions, and when their added cost and complexity are justified.","An AWS Region is a separate geographic area containing multiple Availability Zones. Redundancy within one Region protects against some local failures, but a disruption affecting that entire Region can still make the application unavailable. Deploying in separate Regions gives the application another location from which to serve users.",{"slug":338,"title":339,"focus":340,"teaser":341},"elasticity-matching-capacity-to-demand-clf-c02","Elasticity: matching capacity to demand","How automatic scaling adds and releases capacity as demand changes, supporting performance while reducing idle-resource costs.","Elasticity means adjusting resource capacity as demand changes, in both directions. Capacity is the amount of work your resources can handle. An elastic application gains capacity when more work arrives and releases capacity when that extra capacity is no longer needed.",{"slug":343,"title":344,"focus":345,"teaser":346},"elasticity-and-horizontal-scaling-behavior-versus-mechanism-clf-c02","Elasticity and horizontal scaling: behavior versus mechanism","Why changing the number of resources is a scaling mechanism, while elasticity means matching capacity to demand in both directions.","Horizontal scaling changes the number of resources serving a workload. Adding instances or workers is scaling out; removing them is scaling in. This is a scaling mechanism: it describes how capacity changes. The term alone does not tell you what triggered the change.",{"slug":348,"title":349,"focus":350,"teaser":351},"amazon-ec2-auto-scaling-elastic-instance-capacity-clf-c02","Amazon EC2 Auto Scaling: elastic instance capacity","How an Auto Scaling group adds and removes EC2 instances in response to demand while respecting minimum, desired, and maximum capacity.","Amazon EC2 Auto Scaling adjusts the number of EC2 instances running an application. An Auto Scaling group treats those instances as one collection to manage. Adding and removing instances as demand changes provides elasticity: more capacity when needed and less unused capacity afterward.",{"slug":353,"title":354,"focus":355,"teaser":356},"elasticity-and-high-availability-demand-versus-failure-clf-c02","Elasticity and high availability: demand versus failure","Why matching capacity to changing demand differs from keeping a workload accessible despite failures, and neither guarantees the other.","Elasticity means matching resource capacity to changing demand, in both directions. When more work arrives, capacity increases; when demand falls, unneeded capacity is released. This helps support performance without keeping all peak capacity running continuously.",{"slug":358,"title":359,"focus":360,"teaser":361},"aws-cloudformation-templates-and-stacks-clf-c02","AWS CloudFormation: templates and stacks","How reusable JSON or YAML templates define resources that CloudFormation provisions and manages together as stacks for repeatable deployments.","AWS CloudFormation provisions and manages AWS resources from a text file called a template. You write the template in JSON or YAML to describe the resources you want and their settings, rather than manually creating each resource. This approach is called infrastructure as code.",{"id":363,"title":364,"subtitle":152,"lessons":365},184,"Identify design principles of the AWS Cloud",[366,371,376,381,386,391],{"slug":367,"title":368,"focus":369,"teaser":370},"aws-well-architected-framework-evaluating-designs-through-six-pillars-clf-c02","AWS Well-Architected Framework: evaluating designs through six pillars","How the six pillars guide workload reviews, distinguish architectural priorities, and reveal trade-offs between design choices.","The AWS Well-Architected Framework provides a repeatable way to evaluate a cloud workload against technical and business requirements. A workload includes the application, infrastructure, data, operating procedures, and people delivering a business capability. Reviewing resource settings alone would miss questions such as who responds to failures.",{"slug":372,"title":373,"focus":374,"teaser":375},"architecture-reviews-using-the-aws-well-architected-framework-clf-c02","Architecture Reviews: using the AWS Well-Architected Framework","How the framework’s six pillars and cloud design principles guide an evidence-based workload review toward prioritized improvements rather than a pass-or-fail judgment.","The AWS Well-Architected Framework provides questions, best practices, and design principles for evaluating a cloud workload. A workload includes the application, infrastructure, data, dependencies, and operating procedures that deliver a business capability. The review asks whether these support the intended business outcomes—not whether the architecture deserves a passing grade.",{"slug":377,"title":378,"focus":379,"teaser":380},"aws-well-architected-tool-workload-reviews-clf-c02","AWS Well-Architected Tool: workload reviews","How a workload review uses questions across the Framework’s six pillars to identify architectural risks and guide improvements.","A workload is a set of components that together deliver business value, such as an online store and its supporting systems. A workload review asks how that workload is designed and operated, and where its architecture could improve.",{"slug":382,"title":383,"focus":384,"teaser":385},"resource-efficiency-matching-resources-to-useful-work-clf-c02","Resource Efficiency: matching resources to useful work","How matching resource consumption to useful work supports the Well-Architected goals of performance efficiency, cost optimization, and sustainability while preserving workload requirements.","Resource efficiency means turning infrastructure resources into useful outcomes without unnecessary consumption. Useful work might be a completed order, a successful request, or a finished report. An application that completes the same work with fewer compute hours is more resource-efficient, provided it still meets its requirements.",{"slug":387,"title":388,"focus":389,"teaser":390},"right-sizing-matching-capacity-to-workload-needs-clf-c02","Right-Sizing: matching capacity to workload needs","How matching capacity to measured demand supports Cost Optimization, Performance Efficiency, and Sustainability while preserving performance and reliability requirements.","Right-sizing means selecting resources whose capacity fits the work an application needs to do. Capacity includes processing power, memory, storage performance, and network capacity—not just the size of a virtual machine.",{"slug":392,"title":393,"focus":394,"teaser":395},"aws-compute-optimizer-resource-optimization-recommendations-clf-c02","AWS Compute Optimizer: resource optimization recommendations","How historical utilization informs resource recommendations that support the Cost Optimization and Performance Efficiency pillars of the Well-Architected Framework.","AWS Compute Optimizer uses machine learning to analyze resource configuration and historical utilization: measurements of how resources have been used over time. It recommends configurations that better match the workload. Supported resources include Amazon EC2 instances, Amazon EBS volumes, and AWS Lambda functions. For example, it can recommend a different EC2 instance type based on the instance’s observed demand.",{"id":397,"title":398,"subtitle":152,"lessons":399},185,"Understand the benefits of and strategies for migration to the AWS Cloud",[400,405,410,415,420,425,430,435,440,445,450,455,460,465,470,475,480,485,490,495],{"slug":401,"title":402,"focus":403,"teaser":404},"aws-caf-organizational-readiness-for-cloud-adoption-clf-c02","AWS CAF: organizational readiness for cloud adoption","How CAF’s six perspectives identify capability gaps and guide an iterative transformation roadmap toward measurable business outcomes.","The AWS Cloud Adoption Framework (AWS CAF) helps an organization prepare for cloud adoption as a business transformation, not just a change of infrastructure. A capability is an organizational ability, such as developing workforce skills or responding to incidents. CAF is guidance for assessing and improving these abilities—not a deployable AWS service or a guarantee of results.",{"slug":406,"title":407,"focus":408,"teaser":409},"migration-phases-the-phased-migration-journey-clf-c02","Migration Phases: the phased migration journey","How assess, mobilize, and migrate and modernize organize migration work around readiness, measurable outcomes, and decision points without imposing a rigid sequence.","A cloud migration moves applications, data, and operational responsibilities—not just servers. AWS organizes this work into three phases: assess, mobilize, and migrate and modernize. They provide a planning structure, not a rule that every application must progress at the same time.",{"slug":411,"title":412,"focus":413,"teaser":414},"migration-phases-vs-aws-cloud-adoption-framework-transformation-phases-clf-c02","Migration Phases vs. AWS Cloud Adoption Framework transformation phases","How migration phases organize workload migration while AWS CAF transformation phases structure broader organizational change.","Migration phases organize the work of moving workloads to the cloud. A workload includes an application, its data, and the resources it needs to run. Migration work includes preparation, security, staff readiness, testing, and operational ownership—not just copying servers.",{"slug":416,"title":417,"focus":418,"teaser":419},"aws-application-discovery-service-discovering-on-premises-workloads-clf-c02","AWS Application Discovery Service: discovering on-premises workloads","How agent-based and agentless discovery collect workload inventory and utilization data, with agent-collected dependencies helping identify applications to migrate together.","AWS Application Discovery Service has been in maintenance since October 7, 2025. It is closed to new customers; existing customers can keep using it. AWS's migration guide is at https:\u002F\u002Fdocs.aws.amazon.com\u002Fapplication-discovery\u002Flatest\u002Fuserguide\u002Fapplication-discovery-service-availability-change.html.",{"slug":421,"title":422,"focus":423,"teaser":424},"aws-migration-evaluator-building-a-migration-business-case-clf-c02","AWS Migration Evaluator: building a migration business case","How Migration Evaluator uses on-premises inventory and utilization data to estimate AWS costs and potential savings for a migration business case.","AWS Migration Evaluator helps build a migration business case: an evidence-based comparison of current on-premises costs with estimated costs on AWS. It supports the decision about whether to migrate; it does not move workloads or promise a particular saving.",{"slug":426,"title":427,"focus":428,"teaser":429},"aws-application-discovery-service-vs-aws-migration-evaluator-clf-c02","AWS Application Discovery Service vs AWS Migration Evaluator","When migration planning needs technical inventory and dependency discovery rather than Migration Evaluator's cost analysis and migration business case.","AWS Application Discovery Service has been in maintenance since 2025-10-07: it is closed to new customers, while existing customers can keep using it. This lesson explains its established role, not a recommendation for new workloads. AWS's migration guide: https:\u002F\u002Fdocs.aws.amazon.com\u002Fapplication-discovery\u002Flatest\u002Fuserguide\u002Fapplication-discovery-service-availability-change.html.",{"slug":431,"title":432,"focus":433,"teaser":434},"aws-migration-hub-centralized-migration-tracking-clf-c02","AWS Migration Hub: centralized migration tracking","How Migration Hub consolidates progress updates from AWS and partner migration tools into an application-level view without moving workloads itself.","AWS Migration Hub has been in maintenance since November 7, 2025. It is closed to new customers; existing customers can keep using it. This lesson describes its established tracking role, not a recommendation for new workloads. AWS's migration guide is at https:\u002F\u002Fdocs.aws.amazon.com\u002Fmigrationhub\u002Flatest\u002Fug\u002Fmigrationhub-availability-change.html.",{"slug":436,"title":437,"focus":438,"teaser":439},"aws-prescriptive-guidance-finding-and-selecting-guidance-clf-c02","AWS Prescriptive Guidance: finding and selecting guidance","How to locate and select strategies, guides, and patterns whose objectives and prerequisites fit a migration or other cloud project.","AWS Prescriptive Guidance is an official AWS technical resource containing recommended approaches drawn from cloud project experience. It helps with migration, modernization, and other cloud projects. It is not a managed service: reading a publication does not provision infrastructure or move a workload.",{"slug":441,"title":442,"focus":443,"teaser":444},"aws-partner-network-partner-expertise-and-solutions-clf-c02","AWS Partner Network: partner expertise and solutions","How customers use ISVs and systems integrators for software, integration, and migration expertise, with AWS Marketplace serving as a procurement channel rather than the partner network itself.","The AWS Partner Network (APN) is an ecosystem of organizations that provide software and services for customers using AWS. It is not a cloud runtime service. Customers turn to partners when they need specialist products, implementation skills, or extra delivery capacity.",{"slug":446,"title":447,"focus":448,"teaser":449},"aws-professional-services-scoped-consulting-engagements-clf-c02","AWS Professional Services: scoped consulting engagements","How consultants work with customer teams toward agreed cloud project outcomes, using a migration engagement to explain scope, deliverables, and customer responsibilities.","AWS Professional Services provides consultants who work with customer teams toward agreed cloud project outcomes. It is assistance delivered by people through a consulting engagement, not a cloud resource provisioned through an API.",{"slug":451,"title":452,"focus":453,"teaser":454},"aws-partner-network-vs-aws-professional-services-clf-c02","AWS Partner Network vs AWS Professional Services","How engaging an independent AWS Partner differs from engaging AWS's own Professional Services team for migration assistance.","The AWS Partner Network (APN) is an ecosystem of independent organizations. When you engage an AWS Partner for migration assistance, you engage a separate company, not an AWS consulting team. APN itself is not a team that performs your migration.",{"slug":456,"title":457,"focus":458,"teaser":459},"aws-cloud-migration-benefits-organizational-readiness-clf-c02","AWS Cloud migration benefits: organizational readiness","How the six AWS Cloud Adoption Framework perspectives connect organizational capabilities to measurable improvements in risk, ESG performance, revenue, and operational efficiency.","The AWS Cloud Adoption Framework (AWS CAF) helps an organization prepare for cloud adoption. It organizes readiness into six perspectives: Business, People, Governance, Platform, Security, and Operations. Each perspective highlights capabilities the organization needs—not just technology it needs to buy.",{"slug":461,"title":462,"focus":463,"teaser":464},"migration-and-data-transfer-migration-approaches-clf-c02","Migration and data transfer: migration approaches","How the seven Rs address different workload needs and how database replication supports migration with reduced downtime.","The seven Rs describe choices for a workload—an application and the resources it needs. Rehost moves it with minimal changes, useful when moving quickly matters. Replatform makes targeted improvements without a major redesign, such as moving a self-managed database to a managed database service. Refactor or rearchitect substantially changes the application design to meet needs such as greater flexibility or scale.",{"slug":466,"title":467,"focus":468,"teaser":469},"7-rs-of-migration-choosing-a-workload-strategy-clf-c02","7 Rs of Migration: choosing a workload strategy","How the seven workload strategies differ, how business goals and technical constraints guide the choice, and why database replication is an implementation technique rather than a strategy.","The 7 Rs of Migration are choices about what to do with a workload: an application or component that performs useful work. They are not seven phases to complete in order. Choose a strategy for each workload; different components of one application can follow different paths.",{"slug":471,"title":472,"focus":473,"teaser":474},"database-replication-keeping-a-migration-target-current-clf-c02","Database Replication: keeping a migration target current","How an initial copy and ongoing change replication keep a migration target current while the source remains active, reducing downtime before a controlled cutover without resolving engine incompatibilities.","Database replication maintains a copy of database data. During a migration, the existing database is the source, and the database being prepared is the target. The source can remain active while data moves.",{"slug":476,"title":477,"focus":478,"teaser":479},"aws-application-migration-service-server-rehosting-clf-c02","AWS Application Migration Service: server rehosting","How continuous server replication, test launches, and cutover enable rehosting applications on Amazon EC2 with minimal changes and downtime.","AWS Application Migration Service, often called MGN, helps move applications from existing servers to Amazon EC2. It supports rehosting: moving the server's operating system, applications, and data with minimal application changes, rather than redesigning the application.",{"slug":481,"title":482,"focus":483,"teaser":484},"aws-dms-database-migration-through-replication-clf-c02","AWS DMS: database migration through replication","How source and target endpoints, an initial full load, and ongoing change replication let AWS DMS move database data with minimal downtime.","AWS Database Migration Service (AWS DMS) moves database data from a source to a target. The source can keep serving applications during much of the migration, reducing the time applications must stop using it.",{"slug":486,"title":487,"focus":488,"teaser":489},"aws-application-migration-service-and-aws-dms-server-versus-database-migration-clf-c02","AWS Application Migration Service and AWS DMS: server versus database migration","When to choose AWS Application Migration Service for whole-server rehosting rather than AWS DMS for database migration.","A server contains more than database data: it has an operating system, installed software, configuration, and files. AWS Application Migration Service, often called MGN, helps move that server environment to Amazon EC2. This is rehosting: moving an existing workload to AWS with minimal changes rather than redesigning it.",{"slug":491,"title":492,"focus":493,"teaser":494},"aws-sct-schema-conversion-clf-c02","AWS SCT: schema conversion","How AWS SCT assesses database compatibility and converts schemas and supported database code for a different engine, highlighting objects that need manual changes.","AWS Schema Conversion Tool (AWS SCT) is a tool you install to help prepare a database for a different database engine. Engines can use different SQL syntax, data types, and features. Moving to another engine can therefore require translating database definitions, not simply copying them.",{"slug":496,"title":497,"focus":498,"teaser":499},"aws-dms-vs-aws-sct-data-migration-and-schema-conversion-clf-c02","AWS DMS vs AWS SCT: data migration and schema conversion","How AWS DMS data migration differs from AWS SCT schema and code conversion, and where built-in DMS Schema Conversion fits.","A database contains both data and definitions that organize and use it. Customer records are data. Table definitions, views, and database code such as stored procedures describe how that data is stored or handled.",{"id":501,"title":502,"subtitle":152,"lessons":503},186,"Understand concepts of cloud economics",[504,509,514,519,524,529,534,539,544,549,554,559,564,569,574,579,584,589,594,599,604,609,614],{"slug":505,"title":506,"focus":507,"teaser":508},"cost-management-cloud-cost-structures-clf-c02","Cost management: cloud cost structures","How fixed and variable costs, consumption-based pricing, and ownership overhead affect like-for-like comparisons of cloud and on-premises costs.","A fixed cost stays broadly unchanged over a particular period and capacity range, even when usage changes. An annual data-center lease is an example: serving fewer requests does not reduce the agreed rent. A variable cost changes with consumption, such as a charge based on the amount of data stored.",{"slug":510,"title":511,"focus":512,"teaser":513},"cost-management-rightsizing-resources-clf-c02","Cost management: rightsizing resources","How measured workload demand guides resource sizing to reduce waste without compromising service requirements.","Rightsizing means matching a resource’s type, capacity, and configuration to measured workload needs. The goal is to remove paid-for capacity that adds no useful value while still meeting service requirements, such as response time and availability.",{"slug":515,"title":516,"focus":517,"teaser":518},"cost-management-storage-tier-economics-clf-c02","Cost management: storage tier economics","How access patterns, retrieval requirements, and the full charging model determine whether a storage option or tier saves money.","A cheaper storage option saves money only if it still meets the application's needs. Start with the storage form: object, block, or file. These provide different ways to access data, so they are not interchangeable just because one has a lower advertised price.",{"slug":520,"title":521,"focus":522,"teaser":523},"total-cost-of-ownership-comparing-on-premises-and-cloud-costs-clf-c02","Total Cost of Ownership: comparing on-premises and cloud costs","How to compare equivalent workloads over the same period using complete ownership costs, including indirect and migration expenses, to determine when cloud economics produces real savings.","Total Cost of Ownership (TCO) is the complete cost of a technology solution over an agreed period. It helps answer whether running a workload in the cloud costs less overall than running it on premises—not just whether one server has a lower price.",{"slug":525,"title":526,"focus":527,"teaser":528},"aws-pricing-calculator-planning-cost-estimates-clf-c02","AWS Pricing Calculator: planning cost estimates","How service configurations and usage assumptions produce planning estimates, and how standalone estimates differ from estimates based on an existing bill.","AWS Pricing Calculator produces a planning estimate from the services you choose and the usage you expect. Start by selecting a service, then enter its Region, configuration, and usage assumptions. The calculator applies supported pricing dimensions to those inputs and shows estimated charges.",{"slug":530,"title":531,"focus":532,"teaser":533},"capital-expenditure-upfront-infrastructure-investment-clf-c02","Capital Expenditure: upfront infrastructure investment","How buying long-lived infrastructure commits funds before demand is known and creates capacity costs that persist when utilization falls.","Capital expenditure (CapEx) is spending on assets expected to provide benefits over multiple accounting periods. In infrastructure, examples include buying servers, storage equipment, and networking equipment. These are long-lived assets, purchased to support work over time.",{"slug":535,"title":536,"focus":537,"teaser":538},"operating-expenditure-fixed-and-variable-costs-clf-c02","Operating Expenditure: fixed and variable costs","How ongoing cloud expenses combine fixed commitments with usage-based charges, and why reducing consumption lowers some charges but not others.","Operating expenditure, or OpEx, includes the ongoing costs of running cloud workloads. Those expenses can contain both fixed costs and variable costs. Paying a cloud bill every month does not mean every charge changes with consumption.",{"slug":540,"title":541,"focus":542,"teaser":543},"capital-expenditure-versus-operating-expenditure-clf-c02","Capital Expenditure versus Operating Expenditure","How capital versus operating expenditure differs from fixed versus variable costs, and why recurring or upfront payments alone do not determine accounting classification.","Capital expenditure (CapEx) is spending to acquire or improve a long-lived asset. A server purchase that qualifies for capitalization is recorded as an asset rather than charged entirely as an expense immediately. Its cost is generally recognized as expense over its useful life through depreciation.",{"slug":545,"title":546,"focus":547,"teaser":548},"bring-your-own-license-using-existing-software-entitlements-clf-c02","Bring Your Own License: using existing software entitlements","How vendor eligibility rules, licensed capacity, and ongoing obligations determine whether existing software licenses can be reused economically in the cloud.","Bring Your Own License (BYOL) means using software licenses acquired separately from the cloud service. An entitlement is the right to use software under an agreement. Reusing existing entitlements can avoid buying additional software rights, but you still pay for the cloud resources you consume.",{"slug":550,"title":551,"focus":552,"teaser":553},"license-included-pricing-coverage-and-charges-clf-c02","License-Included Pricing: coverage and charges","How a selected cloud offering supplies specified software usage rights in its price, and why coverage, usage limits, and additional charges must still be checked.","License-included pricing means that a selected cloud offering supplies the right to use specified licensed software as part of its price. You pay for the covered software rights through that offering rather than supplying a separate license for that product.",{"slug":555,"title":556,"focus":557,"teaser":558},"bring-your-own-license-versus-license-included-pricing-clf-c02","Bring Your Own License versus License-Included Pricing","How the two models differ in who supplies software rights, which licensing costs the service price includes, and who manages the licensing obligations.","A software license gives permission to use software under stated terms. Paying for a cloud server does not, by itself, give you permission to run every commercial software product on it.",{"slug":560,"title":561,"focus":562,"teaser":563},"license-portability-conditions-for-moving-existing-licenses-clf-c02","License Portability: conditions for moving existing licenses","How vendor restrictions and license-counting rules determine whether existing entitlements cover a proposed cloud deployment.","An entitlement is a right to use software under specified terms. Moving software to the cloud does not automatically move that right. A successful installation proves that the software runs, not that your existing licenses cover it. The vendor’s license agreement determines which products, editions, versions, and cloud environments are eligible.",{"slug":565,"title":566,"focus":567,"teaser":568},"license-portability-vs-bring-your-own-license-clf-c02","License Portability vs. Bring Your Own License","How portability as a contractual permission differs from BYOL as a licensing strategy, contrasted with obtaining licenses through license-included pricing.","A software license gives you rights to use software under an agreement. License portability is the contractual permission to use an existing license when a workload moves between environments, such as from an on-premises data center to AWS. Being able to copy or install the software does not establish that permission.",{"slug":570,"title":571,"focus":572,"teaser":573},"aws-license-manager-managing-bring-your-own-licenses-clf-c02","AWS License Manager: managing bring-your-own licenses","How License Manager tracks BYOL usage against configured licensing rules, and how managing existing licenses differs from using license-included offerings.","A software license gives you permission to use software under a vendor’s terms. With bring your own license (BYOL), you use licenses your organization already holds for an eligible AWS deployment. You must check that the vendor agreement allows that use, including any restrictions on where the software runs.",{"slug":575,"title":576,"focus":577,"teaser":578},"resource-utilization-interpreting-capacity-use-clf-c02","Resource Utilization: interpreting capacity use","How representative CPU, memory, storage, and network measurements reveal sizing needs while preserving performance and reliability headroom.","Resource utilization describes how much available capacity a workload uses. Rightsizing means matching the type, size, and quantity of resources to the workload's needs. It can mean choosing something smaller, adding capacity, or choosing a different balance of resources—not simply choosing the cheapest option.",{"slug":580,"title":581,"focus":582,"teaser":583},"rightsizing-matching-capacity-to-workload-needs-clf-c02","Rightsizing: matching capacity to workload needs","How measured workload demand guides resource sizing to minimize waste while preserving required performance, headroom, and availability as needs change.","Rightsizing means matching provisioned resources to measured workload needs with minimal waste. The right configuration must still meet required performance and availability. It may mean reducing capacity, adding capacity, choosing a different resource type, or changing the number of resources.",{"slug":585,"title":586,"focus":587,"teaser":588},"determinism-repeatable-automation-clf-c02","Determinism: repeatable automation","How controlling inputs, state, and execution conditions makes automation repeatable and reduces manual variation without guaranteeing correct results.","Determinism means that identical inputs, initial state, and execution conditions produce identical results. For example, an invoice calculation can return the same total each time when the amounts, tax rate, rounding rules, and relevant conditions stay the same.",{"slug":590,"title":591,"focus":592,"teaser":593},"infrastructure-as-code-iac-repeatable-infrastructure-deployments-clf-c02","Infrastructure as code (IaC): repeatable infrastructure deployments","How reusable infrastructure definitions drive provisioning and updates, and when this approach fits better than one-time console actions or operational scripts.","Infrastructure as code (IaC) means describing infrastructure in reusable files and using a deployment tool to create and update it. Instead of repeating console clicks to build each environment, you keep a definition of the resources and their settings.",{"slug":595,"title":596,"focus":597,"teaser":598},"aws-auto-scaling-matching-capacity-to-demand-clf-c02","AWS Auto Scaling: matching capacity to demand","How scaling plans use utilization targets to add or remove application capacity as demand changes, providing elasticity without continual manual adjustment.","Capacity is the amount of work an application’s resources can handle. Demand changes: a busy period needs more capacity, while a quiet period needs less. Keeping enough capacity for the busiest period all the time can leave paid resources idle.",{"slug":600,"title":601,"focus":602,"teaser":603},"volume-discounts-qualifying-for-lower-unit-rates-clf-c02","Volume Discounts: qualifying for lower unit rates","How eligible quantities determine unit rates under service pricing tiers or qualifying partner agreements, and why a lower unit rate does not guarantee a smaller bill.","A volume discount is a lower price per unit tied to the quantity of eligible resources consumed or purchased. Cloud providers can share efficiencies from operating at large scale through lower prices. However, benefiting from those efficiencies is not the same as qualifying for a particular discount.",{"slug":605,"title":606,"focus":607,"teaser":608},"volume-discounts-vs-usage-based-pricing-clf-c02","Volume Discounts vs Usage-Based Pricing","How paying for actual consumption differs from receiving a lower unit rate after qualifying volume thresholds are reached.","Usage-based pricing means charges are tied to actual, measured consumption rather than simply to having access to a service. The service measures a billable quantity, such as requests processed, compute running time, or storage used over time. This answers the question: How much did you consume?",{"slug":610,"title":611,"focus":612,"teaser":613},"aws-organizations-consolidated-billing-clf-c02","AWS Organizations: consolidated billing","How management and member accounts share one bill while retaining per-account cost visibility, pooling eligible usage for volume discounts, and sharing eligible Reserved Instance billing benefits.","AWS Organizations brings multiple AWS accounts into an organization. With consolidated billing, the management account pays the combined charges for its own usage and the usage of the member accounts.",{"slug":615,"title":616,"focus":617,"teaser":618},"volume-discounts-aggregation-under-consolidated-billing-clf-c02","Volume Discounts: aggregation under consolidated billing","How AWS Organizations combines eligible usage across accounts for volume pricing while preserving service-specific thresholds and aggregation boundaries.","Consolidated billing in AWS Organizations brings the charges for an organization's accounts together for payment. The management account is responsible for paying those charges. Member accounts can still run their own workloads; they do not have to move resources into one account.",{"id":620,"title":621,"subtitle":152,"subcategories":622},47,"Security and Compliance",[623,672,856,990],{"id":624,"title":625,"subtitle":152,"lessons":626},187,"Understand the AWS shared responsibility model",[627,632,637,642,647,652,657,662,667],{"slug":628,"title":629,"focus":630,"teaser":631},"aws-shared-responsibility-model-security-of-and-in-the-cloud-clf-c02","AWS shared responsibility model: security of and in the cloud","How the division of security responsibilities lets customers benefit from AWS infrastructure safeguards while using their own access controls and encryption to prevent unauthorized access and protect data confidentiality.","The AWS shared responsibility model divides security between AWS and its customers. AWS handles security of the cloud: protecting the infrastructure that runs AWS services, including physical facilities, hardware, underlying networking, and the virtualization layer.",{"slug":633,"title":634,"focus":635,"teaser":636},"amazon-ec2-operating-your-own-virtual-server-clf-c02","Amazon EC2: operating your own virtual server","How EC2 divides operational responsibility between AWS and the customer, including the work involved in running a database on an instance.","Amazon EC2 provides virtual servers called instances. You can choose an operating system and install software, much as you would on a server you own. AWS supplies the underlying computing infrastructure, so you do not have to buy or maintain physical servers.",{"slug":638,"title":639,"focus":640,"teaser":641},"aws-shared-responsibility-model-service-specific-boundaries-clf-c02","AWS shared responsibility model: service-specific boundaries","How managed services shift operational duties to AWS, using patching and configuration ownership in EC2-hosted and AWS-managed databases to explain reduced management effort and continuing customer responsibilities.","The shared responsibility model assigns duties according to which layers AWS operates and which layers you operate. A useful question is: who manages the software that needs this patch? The answer depends on the service, not just on whether the workload runs on AWS.",{"slug":643,"title":644,"focus":645,"teaser":646},"amazon-rds-the-managed-relational-database-model-clf-c02","Amazon RDS: the managed relational database model","How RDS provides relational database engines with AWS-managed infrastructure and routine maintenance while customers remain responsible for their data, access, and database configuration.","Amazon Relational Database Service (Amazon RDS) helps you set up, operate, and scale relational databases. A relational database organizes data into tables of rows and columns. Relationships connect those tables: an order, for example, can refer to a customer through a customer ID.",{"slug":648,"title":649,"focus":650,"teaser":651},"patch-management-responsibility-across-cloud-service-layers-clf-c02","Patch Management: responsibility across cloud service layers","How patching ownership follows the software layers AWS and customers control, including EC2 guest software and customer update obligations in managed services.","Patch management means keeping software updated with fixes for security vulnerabilities and reliability problems. In the cloud, patching is a shared responsibility: AWS and customers patch different software layers, rather than both patching the same components.",{"slug":653,"title":654,"focus":655,"teaser":656},"configuration-management-responsibility-boundaries-clf-c02","Configuration Management: responsibility boundaries","How responsibility for maintaining approved configurations divides between AWS and customers across infrastructure, EC2 instances, and managed databases.","Configuration management means defining how a system should be configured and keeping it aligned with that approved state. The approved settings form a baseline. They can cover software versions, network access rules, permissions, and database settings. Comparing actual settings with the baseline helps reveal unexpected changes, called configuration drift.",{"slug":658,"title":659,"focus":660,"teaser":661},"cloud-service-models-abstraction-and-management-boundaries-clf-c02","Cloud Service Models: abstraction and management boundaries","How IaaS, PaaS, and SaaS shift management of stack layers toward the provider, using EC2, RDS, and Lambda to show which operational and security responsibilities remain with customers.","A technology stack includes facilities, hardware, virtualization, operating systems, runtimes, applications, and data. A runtime is the software environment that executes application code. Cloud service models describe which layers the provider operates and which the customer manages.",{"slug":663,"title":664,"focus":665,"teaser":666},"amazon-rds-and-amazon-ec2-choosing-database-hosting-clf-c02","Amazon RDS and Amazon EC2: choosing database hosting","When reduced administration with RDS outweighs the operating-system access and database customization available when hosting a database on EC2.","A database engine is the software that stores data and runs database queries. You can use a supported relational database engine through Amazon RDS, a managed database service, or install and operate database software on Amazon EC2, a virtual server service.",{"slug":668,"title":669,"focus":670,"teaser":671},"aws-lambda-managed-function-execution-clf-c02","AWS Lambda: managed function execution","How Lambda runs event-triggered code and scales execution, which workloads suit functions, and how AWS infrastructure responsibilities differ from customer responsibilities for code, dependencies, and permissions.","AWS Lambda runs your code without requiring you to provision or manage servers. You deploy a function, configure what invokes it, and Lambda supplies the environment in which it runs. Serverless means the servers are managed for you, not that there are no servers.",{"id":673,"title":674,"subtitle":152,"lessons":675},188,"Understand AWS Cloud security, governance, and compliance concepts",[676,681,686,691,696,701,706,711,716,721,726,731,736,741,746,751,756,761,766,771,776,781,786,791,796,801,806,811,816,821,826,831,836,841,846,851],{"slug":677,"title":678,"focus":679,"teaser":680},"aws-compliance-vs-management-and-governance-clf-c02","AWS Compliance vs. management and governance","How evaluating conformity with requirements differs from establishing policies, decision rights, and oversight.","Compliance means meeting applicable requirements and demonstrating that they are met. Those requirements can come from laws, industry standards, contracts, or internal policies. Evaluating compliance asks: Does what we actually do meet what is required?",{"slug":682,"title":683,"focus":684,"teaser":685},"aws-compliance-requirement-applicability-and-scope-clf-c02","AWS Compliance: requirement applicability and scope","How industry and geographic obligations determine requirements, and how to verify compliance-program coverage for the services, Regions, and features a workload uses.","Requirement applicability means deciding which obligations apply to your organization, its data, and its activities. Requirements can come from laws, industry standards, contracts, and internal policies. Moving a workload to AWS does not decide which requirements apply.",{"slug":687,"title":688,"focus":689,"teaser":690},"aws-compliance-controls-and-evidence-clf-c02","AWS Compliance: controls and evidence","How AWS infrastructure assurances and customer-operated controls support compliance, and how AWS reports and security guidance support different parts of an assessment.","Compliance means meeting applicable requirements and being able to demonstrate that the required controls work. A control is a safeguard or practice, such as restricting access or reviewing permissions. Using AWS provides infrastructure protections, but it does not automatically make a customer application compliant.",{"slug":692,"title":693,"focus":694,"teaser":695},"management-and-governance-policy-driven-cloud-controls-clf-c02","Management and governance: policy-driven cloud controls","How organizational requirements become preventive, detective, and corrective controls with clear ownership and evidence that they are enforced.","An organizational requirement describes an outcome the organization needs. A control is a measure used to achieve or check that outcome. For example, “protect customer records” gives a direction, but it does not tell an engineer exactly what to configure.",{"slug":697,"title":698,"focus":699,"teaser":700},"aws-config-configuration-compliance-clf-c02","AWS Config: configuration compliance","How AWS Config uses recorded resource configurations and their history to evaluate compliance with rules and provide audit evidence.","AWS Config records the configurations of supported AWS resources so you can understand their settings and how those settings change. You choose which resource types to record. Recording provides the facts that configuration checks and later audits can use.",{"slug":702,"title":703,"focus":704,"teaser":705},"aws-cloudtrail-vs-aws-config-actions-and-resource-configuration-clf-c02","AWS CloudTrail vs AWS Config: actions and resource configuration","How auditing actions with CloudTrail differs from tracking resource configuration and evaluating compliance with AWS Config.","AWS CloudTrail and AWS Config both provide evidence for auditing, but they describe different things. CloudTrail records activity: what action happened, who performed it, and when. Config records resource configuration: what settings a resource had and how those settings changed.",{"slug":707,"title":708,"focus":709,"teaser":710},"aws-control-tower-landing-zone-governance-clf-c02","AWS Control Tower: landing zone governance","How Control Tower establishes a governed multi-account environment with standardized account baselines and controls that prevent or detect departures from governance policies.","AWS Control Tower helps establish and govern a multi-account AWS environment. Separate accounts give teams and workloads their own boundaries, but configuring each account by hand can produce inconsistent security settings. Control Tower automates common setup so accounts start from an agreed foundation.",{"slug":712,"title":713,"focus":714,"teaser":715},"aws-control-tower-vs-aws-organizations-clf-c02","AWS Control Tower vs AWS Organizations","When to use Organizations for account organization and policy boundaries versus Control Tower for automated setup and governance built on Organizations.","AWS Organizations centrally manages multiple AWS accounts. A management account manages the organization, and other accounts join as member accounts. You can group accounts into organizational units (OUs), such as development and production, to manage accounts with shared policy needs together.",{"slug":717,"title":718,"focus":719,"teaser":720},"security-layered-protection-in-aws-clf-c02","Security: layered protection in AWS","How complementary AWS security controls protect confidentiality, integrity, and availability, and why encryption, access restrictions, or threat detection alone cannot secure a workload.","Security protects information and the systems that use it. Confidentiality means only authorized parties can access information. Integrity means information and configurations are protected against unauthorized changes. Availability means systems remain accessible when needed.",{"slug":722,"title":723,"focus":724,"teaser":725},"encryption-protecting-data-confidentiality-clf-c02","Encryption: protecting data confidentiality","How encryption protects stored and transmitted data from being understood without the right key, and why it does not replace access controls.","Encryption converts readable data, called plaintext, into an unreadable form called ciphertext. Its main purpose is confidentiality: keeping the contents from being understood by someone who should not read them.",{"slug":727,"title":728,"focus":729,"teaser":730},"aws-kms-keys-for-data-encryption-clf-c02","AWS KMS: keys for data encryption","How AWS services use KMS keys to protect data encryption keys for encryption at rest, distinct from TLS protection in transit.","Encryption turns readable data into unreadable data called ciphertext. Recovering the readable data requires the appropriate cryptographic key. Where the data is determines which protection you need.",{"slug":732,"title":733,"focus":734,"teaser":735},"amazon-s3-storing-objects-in-buckets-clf-c02","Amazon S3: storing objects in buckets","How buckets and object keys organize retrievable data, including security logs delivered to bucket destinations by AWS services.","Amazon S3 stores data as objects. An object contains the data itself, such as an image, a backup file, or a log file, together with metadata that describes it. Applications can store and retrieve these objects without managing storage servers.",{"slug":737,"title":738,"focus":739,"teaser":740},"amazon-cloudwatch-collecting-and-finding-logs-clf-c02","Amazon CloudWatch: collecting and finding logs","How CloudWatch Logs receives application and service logs, organizes them into log groups and streams, and makes security-related records searchable with configurable retention.","Amazon CloudWatch Logs collects and stores records from applications, operating systems, and supported AWS services. A log records something that happened, such as a failed sign-in or a rejected network connection. Keeping these records centrally helps you investigate without opening each source machine.",{"slug":742,"title":743,"focus":744,"teaser":745},"aws-cloudtrail-recording-and-finding-account-activity-clf-c02","AWS CloudTrail: recording and finding account activity","How CloudTrail records who performed AWS actions, how to find recent management events in Event history, and how trails deliver ongoing audit logs to Amazon S3.","AWS CloudTrail records AWS account activity as events. It helps answer who performed an action, what they did, when, and from where. Actions can originate from the AWS Management Console, command line tools, SDKs, or AWS services.",{"slug":747,"title":748,"focus":749,"teaser":750},"amazon-cloudwatch-and-aws-cloudtrail-monitoring-versus-auditing-clf-c02","Amazon CloudWatch and AWS CloudTrail: monitoring versus auditing","When operational monitoring calls for CloudWatch and when evidence of account activity calls for CloudTrail, including why CloudTrail records can also be delivered to CloudWatch Logs.","Amazon CloudWatch helps you understand how resources and applications are running. It collects operational data such as metrics and logs. Use it to investigate rising CPU usage, application errors, or slow responses, and to monitor conditions that need attention.",{"slug":752,"title":753,"focus":754,"teaser":755},"aws-artifact-security-and-compliance-reports-clf-c02","AWS Artifact: security and compliance reports","How to find and download AWS audit reports and certifications in Artifact, and what these documents establish about AWS compliance rather than a customer's own compliance.","AWS Artifact provides access to AWS security and compliance documents. You use these documents to understand how AWS has been assessed against particular standards and to supply evidence about AWS during your organization's compliance reviews.",{"slug":757,"title":758,"focus":759,"teaser":760},"data-residency-geographic-boundaries-for-data-clf-c02","Data Residency: geographic boundaries for data","How legal, industry, and contractual requirements determine permitted locations for data, including replicas, backups, and logs, and why choosing an AWS Region alone does not establish compliance.","Data residency describes where data resides geographically. A permitted boundary might be a country, an economic area, or an approved set of AWS Regions. The boundary comes from requirements—not simply from whichever location an engineer prefers.",{"slug":762,"title":763,"focus":764,"teaser":765},"amazon-guardduty-continuous-threat-detection-clf-c02","Amazon GuardDuty: continuous threat detection","How GuardDuty analyzes AWS activity for signs of threats and reports findings rather than blocking the activity itself.","Amazon GuardDuty is a managed threat detection service. Once enabled, it continuously analyzes supported AWS activity for signs of malicious or unauthorized behavior, helping you notice potential threats without manually reviewing every activity record.",{"slug":767,"title":768,"focus":769,"teaser":770},"amazon-inspector-automated-vulnerability-assessment-clf-c02","Amazon Inspector: automated vulnerability assessment","How Inspector continuously assesses supported workloads for software vulnerabilities and EC2 network reachability, producing prioritized findings rather than blocking traffic.","Amazon Inspector is an automated vulnerability assessment service. It helps you find security weaknesses in supported workloads so you can address them before they are exploited. A software vulnerability is a known flaw in software, such as an installed package or application dependency.",{"slug":772,"title":773,"focus":774,"teaser":775},"amazon-guardduty-and-amazon-inspector-threats-versus-vulnerabilities-clf-c02","Amazon GuardDuty and Amazon Inspector: threats versus vulnerabilities","When to use GuardDuty to detect suspicious activity versus Inspector to identify software vulnerabilities and unintended network exposure.","Amazon GuardDuty detects signs of threats by analyzing activity in your AWS environment. It helps answer, “Is something suspicious happening?” For example, communication with a known malicious destination can indicate that a resource needs investigation.",{"slug":777,"title":778,"focus":779,"teaser":780},"amazon-macie-vs-amazon-inspector-clf-c02","Amazon Macie vs Amazon Inspector","When to use Macie to discover sensitive data rather than Inspector to identify software vulnerabilities and unintended network exposure.","Amazon Macie and Amazon Inspector identify different kinds of security concerns. Choose between them by asking what you need to discover: sensitive data or workload weaknesses.",{"slug":782,"title":783,"focus":784,"teaser":785},"aws-security-hub-a-unified-view-of-security-findings-clf-c02","AWS Security Hub: a unified view of security findings","How Security Hub brings together findings from security services and Security Hub CSPM checks to provide a prioritized view of an AWS environment's security posture.","An AWS environment can have several kinds of security issues: suspicious activity, vulnerable software, and resource settings that do not meet security best practices. Reviewing each source separately makes it harder to understand the overall picture.",{"slug":787,"title":788,"focus":789,"teaser":790},"aws-security-hub-and-amazon-guardduty-security-posture-versus-threat-detection-clf-c02","AWS Security Hub and Amazon GuardDuty: security posture versus threat detection","When to use Security Hub for a consolidated security view versus GuardDuty for detecting threats from suspicious activity.","Security posture means the overall state of your security: how resources are configured and where weaknesses need attention. Use AWS Security Hub for a consolidated security view that helps you review and prioritize issues. Its security findings aggregation and configuration checks are available through Security Hub CSPM, which stands for cloud security posture management.",{"slug":792,"title":793,"focus":794,"teaser":795},"aws-shield-managed-ddos-protection-clf-c02","AWS Shield: managed DDoS protection","How Shield protects application availability from DDoS attacks, what Standard provides automatically, and what Advanced adds for protected resources.","A distributed denial of service (DDoS) attack uses traffic from many sources to overwhelm an application or its network connections. Legitimate users may see slow responses or be unable to connect. The main target is availability: whether people can use the application when they need it.",{"slug":797,"title":798,"focus":799,"teaser":800},"aws-waf-filtering-web-requests-with-web-acls-clf-c02","AWS WAF: filtering web requests with web ACLs","How web ACLs use custom and managed rules to inspect HTTP requests and allow, block, or count traffic reaching protected applications.","AWS WAF is a web application firewall. It inspects HTTP and HTTPS requests and helps filter unwanted traffic before your application handles it. It can examine request details such as a URL path or an HTTP header, rather than just a network connection.",{"slug":802,"title":803,"focus":804,"teaser":805},"aws-shield-and-aws-waf-ddos-protection-versus-request-filtering-clf-c02","AWS Shield and AWS WAF: DDoS protection versus request filtering","How Shield’s DDoS protection differs from WAF’s web request filtering and why applications may need both.","A distributed denial of service (DDoS) attack tries to make an application unavailable by overwhelming it with traffic from many sources. AWS Shield provides managed DDoS protection: its central purpose is to help keep applications available during these attacks.",{"slug":807,"title":808,"focus":809,"teaser":810},"aws-firewall-manager-vs-aws-waf-management-and-filtering-clf-c02","AWS Firewall Manager vs AWS WAF: management and filtering","When to choose Firewall Manager for centralized policy administration versus AWS WAF for filtering web requests, and why they are complementary rather than interchangeable.","AWS WAF filters web requests reaching supported AWS resources, such as an Amazon CloudFront distribution. Its rules inspect HTTP requests and determine how to handle them, including allowing or blocking them. A web ACL is the collection of rules and settings used for that protection.",{"slug":812,"title":813,"focus":814,"teaser":815},"encryption-in-transit-vs-encryption-at-rest-clf-c02","Encryption in Transit vs. Encryption at Rest","How protection for moving data differs from protection for stored data, and why neither substitutes for the other.","Encryption transforms readable data, called plaintext, into unreadable ciphertext using a cryptographic key. Decryption recovers the readable data with the necessary key. The distinction between encryption in transit and encryption at rest is when and where that protection applies.",{"slug":817,"title":818,"focus":819,"teaser":820},"encryption-in-transit-protecting-a-network-path-clf-c02","Encryption in Transit: protecting a network path","How TLS and AWS VPN protect traffic between endpoints, where their protection ends, and why private connectivity such as Direct Connect does not guarantee encryption.","Encryption in transit protects data as it travels between endpoints. An endpoint is where a protected connection starts or ends. Secure protocols help prevent people along the path from reading the data or changing it without detection.",{"slug":822,"title":823,"focus":824,"teaser":825},"encryption-at-rest-aws-storage-encryption-options-clf-c02","Encryption at Rest: AWS storage encryption options","How AWS provides server-side encryption for S3 objects, EBS volumes, and RDS databases, with service-managed or AWS KMS keys controlling decryption rather than replacing access permissions.","Encryption at rest turns stored, readable data into unreadable ciphertext. A cryptographic key is needed to recover the readable data. The protection is useful because obtaining the stored bytes alone should not reveal their contents.",{"slug":827,"title":828,"focus":829,"teaser":830},"key-management-ownership-and-control-of-encryption-keys-clf-c02","Key Management: ownership and control of encryption keys","How key ownership, custody, and permissions protect the keys used for encryption at rest and TLS connections.","Key management protects the secret values that make encryption work. It covers creating keys, storing them safely, controlling their use, and eventually retiring them. Strong encryption offers little protection if an unauthorized person can use its keys.",{"slug":832,"title":833,"focus":834,"teaser":835},"aws-certificate-manager-acm-tls-certificates-for-encryption-in-transit-clf-c02","AWS Certificate Manager (ACM): TLS certificates for encryption in transit","How ACM manages the lifecycle of TLS certificates used by AWS service endpoints to authenticate servers and protect data in transit.","Encryption in transit protects data while it travels between systems. TLS, the security protocol behind HTTPS, protects a connection against eavesdropping and undetected changes. This is different from encryption at rest, which protects stored data.",{"slug":837,"title":838,"focus":839,"teaser":840},"aws-certificate-manager-acm-vs-aws-kms-certificates-and-encryption-keys-clf-c02","AWS Certificate Manager (ACM) vs AWS KMS: certificates and encryption keys","When to choose ACM for TLS certificate management rather than AWS KMS for managing keys used in cryptographic operations.","AWS Certificate Manager (ACM) manages TLS certificates. A TLS certificate binds an identity, such as a website’s domain name, to a public key. It helps a client check which server it is connecting to when establishing an HTTPS connection.",{"slug":842,"title":843,"focus":844,"teaser":845},"aws-cloudhsm-hardware-protected-keys-and-cryptographic-operations-clf-c02","AWS CloudHSM: hardware-protected keys and cryptographic operations","How applications use keys held in dedicated, customer-controlled HSMs for cryptographic operations that support encryption at rest and in transit.","Encryption turns readable data, called plaintext, into unreadable ciphertext. A cryptographic key controls that operation. Protecting the key matters because someone who obtains it may be able to decrypt the data.",{"slug":847,"title":848,"focus":849,"teaser":850},"aws-cloudhsm-vs-aws-kms-key-control-and-management-responsibilities-clf-c02","AWS CloudHSM vs AWS KMS: key control and management responsibilities","How CloudHSM and KMS differ in HSM tenancy, customer control, operational responsibilities, and integration with AWS services.","A hardware security module (HSM) is specialized hardware that protects cryptographic keys and performs operations such as encryption and signing. Both AWS CloudHSM and AWS Key Management Service (AWS KMS) use HSMs. The difference is not hardware protection versus no hardware protection.",{"slug":852,"title":853,"focus":854,"teaser":855},"amazon-cloudwatch-monitoring-with-metrics-and-alarms-clf-c02","Amazon CloudWatch: monitoring with metrics and alarms","How CloudWatch metrics represent resource health and how threshold alarms notify operators of conditions that need attention.","Amazon CloudWatch monitors resources and applications. A metric is a series of numerical measurements over time. For example, an EC2 instance's CPUUtilization metric records how much of its CPU capacity is being used.",{"id":857,"title":858,"subtitle":152,"lessons":859},189,"Identify AWS access management capabilities",[860,865,870,875,880,885,890,895,900,905,910,915,920,925,930,935,940,945,950,955,960,965,970,975,980,985],{"slug":861,"title":862,"focus":863,"teaser":864},"aws-iam-users-groups-and-permission-policies-clf-c02","AWS IAM: users, groups, and permission policies","How policies attached to users and groups grant least-privilege access through allowed actions, resources, and explicit denies, using managed or custom policies.","AWS Identity and Access Management (IAM) controls access to AWS resources. An IAM user is an identity in an AWS account. Creating a user does not, by itself, give that user permission to use AWS resources.",{"slug":866,"title":867,"focus":868,"teaser":869},"aws-iam-protecting-the-account-root-user-clf-c02","AWS IAM: protecting the account root user","Why the root user requires special protection, which tasks require it, and how MFA, protected recovery credentials, and avoiding routine root use reduce risk.","The AWS account root user is the identity associated with the email address used to create an AWS account. It is not an IAM user. For an account with root sign-in credentials, you sign in as root using the account's root email address and password, with MFA for additional protection.",{"slug":871,"title":872,"focus":873,"teaser":874},"aws-iam-user-credentials-and-mfa-clf-c02","AWS IAM: user credentials and MFA","How passwords and access keys authenticate IAM users, how password policies and MFA protect sign-in, and how to handle credentials without exposing them.","Authentication means proving which identity is making a request. An IAM user can have a password for browser sign-in, access keys for programmatic requests, both, or neither. Successful authentication does not itself grant permission to use a resource.",{"slug":876,"title":877,"focus":878,"teaser":879},"aws-iam-roles-and-federated-access-clf-c02","AWS IAM: roles and federated access","How role trust and permission policies let trusted services, cross-account users, and federated identities obtain temporary access instead of maintaining IAM user credentials.","An IAM role is an identity with permissions that trusted identities can use temporarily. Unlike an IAM user, a role has no long-term password or access keys of its own. Assuming a role creates a role session with credentials that expire.",{"slug":881,"title":882,"focus":883,"teaser":884},"aws-sts-and-aws-iam-issuing-credentials-versus-defining-access-clf-c02","AWS STS and AWS IAM: issuing credentials versus defining access","How IAM's responsibility for identities, roles, and permissions differs from STS's responsibility for issuing temporary credentials.","AWS Identity and Access Management (IAM) manages IAM identities, including users and roles, and the policies that define their permissions. A permission describes an action that is allowed or denied on AWS resources. IAM is where you define access, such as allowing an application to read particular files in Amazon S3.",{"slug":886,"title":887,"focus":888,"teaser":889},"aws-iam-identity-center-vs-aws-identity-and-access-management-iam-clf-c02","AWS IAM Identity Center vs AWS Identity and Access Management (IAM)","When to choose IAM Identity Center for centralized workforce access rather than IAM users, and why Identity Center complements rather than replaces IAM roles and policies.","AWS IAM Identity Center provides centrally managed access for your workforce: employees and other people working for your organization. Choose it for routine human access to AWS accounts and business applications, especially when people need access across multiple accounts. Its organization instance supports AWS account access across an AWS organization.",{"slug":891,"title":892,"focus":893,"teaser":894},"authentication-verifying-identities-in-aws-clf-c02","Authentication: verifying identities in AWS","How AWS verifies human and workload identities through sign-in credentials, MFA, and temporary credentials.","Authentication verifies who is making a request. AWS authenticates both people and workloads, such as applications running on servers. Each presents credentials: evidence that AWS can validate. Use individual identities rather than shared sign-ins so activity can be tied to its source.",{"slug":896,"title":897,"focus":898,"teaser":899},"authentication-vs-access-control-clf-c02","Authentication vs. Access Control","How identity verification fits within access control, and why successful authentication does not by itself grant permission to use a resource.","Access control governs who may do what with a resource. It includes establishing a requester's identity and enforcing rules about what that requester may do. A requester can be a person or an application, not just someone signing in through a browser.",{"slug":901,"title":902,"focus":903,"teaser":904},"privileged-access-management-controlling-aws-root-access-clf-c02","Privileged Access Management: controlling AWS root access","How to recognize operations that require the AWS root user and keep this exceptional access protected and out of routine work.","Privileged Access Management (PAM) means controlling powerful access so that its use is intentional and traceable. The AWS account root user is a particularly sensitive identity because it can perform certain account-level tasks that other identities cannot.",{"slug":906,"title":907,"focus":908,"teaser":909},"least-privilege-scoping-permissions-to-the-job-clf-c02","Least privilege: scoping permissions to the job","How to match users' and groups' permissions to required actions and resources, checking managed or custom policies for unnecessary access.","Least privilege means giving an identity the permissions needed for its work, without unrelated access. It limits what mistakes or a compromised account can affect. Start by describing the work, rather than choosing a policy that sounds convenient.",{"slug":911,"title":912,"focus":913,"teaser":914},"aws-iam-identity-center-workforce-single-sign-on-clf-c02","AWS IAM Identity Center: workforce single sign-on","How workforce users sign in, optionally with MFA, and use a central access portal to reach AWS accounts and applications assigned through users, groups, and permission sets.","AWS IAM Identity Center, formerly AWS Single Sign-On, helps employees and other workforce users reach assigned AWS accounts and applications. Its AWS access portal gives them a central place to start, rather than a separate sign-in for every destination.",{"slug":916,"title":917,"focus":918,"teaser":919},"aws-directory-service-vs-aws-iam-identity-center-clf-c02","AWS Directory Service vs AWS IAM Identity Center","How providing an Active Directory differs from providing workforce single sign-on to AWS accounts and applications, and why the two services can work together.","AWS Directory Service helps provide or connect to Microsoft Active Directory, often called AD. A directory holds identities such as users and groups and supports directory features that compatible computers and applications need. AWS Managed Microsoft AD is a managed Active Directory offered through Directory Service.",{"slug":921,"title":922,"focus":923,"teaser":924},"amazon-cognito-vs-aws-iam-identity-center-clf-c02","Amazon Cognito vs AWS IAM Identity Center","When to choose Cognito for application users rather than IAM Identity Center for workforce access to AWS accounts and business applications.","Amazon Cognito helps developers add sign-up and sign-in to web and mobile applications. Choose it when people need identities for an application you build, such as a shopping app or a customer booking website. These people are application users: they use your product rather than manage its AWS infrastructure.",{"slug":926,"title":927,"focus":928,"teaser":929},"credential-management-protecting-passwords-and-access-keys-clf-c02","Credential Management: protecting passwords and access keys","How credential type determines the appropriate password controls, storage protections, and use of temporary credentials.","A credential helps prove who is making a request. An IAM user can have a console password for signing in and, separately, access keys for programmatic requests from tools or applications. An access key consists of an access key ID and a secret access key. Changing the console password does not replace or disable those keys.",{"slug":931,"title":932,"focus":933,"teaser":934},"password-policies-iam-account-password-rules-clf-c02","Password Policies: IAM account password rules","How IAM account password policies govern IAM user password strength and lifecycle, without governing root passwords, federated identities, access keys, or stored application secrets.","An IAM account password policy sets password rules for IAM users in one AWS account. An IAM user with a password can use it to sign in to the AWS Management Console. Account-wide rules give those users a shared baseline instead of leaving password requirements to each person.",{"slug":936,"title":937,"focus":938,"teaser":939},"aws-secrets-manager-secure-credential-storage-clf-c02","AWS Secrets Manager: secure credential storage","How applications retrieve encrypted credentials from Secrets Manager under IAM permissions instead of hardcoding them.","A secret is sensitive information such as a database password, an API key, or an access token. Hardcoding means putting that value directly into application code. Anyone who can read a copied source file could then obtain the credential.",{"slug":941,"title":942,"focus":943,"teaser":944},"aws-systems-manager-storing-credentials-in-parameter-store-clf-c02","AWS Systems Manager: storing credentials in Parameter Store","How Parameter Store stores and retrieves sensitive configuration using SecureString parameters, AWS KMS encryption, and IAM access controls.","Parameter Store, a capability of AWS Systems Manager, stores configuration as named values called parameters. An application can retrieve a database password by its parameter name instead of keeping the password in its source code.",{"slug":946,"title":947,"focus":948,"teaser":949},"credential-rotation-replacing-and-retiring-credentials-clf-c02","Credential Rotation: replacing and retiring credentials","How rotation coordinates replacement across the validating system, secret storage, and applications, and why password policies or storage alone do not rotate credentials.","Credential rotation replaces an authentication secret and retires the old one. It coordinates three places: the validating system that accepts the credential, the secret store holding its value, and the applications that use it. A replacement must work before a planned rotation is considered successful, and the old credential must stop working.",{"slug":951,"title":952,"focus":953,"teaser":954},"aws-secrets-manager-and-aws-systems-manager-choosing-a-credential-store-clf-c02","AWS Secrets Manager and AWS Systems Manager: choosing a credential store","When to choose Secrets Manager rather than Systems Manager Parameter Store, especially when credentials need automatic rotation.","AWS Secrets Manager and AWS Systems Manager Parameter Store can both store sensitive values securely. A password being secret does not, by itself, mean that only Secrets Manager can store it.",{"slug":956,"title":957,"focus":958,"teaser":959},"multi-factor-authentication-protecting-aws-human-sign-in-clf-c02","Multi-Factor Authentication: protecting AWS human sign-in","How distinct authentication factors protect workforce and root-user sign-ins, including where MFA must be enforced and why it does not grant permissions or automatically protect access keys.","Multi-factor authentication (MFA) requires evidence from at least two different factor categories: something you know, such as a password; something you have, such as an authenticator device; or something you are, such as a biometric. A stolen password alone is then not enough to complete authentication.",{"slug":961,"title":962,"focus":963,"teaser":964},"identity-federation-trusted-sign-in-to-aws-clf-c02","Identity Federation: trusted sign-in to AWS","How AWS trusts authentication from an external identity provider to grant role-based access without separate IAM users, while retaining control over permissions.","Identity federation lets AWS accept evidence of authentication from an external identity provider, such as a company's corporate sign-in system. Employees can use their existing identities instead of having a separate IAM user in every AWS account. Their corporate passwords do not need to be copied into AWS.",{"slug":966,"title":967,"focus":968,"teaser":969},"aws-sts-temporary-credentials-through-role-assumption-clf-c02","AWS STS: temporary credentials through role assumption","How authorized callers obtain expiring role credentials for cross-account or federated access, and where MFA conditions apply.","AWS Security Token Service (AWS STS) lets an authorized caller obtain temporary credentials for an IAM role. Assuming a role creates a role session: the caller uses that session's access instead of borrowing another person's long-term keys.",{"slug":971,"title":972,"focus":973,"teaser":974},"temporary-credentials-time-limited-aws-access-sessions-clf-c02","Temporary Credentials: time-limited AWS access sessions","How federated sign-in, IAM Identity Center, and cross-account role assumption provide expiring credentials rather than permanent access keys, with MFA strengthening authentication rather than granting permissions.","Temporary credentials let a person or application make AWS requests for a limited time. Their permissions determine what the session can do; their expiration determines how long its credentials work. Unlike long-term IAM user access keys, they expire automatically.",{"slug":976,"title":977,"focus":978,"teaser":979},"credential-management-protecting-root-user-credentials-clf-c02","Credential Management: protecting root user credentials","How restricting root credential use, avoiding root access keys, and securing sign-in and recovery channels protect an AWS account.","The AWS account root user is the account identity associated with its root email address. It has highly privileged access, including account capabilities that ordinary administrators do not have. It is not an IAM user, and attaching an IAM permissions policy is not a way to limit its permissions.",{"slug":981,"title":982,"focus":983,"teaser":984},"aws-directory-service-directory-backed-workforce-identities-clf-c02","AWS Directory Service: directory-backed workforce identities","How AWS Directory Service supplies Active Directory identities to compatible AWS workloads through a managed directory or a connection to an existing directory.","A directory holds information about an organization's users, groups, and computers. Microsoft Active Directory (AD) also provides authentication: checking that someone signing in is who they claim to be. A workforce identity represents someone such as an employee or contractor.",{"slug":986,"title":987,"focus":988,"teaser":989},"amazon-cognito-application-identities-and-federation-clf-c02","Amazon Cognito: application identities and federation","How application users sign in through user pools or external identity providers, and how identity pools exchange authenticated identities for temporary AWS credentials.","Amazon Cognito helps web and mobile applications manage their users. Authentication establishes who a user is; authorization determines what that user may do. Signing in does not, by itself, grant access to AWS resources.",{"id":991,"title":992,"subtitle":152,"lessons":993},190,"Identify components and resources for security",[994,999,1004,1009,1014,1019,1024,1029],{"slug":995,"title":996,"focus":997,"teaser":998},"amazon-vpc-security-groups-and-network-acls-clf-c02","Amazon VPC: security groups and network ACLs","How security groups and network ACLs filter VPC traffic, including their scope, allow and deny rules, and stateful versus stateless behavior.","Amazon VPC provides a logically isolated virtual network for AWS resources. Security groups and network access control lists (network ACLs) filter network traffic. Their rules describe permitted traffic using details such as protocol, port, and source or destination address.",{"slug":1000,"title":1001,"focus":1002,"teaser":1003},"aws-firewall-manager-organization-wide-security-policies-clf-c02","AWS Firewall Manager: organization-wide security policies","How Firewall Manager uses AWS Organizations to apply centrally defined security policies to in-scope accounts and resources, include new resources, and track and remediate noncompliance.","AWS Firewall Manager lets a security team define security policies centrally instead of managing each account separately. It uses AWS Organizations, which groups AWS accounts and organizes them into organizational units, or OUs.",{"slug":1005,"title":1006,"focus":1007,"teaser":1008},"aws-marketplace-procuring-third-party-offerings-clf-c02","AWS Marketplace: procuring third-party offerings","How customers find and acquire partner software and services, including security products, through subscriptions with pricing, billing, governance, and entitlement controls.","AWS Marketplace is a digital catalog for finding, buying, deploying, and managing third-party software, data, and services. Customers can search by need, compare listings, and review the seller, delivery method, pricing, and terms. Security offerings include products such as third-party firewalls and vulnerability management tools.",{"slug":1010,"title":1011,"focus":1012,"teaser":1013},"aws-security-center-finding-security-guidance-clf-c02","AWS Security Center: finding security guidance","How AWS Security Center directs learners to authoritative security information, when to follow links to more specific sources such as the Knowledge Center or Security Blog, and why the portal does not operate security controls.","AWS Security Center is a public entry point to AWS security information and resources. It helps you discover guidance about protecting cloud workloads, understanding security responsibilities, and finding more detailed material. Think of it as a guide to information, not a view into your AWS account.",{"slug":1015,"title":1016,"focus":1017,"teaser":1018},"aws-knowledge-center-finding-and-using-troubleshooting-articles-clf-c02","AWS Knowledge Center: finding and using troubleshooting articles","How to locate official troubleshooting articles and determine whether their resolution steps apply to a technical issue, including security and access errors.","AWS Knowledge Center is an official collection of articles answering recurring technical questions and explaining how to troubleshoot specific problems. It is a public information resource, not a service you deploy. You can read its public articles without purchasing a paid AWS Support plan.",{"slug":1020,"title":1021,"focus":1022,"teaser":1023},"aws-security-blog-finding-and-using-security-guidance-clf-c02","AWS Security Blog: finding and using security guidance","How to find official AWS Security Blog articles, recognize when their practical guidance is useful, and verify examples against current documentation before applying them.","The AWS Security Blog is an official AWS publication with security explanations and practical walkthroughs. It covers topics such as identity, data protection, threat detection, and incident response. It is a learning resource, not a deployed service: reading an article does not configure or protect your account.",{"slug":1025,"title":1026,"focus":1027,"teaser":1028},"aws-trusted-advisor-best-practice-checks-clf-c02","AWS Trusted Advisor: best-practice checks","How Trusted Advisor checks AWS resources for security risks and cost-saving opportunities, presents actionable recommendations, and limits check access by support plan.","AWS Trusted Advisor evaluates AWS resources against best-practice checks. A check looks for a particular condition, such as overly open network access or an underused resource, and reports opportunities to improve the environment. It helps you find issues without manually inspecting every resource yourself.",{"slug":1030,"title":1031,"focus":1032,"teaser":1033},"amazon-macie-sensitive-data-discovery-in-amazon-s3-clf-c02","Amazon Macie: sensitive data discovery in Amazon S3","How Macie identifies sensitive data in S3 objects and reports its discoveries through findings without automatically remediating them.","Amazon Macie is a managed service that discovers sensitive data in Amazon S3 objects. An object is a stored file and its metadata. Macie helps you find information such as personal identifiers and financial data so you can decide how to protect it.",{"id":1035,"title":1036,"subtitle":152,"subcategories":1037},48,"Cloud Technology and Services",[1038,1127,1176,1280,1369,1473,1622,1756],{"id":1039,"title":1040,"subtitle":152,"lessons":1041},191,"Define methods of deploying and operating in the AWS Cloud",[1042,1047,1052,1057,1062,1067,1072,1077,1082,1087,1092,1097,1102,1107,1112,1117,1122],{"slug":1043,"title":1044,"focus":1045,"teaser":1046},"aws-management-console-interactive-resource-management-clf-c02","AWS Management Console: interactive resource management","How to find service consoles and inspect or change resources through browser-based workflows in the selected AWS account and Region.","The AWS Management Console is a browser-based interface for AWS. It lets you explore services, inspect resources, and submit changes through pages and forms. It is useful for learning a service or carrying out an interactive task without writing commands or code.",{"slug":1048,"title":1049,"focus":1050,"teaser":1051},"aws-cli-operating-aws-services-from-the-terminal-clf-c02","AWS CLI: operating AWS services from the terminal","How authenticated CLI commands call AWS service APIs for direct operations and repeatable shell scripts, rather than application code or declarative infrastructure.","The AWS Command Line Interface (AWS CLI) is a tool you run in a terminal to operate AWS services. A command names a service, an operation, and any parameters. For example, aws s3api list-objects-v2 --bucket YOUR_BUCKET asks Amazon S3 to list objects in a bucket.",{"slug":1053,"title":1054,"focus":1055,"teaser":1056},"aws-cli-vs-aws-management-console-terminal-or-browser-clf-c02","AWS CLI vs AWS Management Console: terminal or browser","How command-based access and browser-based access differ in discoverability, repeatability, and suitability for everyday AWS operations.","The AWS Management Console is a browser-based interface with pages, menus, forms, and resource lists. The AWS Command Line Interface (AWS CLI) lets you request AWS operations by typing commands in a terminal. They are different ways to manage AWS resources, not separate sets of resources.",{"slug":1058,"title":1059,"focus":1060,"teaser":1061},"aws-elastic-beanstalk-deploying-code-to-managed-environments-clf-c02","AWS Elastic Beanstalk: deploying code to managed environments","How application code, a supported platform, and an environment let Elastic Beanstalk provision and operate the AWS resources an application needs.","AWS Elastic Beanstalk deploys applications and manages the AWS resources that run them. You supply application code and configuration choices instead of setting up every infrastructure resource separately.",{"slug":1063,"title":1064,"focus":1065,"teaser":1066},"aws-cloudformation-vs-aws-elastic-beanstalk-clf-c02","AWS CloudFormation vs AWS Elastic Beanstalk","When to choose template-defined infrastructure with CloudFormation rather than an application deployment platform with Elastic Beanstalk.","AWS CloudFormation and AWS Elastic Beanstalk both automate work in AWS, but they start with different things. CloudFormation starts with a description of the infrastructure you want. Elastic Beanstalk starts with an application you want to run.",{"slug":1068,"title":1069,"focus":1070,"teaser":1071},"apis-requests-to-aws-services-clf-c02","APIs: requests to AWS services","How API operations define requests, responses, and errors underlying access through the console, CLI, SDKs, and direct calls.","An application programming interface (API) is a contract for interacting with software. An AWS service exposes named operations: actions such as reading an object or describing a resource. Each operation defines the parameters it accepts, the successful response it can return, and possible errors. You can use the operation without knowing how AWS implements it internally.",{"slug":1073,"title":1074,"focus":1075,"teaser":1076},"aws-tools-and-sdks-accessing-services-from-application-code-clf-c02","AWS Tools and SDKs: accessing services from application code","How language-specific SDKs use service clients, credentials, and Regions to make AWS API calls from applications.","An AWS Software Development Kit (SDK) is a library that application code uses to call AWS services. Choose an SDK for your programming language: for example, Boto3 for Python or the AWS SDK for JavaScript. Your application calls library methods rather than building AWS API requests by hand.",{"slug":1078,"title":1079,"focus":1080,"teaser":1081},"aws-sdks-calling-services-from-application-code-clf-c02","AWS SDKs: calling services from application code","How language-specific service clients turn application calls into authenticated AWS requests and usable responses, and when this access method fits.","An AWS SDK is a library that application code uses to call AWS services. SDKs support languages including Python, Java, JavaScript, and .NET languages. Boto3 is the AWS SDK for Python.",{"slug":1083,"title":1084,"focus":1085,"teaser":1086},"apis-and-aws-sdks-interfaces-versus-client-libraries-clf-c02","APIs and AWS SDKs: interfaces versus client libraries","How a service's API contract differs from a language-specific SDK that helps applications call it.","An application programming interface (API) is a contract between software components. A service's API defines the operations callers can request, the inputs those operations accept, and the results or errors they return. The contract describes how to interact with the service without knowing how the service is built internally.",{"slug":1088,"title":1089,"focus":1090,"teaser":1091},"public-cloud-the-provider-operated-deployment-model-clf-c02","Public Cloud: the provider-operated deployment model","How customers provision resources on provider-operated infrastructure while retaining control and responsibility for their workloads.","Public cloud is a deployment model: a provider operates infrastructure and offers computing resources to a broad customer base. Customers build workloads—their applications and supporting data—using services such as virtual machines, storage, and databases. Public cloud is not one particular product or application design.",{"slug":1093,"title":1094,"focus":1095,"teaser":1096},"on-premises-infrastructure-locally-operated-workloads-clf-c02","On-Premises Infrastructure: locally operated workloads","How workloads run on infrastructure in an organization’s own facilities or leased data-center space, and what operating that infrastructure entails.","A workload is an application or computing task together with the resources it needs. In an on-premises deployment, workloads run on infrastructure in an organization’s own facilities or leased data-center space. The equipment can be owned or leased; the organization does not have to own the building.",{"slug":1098,"title":1099,"focus":1100,"teaser":1101},"public-cloud-vs-on-premises-infrastructure-who-operates-the-infrastructure-clf-c02","Public Cloud vs On-Premises Infrastructure: who operates the infrastructure","How provider-operated cloud infrastructure differs from organization-managed infrastructure, regardless of whether workloads are publicly accessible.","Infrastructure is the underlying equipment and facilities that run applications: servers, storage, networking, and the data center around them. The main distinction here is who operates that foundation.",{"slug":1103,"title":1104,"focus":1105,"teaser":1106},"hybrid-cloud-connected-workloads-across-environments-clf-c02","Hybrid Cloud: connected workloads across environments","How integrated application and data flows connect local systems with cloud resources to accommodate latency, data-handling, and migration constraints.","Hybrid cloud connects on-premises systems or a private cloud with public cloud resources so that applications and data flows work across the environments. The useful starting point is the work they share: which application needs which data, and where that work must happen.",{"slug":1108,"title":1109,"focus":1110,"teaser":1111},"hybrid-cloud-vs-public-cloud-clf-c02","Hybrid Cloud vs Public Cloud","How to distinguish a hybrid deployment that depends on integrated local systems from a cloud deployment without that dependency.","A public cloud provider supplies cloud infrastructure. A cloud-only deployment runs the relevant application and its supporting systems in that cloud, without depending on an integrated local application environment.",{"slug":1113,"title":1114,"focus":1115,"teaser":1116},"hybrid-cloud-vs-on-premises-infrastructure-clf-c02","Hybrid Cloud vs On-Premises Infrastructure","Why retaining local workloads does not make a deployment exclusively on-premises when those workloads are integrated with cloud resources.","On-premises infrastructure runs workloads in facilities an organization controls, such as its data center. An exclusively on-premises deployment keeps the relevant workloads there without integrating them with cloud resources.",{"slug":1118,"title":1119,"focus":1120,"teaser":1121},"aws-outposts-aws-infrastructure-on-premises-clf-c02","AWS Outposts: AWS infrastructure on premises","How AWS-managed hardware extends a connected AWS Region into your facility to run supported AWS services locally for latency and data residency needs.","AWS Outposts brings AWS-designed, AWS-managed hardware into your data center, colocation space, or other on-premises facility. Supported AWS services run on that hardware, close to your local applications and data.",{"slug":1123,"title":1124,"focus":1125,"teaser":1126},"aws-outposts-vs-aws-storage-gateway-hybrid-infrastructure-or-hybrid-storage-clf-c02","AWS Outposts vs AWS Storage Gateway: hybrid infrastructure or hybrid storage","When a hybrid deployment needs local AWS compute and storage through Outposts rather than access to AWS cloud storage through Storage Gateway.","A hybrid deployment connects an on-premises environment with cloud services. That description alone does not tell you what must remain local. The important distinction here is between bringing AWS infrastructure to your facility and connecting your existing infrastructure to AWS storage.",{"id":1128,"title":1129,"subtitle":152,"lessons":1130},192,"Define the AWS global infrastructure",[1131,1136,1141,1146,1151,1156,1161,1166,1171],{"slug":1132,"title":1133,"focus":1134,"teaser":1135},"aws-global-infrastructure-availability-zone-isolation-clf-c02","AWS global infrastructure: Availability Zone isolation","How physically separated Availability Zones provide failure boundaries and why a workload must span those boundaries without single-zone dependencies to remain available.","An Availability Zone consists of one or more discrete data centers within an AWS Region. Each zone has redundant power, networking, and connectivity. Zones are physically separated and designed with independent supporting infrastructure.",{"slug":1137,"title":1138,"focus":1139,"teaser":1140},"failover-transferring-work-across-availability-zones-clf-c02","Failover: transferring work across Availability Zones","How health detection and redirection to healthy redundant resources in another Availability Zone keep work running when an instance or zone fails.","Failover transfers work from an unavailable or unhealthy resource to another resource that can do the same job. For a web application, this can mean sending new requests to another application instance rather than continuing to use a failed one.",{"slug":1142,"title":1143,"focus":1144,"teaser":1145},"disaster-recovery-recovery-across-aws-regions-clf-c02","Disaster recovery: recovery across AWS Regions","Why recovery from a Region-wide disruption needs a separate Region with recoverable data and replacement infrastructure, and how this purpose differs from latency and data-sovereignty goals.","An AWS Region is a separate geographic area containing multiple Availability Zones. If a disruption affects an entire Region, moving work to another Zone within that Region is not enough. Cross-Region disaster recovery prepares a way to restore service in a separate Region.",{"slug":1147,"title":1148,"focus":1149,"teaser":1150},"aws-elastic-disaster-recovery-recovery-into-another-region-clf-c02","AWS Elastic Disaster Recovery: recovery into another Region","How continuous server replication into a recovery Region enables recovery after a source Region outage without keeping full production servers running there.","AWS Elastic Disaster Recovery, or AWS DRS, continuously copies server disk changes to a recovery location. For protection against a source Region outage, choose a different AWS Region as the recovery destination. Another Availability Zone in the source Region does not provide the same separation from a Region-wide outage.",{"slug":1152,"title":1153,"focus":1154,"teaser":1155},"caching-keeping-reusable-data-close-to-readers-clf-c02","Caching: keeping reusable data close to readers","How cache hits and misses affect access to a remote source, using edge content caches and local caches of cloud-backed files as examples.","A cache keeps reusable data closer to the people or applications reading it. Reading that copy can take less time than fetching the same data repeatedly from a remote source. The source normally remains authoritative: adding a cache does not replace it.",{"slug":1157,"title":1158,"focus":1159,"teaser":1160},"fault-isolation-availability-zone-failure-domains-clf-c02","Fault Isolation: Availability Zone failure domains","How physically separated Availability Zones limit shared infrastructure failures, and why that isolation does not automatically protect against application-wide failures.","Fault isolation limits how far a failure can spread. A failure domain is a set of resources that one event can affect together. The scope of the resulting impact is its blast radius.",{"slug":1162,"title":1163,"focus":1164,"teaser":1165},"resiliency-independent-availability-zone-failure-domains-clf-c02","Resiliency: independent Availability Zone failure domains","How Availability Zone isolation limits the impact of infrastructure failures, and why multi-zone workloads still need to avoid shared single points of failure.","Resiliency means handling disruption without unacceptable loss of service or data. One way to improve it is to spread resources across failure domains: boundaries within which one failure can affect several resources.",{"slug":1167,"title":1168,"focus":1169,"teaser":1170},"data-sovereignty-choosing-approved-regions-clf-c02","Data Sovereignty: choosing approved Regions","How jurisdictional requirements guide Region selection, including when to separate workloads across Regions and where replication and recovery copies are permitted.","Data sovereignty concerns the legal authority that applies to data and its handling. Physical location matters, but obligations can also depend on who controls the data, whose information it contains, and where people access it. Work with legal and compliance teams to establish requirements before selecting infrastructure locations.",{"slug":1172,"title":1173,"focus":1174,"teaser":1175},"backup-and-restore-vs-disaster-recovery-clf-c02","Backup and Restore vs. Disaster Recovery","Why recovering saved data is only one part of disaster recovery, which must also restore the infrastructure, applications, and dependencies needed to resume service.","Backup and restore preserves recoverable states of supported resources and uses them to recover data. Disaster recovery has a wider goal: restoring a usable service after a serious disruption. Backup and restore can be part of a disaster recovery strategy; they are not competing alternatives.",{"id":1177,"title":1178,"subtitle":152,"lessons":1179},193,"Identify AWS compute services",[1180,1185,1190,1195,1200,1205,1210,1215,1220,1225,1230,1235,1240,1245,1250,1255,1260,1265,1270,1275],{"slug":1181,"title":1182,"focus":1183,"teaser":1184},"compute-execution-models-and-aws-service-choices-clf-c02","Compute: execution models and AWS service choices","How workload execution needs and desired infrastructure control guide the choice among virtual machines, containers, functions, managed application platforms, and batch compute on AWS.","Compute is the capacity that executes application instructions, using resources such as CPU and memory. Choosing compute starts with two questions: does the application need a continuously running environment or separate executions, and how much infrastructure must you control?",{"slug":1186,"title":1187,"focus":1188,"teaser":1189},"amazon-ec2-choosing-an-instance-type-clf-c02","Amazon EC2: choosing an instance type","How instance families and sizes provide different resource balances for general-purpose, compute-intensive, memory-intensive, and storage-intensive workloads.","An Amazon EC2 instance is a virtual server. Its instance type determines its mix of processing power, memory, storage capabilities, and networking capacity. Processing power runs instructions; memory, or RAM, holds data that applications are actively using.",{"slug":1191,"title":1192,"focus":1193,"teaser":1194},"amazon-lightsail-bundled-virtual-servers-clf-c02","Amazon Lightsail: bundled virtual servers","How Lightsail combines preconfigured server blueprints and resource bundles to simplify hosting small websites and applications with predictable costs.","Amazon Lightsail simplifies hosting small websites and applications on virtual servers. A virtual server, also called an instance, gives your software computing resources without requiring you to own a physical machine. Lightsail brings common setup choices into a simplified console.",{"slug":1196,"title":1197,"focus":1198,"teaser":1199},"amazon-lightsail-and-amazon-ec2-choosing-a-virtual-server-service-clf-c02","Amazon Lightsail and Amazon EC2: choosing a virtual server service","When Lightsail's simplified, bundled approach is a better fit than EC2's greater infrastructure flexibility and configuration control.","Amazon Lightsail and Amazon EC2 both let you run applications on virtual servers in AWS. A virtual server provides computing resources without requiring you to buy physical hardware. The main choice between these services is not whether they can host an application, but how much infrastructure you want to configure.",{"slug":1201,"title":1202,"focus":1203,"teaser":1204},"aws-fargate-and-aws-lambda-containers-versus-functions-clf-c02","AWS Fargate and AWS Lambda: containers versus functions","When to choose Fargate for containerized applications rather than Lambda for function-based execution.","AWS Fargate and AWS Lambda both offer serverless compute: AWS manages the underlying servers. The main difference for this comparison is what your application runs as—a containerized application or an invoked function.",{"slug":1206,"title":1207,"focus":1208,"teaser":1209},"aws-batch-running-queued-batch-jobs-clf-c02","AWS Batch: running queued batch jobs","How AWS Batch schedules noninteractive container jobs from queues and automatically scales managed compute resources to run them.","AWS Batch manages batch computing: submitting work that runs without someone interacting with it while it executes. Examples include converting a collection of images, processing data files, and running scientific calculations.",{"slug":1211,"title":1212,"focus":1213,"teaser":1214},"aws-batch-vs-aws-lambda-batch-jobs-and-event-driven-functions-clf-c02","AWS Batch vs AWS Lambda: batch jobs and event-driven functions","When queued, resource-intensive batch workloads fit AWS Batch rather than the short-lived, event-driven function model of AWS Lambda.","AWS Batch organizes work as jobs. A batch job performs a defined task without someone interacting with it while it runs, such as calculating simulation results or processing a collection of files. Jobs enter a job queue, where they wait to be scheduled onto suitable compute resources.",{"slug":1216,"title":1217,"focus":1218,"teaser":1219},"amazon-ec2-instance-types-matching-families-to-workloads-clf-c02","Amazon EC2 instance types: matching families to workloads","How the resource balance of general-purpose, compute-optimized, memory-optimized, storage-optimized, and accelerated instance families suits different workload needs.","An Amazon EC2 instance is a virtual server. Its instance type defines its hardware resources, including CPU, memory, and storage and network capabilities. Instance families offer different resource balances: choosing a family means matching those resources to the work an application does.",{"slug":1221,"title":1222,"focus":1223,"teaser":1224},"containers-running-applications-with-orchestration-clf-c02","Containers: running applications with orchestration","How orchestration runs container images and when to choose AWS-native ECS or Kubernetes-based EKS, with EC2 or Fargate supplying compute.","A container image packages an application, its dependencies, and instructions for starting it. A container is a running instance of that image. Typical containers share their host's operating-system kernel rather than each booting a separate operating system.",{"slug":1226,"title":1227,"focus":1228,"teaser":1229},"amazon-ecs-running-containerized-applications-clf-c02","Amazon ECS: running containerized applications","How ECS uses task definitions, tasks, and services to run containerized applications in clusters backed by EC2 or AWS Fargate.","Amazon Elastic Container Service (Amazon ECS) is a managed container orchestration service. A container packages an application with the software it needs. ECS coordinates launching and stopping containers so you do not have to build your own container scheduling system.",{"slug":1231,"title":1232,"focus":1233,"teaser":1234},"amazon-eks-managed-kubernetes-clf-c02","Amazon EKS: managed Kubernetes","How EKS runs containerized applications using standard Kubernetes, with an AWS-managed control plane and a choice of worker compute.","A container packages an application with the software it needs to run. Kubernetes coordinates containerized applications: it places workloads, maintains the requested number of copies, and replaces failed workloads. Its smallest deployable unit is a Pod, which contains one or more containers.",{"slug":1236,"title":1237,"focus":1238,"teaser":1239},"aws-fargate-serverless-compute-for-containers-clf-c02","AWS Fargate: serverless compute for containers","How Fargate runs ECS tasks or EKS pods using requested compute resources while AWS manages the underlying servers.","A container packages application code with the software it needs to run. Containers still need processing power and memory on a server. AWS Fargate supplies that compute capacity without making you provision or maintain the underlying servers.",{"slug":1241,"title":1242,"focus":1243,"teaser":1244},"amazon-ecs-and-amazon-eks-choosing-an-orchestrator-clf-c02","Amazon ECS and Amazon EKS: choosing an orchestrator","When to choose ECS for AWS-native container orchestration versus EKS for Kubernetes compatibility and its ecosystem.","A container packages an application with the software it needs to run. Container orchestration coordinates running containers: placing them on available computing capacity, replacing failed containers, and adjusting how many copies run. Both Amazon ECS and Amazon EKS provide managed container orchestration.",{"slug":1246,"title":1247,"focus":1248,"teaser":1249},"amazon-ecr-and-amazon-ecs-image-storage-versus-container-orchestration-clf-c02","Amazon ECR and Amazon ECS: image storage versus container orchestration","When a container application needs ECR for image storage versus ECS for orchestrating running containers.","A container image is a packaged application and the files it needs to run. A container is a running instance of an image. Keeping the package available and managing running instances are different jobs.",{"slug":1251,"title":1252,"focus":1253,"teaser":1254},"amazon-ecr-container-image-repositories-clf-c02","Amazon ECR: container image repositories","How ECR repositories store container images that developers push and container workloads pull for deployment.","A container image packages application code and the files it needs to run. A running container is created from an image. Amazon Elastic Container Registry (Amazon ECR) stores and shares these images without requiring you to operate your own registry infrastructure.",{"slug":1256,"title":1257,"focus":1258,"teaser":1259},"serverless-choosing-a-compute-execution-model-clf-c02","Serverless: choosing a compute execution model","How provider-managed infrastructure supports short event-driven functions with Lambda or container workloads with Fargate, and how execution limits, scaling, costs, and customer responsibilities affect the choice.","Serverless means the cloud provider operates the servers that run your application. Servers still exist, but AWS handles provisioning, maintaining, and replacing the underlying hosts. You work with resources such as functions or container tasks instead of administering individual machines.",{"slug":1261,"title":1262,"focus":1263,"teaser":1264},"horizontal-scaling-sharing-work-across-instances-clf-c02","Horizontal Scaling: sharing work across instances","How adding or removing parallel instances changes capacity when requests or jobs can be distributed across them.","Horizontal scaling changes the number of instances doing the same kind of work. An instance is one running copy of the application or worker. Adding instances is scaling out; removing them is scaling in. The instances work in parallel rather than sending every task through one instance after another.",{"slug":1266,"title":1267,"focus":1268,"teaser":1269},"amazon-ec2-auto-scaling-vs-aws-auto-scaling-clf-c02","Amazon EC2 Auto Scaling vs AWS Auto Scaling","How EC2 instance group scaling differs from the scaling plans AWS Auto Scaling provides across supported resource types.","Amazon EC2 Auto Scaling manages groups of EC2 instances. An Auto Scaling group treats those instances as one unit, allowing the service to launch or terminate instances as capacity needs change.",{"slug":1271,"title":1272,"focus":1273,"teaser":1274},"load-balancing-distributing-traffic-to-healthy-targets-clf-c02","Load Balancing: distributing traffic to healthy targets","How a shared endpoint distributes incoming traffic across healthy application targets to spread demand and support availability without adding capacity itself.","A load balancer receives incoming application traffic at a shared endpoint and distributes it across application resources called targets. Clients use that endpoint instead of choosing an individual server.",{"slug":1276,"title":1277,"focus":1278,"teaser":1279},"content-delivery-network-and-load-balancing-offloading-versus-distributing-requests-clf-c02","Content Delivery Network and Load Balancing: offloading versus distributing requests","Why reusing cached content and distributing requests among healthy application targets solve different problems and complement each other.","A busy website faces two different problems: repeated requests for the same content, and application work that several servers must share. A content delivery network (CDN) and a load balancer address these different problems.",{"id":1281,"title":1282,"subtitle":152,"lessons":1283},194,"Identify AWS database services",[1284,1289,1294,1299,1304,1309,1314,1319,1324,1329,1334,1339,1344,1349,1354,1359,1364],{"slug":1285,"title":1286,"focus":1287,"teaser":1288},"database-matching-data-models-to-aws-services-clf-c02","Database: matching data models to AWS services","How application access patterns guide the choice of a database model and its AWS service, including when a cache or data warehouse is appropriate.","A database organizes information so an application can retrieve and change it reliably. Start the choice with its access patterns: which records it reads, how it finds them, and which changes must happen together. Storing customer information does not, by itself, tell you which database to choose.",{"slug":1290,"title":1291,"focus":1292,"teaser":1293},"amazon-aurora-a-managed-relational-database-engine-clf-c02","Amazon Aurora: a managed relational database engine","How Aurora supports relational applications using SQL, related tables, and MySQL or PostgreSQL compatibility while AWS manages the database infrastructure.","Amazon Aurora is a managed relational database engine: software that stores organized data and processes requests for it. Relational applications store data in tables, with rows for individual records and columns for their attributes. For example, a Customers table might contain a customer ID and name for each customer.",{"slug":1295,"title":1296,"focus":1297,"teaser":1298},"amazon-aurora-and-amazon-rds-engine-versus-service-clf-c02","Amazon Aurora and Amazon RDS: engine versus service","How Aurora fits within Amazon RDS and how choosing Aurora differs from choosing the standard MySQL or PostgreSQL engines available through RDS.","Amazon RDS is a managed service for running relational databases. A database engine is the software that stores the data and processes database queries. Choosing the service and choosing the engine are related decisions, but they are not the same decision.",{"slug":1300,"title":1301,"focus":1302,"teaser":1303},"amazon-dynamodb-key-value-and-document-data-clf-c02","Amazon DynamoDB: key-value and document data","How DynamoDB organizes flexible data into tables, items, attributes, and keys for fast access in a fully managed NoSQL database.","Amazon DynamoDB is a fully managed NoSQL database for key-value and document data. AWS operates the database infrastructure, including server maintenance, software patching, and data replication. You still choose how to organize your data and how your application accesses it.",{"slug":1305,"title":1306,"focus":1307,"teaser":1308},"amazon-documentdb-and-amazon-dynamodb-choosing-a-nosql-database-clf-c02","Amazon DocumentDB and Amazon DynamoDB: choosing a NoSQL database","When MongoDB compatibility and document-query needs favor DocumentDB over DynamoDB's key-value and document access patterns.","Amazon DocumentDB and Amazon DynamoDB are managed NoSQL databases. Both can store flexible, nested data, such as a product with a list of sizes and a set of specifications. Seeing document-shaped data is not enough to choose between them.",{"slug":1310,"title":1311,"focus":1312,"teaser":1313},"amazon-elasticache-in-memory-caching-clf-c02","Amazon ElastiCache: in-memory caching","How ElastiCache keeps frequently accessed data in memory to reduce application latency and database load, using managed Valkey, Redis OSS, or Memcached engines.","Amazon ElastiCache is a fully managed, in-memory caching service. A cache holds data that an application can reuse, such as a frequently requested product description. Keeping that data in memory helps reduce latency, the time an application waits for a response.",{"slug":1315,"title":1316,"focus":1317,"teaser":1318},"amazon-neptune-graph-data-and-relationships-clf-c02","Amazon Neptune: graph data and relationships","How Neptune represents connected data as graphs and uses relationship traversal to support applications such as recommendations, fraud detection, and knowledge graphs.","Amazon Neptune is a fully managed graph database service. A graph represents things and the relationships between them, making connections part of the stored data. AWS manages the underlying database infrastructure so developers can focus on their data and applications.",{"slug":1320,"title":1321,"focus":1322,"teaser":1323},"heterogeneous-migration-vs-homogeneous-migration-clf-c02","Heterogeneous Migration vs Homogeneous Migration","How a change of database engine distinguishes heterogeneous from homogeneous migration, regardless of changes in hosting location.","A database migration moves a database from a source, where it starts, to a target, where it will be used. The database engine is the software that stores, manages, and queries the data. PostgreSQL, MySQL, and Oracle Database are examples of database engines.",{"slug":1325,"title":1326,"focus":1327,"teaser":1328},"homogeneous-migration-moving-databases-within-the-same-engine-clf-c02","Homogeneous Migration: moving databases within the same engine","How retaining the database engine simplifies a move to AWS, while still requiring compatibility checks, data validation, and a controlled cutover.","A homogeneous migration moves a database while keeping the same database engine. For example, moving a self-managed PostgreSQL database to Amazon RDS for PostgreSQL retains PostgreSQL. The hosting location, operating environment, and database version can change without changing this classification.",{"slug":1330,"title":1331,"focus":1332,"teaser":1333},"heterogeneous-migration-compatibility-across-database-engines-clf-c02","Heterogeneous Migration: compatibility across database engines","Why moving to a different database engine requires schema and application compatibility checks, and how AWS SCT supports schema conversion while AWS DMS moves data.","A heterogeneous migration moves a database to a different database engine, such as Oracle to PostgreSQL. The new engine may store the same business information but use different rules for defining it and working with it. Copying rows is therefore not enough.",{"slug":1335,"title":1336,"focus":1337,"teaser":1338},"relational-data-model-tables-and-relationships-clf-c02","Relational Data Model: tables and relationships","How typed columns, rows, and keys organize related records, and how this model identifies Amazon RDS and Amazon Aurora as relational database services.","The relational data model organizes information into tables, such as Customers and Orders. It describes how information is structured, independently of the servers or storage running the database. A table's defined structure is called its schema.",{"slug":1340,"title":1341,"focus":1342,"teaser":1343},"key-value-data-model-records-accessed-by-key-clf-c02","Key-Value Data Model: records accessed by key","How unique keys identify values for reading, writing, and deleting records, why this suits sessions and shopping carts, and how Amazon DynamoDB supports this NoSQL model.","The key-value data model stores records as associations between keys and values. A key identifies one record within a collection; its value contains the application data. For example, cart:customer-482 could identify a value containing product identifiers and quantities. The application uses the key to find that particular cart.",{"slug":1345,"title":1346,"focus":1347,"teaser":1348},"document-data-model-flexible-document-records-clf-c02","Document Data Model: flexible document records","How documents organize related information into named fields, nested objects, and arrays, with flexible structures supported by databases such as Amazon DynamoDB and Amazon DocumentDB.","A document is a record containing named fields and their values. In {\"productId\":\"P1\",\"name\":\"Shirt\",\"price\":25}, the field name holds text and price holds a number. Documents can also contain true-or-false values.",{"slug":1350,"title":1351,"focus":1352,"teaser":1353},"document-data-model-vs-key-value-data-model-clf-c02","Document Data Model vs Key-Value Data Model","How document models expose record fields for database operations while key-value models center on retrieving values by key, and why DynamoDB supports both models.","A data model describes how a database represents information and lets applications work with it. The key-value and document models differ mainly in what database operations focus on—not simply in how the stored data looks.",{"slug":1355,"title":1356,"focus":1357,"teaser":1358},"amazon-documentdb-the-document-database-model-clf-c02","Amazon DocumentDB: the document database model","How DocumentDB stores and queries flexible, nested documents through MongoDB-compatible APIs, and which application needs this model suits.","Amazon DocumentDB is a managed NoSQL document database. Instead of requiring every record to fit the same set of table columns, it stores records as JSON-like documents. A collection holds documents, such as the products in a catalog.",{"slug":1360,"title":1361,"focus":1362,"teaser":1363},"graph-data-model-modeling-connected-data-clf-c02","Graph Data Model: modeling connected data","How nodes and edges support relationship traversal, and why connection-heavy workloads fit graph databases such as Amazon Neptune within the NoSQL family.","A graph data model represents entities as nodes, also called vertices, and relationships as edges. A person, a product, or an account can be a node. An edge connects two nodes and describes how they are related.",{"slug":1365,"title":1366,"focus":1367,"teaser":1368},"in-memory-caching-reusable-data-in-ram-clf-c02","In-Memory Caching: reusable data in RAM","How keeping reusable copies in RAM reduces database work through cache hits and misses, why a cache usually does not replace the authoritative database, and where Amazon ElastiCache fits.","An in-memory cache keeps reusable data in RAM, the computer's working memory. For example, an application can reuse a cached product description instead of asking its database for the same description on every request. This can reduce response time and database work.",{"id":1370,"title":1371,"subtitle":152,"lessons":1372},195,"Identify AWS network services",[1373,1378,1383,1388,1393,1398,1403,1408,1413,1418,1423,1428,1433,1438,1443,1448,1453,1458,1463,1468],{"slug":1374,"title":1375,"focus":1376,"teaser":1377},"amazon-vpc-subnets-and-routing-clf-c02","Amazon VPC: subnets and routing","How IP address ranges, Availability Zone–scoped subnets, route tables, and gateways define a VPC's network layout and public or private connectivity.","Amazon VPC gives you a logically isolated virtual network in an AWS Region. You choose its IP address ranges and divide those ranges into subnets, where resources such as EC2 instances receive private IP addresses.",{"slug":1379,"title":1380,"focus":1381,"teaser":1382},"amazon-route-53-connecting-domain-names-to-applications-clf-c02","Amazon Route 53: connecting domain names to applications","How Route 53 uses hosted zones and DNS records to resolve domain names to application endpoints inside or outside AWS.","Amazon Route 53 is a managed Domain Name System (DNS) service. DNS helps software turn a readable domain name, such as www.example.com, into information it can use to reach an application. People can keep using the same name even when the application's address changes.",{"slug":1384,"title":1385,"focus":1386,"teaser":1387},"networking-connectivity-and-content-delivery-service-roles-along-a-request-path-clf-c02","Networking, connectivity, and content delivery: service roles along a request path","How Amazon VPC, AWS PrivateLink, Amazon Route 53, Amazon CloudFront, and AWS Global Accelerator provide distinct capabilities for reaching applications.","Amazon VPC provides a logically isolated virtual network for AWS resources. You choose IP address ranges, organize resources into subnets, and configure routes and network security controls. A VPC belongs to one AWS Region and can contain subnets in multiple Availability Zones.",{"slug":1389,"title":1390,"focus":1391,"teaser":1392},"content-delivery-network-cache-reuse-and-freshness-clf-c02","Content Delivery Network: cache reuse and freshness","How cache eligibility and expiration determine whether requests reuse an edge response or require an origin fetch.","A content delivery network (CDN) keeps copies of responses at distributed edge locations. When an edge can reuse a stored response, it answers without fetching that content from its original source, the origin. This can shorten delivery time and reduce repeated origin work.",{"slug":1394,"title":1395,"focus":1396,"teaser":1397},"aws-privatelink-private-access-to-services-clf-c02","AWS PrivateLink: private access to services","How interface VPC endpoints provide private access to supported AWS services, partner services, and applications in other VPCs without using the public internet.","AWS PrivateLink provides private connectivity to supported services without sending traffic over the public internet. An application in your virtual private cloud (VPC) can use a service without needing a public IP address or an internet gateway for that connection.",{"slug":1399,"title":1400,"focus":1401,"teaser":1402},"ip-routing-subnet-route-tables-clf-c02","IP Routing: subnet route tables","How a subnet’s route table selects where traffic goes, including local VPC paths and gateway paths for internet access.","A route table tells AWS where to send traffic leaving a subnet. Each route pairs a destination, an IP address range, with a target, such as a gateway. AWS compares the packet’s destination IP address with these ranges to choose a path.",{"slug":1404,"title":1405,"focus":1406,"teaser":1407},"network-address-translation-outbound-ipv4-connectivity-clf-c02","Network Address Translation: outbound IPv4 connectivity","How a NAT gateway uses source-address and port mappings to give private workloads outbound IPv4 connectivity and return responses to the originating workload.","A private application may need to download updates from an internet server. Network Address Translation (NAT) lets it make that outbound IPv4 connection without giving the application its own public IPv4 address.",{"slug":1409,"title":1410,"focus":1411,"teaser":1412},"ip-addressing-vs-ip-routing-clf-c02","IP Addressing vs IP Routing","Why address assignment identifies endpoints while routes determine traffic paths, so an address alone does not establish internet reachability or make a subnet public.","IP addressing gives a network interface an address that identifies a network endpoint. For example, an EC2 instance's interface might have the private IPv4 address 10.20.1.15. Packets carry source and destination addresses: where they came from and where they are going.",{"slug":1414,"title":1415,"focus":1416,"teaser":1417},"network-address-translation-vs-ip-routing-clf-c02","Network Address Translation vs IP Routing","Why routing selects a traffic path while NAT changes packet addresses, and why a route alone does not provide address translation.","An IP packet carries a source address, identifying its sender, and a destination address, identifying its intended receiver. IP routing examines the destination and selects where to forward the packet next. A route describes a destination range and a forwarding target.",{"slug":1419,"title":1420,"focus":1421,"teaser":1422},"stateful-and-stateless-filtering-connection-memory-and-return-traffic-clf-c02","Stateful and Stateless Filtering: connection memory and return traffic","How connection tracking changes return-traffic rules, illustrated by security groups at network interfaces and stateless network ACLs at subnet boundaries that must both permit an exchange.","A network filter decides whether traffic may pass. Stateless filtering checks each packet independently, using information such as addresses, protocol, and ports. A reply must match a rule just as the original request must.",{"slug":1424,"title":1425,"focus":1426,"teaser":1427},"network-segmentation-workload-boundaries-in-a-vpc-clf-c02","Network Segmentation: workload boundaries in a VPC","How subnets, route tables, gateways, and traffic filtering work together to separate workloads and permit only required connections.","Network segmentation separates workloads so that each can reach only what it needs. For example, internet users may need a web server, while only that web server needs the database. These boundaries help limit how far a compromised workload can reach.",{"slug":1429,"title":1430,"focus":1431,"teaser":1432},"vulnerability-assessment-identifying-weaknesses-in-vpc-workloads-clf-c02","Vulnerability Assessment: identifying weaknesses in VPC workloads","How assessments such as Amazon Inspector identify workload weaknesses that VPC traffic controls do not detect or remove.","A vulnerability is a weakness that could be exploited. For example, a web server running on an Amazon EC2 instance might use a software package with a known security flaw. Vulnerability assessment examines workloads for weaknesses and reports evidence that helps you address them.",{"slug":1434,"title":1435,"focus":1436,"teaser":1437},"dns-resolving-names-to-resource-endpoints-clf-c02","DNS: resolving names to resource endpoints","How DNS resolves stable hostnames to resource endpoints, with Amazon Route 53 publishing authoritative answers rather than serving application traffic.","DNS, the Domain Name System, helps clients find resources by name. In https:\u002F\u002Fapp.example.com\u002Forders, DNS resolves the hostname, app.example.com. It does not interpret the HTTPS scheme or the \u002Forders path.",{"slug":1439,"title":1440,"focus":1441,"teaser":1442},"virtual-private-networks-logical-tunnels-over-existing-networks-clf-c02","Virtual Private Networks: logical tunnels over existing networks","How VPN tunnels encapsulate private-network traffic over an underlying network without requiring a dedicated physical circuit or guaranteeing bandwidth.","A virtual private network (VPN) creates a logical connection across an existing network. The connection is called a tunnel: it lets private-network traffic cross another network without requiring a new, dedicated physical circuit between the endpoints.",{"slug":1444,"title":1445,"focus":1446,"teaser":1447},"aws-site-to-site-vpn-connecting-networks-with-encrypted-tunnels-clf-c02","AWS Site-to-Site VPN: connecting networks with encrypted tunnels","How IPsec tunnels connect an on-premises network to AWS through customer and AWS-side gateways, with two tunnels providing redundancy.","AWS Site-to-Site VPN connects an on-premises network, such as an office or data center, to a network in AWS. An Amazon VPC is a logically isolated network in AWS where you can run resources.",{"slug":1449,"title":1450,"focus":1451,"teaser":1452},"aws-client-vpn-secure-remote-access-clf-c02","AWS Client VPN: secure remote access","How a user's VPN client connects through a managed Client VPN endpoint to reach private AWS resources and connected on-premises networks.","AWS Client VPN gives remote users secure network access from their devices. A VPN client establishes an encrypted tunnel over the internet to a managed Client VPN endpoint. AWS operates the VPN service infrastructure; you configure who can connect and what they can reach.",{"slug":1454,"title":1455,"focus":1456,"teaser":1457},"aws-client-vpn-vs-aws-site-to-site-vpn-clf-c02","AWS Client VPN vs AWS Site-to-Site VPN","How remote access for individual devices differs from VPN connectivity between entire networks, and when each service is appropriate.","A virtual private network (VPN) carries traffic through an encrypted connection. AWS Client VPN and AWS Site-to-Site VPN both provide VPN connectivity, but they connect different things.",{"slug":1459,"title":1460,"focus":1461,"teaser":1462},"aws-direct-connect-dedicated-connectivity-to-aws-clf-c02","AWS Direct Connect: dedicated connectivity to AWS","How dedicated and hosted connections through Direct Connect locations provide a consistent network path to AWS outside the public internet, without encrypting traffic by default.","AWS Direct Connect connects an organization's network to AWS without sending that traffic over the public internet. Avoiding the changing conditions of internet routes can provide a more consistent network experience, though it does not guarantee a particular application speed.",{"slug":1464,"title":1465,"focus":1466,"teaser":1467},"aws-direct-connect-vs-aws-site-to-site-vpn-clf-c02","AWS Direct Connect vs AWS Site-to-Site VPN","How the two services differ in network path, encryption, setup time, and performance consistency, and when to choose each.","AWS Direct Connect and AWS Site-to-Site VPN both connect an organization's network, such as a data center or office, to AWS. Their main difference is the network path that carries the traffic.",{"slug":1469,"title":1470,"focus":1471,"teaser":1472},"aws-transit-gateway-a-central-hub-for-connected-networks-clf-c02","AWS Transit Gateway: a central hub for connected networks","How Transit Gateway routes traffic among VPCs and on-premises networks through attachments, using Site-to-Site VPN or a Direct Connect gateway for hybrid connectivity.","AWS Transit Gateway is a managed network routing hub. It connects VPCs, which are isolated networks in AWS, and on-premises networks, such as an office or data center. This is called a hub-and-spoke design: each network connects to the hub instead of needing a separate connection to every other network.",{"id":1474,"title":1475,"subtitle":152,"lessons":1476},196,"Identify AWS storage services",[1477,1482,1487,1492,1497,1502,1507,1512,1517,1522,1527,1532,1537,1542,1547,1552,1557,1562,1567,1572,1577,1582,1587,1592,1597,1602,1607,1612,1617],{"slug":1478,"title":1479,"focus":1480,"teaser":1481},"storage-object-block-and-file-models-clf-c02","Storage: object, block, and file models","How data access requirements determine the storage model, its AWS service, and when hybrid access through Storage Gateway is useful.","A storage model describes how an application sees and accesses data. Object storage stores data as objects, each identified by a key within a bucket. Applications use API requests to store and retrieve them. Amazon S3 provides object storage for data such as images, logs, and backups; it does not present a disk to an operating system.",{"slug":1483,"title":1484,"focus":1485,"teaser":1486},"amazon-s3-storage-classes-clf-c02","Amazon S3: storage classes","How access frequency, retrieval speed, resilience, and storage and retrieval charges distinguish S3 storage classes.","An S3 storage class determines how an object is stored and charged for. Classes differ in access frequency, retrieval speed, resilience to failures, and cost. A lower storage price does not always mean a lower total bill.",{"slug":1488,"title":1489,"focus":1490,"teaser":1491},"amazon-s3-glacier-vs-amazon-s3-archival-classes-and-the-storage-service-clf-c02","Amazon S3 Glacier vs. Amazon S3: archival classes and the storage service","Why S3 Glacier names an archival storage-class family within Amazon S3 rather than a separate alternative to the S3 object storage service.","Amazon S3 is an object storage service. It stores data as objects in buckets. A storage class is a choice within that service that determines how an object is stored, with associated access behavior and charges.",{"slug":1493,"title":1494,"focus":1495,"teaser":1496},"amazon-s3-lifecycle-rules-clf-c02","Amazon S3: lifecycle rules","How lifecycle rules automatically transition or expire selected objects as they age.","S3 Lifecycle rules tell Amazon S3 how to manage objects as they age. For example, you can keep recent logs readily available, move older logs to an archival storage class, and remove logs you no longer need. S3 performs the configured actions automatically, without you handling each object.",{"slug":1498,"title":1499,"focus":1500,"teaser":1501},"amazon-ebs-persistent-block-storage-volumes-clf-c02","Amazon EBS: persistent block storage volumes","How EBS volumes provide durable block storage for EC2 instances, including Availability Zone attachment boundaries and persistence across instance stops and starts.","Amazon Elastic Block Store (Amazon EBS) provides volumes that an EC2 instance uses like disks. With block storage, the operating system reads and writes blocks of data. It can organize those blocks into a file system to store operating-system files, application files, or database data.",{"slug":1503,"title":1504,"focus":1505,"teaser":1506},"amazon-s3-and-amazon-ebs-object-versus-block-storage-clf-c02","Amazon S3 and Amazon EBS: object versus block storage","Why independently accessed objects in S3 differ from EBS disk volumes in workload suitability and how storage capacity is billed.","Amazon S3 provides object storage. An object holds data, such as a photo or backup file, along with information describing it. Applications send requests to S3 to store or retrieve individual objects. Each object can be accessed independently; an application does not need an attached disk to retrieve it.",{"slug":1508,"title":1509,"focus":1510,"teaser":1511},"amazon-ebs-and-amazon-ec2-instance-store-persistent-versus-temporary-storage-clf-c02","Amazon EBS and Amazon EC2 instance store: persistent versus temporary storage","How EBS and EC2 instance store differ in data persistence and attachment flexibility, and when each is appropriate.","An Amazon EC2 instance is a virtual server. Both Amazon Elastic Block Store (Amazon EBS) and EC2 instance store provide block storage: storage that the operating system can use like a disk. The important difference is whether that storage exists independently of the instance.",{"slug":1513,"title":1514,"focus":1515,"teaser":1516},"amazon-efs-elastic-shared-file-storage-clf-c02","Amazon EFS: elastic shared file storage","How EFS provides an automatically growing and shrinking NFS file system that multiple Linux clients can mount and share.","Amazon Elastic File System (Amazon EFS) is managed file storage for Linux workloads. It stores files in directories, giving applications a familiar way to organize and use data. AWS manages the storage infrastructure behind the file system.",{"slug":1518,"title":1519,"focus":1520,"teaser":1521},"amazon-fsx-managed-file-system-families-clf-c02","Amazon FSx: managed file system families","How FSx provides managed shared storage using Windows File Server, Lustre, OpenZFS, and NetApp ONTAP, and which application needs each family serves.","Amazon FSx provides fully managed file systems: storage organized as files and folders that applications access over a network. Multiple clients can use the same file system, subject to its permissions. This is shared file storage, rather than a separate copy of the files on every application server.",{"slug":1523,"title":1524,"focus":1525,"teaser":1526},"amazon-efs-and-amazon-fsx-choosing-a-file-service-clf-c02","Amazon EFS and Amazon FSx: choosing a file service","When to choose EFS for elastic shared Linux file storage rather than an FSx offering for a specific file system or protocol.","Shared file storage lets several computers work with files and folders in the same file system. Both Amazon EFS and Amazon FSx provide managed file storage: AWS operates the underlying storage infrastructure, rather than requiring you to run your own file servers.",{"slug":1528,"title":1529,"focus":1530,"teaser":1531},"aws-storage-gateway-local-caching-with-s3-file-gateway-clf-c02","AWS Storage Gateway: local caching with S3 File Gateway","How S3 File Gateway presents S3-backed NFS or SMB file shares, caches frequently accessed data locally, and uploads file changes asynchronously.","Amazon S3 File Gateway is a type of AWS Storage Gateway that presents file shares backed by Amazon S3. Applications access a share using NFS or SMB, familiar network file-sharing protocols. Each share uses one of these protocols.",{"slug":1533,"title":1534,"focus":1535,"teaser":1536},"aws-storage-gateway-and-amazon-s3-cached-file-access-versus-object-storage-clf-c02","AWS Storage Gateway and Amazon S3: cached file access versus object storage","When applications need Storage Gateway's locally cached file interface rather than direct access to Amazon S3 object storage.","Amazon S3 is object storage. An application can store and retrieve objects directly using the S3 API, often through an AWS software development kit. S3 itself does not present a traditional network file share.",{"slug":1538,"title":1539,"focus":1540,"teaser":1541},"object-storage-how-objects-fit-application-workloads-clf-c02","Object Storage: how objects fit application workloads","How storing and accessing whole objects by key makes object storage suitable for media, backups, logs, and data lakes rather than live disks or shared file systems.","Object storage stores data as separate objects. Each object has the data itself, metadata describing it, and a key that identifies it within a bucket. Amazon S3 is an AWS object storage service; an S3 bucket holds objects.",{"slug":1543,"title":1544,"focus":1545,"teaser":1546},"data-archiving-object-storage-for-long-term-retention-clf-c02","Data Archiving: object storage for long-term retention","How object storage preserves inactive data for later reference, with archival tier choices balancing retention needs, storage costs, and retrieval delays.","Data archiving preserves information that is no longer needed for everyday work but still has value or must be retained. Completed project files, historical logs, financial statements, and original media files are common examples. Inactive does not mean disposable.",{"slug":1548,"title":1549,"focus":1550,"teaser":1551},"data-lakes-object-storage-as-an-analytics-foundation-clf-c02","Data Lakes: object storage as an analytics foundation","How data lakes use object storage such as Amazon S3 to retain raw and prepared datasets for reuse by separate analytics engines.","A data lake retains diverse datasets for analysis without requiring everything to fit one relational model before it arrives. It can hold database exports, JSON events, documents, images, and audio. Amazon S3 is a common storage foundation: it stores data as objects in buckets, with each object identified by a key.",{"slug":1553,"title":1554,"focus":1555,"teaser":1556},"data-durability-protection-across-s3-storage-classes-clf-c02","Data Durability: protection across S3 storage classes","How durability targets and failure-domain coverage explain why S3 storage classes can offer similar data preservation but different protection against an Availability Zone's loss.","Data durability answers, “Will the data still exist when it is needed?” It concerns permanent data loss. Availability answers a different question: “Can I access the data now?” A temporary interruption can make data unavailable without destroying it.",{"slug":1558,"title":1559,"focus":1560,"teaser":1561},"retrieval-latency-instant-access-and-archive-restoration-clf-c02","Retrieval Latency: instant access and archive restoration","How acceptable waiting time determines storage-class choices, distinguishing millisecond reads from archive restoration delays in Amazon S3.","Retrieval latency is the wait between requesting stored data and that data becoming available to read. When choosing storage, start with a simple question: how long can the person or application wait?",{"slug":1563,"title":1564,"focus":1565,"teaser":1566},"amazon-s3-glacier-archive-storage-classes-clf-c02","Amazon S3 Glacier: archive storage classes","How Instant Retrieval, Flexible Retrieval, and Deep Archive differ in access latency, restoration requirements, retrieval costs, and minimum storage duration.","S3 Glacier Instant Retrieval, S3 Glacier Flexible Retrieval, and S3 Glacier Deep Archive store rarely accessed data. Their main difference is how quickly that data becomes available when you need it. Instant Retrieval provides millisecond access: you can read an object directly without restoring it first.",{"slug":1568,"title":1569,"focus":1570,"teaser":1571},"storage-choosing-cost-effective-tiers-clf-c02","Storage: choosing cost-effective tiers","How capacity billing and access patterns determine total storage cost, using S3 classes to explain retrieval speed, resilience, retrieval charges, and minimum storage durations.","An Amazon S3 storage class is a choice of storage pricing and access characteristics for an object. S3 generally bills for the data you store, rather than an empty capacity reservation. However, some classes have minimum billable object sizes, so very small objects can be billed as larger ones.",{"slug":1573,"title":1574,"focus":1575,"teaser":1576},"block-storage-cloud-disks-and-their-lifecycles-clf-c02","Block Storage: cloud disks and their lifecycles","How applications use block devices as disks, and why Amazon EBS volumes and EC2 instance store have different data-retention guarantees.","Block storage exposes numbered chunks of storage called blocks. The operating system sees a block device, much like a disk. It can read and overwrite particular blocks without replacing the entire disk.",{"slug":1578,"title":1579,"focus":1580,"teaser":1581},"amazon-ec2-instance-storage-clf-c02","Amazon EC2: instance storage","How EBS volumes and instance store provide block storage with different persistence and instance-lifecycle behavior.","An Amazon EC2 instance is a virtual server. It can use block storage: storage presented to its operating system as a disk made of addressable blocks. The operating system can put a file system on that disk to store files, just as it would on a physical server.",{"slug":1583,"title":1584,"focus":1585,"teaser":1586},"ephemeral-storage-ec2-instance-store-and-data-lifetime-clf-c02","Ephemeral Storage: EC2 instance store and data lifetime","How instance store's data lifetime differs from EBS—surviving reboots but not stops or termination—and makes it suitable for disposable working data.","Ephemeral storage is storage whose data should be treated as expendable. The key question is not what kind of disk it uses, but which events cause its data to disappear.",{"slug":1588,"title":1589,"focus":1590,"teaser":1591},"shared-file-systems-network-file-access-and-managed-services-clf-c02","Shared File Systems: network file access and managed services","How multiple servers access the same files through NFS or SMB, and how workload filesystem requirements distinguish Amazon EFS from the Amazon FSx family.","A shared file system gives several servers access to the same files and directories over a network. A server mounts the filesystem or connects to a share, then applications use file paths to open, read, and write files. NFS is common with Linux and Unix; SMB is common with Windows.",{"slug":1593,"title":1594,"focus":1595,"teaser":1596},"hybrid-cloud-storage-cloud-backed-file-access-clf-c02","Hybrid Cloud Storage: cloud-backed file access","How a gateway combines local file access and caching with cloud storage, using AWS Storage Gateway as an example, and why uncached reads and pending uploads depend on connectivity.","Hybrid cloud storage coordinates storage in an organization’s local environment with storage in a public cloud. A storage gateway connects the two: applications use a familiar file share, while the gateway handles cloud storage access.",{"slug":1598,"title":1599,"focus":1600,"teaser":1601},"data-retention-retention-periods-and-expiration-clf-c02","Data Retention: retention periods and expiration","How retention periods control expiration of stored data and AWS Backup recovery points, and how legal holds can suspend disposal.","A retention period describes how long data should be kept. A retention policy identifies the data, why it is needed, and the event that starts the clock. That event could be creation of a record or closure of a business transaction. Retention periods come from business, legal, and recovery requirements—not one universal AWS default.",{"slug":1603,"title":1604,"focus":1605,"teaser":1606},"storage-tiering-cost-effective-placement-over-a-data-lifecycle-clf-c02","Storage Tiering: cost-effective placement over a data lifecycle","How access patterns, retrieval deadlines, and total storage costs guide tier selection and automated transitions without confusing transitions with deletion.","Storage tiering means placing data in a storage class that matches how often it is read and how quickly it must be available. Frequently read data usually needs economical, immediate access. Rarely read data may benefit from a lower storage price. These needs can change as data gets older.",{"slug":1608,"title":1609,"focus":1610,"teaser":1611},"data-retention-vs-storage-tiering-clf-c02","Data Retention vs. Storage Tiering","Why moving data to cheaper storage changes its cost and accessibility without necessarily changing how long it is kept or deleting it.","Data retention answers how long data should be kept. Storage tiering answers which storage class should hold it while it is kept. These are separate decisions about the same data.",{"slug":1613,"title":1614,"focus":1615,"teaser":1616},"backup-and-restore-recovering-earlier-data-states-clf-c02","Backup and Restore: recovering earlier data states","How retained recovery points enable recovery from data loss or corruption, and when AWS Backup is useful for centralizing this protection across supported resources.","A backup preserves a recoverable state of data. That saved state is called a recovery point. If someone deletes records or a software error corrupts files, a recovery point from before the damage can provide the earlier data. A restore uses that recovery point to recover the data.",{"slug":1618,"title":1619,"focus":1620,"teaser":1621},"aws-backup-centralized-backup-plans-clf-c02","AWS Backup: centralized backup plans","How backup plans automate scheduling and retention for supported resources, creating recovery points that can be restored after data loss.","AWS Backup is a fully managed service for centrally managing backups across supported resources. Instead of maintaining separate backup scripts for each resource, you define reusable rules in a backup plan. AWS Backup uses those rules to automate backup work.",{"id":1623,"title":1624,"subtitle":152,"lessons":1625},197,"Identify AWS artificial intelligence and machine learning (AI\u002FML) services and analytics services",[1626,1631,1636,1641,1646,1651,1656,1661,1666,1671,1676,1681,1686,1691,1696,1701,1706,1711,1716,1721,1726,1731,1736,1741,1746,1751],{"slug":1627,"title":1628,"focus":1629,"teaser":1630},"amazon-comprehend-insights-from-text-clf-c02","Amazon Comprehend: insights from text","How pretrained NLP models turn unstructured text into insights such as sentiment, entities, and key phrases without requiring users to build models.","Customer reviews, emails, and articles contain unstructured text: people write freely rather than filling in predictable fields. The information is there, but an application cannot simply read a column named “customer opinion” to find it.",{"slug":1632,"title":1633,"focus":1634,"teaser":1635},"amazon-comprehend-and-amazon-lex-text-analysis-versus-conversation-clf-c02","Amazon Comprehend and Amazon Lex: text analysis versus conversation","When to choose Comprehend to analyze text rather than Lex to build a conversational interface.","Amazon Comprehend analyzes text to uncover information in it. Choose it when an application needs findings about written content, such as the sentiment of customer feedback or the people and places mentioned in documents. The text is material to study; the result is information the application can use.",{"slug":1637,"title":1638,"focus":1639,"teaser":1640},"amazon-polly-turning-text-into-speech-clf-c02","Amazon Polly: turning text into speech","How Polly converts written text into spoken audio using a chosen language and voice for speech-enabled applications.","Amazon Polly is a managed text-to-speech (TTS) service: it converts written text into spoken audio. This conversion is called speech synthesis. AWS runs the speech-generation technology, so developers do not need to build or train their own speech model.",{"slug":1642,"title":1643,"focus":1644,"teaser":1645},"amazon-polly-and-amazon-lex-speech-synthesis-versus-conversational-interfaces-clf-c02","Amazon Polly and Amazon Lex: speech synthesis versus conversational interfaces","When an application needs Polly to speak supplied text versus Lex to understand user requests and manage a conversation.","Amazon Polly turns supplied text into spoken audio. This is called text-to-speech, or speech synthesis. The application supplies the words; Polly produces speech that the application can play. Reading an article or announcing a delivery update does not require understanding a user's request.",{"slug":1647,"title":1648,"focus":1649,"teaser":1650},"amazon-rekognition-image-and-video-analysis-clf-c02","Amazon Rekognition: image and video analysis","How Rekognition uses pretrained models to turn images and videos into visual detections with confidence scores, and which application needs those results can support.","Amazon Rekognition is a managed AWS service that analyzes images and videos. Applications call its APIs to detect visual content, such as objects, scenes, faces, text, and potentially inappropriate content. Developers do not need to build the underlying computer vision system.",{"slug":1652,"title":1653,"focus":1654,"teaser":1655},"amazon-sagemaker-the-managed-machine-learning-lifecycle-clf-c02","Amazon SageMaker: the managed machine learning lifecycle","How SageMaker AI fits within the SageMaker platform and helps teams build, train, and deploy custom models for predictions without managing the underlying infrastructure.","Amazon SageMaker is a unified platform for data, analytics, and AI. It brings together capabilities for working with data, analyzing it, and developing AI applications. SageMaker Unified Studio provides a shared development environment for these activities.",{"slug":1657,"title":1658,"focus":1659,"teaser":1660},"amazon-q-generative-ai-assistants-clf-c02","Amazon Q: generative AI assistants","How Amazon Q supports natural-language assistance through Q Developer for software and AWS work and Q Business for answers grounded in authorized organizational content.","Amazon Q is in maintenance since June 30, 2026 (2026-06-30): it is closed to new customers, while existing customers can keep using it. This lesson describes the service as AWS offered it, not as a recommendation for new workloads. AWS's migration guide is https:\u002F\u002Fdocs.aws.amazon.com\u002Famazonq\u002Flatest\u002Fqbusiness-ug\u002Fqbusiness-availability-change.html.",{"slug":1662,"title":1663,"focus":1664,"teaser":1665},"amazon-athena-querying-data-in-amazon-s3-clf-c02","Amazon Athena: querying data in Amazon S3","How Athena uses table definitions to run serverless SQL queries directly on S3 data, with query costs based on data scanned.","Amazon Athena is a serverless query service. You write SQL to analyze data directly in Amazon S3, without first loading it into a separate database. AWS manages the computing resources that run the query.",{"slug":1667,"title":1668,"focus":1669,"teaser":1670},"amazon-redshift-analytical-data-warehousing-clf-c02","Amazon Redshift: analytical data warehousing","How Redshift uses columnar storage and parallel processing to support SQL analysis of large datasets for reporting and business intelligence.","Amazon Redshift is a managed data warehouse: a service designed to store and analyze large datasets. A warehouse brings data together for questions such as “How much did each region sell this year?” rather than focusing on individual actions such as updating one customer's address.",{"slug":1672,"title":1673,"focus":1674,"teaser":1675},"amazon-athena-and-amazon-redshift-choosing-a-query-service-clf-c02","Amazon Athena and Amazon Redshift: choosing a query service","When to choose Athena for querying S3 data directly rather than Redshift for data warehouse analytics.","Amazon Athena and Amazon Redshift both let you analyze data with SQL, a language for asking questions about data. The important difference is not the language: it is whether you want to query files where they already sit or use a data warehouse for analytics.",{"slug":1677,"title":1678,"focus":1679,"teaser":1680},"amazon-emr-managed-big-data-processing-clf-c02","Amazon EMR: managed big data processing","How EMR runs distributed processing jobs with frameworks such as Apache Spark and Hadoop on managed, scalable compute resources.","Amazon EMR is a managed service for processing large amounts of data using frameworks such as Apache Spark and Apache Hadoop. A framework provides software for organizing and running data-processing work; EMR helps set up and operate the resources that run it.",{"slug":1682,"title":1683,"focus":1684,"teaser":1685},"amazon-emr-and-amazon-athena-processing-frameworks-or-sql-queries-clf-c02","Amazon EMR and Amazon Athena: processing frameworks or SQL queries","When to choose EMR for customizable distributed processing rather than Athena for querying data directly with serverless SQL.","Amazon EMR runs data-processing applications using frameworks such as Apache Spark and Hadoop. A framework provides tools for dividing work across computing resources. Choose EMR when you need to build or adapt how a large processing job runs, rather than just submit a query.",{"slug":1687,"title":1688,"focus":1689,"teaser":1690},"aws-glue-and-amazon-athena-preparing-data-versus-querying-it-clf-c02","AWS Glue and Amazon Athena: preparing data versus querying it","When to choose Glue for data preparation rather than Athena for SQL queries, and why their shared use of catalog metadata does not make them interchangeable.","AWS Glue helps prepare and integrate data. Its managed ETL jobs extract data from sources, transform it, and load the result into a destination. Choose this approach when you need to clean inconsistent values, combine sources, or produce a reusable dataset.",{"slug":1692,"title":1693,"focus":1694,"teaser":1695},"amazon-opensearch-service-indexed-search-and-analytics-clf-c02","Amazon OpenSearch Service: indexed search and analytics","How OpenSearch Service indexes data for fast application search and near-real-time log analysis, with results explored in OpenSearch Dashboards.","Amazon OpenSearch Service is a managed search and analytics service. It helps applications find matching information quickly and helps people investigate logs. AWS manages much of the underlying infrastructure, while you decide what data to send and how to search it.",{"slug":1697,"title":1698,"focus":1699,"teaser":1700},"amazon-quicksight-interactive-business-intelligence-dashboards-clf-c02","Amazon QuickSight: interactive business intelligence dashboards","How QuickSight turns connected datasets into interactive dashboards that business users can explore without managing servers.","Amazon QuickSight is a cloud-based business intelligence service: it helps people turn data into charts, tables, and interactive dashboards. For example, a sales team can explore revenue by month or region instead of reading rows of sales records.",{"slug":1702,"title":1703,"focus":1704,"teaser":1705},"amazon-lex-voice-and-text-conversations-clf-c02","Amazon Lex: voice and text conversations","How Lex uses intents, slots, and prompts to turn voice or text input into a conversation that fulfills a user's request.","Amazon Lex helps you build conversational interfaces that accept voice or text. For voice input, speech recognition turns speech into text. Natural language understanding interprets what the user means. The user's spoken or typed input is called an utterance.",{"slug":1707,"title":1708,"focus":1709,"teaser":1710},"amazon-textract-extracting-document-data-clf-c02","Amazon Textract: extracting document data","How Textract turns printed and handwritten document content into machine-readable text and structured form and table data.","A scanned document is a picture of a page. A person can read the words, but an application needs those words as data to search, copy, or process them. Amazon Textract is a managed machine learning service that extracts text and data from documents, reducing manual retyping. You do not need to build or train your own recognition model.",{"slug":1712,"title":1713,"focus":1714,"teaser":1715},"amazon-transcribe-turning-speech-into-text-clf-c02","Amazon Transcribe: turning speech into text","How Transcribe converts recorded or streaming speech into readable transcripts with timestamps and speaker labels.","Amazon Transcribe is a managed automatic speech recognition service: it recognizes spoken words in audio and returns text. AWS runs the speech recognition models, so you do not need to train or operate your own model.",{"slug":1717,"title":1718,"focus":1719,"teaser":1720},"amazon-translate-translating-text-between-languages-clf-c02","Amazon Translate: translating text between languages","How managed neural machine translation converts text between languages for real-time communication and batch content localization.","Amazon Translate is a managed service that converts text from one language into another. The source language is the language of the original text; the target language is the language you want to produce.",{"slug":1722,"title":1723,"focus":1724,"teaser":1725},"amazon-lex-vs-amazon-transcribe-clf-c02","Amazon Lex vs. Amazon Transcribe","When to choose Lex for an interactive conversational bot rather than Transcribe for converting speech into text.","Amazon Lex helps you build an interactive conversational bot using voice or text. Choose it when an application needs to understand a user's request and guide the user through a conversation, such as a bot that helps arrange an appointment.",{"slug":1727,"title":1728,"focus":1729,"teaser":1730},"amazon-textract-vs-amazon-transcribe-documents-or-speech-clf-c02","Amazon Textract vs Amazon Transcribe: documents or speech","How to choose between Textract for extracting document content and Transcribe for converting speech into text.","Amazon Textract and Amazon Transcribe both help turn information into text that software can use. The main difference is their input: Textract extracts content from documents, while Transcribe converts speech into text.",{"slug":1732,"title":1733,"focus":1734,"teaser":1735},"amazon-transcribe-vs-amazon-translate-clf-c02","Amazon Transcribe vs Amazon Translate","When to use Transcribe to turn speech into text versus Translate to convert text between languages.","Amazon Transcribe turns speech into text. This is called transcription: spoken words become a written transcript in the language being spoken. For example, an English recording becomes English text that someone can read instead of listening to the recording.",{"slug":1737,"title":1738,"focus":1739,"teaser":1740},"aws-glue-serverless-data-preparation-clf-c02","AWS Glue: serverless data preparation","How Glue uses crawlers, Data Catalog metadata, and managed ETL jobs to turn source data into analytics-ready datasets.","AWS Glue is a managed data integration service that helps prepare and combine data for analytics. Its ETL jobs extract data from a source, transform it into a useful form, and load the results into a destination.",{"slug":1742,"title":1743,"focus":1744,"teaser":1745},"amazon-data-firehose-managed-streaming-data-delivery-clf-c02","Amazon Data Firehose: managed streaming data delivery","How Firehose receives streaming records, buffers them, and delivers them to analytics destinations without requiring custom delivery applications.","Streaming data arrives continuously as records, such as website clicks, application logs, or sensor readings. Amazon Data Firehose is a fully managed delivery service: it receives those records, temporarily collects them, and delivers them to a configured destination.",{"slug":1747,"title":1748,"focus":1749,"teaser":1750},"amazon-kinesis-data-streams-capturing-data-for-real-time-processing-clf-c02","Amazon Kinesis Data Streams: capturing data for real-time processing","How producers write records to a durable stream that independent consumers can read and replay within its retention period for real-time processing.","Amazon Kinesis Data Streams is a managed service that captures and retains a continuous flow of data records. Applications can process records as they arrive instead of waiting for a large batch to accumulate.",{"slug":1752,"title":1753,"focus":1754,"teaser":1755},"amazon-data-firehose-and-amazon-kinesis-data-streams-delivery-versus-custom-consumption-clf-c02","Amazon Data Firehose and Amazon Kinesis Data Streams: delivery versus custom consumption","When to choose Firehose for managed delivery to destinations rather than Kinesis Data Streams for retained streams with custom consumers and replay.","Streaming data is a continuing flow of records, such as application events. Amazon Data Firehose and Amazon Kinesis Data Streams both handle streaming data, but they solve different problems.",{"id":1757,"title":1758,"subtitle":152,"lessons":1759},198,"Identify services from other in-scope AWS service categories",[1760,1765,1770,1775,1780,1785,1790,1795,1800,1805,1810,1815,1820,1825,1830,1835,1840,1845,1850,1855,1860,1865,1870,1875,1880,1885,1890,1895,1900,1905,1910,1915,1920,1925],{"slug":1761,"title":1762,"focus":1763,"teaser":1764},"amazon-eventbridge-routing-events-with-rules-clf-c02","Amazon EventBridge: routing events with rules","How event buses receive events from AWS services, SaaS applications, and custom applications and use matching rules to route them to targets.","An event is a record of something that happened, such as an instance stopping or an order being placed. Amazon EventBridge is a serverless service that receives events and routes them to destinations. You do not manage servers for its event buses.",{"slug":1766,"title":1767,"focus":1768,"teaser":1769},"amazon-sns-publishing-to-topics-and-subscribers-clf-c02","Amazon SNS: publishing to topics and subscribers","How publishers send messages to SNS topics that fan out notifications to subscribed applications and people.","Amazon Simple Notification Service (Amazon SNS) distributes messages from senders to interested applications and people. It uses a publish\u002Fsubscribe model: senders publish messages, and receivers subscribe to receive them.",{"slug":1771,"title":1772,"focus":1773,"teaser":1774},"amazon-sqs-decoupling-applications-with-message-queues-clf-c02","Amazon SQS: decoupling applications with message queues","How producers send work to a durable queue and consumers receive, process, and delete messages independently, allowing applications to absorb traffic spikes and temporary consumer outages.","Amazon Simple Queue Service (Amazon SQS) is a fully managed message queuing service. A producer sends a message describing work to a durable queue. A consumer retrieves that message and does the work. AWS operates the queue infrastructure; you write the applications that use it.",{"slug":1776,"title":1777,"focus":1778,"teaser":1779},"amazon-eventbridge-vs-amazon-sns-event-routing-or-notifications-clf-c02","Amazon EventBridge vs Amazon SNS: event routing or notifications","When to choose EventBridge for routing application events rather than SNS for publishing messages to subscribers and sending notifications.","An event describes something that happened, such as an order being placed. Choose Amazon EventBridge when the main job is to examine application events and route matching events to targets. An event bus receives events, and rules select where they go.",{"slug":1781,"title":1782,"focus":1783,"teaser":1784},"amazon-eventbridge-vs-amazon-sqs-event-routing-or-message-queuing-clf-c02","Amazon EventBridge vs Amazon SQS: event routing or message queuing","When to choose EventBridge to route events to targets rather than SQS to hold messages for consumers to retrieve and process.","An event describes something that happened, such as an order being placed. Amazon EventBridge receives events on an event bus and uses rules to route matching events to configured targets. Choose it when the main question is: which targets should receive this event?",{"slug":1786,"title":1787,"focus":1788,"teaser":1789},"amazon-sns-and-amazon-sqs-notifications-versus-queues-clf-c02","Amazon SNS and Amazon SQS: notifications versus queues","When to choose SNS for push-based fan-out rather than SQS for buffering messages until consumers retrieve them.","Amazon Simple Notification Service (Amazon SNS) distributes notifications. A publisher sends a message to a topic, a named destination with subscribers. SNS pushes the message to subscribed destinations. Sending one published message to multiple subscribers is called fan-out.",{"slug":1791,"title":1792,"focus":1793,"teaser":1794},"amazon-connect-managed-contact-centers-clf-c02","Amazon Connect: managed contact centers","How Amazon Connect handles customer voice and chat interactions through contact flows, queues, and agents, and when a business needs a managed contact center.","Amazon Connect is an AWS-managed cloud contact center. It helps a business handle customer voice calls and chats, guide customers through automated steps, and route interactions to human agents.",{"slug":1796,"title":1797,"focus":1798,"teaser":1799},"amazon-ses-sending-application-email-clf-c02","Amazon SES: sending application email","How applications use SES to send transactional, notification, and marketing emails through APIs or SMTP without managing mail servers.","Amazon Simple Email Service (Amazon SES) is a managed service for sending email from applications. Your application supplies the recipient, sender, and message; SES handles the outgoing email infrastructure. You do not install, patch, or operate mail servers.",{"slug":1801,"title":1802,"focus":1803,"teaser":1804},"aws-support-support-plans-clf-c02","AWS Support: support plans","How Basic Support, Business Support+, Enterprise Support, and Unified Operations differ in assistance, response commitments, and proactive guidance to suit customer needs.","AWS Support plans determine how you get help with AWS and how much ongoing guidance you receive. Basic Support is included for all AWS customers. It provides account and billing assistance, while technical learning and troubleshooting rely on self-service resources such as AWS documentation and the AWS re:Post community.",{"slug":1806,"title":1807,"focus":1808,"teaser":1809},"aws-health-dashboard-service-health-events-clf-c02","AWS Health Dashboard: service health events","How public and account-specific health events describe AWS disruptions, scheduled changes, and affected resources, with programmatic access through the AWS Health API.","AWS Health Dashboard reports AWS operational events, including service disruptions and planned changes. It helps you understand what AWS reports and whether the event is relevant to your resources. It does not measure your application's response time or check that your application works correctly.",{"slug":1811,"title":1812,"focus":1813,"teaser":1814},"aws-health-dashboard-vs-aws-trusted-advisor-clf-c02","AWS Health Dashboard vs AWS Trusted Advisor","How AWS Health operational event information differs from AWS Trusted Advisor recommendations for cost optimization and other best practices.","AWS Health Dashboard helps answer, “What AWS operational events could affect my environment?” It presents information about AWS service disruptions, scheduled changes, and events relevant to your account. This information helps you understand an event’s impact and prepare or respond.",{"slug":1816,"title":1817,"focus":1818,"teaser":1819},"aws-codebuild-managed-software-builds-clf-c02","AWS CodeBuild: managed software builds","How CodeBuild runs build and test commands in managed environments to turn source code into deployable artifacts without managing build servers.","AWS CodeBuild is a managed service that runs commands to compile source code, run tests, and package software. The resulting files are called build artifacts: for example, an application ZIP file that can later be deployed.",{"slug":1821,"title":1822,"focus":1823,"teaser":1824},"aws-codepipeline-release-workflows-clf-c02","AWS CodePipeline: release workflows","How CodePipeline uses triggers, stages, and actions to coordinate a software change from source through build, test, and deployment.","AWS CodePipeline is a managed service that coordinates the steps used to release a software change. You define a pipeline: a repeatable workflow that takes a source revision through the work needed before deployment. This reduces manual handoffs and makes the release process consistent.",{"slug":1826,"title":1827,"focus":1828,"teaser":1829},"aws-codebuild-vs-aws-codepipeline-builds-and-release-orchestration-clf-c02","AWS CodeBuild vs AWS CodePipeline: builds and release orchestration","How CodeBuild's execution of builds differs from CodePipeline's orchestration of stages across a software release workflow.","A software release involves different jobs: preparing source code, building it, checking it, and deploying it. AWS CodeBuild and AWS CodePipeline address different parts of that work rather than being interchangeable services.",{"slug":1831,"title":1832,"focus":1833,"teaser":1834},"aws-x-ray-distributed-request-tracing-clf-c02","AWS X-Ray: distributed request tracing","How X-Ray uses request traces and service maps to reveal dependencies, latency bottlenecks, and errors across distributed applications.","A single application request can pass through several services before returning a result. AWS X-Ray helps you understand that journey through distributed tracing: connecting records of work across application components.",{"slug":1836,"title":1837,"focus":1838,"teaser":1839},"amazon-appstream-2-0-streaming-applications-to-users-clf-c02","Amazon AppStream 2.0: streaming applications to users","How applications run on AWS streaming instances while users view their output and send keyboard and mouse input from a browser without installing the applications locally.","Amazon AppStream 2.0 is a fully managed application streaming service. It lets users work with desktop applications through a supported web browser without installing those applications on their own devices.",{"slug":1841,"title":1842,"focus":1843,"teaser":1844},"amazon-workspaces-cloud-desktops-and-remote-access-clf-c02","Amazon WorkSpaces: cloud desktops and remote access","How WorkSpaces runs desktops in AWS and delivers their display and interaction to supported user devices, with persistent personal desktops or non-persistent pooled desktops.","Amazon WorkSpaces is a managed cloud desktop service. The desktop operating system and its applications run in AWS, rather than on the user's laptop or tablet. This lets an organization provide a work desktop without putting that desktop's computing hardware at the user's location.",{"slug":1846,"title":1847,"focus":1848,"teaser":1849},"amazon-workspaces-web-managed-remote-browser-sessions-clf-c02","Amazon WorkSpaces Web: managed remote browser sessions","How WorkSpaces Web, now called WorkSpaces Secure Browser, streams an isolated cloud browser to users for access to internal websites and SaaS applications.","Amazon WorkSpaces Web is now called Amazon WorkSpaces Secure Browser. It provides a managed, isolated cloud browser for accessing internal websites and SaaS applications—software used through the web.",{"slug":1851,"title":1852,"focus":1853,"teaser":1854},"amazon-appstream-2-0-vs-amazon-workspaces-applications-or-personal-desktops-clf-c02","Amazon AppStream 2.0 vs Amazon WorkSpaces: applications or personal desktops","How AppStream's application-centered streaming differs from WorkSpaces' personal virtual desktops, and which user needs each serves.","Amazon AppStream 2.0 and Amazon WorkSpaces both let people interact with software running in AWS. The user's device displays the remote output and sends input, such as keyboard actions and mouse clicks. The device is not doing the application's main computing work.",{"slug":1856,"title":1857,"focus":1858,"teaser":1859},"amazon-workspaces-vs-amazon-workspaces-secure-browser-clf-c02","Amazon WorkSpaces vs Amazon WorkSpaces Secure Browser","When users need a complete cloud desktop rather than browser-only access to websites and web applications.","Amazon WorkSpaces provides a complete cloud desktop: a desktop environment running in AWS where users can work with applications, files, and websites. Their device displays the remote desktop and sends their interactions to it.",{"slug":1861,"title":1862,"focus":1863,"teaser":1864},"amazon-workspaces-web-vs-amazon-appstream-2-0-clf-c02","Amazon WorkSpaces Web vs. Amazon AppStream 2.0","How access through a managed remote browser differs from streaming installed desktop applications.","Amazon WorkSpaces Web, now called Amazon WorkSpaces Secure Browser, provides a managed browser running in AWS. Users access internal websites and software-as-a-service (SaaS) applications through that remote browser.",{"slug":1866,"title":1867,"focus":1868,"teaser":1869},"aws-amplify-building-and-deploying-web-and-mobile-apps-clf-c02","AWS Amplify: building and deploying web and mobile apps","How Amplify connects web and mobile frontends to AWS backends and provides managed build, deployment, and hosting for web apps.","A frontend is the part of an application people interact with: pages in a web browser or screens in a mobile app. A backend provides capabilities such as user sign-in, access to shared data, and storage.",{"slug":1871,"title":1872,"focus":1873,"teaser":1874},"aws-iot-core-device-to-cloud-messaging-clf-c02","AWS IoT Core: device-to-cloud messaging","How AWS IoT Core lets devices securely exchange messages with cloud applications without managing messaging infrastructure.","AWS IoT Core is a managed service that lets connected devices exchange messages with cloud applications. A sensor can send a temperature reading, and an application can send a command back. AWS operates the messaging infrastructure, so you do not install, patch, or scale message-broker servers.",{"slug":1876,"title":1877,"focus":1878,"teaser":1879},"aws-iot-core-vs-aws-iot-device-management-clf-c02","AWS IoT Core vs AWS IoT Device Management","When to use AWS IoT Core for device communication versus AWS IoT Device Management for organizing, monitoring, and updating device fleets.","An IoT device is a connected physical device, such as a temperature sensor or a smart thermostat. A fleet is a collection of these devices. Running an IoT system means both exchanging messages with devices and keeping the fleet organized and maintained.",{"slug":1881,"title":1882,"focus":1883,"teaser":1884},"event-driven-architecture-delivering-events-to-independent-consumers-clf-c02","Event-Driven Architecture: delivering events to independent consumers","How decoupled event delivery works, and when queues, publish-subscribe topics, or event buses suit background work, notifications, or event routing.","An event is a record that something happened, such as OrderPlaced. A producer publishes that fact, and consumers react to it. Fulfillment and reporting can respond to the same order without the order application directly calling each of them.",{"slug":1886,"title":1887,"focus":1888,"teaser":1889},"message-queuing-buffering-background-work-clf-c02","Message Queuing: buffering background work","How a queue holds work until consumers can process it, and why Amazon SQS suits applications with asynchronous background tasks.","A message queue holds messages describing work until an application can process them. The application creating the work is the producer; the application performing it is the consumer, often called a worker.",{"slug":1891,"title":1892,"focus":1893,"teaser":1894},"publish-subscribe-messaging-topic-based-fan-out-clf-c02","Publish-Subscribe Messaging: topic-based fan-out","How topics and subscriptions distribute a published message to independent recipients, and why Amazon SNS fits fan-out and alert notifications.","Publish-subscribe messaging separates sending a message from responding to it. A publisher sends a message to a named destination called a topic, rather than contacting every recipient directly.",{"slug":1896,"title":1897,"focus":1898,"teaser":1899},"message-queuing-vs-publish-subscribe-messaging-clf-c02","Message Queuing vs. Publish-Subscribe Messaging","How distributing queued work among competing consumers differs from broadcasting to subscribers, guiding the choice between Amazon SQS and Amazon SNS for work delivery or notifications.","Messaging lets one application send information without waiting for another application to finish acting on it. The key choice is whether recipients should share the work or each receive a copy.",{"slug":1901,"title":1902,"focus":1903,"teaser":1904},"aws-support-plans-choosing-support-coverage-clf-c02","AWS Support plans: choosing support coverage","How support tiers differ in technical assistance, contact channels, severity-based initial response targets, and proactive guidance, and how those entitlements fit workload needs.","AWS Support plans define the assistance you can receive from AWS. They do not change the resources running your application. Buying a higher tier does not automatically make an application more available or transfer your operational responsibilities to AWS.",{"slug":1906,"title":1907,"focus":1908,"teaser":1909},"aws-support-plans-versus-aws-professional-services-clf-c02","AWS Support plans versus AWS Professional Services","How ongoing operational support differs from scoped consulting engagements for cloud adoption and transformation.","AWS Support plans provide an ongoing support relationship for customers using AWS. They help teams obtain assistance with account questions and, depending on the plan, technical troubleshooting and guidance. The purpose is to support the customer's use of AWS, rather than deliver a separately defined cloud transformation project.",{"slug":1911,"title":1912,"focus":1913,"teaser":1914},"aws-professional-services-and-aws-solutions-architects-project-delivery-versus-architectural-guidance-clf-c02","AWS Professional Services and AWS Solutions Architects: project delivery versus architectural guidance","How to distinguish a scoped Professional Services delivery engagement from solutions architect guidance when choosing expert assistance.","AWS Professional Services and AWS Solutions Architects both help customers succeed on AWS. They provide assistance through people, rather than cloud resources you create in the AWS console. The main distinction is scoped project delivery versus architectural guidance.",{"slug":1916,"title":1917,"focus":1918,"teaser":1919},"ci-cd-from-code-changes-to-releases-clf-c02","CI\u002FCD: from code changes to releases","How automated pipelines move code through build, test, and release stages, how continuous delivery differs from continuous deployment, and where AWS CodeBuild and AWS CodePipeline fit.","Continuous integration (CI) means developers frequently merge small changes into shared source code and get automated build and test feedback. This catches problems early; an occasional automated build alone is not effective CI if changes stay isolated for long periods.",{"slug":1921,"title":1922,"focus":1923,"teaser":1924},"distributed-tracing-following-requests-across-services-clf-c02","Distributed Tracing: following requests across services","How connected spans reveal a request’s path, delays, and failures across services, and how AWS X-Ray makes these traces available for troubleshooting.","Distributed tracing follows one request across the services that handle it. An order request might enter an order service, which calls an inventory service. Both services could appear healthy overall while that particular request is slow or fails.",{"slug":1926,"title":1927,"focus":1928,"teaser":1929},"aws-iot-device-management-remote-fleet-management-clf-c02","AWS IoT Device Management: remote fleet management","How device groups and jobs let operators target, roll out, and track remote changes across an IoT fleet.","AWS IoT Device Management helps operators organize and remotely manage a fleet of connected devices. A registered device is represented by a thing. A thing group collects these representations so operators can target a useful set of devices instead of selecting each device individually.",{"id":1931,"title":1932,"subtitle":152,"subcategories":1933},49,"Billing, Pricing, and Support",[1934,2003,2072],{"id":1935,"title":1936,"subtitle":152,"lessons":1937},199,"Compare AWS pricing models",[1938,1943,1948,1953,1958,1963,1968,1973,1978,1983,1988,1993,1998],{"slug":1939,"title":1940,"focus":1941,"teaser":1942},"usage-based-pricing-vs-commitment-discounts-clf-c02","Usage-Based Pricing vs Commitment Discounts","How charging for measured resource usage differs from exchanging a spending or usage commitment for discounted rates, including the cost of unused commitments.","Usage-based pricing connects charges to measured quantities, such as compute running time, stored data, or requests. With an option such as EC2 On-Demand, you pay for billable usage without accepting a long-term purchasing commitment. Measured usage is not the same as useful work: a running instance can incur compute charges even when its application is idle.",{"slug":1944,"title":1945,"focus":1946,"teaser":1947},"commitment-discounts-matching-commitments-to-workloads-clf-c02","Commitment Discounts: matching commitments to workloads","How resource-based and spending-based discounts apply to eligible usage, and why a predictable workload baseline is the best fit.","A commitment discount lowers the price of eligible usage in exchange for an obligation over a term. The important question is what usage the agreement can cover. Two common approaches are resource-based and spending-based commitments.",{"slug":1949,"title":1950,"focus":1951,"teaser":1952},"usage-based-pricing-compute-purchasing-options-clf-c02","Usage-Based Pricing: compute purchasing options","How compute purchasing options change charges for running, idle, committed, interrupted, reserved, or dedicated capacity.","An Amazon EC2 instance is a virtual server. With On-Demand Instances, you pay for running instance usage without a long-term commitment. Running is not the same as doing useful work: an instance with an idle CPU still incurs compute charges. Stopping an EBS-backed On-Demand instance generally stops its instance compute charges, but retained storage and other resources can still cost money.",{"slug":1954,"title":1955,"focus":1956,"teaser":1957},"amazon-ec2-purchasing-capacity-clf-c02","Amazon EC2: purchasing capacity","How EC2 purchasing options suit different workloads through trade-offs in commitment, interruption risk, capacity assurance, and dedicated tenancy.","An EC2 instance is a virtual server. Purchasing options change how you pay for it, whether spare capacity can be reclaimed, whether capacity is reserved for you, and whether its physical hardware is dedicated to your use.",{"slug":1959,"title":1960,"focus":1961,"teaser":1962},"savings-plans-commitment-based-pricing-clf-c02","Savings Plans: commitment-based pricing","How hourly spending commitments produce automatic discounts, and how workload predictability and each plan type’s flexibility determine when Savings Plans are suitable without reserving capacity.","Savings Plans is a pricing model, not a resource you deploy. You commit to a spending amount in dollars per hour for a one-year or three-year term. AWS automatically applies discounted rates to eligible usage that matches your plan.",{"slug":1964,"title":1965,"focus":1966,"teaser":1967},"amazon-ec2-reserved-instance-flexibility-and-discount-application-clf-c02","Amazon EC2: Reserved Instance flexibility and discount application","How Reserved Instance matching, modification, and exchange rules affect discount coverage within an account and across AWS Organizations accounts.","An EC2 Reserved Instance (RI) is a billing benefit, not a separate virtual machine. In return for a term commitment, it discounts eligible EC2 usage automatically. You do not attach it to a particular running instance. Unused benefit is not saved for later.",{"slug":1969,"title":1970,"focus":1971,"teaser":1972},"workload-predictability-finding-a-dependable-compute-baseline-clf-c02","Workload Predictability: finding a dependable compute baseline","How measured demand, operating schedules, and expected workload lifetime identify usage suitable for Reserved Instances or Savings Plans while uncertain demand stays On-Demand.","Workload predictability means confidence in future compute needs. It does not mean demand must stay constant. Start with measured usage over a period that includes ordinary busy and quiet times, relevant business cycles, and seasonal changes. Historical measurements are evidence, not a promise that future demand will be identical.",{"slug":1974,"title":1975,"focus":1976,"teaser":1977},"fault-tolerance-interruption-tolerant-workloads-clf-c02","Fault Tolerance: interruption-tolerant workloads","How durable progress and safely retried work let workloads survive compute interruptions, making Spot capacity suitable without relying on interruption warnings.","Interruption tolerance means work can still finish correctly even if the computer doing it stops. Amazon EC2 Spot Instances use spare AWS compute capacity at discounted prices, but AWS can reclaim that capacity. They suit work that can pause, restart, or move to another worker.",{"slug":1979,"title":1980,"focus":1981,"teaser":1982},"workload-predictability-vs-fault-tolerance-clf-c02","Workload Predictability vs. Fault Tolerance","Why confidence in future compute demand differs from the ability to withstand disruptions, so predictable usage alone does not establish suitability for Spot Instances.","Workload predictability means confidence in estimating future compute demand: how much computing power you will need and when you will need it. Predictable does not mean constant. A job that runs every evening can have predictable demand even though it is idle during the day.",{"slug":1984,"title":1985,"focus":1986,"teaser":1987},"data-egress-how-transfer-paths-affect-cost-clf-c02","Data Egress: how transfer paths affect cost","How a transfer’s direction, source, destination, and route determine AWS data transfer charges, including internet, inter-Region, and same-Region traffic.","Data egress means data leaving a defined boundary. A file leaving an AWS Region is egress from that Region, even if it goes to another AWS Region. Ingress is data entering a boundary. Always name the boundary before describing the direction.",{"slug":1989,"title":1990,"focus":1991,"teaser":1992},"migration-and-data-transfer-transfer-charges-clf-c02","Migration and data transfer: transfer charges","How traffic direction, Region, Availability Zone, and network path determine data-transfer charges and additional network costs.","Data transfer means moving bytes between locations. Direction matters: data arriving in AWS from the internet is generally free of data-transfer charges. Data leaving AWS for the internet is generally charged, subject to allowances and service-specific exceptions. Free transfer does not mean free storage, requests, or processing.",{"slug":1994,"title":1995,"focus":1996,"teaser":1997},"data-locality-placement-and-data-transfer-costs-clf-c02","Data Locality: placement and data transfer costs","How placing data near its consumers affects transfer costs, accounting for transfer direction, Region and Availability Zone boundaries, and service-specific exceptions.","Data locality means putting data near the applications or people that use it, or running computation near its data. Moving less data across chargeable boundaries can reduce transfer costs. A small request can return a large dataset, so follow the direction and volume of the actual data.",{"slug":1999,"title":2000,"focus":2001,"teaser":2002},"usage-based-pricing-storage-access-costs-clf-c02","Usage-Based Pricing: storage access costs","How capacity, performance, requests, retrievals, transfers, and minimum billing rules determine storage costs for a workload's access pattern.","A storage bill can include both capacity, the amount of storage, and performance, how quickly it can handle work. Paying for storage does not always mean paying only for the bytes your application has written.",{"id":2004,"title":2005,"subtitle":152,"lessons":2006},200,"Understand resources for billing, budget, and cost management",[2007,2012,2017,2022,2027,2032,2037,2042,2047,2052,2057,2062,2067],{"slug":2008,"title":2009,"focus":2010,"teaser":2011},"aws-billing-and-cost-management-bills-and-billing-inquiries-clf-c02","AWS Billing and Cost Management: bills and billing inquiries","How to find charges and invoices, distinguish estimated charges from finalized bills, and obtain account and billing support.","AWS Billing and Cost Management is where you inspect AWS charges and billing documents. Open its console, choose Bills, and select the billing month you want to review. Check the month first so that you do not confuse current charges with an earlier bill.",{"slug":2013,"title":2014,"focus":2015,"teaser":2016},"aws-support-account-and-billing-support-cases-clf-c02","AWS Support: account and billing support cases","How customers on any support plan use AWS Support Center to open, track, and respond to account and billing inquiries.","AWS Support provides account and billing assistance to customers on every support plan, including Basic Support. You do not need to purchase a paid support plan to ask about an invoice, a payment problem, or an account-related issue.",{"slug":2018,"title":2019,"focus":2020,"teaser":2021},"aws-support-center-support-case-lifecycle-clf-c02","AWS Support Center: support case lifecycle","How to open and manage account, billing, and eligible technical cases, including support-plan eligibility, useful evidence, severity, and correspondence through resolution.","AWS Support Center is where you create and manage support cases: recorded conversations with AWS about an account, a bill, or an eligible technical problem. It is not a monitoring system or a cost-analysis dashboard. Open it from the AWS Management Console while signed in to the relevant account with permission to manage support cases.",{"slug":2023,"title":2024,"focus":2025,"teaser":2026},"usage-based-pricing-billable-quantities-and-cost-estimates-clf-c02","Usage-Based Pricing: billable quantities and cost estimates","How to estimate workload costs from billable quantities and official service rates, accounting for regional differences, billing granularity, minimum charges, and free allowances.","Usage-based pricing connects a charge to a measurable quantity, such as compute time, stored data, requests, or data transferred. Start with a defined period, such as a month, and estimate each chargeable quantity separately. A running resource can generate charges even when it is not doing useful application work.",{"slug":2028,"title":2029,"focus":2030,"teaser":2031},"resource-tagging-cost-allocation-tags-clf-c02","Resource Tagging: cost allocation tags","How user-defined and AWS-generated tags become billing dimensions through activation, including their availability and limitations in cost reports.","A cost allocation tag lets you organize eligible AWS charges by a business label, such as department or project. A tag has a key and a value: in CostCenter=CC104, the key is CostCenter and the value is CC104. Billing tools can use these values to show costs for each cost center.",{"slug":2033,"title":2034,"focus":2035,"teaser":2036},"aws-billing-and-cost-management-cost-allocation-tags-clf-c02","AWS Billing and Cost Management: cost allocation tags","How user-defined and AWS-generated cost allocation tags are activated and become available for attributing spending in billing reports.","A cost allocation tag is a label used to attribute AWS spending to a project, team, or other category. A tag has a key and a value: in Project=Atlas, the key is Project and the value is Atlas.",{"slug":2038,"title":2039,"focus":2040,"teaser":2041},"cost-allocation-attributing-aws-charges-to-owners-clf-c02","Cost Allocation: attributing AWS charges to owners","How linked accounts and activated user-defined or AWS-generated cost allocation tags attribute consolidated charges in billing reports, while shared and unmatched costs require separate allocation rules.","Cost allocation means attributing charges to the teams, products, or departments responsible for them. It answers “Where does this cost belong?” rather than “What price does AWS charge?” Allocating a charge does not itself reduce usage or change its price.",{"slug":2043,"title":2044,"focus":2045,"teaser":2046},"aws-cost-and-usage-report-cost-allocation-tag-columns-clf-c02","AWS Cost and Usage Report: cost allocation tag columns","How activated AWS-generated and user-defined cost allocation tags appear in report columns and help attribute usage costs, including the limits of untagged data.","The AWS Cost and Usage Report (CUR) contains detailed cost and usage line items. Cost allocation tags help connect eligible costs to labels such as a project or department.",{"slug":2048,"title":2049,"focus":2050,"teaser":2051},"aws-cost-and-usage-report-vs-aws-cost-explorer-clf-c02","AWS Cost and Usage Report vs AWS Cost Explorer","When to use detailed report exports rather than interactive cost views to analyze spending by cost allocation tag.","A cost allocation tag, such as Project, lets you organize spending by a business label. For this lesson, assume the tag is already available for cost analysis. Both AWS Cost Explorer and AWS Cost and Usage Report (CUR) support analyzing spending by that tag.",{"slug":2053,"title":2054,"focus":2055,"teaser":2056},"cost-allocation-vs-resource-tagging-clf-c02","Cost Allocation vs Resource Tagging","How to distinguish financial attribution from resource organization when tags serve purposes such as search, automation, or access control rather than identifying a cost owner.","Resource tagging adds descriptive information to a resource, usually as a key and value such as Environment=Development. Tags help people and tools find and manage resources. One resource can have several tags for different purposes.",{"slug":2058,"title":2059,"focus":2060,"teaser":2061},"aws-budgets-budget-thresholds-and-notifications-clf-c02","AWS Budgets: budget thresholds and notifications","How scoped cost and usage budgets track actual or forecasted spending against thresholds, send notifications, and support optional actions without imposing an automatic spending cap.","AWS Budgets monitors costs or usage against a target you define for a period, such as a month. It helps you notice when consumption is moving beyond your plan so you can respond.",{"slug":2063,"title":2064,"focus":2065,"teaser":2066},"aws-cost-explorer-spending-analysis-clf-c02","AWS Cost Explorer: spending analysis","How to use cost and usage reports, filtering, grouping, and forecasts to understand spending patterns over time.","AWS Cost Explorer turns AWS cost and usage data into interactive charts and tables. A cost view shows money spent; a usage view shows quantities consumed, such as running hours or storage. Compare usage with matching units: adding unrelated quantities does not produce a meaningful total.",{"slug":2068,"title":2069,"focus":2070,"teaser":2071},"aws-budgets-vs-aws-cost-explorer-clf-c02","AWS Budgets vs AWS Cost Explorer","When to use AWS Budgets for monitoring defined budget thresholds rather than AWS Cost Explorer for investigating spending patterns and cost drivers.","AWS Budgets monitors costs against a budget you define. Choose it when your question is, “Has spending crossed the threshold I want to watch?” Its value is ongoing attention to a defined target, with notifications configured for that target.",{"id":2073,"title":2074,"subtitle":152,"lessons":2075},201,"Identify AWS technical resources and AWS Support options",[2076,2081,2086,2091,2096,2101],{"slug":2077,"title":2078,"focus":2079,"teaser":2080},"aws-prescriptive-guidance-vs-aws-knowledge-center-clf-c02","AWS Prescriptive Guidance vs. AWS Knowledge Center","When to choose recommended approaches and implementation patterns rather than articles answering common questions and troubleshooting problems.","AWS Prescriptive Guidance and AWS Knowledge Center are official AWS technical resources, not services that deploy or manage your infrastructure. The useful distinction is the kind of help you need: a recommended approach for achieving an objective, or a focused answer to a question or problem.",{"slug":2082,"title":2083,"focus":2084,"teaser":2085},"aws-re-post-community-based-technical-help-clf-c02","AWS re:Post: community-based technical help","How to find and use community answers on re:Post and recognize when AWS Knowledge Center or AWS Prescriptive Guidance is a better resource.","AWS re:Post is a public technical knowledge community at https:\u002F\u002Frepost.aws\u002F. It contains questions, answers, and technical articles about building and operating on AWS. Community members and AWS experts share knowledge so that others can reuse it.",{"slug":2087,"title":2088,"focus":2089,"teaser":2090},"acceptable-use-policy-reporting-cloud-resource-abuse-clf-c02","Acceptable Use Policy: reporting cloud resource abuse","How acceptable-use boundaries identify suspected AWS resource abuse and how to report it to AWS Trust and Safety with useful evidence.","The AWS Acceptable Use Policy (AUP) sets boundaries for how customers and their users may use AWS services. These boundaries apply to activity through cloud resources, including virtual machines, websites, storage, and messaging systems. The AUP works alongside service agreements and applicable law to protect customers, internet users, and AWS infrastructure.",{"slug":2092,"title":2093,"focus":2094,"teaser":2095},"aws-partner-network-benefits-for-participating-organizations-clf-c02","AWS Partner Network: benefits for participating organizations","How participating organizations access training, certification resources, events, and eligibility-dependent commercial benefits without receiving automatic discounts on AWS usage.","The AWS Partner Network (APN) is an ecosystem of participating organizations. It helps those organizations develop AWS skills and grow their businesses. It is not a cloud runtime service or an AWS Support plan.",{"slug":2097,"title":2098,"focus":2099,"teaser":2100},"license-entitlements-software-usage-rights-in-aws-marketplace-clf-c02","License Entitlements: software usage rights in AWS Marketplace","How AWS Marketplace purchases establish software usage rights, including quantity and duration limits, that supported products can check and apply.","AWS Marketplace helps customers purchase third-party software. The purchase agreement defines the customer's license entitlements: the rights to use that software. These can include a product edition, enabled features, a licensed quantity, and a period of use. An entitlement record represents those rights; it does not replace the agreement.",{"slug":2102,"title":2103,"focus":2104,"teaser":2105},"aws-solutions-architects-architectural-guidance-clf-c02","AWS Solutions Architects: architectural guidance","How solutions architects translate workload requirements into design options and trade-offs while customers remain responsible for implementation and validation.","AWS Solutions Architects are customer-facing technical advisors who help organizations design and improve workloads on AWS. A workload is an application or system that delivers a business function. Architectural guidance connects what that workload needs to possible designs.",{"id":155,"code":24,"slug":19,"dateLastDay":152,"whatChanged":152,"pageSlug":25},1793320643547]