AWS Certified CloudOps Engineer - Associate (SOA-C03) Course

AWS CloudTrail provides evidence of AWS activity. Use it when the question is about an AWS API action: which identity requested a change, what action was requested, and when. For example, investigating who requested a database configuration change calls for activity evidence, not a graph of database performance.

Amazon Managed Service for Prometheus provides a managed backend for Prometheus-compatible metrics. Choose it when you want to keep Prometheus instrumentation, labeled time series, and PromQL queries without operating the metrics storage and query infrastructure yourself. It is especially useful for teams already using the Prometheus ecosystem to monitor containers.

AWS CloudTrail records supported AWS API activity so you can investigate who did what, to which resource, and when. Start by naming the actions you need evidence for. Changing a workload's configuration and using that workload are different audit needs.

AWS CloudTrail records AWS API activity so you can investigate who requested an action, what they requested, and what happened. Calls can originate from the console, command-line tools, SDKs, or AWS services. Coverage depends on the supported event types and the recording configuration; do not assume every action appears automatically.

Amazon Managed Service for Prometheus stores Prometheus-compatible metrics in a workspace. Creating a workspace gives you a destination for ingestion; it does not, by itself, configure collection from your applications.

Amazon Bedrock automatically publishes inference metrics to Amazon CloudWatch in the AWS/Bedrock namespace. Use invocation counts, latency, errors, throttles, and supported token-count metrics to understand workload health. Select the appropriate model dimensions and statistic: a sum answers a count question, while a latency percentile helps reveal slow requests.

Log retention defines how long records remain available. Choose the duration from troubleshooting, investigation, and contractual requirements—not one default for every workload. Also decide how quickly older records must be retrieved. Collecting logs and retaining them are separate tasks.

An alerting rule defines a condition over metrics already stored in an Amazon Managed Service for Prometheus workspace. You upload Prometheus-compatible rule definitions into a rule groups namespace. Each rule group is evaluated repeatedly at its configured interval; an alerting rule includes an alert name and a PromQL expression in expr.

Amazon EKS runs Kubernetes. An EKS cluster includes a Kubernetes control plane and the compute used to run workloads. AWS manages the control plane; application containers and monitoring collectors run on workload compute, not inside that managed control plane.

EC2 publishes metrics such as CPU utilization and network traffic without a guest agent. To collect memory utilization, filesystem space used, and operating system or application logs, install and configure the CloudWatch agent inside the instance. Enabling EC2 detailed monitoring does not add these guest measurements.

For an ECS cluster running on EC2, deploy the CloudWatch agent as an ECS service with the DAEMON scheduling strategy. ECS places one service task on each eligible container instance, including newly added instances. Eligibility depends on placement constraints and available resources; you do not maintain a desired task count.

The Amazon CloudWatch Observability EKS add-on installs and manages the collectors used for Container Insights: the CloudWatch agent for infrastructure telemetry and Fluent Bit for logs. You enable the add-on on an existing EKS cluster rather than installing a collector in every application container.

Amazon SNS delivers messages published to a topic to its subscriptions. Choose it when an AWS service already provides the notification you need and the next job is delivery to subscribers, such as an operations email list.

An Amazon SNS topic is a destination that publishers send messages to. A subscription connects that topic to a recipient endpoint. Publishers address the topic, not each recipient, so you can change recipients without changing every publisher.

An EventBridge rule matches an event pattern on one event bus and sends matching events to configured targets. AWS service events normally arrive on the default event bus in the Region where they occur. CloudWatch sends state-change events for metric and composite alarms; these are changes of state, not repeated reminders while an alarm stays in ALARM.

AWS Lambda runs a handler when an event invokes the function. The handler receives event data, decides whether action is needed, and calls AWS APIs. You provide the code; Lambda manages the compute that runs it.

A source account owns the metrics and alarms. A monitoring account displays them in a CloudWatch dashboard. In the role-based sharing pattern, the source account keeps control of access by providing a role that trusted monitoring callers can assume.

A CloudWatch dashboard is a saved layout of widgets. Dashboards are global within an AWS account, but the metrics and alarms they display belong to particular accounts and Regions. A dashboard brings those views together; it does not move the underlying resources or metric data.

Amazon SNS separates publishers from recipients. A publisher sends a notification to a topic; SNS distributes it through the topic's subscriptions. Publishers need the topic's address, not a list of recipients.

CloudWatch anomaly detection uses historical metric data to model expected behavior. Its anomaly detection band has an upper and lower boundary that change over time. The model can account for trends and recurring hourly, daily, or weekly patterns, so a normal daytime traffic peak need not look like an incident.

CloudWatch Internet Monitor helps locate internet connectivity problems between users and your AWS application resources. It uses AWS network observations and your application's traffic patterns; you do not install an agent on users' devices. Start in the CloudWatch console, open Internet Monitor, and create a monitor.

CloudWatch Network Monitor sends synthetic probe traffic from an AWS subnet to a destination IP address. It measures round-trip latency and packet loss without requiring you to install a monitoring agent on an EC2 instance.

An Automation runbook is a Systems Manager document that defines an operational workflow. An execution is one run of that document with particular inputs. Start with an AWS-provided runbook when its steps match your task: for example, AWS-StartEC2Instance starts an EC2 instance. Read its parameters, permissions, and effects before using it. Create a custom runbook when you need your own checks, branching, or sequence of actions.

Kiro is a development tool that can help investigate performance problems using information you supply or make available through configured tools. It is not a monitoring service and does not automatically see production telemetry. Start a conversation with the affected operation, the incident time window, the expected behavior, and the observed change.

Amazon SQS is a durable work queue. A producer sends messages, and workers receive them when they have capacity. The queue holds a backlog within its configured retention period, so producers and workers do not have to run at the same pace.

An EventBridge rule matches events on an event bus and sends matching events to its configured SQS target. Once SQS accepts a message, EventBridge delivery has succeeded; processing that message is a separate responsibility.

An AWS SDK lets a script call service APIs using language-native methods. In Python, Boto3 uses its credential provider chain to find configured credentials, such as environment credentials, a local profile, or temporary credentials from an attached IAM role. Prefer temporary credentials and never embed access keys in source code. Temporary credentials include a session token, which the SDK handles when obtained through a supported provider.

Idempotency means that repeating the same logical request does not change its intended effect. A runbook needs this because a request can succeed even when its response is lost. Retrying must not undo the first action or add another unwanted effect. Responses, logs, and execution counts can still differ.

Resource utilization is how much available capacity a workload uses. Measure CPU, memory, storage, and network separately: spare CPU does not compensate for exhausted memory. The goal is enough capacity to meet performance and resilience needs, not a universal utilization percentage.

Resource tags are key–value metadata that let you organize infrastructure by business purpose rather than resource identifier. Use Application=Payments to identify a workload, Environment=Development to separate its development resources, and Owner=PaymentsPlatform to identify the accountable team. The same resource can participate in several management views without being moved or copied.

An EC2 instance type defines a resource envelope: vCPUs, memory, storage capabilities, and network performance. The family emphasizes a resource mix; the size selects capacity within that family. Compute-optimized instances suit CPU-heavy work, while memory-optimized instances suit workloads that need more RAM. More vCPUs will not fix a memory shortage or automatically accelerate a single-threaded application.

Right-sizing matches compute capacity to workload demand, with enough headroom to meet performance and reliability requirements. It can mean reducing an oversized instance, increasing an undersized one, or choosing a different instance family. The smallest configuration is not necessarily the right configuration.

AWS Compute Optimizer analyzes resource configuration and historical utilization to recommend better-fitting resources. For an EC2 instance, rightsizing can mean choosing a smaller instance, a larger instance, or a different instance family. Low average CPU utilization alone is not enough to justify downsizing: peaks, memory demand, network traffic, and storage activity can affect the fit.

AWS Trusted Advisor provides a broad review of your AWS environment using best-practice checks. Its checks cover areas such as cost optimization, performance, security, fault tolerance, operational excellence, and service limits. Use it to ask, Where does this environment need attention?

IOPS measures completed input/output operations per second. Throughput measures bytes transferred per second. In Amazon CloudWatch, add the Sum of VolumeReadOps and VolumeWriteOps over the same period, then divide by the period in seconds to calculate average IOPS. Use VolumeReadBytes and VolumeWriteBytes in the same way for throughput.

An S3 storage class belongs to an object, not to the whole bucket. Objects in the same general purpose bucket can use different classes. Choose by access frequency, retrieval requirements, and whether the data can be recreated—not just by the storage rate.

S3 Lifecycle transitions change an object's storage class while retaining its data and key. They are different from expiration, which removes data according to the bucket's versioning behavior. Use transitions when access requirements change predictably as objects get older.

Throughput is the amount of data transferred per unit of time. For a large object, multipart upload lets a client send separate parts instead of the entire object in one request. The parts can upload independently, so a failed part can be retried without restarting the whole object.

An AWS DataSync task defines a source, a destination, and transfer settings. Each run is a task execution. For transfers into Amazon S3, performance depends on both moving the bytes and doing the surrounding work: discovering items, comparing them, and verifying results.

A shared file system gives multiple clients access to files and directories through a common namespace. Start selection with the application's existing file contract: its protocol, permissions, locking, and directory operations. NFS is common for Linux and Unix; SMB is common for Windows. A supported protocol is necessary, but it does not prove that every application operation will behave correctly.

Shared storage means several application instances can access the same data. Both Amazon S3 and Amazon EFS support this, but they expose different interfaces. Choose the interface the application needs before comparing speed or price.

Shared file storage lets multiple clients work with files and directories in a common file system. Choosing it starts with the application's contract: the access protocol it uses and the file behavior it expects, such as permissions and locking. A service being managed does not make it compatible with every application.

Amazon EFS lets multiple Linux clients share files through NFS. Storage capacity grows and shrinks as files are added or removed, but capacity and throughput are different choices: throughput is the rate at which clients can read and write data across the file system.

Amazon FSx is a family of managed file systems, not one file system with interchangeable protocols. Start with the application's required protocol and file-system behavior. More throughput cannot make an incompatible file system work.

Amazon S3 Files provides shared file access to data in an S3 bucket. Applications mount a file system and use file operations, such as opening a path or reading a directory, instead of issuing S3 object API calls themselves. Multiple authorized hosts can access the shared file system.

Start a performance investigation by identifying the slow period and comparing it with normal activity under similar traffic. Amazon RDS publishes resource metrics to Amazon CloudWatch. Look at related metrics together: high CPU, low available memory, storage latency, and growing connection counts point toward different investigations. A single high reading does not establish the cause.

For provisioned Amazon RDS DB instances, increasing capacity can mean increasing compute, increasing storage space, or adding read capacity. These are separate changes. This lesson uses RDS for MySQL and PostgreSQL as examples, rather than Aurora.

A connection pool keeps database connections available for reuse. A request borrows a connection, performs its database work, and returns it rather than opening a fresh network connection each time. Return connections in cleanup paths even after errors, roll back unfinished transactions, and reset session state as required by the driver. A leaked connection reduces the pool's usable capacity.

Amazon RDS Proxy is a managed connection layer between an application and a supported RDS or Aurora database. The application uses its normal database driver but connects to the proxy endpoint instead of directly to the database.

Data locality means placing compute near the data it uses and the peers it communicates with. Start with the Region: repeatedly scanning a dataset from another Region adds network distance and generally incurs inter-Region transfer charges. Running the scan in the data's Region avoids that boundary. Location requirements and recovery needs can still justify a separate Region.

Vertical scaling changes the capacity of an individual instance. Scaling up gives it more resources, such as CPU or memory; scaling down reduces those resources. The defining change is capacity per instance, not the number of instances.

A scaling mechanism describes how capacity changes. Horizontal scaling changes the number of workers serving a workload, such as application instances or container tasks. Adding workers is scaling out; removing workers is scaling in.

Elasticity requires a control loop: measure demand, decide whether capacity should change, and observe the result. In Amazon EC2 Auto Scaling, a dynamic scaling policy uses a metric to adjust an Auto Scaling group's desired capacity. The metric must indicate pressure that adding instances can actually relieve.

Vertical scaling changes the capacity of an existing resource. For a virtual machine, this usually means selecting an instance type with different CPU, memory, or bandwidth. Start with a baseline: record throughput, response time, errors, and resource use over representative demand, including busy periods. A brief CPU spike alone is not enough evidence for a resize.

Amazon EC2 Auto Scaling manages fleets of EC2 instances through Auto Scaling groups. A group treats instances as one unit for capacity management. Use this service when you need to maintain EC2 capacity, replace unhealthy instances, or change the size of an EC2 fleet as demand changes.

An Auto Scaling group manages EC2 instances as one pool of capacity. Its desired capacity is the amount it tries to maintain. Raising desired capacity causes instances to launch; lowering it causes instances to terminate. Actual capacity can temporarily differ while these changes happen.

An AWS Auto Scaling scaling plan collects scaling instructions for supported resources in an application. You identify the application resources, for example through an AWS CloudFormation stack or resource tags, and select the eligible resources to manage. The plan then manages scaling policies for those resources.

Read offloading means answering repeated reads without repeating the same work at the source. A cache hit uses a reusable cached copy; a cache miss requires work farther downstream. Caching helps demand grow without making every additional request consume the same origin or database capacity.

Amazon CloudFront caches HTTP responses at edge locations near users. A reusable image, page, or API response can be served without asking the origin to produce it again. CloudFront can cache eligible dynamic responses, not just static files.

Cache-aside keeps reusable copies of database results in a separate cache. The application checks that cache first. A hit supplies the result without a database read. On a miss, application code reads the database, fills the cache with an expiration time, and returns the result. Unlike read-through caching, the cache does not fetch the missing data itself.

Time to Live (TTL) defines how long a cached response can normally be reused without checking its source. During that lifetime, the response is fresh according to the cache's rules. Fresh does not mean identical to the latest origin content: the origin can change while the cached response remains fresh.

Amazon ElastiCache provides a managed, in-memory cache. In cache-aside, application code first looks for a reusable copy of data in the cache. A cache hit supplies the value without a database read; a cache miss makes the application read the database and populate the cache for later requests.

Amazon CloudFront reduces origin work by reusing cached responses. The diagram shows request and control flows, not response arrows. A cache key identifies the cached response to look up; requests with the same key can reuse that response while it is fresh.

CloudFront chooses a cache behavior for the requested path. That behavior's cache policy controls the cache key and freshness settings. The key identifies a cached response: it includes the URL path and can include selected query strings, headers, and cookies. Requests with the same key can reuse a response, provided it is eligible and usable.

Cache invalidation removes outdated copies so later reads can obtain current data. In this application, a product response can be cached in the browser, in CloudFront, and as application data in ElastiCache. Changing the database does not automatically refresh those copies.

A read-capable replica maintains a copy of database data and can answer queries. Moving suitable reads from the writer to replicas spreads query work across database instances. This can increase read throughput: the amount of read work completed over time.

A provisioned Aurora cluster has database instances whose CPU and memory depend on their DB instance class. Modify an instance and select another supported class when it needs different compute capacity. Resize the writer for writer resource pressure, or a reader when that reader needs more resources.

Amazon Aurora is part of the RDS family, but its storage architecture differs from RDS for MySQL and PostgreSQL. Here, the comparison is between a standard Aurora cluster and an RDS DB instance with a separate read replica.

Amazon Aurora Serverless is a compute option for Amazon Aurora, not a separate database engine. Aurora supports MySQL-compatible and PostgreSQL-compatible databases. The comparison here is between Aurora Serverless v2 compute and provisioned Aurora compute: how much processing capacity is available, and who adjusts it.

Aurora Serverless v2 adjusts a database instance’s compute capacity as demand changes. Capacity is measured in Aurora Capacity Units (ACUs), which represent memory with corresponding CPU and networking resources. Aurora scales in small increments rather than switching between fixed instance sizes. Normal compute scaling does not require restarting the instance, but available capacity still affects workload performance.

DynamoDB manages its servers and storage, but your workload still needs enough read and write throughput. Read and write capacity are separate: spare read capacity cannot cover a shortage of write capacity.

A registered target is not automatically ready for requests. An Application Load Balancer (ALB) checks targets using the health-check settings of their target group. Normally, it routes requests to healthy targets and excludes unhealthy ones. Checks continue while a target is unhealthy, allowing it to recover.

Route 53 helps a client discover a destination through DNS. ELB target health helps a load balancer decide which registered targets can receive traffic after the client reaches it. These are separate decisions, not two versions of the same check.

Amazon Route 53 uses health information to choose DNS answers; it does not forward application traffic. An endpoint health check independently probes a configured destination using HTTP, HTTPS, or TCP. For HTTP or HTTPS, choose a path that represents application readiness; optional string matching can verify expected content. A check of a page that always succeeds can hide an application failure.

An Availability Zone is an infrastructure failure domain within an AWS Region. Each zone consists of one or more discrete data centers with redundant power, networking, and connectivity. Zones are physically separated and designed not to share single points of failure in their supporting infrastructure.

Fault tolerance starts with a specific failure to survive. Here, the goal is to keep serving requests when either one EC2 instance or one Availability Zone becomes unavailable. Availability Zones are separate failure domains within a Region, with independent power, cooling, and physical infrastructure. Two instances in one zone protect against an individual instance failure, but not the loss of that zone.

Failover transfers work from an unhealthy resource to a healthy alternative. It needs three things working together: health detection, capacity outside the failed Availability Zone, and a way to redirect work.

Fault isolation limits how far a failure spreads. A failure domain contains resources that can be affected by the same event; the resulting scope of damage is the blast radius. Isolation asks, “What else can this failure affect?” It does not answer, “Can users still complete their work?”

Failover transfers responsibility from an unhealthy component to a healthy alternative. It answers: “Where will the work go now?” Fault tolerance means maintaining correct service despite the failures covered by the design. It answers: “Can the service still do its job while something has failed?”

An EBS snapshot is a point-in-time recovery point for an EBS volume’s block data. AWS stores EBS snapshots in Amazon S3, but manages that storage for you. The snapshot is not an object placed in a customer-accessible S3 bucket.

An EBS volume is the block storage an application reads and writes through an EC2 instance. An EBS snapshot is a point-in-time backup of that volume’s data. Replication within an Availability Zone protects a volume against infrastructure failures, but it also preserves unwanted writes. A snapshot lets you recover an earlier state after accidental deletion or corruption.

An Amazon Machine Image (AMI) is a reusable starting point for launching EC2 instances. An EBS-backed AMI references snapshots containing the operating system, installed software, and data on included EBS volumes. It also records image metadata and block device mappings. It does not capture running memory or the contents of instance store volumes.

A recovery point is the database state you can restore. Your recovery point objective (RPO) is how much recent data you can afford to lose. For RDS DB instances, enabled automated backups combine daily backups with transaction logs to support point-in-time recovery within the configured retention period.

Amazon DynamoDB offers two ways to recover earlier table data. An on-demand backup preserves a full table backup at a particular point. Use it for a named recovery checkpoint, such as before a bulk update. Native DynamoDB on-demand backups remain available until you delete them, independently of the source table.

S3 Versioning preserves multiple versions of an object under the same key, such as reports/monthly.csv. In a general purpose bucket, enabling versioning helps recover from accidental overwrites and deletions. The setting applies to the bucket, not to selected objects.

AWS Backup centrally manages backups for supported resources, including EC2 instances, EBS volumes, RDS databases, DynamoDB tables, and S3 buckets. Support and setup requirements vary by resource type and Region. Check the relevant service opt-in settings and prerequisites before relying on a plan.

A snapshot restore recovers the state captured by a particular backup. For example, an Amazon EBS snapshot can create a new volume, and an Amazon RDS DB snapshot can create a new DB instance. Restoring data does not, by itself, reconnect the application or prove that its data is usable.

Recovery Time Objective (RTO) is the target maximum time that a service can remain unavailable after a disruption. For database-backed applications, recovery ends when users can complete the required business operations—not merely when the database reports that it is available. Define that finish line, such as successfully submitting and retrieving an order.

Point-in-Time Recovery (PITR) reconstructs a database at a selected historical time. A common implementation starts with a baseline backup and applies retained transaction logs or other change history through the requested time, excluding later changes. A snapshot alone restores its captured state; PITR can offer recovery points between snapshots.

A shadow copy preserves the state of files at a point in time on Amazon FSx for Windows File Server. Later edits do not change that saved view. It is not a history of every save: a change is recoverable only if an available shadow copy captured the state you need.

Backup and restore preserves recoverable states and uses them to recover data or supported resources. A backup records a state that can be retained; a restore makes that preserved state usable again. This helps recover from problems such as deleted records or corrupted files.

A recovery strategy determines what is ready before a disruption and what must happen afterward. Choose it against two targets: recovery time objective (RTO), the maximum acceptable time to restore service, and recovery point objective (RPO), the maximum acceptable data loss measured in time.

A pilot light keeps an essential core operating in the recovery location, not a complete application ready for users. Here, an Amazon RDS Cross-Region read replica receives database changes while recovery application instances remain absent or stopped. Choose an RDS engine and configuration that support this replication design.

Warm standby keeps a complete, working application environment running at reduced capacity in a separate recovery location. Its application tiers, networking, data stores, and supporting dependencies already exist. Recovery should not depend on first deploying a missing application tier.

Pilot light and warm standby both prepare a recovery location before a disruption. The key difference is whether a working application is already running there—not simply whether a database replica exists.

Active-active means that multiple environments serve production traffic at the same time; they do not need equal shares. For regional continuity, each Region needs an independently operable stack. Spreading servers across Availability Zones in one Region does not protect against losing that Region.

Active-active means multiple environments serve production traffic at the same time. The traffic shares do not have to be equal: an environment handling a small but regular share of real requests is still active. The defining feature is concurrent production service, not the number of running servers.

Amazon ECR stores container images; it does not build or run them. In this lesson, use a private repository named app. Set REGION and ACCOUNT_ID to your destination, then set REGISTRY=${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com. Create the repository with aws ecr create-repository --repository-name app --region "$REGION". Your AWS identity needs permission to obtain an ECR authorization token and perform the required repository operations.

EC2 Image Builder automates creating reusable images. Its outputs are Amazon Machine Images (AMIs) for launching EC2 instances and container images for container workloads. Instead of configuring every new machine by hand, you describe how to build and check an image.

A distribution configuration tells EC2 Image Builder where to publish a completed image. It specifies destination settings for selected AWS Regions. Distribution makes an artifact available for deployment; it does not replace running instances or containers. A deployment system must consume the new image and perform the rollout.

Immutable infrastructure treats deployed compute as a replaceable copy of an approved definition. To change its software, update the build definition, build and test a new image, and replace the instances or containers. Normal releases do not depend on logging into production and changing installed files.

AWS CloudFormation provisions infrastructure from a declarative template written in YAML or JSON. The template describes the resources and properties you want, rather than a sequence of API calls. CloudFormation manages those resources as a stack and coordinates their creation and updates.

An AWS CloudFormation template is a JSON or YAML document describing desired infrastructure. A stack is a collection of resources CloudFormation manages as one unit using that template. Creating a stack provisions its resources; editing a template file alone changes nothing in AWS.

A CDK app contains one or more stacks. Each stack is a deployment unit managed through AWS CloudFormation. Inside a stack, you create constructs: objects that describe resources or reusable groups of resources. Creating these objects runs your infrastructure definition; it does not yet create AWS resources.

A stack status summarizes an operation; it rarely explains the underlying fault. Open the stack's Events tab and examine the failed operation's timeline. Events include a timestamp, resource logical ID, resource status, and status reason. The logical ID connects an event to its resource definition in the template.

CloudFormation drift detection compares the actual configuration of stack resources with the expected configuration defined by the deployed stack template and its parameter values. An out-of-band console or API change can create drift without changing the template. Detection reports differences; it does not repair them.

A StackSet lets you provision a common CloudFormation template across selected AWS accounts and Regions. Each stack instance is a StackSet record for one account–Region pair and refers to the stack deployed there. These are separate stacks, not one stack stretched across Regions.

An IPv4 address has 32 bits. In CIDR notation, the number after the slash tells you how many bits identify the network. The remaining bits determine the range size: total addresses = 2^(32 − prefix). A larger prefix number means a smaller range; moving from /26 to /27 halves the total addresses.

A CIDR block describes a range of IP addresses. In IPv4, the prefix after the slash says how many of the 32 bits identify the network. A smaller prefix number leaves more address bits: 10.0.0.0/16 is larger than 10.0.0.0/24. Choose VPC ranges with room for growth and without overlap with networks you expect to connect.

Effective permissions are the authorization result for a particular principal, action, resource, and request context. An identity policy containing an Allow is evidence of a grant, not proof that the request will succeed. Without an applicable grant, the result is an implicit deny; an applicable explicit deny overrides an allow.

IAM authorization evaluates a request: which principal is acting, which action it requests, which resource it targets, and the request context. A policy statement contributes only when its action, resource, principal where specified, and conditions match. For example, allowing s3:ListBucket on a bucket does not allow s3:GetObject on objects inside it.

An IAM role is an identity that can be assumed to obtain temporary credentials. Its trust policy answers “Who may assume this role, and under what conditions?” Its permissions policies answer “What may a session using this role do?” Allowing someone to assume a role does not, by itself, grant access to application resources.

Investigate access using a specific request, not just a user's description of their permissions. In AWS CloudTrail, locate the matching event using the time, account, Region, and API operation. Inspect eventSource, eventName, requestParameters, and any recorded resource details. For a failure, read errorCode and errorMessage; an access-denied message may provide useful policy clues, but does not always identify the exact policy responsible.

Service Quotas lets you inspect supported AWS quotas and request increases where supported. A quota limits resources, throughput, or operations; it does not provision resources or reserve capacity. Start with the failed resource's error message. For a CloudFormation deployment, inspect the failed resource event rather than treating the overall stack failure as the cause.

AWS Resource Access Manager (AWS RAM) lets an owning account share supported resources without copying them or transferring ownership. For example, accounts can use a shared transit gateway while its owner continues to manage it. Support depends on the resource type; RAM is not a way to share every AWS resource.

A rolling deployment updates or replaces a serving fleet in successive batches. Old and new versions coexist until the rollout finishes. Choose a batch size that leaves enough healthy capacity for demand, not simply a size that finishes quickly. Smaller batches affect fewer resources at once but usually extend deployment time.

Blue-green deployment separates preparing a release from exposing it to users. Blue serves the current application while you provision green and deploy the replacement. Use infrastructure as code and versioned application artifacts to make green reproducible, with production-equivalent configuration, permissions, network access, and enough capacity for production demand.

Both strategies release a new application version while keeping the service available, but they change different units. Blue-green deployment prepares a complete replacement environment alongside the current one. Once the replacement is ready, production traffic switches to it. The colors name the environments; neither color must always mean production.

A canary deployment gives a candidate version limited real production traffic while the stable version serves the rest. Deployment makes the candidate available; traffic exposure determines how many requests reach it. The candidate is serving real users, not just receiving test requests.

Rolling deployment changes a serving fleet in successive batches. Some instances run the new version while others still run the previous version. Its defining control is how much of the fleet is updated at once, often with health checks before the next batch.

Blue-green deployment separates the current release from its replacement. Blue serves the current version while green provides a separate environment for the candidate. A classic blue-green release switches production routing to green in one cutover rather than deliberately starting with a small live audience.

AWS CodeDeploy coordinates application deployments; it does not build the application. An application revision is a bundle containing deployable files, an AppSpec file, and any deployment scripts. The diagram uses Amazon S3 to store that bundle and shows an EC2 blue/green deployment.

AWS CodeDeploy manages blue/green releases for ECS and Lambda: the current application remains available while a replacement is introduced. CodeDeploy controls the transition; it does not sit in the application request path.

A Git repository stores infrastructure definitions and their history. A commit records a snapshot of tracked files, links to its parent history, and includes author information and a message. Its commit ID identifies that revision. Changing committed content creates a different commit; it does not update the existing snapshot.

Terraform describes desired infrastructure in configuration files, usually written in HCL. Resources describe objects to manage, providers connect Terraform to service APIs, and input variables let a shared design use different settings in development and production. Repeatability means deploying a controlled design consistently, not making every environment identical.

AWS CodeBuild can run deployment tools as well as compile applications. In this example, a Git repository in AWS CodeCommit holds Terraform configuration and a buildspec.yml file. When a build starts, CodeBuild downloads the configured source revision and runs the buildspec commands.

An AWS Config rule reports whether a resource meets a requirement; it does not itself change the resource. Attach a remediation action to the rule to identify the corrective work. AWS Config invokes an AWS Systems Manager Automation runbook to perform that work.

AWS Step Functions coordinates actions performed by other AWS services. A state machine defines the procedure; an execution is one run with its own input and progress. For example, one execution can check a resource, decide whether repair is necessary, and report an unsuccessful repair.

An event records something that happened. An S3 Object Created event says that an object was created; it does not tell every consumer which action to perform. Each handler chooses its own response.

S3 event notifications describe changes to objects in a general purpose bucket. In the bucket's Properties, create an event notification by choosing event types, optional object-key filters, and a destination. The notification contains event details and an object reference, not the object's contents.

AWS DevOps Agent investigates application incidents by connecting operational symptoms with evidence. An alert delivered through a configured integration can initiate an investigation; the alert identifies a problem to examine, not a proven root cause.

Least privilege means granting the access needed for a task without unrelated capabilities. Describe the task using four questions: which principal makes the request, which actions it needs, which resources it uses, and which conditions must hold. For an invoice reader, reading approved invoice objects is required; deleting objects or changing bucket policies is not.

An account password policy sets rules for IAM user console passwords across an AWS account. Use a custom policy to set minimum length, required character types, password expiration, and prevention of password reuse. It can also let IAM users change their own passwords and require an administrator to reset expired passwords.

An IAM account password policy governs the console passwords of IAM users in one AWS account. It is an account-wide setting, not a policy document attached to a user or group. You cannot assign different account password policies to different IAM groups. If you have not configured a custom policy, AWS applies its default password policy.

Role-Based Access Control (RBAC) groups permissions around a responsibility, such as reading development reports, rather than creating a different permission set for every person. Start with the tasks the job needs, not a broad policy whose name sounds suitable. Authentication establishes identity; authorization determines what that identity may do.

AWS Identity and Access Management (IAM) defines identities and permissions. Use it to create IAM users, organize users into groups, create roles, and manage policies. Policies describe which actions are allowed or denied on which resources, with conditions where needed.

A role session is temporary access as an IAM role. A caller requests it from AWS STS using AssumeRole, identifying the role and providing a session name. The role's trust policy controls which principals may assume it and under which conditions.

Identity federation lets AWS accept evidence of authentication from an external identity provider. The provider authenticates a person or workload and issues a signed assertion or token. AWS does not need a copy of that identity's password or a separate IAM user for it.

Multi-factor authentication (MFA) combines different factor categories, such as a password and possession of an authenticator. It strengthens authentication; it does not grant permissions. For routine human access, prefer federation and temporary role credentials over IAM users with permanent access keys.

AWS Identity and Access Management (IAM) defines identities and permissions for access to AWS resources. Its policies describe allowed or denied actions on resources, with optional conditions. For example, a policy can allow an IAM role to read objects from one S3 bucket without allowing it to delete them. IAM supports both people and workloads, such as applications running on AWS.

An organization instance of AWS IAM Identity Center manages workforce access to accounts in AWS Organizations. Use this instance type for multi-account access; an account instance supports certain applications but does not manage AWS account access. Users and groups come from the configured identity source, such as the Identity Center directory or an external identity provider.

Attribute-Based Access Control (ABAC) uses attributes in policy conditions to decide access. In AWS, an IAM policy can allow selected actions when the caller's principal tag matches a resource tag. Tags do not grant permissions by themselves: an applicable Allow must name the action and resource, and its conditions must match.

Role-Based Access Control (RBAC) groups permissions around approved responsibilities, such as auditor, developer, or application operator. An auditor's permissions might allow reading configuration but not changing it. Administrators assign people to the appropriate roles instead of maintaining a separate permission list for every person. Each role still needs an appropriate resource scope.

An AWS authorization failure can come from two different causes. An explicit deny is a matching policy statement with Effect: Deny. An implicit deny means the request lacks the permission required by its applicable authorization path. The difference determines what you must change.

AWS Organizations arranges accounts beneath an organization root. An organizational unit (OU) groups accounts and can contain other OUs. The organization root is a container, not an account's root user. Using service control policies (SCPs) requires the organization's all-features mode and the SCP policy type enabled.

A service control policy (SCP) in AWS Organizations sets a maximum permission boundary for principals in member accounts. It does not grant permission to use a service. An action must fit inside this ceiling and still be authorized by the applicable access policies, such as an IAM policy.

Blast radius is the potential reach of a failure or compromise. Separate AWS accounts give workloads distinct identity and resource permission boundaries. A stolen development role does not automatically gain production access just because both accounts belong to the same AWS Organization. Separate development and production, and separate workloads with different trust requirements, to reduce potential exposure.

An AWS Control Tower landing zone is a governed, multi-account environment built on AWS Organizations. It establishes shared security and operational foundations so that each team does not have to invent its own account setup. Accounts are arranged into organizational units (OUs), which provide boundaries for applying governance controls.

AWS Organizations provides the foundation for managing multiple AWS accounts. It lets you create or invite accounts, group them into organizational units (OUs), manage organization policies, and consolidate billing. You can operate these capabilities directly through the console or automate them through APIs.

AWS Trusted Advisor security checks identify configurations that need attention and recommend improvements. In the Trusted Advisor console, open the Security category and select a check. Read its description and alert criteria: the check name alone does not explain exactly what was evaluated.

A compliance obligation describes what must be true; a control describes how you make it true and demonstrate it. Start by identifying the data and applicable requirement. Then record the control's scope, owner, implementation, and evidence. For example, translate “protect stored customer records” into specific access, encryption, and monitoring controls rather than a vague instruction to “use secure services.”

AWS Config records resource configurations and evaluates them against rules. A configuration item describes a resource at a point in time, including its settings and relationships. Recording a configuration is not the same as deciding whether it meets a policy.

AWS Config answers configuration questions: what settings did a resource have, how did those settings change, and does the resource satisfy a rule? It records supported resource configurations and evaluates resources against managed or custom rules. A compliance result belongs to a particular rule and resource; it is not a verdict on the whole organization's compliance.

Data residency means keeping specified data within an approved geographic boundary. Establish that boundary with legal and compliance teams, then map it to an explicit list of approved AWS Regions for each data class. A country, an economic area, and a Region are not interchangeable. Residency also does not, by itself, settle questions about legal jurisdiction or remote access.

A classification scheme groups information according to the harm caused by unauthorized disclosure, modification, loss, or unavailability. Labels such as public, internal, confidential, and restricted have organization-specific meanings. Define the criteria behind each label: public documentation may need little confidentiality protection but still need strong protection against unauthorized changes.

Amazon Macie discovers sensitive data in Amazon S3 object content. A sensitive data discovery job lets you target selected buckets, narrow the objects to inspect, and choose the types of sensitive data to look for. Use this evidence to support your organization’s classification scheme, such as Internal, Confidential, or Restricted.

Envelope encryption separates bulk-data encryption from protection of the encryption key. A data key encrypts and decrypts the data locally, inside the application or storage service doing the work. A separate KMS key protects an encrypted copy of that data key.

With envelope encryption, a data key encrypts the stored data, and a KMS key protects that data key. The integrated AWS service handles the data encryption; it does not send the whole object or volume to KMS for encryption.

Encryption at rest protects stored data. With server-side encryption, the storage service encrypts data as it stores it and decrypts it for authorized reads. The important configuration questions are: which resources are covered, when does the setting take effect, and what happens to existing data?

A KMS key is a logical resource with an identifier, permissions, and underlying cryptographic material. With supported native rotation, AWS KMS changes that material without changing the key ID, ARN, policies, or aliases. New encryption operations use the current material; KMS retains older material and selects the correct version when decrypting existing ciphertext.

Access to KMS-encrypted data depends on both storage permissions and permission to use the required KMS key. Being allowed to read an object does not, by itself, authorize decryption.

TLS protects traffic between the endpoints of a TLS connection. HTTPS is HTTP carried over TLS. When an intermediary terminates TLS, that connection ends there; protection for the next segment needs separate configuration.

Transport Layer Security (TLS) protects traffic against disclosure and undetected changes. During its handshake, endpoints agree on protocol settings and establish keys. For HTTPS, the client also checks the server certificate before trusting the connection.

AWS Certificate Manager (ACM) manages TLS certificates; the endpoint presents a certificate to clients to prove its identity. Requesting a public certificate does not immediately make it usable. ACM must first verify control of every domain name on the request, then change the certificate status from Pending validation to Issued.

Transport Layer Security (TLS) protects communication between a client and a server. In typical server-authenticated TLS, such as ordinary HTTPS, the server presents a certificate. The client validates that certificate and checks that it identifies the intended server. The server proves possession of the associated private key without transmitting the key.

A TLS termination boundary is where a TLS connection ends and its traffic is decrypted. Certificate validation belongs to that connection, not to the entire application request. When a proxy terminates TLS and opens another connection, the second connection needs its own trust configuration.

AWS Secrets Manager stores sensitive values such as database passwords and API tokens. Application code keeps a secret's name or ARN instead of its value, then retrieves the value when needed. A secret identifier tells the application what to request; it does not grant access.

Parameter Store, a capability of AWS Systems Manager, stores named values that applications can retrieve at runtime. For a secret such as a database password, create a parameter with type SecureString, rather than String or StringList.

AWS Secrets Manager stores credentials centrally so applications do not need passwords embedded in code or deployment files. It encrypts secret values using envelope encryption: a data key encrypts the value, and an AWS KMS key protects the data key. Secrets Manager stores the encrypted value and encrypted data key, not an unprotected password.

AWS Secrets Manager and AWS Systems Manager Parameter Store SecureString can both store encrypted sensitive values. A password does not require Secrets Manager simply because it is secret. The important difference is what must happen to that value after you store it: its lifecycle.

A GuardDuty finding describes suspected malicious activity, not a confirmed incident. Read its type, severity, affected resource, account, Region, and activity details together. Severity helps prioritize investigation; it does not prove that an action such as isolating an instance is appropriate. The occurrence count and first- and last-seen times help distinguish a single observation from continuing activity.

An Amazon Inspector finding connects a security issue to an affected resource. Open its details and identify the account, Region, resource ID, finding type, and status. For a package vulnerability, inspect the CVE identifier, affected package, installed version, and fixed version when available. One CVE can affect several resources; fixing one resource does not fix every finding for that CVE.

An AWS Security Agent assessment report describes weaknesses found using the inputs and access available to an assessment. Start by checking what was assessed: the supplied design documentation, the source revision, or the running application and its authorized testing scope. A report is not a statement that every part of the application was examined.

Security Hub CSPM consolidates security findings in the AWS Security Finding Format (ASFF). Filter findings by fields such as account, resource, severity, and workflow status to create a useful work list. Insights combine filters with a grouping field, such as resource ID, to summarize related findings. Cross-account and cross-Region visibility depends on the administration and aggregation you have configured; it is not automatically global.

Amazon GuardDuty asks, “Does this activity suggest a threat?” It analyzes supported activity data using threat intelligence, anomaly detection, and machine learning. Its findings describe potential threats, such as suspicious use of AWS credentials or communication with a malicious destination.

Amazon GuardDuty detects potential threats: suspicious or malicious activity involving AWS accounts, workloads, and data. Amazon Inspector identifies weaknesses: software vulnerabilities and network exposure in supported resources. The useful distinction is what appears to be happening versus what could be exploited.

AWS Security Agent assesses application security across design, source code, and running applications. Choose the assessment by the question you need answered, not simply by whether the application has been deployed.

IP routing selects where a packet goes next. A route pairs a destination range with a forwarding target. For example, an IPv4 default route, 0.0.0.0/0, can send traffic without a more specific route to a gateway. Selecting that target does not itself rewrite the packet's source address.

A subnet route table tells Amazon VPC where to forward traffic from a subnet. Each route pairs a destination address range with a target. Before reading routes, identify the table associated with the source subnet.

A route table maps destination address ranges to targets. Each subnet uses one subnet route table at a time. An explicit association selects that table; without one, the subnet implicitly uses the VPC's main route table. Several subnets can share a table. A table's name does not determine which subnets use it.

A security group filters traffic for associated network interfaces. It is stateful: connection tracking recognizes return traffic belonging to a permitted flow. That return traffic is allowed without a separate rule in the opposite direction. This does not authorize unrelated connections initiated in reverse.

A security group controls traffic at a resource's network interface, such as an EC2 instance's interface. A network ACL controls traffic entering or leaving an associated subnet. For traffic crossing a subnet boundary to reach an instance, both filters must permit it; an allow in one cannot override a block in the other.

A public NAT gateway lets a workload initiate IPv4 connections to the internet without giving the workload a public IPv4 address. The diagram shows the request and its reply; its arrows describe packet travel, not separate connections.

Network segmentation limits which workloads can communicate, reducing the paths available to a compromised workload. Start with the required source, destination, protocol, and port. Putting workloads in different subnets organizes them, but does not by itself enforce that boundary: VPC route tables normally include local routing between the VPC's address ranges.

Network isolation means allowing only justified communication, not necessarily disconnecting everything. A private address alone does not prove isolation: private routes can still connect a workload to other networks. Choose connectivity according to whether the workload needs one service or access to resources in another VPC.

A VPC endpoint gives workloads private access to a supported service without requiring an internet gateway, NAT device, or public IP address for that service traffic. It provides a network path, not automatic permission to use the service.

An interface endpoint gives clients private IP addresses through which to reach a supported service using AWS PrivateLink. AWS creates endpoint network interfaces in your selected subnets. Clients reach those interfaces rather than sending this service traffic through an internet gateway or NAT device.

A VPC peering connection lets resources in two VPCs communicate using private IP addresses. The VPCs can belong to different accounts or Regions. One owner requests the connection, and the accepting VPC's owner accepts it. An active connection is ready for use, but routes and traffic permissions still need configuration.

Amazon VPC provides your isolated virtual network. VPC peering is a feature that connects two VPCs so their resources can communicate using private IP addresses. AWS PrivateLink provides private access to supported services and resources. Here, we compare its interface-endpoint access to a published service with VPC peering.

An AWS Network Firewall policy defines how a firewall inspects traffic that reaches it. The policy references reusable rule groups and sets evaluation behavior and default actions. Attaching a rule group does not guarantee that every packet reaches its rules.

An AWS WAF web access control list, or web ACL, contains rules and a default action for web requests. Creating one does not protect every application in the account. Coverage depends on its scope, the resources associated with it, and the actions its rules actually apply.

AWS Network Firewall inspects network traffic directed through its inspection endpoints. It can protect inbound, outbound, or traffic between networks when the network design sends those flows through it. Its inspection is not limited to web traffic: TCP and UDP traffic can be inspected too.

Web ACL logging records the requests AWS WAF inspects and the decisions it makes. Enable it explicitly on the web ACL; request sampling and rule metrics do not replace request logs. Supported destinations are CloudWatch Logs, Amazon S3, and Amazon Data Firehose.

AWS Shield helps protect application availability against distributed denial of service (DDoS) attacks. Shield Standard is automatically available to AWS customers at no additional charge. It provides baseline protection against common network-layer and transport-layer DDoS attacks; you do not subscribe or enroll individual resources to receive it.

AWS Shield protects availability against distributed denial-of-service (DDoS) attacks. These attacks try to exhaust bandwidth, connection capacity, or application resources so legitimate users cannot get service. Shield Standard provides automatic protection against common network-layer and transport-layer DDoS attacks, such as UDP floods and SYN floods.

Data egress means data leaving a defined boundary. A copy between AWS Regions leaves the source Region even though it stays within AWS. Record each transfer's source, destination, direction, volume, and route; “outbound traffic” alone is not a pricing category.

AWS Cost Explorer turns billing data into cost and usage breakdowns over time. For network spending, start with a date range and group by Service to see which billing services contribute to the total. Network charges are not all collected under one service, so begin broadly before narrowing the report.

A network design is economical only if it still meets its connectivity, security, and availability requirements. Record each traffic flow: source, destination, Region, Availability Zone, intermediate services, and bytes in each direction over a representative period, including peaks.

A recursive resolver finds an answer for a client. It can return a cached answer or query other DNS servers. An authoritative server publishes the records for a zone: an administratively managed part of the DNS namespace. Amazon Route 53 provides both resolver capabilities and authoritative hosted zones, but these are different jobs.

A hosted zone is a container for DNS records for a domain and its subdomains. A public hosted zone answers internet DNS queries when the domain is delegated to its name servers. A private hosted zone answers through VPC DNS for associated VPCs; it does not publish its records to internet resolvers. Enable both enableDnsSupport and enableDnsHostnames on VPCs using private hosted zones.

A Route 53 routing policy determines which record values appear in a DNS answer. Route 53 does not forward the application's HTTP requests. A recursive DNS resolver can cache an answer for its TTL, so many application requests can follow one DNS lookup.

Split-horizon DNS lets the same fully qualified domain name return different answers through different resolution paths. For example, api.example.com can identify an internet-facing endpoint for public users and an internal endpoint for private-network clients.

Route 53 Resolver answers DNS queries from VPC workloads, including queries for private hosted zones associated with the VPC. Hybrid DNS extends that resolution across a private network connection: an inbound endpoint accepts queries coming into AWS, while an outbound endpoint sends selected queries from AWS to external DNS servers.

Amazon CloudFront is a content delivery network for HTTP and HTTPS. It understands web requests and can cache eligible responses at edge locations. A reusable cached response can be served without fetching it again from the origin, the source of the content. This reduces delivery latency and origin load.

A CloudFront distribution connects a public delivery endpoint to content sources called origins. One distribution can serve static files from S3 and application requests through an Application Load Balancer. A request does not go to every origin: its matching cache behavior selects one.

An AWS Global Accelerator standard accelerator gives clients static entry IP addresses for an application. These are anycast IPs: AWS advertises the same addresses from multiple edge locations, so network routing brings clients to an AWS edge entry point. Traffic then uses the AWS global network toward the application.

AWS Transit Gateway routes traffic between attached networks. A VPC attachment provides the connection, but creating it does not create every route needed for communication. Check that each attachment is available; an attachment awaiting acceptance or still pending is not ready to carry the traffic.

Asymmetric routing means a connection's forward and return packets take different paths. Different paths are not automatically wrong: the important question is whether both directions reach the stateful devices that must process the connection.

VPC Flow Logs collect metadata about IP traffic to and from network interfaces; they do not capture packet contents. Create a flow log on a VPC, subnet, or network interface. VPC and subnet scopes cover the network interfaces in that scope, including interfaces created later. Choose ALL to investigate both accepted and rejected traffic; ACCEPT and REJECT filters collect only their respective outcomes.

ELB access logs record traffic handled by a load balancer and deliver log files to Amazon S3. Logging is disabled by default and uses best-effort delivery. A missing record is not proof that no connection attempt occurred.

Temporal correlation reconstructs a sequence from observations across log sources. Start with a known event, such as a failed load balancer request, and preserve its original timestamp and resource context. Distinguish event time, when the source says the activity happened, from ingestion time, when the logging platform received the record. Delivery order is not event order.

A cached response is fresh while its freshness lifetime allows reuse without checking the origin. Updating the origin does not tell CloudFront that an existing cached response has changed. CloudFront can therefore serve an older version that is still fresh according to its caching rules.

Border Gateway Protocol (BGP) exchanges routes between configured peers. Each peer has an autonomous system number (ASN) identifying its routing domain. After a session reaches Established, peers can advertise prefixes such as 172.20.0.0/16, meaning that the advertised network is reachable through them.

AWS Client VPN connects individual remote devices to resources reachable through AWS. A person runs VPN client software on a laptop, authenticates, and establishes an encrypted connection to a managed Client VPN endpoint. This suits people working from home, hotels, or other changing networks.

AWS Direct Connect provides dedicated connectivity from your network to AWS through a Direct Connect location. Its AWS-bound traffic bypasses the public internet. Reaching that location can involve a network provider, so the connection still depends on infrastructure outside AWS.

AWS Site-to-Site VPN connects networks through encrypted IPsec tunnels. This example uses a virtual private gateway attached to a VPC. The customer gateway device is the router or firewall on your side that terminates the tunnels; the AWS customer gateway resource describes that device.

A Direct Connect connection supplies the underlying network link. A virtual interface, or VIF, adds a logical interface with a VLAN, peer IP addresses, and a Border Gateway Protocol (BGP) session. BGP exchanges network prefixes so routers can learn which destinations are reachable through that VIF. A working physical link alone does not provide those routes.

AWS Client VPN gives a remote device a secure tunnel to a Client VPN endpoint. Successfully connecting proves that the client can establish the VPN session; it does not prove that an application is reachable.