[{"data":1,"prerenderedAt":2796},["ShallowReactive",2],{"practiceExams":3,"practice-exams-\u002Fcourses\u002Faws-certified-solutions-architect-associate":153,"courses-\u002Fcourses\u002Faws-certified-solutions-architect-associate":196,"course-\u002Fcourses\u002Faws-certified-solutions-architect-associate":245},[4,17,28,39,49,59,70,80,90,101,111,122,134,145],{"id":5,"slug":6,"description":7,"questionCount":8,"isActive":9,"datePublicModified":10,"difficulty":11,"examVersion":16},1,"aws-certified-solutions-architect-associate-saa-c03","Unlock your potential with the AWS Certified Solutions Architect - Associate Practice Exam Simulator. This comprehensive tool is designed to prepare you thoroughly and assess your readiness for the most sought-after AWS associate certification.",1203,true,"2026-10-30T00:00:00.000Z",{"title":12,"subtitle":13,"slug":14,"coverImageUrl":15},"AWS Certified Solutions Architect - Associate","SAA-C03","aws-certified-solutions-architect-associate","\u002Fimages\u002Fdifficulties\u002Faws-certified-solutions-architect-associatesaa-c03\u002Fcovers\u002Faws-SAA-C03.png",{"slug":6,"pageSlug":14},{"id":18,"slug":19,"description":20,"questionCount":21,"isActive":9,"datePublicModified":10,"difficulty":22,"examVersion":27},5,"aws-certified-cloud-practitioner-clf-c02","Master your AWS Certified Cloud Practitioner exam with our Practice Exam Simulator. Prepare effectively and assess your readiness with realistic practice exams designed to mirror the most popular official AWS exam.",937,{"title":23,"subtitle":24,"slug":25,"coverImageUrl":26},"AWS Certified Cloud Practitioner","CLF-C02","aws-certified-cloud-practitioner","\u002Fimages\u002Fdifficulties\u002Faws-certified-cloud-practitionerclf-c02\u002Fcovers\u002Faws-CLF-C02.png",{"slug":19,"pageSlug":25},{"id":29,"slug":30,"description":31,"questionCount":32,"isActive":9,"datePublicModified":10,"difficulty":33,"examVersion":38},8,"aws-certified-devops-engineer-professional-dop-c02","Boost your readiness for the AWS Certified DevOps Engineer - Professional (DOP-C02) exam with our practice exam simulator. Featuring realistic questions and detailed explanations, it helps you identify knowledge gaps and improve your skills.",1040,{"title":34,"subtitle":35,"slug":36,"coverImageUrl":37},"AWS Certified DevOps Engineer - Professional","DOP-C02","aws-certified-devops-engineer-professional","",{"slug":30,"pageSlug":36},{"id":40,"slug":41,"description":42,"questionCount":43,"isActive":9,"datePublicModified":10,"difficulty":44,"examVersion":48},9,"aws-certified-data-engineer-associate-dea-c01","Prepare for your AWS Certified Data Engineer - Associate exam with our practice exam simulator. Featuring real exam scenarios, detailed explanations, and instant feedback to boost your confidence and success rate.",891,{"title":45,"subtitle":46,"slug":47,"coverImageUrl":37},"AWS Certified Data Engineer - Associate","DEA-C01","aws-certified-data-engineer-associate",{"slug":41,"pageSlug":47},{"id":50,"slug":51,"description":52,"questionCount":53,"isActive":9,"datePublicModified":10,"difficulty":54,"examVersion":58},11,"aws-certified-ai-practitioner-aif-c01","Prepare for the AWS Certified AI Practitioner exam with our practice exam simulator. Realistic questions on AI, machine learning and generative AI fundamentals, with detailed explanations, help you find your knowledge gaps and assess your readiness.",928,{"title":55,"subtitle":56,"slug":57,"coverImageUrl":37},"AWS Certified AI Practitioner","AIF-C01","aws-certified-ai-practitioner",{"slug":51,"pageSlug":57},{"id":60,"slug":61,"description":62,"questionCount":63,"isActive":9,"datePublicModified":64,"difficulty":65,"examVersion":69},17,"aws-certified-generative-ai-developer-professional-aip-c01","Get ready for the AWS Certified Generative AI Developer - Professional exam with our practice exam simulator. Realistic scenario-based questions with detailed explanations help you assess your readiness to build generative AI solutions on AWS.",982,"2026-10-29T00:00:00.000Z",{"title":66,"subtitle":67,"slug":68,"coverImageUrl":37},"AWS Certified Generative AI Developer - Professional","AIP-C01","aws-certified-generative-ai-developer-professional",{"slug":61,"pageSlug":68},{"id":71,"slug":72,"description":73,"questionCount":74,"isActive":9,"datePublicModified":64,"difficulty":75,"examVersion":79},19,"aws-certified-machine-learning-engineer-associate-mla-c02","Prepare for the AWS Certified Machine Learning Engineer - Associate exam with our practice exam simulator. Realistic questions with detailed explanations help you find your knowledge gaps and assess your readiness to build and run ML workloads on AWS.",861,{"title":76,"subtitle":77,"slug":78,"coverImageUrl":37},"AWS Certified Machine Learning Engineer - Associate","MLA-C02","aws-certified-machine-learning-engineer-associate",{"slug":72,"pageSlug":78},{"id":81,"slug":82,"description":83,"questionCount":84,"isActive":9,"datePublicModified":64,"difficulty":85,"examVersion":89},21,"aws-certified-cloudops-engineer-associate-soa-c03","Prepare for the AWS Certified CloudOps Engineer - Associate exam with our practice exam simulator. Realistic questions with detailed explanations help you assess your readiness to deploy, operate and troubleshoot workloads on AWS.",862,{"title":86,"subtitle":87,"slug":88,"coverImageUrl":37},"AWS Certified CloudOps Engineer - Associate","SOA-C03","aws-certified-cloudops-engineer-associate",{"slug":82,"pageSlug":88},{"id":91,"slug":92,"description":93,"questionCount":94,"isActive":9,"datePublicModified":64,"difficulty":95,"examVersion":100},13,"aws-certified-security-specialty-scs-c03","Advance your career in cloud security with the AWS Certified Security - Specialty (SCS-C03) Exam Simulator. Realistic, scenario-based practice exams mirror the official exam, with detailed explanations to close your knowledge gaps.",864,{"title":96,"subtitle":97,"slug":98,"coverImageUrl":99},"AWS Certified Security - Specialty","SCS-C03","aws-certified-security-specialty","\u002Fimages\u002Fdifficulties\u002Faws-certified-security-specialtyscs-c02\u002Fcovers\u002Faws_SCS_c02.png",{"slug":92,"pageSlug":98},{"id":102,"slug":103,"description":104,"questionCount":105,"isActive":9,"datePublicModified":64,"difficulty":106,"examVersion":110},15,"aws-certified-ai-business-strategist-aib-c01","Prepare for the AWS Certified AI Business Strategist exam with our practice exam simulator. Realistic, scenario-based questions with detailed explanations help you assess your readiness to lead AI adoption on AWS and close your knowledge gaps.",848,{"title":107,"subtitle":108,"slug":109,"coverImageUrl":37},"AWS Certified AI Business Strategist","AIB-C01","aws-certified-ai-business-strategist",{"slug":103,"pageSlug":109},{"id":112,"slug":113,"description":114,"questionCount":115,"isActive":9,"datePublicModified":116,"difficulty":117,"examVersion":121},10,"aws-certified-advanced-networking-specialty-ans-c01","The AWS Certified Advanced Networking - Specialty practice exam simulates the real test, offering scenario-based questions that assess your ability to design, implement, and troubleshoot complex AWS networking solutions. ",681,"2024-11-13T00:00:00.000Z",{"title":118,"subtitle":119,"slug":120,"coverImageUrl":37},"AWS Certified Advanced Networking - Specialty","ANS-C01","aws-certified-advanced-networking-specialty",{"slug":113,"pageSlug":120},{"id":123,"slug":124,"description":125,"questionCount":126,"isActive":9,"datePublicModified":127,"difficulty":128,"examVersion":133},4,"aws-certified-developer-associate-dva-c02","Unlock your potential as a software developer with the AWS Certified Developer - Associate Exam Simulator! Prepare thoroughly with realistic practice exams designed to mirror the official exam.",399,"2024-06-06T00:00:00.000Z",{"title":129,"subtitle":130,"slug":131,"coverImageUrl":132},"AWS Certified Developer - Associate","DVA-C02","aws-certified-developer-associate","\u002Fimages\u002Fdifficulties\u002Faws-certified-developer-associatedva-c02\u002Fcovers\u002Faws-DVA-C02.png",{"slug":124,"pageSlug":131},{"id":135,"slug":136,"description":137,"questionCount":138,"isActive":9,"datePublicModified":127,"difficulty":139,"examVersion":144},6,"aws-certified-solutions-architect-professional-sap-c02","Elevate your career with the AWS Certified Solutions Architect - Professional Exam Simulator. Get ready to ace the most popular Professional AWS exam with our realistic practice exams. Assess your readiness, boost your confidence, and ensure your success.",789,{"title":140,"subtitle":141,"slug":142,"coverImageUrl":143},"AWS Certified Solutions Architect - Professional","SAP-C02","aws-certified-solutions-architect-professional","\u002Fimages\u002Fdifficulties\u002Faws-certified-solutions-architect-professionalsap-c02\u002Fcovers\u002Faws-SAP-C02.png",{"slug":136,"pageSlug":142},{"id":146,"slug":147,"description":148,"questionCount":149,"isActive":9,"datePublicModified":127,"difficulty":150,"examVersion":151},7,"aws-certified-security-specialty-scs-c02","Advance your career in cloud cybersecurity with the AWS Certified Security - Specialty Exam Simulator! Tailored for professionals, this tool offers realistic practice exams to mirror the official exam.",5431,{"title":96,"subtitle":97,"slug":98,"coverImageUrl":99},{"slug":147,"pageSlug":152},null,[154,157,160,163,166,169,172,175,178,181,184,187,190,193],{"id":50,"slug":51,"description":52,"questionCount":53,"isActive":9,"datePublicModified":10,"difficulty":155,"examVersion":156},{"title":55,"subtitle":56,"slug":57,"coverImageUrl":37},{"slug":51,"pageSlug":57},{"id":5,"slug":6,"description":7,"questionCount":8,"isActive":9,"datePublicModified":10,"difficulty":158,"examVersion":159},{"title":12,"subtitle":13,"slug":14,"coverImageUrl":15},{"slug":6,"pageSlug":14},{"id":18,"slug":19,"description":20,"questionCount":21,"isActive":9,"datePublicModified":10,"difficulty":161,"examVersion":162},{"title":23,"subtitle":24,"slug":25,"coverImageUrl":26},{"slug":19,"pageSlug":25},{"id":29,"slug":30,"description":31,"questionCount":32,"isActive":9,"datePublicModified":10,"difficulty":164,"examVersion":165},{"title":34,"subtitle":35,"slug":36,"coverImageUrl":37},{"slug":30,"pageSlug":36},{"id":40,"slug":41,"description":42,"questionCount":43,"isActive":9,"datePublicModified":10,"difficulty":167,"examVersion":168},{"title":45,"subtitle":46,"slug":47,"coverImageUrl":37},{"slug":41,"pageSlug":47},{"id":91,"slug":92,"description":93,"questionCount":94,"isActive":9,"datePublicModified":64,"difficulty":170,"examVersion":171},{"title":96,"subtitle":97,"slug":98,"coverImageUrl":99},{"slug":92,"pageSlug":98},{"id":102,"slug":103,"description":104,"questionCount":105,"isActive":9,"datePublicModified":64,"difficulty":173,"examVersion":174},{"title":107,"subtitle":108,"slug":109,"coverImageUrl":37},{"slug":103,"pageSlug":109},{"id":60,"slug":61,"description":62,"questionCount":63,"isActive":9,"datePublicModified":64,"difficulty":176,"examVersion":177},{"title":66,"subtitle":67,"slug":68,"coverImageUrl":37},{"slug":61,"pageSlug":68},{"id":71,"slug":72,"description":73,"questionCount":74,"isActive":9,"datePublicModified":64,"difficulty":179,"examVersion":180},{"title":76,"subtitle":77,"slug":78,"coverImageUrl":37},{"slug":72,"pageSlug":78},{"id":81,"slug":82,"description":83,"questionCount":84,"isActive":9,"datePublicModified":64,"difficulty":182,"examVersion":183},{"title":86,"subtitle":87,"slug":88,"coverImageUrl":37},{"slug":82,"pageSlug":88},{"id":112,"slug":113,"description":114,"questionCount":115,"isActive":9,"datePublicModified":116,"difficulty":185,"examVersion":186},{"title":118,"subtitle":119,"slug":120,"coverImageUrl":37},{"slug":113,"pageSlug":120},{"id":123,"slug":124,"description":125,"questionCount":126,"isActive":9,"datePublicModified":127,"difficulty":188,"examVersion":189},{"title":129,"subtitle":130,"slug":131,"coverImageUrl":132},{"slug":124,"pageSlug":131},{"id":135,"slug":136,"description":137,"questionCount":138,"isActive":9,"datePublicModified":127,"difficulty":191,"examVersion":192},{"title":140,"subtitle":141,"slug":142,"coverImageUrl":143},{"slug":136,"pageSlug":142},{"id":146,"slug":147,"description":148,"questionCount":149,"isActive":9,"datePublicModified":127,"difficulty":194,"examVersion":195},{"title":96,"subtitle":97,"slug":98,"coverImageUrl":99},{"slug":147,"pageSlug":152},[197,203,209,214,219,223,227,231,235,240],{"id":5,"slug":19,"examVersionId":198,"description":199,"difficulty":200,"examVersion":201,"lessonsCount":202},3,"Unlock your cloud computing potential with our interactive AWS course designed for the AWS Certified Cloud Practitioner exam. Gain hands-on experience, understand core AWS services, and confidently ace your certification.",{"id":198,"title":23,"subtitle":24,"slug":25},{"slug":19,"pageSlug":25},353,{"id":204,"slug":6,"examVersionId":5,"description":205,"difficulty":206,"examVersion":207,"lessonsCount":208},2,"Master cloud architecture with our comprehensive interactive course tailored for the AWS Certified Solutions Architect - Associate exam. Learn to design scalable, cost-effective AWS solutions.",{"id":5,"title":12,"subtitle":13,"slug":14},{"slug":6,"pageSlug":14},495,{"id":135,"slug":30,"examVersionId":135,"description":210,"difficulty":211,"examVersion":212,"lessonsCount":213},"Master the AWS Certified DevOps Engineer - Professional (DOP-C02) exam with our interactive course. Engage with hands-on labs, real-world scenarios, and expert guidance to enhance your skills. Learn at your own pace and ensure exam success.",{"id":135,"title":34,"subtitle":35,"slug":36},{"slug":30,"pageSlug":36},381,{"id":146,"slug":41,"examVersionId":146,"description":215,"difficulty":216,"examVersion":217,"lessonsCount":218},"Master the AWS Certified Data Engineer - Associate exam with our interactive course. Explore real-world scenarios and expert guidance to build your skills and pass with confidence. Start your certification journey now!",{"id":146,"title":45,"subtitle":46,"slug":47},{"slug":41,"pageSlug":47},341,{"id":40,"slug":51,"examVersionId":40,"description":37,"difficulty":220,"examVersion":221,"lessonsCount":222},{"id":40,"title":55,"subtitle":56,"slug":57},{"slug":51,"pageSlug":57},246,{"id":50,"slug":92,"examVersionId":60,"description":152,"difficulty":224,"examVersion":225,"lessonsCount":226},{"id":18,"title":96,"subtitle":97,"slug":98},{"slug":92,"pageSlug":98},272,{"id":91,"slug":103,"examVersionId":71,"description":152,"difficulty":228,"examVersion":229,"lessonsCount":230},{"id":50,"title":107,"subtitle":108,"slug":109},{"slug":103,"pageSlug":109},221,{"id":102,"slug":61,"examVersionId":81,"description":152,"difficulty":232,"examVersion":233,"lessonsCount":234},{"id":91,"title":66,"subtitle":67,"slug":68},{"slug":61,"pageSlug":68},368,{"id":60,"slug":72,"examVersionId":236,"description":152,"difficulty":237,"examVersion":238,"lessonsCount":239},23,{"id":102,"title":76,"subtitle":77,"slug":78},{"slug":72,"pageSlug":78},391,{"id":71,"slug":82,"examVersionId":241,"description":152,"difficulty":242,"examVersion":243,"lessonsCount":244},25,{"id":60,"title":86,"subtitle":87,"slug":88},{"slug":82,"pageSlug":88},218,{"id":204,"slug":6,"description":205,"datePublicModified":10,"difficulty":246,"examVersion":2795,"lessonsCount":208,"previousExamVersion":152,"newerExamVersion":152},{"id":5,"title":12,"subtitle":13,"rating":247,"slug":14,"guideUrl":248,"categories":249},3.5,"https:\u002F\u002Fd1.awsstatic.com\u002Ftraining-and-certification\u002Fdocs-sa-assoc\u002FAWS-Certified-Solutions-Architect-Associate_Exam-Guide.pdf",[250,990,1897,2455],{"id":251,"title":252,"subtitle":152,"subcategories":253},54,"Design Secure Architectures",[254,473,722],{"id":255,"title":256,"subtitle":152,"lessons":257},216,"Design secure access to AWS resources",[258,263,268,273,278,283,288,293,298,303,308,313,318,323,328,333,338,343,348,353,358,363,368,373,378,383,388,393,398,403,408,413,418,423,428,433,438,443,448,453,458,463,468],{"slug":259,"title":260,"focus":261,"teaser":262},"aws-iam-role-trust-and-delegated-access-saa-c03","AWS IAM: Role trust and delegated access","How role trust policies enable role assumption across accounts and federation from external identity providers without creating permanent IAM-user credentials.","An IAM role is an identity with permissions that another identity can temporarily assume. Unlike an IAM user, a role has no permanent password or access keys. Assuming it creates a role session with temporary credentials.",{"slug":264,"title":265,"focus":266,"teaser":267},"aws-sts-vs-aws-iam-temporary-sessions-and-persistent-access-definitions-saa-c03","AWS STS vs AWS IAM: Temporary sessions and persistent access definitions","How IAM's responsibility for defining roles, trust, and permissions differs from STS's responsibility for issuing temporary session credentials.","AWS Identity and Access Management (IAM) maintains the definitions that govern access to AWS resources. For role-based access, you use IAM to create a role, define who may assume it, and assign its permissions. These definitions persist until you change or delete them.",{"slug":269,"title":270,"focus":271,"teaser":272},"cross-account-access-authorizing-access-across-account-boundaries-saa-c03","Cross-Account Access: authorizing access across account boundaries","How source-account permissions combine with destination role trust or resource policies to grant narrowly scoped access without removing account isolation.","Cross-account access grants selected capabilities without combining accounts or transferring ownership. Network connectivity and membership in the same AWS organization do not automatically grant access. Two common patterns are assuming a destination-account role and accessing a resource directly through its resource policy.",{"slug":274,"title":275,"focus":276,"teaser":277},"aws-organizations-service-control-policies-saa-c03","AWS Organizations: service control policies","How SCPs inherited through the root, organizational units, and member accounts limit available permissions without granting access, and why they require all features.","AWS Organizations centrally manages multiple AWS accounts. A service control policy (SCP) limits the permissions available to identities in member accounts. It sets a permissions ceiling: an action outside that ceiling cannot be authorized by giving a user or role more IAM permissions.",{"slug":279,"title":280,"focus":281,"teaser":282},"policy-inheritance-scps-across-the-account-hierarchy-saa-c03","Policy Inheritance: SCPs across the account hierarchy","How SCPs combine along the root-to-account path to limit member-account permissions without granting access or allowing child policies to override inherited restrictions.","A service control policy (SCP) in AWS Organizations limits the permissions available to principals in member accounts. Attach SCPs to the organization root, an organizational unit (OU), or an account. An account inherits applicable restrictions along its root-to-account path, including through nested OUs.",{"slug":284,"title":285,"focus":286,"teaser":287},"aws-control-tower-and-aws-organizations-governance-responsibilities-saa-c03","AWS Control Tower and AWS Organizations: governance responsibilities","When to choose Control Tower's automated landing zone governance rather than configure account organization and policy boundaries directly with AWS Organizations.","AWS Organizations provides the foundation for managing multiple AWS accounts. You create or invite accounts, arrange them into organizational units (OUs), and apply organization policies. OUs let you group accounts that need common governance boundaries.",{"slug":289,"title":290,"focus":291,"teaser":292},"aws-iam-identity-center-workforce-single-sign-on-saa-c03","AWS IAM Identity Center: Workforce single sign-on","How identity sources and access assignments give employees federated access to AWS accounts through permission sets and to business applications through SAML.","AWS IAM Identity Center gives employees a central place to access assigned AWS accounts and applications. Its identity source determines where workforce identities come from. Choose the built-in Identity Center directory to manage users and groups there, connect Microsoft Active Directory, or connect an existing external identity provider.",{"slug":294,"title":295,"focus":296,"teaser":297},"aws-iam-identity-center-vs-aws-identity-and-access-management-iam-saa-c03","AWS IAM Identity Center vs AWS Identity and Access Management (IAM)","When centralized workforce sign-on calls for IAM Identity Center rather than direct management of IAM identities and role federation.","AWS IAM Identity Center centralizes access for a workforce: employees and contractors who need to sign in to AWS accounts and supported applications. For centralized workforce access across AWS accounts, it is the recommended starting point. People use an AWS access portal to find their assigned accounts and access levels, rather than maintaining a separate IAM user in each account.",{"slug":299,"title":300,"focus":301,"teaser":302},"aws-directory-service-vs-aws-iam-identity-center-saa-c03","AWS Directory Service vs AWS IAM Identity Center","Why Directory Service supplies or connects Active Directory identities while IAM Identity Center manages workforce sign-in and permission-set assignments across AWS accounts.","AWS Directory Service supplies or connects Microsoft Active Directory identities. It addresses directory needs such as maintaining AD users and groups and supporting workloads that depend on AD.",{"slug":304,"title":305,"focus":306,"teaser":307},"aws-ram-cross-account-resource-shares-saa-c03","AWS RAM: cross-account resource shares","How resource shares combine supported resources, principals, and managed permissions to grant cross-account access, including organization sharing, external-account invitations, and access revocation.","AWS Resource Access Manager (AWS RAM) lets an owner share supported resources without copying them or transferring ownership. A resource share combines three ingredients: the resources being shared, the principals receiving access, and the managed permissions defining the allowed actions.",{"slug":309,"title":310,"focus":311,"teaser":312},"aws-ram-vs-iam-resource-sharing-and-identity-permissions-saa-c03","AWS RAM vs IAM: resource sharing and identity permissions","Why sharing a resource through AWS RAM differs from granting an identity permissions through IAM, and why a recipient can need both.","AWS Resource Access Manager (AWS RAM) lets a resource owner share supported resources with other AWS accounts. The resource stays in the owning account; sharing does not copy it or transfer ownership. The share establishes which recipients can access it and which shared operations are available.",{"slug":314,"title":315,"focus":316,"teaser":317},"effective-permissions-authorization-across-accounts-saa-c03","Effective Permissions: authorization across accounts","How grants on both sides of an account boundary, organizational limits, and assumed-role session restrictions determine whether a request is allowed.","Effective permissions are the result for a particular caller, action, resource, and request context—not just a list of policy statements. An allow must cover the requested action and resource, and its conditions must match. An applicable explicit deny overrides an allow.",{"slug":319,"title":320,"focus":321,"teaser":322},"identity-federation-workforce-access-through-trusted-identity-providers-saa-c03","Identity Federation: workforce access through trusted identity providers","How directory sign-in becomes AWS role access through validated identity assertions and role mappings, using IAM Identity Center or direct SAML federation instead of separate IAM users.","Identity federation lets employees use their existing directory identity instead of separate IAM users in each AWS account. An identity provider, or IdP, authenticates the employee and issues signed evidence of that authentication. AWS validates the evidence and maps the employee to role access; it does not need a copy of the directory password.",{"slug":324,"title":325,"focus":326,"teaser":327},"temporary-credentials-federated-access-sessions-saa-c03","Temporary Credentials: federated access sessions","How federated sign-in leads to temporary AWS role credentials, how session permissions and expiration bound access, and why continued access requires fresh credentials.","Federation lets a person authenticate through an identity provider and obtain AWS access without receiving an IAM user's long-term access keys. Authentication establishes who the person is; an AWS role session supplies temporary AWS access. Successful sign-in alone does not authorize access to AWS resources.",{"slug":329,"title":330,"focus":331,"teaser":332},"aws-sts-assuming-roles-for-temporary-access-saa-c03","AWS STS: Assuming roles for temporary access","How AssumeRole uses caller permissions and role trust to issue temporary credentials for role switching and cross-account access, with permissions and duration bounded by the role session.","AssumeRole lets an authenticated caller obtain temporary credentials for an IAM role. Use it to switch responsibilities within an account or access another account without sharing that account's long-term credentials.",{"slug":334,"title":335,"focus":336,"teaser":337},"amazon-cognito-identity-pools-and-aws-credentials-saa-c03","Amazon Cognito: identity pools and AWS credentials","How identity pools exchange authenticated or guest identities for temporary AWS credentials scoped by IAM roles.","An Amazon Cognito identity pool lets an application obtain temporary AWS credentials for an authenticated user or, when enabled, an unauthenticated guest. Use it when a web or mobile application needs to call AWS services directly without embedding long-term access keys.",{"slug":339,"title":340,"focus":341,"teaser":342},"amazon-cognito-vs-aws-identity-and-access-management-iam-saa-c03","Amazon Cognito vs AWS Identity and Access Management (IAM)","When application identity management belongs in Cognito and when AWS resource permissions belong in IAM.","Amazon Cognito manages identities for web and mobile applications. Choose it when customers need to register, sign in, recover accounts, or sign in through an external identity provider. A Cognito user pool authenticates application users and issues tokens that an application or API can validate.",{"slug":344,"title":345,"focus":346,"teaser":347},"aws-global-infrastructure-deployment-scope-saa-c03","AWS global infrastructure: deployment scope","How Region, Availability Zone, and global service scopes determine where resources exist, which capabilities are available, and how placement affects pricing and connectivity.","A Region is a separate geographic area containing multiple Availability Zones (AZs). An AZ consists of one or more discrete data centers with redundant power, networking, and connectivity. AZs in a Region are physically separated and connected by low-latency networking. Choose a Region for geographic placement; choose AZs within it for placement across distinct failure boundaries.",{"slug":349,"title":350,"focus":351,"teaser":352},"fault-isolation-aws-infrastructure-failure-domains-saa-c03","Fault Isolation: AWS infrastructure failure domains","How host, Availability Zone, and Region boundaries limit shared failure exposure, and how shared dependencies can undermine that isolation.","A failure domain is a set of resources that can be affected by the same event. A physical host is one such domain: several virtual machines on that host can fail together. Adding virtual machines is redundancy, but it does not establish host isolation unless their placement separates them.",{"slug":354,"title":355,"focus":356,"teaser":357},"least-privilege-what-it-means","Least privilege","What it means and how to get there","Least privilege means every user, role and application can do exactly what its task needs and nothing more. If its credentials leak or its code misbehaves, the damage stops at what it was allowed to do.",{"slug":359,"title":360,"focus":361,"teaser":362},"aws-iam-root-and-iam-user-credential-security-saa-c03","AWS IAM: Root and IAM-user credential security","How to protect root and IAM-user credentials through MFA, restricted root use, and secure password and access-key management.","The AWS account root user is the account identity associated with its root email address. It has highly privileged access, including tasks that ordinary administrators cannot perform. Reserve root sign-in for tasks that specifically require it; use named, non-root identities for everyday administration.",{"slug":364,"title":365,"focus":366,"teaser":367},"aws-iam-identity-based-permissions-saa-c03","AWS IAM: Identity-based permissions","How policies assigned through users, groups, and roles define least-privilege permissions using actions, resources, conditions, and explicit denies.","An identity-based policy is a JSON document that defines permissions for an IAM user, group, or role. Attach a policy directly to a user for individual permissions, or to an IAM group to give its member users a shared set of permissions. A group is a collection of users, not an identity that signs in or makes requests.",{"slug":369,"title":370,"focus":371,"teaser":372},"least-privilege-scoping-permissions-to-workload-needs-saa-c03","Least privilege: scoping permissions to workload needs","How to translate required operations into narrowly scoped actions, resources, and conditions, and test that unrelated operations remain denied.","Start with what the workload actually does, not a broad label such as “S3 access.” Our example is an invoice reader that downloads existing objects using known keys under invoices\u002F in the billing-records bucket. It does not discover keys, upload files, delete objects, or change bucket settings.",{"slug":374,"title":375,"focus":376,"teaser":377},"least-privilege-and-separation-of-duties-saa-c03","Least privilege and separation of duties","How limiting each identity's capabilities differs from dividing incompatible responsibilities among separate identities.","Least privilege asks: what capabilities does this identity need for its assigned work? It limits unnecessary access. For example, an application that reads invoices should not also be able to delete them or change their storage permissions.",{"slug":379,"title":380,"focus":381,"teaser":382},"separation-of-duties-enforcing-independent-roles-saa-c03","Separation of Duties: enforcing independent roles","How to separate incompatible responsibilities with roles that prevent one actor from completing a sensitive operation without independent oversight, including through role assumption or permission changes.","Separation of duties prevents one actor from controlling every stage of a sensitive operation. For a production release, assign proposal, approval, and execution to distinct responsibilities. Different role names are not enough: the requester must not also control the approval identity.",{"slug":384,"title":385,"focus":386,"teaser":387},"defense-in-depth-independent-security-layers-saa-c03","Defense in Depth: independent security layers","How complementary security layers combine least-privilege access with detection and response to limit compromise when one safeguard fails.","Defense in depth combines safeguards that address different failure modes. A network rule limits which connections can reach an application; application authorization decides what a caller may do. Passing the network check must not automatically grant access to data.",{"slug":389,"title":390,"focus":391,"teaser":392},"aws-cloudtrail-secure-audit-trails-saa-c03","AWS CloudTrail: secure audit trails","How to configure a multi-Region trail to capture security-relevant API activity and protect its audit records with restricted access, encryption, and log file integrity validation.","AWS CloudTrail records account activity, including who made an API request, when it happened, its source, and the requested action. A trail delivers records to an S3 bucket for retention; do not rely only on the console's Event history as your audit archive.",{"slug":394,"title":395,"focus":396,"teaser":397},"aws-trusted-advisor-security-checks-saa-c03","AWS Trusted Advisor: security checks","How Trusted Advisor security checks flag risky account and resource configurations, report affected resources, and recommend corrective actions.","AWS Trusted Advisor security checks evaluate account and resource configurations against AWS best practices. They flag conditions that deserve attention and recommend corrective actions. A warning means a configuration presents a potential risk; it does not, by itself, prove that someone exploited it. Trusted Advisor provides advice rather than automatically enforcing the recommended configuration.",{"slug":399,"title":400,"focus":401,"teaser":402},"aws-shared-responsibility-model-security-boundaries-across-services-saa-c03","AWS shared responsibility model: security boundaries across services","How security responsibilities divide between AWS and customers across EC2, RDS, and Lambda, including which controls remain customer-owned as AWS manages more of the stack.","The shared responsibility model separates security of the cloud from security in the cloud. AWS protects the physical facilities, hardware, underlying networking, and virtualization layer that run its services. Customers protect their data and configure the access and workload controls they manage.",{"slug":404,"title":405,"focus":406,"teaser":407},"multi-factor-authentication-securing-iam-user-and-root-access-saa-c03","Multi-Factor Authentication: securing IAM-user and root access","How to configure and enforce MFA for AWS human access, distinguishing device enrollment from protection of console, API, and recovery paths.","Multi-factor authentication (MFA) requires different factor categories, such as a password plus possession of an authenticator. Two passwords are not MFA. A passkey can provide MFA through possession of its credential plus local verification with a PIN or biometric.",{"slug":409,"title":410,"focus":411,"teaser":412},"credential-rotation-replacing-iam-credentials-safely-saa-c03","Credential Rotation: replacing IAM credentials safely","How to replace and retire long-lived IAM credentials safely, including access-key cutover, key-slot limits, and why console password expiration does not rotate access keys.","Credential rotation means replacing a credential, moving its consumers to the replacement, and retiring the old credential. Generating a new secret is not enough if applications still use the old one or AWS still accepts it.",{"slug":414,"title":415,"focus":416,"teaser":417},"access-control-and-authentication-permission-versus-identity-saa-c03","Access Control and Authentication: permission versus identity","How establishing identity differs from granting permission, and why successful authentication can still result in an access denial.","Authentication establishes who is making a request. A trusted system validates evidence and associates the request with a principal: an identity such as a user or an assumed role session. This applies to both people signing in and workloads using credentials.",{"slug":419,"title":420,"focus":421,"teaser":422},"aws-iam-resource-based-authorization-saa-c03","AWS IAM: Resource-based authorization","How resource policies interact with identity permissions, including access-point ARNs, invocation actions, and source-VPC or endpoint conditions that restrict ingestion and data access.","An identity-based policy describes what a user or role may do. A resource-based policy is attached to a supported resource, such as an S3 bucket or Lambda function, and describes which principals may access it. Its Principal identifies an account, role, user, or AWS service receiving permission.",{"slug":424,"title":425,"focus":426,"teaser":427},"role-based-access-control-scoped-roles-and-controlled-assumption-saa-c03","Role-Based Access Control: scoped roles and controlled assumption","How job responsibilities map to scoped AWS roles that approved identities assume through STS-backed role switching, including across account boundaries.","Role-Based Access Control (RBAC) starts with a job, not a person. Define the operations that job needs, then limit their resource and environment scope. A reports analyst might need s3:GetObject for objects under one reports prefix, not write access or access to every bucket. People with the same approved responsibility can use the same role.",{"slug":429,"title":430,"focus":431,"teaser":432},"attribute-based-access-control-tag-based-authorization-saa-c03","Attribute-Based Access Control: tag-based authorization","How IAM policies use trusted principal and resource tags to scale permissions across teams while preventing unauthorized attribute changes and accounting for action-specific authorization support.","Attribute-Based Access Control (ABAC) uses attributes in policy conditions to decide which resources a requester may access. In AWS, a principal tag describes the requesting identity, while a resource tag describes the target. A Project tag can let one shared policy separate several teams without listing every team's resources.",{"slug":434,"title":435,"focus":436,"teaser":437},"attribute-based-access-control-vs-role-based-access-control-saa-c03","Attribute-Based Access Control vs. Role-Based Access Control","How attribute-based rules differ from job-function permission assignments, when each fits, and why they can complement each other.","Role-Based Access Control (RBAC) groups permissions around job functions. An auditor receives permissions to inspect records; an operator receives permissions to run approved operational tasks. Access follows an identity's assigned responsibility, with permissions scoped to the resources that responsibility covers.",{"slug":439,"title":440,"focus":441,"teaser":442},"blast-radius-aws-account-isolation-saa-c03","Blast Radius: AWS account isolation","How account boundaries limit a compromise’s reach, and why effective containment also requires constrained cross-account trust, shared administrative access, and SCP permission ceilings.","Blast radius is the potential reach of a failure or compromise. For a stolen identity, ask which resources it can access, which permissions it can change, and which other identities it can become. Permission to read customer records establishes potential exposure; it does not prove that those records were read.",{"slug":444,"title":445,"focus":446,"teaser":447},"aws-control-tower-landing-zone-governance-saa-c03","AWS Control Tower: landing zone governance","How a landing zone establishes security baselines and applies preventive, detective, and proactive controls across enrolled accounts and organizational units.","An AWS Control Tower landing zone is a configured starting point for a multi-account environment. It establishes shared governance resources and account baselines so that each team does not have to assemble its own security foundation. The baseline supports consistent logging, access, and oversight; it does not make every workload automatically secure or compliant.",{"slug":449,"title":450,"focus":451,"teaser":452},"explicit-deny-precedence-resource-policy-guardrails-saa-c03","Explicit Deny Precedence: resource-policy guardrails","How matching deny statements in resource policies override allows, and how their principal, action, resource, and conditions determine which requests they block.","A resource-based policy is attached to a resource, such as an Amazon S3 bucket. It can grant access and can also place explicit restrictions on requests to that resource. A statement with \"Effect\":\"Deny\" creates an explicit deny when that statement matches the request.",{"slug":454,"title":455,"focus":456,"teaser":457},"confused-deputy-problem-source-bound-resource-policies-saa-c03","Confused Deputy Problem: source-bound resource policies","How supported aws:SourceArn and aws:SourceAccount conditions bind an AWS service principal’s resource access to the intended origin rather than trusting the intermediary’s identity alone.","An AWS service can legitimately access your resource on someone else's behalf. The confused deputy problem arises when that service uses its trusted access for an unintended caller or source. The service can be correctly authenticated while the request is still associated with the wrong origin.",{"slug":459,"title":460,"focus":461,"teaser":462},"amazon-s3-bucket-security-controls-saa-c03","Amazon S3: bucket security controls","How bucket policies, public access controls, and encryption settings protect data-lake objects.","A data lake often separates objects into prefixes such as raw\u002F and curated\u002F. A bucket policy is a resource-based JSON policy attached to an S3 bucket. It identifies the principal, permitted or denied actions, affected resources, and any conditions. Use specific role principals and narrow permissions rather than granting broad access.",{"slug":464,"title":465,"focus":466,"teaser":467},"aws-kms-key-policies-and-grants-saa-c03","AWS KMS: key policies and grants","How key policies, IAM permissions, and grants authorize key administration and cryptographic use, including access through AWS services and across accounts.","An AWS KMS key has its own authorization controls. Permission to read an encrypted object or manage a storage service does not automatically include permission to use its KMS key. This lesson focuses on customer managed keys, whose policies you control.",{"slug":469,"title":470,"focus":471,"teaser":472},"aws-directory-service-directory-identities-for-federated-access-saa-c03","AWS Directory Service: directory identities for federated access","How AWS Managed Microsoft AD and AD Connector provide directory authentication for federated AWS access using IAM roles instead of individual IAM users.","An employee with an Active Directory account does not need a separate IAM user just to access AWS. With federated access, the employee authenticates using a directory identity and accesses AWS through an IAM role. This avoids maintaining a second personal account and long-term AWS credentials for each employee.",{"id":474,"title":475,"subtitle":152,"lessons":476},217,"Design secure workloads and applications",[477,482,487,492,497,502,507,512,517,522,527,532,537,542,547,552,557,562,567,572,577,582,587,592,597,602,607,612,617,622,627,632,637,642,647,652,657,662,667,672,677,682,687,692,697,702,707,712,717],{"slug":478,"title":479,"focus":480,"teaser":481},"externalized-configuration-safe-application-configuration-saa-c03","Externalized Configuration: safe application configuration","How applications consume environment-specific settings outside build artifacts while enforcing validation, authorized changes, and explicit loading rules that prevent unsafe defaults or stale settings.","Externalized configuration keeps environment-specific values outside the application build artifact. The same container image or executable can run in staging and production while receiving different database endpoints, timeouts, and feature settings.",{"slug":483,"title":484,"focus":485,"teaser":486},"credential-management-secure-application-credential-delivery-saa-c03","Credential Management: secure application credential delivery","How applications obtain and refresh credentials at runtime through IAM roles and access-controlled secret stores rather than embedding secrets in code or configuration.","An application needs AWS credentials to sign AWS API requests. Instead of putting long-lived access keys in source code, images, or configuration files, assign the workload an IAM role. The role defines the permissions available to the application; temporary credentials let it act with those permissions.",{"slug":488,"title":489,"focus":490,"teaser":491},"aws-systems-manager-secure-application-configuration-with-parameter-store-saa-c03","AWS Systems Manager: secure application configuration with Parameter Store","How applications store and retrieve hierarchical parameters securely using SecureString encryption, KMS keys, and IAM access controls.","Parameter Store, a capability of AWS Systems Manager, stores named configuration values outside application code. An application retrieves a value by name instead of embedding it in its source code or deployment image.",{"slug":493,"title":494,"focus":495,"teaser":496},"aws-secrets-manager-application-credential-lifecycle-saa-c03","AWS Secrets Manager: application credential lifecycle","How applications use encrypted, access-controlled secrets and keep credentials current through automatic rotation instead of hardcoding them.","A database password embedded in source code or a machine image is difficult to replace and easy to copy accidentally. With AWS Secrets Manager, the application stores a secret identifier in its configuration and retrieves the credential at runtime. A secret can hold related fields together, such as a username and password.",{"slug":498,"title":499,"focus":500,"teaser":501},"aws-secrets-manager-vs-aws-systems-manager-parameter-store-saa-c03","AWS Secrets Manager vs AWS Systems Manager Parameter Store","When to choose Secrets Manager rather than Parameter Store based on credential rotation needs, configuration storage requirements, and cost.","AWS Secrets Manager is designed for secrets such as database passwords, API keys, and access tokens. Parameter Store, a capability of AWS Systems Manager, stores application configuration such as service endpoints, environment settings, and sensitive values.",{"slug":503,"title":504,"focus":505,"teaser":506},"amazon-vpc-private-access-through-vpc-endpoints-saa-c03","Amazon VPC: private access through VPC endpoints","How gateway and interface endpoints provide private service access through route tables or private IP addresses, with endpoint policies and cost tradeoffs.","A VPC endpoint lets workloads reach a supported service without sending that traffic through an internet gateway or NAT gateway. The workload does not need a public IP address. Choose the endpoint type supported by the service and appropriate for the access you need.",{"slug":508,"title":509,"focus":510,"teaser":511},"aws-privatelink-private-access-through-interface-endpoints-saa-c03","AWS PrivateLink: private access through interface endpoints","How interface endpoint ENIs, private DNS, access controls, and Availability Zone placement provide secure, highly available connectivity to AWS services and VPC endpoint services.","AWS PrivateLink lets an application reach a supported service privately through an interface VPC endpoint. You select subnets in your VPC, and AWS creates an endpoint network interface, or ENI, in each selected subnet. The application connects to an ENI's private IP address; this path needs neither an internet gateway nor a NAT gateway.",{"slug":513,"title":514,"focus":515,"teaser":516},"amazon-vpc-and-aws-privatelink-network-peering-versus-service-access-saa-c03","Amazon VPC and AWS PrivateLink: network peering versus service access","When routed connectivity between VPC networks is appropriate instead of exposing only a selected service through AWS PrivateLink.","Start with what the application must reach. Routed VPC connectivity, such as VPC peering, lets workloads address resources in another VPC by their private IP addresses. It suits applications that need network-level communication across several workloads, especially when either side must initiate connections.",{"slug":518,"title":519,"focus":520,"teaser":521},"allowlisting-defining-permitted-network-flows-saa-c03","Allowlisting: defining permitted network flows","How to translate required application connections into narrowly scoped source, destination, port, and protocol permissions while denying unapproved traffic by default.","Network allowlisting permits explicitly approved connections and denies other connections by default. Start with an application dependency, not with a broad rule such as “allow the private network.” For each dependency, record the source that initiates it, the destination that receives it, the transport protocol, and the destination port.",{"slug":523,"title":524,"focus":525,"teaser":526},"stateful-and-stateless-filtering-permitting-return-traffic-saa-c03","Stateful and Stateless Filtering: permitting return traffic","How connection tracking determines the port and protocol rules needed for requests and responses through stateful security groups and stateless network ACLs.","An HTTPS client sends a TCP request from a temporary source port, such as 51000, to the server's destination port 443. The response reverses those roles: its source port is 443 and its destination port is 51000.",{"slug":528,"title":529,"focus":530,"teaser":531},"amazon-vpc-security-groups-and-network-acls-saa-c03","Amazon VPC: security groups and network ACLs","How stateful security groups and stateless network ACLs evaluate traffic and enforce access boundaries between workload tiers.","A security group filters traffic at a resource's network interface. A network ACL, or NACL, filters traffic entering or leaving a subnet. For a request between instances in different subnets, the applicable controls on both sides must permit it. Permission from one control cannot override a block from another.",{"slug":533,"title":534,"focus":535,"teaser":536},"ephemeral-ports-allowing-return-traffic-saa-c03","Ephemeral Ports: allowing return traffic","How assigned source ports and their ranges determine return-traffic rules for network ACLs, and why security groups need no equivalent response rules.","When an application starts a TCP connection without choosing a local port, the operating system assigns an available ephemeral port from its configured range. The assignment belongs to the socket, not to each packet. Ephemeral means temporarily assigned; a long-lived connection can keep that port for hours.",{"slug":538,"title":539,"focus":540,"teaser":541},"aws-network-firewall-traffic-inspection-policies-saa-c03","AWS Network Firewall: traffic inspection policies","How firewall policies combine stateless and stateful rule groups to allow or block traffic by ports, protocols, connection state, and application content.","An AWS Network Firewall firewall policy brings together references to rule groups and settings for handling unmatched traffic. A rule group is a reusable collection of rules. The policy combines stateless and stateful rule groups rather than treating them as interchangeable choices.",{"slug":543,"title":544,"focus":545,"teaser":546},"aws-network-firewall-vs-amazon-vpc-choosing-traffic-controls-saa-c03","AWS Network Firewall vs Amazon VPC: choosing traffic controls","When managed network inspection is needed instead of, or alongside, VPC security groups and network ACLs.","Amazon VPC provides your network and its basic traffic controls. Use security groups to restrict traffic at workload network interfaces and network ACLs to filter traffic at subnet boundaries. These controls match network details such as addresses, protocols, and ports—not application payloads.",{"slug":548,"title":549,"focus":550,"teaser":551},"authentication-verifying-application-requests-saa-c03","Authentication: verifying application requests","How applications establish caller identity using trusted tokens or signed credentials and reject evidence with invalid signatures, incorrect scope, or expired validity.","An application cannot trust a caller merely because a request contains a username or user ID. Authentication requires evidence that a trusted system can validate. After validation, the application can associate the request with an identity.",{"slug":553,"title":554,"focus":555,"teaser":556},"access-control-application-request-authorization-saa-c03","Access Control: application request authorization","How application and ingestion endpoints restrict callers to permitted operations and request contexts independently of network reachability.","Network reachability lets traffic arrive at an endpoint. Request authorization decides whether that caller may perform the requested operation in the current context. A private endpoint still needs authorization; a reachable public endpoint can still reject a request.",{"slug":558,"title":559,"focus":560,"teaser":561},"amazon-cognito-user-pool-authentication-saa-c03","Amazon Cognito: user pool authentication","How user pools authenticate application users, enforce sign-in security, and issue tokens for protected application access.","An Amazon Cognito user pool is a managed directory that authenticates application users. It supports registration, sign-in, account recovery, and user attributes. Your application registers an app client in the pool to define how it uses authentication. A pool can also accept sign-in through configured social or enterprise identity providers.",{"slug":563,"title":564,"focus":565,"teaser":566},"amazon-guardduty-threat-detection-from-aws-activity-saa-c03","Amazon GuardDuty: threat detection from AWS activity","How GuardDuty turns AWS activity signals into threat findings and which security use cases its detection capabilities address.","Amazon GuardDuty continuously analyzes AWS activity for signs of threats. Its foundational sources include CloudTrail management events, VPC flow logs, and DNS query logs. These reveal API actions, network connections, and domain lookups—not the contents of network packets.",{"slug":568,"title":569,"focus":570,"teaser":571},"amazon-inspector-continuous-vulnerability-scanning-saa-c03","Amazon Inspector: continuous vulnerability scanning","How Inspector continuously assesses EC2 instances, ECR container images, and Lambda functions for vulnerabilities and produces prioritized findings with remediation guidance.","Amazon Inspector discovers supported resources and assesses them for vulnerabilities after you enable the relevant scanning types in an AWS Region. Its coverage includes EC2 instances, container images in Amazon ECR, and Lambda functions. It produces findings: records of identified security issues and the resources they affect.",{"slug":573,"title":574,"focus":575,"teaser":576},"amazon-guardduty-and-amazon-inspector-threat-detection-versus-vulnerability-assessment-saa-c03","Amazon GuardDuty and Amazon Inspector: threat detection versus vulnerability assessment","When to choose GuardDuty for signs of malicious activity rather than Inspector for software vulnerabilities and unintended network exposure.","Amazon GuardDuty detects signs of threats: “Does this activity suggest someone is misusing my AWS environment?” Amazon Inspector assesses weaknesses: “Does this resource have vulnerable software or network exposure that needs attention?” Choose by the question you need answered, not simply because both services produce security findings.",{"slug":578,"title":579,"focus":580,"teaser":581},"amazon-macie-sensitive-data-discovery-in-s3-saa-c03","Amazon Macie: sensitive data discovery in S3","How Macie uses managed and custom data identifiers to discover sensitive data in S3 objects and report findings without enforcing access controls.","Amazon Macie discovers sensitive data in Amazon S3 objects. Its data identifiers describe what to look for in object content, such as financial information, personal information, or an organization's internal identifiers. They classify content; they do not grant or deny access to it.",{"slug":583,"title":584,"focus":585,"teaser":586},"amazon-macie-vs-amazon-guardduty-sensitive-data-discovery-and-threat-detection-saa-c03","Amazon Macie vs Amazon GuardDuty: sensitive data discovery and threat detection","When to use Macie to identify sensitive data in S3 rather than GuardDuty to detect suspicious activity and threats.","Amazon Macie answers a data discovery question: “Which objects in Amazon S3 contain sensitive information?” Use it to identify data such as personal information or payment card numbers so you can review how that data is stored and protected.",{"slug":588,"title":589,"focus":590,"teaser":591},"aws-security-hub-consolidated-security-findings-saa-c03","AWS Security Hub: consolidated security findings","How Security Hub CSPM combines findings from integrated security services and standards-based control checks into a unified view of AWS security posture.","AWS Security Hub CSPM brings security findings and configuration-check results into one place. CSPM means cloud security posture management: understanding how securely your cloud resources are configured and where attention is needed.",{"slug":593,"title":594,"focus":595,"teaser":596},"aws-security-hub-vs-amazon-guardduty-saa-c03","AWS Security Hub vs Amazon GuardDuty","When a workload needs GuardDuty's threat detection versus Security Hub's consolidated security posture management, and why they are complementary.","Amazon GuardDuty answers: “Does observed activity suggest a threat?” It analyzes AWS activity signals to detect signs of malicious or unauthorized behavior. Choose it when a workload needs threat detection, such as identifying suspicious use of AWS credentials.",{"slug":598,"title":599,"focus":600,"teaser":601},"aws-shield-ddos-protection-with-standard-and-advanced-saa-c03","AWS Shield: DDoS protection with Standard and Advanced","How Shield Standard and Advanced protect supported AWS application entry points from DDoS attacks, including Advanced integration with AWS WAF for application-layer mitigation.","A distributed denial-of-service attack, or DDoS attack, tries to exhaust capacity so legitimate users cannot use an application. Network and transport-layer attacks can flood bandwidth or overwhelm connection handling. AWS Shield Standard automatically protects AWS customers against common attacks at these layers, without a separate subscription or an activation step.",{"slug":603,"title":604,"focus":605,"teaser":606},"aws-waf-filtering-requests-with-web-acls-saa-c03","AWS WAF: filtering requests with web ACLs","How web ACLs attached to supported application endpoints evaluate ordered custom, managed, and rate-based rules to allow or block HTTP requests.","AWS WAF inspects HTTP and HTTPS requests at supported application endpoints. A web access control list, or web ACL, holds the rules and default action that decide whether a request can continue. You associate the web ACL with the endpoint; you do not deploy WAF as a separate proxy server.",{"slug":608,"title":609,"focus":610,"teaser":611},"aws-shield-vs-aws-waf-ddos-protection-and-request-filtering-saa-c03","AWS Shield vs AWS WAF: DDoS protection and request filtering","How Shield’s managed DDoS protection differs from AWS WAF’s web request filtering, and why applications may need both.","AWS Shield provides managed protection against distributed denial of service (DDoS) attacks. A DDoS attack uses distributed sources to overwhelm capacity or resources and make an application unavailable. Network traffic floods and floods of connection attempts are examples: the attack does not need to contain malicious web request content.",{"slug":613,"title":614,"focus":615,"teaser":616},"ddos-mitigation-matching-defenses-to-attack-layers-saa-c03","DDoS Mitigation: matching defenses to attack layers","How to place defenses before the resources an attack can exhaust, using AWS edge protections to preserve legitimate access without leaving an origin bypass.","A distributed denial-of-service attack tries to exhaust a resource so legitimate users cannot use it. Start by naming that resource. A volumetric flood consumes bandwidth; a protocol attack such as a SYN flood targets connection establishment or network state; an application-layer flood consumes work through HTTP requests. Blocking traffic after the scarce resource has already been consumed is too late.",{"slug":618,"title":619,"focus":620,"teaser":621},"sql-injection-protecting-the-query-boundary-saa-c03","SQL Injection: protecting the query boundary","How parameterized queries keep untrusted input from becoming SQL instructions, and why cloud request filtering cannot replace this protection.","SQL injection happens when untrusted input becomes executable SQL. Joining request text onto SELECT * FROM orders WHERE order_id = lets that text change the query's meaning. The database executes the result with the application's database permissions, not the requester's intended permissions.",{"slug":623,"title":624,"focus":625,"teaser":626},"cross-site-scripting-safe-rendering-of-untrusted-content-saa-c03","Cross-Site Scripting: safe rendering of untrusted content","How unsafe rendering enables browser-side code execution, and why context-aware output handling is the primary defense rather than application-layer filtering alone.","Cross-site scripting (XSS) happens when an application lets untrusted content cross the boundary from data into executable browser content. A support portal might intend to display a customer message but insert it as raw HTML instead. Attacker-controlled markup can then cause the browser to execute code.",{"slug":628,"title":629,"focus":630,"teaser":631},"cross-site-scripting-vs-sql-injection-saa-c03","Cross-Site Scripting vs SQL Injection","How browser execution differs from database query injection, and why their primary defenses protect different interpretation boundaries.","Cross-site scripting (XSS) and SQL injection share a basic mistake: untrusted data becomes instructions. The distinction is the interpreter that gives those instructions meaning. An attack arriving in a web request is not necessarily an attack on the browser; follow the input to where it is interpreted.",{"slug":633,"title":634,"focus":635,"teaser":636},"ip-routing-subnet-route-tables-saa-c03","IP Routing: subnet route tables","How subnet associations and longest-prefix matching select local and internet forwarding paths for IPv4 and IPv6.","A subnet route table supplies forwarding rules for traffic leaving a subnet. Each route pairs a destination, written as a CIDR address range, with a target, such as local VPC routing or an internet gateway. The destination describes which packets match; the target describes where to send them.",{"slug":638,"title":639,"focus":640,"teaser":641},"amazon-vpc-subnet-addressing-and-routing-saa-c03","Amazon VPC: subnet addressing and routing","How IP ranges, Availability Zone boundaries, and subnet route tables define public and private tiers with room for growth.","A VPC is a regional virtual network. Its IPv4 CIDR block defines an address range, such as 10.20.0.0\u002F16. Each subnet receives a nonoverlapping range contained within a VPC CIDR block. Instances take private IPv4 addresses from their subnet.",{"slug":643,"title":644,"focus":645,"teaser":646},"network-address-translation-private-subnet-ipv4-egress-saa-c03","Network Address Translation: private-subnet IPv4 egress","How stateful source translation and the required route path give private workloads outbound IPv4 access without exposing them to unsolicited inbound connections or replacing security controls.","Source Network Address Translation (source NAT) changes a packet's sender address. It lets a workload with only a private IPv4 address initiate connections to internet destinations without receiving its own public IPv4 address.",{"slug":648,"title":649,"focus":650,"teaser":651},"ip-routing-versus-network-address-translation-saa-c03","IP Routing versus Network Address Translation","How selecting a forwarding path differs from translating packet addresses, and why neither operation substitutes for the other.","IP routing selects a forwarding path. It examines a packet’s destination IP address and uses routing information to choose a next hop, such as a gateway. Selecting that next hop does not itself translate the packet’s source or destination address.",{"slug":653,"title":654,"focus":655,"teaser":656},"amazon-vpc-nat-gateway-egress-saa-c03","Amazon VPC: NAT gateway egress","How NAT gateway routing and placement provide private-subnet egress, balancing availability and transfer costs against NAT instance alternatives.","A public NAT gateway lets workloads with private IPv4 addresses initiate internet connections without assigning public IPv4 addresses to those workloads. Replies return through the translation state, but internet hosts cannot initiate unsolicited connections through the NAT gateway.",{"slug":658,"title":659,"focus":660,"teaser":661},"network-segmentation-enforcing-workload-trust-boundaries-saa-c03","Network Segmentation: enforcing workload trust boundaries","How public, private, and isolated subnet placement works with routing and traffic filters to permit required connections while isolating workload tiers.","Network segmentation limits which workloads can reach one another. Start with the required source, destination, protocol, and port; then choose subnet placement and traffic rules. A subnet belongs to one Availability Zone, and its associated route table determines where traffic goes. A subnet name does not determine its connectivity.",{"slug":663,"title":664,"focus":665,"teaser":666},"trust-boundaries-versus-network-segmentation-saa-c03","Trust Boundaries versus Network Segmentation","How logical changes in trust differ from network isolation, and why subnet placement alone neither establishes trust nor captures every trust boundary.","A trust boundary marks a change in security assumptions: who controls a component, which identity is acting, or how much confidence the receiver can place in incoming data. Crossing it requires explicit checks appropriate to the interaction. It is a logical distinction, not necessarily a network edge.",{"slug":668,"title":669,"focus":670,"teaser":671},"subnetting-cidr-subdivision-and-boundaries-saa-c03","Subnetting: CIDR subdivision and boundaries","How extending a network prefix creates smaller subnets, determines their address counts, and constrains valid boundaries when dividing a parent block into equal or unequal ranges.","An IPv4 address has 32 bits. In CIDR notation, the number after the slash counts the bits fixed as the network prefix. The remaining bits vary to identify addresses within that block. A prefix of length p therefore contains 2^(32 − p) total addresses: a \u002F24 has 256, while a \u002F26 has 64.",{"slug":673,"title":674,"focus":675,"teaser":676},"trust-boundaries-identifying-crossings-in-application-data-flows-saa-c03","Trust Boundaries: identifying crossings in application data flows","How changes in exposure, identity, or administrative control reveal where application flows require explicit security checks, even between private workload tiers.","A trust boundary is a point where a flow enters a different security context. To find one, follow the data and ask three questions: does its exposure change, does the receiving component rely on a different identity, or does a different team have administrative control?",{"slug":678,"title":679,"focus":680,"teaser":681},"leased-lines-vs-virtual-private-networks-saa-c03","Leased Lines vs Virtual Private Networks","How a carrier-provisioned circuit differs from a VPN tunnel in deployment, performance predictability, and encryption, and why a VPN can run over a leased line.","A leased line is a carrier-provisioned circuit between specified endpoints, with contracted capacity and service terms. The carrier may use shared infrastructure with logical isolation; private connectivity does not require an exclusive fiber strand along the whole route.",{"slug":683,"title":684,"focus":685,"teaser":686},"encryption-in-transit-protecting-application-connections-with-tls-saa-c03","Encryption in Transit: protecting application connections with TLS","How to configure TLS-protected application paths using trusted certificates, modern protocol versions, and explicit protection across termination points.","Transport Layer Security (TLS) protects application traffic against interception and modification while it travels between endpoints. HTTPS is HTTP carried over TLS. Encrypting a disk or database does not protect these connections; encryption at rest and encryption in transit solve different problems.",{"slug":688,"title":689,"focus":690,"teaser":691},"ipsec-gateway-to-gateway-tunnel-protection-saa-c03","IPsec: gateway-to-gateway tunnel protection","How IKE and ESP establish authenticated, encrypted tunnels for external cloud traffic, and where that protection ends.","IPsec protects traffic at the IP layer, so a gateway-to-gateway tunnel can carry traffic for many applications without changing those applications. For external cloud connectivity, AWS Site-to-Site VPN uses IPsec between a customer network gateway and an AWS tunnel endpoint.",{"slug":693,"title":694,"focus":695,"teaser":696},"ipsec-and-link-layer-encryption-protection-boundaries-saa-c03","IPsec and Link-Layer Encryption: protection boundaries","How IPsec's gateway-to-gateway protection differs from link-layer encryption such as MACsec on supported Direct Connect links.","An encryption claim needs a protection boundary: the endpoints where protection starts and stops. IPsec can protect IP traffic between security gateways across a routed network. MACsec protects Ethernet frames between participating link-layer devices.",{"slug":698,"title":699,"focus":700,"teaser":701},"aws-site-to-site-vpn-encrypted-hybrid-connections-saa-c03","AWS Site-to-Site VPN: encrypted hybrid connections","How customer gateways, AWS gateways, IPsec settings, routing, and redundant tunnels establish secure connectivity between an on-premises network and AWS.","AWS Site-to-Site VPN carries traffic between networks through encrypted IPsec tunnels. Here, an on-premises application reaches an EC2 instance by its private IP address. We use an internet-based VPN connection: encryption protects the traffic crossing the public network.",{"slug":703,"title":704,"focus":705,"teaser":706},"aws-client-vpn-secure-remote-access-endpoints-saa-c03","AWS Client VPN: secure remote-access endpoints","How a Client VPN endpoint provides encrypted remote-user access, with authentication, target network associations, routes, and authorization rules controlling which resources users can reach.","AWS Client VPN is a managed remote-access VPN service. A user runs a compatible VPN client and connects to a Client VPN endpoint. The encrypted tunnel protects traffic between the user's device and that endpoint; use application encryption, such as HTTPS, when protection must continue to the application.",{"slug":708,"title":709,"focus":710,"teaser":711},"aws-client-vpn-vs-aws-site-to-site-vpn-saa-c03","AWS Client VPN vs AWS Site-to-Site VPN","How remote-user connectivity through Client VPN differs from network-to-network connectivity through Site-to-Site VPN, and when each is appropriate.","AWS Client VPN connects individual remote devices to a network. A user runs compatible VPN software and connects to a managed Client VPN endpoint. Choose this model for people working from home or traveling who need access to private resources.",{"slug":713,"title":714,"focus":715,"teaser":716},"aws-direct-connect-securing-connectivity-to-aws-saa-c03","AWS Direct Connect: Securing connectivity to AWS","How virtual interfaces control connectivity to AWS destinations, why a private connection is not encrypted by default, and where MACsec or an IPsec overlay provides protection.","AWS Direct Connect provides connectivity from your network to AWS without using the public internet as the transport path. A virtual interface (VIF) is a logical interface on that connection. Its VLAN separates traffic, and its BGP routing session exchanges reachability information.",{"slug":718,"title":719,"focus":720,"teaser":721},"aws-direct-connect-vs-aws-site-to-site-vpn-saa-c03","AWS Direct Connect vs AWS Site-to-Site VPN","How the services differ in transport, encryption, provisioning time, throughput consistency, and cost when choosing hybrid connectivity.","Both services connect an on-premises network to AWS. AWS Direct Connect provides connectivity through a Direct Connect location, bypassing the public internet. A typical AWS Site-to-Site VPN carries network traffic inside encrypted IPsec tunnels over an existing internet connection. Here, VPN means this internet-based deployment unless stated otherwise.",{"id":244,"title":723,"subtitle":152,"lessons":724},"Determine appropriate data security controls",[725,730,735,740,745,750,755,760,765,770,775,780,785,790,795,800,805,810,815,820,825,830,835,840,845,850,855,860,865,870,875,880,885,890,895,900,905,910,915,920,925,930,935,940,945,950,955,960,965,970,975,980,985],{"slug":726,"title":727,"focus":728,"teaser":729},"access-control-data-resource-permissions-saa-c03","Access Control: data resource permissions","How caller permissions and resource-side grants combine to authorize data access within and across accounts.","A data-access request asks whether a particular principal, such as an IAM role, may perform an action on a resource. For example, reading an S3 object uses s3:GetObject. Permission to list a bucket is a different action and does not itself permit reading its objects.",{"slug":731,"title":732,"focus":733,"teaser":734},"access-control-encryption-key-permissions-saa-c03","Access Control: encryption-key permissions","How key access policies distinguish permission to use encryption keys from permission to administer them, independently of access to encrypted data.","In AWS Key Management Service (AWS KMS), permissions apply to particular actions on particular keys. For a customer managed key, you control who can use the key and who can administer it. These are separate responsibilities, not two names for the same access.",{"slug":736,"title":737,"focus":738,"teaser":739},"access-control-permissions-for-data-protection-changes-saa-c03","Access Control: permissions for data protection changes","How to restrict deletion and changes to lifecycle, retention, and backup protection without blocking legitimate data access.","A workload that reads or writes data does not automatically need permission to delete it or change how long it survives. Separate a data-use role from a protection-administration role. Give the workload only its required operations on the intended resources; reserve deletion, lifecycle changes, retention changes, and backup administration for separately authorized roles.",{"slug":741,"title":742,"focus":743,"teaser":744},"aws-lake-formation-governed-data-lake-access-saa-c03","AWS Lake Formation: governed data lake access","How registering S3 locations and granting Data Catalog permissions lets Lake Formation govern fine-grained data access through integrated analytics services.","AWS Lake Formation controls access to data described by the AWS Glue Data Catalog. The files remain in Amazon S3. Catalog tables describe their columns, formats, and S3 locations, giving permissions a table-level meaning rather than just a bucket-and-object meaning.",{"slug":746,"title":747,"focus":748,"teaser":749},"aws-lake-formation-vs-aws-glue-governance-and-data-preparation-saa-c03","AWS Lake Formation vs AWS Glue: governance and data preparation","How Lake Formation's data governance role differs from AWS Glue's cataloging and data preparation role, and when a data lake uses both.","AWS Glue helps make data discoverable and usable. Its crawlers can discover schemas and populate the Glue Data Catalog, which stores metadata such as columns, formats, and data locations. Glue ETL jobs read, transform, and write the actual data. A catalog entry describes data; it does not clean or convert the files.",{"slug":751,"title":752,"focus":753,"teaser":754},"recovery-point-objective-vs-recovery-time-objective-saa-c03","Recovery Point Objective vs. Recovery Time Objective","How acceptable data loss differs from acceptable service downtime, and why meeting either objective does not imply meeting the other.","Recovery Point Objective (RPO) is the maximum acceptable loss of recent data, expressed as time. A five-minute RPO means recovery must preserve data through a point no more than five minutes before the disruption. It asks: How much recent work can we afford to lose?",{"slug":756,"title":757,"focus":758,"teaser":759},"recovery-point-objective-meeting-data-loss-limits-saa-c03","Recovery Point Objective: meeting data-loss limits","How to evaluate the age of the latest usable recovery point against business data-loss limits when choosing backup frequency or replication, including failure exposure and cost tradeoffs.","Recovery Point Objective (RPO) is the maximum amount of recent data loss the business accepts, expressed as time. A 30-minute RPO requires recovery to a data state no more than 30 minutes before the disruption. Set the objective for each dataset according to the business impact of losing its changes.",{"slug":761,"title":762,"focus":763,"teaser":764},"recovery-time-objective-end-to-end-recovery-budgets-saa-c03","Recovery Time Objective: end-to-end recovery budgets","How to budget and verify the complete recovery timeline, including dependencies and service validation, to determine whether restore procedures and disaster recovery designs meet acceptable downtime.","A Recovery Time Objective (RTO) is the business target for how long a service may remain unavailable after a disruption. It is not a database restore duration or a provider guarantee. Agree on the failure being covered, such as loss of a Region, and which business operations must resume.",{"slug":766,"title":767,"focus":768,"teaser":769},"backup-and-restore-recovery-point-policies-saa-c03","Backup and Restore: recovery-point policies","How backup frequency and protected retention determine recoverable history, isolation from failures, and storage cost.","A recovery point represents a recoverable state of your data. Backup frequency controls the spacing between scheduled recovery points. Choose it from the recovery point objective (RPO): the maximum acceptable data loss measured in time. Daily backups can leave nearly a day of changes unprotected; hourly backups reduce that gap, assuming jobs succeed and usable recovery points become available on time.",{"slug":771,"title":772,"focus":773,"teaser":774},"backup-and-restore-vs-database-replication-saa-c03","Backup and Restore vs. Database Replication","Why maintaining a current replica does not provide the same recovery from unwanted changes as preserving earlier recoverable states.","Database replication maintains another copy of changing data. After an initial copy, replication transfers ongoing changes, including inserts, updates, and deletes. This can support availability or read scaling, depending on the database and configuration.",{"slug":776,"title":777,"focus":778,"teaser":779},"backup-and-restore-vs-data-archiving-saa-c03","Backup and Restore vs. Data Archiving","How operational recovery differs from long-term data preservation in purpose, retrieval expectations, and retention.","Backup and restore supports operational recovery after deletion, corruption, or failure. A backup preserves a recoverable state; a restore uses that state to recover usable data and application functionality. The question is: Can we get the workload working again?",{"slug":781,"title":782,"focus":783,"teaser":784},"backup-and-restore-tested-recovery-workflows-saa-c03","Backup and Restore: tested recovery workflows","How selecting an appropriate recovery point and testing the complete restoration workflow establishes whether a workload meets its recovery objectives.","Backup and restore recovers a workload from a preserved state. A completed backup job proves that a backup was created; it does not prove that the application can recover within its business requirements.",{"slug":786,"title":787,"focus":788,"teaser":789},"aws-backup-recovery-points-and-backup-copies-saa-c03","AWS Backup: recovery points and backup copies","How recovery points held in backup vaults, including cross-Region and cross-account copies, provide independent backups that can be restored after data loss.","A recovery point is a backup of a protected resource. For a snapshot-based backup, such as an Amazon EBS backup, it represents the resource's data at a particular time. Later changes to the live volume do not rewrite that earlier backup.",{"slug":791,"title":792,"focus":793,"teaser":794},"aws-backup-backup-plans-and-lifecycle-rules-saa-c03","AWS Backup: backup plans and lifecycle rules","How backup plans automate protection of selected resources through schedules, retention periods, and supported cold-storage transitions.","An AWS Backup plan is a reusable protection policy containing one or more backup rules. Rules define when backups run, how long they are retained, and any supported lifecycle transitions. A plan can apply consistent protection to many resources without separate scheduling scripts.",{"slug":796,"title":797,"focus":798,"teaser":799},"amazon-s3-version-based-data-protection-saa-c03","Amazon S3: version-based data protection","How object versioning and replication protect against overwrites, deletions, and loss of a source bucket.","In an S3 general purpose bucket, an object’s key is its name. With S3 Versioning enabled, writing to an existing key creates a new version with its own version ID. The previous version becomes noncurrent rather than disappearing. An ordinary read returns the current version; a read with a version ID can retrieve an older one.",{"slug":801,"title":802,"focus":803,"teaser":804},"aws-backup-vs-amazon-s3-glacier-managed-backups-versus-archival-storage-saa-c03","AWS Backup vs Amazon S3 Glacier: managed backups versus archival storage","When centralized protection of supported resources calls for AWS Backup rather than archival storage using Amazon S3 Glacier storage classes.","AWS Backup and Amazon S3 Glacier storage classes solve different problems. AWS Backup centrally manages backup protection for supported resources. S3 Glacier storage classes provide archival storage for S3 objects. The choice starts with the job you need done, not simply how long you need to keep data.",{"slug":806,"title":807,"focus":808,"teaser":809},"aws-elastic-disaster-recovery-vs-aws-backup-choosing-recovery-protection-saa-c03","AWS Elastic Disaster Recovery vs AWS Backup: choosing recovery protection","When replication-based server recovery or backup-and-restore protection better fits recovery objectives, retention needs, and cost constraints.","Recovery point objective (RPO) is the maximum acceptable data loss measured in time. If the newest usable recovery point is older than the RPO allows, protection is insufficient—even if recovery is fast.",{"slug":811,"title":812,"focus":813,"teaser":814},"data-classification-categories-and-handling-requirements-saa-c03","Data Classification: categories and handling requirements","How data owners assign categories based on sensitivity and business impact and map them to handling requirements, including retention obligations.","Data classification assigns information to categories based on sensitivity and business impact. Assess the consequences of unauthorized disclosure, modification, loss, and unavailability—not just whether the data contains personal identifiers. Public information can still need strong protection against unauthorized changes or outages.",{"slug":816,"title":817,"focus":818,"teaser":819},"data-retention-defining-retention-periods-saa-c03","Data Retention: defining retention periods","How classification, business obligations, and recovery needs determine retention clocks and minimum and maximum periods for production data and recovery points, independently of backup frequency.","A retention period is an approved length of time to keep data, not a default chosen by the storage service. Start with classification: identify the data's purpose, sensitivity, owner, and applicable obligations. Financial evidence, customer records, and temporary diagnostic data can need different periods. Sensitivity alone does not determine a duration.",{"slug":821,"title":822,"focus":823,"teaser":824},"data-retention-vs-storage-tiering-saa-c03","Data Retention vs. Storage Tiering","How keeping data for an approved period differs from changing its storage class, including why tier transitions and minimum storage duration charges do not establish retention protection or disposal deadlines.","Data retention determines how long data must be kept and when it should be disposed of under an approved policy. Storage tiering chooses a storage class that fits the data's access needs and cost. A record can pass through several storage classes during one retention period.",{"slug":826,"title":827,"focus":828,"teaser":829},"amazon-s3-storage-classes-and-lifecycle-rules-saa-c03","Amazon S3: storage classes and lifecycle rules","How lifecycle rules transition and expire object versions according to access needs, retrieval costs, and retention requirements.","Choose an S3 storage class by how often objects will be read, how quickly reads must complete, and how long the data must remain stored. S3 Standard suits frequent access. S3 Standard-IA suits infrequent access that still needs immediate reads. S3 One Zone-IA also provides immediate reads, but stores data in one Availability Zone; use it for data you can recreate, not your only irreplaceable copy.",{"slug":831,"title":832,"focus":833,"teaser":834},"data-retention-lifecycle-expiration-saa-c03","Data Retention: lifecycle expiration","How approved disposal deadlines become lifecycle expiration rules that account for object versions, database records, and retained copies without mistaking archival transitions for deletion.","An approved disposal policy becomes an executable rule only when you identify which data it covers, what starts its clock, and what action removes it. In Amazon S3, lifecycle filters can select objects by prefix or tags, while expiration conditions determine when selected objects become eligible for deletion.",{"slug":836,"title":837,"focus":838,"teaser":839},"immutable-storage-vs-data-retention-saa-c03","Immutable Storage vs. Data Retention","Why specifying how long data should be kept does not necessarily prevent its alteration or early deletion.","Data retention specifies how long data should be kept. “Keep audit records for one year” describes the required outcome, but it does not itself stop anyone from changing or deleting those records during that year.",{"slug":841,"title":842,"focus":843,"teaser":844},"data-retention-protection-against-premature-deletion-saa-c03","Data Retention: protection against premature deletion","How immutable retention controls enforce minimum retention periods, including S3 Object Lock modes, legal-hold exceptions, and AWS Backup Vault Lock constraints.","A retention setting says how long data should remain; an immutable retention control prevents early deletion. For Amazon S3, Object Lock protects individual object versions against permanent deletion or overwrite. It requires S3 Versioning. A time-based retention setting gives a version a retain-until date: protection lasts until that date, subject to the selected mode.",{"slug":846,"title":847,"focus":848,"teaser":849},"legal-holds-enforcing-preservation-saa-c03","Legal Holds: enforcing preservation","How scoped object versions and backup recovery points are protected from deletion, with restricted hold administration and verified retrieval.","A legal hold prevents disposal of information needed for a legal matter or investigation. Start with a preservation inventory: the case reference, relevant records, timestamps, owners, locations, and copies. A case tag helps find evidence, but does not prevent deletion.",{"slug":851,"title":852,"focus":853,"teaser":854},"legal-holds-and-data-retention-release-versus-expiration-saa-c03","Legal Holds and Data Retention: release versus expiration","How explicitly released legal holds differ from time-based retention and why removing either control does not override the other.","A legal hold preserves information for a legal matter or investigation until an authorized person explicitly releases it. A case closing does not itself change the storage control. Time-based retention instead protects information for a defined period; that protection ends when the retention deadline passes.",{"slug":856,"title":857,"focus":858,"teaser":859},"encryption-confidentiality-boundaries-saa-c03","Encryption: confidentiality boundaries","How encryption placement, key protection, and decryption permissions determine who can read data at rest and in transit.","Encryption turns readable plaintext into ciphertext. Its confidentiality boundary depends on where encryption starts and where decryption happens—not simply on whether a resource is marked encrypted.",{"slug":861,"title":862,"focus":863,"teaser":864},"key-management-control-throughout-the-key-lifecycle-saa-c03","Key Management: control throughout the key lifecycle","How key custody, access permissions, rotation, and retirement preserve authorized decryption while preventing key exposure and irreversible data loss.","Key custody concerns where key material is held and who can operate it. AWS owned keys leave key management to AWS. AWS managed keys are managed by an AWS service in your account. A customer managed KMS key gives you control over its policy and lifecycle, but does not mean your application holds the underlying key material. With standard KMS-generated symmetric encryption keys, applications request cryptographic operations rather than retrieve that material.",{"slug":866,"title":867,"focus":868,"teaser":869},"envelope-encryption-data-keys-and-key-wrapping-saa-c03","Envelope Encryption: data keys and key wrapping","How data keys encrypt payloads locally while separately protected wrapping keys control access to those data keys.","Envelope encryption separates encrypting data from protecting the key that encrypts it. A data encryption key (DEK) encrypts the payload, such as a document, locally in the component handling that data. A separate key-encryption key (KEK), also called a wrapping key, encrypts the DEK.",{"slug":871,"title":872,"focus":873,"teaser":874},"aws-kms-envelope-encryption-for-data-at-rest-saa-c03","AWS KMS: envelope encryption for data at rest","How AWS services use KMS keys to protect data keys through envelope encryption, and how key ownership and availability affect access to encrypted data.","Envelope encryption separates encrypting data from protecting the key that encrypts it. A data key encrypts the actual data. A KMS key protects that data key. The AWS service handles the bulk data; it does not send the entire object to KMS for encryption.",{"slug":876,"title":877,"focus":878,"teaser":879},"aws-cloudhsm-hsm-backed-keys-and-cryptographic-operations-saa-c03","AWS CloudHSM: HSM-backed keys and cryptographic operations","How applications use customer-controlled keys inside CloudHSM through authenticated cryptographic sessions without exposing nonextractable key material.","AWS CloudHSM provides hardware security modules in which you control cryptographic keys and access to them. An application can ask an HSM to perform an operation without receiving the key material used for that operation.",{"slug":881,"title":882,"focus":883,"teaser":884},"aws-cloudhsm-vs-aws-kms-choosing-key-control-saa-c03","AWS CloudHSM vs AWS KMS: choosing key control","How CloudHSM and KMS differ in key custody, application interfaces, AWS service integration, and operational responsibility.","Both AWS KMS and AWS CloudHSM protect cryptographic keys with hardware security modules, or HSMs. The choice is not hardware protection versus software protection. It is how directly you must control the HSM and how much responsibility you want to take on.",{"slug":886,"title":887,"focus":888,"teaser":889},"aws-compliance-mapping-requirements-to-workload-controls-saa-c03","AWS Compliance: mapping requirements to workload controls","How to translate applicable obligations into workload controls and evidence, accounting for customer responsibilities and AWS service, Region, and assurance scope.","Compliance means meeting applicable requirements and demonstrating that the required controls work. Start by classifying the workload's data and identifying obligations from laws, industry standards, contracts, and internal policies. Confirm applicability with the organization's legal, security, and compliance owners rather than choosing a framework simply because AWS supports it.",{"slug":891,"title":892,"focus":893,"teaser":894},"aws-artifact-compliance-reports-saa-c03","AWS Artifact: compliance reports","How to obtain AWS compliance reports, interpret their scope, and distinguish evidence of AWS compliance from the customer's own compliance responsibilities.","AWS Artifact Reports provides on-demand access to AWS security and compliance documents, including SOC reports, ISO certificates, and PCI reports. Use these when an auditor or your risk team needs evidence about AWS controls. Artifact does not inspect your workload or certify your application.",{"slug":896,"title":897,"focus":898,"teaser":899},"data-locality-vs-data-residency-saa-c03","Data Locality vs Data Residency","How proximity for efficient data access differs from restrictions on where data may be stored or processed.","Data locality describes proximity between data and the computation or people that use it. Its purpose is efficient access: reducing unnecessary network movement and latency, and potentially reducing transfer costs. Running a processing job near the dataset it repeatedly reads is a locality choice.",{"slug":901,"title":902,"focus":903,"teaser":904},"data-residency-geographic-boundaries-in-aws-saa-c03","Data Residency: geographic boundaries in AWS","How residency requirements constrain Region and Availability Zone selection for a workload and its data copies, including backups and logs.","A data residency requirement identifies where specified data may be stored or processed. Translate it into an explicit list of approved AWS Regions with your legal and compliance teams. Identify the covered data classes: customer records, for example, may have different restrictions from public assets.",{"slug":906,"title":907,"focus":908,"teaser":909},"amazon-cloudwatch-and-aws-cloudtrail-operational-monitoring-versus-activity-auditing-saa-c03","Amazon CloudWatch and AWS CloudTrail: operational monitoring versus activity auditing","How CloudWatch operational telemetry differs from CloudTrail records of account and API activity, and when each provides the visibility needed.","Amazon CloudWatch provides operational visibility: how resources and applications are behaving. Metrics such as CPU utilization show changes over time, while application logs provide details about failures. Use this evidence to investigate performance, availability, and application health.",{"slug":911,"title":912,"focus":913,"teaser":914},"aws-config-rules-and-automatic-remediation-saa-c03","AWS Config: rules and automatic remediation","How Config rules evaluate resource configurations and trigger Systems Manager Automation remediation when resources become noncompliant.","AWS Config records supported resource configurations as configuration items: point-in-time descriptions of resource settings and relationships. Enable recording for the resource types you want to check. A Config rule evaluates applicable resources against a requirement and reports results such as COMPLIANT or NON_COMPLIANT.",{"slug":916,"title":917,"focus":918,"teaser":919},"aws-config-and-aws-cloudformation-compliance-versus-stack-drift-saa-c03","AWS Config and AWS CloudFormation: compliance versus stack drift","How checking resource compliance against Config rules differs from detecting differences between deployed resources and CloudFormation templates.","AWS Config rules ask whether a resource meets a defined requirement. A rule might require an ownership tag or prohibit a particular network setting. The baseline is the rule's policy, not the template that created the resource. A compliant result means the resource passes that rule; it does not certify every aspect of the resource.",{"slug":921,"title":922,"focus":923,"teaser":924},"encryption-at-rest-storage-encryption-coverage-saa-c03","Encryption at Rest: storage encryption coverage","How to determine which stored data and copies a storage encryption setting protects, including why new defaults do not necessarily encrypt existing data.","Encryption coverage means the stored data and copies that a particular setting protects. Start by naming the storage resource, then list its snapshots, backups, replicas, exports, logs, and temporary files. Do not treat “the application is encrypted” as a useful boundary: one application can store data in several places.",{"slug":926,"title":927,"focus":928,"teaser":929},"client-side-encryption-vs-server-side-encryption-saa-c03","Client-Side Encryption vs. Server-Side Encryption","How the encryption boundary determines whether the storage service receives plaintext, and why supplying a customer key does not make server-side encryption client-side.","Plaintext is readable data; ciphertext is its encrypted form. To distinguish client-side from server-side encryption, locate the encryption operation relative to the storage-service boundary. Ask what the storage service receives, not just whether the stored object is encrypted.",{"slug":931,"title":932,"focus":933,"teaser":934},"encryption-at-rest-encryption-key-dependencies-saa-c03","Encryption at Rest: encryption key dependencies","How envelope encryption connects stored data to KMS keys, and how key ownership, permissions, and lifecycle choices affect confidentiality and continued access.","Envelope encryption separates bulk data encryption from key protection. A data key encrypts the object’s contents. A separate KMS key encrypts, or wraps, that data key. The service stores the encrypted data key with the encrypted object, not the plaintext data key.",{"slug":936,"title":937,"focus":938,"teaser":939},"server-side-encryption-configuring-protection-at-rest-saa-c03","Server-Side Encryption: configuring protection at rest","How service-side encryption uses managed keys to protect stored data, and how key choices and permissions govern transparent decryption.","Server-side encryption means the receiving service encrypts data before storing it and decrypts it for an authorized reader. Applications use normal storage requests rather than implementing encryption themselves. Use TLS as well: protection at rest does not protect data travelling over the network.",{"slug":941,"title":942,"focus":943,"teaser":944},"client-side-encryption-application-side-envelope-encryption-saa-c03","Client-Side Encryption: application-side envelope encryption","How applications encrypt data before storage and recover it using protected data keys, keeping storage access separate from decryption authority.","With client-side encryption, the application encrypts data before sending it to storage. The application can run in the cloud: “client-side” identifies where encryption happens, not where the computer is located.",{"slug":946,"title":947,"focus":948,"teaser":949},"transport-layer-security-securing-every-network-hop-saa-c03","Transport Layer Security: securing every network hop","How to enforce authenticated, encrypted connections across TLS termination boundaries using appropriate protocol policies and certificate validation.","Transport Layer Security (TLS) protects traffic against disclosure and undetected changes. During connection setup, the endpoints negotiate security settings and establish keys. In HTTPS, the client also validates the server certificate to check that it is connecting to the intended server.",{"slug":951,"title":952,"focus":953,"teaser":954},"aws-certificate-manager-acm-provisioning-certificates-for-https-saa-c03","AWS Certificate Manager (ACM): provisioning certificates for HTTPS","How to provision and validate an ACM certificate for the required domain names and Region so an integrated AWS service can use it to terminate TLS.","AWS Certificate Manager (ACM) provisions and manages TLS certificates. For a public HTTPS website, request a public certificate: it lets a client authenticate the website's domain name during the TLS handshake. An integrated AWS service presents that certificate and terminates TLS; ACM itself does not receive the website's HTTPS traffic.",{"slug":956,"title":957,"focus":958,"teaser":959},"mutual-tls-establishing-trusted-peer-connections-saa-c03","Mutual TLS: establishing trusted peer connections","How certificate validation and private-key proof establish an encrypted connection that authenticates both client and server.","Mutual TLS (mTLS) establishes an encrypted connection that authenticates both the client and the server. Each peer presents a certificate that binds an identity to a public key. Each side must be configured with trusted certificate authorities; they do not have to trust the same authorities.",{"slug":961,"title":962,"focus":963,"teaser":964},"mutual-tls-vs-server-authenticated-transport-layer-security-saa-c03","Mutual TLS vs. server-authenticated Transport Layer Security","How mutual TLS differs from server-authenticated TLS in whose identity is verified, rather than whether traffic is encrypted.","Transport Layer Security (TLS) protects application traffic against disclosure and undetected modification. Both server-authenticated TLS and mutual TLS (mTLS) provide this protection. Their difference is whose identity is verified, not whether traffic is encrypted.",{"slug":966,"title":967,"focus":968,"teaser":969},"backup-isolation-independent-recovery-boundaries-saa-c03","Backup Isolation: independent recovery boundaries","How separate backup administration, protected retention, and independent encryption-key control preserve usable recovery copies when production is compromised.","Backup isolation keeps recovery copies outside the effective control of production systems and identities. If production credentials are stolen, the attacker should not automatically gain permission to delete backups, shorten retention, or disable the keys needed to restore them.",{"slug":971,"title":972,"focus":973,"teaser":974},"amazon-dynamodb-replication-and-availability-saa-c03","Amazon DynamoDB: replication and availability","How automatic multi-AZ replication and global tables provide regional and cross-Region resilience, including their consistency and cost tradeoffs.","Every DynamoDB table automatically stores data across multiple Availability Zones within one AWS Region. DynamoDB manages these copies and the infrastructure failures they protect against. You do not select AZs, create standby instances, or promote an AZ replica. This built-in protection does not create a copy in another Region.",{"slug":976,"title":977,"focus":978,"teaser":979},"immutable-storage-retention-locks-saa-c03","Immutable Storage: retention locks","How retention locks protect individual record versions, including privileged bypass rules, legal holds, and limits on lifecycle deletion.","Amazon S3 Object Lock protects individual object versions against permanent deletion and overwriting. It works with S3 Versioning: enable Object Lock on the bucket, then apply retention settings or a legal hold to the versions you need to preserve. Enabling Object Lock alone does not give every version a retention period.",{"slug":981,"title":982,"focus":983,"teaser":984},"key-rotation-rotating-aws-kms-key-material-saa-c03","Key Rotation: rotating AWS KMS key material","How automatic and manual AWS KMS rotation move new encryption to fresh key material while preserving access to older ciphertext.","An AWS KMS key is a logical resource with an identifier, permissions, and underlying key material. Rotation changes the material used for new encryption operations. A rotation schedule helps limit the period during which one material version is used to encrypt new data.",{"slug":986,"title":987,"focus":988,"teaser":989},"certificate-management-certificate-renewal-saa-c03","Certificate management: certificate renewal","How managed and imported certificates are renewed, validated, and deployed before expiration, including monitoring and the conditions required for automatic renewal.","Certificate renewal replaces a certificate before its validity ends. Success means the endpoint serves the replacement—not simply that a certificate authority issued it. Otherwise, clients can reject connections when the old certificate expires.",{"id":991,"title":992,"subtitle":152,"subcategories":993},55,"Design Resilient Architectures",[994,1673],{"id":995,"title":996,"subtitle":152,"lessons":997},219,"Design scalable and loosely coupled architectures",[998,1003,1008,1013,1018,1023,1028,1033,1038,1043,1048,1053,1058,1063,1068,1073,1078,1083,1088,1093,1098,1103,1108,1113,1118,1123,1128,1133,1138,1143,1148,1153,1158,1163,1168,1173,1178,1183,1188,1193,1198,1203,1208,1213,1218,1223,1228,1233,1238,1243,1248,1253,1258,1263,1268,1273,1278,1283,1288,1293,1298,1303,1308,1313,1318,1323,1328,1333,1338,1343,1348,1353,1358,1363,1368,1373,1378,1383,1388,1393,1398,1403,1408,1413,1418,1423,1428,1433,1438,1443,1448,1453,1458,1463,1468,1473,1478,1483,1488,1493,1498,1503,1508,1513,1518,1523,1528,1533,1538,1543,1548,1553,1558,1563,1568,1573,1578,1583,1588,1593,1598,1603,1608,1613,1618,1623,1628,1633,1638,1643,1648,1653,1658,1663,1668],{"slug":999,"title":1000,"focus":1001,"teaser":1002},"rest-stateless-resource-interfaces-saa-c03","REST: stateless resource interfaces","How resource identifiers, representations, and consistent HTTP semantics form a stateless interface that decouples clients from independently scalable backends.","REST, or Representational State Transfer, is an architectural style, not a protocol or product. A resource is something an application exposes, such as an order. Its identifier, such as \u002Forders\u002F123, names the resource rather than the database table or server that stores it.",{"slug":1004,"title":1005,"focus":1006,"teaser":1007},"apis-creating-and-managing-rest-interfaces-saa-c03","APIs: creating and managing REST interfaces","How to define and publish REST endpoints for backend operations, then manage access, request limits, and compatible changes to keep clients loosely coupled.","A REST interface exposes resources through paths and HTTP methods. For an orders API, GET \u002Fv1\u002Forders\u002F{id} retrieves an order, while POST \u002Fv1\u002Forders creates one. Define the required parameters, request body, response fields, and status codes, such as 201 for successful creation and 404 for a missing order. This contract, which can be described with OpenAPI, is what clients depend on.",{"slug":1009,"title":1010,"focus":1011,"teaser":1012},"amazon-api-gateway-creating-and-publishing-apis-saa-c03","Amazon API Gateway: creating and publishing APIs","How to choose an API type, connect routes to backend integrations, and publish the API through deployment stages.","Amazon API Gateway provides a managed entry point for clients to call backend functionality. Start by choosing the API type: HTTP API and REST API both support HTTP request-and-response applications. An HTTP API can serve a RESTful application; the product names do not describe two different application styles.",{"slug":1014,"title":1015,"focus":1016,"teaser":1017},"rate-limiting-traffic-budgets-and-throttling-policies-saa-c03","Rate Limiting: traffic budgets and throttling policies","How to choose and enforce sustained-rate and burst budgets that protect backend capacity during normal operation and failover without causing retry storms.","A sustained-rate budget controls how quickly requests can keep arriving over time. A burst budget allows a short concentration of requests without granting a permanently higher rate. Choose both: a safe average can still hide a burst large enough to overwhelm a backend.",{"slug":1019,"title":1020,"focus":1021,"teaser":1022},"exponential-backoff-vs-rate-limiting-saa-c03","Exponential Backoff vs. Rate Limiting","How reactive retry timing differs from proactive request-rate control, and when each control is appropriate.","Exponential backoff controls when a caller retries after a retryable failure. It is reactive: an unsuccessful attempt triggers a wait, and successive failures lead to progressively longer retry delays. For example, an illustrative schedule might wait one second, then two, then four. Backoff does not control the arrival rate of new requests.",{"slug":1024,"title":1025,"focus":1026,"teaser":1027},"amazon-sqs-buffered-work-queues-saa-c03","Amazon SQS: buffered work queues","How message buffering, receive-and-delete processing, and competing consumers let producers and workers operate and scale independently.","Amazon SQS is a managed message queue. A producer sends a message describing work, and a consumer, often called a worker, receives it later. The producer needs the queue to accept the message, not a worker to be ready at that moment.",{"slug":1029,"title":1030,"focus":1031,"teaser":1032},"amazon-sqs-standard-and-fifo-delivery-guarantees-saa-c03","Amazon SQS: Standard and FIFO delivery guarantees","How ordering, duplicate delivery, deduplication, and message groups determine queue choice and safe consumer processing.","Amazon SQS holds messages until consumers can work on them. Choosing Standard or FIFO determines what consumers can assume about delivery order and repeated messages—not whether the application can ignore failures.",{"slug":1034,"title":1035,"focus":1036,"teaser":1037},"amazon-sns-vs-amazon-sqs-fanout-or-queueing-saa-c03","Amazon SNS vs Amazon SQS: fanout or queueing","When requirements call for SNS message distribution, SQS buffered processing, or both services together.","Both services support loose coupling: a producer sends a message without directly calling the application that processes it. Choose between them by asking whether the requirement is to distribute a message, buffer work, or do both.",{"slug":1039,"title":1040,"focus":1041,"teaser":1042},"amazon-mq-vs-amazon-sqs-choosing-a-messaging-service-saa-c03","Amazon MQ vs Amazon SQS: choosing a messaging service","When broker compatibility favors Amazon MQ over Amazon SQS, considering application changes, capacity management, and operational responsibilities.","Amazon MQ is a managed message broker service for Apache ActiveMQ and RabbitMQ. Amazon SQS is a managed queue service with its own service API. Both can decouple applications, so “we need a queue” is not enough to choose between them.",{"slug":1044,"title":1045,"focus":1046,"teaser":1047},"aws-transfer-family-managed-file-transfer-endpoints-saa-c03","AWS Transfer Family: managed file-transfer endpoints","How managed protocol endpoints give existing file-transfer clients access to S3 or EFS, including endpoint placement, user permissions, and endpoint-hour and transfer charges.","AWS Transfer Family provides managed file-transfer server endpoints. Existing clients connect using SFTP, FTPS, or FTP, while files are stored in Amazon S3 or Amazon EFS. AWS operates the endpoint infrastructure; you configure its protocols, network placement, identities, and storage permissions.",{"slug":1049,"title":1050,"focus":1051,"teaser":1052},"aws-transfer-family-vs-aws-datasync-file-transfer-workflows-or-storage-synchronization-saa-c03","AWS Transfer Family vs AWS DataSync: file-transfer workflows or storage synchronization","When client-driven transfers through standard file-transfer protocols call for Transfer Family rather than DataSync storage-copy tasks, and how their cost models differ.","AWS Transfer Family provides managed file-transfer endpoints for clients using protocols such as SFTP, FTPS, and FTP. Choose this model when a person, partner application, or script connects and decides which files to upload or download.",{"slug":1054,"title":1055,"focus":1056,"teaser":1057},"caching-application-cache-lifecycles-saa-c03","Caching: application cache lifecycles","How cache-aside and write-through manage cached application data, balancing freshness and database savings while keeping misses and cache failures safe for the source.","An application cache stores reusable objects or query results under keys. Here, an application on Amazon EC2 uses Amazon ElastiCache for cached copies and Amazon RDS as its system of record. A usable cache hit avoids a database read; the database remains authoritative.",{"slug":1059,"title":1060,"focus":1061,"teaser":1062},"cache-aside-application-controlled-cache-reads-saa-c03","Cache-Aside: application-controlled cache reads","How application-managed cache hits and misses affect latency, database load, cost, and safe fallback when cached data is unavailable.","In cache-aside, the application checks a faster, optional copy before reading the authoritative database. A hit supplies a usable cached value. A miss means the requested value is absent: the application reads the database, caches the result, and returns it.",{"slug":1064,"title":1065,"focus":1066,"teaser":1067},"cache-aside-keeping-cached-data-fresh-saa-c03","Cache-Aside: keeping cached data fresh","How expiration and database-first invalidation bound staleness, where concurrent reads create races, and when authoritative reads are necessary.","In cache-aside, the application manages a cached copy while the database remains authoritative. Here, an application on Amazon EC2 uses Amazon ElastiCache for cached values and Amazon RDS for stored records. The diagram shows request and response channels, not the timing of individual operations.",{"slug":1069,"title":1070,"focus":1071,"teaser":1072},"write-through-caching-synchronous-cache-updates-saa-c03","Write-Through Caching: synchronous cache updates","How coordinating database and cache updates on the write path trades faster subsequent reads for write overhead, cache costs, and explicit handling of failed or concurrent updates.","Write-through caching updates the backing database and the cache on the write path, before acknowledging the operation as fully successful. The database remains the authoritative source; the cache holds a replaceable copy for faster reads.",{"slug":1074,"title":1075,"focus":1076,"teaser":1077},"cache-aside-vs-write-through-caching-saa-c03","Cache-Aside vs. Write-Through Caching","How demand-driven cache population differs from synchronous cache updates on writes in freshness, write latency, and cache utilization.","Cache-aside populates a cache because someone requests data: the application checks the cache, reads the database after a miss, and caches the result. Write-through populates or refreshes a cache because someone writes data: both the database and cache updates must complete before the write is acknowledged as fully successful.",{"slug":1079,"title":1080,"focus":1081,"teaser":1082},"amazon-elasticache-cache-population-and-freshness-saa-c03","Amazon ElastiCache: cache population and freshness","How cache-aside and write-through patterns use expiration and invalidation to reduce database reads while controlling stale data and cache misses.","Amazon ElastiCache holds in-memory copies of data so repeated reads can avoid the database. In this example, an application on Amazon EC2 uses Amazon RDS as its source of truth. The application implements the caching pattern; ElastiCache does not automatically discover database changes or fetch missing database rows.",{"slug":1084,"title":1085,"focus":1086,"teaser":1087},"amazon-elasticache-cache-capacity-and-scaling-saa-c03","Amazon ElastiCache: cache capacity and scaling","How engine-specific node-based scaling and serverless capacity affect cache throughput, availability, and cost.","With node-based ElastiCache, you choose node types and topology, and pay for provisioned nodes even when they are lightly used. For Valkey and Redis OSS, a shard holds part of the keyspace and has a primary that accepts writes. With cluster mode disabled, there is one shard; with cluster mode enabled, data can be partitioned across multiple shards using a cluster-aware client.",{"slug":1089,"title":1090,"focus":1091,"teaser":1092},"amazon-elasticache-versus-amazon-dynamodb-application-caches-and-database-acceleration-saa-c03","Amazon ElastiCache versus Amazon DynamoDB: application caches and database acceleration","How a general-purpose ElastiCache layer differs from DynamoDB storage and its DAX accelerator in application integration, data access, and consistency.","Amazon DynamoDB is a durable key-value and document database. Its tables hold the application's source data, accessed through DynamoDB operations such as GetItem and Query. Adding a cache does not replace that storage role.",{"slug":1094,"title":1095,"focus":1096,"teaser":1097},"caching-reuse-at-the-edge-saa-c03","Caching: reuse at the edge","How content reuse, cache keys, and freshness determine whether edge caching safely reduces delivery latency, origin requests, and total transfer cost.","Edge caching keeps reusable responses near viewers. In this architecture, Amazon CloudFront delivers shared assets from an Amazon S3 bucket, which remains the origin: the authoritative source. Edge locations are distributed delivery locations, not Regions or Availability Zones.",{"slug":1099,"title":1100,"focus":1101,"teaser":1102},"edge-computing-and-caching-local-execution-versus-result-reuse-saa-c03","Edge Computing and Caching: local execution versus result reuse","How processing near the workload differs from reusing stored results, and why the two techniques can complement rather than replace each other.","Edge computing runs selected logic near the users or devices involved in a workload. It changes where computation happens. A gateway evaluating a new sensor reading locally is doing edge computing even if it has never seen that reading before.",{"slug":1104,"title":1105,"focus":1106,"teaser":1107},"amazon-cloudfront-edge-caching-and-request-flow-saa-c03","Amazon CloudFront: edge caching and request flow","How CloudFront routes requests through its edge cache hierarchy and uses cache keys and TTLs to reduce latency and origin load.","Amazon CloudFront is a content delivery network for HTTP and HTTPS content. A distribution connects viewer-facing delivery settings to an origin, the source of the content. CloudFront routes viewers to an edge location selected for low latency, not simply the geographically closest location.",{"slug":1109,"title":1110,"focus":1111,"teaser":1112},"amazon-cloudfront-in-front-of-s3","Amazon CloudFront in front of S3","Serving a website through the edge","A website served straight from one Region is slow for users far away: every request crosses the world. Amazon CloudFront is a content delivery network. It answers from edge locations close to the user and keeps copies of your files there.",{"slug":1114,"title":1115,"focus":1116,"teaser":1117},"amazon-cloudfront-vs-aws-global-accelerator-saa-c03","Amazon CloudFront vs AWS Global Accelerator","When HTTP content delivery and caching favor CloudFront rather than Global Accelerator's static IP addresses and TCP or UDP traffic acceleration.","Amazon CloudFront is a content delivery network for HTTP and HTTPS applications. It can cache reusable responses at edge locations and serve them closer to users. Choose it for delivering web pages, images, downloads, video, or APIs, especially when caching can reduce latency and work at the origin, the backend that supplies content.",{"slug":1119,"title":1120,"focus":1121,"teaser":1122},"loose-coupling-component-boundaries-and-contracts-saa-c03","Loose Coupling: Component boundaries and contracts","How explicit interfaces and clear state ownership let tiers and microservices change independently without depending on one another's internal implementation.","Loose coupling lets one component change without forcing its callers to understand the change. Callers depend on an explicit interface contract: supported operations, required inputs, returned fields and their meanings, and expected errors. For an order lookup, that might mean an order identifier as input and a documented order status as output.",{"slug":1124,"title":1125,"focus":1126,"teaser":1127},"separation-of-concerns-vs-loose-coupling-saa-c03","Separation of Concerns vs. Loose Coupling","How separating responsibilities differs from reducing dependencies, and why distinct components can still be tightly coupled.","Separation of concerns asks, “Which responsibility belongs here?” Loose coupling asks, “How much must this component know about, or depend on, another component?” They support each other, but they describe different properties of a design.",{"slug":1129,"title":1130,"focus":1131,"teaser":1132},"statelessness-interchangeable-processing-instances-saa-c03","Statelessness: interchangeable processing instances","How explicit request context and externally stored state let any instance handle a request correctly, unlike reliance on instance-local session state.","A stateless processing instance can handle a request correctly without remembering an earlier request. Each request carries explicit context, such as authentication information, the operation to perform, and a cart identifier. The instance uses that context to find any required records in an external store.",{"slug":1134,"title":1135,"focus":1136,"teaser":1137},"microservices-and-component-delivery-independently-deployable-services-saa-c03","Microservices and component delivery: independently deployable services","How business-aligned boundaries, explicit interfaces, and service-owned state enable independent releases and scaling, including the compute-efficiency trade-offs of service decomposition.","A microservice is a service with a focused responsibility that can be deployed without releasing the whole application. Choose boundaries around business capabilities, such as ordering and notifications. Each capability should contain the rules and data access needed to do its job, rather than depending on a shared business-logic deployment for every change.",{"slug":1139,"title":1140,"focus":1141,"teaser":1142},"separation-of-concerns-vs-microservices-saa-c03","Separation of Concerns vs. Microservices","Why microservice deployment does not guarantee separated responsibilities and a modular monolith can separate them effectively.","Separation of concerns describes how responsibilities are organized. It asks which component owns a rule or behavior, and which interface other components use to reach it. Deployment boundaries describe which pieces of software are released and run together. These are different questions.",{"slug":1144,"title":1145,"focus":1146,"teaser":1147},"microservices-and-component-delivery-versus-containers-saa-c03","Microservices and component delivery versus containers","Why container packaging does not establish microservice boundaries, and why microservices do not require containers.","Microservices describe how an application is divided into services. Containers describe how application code and its dependencies are packaged and run. These are separate choices: a package boundary does not establish a service boundary.",{"slug":1149,"title":1150,"focus":1151,"teaser":1152},"loose-coupling-reliable-message-processing-saa-c03","Loose Coupling: Reliable message processing","How idempotent processing, bounded retries, and recovery mechanisms preserve correct outcomes across duplicate delivery, partial failures, and delayed consistency.","An Amazon SQS standard queue can deliver a message more than once. A worker can also finish a change and crash before deleting the message. Idempotent processing means that processing the same operation again does not repeat its business effect.",{"slug":1154,"title":1155,"focus":1156,"teaser":1157},"event-driven-architecture-decoupling-components-with-events-saa-c03","Event-Driven Architecture: decoupling components with events","How producer–consumer boundaries, asynchronous event delivery, and recoverable processing let components scale independently while tolerating delayed or duplicate events.","In event-driven architecture, a producer publishes a record of something that happened, and a consumer decides how to react. OrderPlaced describes a fact; UpdateFulfillmentStatus requests an action. Here, an order component publishes the fact without directly calling the fulfillment component.",{"slug":1159,"title":1160,"focus":1161,"teaser":1162},"publish-subscribe-messaging-independent-subscriber-delivery-saa-c03","Publish-Subscribe Messaging: independent subscriber delivery","How topic-based fan-out delivers messages to independent subscribers, and how each delivery path handles filtering, buffering, and delivery failures.","A publisher sends a message to a topic, rather than contacting every recipient. Amazon SNS performs fan-out: it delivers a copy to each matching subscription. Adding a subscription does not require the publisher to send another copy itself.",{"slug":1164,"title":1165,"focus":1166,"teaser":1167},"event-driven-architecture-vs-publish-subscribe-messaging-saa-c03","Event-Driven Architecture vs Publish-Subscribe Messaging","Why publish-subscribe is a message distribution pattern rather than an architecture, and why neither concept requires the other.","Event-driven architecture describes how an application organizes its behavior: components react to events, which record facts such as OrderPlaced. It is an architectural style because it shapes how responsibilities interact across the application.",{"slug":1169,"title":1170,"focus":1171,"teaser":1172},"message-queuing-vs-publish-subscribe-messaging-saa-c03","Message Queuing vs Publish-Subscribe Messaging","How competing consumers sharing work differ from independent subscribers each receiving a published message, including why fan-out can use a separate queue per subscriber.","A work queue distributes work among competing consumers. Several workers read from one queue, but each message is intended to be processed by one worker, not independently by every worker. The workers usually perform the same job, such as generating a thumbnail.",{"slug":1174,"title":1175,"focus":1176,"teaser":1177},"idempotency-retry-safe-distributed-operations-saa-c03","Idempotency: retry-safe distributed operations","How stable request keys and atomic deduplication records prevent repeated requests or duplicate events from repeating an operation’s intended effects, including recovery after partial failure.","Idempotency means repeating the same logical operation does not repeat its intended effect. A request can succeed even when its response is lost, so a timeout is not proof that nothing happened. Retrying an order request should not create another order.",{"slug":1179,"title":1180,"focus":1181,"teaser":1182},"message-ordering-vs-idempotency-saa-c03","Message Ordering vs. Idempotency","Why preserving event sequence and preventing repeated business effects are separate guarantees that do not imply each other.","Message ordering preserves a required sequence between different events. Idempotency ensures that repeating the same logical event does not repeat its intended business effects. Ordering asks, “Which event comes first?” Idempotency asks, “What happens if this event happens again?”",{"slug":1184,"title":1185,"focus":1186,"teaser":1187},"amazon-eventbridge-routing-events-to-independent-consumers-saa-c03","Amazon EventBridge: routing events to independent consumers","How event buses and event-pattern rules route AWS, SaaS, and custom application events to targets without coupling producers to consumers.","An event records something that happened, such as an order being placed. With Amazon EventBridge, a producer publishes that event to an event bus. Rules on that bus select interested targets, so the producer does not need their addresses or processing logic.",{"slug":1189,"title":1190,"focus":1191,"teaser":1192},"amazon-eventbridge-and-amazon-sns-choosing-event-distribution-saa-c03","Amazon EventBridge and Amazon SNS: choosing event distribution","When to choose EventBridge event-bus routing rather than SNS topic-based publish\u002Fsubscribe for loosely coupled applications.","Loose coupling means a producer does not call each consumer directly. With either Amazon EventBridge or Amazon SNS, the producer publishes to an intermediary, and consumers can be added without adding consumer addresses to the producer.",{"slug":1194,"title":1195,"focus":1196,"teaser":1197},"aws-lambda-event-driven-execution-saa-c03","AWS Lambda: event-driven execution","How Lambda invokes and scales stateless functions, and how invocation modes, execution limits, and retries shape suitable workloads.","AWS Lambda runs your code without requiring you to provision servers. For ordinary on-demand, event-driven functions, an invocation passes an event to a handler, which performs a bounded piece of work and finishes. Examples include validating an API request or processing a newly uploaded object.",{"slug":1199,"title":1200,"focus":1201,"teaser":1202},"aws-step-functions-and-aws-lambda-orchestration-versus-compute-saa-c03","AWS Step Functions and AWS Lambda: orchestration versus compute","Why Step Functions coordinates a workflow while Lambda executes its code, and when orchestration belongs outside a function.","AWS Lambda provides compute: it executes your function code. That code might validate an order or calculate its price. AWS Step Functions provides orchestration: it coordinates tasks according to a workflow definition called a state machine.",{"slug":1204,"title":1205,"focus":1206,"teaser":1207},"horizontal-scaling-adding-and-removing-workload-capacity-saa-c03","Horizontal Scaling: adding and removing workload capacity","How workload distribution, state placement, shared bottlenecks, and safe resource removal determine whether scaling a component out or in provides useful, cost-effective capacity.","Scaling out adds resources serving a workload; scaling in removes them. An extra application instance adds useful capacity only if work can reach it and be processed independently of the other instances.",{"slug":1209,"title":1210,"focus":1211,"teaser":1212},"vertical-scaling-choosing-instance-capacity-saa-c03","Vertical Scaling: choosing instance capacity","How workload bottlenecks determine a useful instance size, its performance ceiling, and whether its added capacity justifies the cost.","Vertical scaling changes the capacity of an existing resource. For Amazon EC2, you choose an instance type; for an instance-based Amazon RDS database, you choose a DB instance class. A useful choice adds capacity to the resource that is actually limiting the workload: its bottleneck.",{"slug":1214,"title":1215,"focus":1216,"teaser":1217},"horizontal-scaling-and-vertical-scaling-choosing-the-scaling-direction-saa-c03","Horizontal Scaling and Vertical Scaling: choosing the scaling direction","How changing resource count differs from changing resource size in workload suitability, capacity limits, disruption, and cost.","Horizontal scaling changes how many resources serve a workload. Adding application instances or workers is scaling out; removing them is scaling in. Each resource handles part of the work.",{"slug":1219,"title":1220,"focus":1221,"teaser":1222},"vertical-scaling-the-resize-lifecycle-saa-c03","Vertical Scaling: the resize lifecycle","How changing an existing resource's capacity works, including compatibility checks, interruption planning, validation, and rollback.","Vertical scaling changes an existing resource's capacity. The resize lifecycle starts before the change: confirm compatibility, prepare for interruption, apply the change, validate the result, and either accept it or roll back. A larger configuration is not automatically a compatible configuration.",{"slug":1224,"title":1225,"focus":1226,"teaser":1227},"amazon-ec2-instance-families-and-sizing-saa-c03","Amazon EC2: instance families and sizing","How instance families, sizes, processor architectures, and resource limits determine workload suitability, performance, and cost.","An EC2 instance type defines a virtual server's processor, memory, storage capabilities, and networking capabilities. Start with the workload's limiting resource: compute-optimized families emphasize CPU, memory-optimized families emphasize RAM, and storage-optimized families emphasize local storage performance. General purpose families balance resources; accelerated computing families provide hardware such as GPUs or specialized accelerators.",{"slug":1229,"title":1230,"focus":1231,"teaser":1232},"amazon-ec2-instance-lifecycle-and-resizing-saa-c03","Amazon EC2: instance lifecycle and resizing","How stopping, starting, hibernating, and resizing instances change available capacity, retained state, and ongoing charges.","An EC2 instance in the running state provides compute capacity and incurs instance usage charges, even when its application is idle. A reboot restarts the operating system without releasing that capacity: billing continues, RAM contents are lost, and attached storage remains. For an EBS-backed instance, stopping shuts down the instance but keeps its identity and EBS volumes for a later start.",{"slug":1234,"title":1235,"focus":1236,"teaser":1237},"amazon-rds-instance-and-storage-capacity-saa-c03","Amazon RDS: instance and storage capacity","How instance classes, storage types, provisioned IOPS, and storage autoscaling determine database capacity and performance.","For an Amazon RDS DB instance, capacity has several dimensions. The DB instance class supplies CPU and memory and sets limits on network and storage I\u002FO. Allocated storage is the space available for database files. More storage space does not automatically mean more CPU or memory.",{"slug":1239,"title":1240,"focus":1241,"teaser":1242},"amazon-rds-read-replicas-saa-c03","Amazon RDS: read replicas","How asynchronous replication, replica endpoints, lag, placement, promotion, and replica costs shape read scaling, distinct from Multi-AZ failover.","An Amazon RDS read replica is a separate database instance that receives changes from a source database and can serve read queries. Moving suitable reads to it frees source capacity, but does not add write capacity. This lesson uses RDS for MySQL or PostgreSQL DB instance read replicas, rather than Aurora replicas.",{"slug":1244,"title":1245,"focus":1246,"teaser":1247},"horizontal-scaling-and-elasticity-capacity-direction-versus-demand-matching-saa-c03","Horizontal Scaling and Elasticity: capacity direction versus demand matching","Why changing resource count does not necessarily provide elasticity, and why matching capacity to demand can use either horizontal or vertical adjustments.","Horizontal scaling changes the number of resources serving a workload. Adding instances or workers is scaling out; removing them is scaling in. Vertical scaling changes the capacity of an individual resource, such as its CPU or memory. These terms describe how capacity changes.",{"slug":1249,"title":1250,"focus":1251,"teaser":1252},"elasticity-automatic-capacity-control-policies-saa-c03","Elasticity: automatic capacity-control policies","How workload bottlenecks, scaling signals, provisioning delays, capacity bounds, and safe scale-in determine the choice and behavior of capacity-control policies.","An automatic capacity-control policy uses a measured signal to decide when capacity should change. Amazon EC2 Auto Scaling applies these decisions to the desired number of EC2 instances in a group. Adding instances helps only when those instances can share the work that is limiting throughput.",{"slug":1254,"title":1255,"focus":1256,"teaser":1257},"amazon-ec2-auto-scaling-capacity-scaling-policies-saa-c03","Amazon EC2 Auto Scaling: capacity scaling policies","How scaling policies adjust group capacity within configured limits using demand metrics, schedules, and forecasts, with suitable metrics and instance warmup to balance performance and cost.","An Auto Scaling group maintains a desired amount of EC2 capacity. Minimum capacity sets its floor, maximum capacity sets its ceiling, and desired capacity is the amount the group currently tries to maintain. In a group that counts each instance equally, a minimum of 2, desired capacity of 4, and maximum of 8 means the group aims to run four instances within a range of two to eight.",{"slug":1259,"title":1260,"focus":1261,"teaser":1262},"amazon-aurora-serverless-vs-provisioned-amazon-rds-saa-c03","Amazon Aurora Serverless vs. provisioned Amazon RDS","When workload variability favors Aurora Serverless over provisioned RDS database instances, distinguishing automatic compute scaling from instance sizing and storage autoscaling.","Amazon Aurora Serverless is a configuration of Aurora, which is part of Amazon RDS—not a separate alternative to all of RDS. This lesson compares Aurora Serverless v2 with provisioned RDS database instances. Both provide managed relational databases; the important difference here is how their compute capacity changes.",{"slug":1264,"title":1265,"focus":1266,"teaser":1267},"content-delivery-network-edge-caching-and-origin-offload-saa-c03","Content Delivery Network: edge caching and origin offload","How cacheable HTTP content benefits from distributed edge delivery, and why cache misses, expiration, and uncached requests still depend on resilient origins.","A content delivery network (CDN) delivers HTTP content through distributed edge locations. Amazon CloudFront is AWS's CDN. Routing selects an edge using network conditions and proximity, not geographic distance alone. Reusing content at the edge can reduce latency and repeated work at the origin, the source of the content.",{"slug":1269,"title":1270,"focus":1271,"teaser":1272},"aws-global-accelerator-routing-traffic-over-the-aws-global-network-saa-c03","AWS Global Accelerator: routing traffic over the AWS global network","How static anycast IP addresses and standard accelerator routing direct TCP and UDP traffic through AWS edge locations to healthy regional endpoints.","AWS Global Accelerator gives clients a stable entry point for applications that use TCP or UDP. A standard accelerator directs traffic through AWS edge locations and across the AWS global network to regional application endpoints. This can improve performance by reducing how much of the journey depends on public internet routing.",{"slug":1274,"title":1275,"focus":1276,"teaser":1277},"containers-image-based-application-delivery-saa-c03","Containers: image-based application delivery","How packaging dependencies into images, matching runtime requirements, and externalizing durable state make suitable applications portable and replaceable.","A container image packages application files, required libraries, language runtimes, and startup metadata. A container is a running instance of that image. For example, an API image can include the application and its required Python packages, so each destination does not need those packages installed separately.",{"slug":1279,"title":1280,"focus":1281,"teaser":1282},"containers-workload-orchestration-saa-c03","Containers: workload orchestration","How orchestrators place resource-sized container replicas on compute capacity and reconcile desired state to support recovery, scaling, and efficient utilization.","An orchestrator places container workloads on compute capacity and keeps their actual state moving toward a declared desired state. For a long-running service, you specify what to run, its resource requirements, and how many replicas should exist. You do not manually choose a host for every replacement.",{"slug":1284,"title":1285,"focus":1286,"teaser":1287},"containers-and-serverless-packaging-versus-infrastructure-management-saa-c03","Containers and Serverless: packaging versus infrastructure management","Why containers describe application packaging and execution while serverless describes infrastructure management, allowing container workloads to use either managed or self-managed capacity.","Containers describe application packaging and execution. A container image packages an application, its dependencies, and startup information. A container is a running instance of that image, executed by a container runtime using operating-system isolation.",{"slug":1289,"title":1290,"focus":1291,"teaser":1292},"amazon-ecr-vs-amazon-ecs-image-registry-and-container-orchestration-saa-c03","Amazon ECR vs Amazon ECS: image registry and container orchestration","Why ECR stores and distributes container images while ECS schedules and runs containers, and why containerized applications commonly need both.","A container image packages application code, libraries, and other files needed to start an application. A container is a running instance of that image. The same image can supply many running containers.",{"slug":1294,"title":1295,"focus":1296,"teaser":1297},"amazon-ecr-publishing-images-for-container-deployments-saa-c03","Amazon ECR: publishing images for container deployments","How to authenticate, push application images to private repositories, and provide image references and pull permissions for container deployments.","A private ECR repository holds your application images in an AWS account and Region. For this example, create the repository with aws ecr create-repository --repository-name orders --region us-east-1. Its registry hostname is 111122223333.dkr.ecr.us-east-1.amazonaws.com; replace the example account ID with yours. The repository must exist before the push.",{"slug":1299,"title":1300,"focus":1301,"teaser":1302},"amazon-ecs-task-scheduling-and-services-saa-c03","Amazon ECS: task scheduling and services","How ECS uses task definitions, cluster capacity, and service scheduling to place containers, replace unhealthy tasks, and scale the desired task count.","Amazon ECS schedules tasks, not individual containers independently. A task definition is a versioned blueprint for a task. It specifies one or more containers, their images, CPU and memory settings, and configuration such as ports, logging, and permissions. Containers in the same task are scheduled together.",{"slug":1304,"title":1305,"focus":1306,"teaser":1307},"amazon-eks-kubernetes-workload-orchestration-saa-c03","Amazon EKS: Kubernetes workload orchestration","How the EKS-managed Kubernetes control plane maintains desired workload state through pod scheduling, failure replacement, and replica scaling on worker compute.","Amazon EKS provides a managed Kubernetes control plane. You describe the workload you want, and Kubernetes continually works to make the running workload match that description. This repeated comparison of desired state with actual state is called reconciliation.",{"slug":1309,"title":1310,"focus":1311,"teaser":1312},"amazon-ecs-and-amazon-eks-choosing-a-container-orchestrator-saa-c03","Amazon ECS and Amazon EKS: choosing a container orchestrator","How ECS-native orchestration differs from managed Kubernetes in EKS in application configuration, operational responsibilities, and ecosystem compatibility.","Amazon ECS and Amazon EKS both orchestrate containers: they use application requirements to run workloads and maintain their desired state. The main difference is the interface your team works with. ECS uses an AWS-native orchestration model; EKS provides managed Kubernetes, using the standard Kubernetes API.",{"slug":1314,"title":1315,"focus":1316,"teaser":1317},"aws-fargate-serverless-container-execution-saa-c03","AWS Fargate: serverless container execution","How Fargate runs isolated ECS tasks or EKS pods without customer-managed worker nodes, and which workload and availability responsibilities remain with you.","AWS Fargate provides compute for containers managed by Amazon ECS or Amazon EKS. AWS provisions and maintains the underlying compute infrastructure. You do not create worker-node fleets, choose host instances, or patch their operating systems. You still configure and manage your ECS or EKS workloads.",{"slug":1319,"title":1320,"focus":1321,"teaser":1322},"load-balancing-distributing-traffic-across-healthy-targets-saa-c03","Load Balancing: distributing traffic across healthy targets","How target selection, health checks, session affinity, and connection draining distribute demand without creating capacity or guaranteeing uninterrupted service.","A load balancer gives clients an application endpoint instead of making them choose an individual server. In this example, an Application Load Balancer selects an eligible EC2 target from a target group. The diagram shows request and session-access paths, not replies or health probes.",{"slug":1324,"title":1325,"focus":1326,"teaser":1327},"health-checks-target-eligibility-for-load-balanced-traffic-saa-c03","Health Checks: target eligibility for load-balanced traffic","How probe settings and health thresholds determine which backends receive traffic, including all-unhealthy behavior and why routing exclusion does not itself replace failed capacity.","A load balancer's health check asks whether a registered backend should receive new requests. For an Application Load Balancer (ALB), health checks are configured on the target group. Normally, ALB directs requests to healthy targets rather than unhealthy ones.",{"slug":1329,"title":1330,"focus":1331,"teaser":1332},"load-balancing-choosing-a-routing-architecture-saa-c03","Load Balancing: choosing a routing architecture","How transport-layer, application-layer, and inline-appliance load balancing differ in routing capabilities, TLS handling, performance, and cost, including the effect of cross-zone and regional traffic paths.","Start with the routing decision. An Application Load Balancer (ALB) understands HTTP requests at the application layer. It can send different hostnames or URL paths to different target groups. Choose it when, for example, \u002Fimages and \u002Fcheckout must reach different application services.",{"slug":1334,"title":1335,"focus":1336,"teaser":1337},"content-based-routing-vs-load-balancing-saa-c03","Content-Based Routing vs Load Balancing","How matching request attributes to suitable destinations differs from distributing demand across healthy targets, and why the two can work together.","Content-based routing asks, “Which destination can handle this kind of request?” It examines request attributes and matches them to a suitable service or processing path. For example, a request for \u002Fcheckout belongs with checkout code, not catalog code.",{"slug":1339,"title":1340,"focus":1341,"teaser":1342},"elastic-load-balancing-elb-choosing-a-load-balancer-type-saa-c03","Elastic Load Balancing (ELB): choosing a load balancer type","How protocol, routing, endpoint, and pricing requirements determine the choice of Application, Network, or Gateway Load Balancer.","Elastic Load Balancing (ELB) offers different load balancer types because distributing web requests, distributing network connections, and inserting inspection appliances are different jobs. Start with the required protocol and routing behavior, rather than choosing by expected traffic volume alone.",{"slug":1344,"title":1345,"focus":1346,"teaser":1347},"elastic-load-balancing-elb-distributing-traffic-to-healthy-targets-saa-c03","Elastic Load Balancing (ELB): distributing traffic to healthy targets","How target groups, health checks, and cross-zone distribution keep traffic flowing as targets scale, drain, or fail.","Elastic Load Balancing gives clients an entry point while the application targets behind it change. Using an Application Load Balancer (ALB) as our example, a listener accepts requests on a configured protocol and port. Its rules select a target group: a registered pool of destinations and their traffic ports.",{"slug":1349,"title":1350,"focus":1351,"teaser":1352},"session-affinity-dependence-on-individual-targets-saa-c03","Session Affinity: dependence on individual targets","How keeping sessions on individual targets affects load distribution, scaling, and session continuity during target replacement, and when shared session state removes that dependency.","Session affinity, also called stickiness, attempts to send a returning session to its previous application target. This can support an application that keeps session data, such as a shopping cart, only in that target's memory. The routing assignment does not copy the session data elsewhere.",{"slug":1354,"title":1355,"focus":1356,"teaser":1357},"session-affinity-client-to-target-bindings-saa-c03","Session Affinity: client-to-target bindings","How ALB cookie-based and NLB source-IP affinity identify returning clients and preserve target assignments across requests and connections.","Session affinity, also called stickiness, lets a load balancer recognize returning traffic and reuse a previous target assignment. The identifying information differs: an HTTP cookie for Application Load Balancer (ALB) stickiness, or a source IP address for Network Load Balancer (NLB) stickiness.",{"slug":1359,"title":1360,"focus":1361,"teaser":1362},"elastic-load-balancing-elb-vs-amazon-route-53-saa-c03","Elastic Load Balancing (ELB) vs Amazon Route 53","How balancing application connections differs from DNS-based traffic routing, including their scope and response to failures.","Amazon Route 53 chooses what destination to return in a DNS answer. The client uses that answer to connect to an application endpoint. Route 53 does not receive and forward the application's HTTP requests or transport connections.",{"slug":1364,"title":1365,"focus":1366,"teaser":1367},"separation-of-concerns-responsibility-boundaries-saa-c03","Separation of Concerns: responsibility boundaries","How to assign cohesive responsibilities and explicit ownership boundaries to tiers, business services, and event-processing components.","Separation of concerns assigns distinct responsibilities to components. A responsibility is cohesive when its behavior belongs together: checking whether an order is acceptable and recording its accepted state enforce the same business rules. Formatting a customer notification changes for different reasons and belongs elsewhere.",{"slug":1369,"title":1370,"focus":1371,"teaser":1372},"message-queuing-buffering-work-for-independent-scaling-saa-c03","Message Queuing: buffering work for independent scaling","How durable buffering separates producer and consumer availability, absorbs bursts, and lets worker capacity scale against backlog and processing delay.","A producer creates work; a consumer, often called a worker, performs it. With message queuing, the producer submits a message to a durable queue instead of waiting for a worker to finish. Successful queue acceptance means submitted, not completed. This suits background work whose result can arrive later.",{"slug":1374,"title":1375,"focus":1376,"teaser":1377},"message-queuing-reliable-message-processing-saa-c03","Message Queuing: reliable message processing","How acknowledgments, delivery locks, and bounded retries recover failed work while idempotent consumers prevent duplicate business effects.","A queue accepting a message means that work was submitted, not completed. A consumer must perform the work and then acknowledge success. With Amazon SQS, an application-managed consumer acknowledges by deleting the message after successful processing.",{"slug":1379,"title":1380,"focus":1381,"teaser":1382},"amazon-sns-topic-based-fanout-saa-c03","Amazon SNS: topic-based fanout","How SNS topics distribute messages to independent subscribers through supported endpoints and subscription filters to decouple producers from consumers.","Amazon SNS provides topic-based publish\u002Fsubscribe messaging. A publisher sends a message to a topic, a named distribution point. Each subscription connects that topic to an endpoint that can receive messages.",{"slug":1384,"title":1385,"focus":1386,"teaser":1387},"amazon-mq-managed-broker-messaging-saa-c03","Amazon MQ: managed broker messaging","How managed ActiveMQ and RabbitMQ brokers support queue and publish\u002Fsubscribe messaging while preserving existing applications' messaging APIs and protocols.","Amazon MQ runs managed Apache ActiveMQ or RabbitMQ brokers. A broker accepts messages from producers and makes them available to consumers, so applications do not need to communicate directly or run at the same time. AWS handles broker provisioning and maintenance; you still configure messaging behavior and application connections.",{"slug":1389,"title":1390,"focus":1391,"teaser":1392},"serverless-workload-execution-models-saa-c03","Serverless: workload execution models","How function and managed-container execution models shape workload fit, external state storage, and retry-safe processing.","AWS Lambda runs a function handler for an invocation. It suits short, bounded work triggered by an event, such as validating an order or processing a queue message. Each invocation must finish within the service's execution-duration limit; it is not a continuously running application process.",{"slug":1394,"title":1395,"focus":1396,"teaser":1397},"amazon-ec2-and-aws-lambda-choosing-a-compute-model-saa-c03","Amazon EC2 and AWS Lambda: choosing a compute model","How virtual servers and event-driven functions differ in operating responsibility, execution constraints, scaling behavior, and billing for steady or intermittent workloads.","Amazon EC2 provides virtual servers called instances. You choose an operating system, install software, and run application processes. AWS manages the physical infrastructure; you manage the guest operating system, its patches, application dependencies, and the health of your application.",{"slug":1399,"title":1400,"focus":1401,"teaser":1402},"aws-fargate-and-aws-lambda-containers-versus-functions-saa-c03","AWS Fargate and AWS Lambda: containers versus functions","How workload lifetime, execution control, scaling behavior, and billing differ between Fargate and Lambda when choosing serverless compute.","AWS Fargate runs containers as Amazon ECS tasks or Amazon EKS pods without you managing the underlying servers. AWS Lambda runs code in response to invocations. Here, Lambda means on-demand, event-driven functions; other Lambda compute options have different controls and billing.",{"slug":1404,"title":1405,"focus":1406,"teaser":1407},"serverless-compute-capacity-and-cost-saa-c03","Serverless: compute capacity and cost","How concurrency, configured container capacity, scaling limits, and execution charges affect serverless compute utilization.","Concurrency is the number of invocations executing at the same time. For standard AWS Lambda execution, each execution environment handles one invocation at a time. Under steady demand, estimate required concurrency as requests per second × average duration in seconds. For example, 60 requests per second taking 0.2 seconds each need about 12 concurrent executions. Bursts and variations in duration require additional headroom.",{"slug":1409,"title":1410,"focus":1411,"teaser":1412},"aws-step-functions-state-machine-orchestration-saa-c03","AWS Step Functions: state machine orchestration","How state machines coordinate AWS service tasks through branching, parallel execution, waits, and failure recovery.","AWS Step Functions runs a state machine: a workflow definition containing states and transitions. Each run is an execution with its own input and progress. You can define the workflow in Amazon States Language, a JSON-based language, or use Workflow Studio.",{"slug":1414,"title":1415,"focus":1416,"teaser":1417},"block-storage-disk-devices-and-volume-lifecycles-saa-c03","Block Storage: disk devices and volume lifecycles","How applications use block devices and how persistent volumes and host-local disks behave across instance lifecycle events.","Block storage presents an operating system with a sequence of addressable blocks, like a disk. The operating system or application decides how to organize those blocks. Most applications use a filesystem on the device: the filesystem supplies filenames, directories, and permissions. Some databases can instead use a block device directly.",{"slug":1419,"title":1420,"focus":1421,"teaser":1422},"ephemeral-storage-compute-bound-data-lifecycles-saa-c03","Ephemeral Storage: compute-bound data lifecycles","How compute lifecycle events determine data retention, including EC2 instance store behavior, and which application data is safe to keep on ephemeral storage.","Ephemeral storage is storage whose data you must be prepared to lose with its associated compute environment. It is defined by its retention guarantees, not by whether it uses SSDs, other disks, or memory. EC2 instance store provides temporary block storage on disks physically attached to the host, on supported instance types.",{"slug":1424,"title":1425,"focus":1426,"teaser":1427},"block-storage-matching-disk-performance-to-workload-saa-c03","Block Storage: matching disk performance to workload","How access patterns, SSD and HDD characteristics, and provisioned performance determine block storage speed and cost.","A block volume can have enough space but still be too slow. Describe speed using IOPS, the number of input\u002Foutput operations completed per second; throughput, the amount of data transferred per second; and latency, the time an individual operation takes. Storage capacity alone describes none of these.",{"slug":1429,"title":1430,"focus":1431,"teaser":1432},"object-storage-the-object-access-model-saa-c03","Object Storage: the object access model","How key-addressed objects and API-based access determine workload suitability, scaling behavior, and storage and request costs.","Object storage stores data as objects: data bytes with associated metadata, identified by a key within a bucket. In Amazon S3, an application addresses an object using its bucket and key, such as bucket product-assets and key images\u002Fitem123.jpg. The slash is part of the key; a prefix such as images\u002F groups names rather than creating a traditional directory.",{"slug":1434,"title":1435,"focus":1436,"teaser":1437},"shared-file-systems-network-mounted-file-access-saa-c03","Shared File Systems: network-mounted file access","How network-mounted file semantics support persistent access from multiple servers and shape workload suitability, performance, and cost.","A shared file system provides files and directories that multiple servers access over a network. Each server mounts the file system into its own directory tree. Applications then use familiar file operations, such as opening, reading, writing, and renaming files.",{"slug":1439,"title":1440,"focus":1441,"teaser":1442},"block-storage-vs-object-storage-saa-c03","Block Storage vs Object Storage","How disk-addressed reads and writes differ from object API access in update behavior, application compatibility, and scaling.","Block storage exposes a disk-like device containing addressable blocks. The operating system issues reads and writes at positions on that device. Applications usually work through a filesystem, which translates file operations into block operations; some databases use block devices directly. Amazon EBS provides this disk interface for Amazon EC2.",{"slug":1444,"title":1445,"focus":1446,"teaser":1447},"block-storage-vs-shared-file-systems-saa-c03","Block Storage vs Shared File Systems","Why attaching a block device to multiple hosts is not equivalent to providing a shared file hierarchy with coordinated file access.","Block storage exposes addressed blocks, not filenames. With Amazon EBS, an operating system typically creates a filesystem on the volume. That filesystem manages directories, permissions, and the metadata that records which blocks belong to each file.",{"slug":1449,"title":1450,"focus":1451,"teaser":1452},"object-storage-vs-shared-file-systems-saa-c03","Object Storage vs Shared File Systems","How object API semantics differ from shared filesystem paths, in-place updates, and locking when choosing storage for applications.","Object storage and shared file systems can both hold documents, images, and application data. The important difference is the interface the application expects. Object clients identify objects by bucket and key and use API operations such as upload, retrieve, list, and delete.",{"slug":1454,"title":1455,"focus":1456,"teaser":1457},"amazon-ebs-choosing-a-volume-type-saa-c03","Amazon EBS: choosing a volume type","How EBS SSD and HDD volume types match EC2 block-storage workloads through their latency, IOPS, throughput, and provisioning costs.","An Amazon EBS volume provides block storage for an EC2 instance. Choosing its type starts with how the application reads and writes, not just how much data it stores.",{"slug":1459,"title":1460,"focus":1461,"teaser":1462},"amazon-s3-object-storage-workload-fit-and-economics-saa-c03","Amazon S3: object storage workload fit and economics","How S3's object access model, elastic capacity, and storage, request, and transfer charges determine workload suitability and total cost.","Amazon S3 is object storage. In a general purpose bucket, each object contains data and metadata and is identified by a key. A key such as reports\u002Fjune.csv looks like a file path, but its slashes form a naming prefix, not directories in a mounted file system.",{"slug":1464,"title":1465,"focus":1466,"teaser":1467},"amazon-s3-glacier-and-amazon-s3-understanding-their-relationship-saa-c03","Amazon S3 Glacier and Amazon S3: understanding their relationship","How Glacier storage classes fit within S3 object storage rather than acting as a separate backup system or file store.","Amazon S3 stores objects in buckets. Each object has a key, its name within the bucket, and a storage class, which determines storage and access characteristics. A general purpose bucket can contain objects in different storage classes.",{"slug":1469,"title":1470,"focus":1471,"teaser":1472},"amazon-efs-elastic-shared-file-storage-saa-c03","Amazon EFS: elastic shared file storage","How EFS's shared NFS file system supports concurrent Linux clients, with elastic capacity and workload-dependent performance and storage costs.","Amazon EFS provides a managed file system that Linux clients mount using NFS. Multiple clients can use the same directories and files concurrently, making EFS useful for shared application content, home directories, and parallel processing of files.",{"slug":1474,"title":1475,"focus":1476,"teaser":1477},"amazon-fsx-choosing-a-file-system-family-saa-c03","Amazon FSx: choosing a file system family","How Windows File Server, Lustre, OpenZFS, and NetApp ONTAP match application requirements and when their specialized capabilities justify their cost.","Amazon FSx provides managed storage based on four different file system families. They are not interchangeable performance tiers: each preserves different protocols, application behavior, and management capabilities. Start with what the application requires, then choose capacity, performance, and availability within that family.",{"slug":1479,"title":1480,"focus":1481,"teaser":1482},"amazon-ebs-vs-amazon-efs-block-storage-or-shared-files-saa-c03","Amazon EBS vs Amazon EFS: block storage or shared files","How access models, sharing requirements, Availability Zone scope, and billing differences determine whether EBS or EFS fits a workload.","Amazon EBS provides a block device attached to an EC2 instance, much like a disk. The operating system can create a file system on it, or an application can use the blocks directly. EBS fits boot volumes and application or database data that needs an instance-attached disk.",{"slug":1484,"title":1485,"focus":1486,"teaser":1487},"amazon-s3-and-amazon-efs-object-storage-versus-shared-files-saa-c03","Amazon S3 and Amazon EFS: object storage versus shared files","How access semantics and storage, operation, and throughput pricing distinguish S3 from EFS when choosing the lowest-cost suitable storage.","Amazon S3 stores objects in buckets. An application identifies an object by its key and uses API requests such as GET and PUT to read or write it. This suits images, backups, logs, and application data handled as objects.",{"slug":1489,"title":1490,"focus":1491,"teaser":1492},"amazon-fsx-vs-amazon-efs-specialized-and-elastic-file-storage-saa-c03","Amazon FSx vs Amazon EFS: specialized and elastic file storage","When application compatibility and workload requirements favor an FSx file system over EFS's elastic NFS storage, and how that choice affects cost.","Amazon EFS provides elastic shared file storage over NFS for Linux workloads. Applications share a file system, and its storage grows and shrinks as files are added or removed. EFS is a strong starting point when ordinary shared Linux file access meets the application's needs.",{"slug":1494,"title":1495,"focus":1496,"teaser":1497},"database-replication-read-replicas-and-replication-lag-saa-c03","Database Replication: read replicas and replication lag","How replication timing affects read freshness and determines which workloads can safely offload reads to replicas.","A read replica maintains a copy of a source database and serves read queries. Sending suitable reads to it reduces read work on the primary. It does not move application writes off the primary.",{"slug":1499,"title":1500,"focus":1501,"teaser":1502},"eventual-consistency-read-visibility-saa-c03","Eventual Consistency: read visibility","How asynchronous update propagation permits stale reads, determines which workloads can use replicas, and requires an authoritative read path when immediate visibility matters.","Eventual consistency allows copies of data to differ temporarily while updates propagate. If updates stop and replication operates successfully, the copies eventually agree. The model alone does not promise a maximum waiting time or that a client immediately sees its own writes.",{"slug":1504,"title":1505,"focus":1506,"teaser":1507},"read-write-splitting-routing-reads-to-replicas-saa-c03","Read\u002FWrite Splitting: routing reads to replicas","How to offload suitable reads to replicas while keeping writes and freshness-sensitive reads on the primary.","Read\u002Fwrite splitting sends changes to a writable primary and suitable queries to read replicas. Each replica maintains a copy of the primary's data. Moving reads away from the primary reduces competition for processing power, memory, and storage throughput.",{"slug":1509,"title":1510,"focus":1511,"teaser":1512},"amazon-aurora-read-replicas-and-reader-routing-saa-c03","Amazon Aurora: read replicas and reader routing","How Aurora Replicas use shared cluster storage, scale reads through reader endpoints, and support failover through replica placement and promotion priorities.","In a conventional single-writer Aurora DB cluster, the writer handles database changes and Aurora Replicas provide additional compute for read-only queries. The writer and replicas use the same cluster storage volume; adding a replica does not create another independent, full copy of the database volume.",{"slug":1514,"title":1515,"focus":1516,"teaser":1517},"eventual-consistency-replication-lag-budgets-saa-c03","Eventual Consistency: replication lag budgets","How acceptable staleness guides replica capacity and placement decisions, using measured replication lag to balance business requirements against cost.","A replication lag budget is the amount of delay the business accepts between a committed update and its availability on a read replica. For example, a product-browsing page might accept updates appearing within five seconds. That is an illustrative business target, not a database guarantee.",{"slug":1519,"title":1520,"focus":1521,"teaser":1522},"database-replication-read-replica-capacity-planning-saa-c03","Database Replication: read-replica capacity planning","How to choose replica count, capacity, and placement to meet read demand while controlling compute and data-transfer costs.","A read replica adds capacity for reads that the application can send away from the primary database. First measure the peak eligible read demand: the reads you intend to offload, including their query mix and concurrency. Replicas do not increase the primary's write capacity.",{"slug":1524,"title":1525,"focus":1526,"teaser":1527},"state-machines-coordinating-distributed-workflows-saa-c03","State Machines: coordinating distributed workflows","How explicit states and transitions let an orchestrator coordinate independent workers, track progress, and route failures through defined recovery paths.","A state machine defines a process as named states and allowed transitions. A state might invoke a worker, wait, or choose a branch. A transition moves to another state according to a result, condition, or event; it is not an arbitrary change of status.",{"slug":1529,"title":1530,"focus":1531,"teaser":1532},"capacity-planning-vs-elasticity-saa-c03","Capacity Planning vs. Elasticity","How anticipating resource requirements differs from automatically adjusting resources as demand changes, and why elasticity does not eliminate capacity planning.","Capacity planning anticipates the resources a workload will need to meet its service objectives, such as response time and throughput. It uses expected demand, growth, and measured resource performance to decide what capacity must be available.",{"slug":1534,"title":1535,"focus":1536,"teaser":1537},"right-sizing-vs-elasticity-saa-c03","Right-Sizing vs. Elasticity","How choosing capacity that fits a workload differs from adjusting capacity as demand changes, and why elastic resources can still be oversized.","Right-sizing asks, “What resource configuration fits this workload?” The answer must meet performance and availability requirements with justified headroom. It is not necessarily the smallest resource: too little capacity can cause slow responses or failures, while too much wastes resources.",{"slug":1539,"title":1540,"focus":1541,"teaser":1542},"elasticity-automatic-storage-capacity-growth-saa-c03","Elasticity: automatic storage capacity growth","How storage growth, expansion thresholds, provisioning delays, and inability to shrink determine when automatic storage expansion is useful and what costs remain.","Automatic storage expansion adds storage capacity as stored data grows. It is useful when a database keeps accumulating records, indexes, or logs and predicting the exact growth is difficult. A traffic spike alone does not necessarily require more storage: read requests can increase without adding much data, while a quiet data import can consume substantial space.",{"slug":1544,"title":1545,"focus":1546,"teaser":1547},"amazon-ec2-auto-scaling-and-aws-auto-scaling-scope-and-responsibilities-saa-c03","Amazon EC2 Auto Scaling and AWS Auto Scaling: scope and responsibilities","How EC2 instance-group scaling differs from coordinating scaling across supported AWS resources through AWS Auto Scaling scaling plans.","Amazon EC2 Auto Scaling manages EC2 instances in an Auto Scaling group: a collection treated as one unit for capacity management. It launches and terminates instances to maintain the group's desired capacity, and replaces instances that it detects as unhealthy.",{"slug":1549,"title":1550,"focus":1551,"teaser":1552},"amazon-dynamodb-throughput-capacity-saa-c03","Amazon DynamoDB: throughput capacity","How read and write capacity consumption, on-demand and provisioned modes, and automatic scaling determine throughput, throttling, and cost.","DynamoDB measures read and write work separately. In provisioned mode, a read capacity unit (RCU) supports one strongly consistent read per second of an item up to 4 KB, or two eventually consistent reads per second of that size. A write capacity unit (WCU) supports one standard write per second of an item up to 1 KB.",{"slug":1554,"title":1555,"focus":1556,"teaser":1557},"loose-coupling-choosing-messaging-services-saa-c03","Loose Coupling: Choosing messaging services","How work distribution, fan-out, event routing, and broker compatibility guide choices among Amazon SQS, Amazon SNS, Amazon EventBridge, and Amazon MQ, with buffering allowing producers and consumers to scale independently.","Start with what should happen to each message. Amazon SQS provides a work queue: producers send messages, and consumers poll for work. Workers sharing a queue compete for its messages rather than each receiving a separate copy. This suits jobs such as processing an uploaded image. It is not a promise that a message can never be delivered again.",{"slug":1559,"title":1560,"focus":1561,"teaser":1562},"serverless-database-capacity-and-cost-saa-c03","Serverless: database capacity and cost","How serverless database capacity adjusts to demand and how scaling bounds, minimum capacity, and usage charges affect workload fit.","A serverless database removes the need to provision and maintain database hosts, but you still choose a data model and capacity settings. Automatic scaling follows demand within service limits; it does not guarantee unlimited throughput or eliminate every charge.",{"slug":1564,"title":1565,"focus":1566,"teaser":1567},"amazon-rds-choosing-a-database-engine-saa-c03","Amazon RDS: choosing a database engine","How relational workload requirements, engine compatibility, licensing, and managed-service boundaries determine an appropriate RDS engine and its cost.","Amazon RDS operates relational databases for you, but you still choose the database engine. Relational workloads use tables, relationships, SQL queries, and transactions. For example, an order transaction can update an order and its inventory records together. These requirements establish the workload's needs; they do not by themselves distinguish MySQL from PostgreSQL.",{"slug":1569,"title":1570,"focus":1571,"teaser":1572},"amazon-dynamodb-access-pattern-driven-tables-saa-c03","Amazon DynamoDB: access-pattern-driven tables","How key-value and document items, primary keys, and secondary indexes determine which workloads DynamoDB serves efficiently and which query patterns fit poorly.","Amazon DynamoDB is a fully managed NoSQL database. A table contains items, and each item contains named attributes. In a key-value model, an application retrieves an item by its key. In a document model, the item can also contain nested maps and lists, such as a delivery address or shopping-cart contents.",{"slug":1574,"title":1575,"focus":1576,"teaser":1577},"amazon-dynamodb-and-amazon-rds-choosing-a-database-saa-c03","Amazon DynamoDB and Amazon RDS: choosing a database","How the services differ in access-pattern flexibility, relational capabilities, scaling responsibility, and cost structure for common workloads.","Amazon DynamoDB is a managed NoSQL database for key-value and document data. Amazon RDS runs managed relational databases. Start the choice with the application's access patterns: which records it retrieves, how it finds them, and how often those requests change.",{"slug":1579,"title":1580,"focus":1581,"teaser":1582},"amazon-documentdb-vs-amazon-dynamodb-choosing-a-document-database-saa-c03","Amazon DocumentDB vs Amazon DynamoDB: choosing a document database","When MongoDB-compatible document queries favor DocumentDB over DynamoDB's key-based access patterns and serverless scaling model.","Amazon DocumentDB and Amazon DynamoDB can both store nested, evolving document data. A product with optional attributes, a nested address, or a list of tags does not by itself make DocumentDB the better choice. The important distinction is how the application retrieves and changes those documents.",{"slug":1584,"title":1585,"focus":1586,"teaser":1587},"amazon-redshift-vs-amazon-rds-analytical-and-transactional-workloads-saa-c03","Amazon Redshift vs Amazon RDS: analytical and transactional workloads","When workload access patterns and cost requirements favor a Redshift data warehouse over an RDS transactional database.","Amazon RDS is a managed relational database service suited to transactional workloads, often called OLTP. Typical requests retrieve one customer's details, insert an order, or update a few inventory records. They need short response times while many users make small reads and writes.",{"slug":1589,"title":1590,"focus":1591,"teaser":1592},"amazon-aurora-and-amazon-rds-choosing-a-relational-offering-saa-c03","Amazon Aurora and Amazon RDS: choosing a relational offering","How choosing Aurora within Amazon RDS differs from choosing RDS for MySQL or PostgreSQL in compatibility, availability guarantees, and pricing tradeoffs.","Amazon RDS is the managed service; Amazon Aurora is one of its database engine choices. The comparison here is Aurora MySQL-Compatible versus RDS for MySQL, or Aurora PostgreSQL-Compatible versus RDS for PostgreSQL. All support relational tables, SQL, and transactions, and all offload infrastructure tasks such as provisioning, backups, and patching to AWS.",{"slug":1594,"title":1595,"focus":1596,"teaser":1597},"amazon-ec2-nat-instances-saa-c03","Amazon EC2: NAT instances","How an EC2 instance provides outbound NAT through packet forwarding, source\u002Fdestination check configuration, and appropriate sizing, with owner-managed availability and costs.","A NAT instance is an EC2 instance configured to forward and translate traffic for other instances. It lets a workload in a private subnet initiate IPv4 connections to the internet without giving that workload a public IPv4 address.",{"slug":1599,"title":1600,"focus":1601,"teaser":1602},"amazon-vpc-peering-and-connected-network-routes-saa-c03","Amazon VPC: peering and connected-network routes","How VPC peering and routes to network attachments connect separate networks, accounting for address overlap, nontransitive routing, and transfer costs.","VPC peering provides direct, private connectivity between two VPCs using their private addresses. The VPCs can belong to different accounts or Regions. Creating and accepting the peering request establishes the connection; it does not automatically add the subnet routes that applications need.",{"slug":1604,"title":1605,"focus":1606,"teaser":1607},"aws-transit-gateway-and-amazon-vpc-transit-hubs-versus-vpc-peering-saa-c03","AWS Transit Gateway and Amazon VPC: transit hubs versus VPC peering","How transit hubs differ from VPC peering in transitive connectivity, scaling, operational complexity, and pricing.","VPC peering provides direct private connectivity between two VPCs. It is nontransitive: peering A with B and B with C does not let A reach C through B. A needs its own connection to C.",{"slug":1609,"title":1610,"focus":1611,"teaser":1612},"key-value-data-model-designing-for-key-based-access-saa-c03","Key-Value Data Model: designing for key-based access","How identifier-driven access patterns shape key design and make key-value storage suitable for workloads such as sessions, carts, and device state.","A key-value data model associates a unique key with a value inside a collection or namespace. The key identifies the record; the value contains the application data. The basic operations are reading, writing, and deleting a record by key.",{"slug":1614,"title":1615,"focus":1616,"teaser":1617},"relational-data-model-vs-key-value-data-model-saa-c03","Relational Data Model vs Key-Value Data Model","How relational access across connected records differs from key-based access, and why the word table does not imply relational behavior.","A relational data model organizes records into tables whose columns describe attributes. A primary key identifies a row. A foreign key references a key in a related table: for example, an Orders row can hold a customer_id that refers to Customers.",{"slug":1619,"title":1620,"focus":1621,"teaser":1622},"document-data-model-choosing-document-boundaries-saa-c03","Document Data Model: choosing document boundaries","How read and update patterns guide embedding versus referencing so documents fit the workload without unbounded growth or unnecessary duplication.","A document boundary decides which fields live together in one document and which live in separate documents. Start with the application's common reads and updates, not with a list of related business objects. For an order-details screen, identify the fields usually needed together: the order identifier, shipping address, and purchased items.",{"slug":1624,"title":1625,"focus":1626,"teaser":1627},"relational-data-model-vs-document-data-model-saa-c03","Relational Data Model vs Document Data Model","How relationships between separate records differ from embedded document structures, changing the cost of retrieval and duplicated-data updates.","The relational data model commonly represents related things as separate rows. A Customers table can hold one row per customer, identified by a primary key, such as customer_id. Each row in Orders can contain that customer's identifier as a foreign key. The order points to the customer; it does not need to contain the customer's name.",{"slug":1629,"title":1630,"focus":1631,"teaser":1632},"document-data-model-versus-key-value-data-model-saa-c03","Document Data Model versus Key-Value Data Model","How querying and updating document fields differs from accessing an opaque value by key, even when one database supports both models.","A key-value data model associates a key with a value. In basic, opaque-value access, the database retrieves or replaces that value by key without interpreting its contents. Opaque means the application, rather than the database operation, understands the fields inside the value.",{"slug":1634,"title":1635,"focus":1636,"teaser":1637},"amazon-documentdb-mongodb-compatible-document-workloads-saa-c03","Amazon DocumentDB: MongoDB-compatible document workloads","How DocumentDB supports applications with nested, evolving documents, and where its MongoDB API compatibility enables reuse of drivers and tools or requires validation.","Amazon DocumentDB is a managed document database with MongoDB API compatibility. It stores BSON documents: JSON-like records that support fields, nested objects, arrays, and additional data types. A product document can keep its name, dimensions, and available colors together, matching how an application reads that product.",{"slug":1639,"title":1640,"focus":1641,"teaser":1642},"graph-data-model-modeling-connected-data-saa-c03","Graph Data Model: modeling connected data","How nodes, edges, and relationship traversals model connection-heavy workloads suited to a graph database such as Amazon Neptune.","A graph data model makes connections part of the stored data. A node, also called a vertex, represents an entity such as an account or device. An edge represents a relationship between entities. For example, Account A —USES→ Device D says that a particular account uses a particular device. Multiple accounts can connect to the same device node, making that shared connection explicit.",{"slug":1644,"title":1645,"focus":1646,"teaser":1647},"amazon-neptune-graph-models-and-relationship-traversal-saa-c03","Amazon Neptune: graph models and relationship traversal","How property graphs and RDF represent connected data, and why Neptune suits workloads built around traversing relationships.","Amazon Neptune is a fully managed graph database for storing connected data and querying its relationships. In a property graph, a vertex, also called a node, represents an entity. An edge represents a directed relationship between entities. Both vertices and edges can carry key-value properties.",{"slug":1649,"title":1650,"focus":1651,"teaser":1652},"amazon-neptune-and-amazon-documentdb-graphs-versus-documents-saa-c03","Amazon Neptune and Amazon DocumentDB: graphs versus documents","How relationship-traversal requirements differ from document-oriented access patterns when choosing between Neptune and DocumentDB.","Amazon Neptune is a graph database built for working with connected entities and their relationships. A relationship traversal starts at an entity and follows connections to other entities. For example, an application might follow a customer’s purchases to products, then follow those products to other customers who bought them.",{"slug":1654,"title":1655,"focus":1656,"teaser":1657},"amazon-opensearch-service-distributed-search-indexes-saa-c03","Amazon OpenSearch Service: distributed search indexes","How document indexes support search and log analytics, using shards to distribute workloads and replicas across Availability Zones to maintain availability.","Amazon OpenSearch Service is a managed service for search and analytics. In a managed domain, OpenSearch stores JSON documents in an index: a logical collection of related documents. A document might represent a product or one application log event.",{"slug":1659,"title":1660,"focus":1661,"teaser":1662},"aws-batch-managed-batch-execution-saa-c03","AWS Batch: managed batch execution","How AWS Batch uses job definitions, queues, and compute environments to run noninteractive container jobs with capacity that scales to workload demands.","AWS Batch schedules and runs noninteractive jobs: programs that start, do their work, and finish without someone operating them. Examples include generating reports, converting files, and running simulations. For container jobs, package the program and its dependencies into a container image; even a script runs inside a container.",{"slug":1664,"title":1665,"focus":1666,"teaser":1667},"aws-batch-vs-amazon-emr-choosing-a-processing-model-saa-c03","AWS Batch vs Amazon EMR: choosing a processing model","When queued container jobs suit a workload better than processing with managed big-data frameworks such as Spark.","AWS Batch and Amazon EMR can both process work without user interaction. A nightly schedule, large input files, or data stored in Amazon S3 does not distinguish them. The useful question is: What should the service manage for this application?",{"slug":1669,"title":1670,"focus":1671,"teaser":1672},"amazon-neptune-cluster-replication-and-failover-saa-c03","Amazon Neptune: cluster replication and failover","How Neptune combines replicated multi-AZ storage, a writer, and read replicas to scale graph reads and restore database availability after instance failures.","A Neptune Database cluster separates the instances that execute graph queries from the storage that holds the graph. Its shared cluster storage automatically replicates data across multiple Availability Zones in one Region. Storage replication protects data; it does not create more instances to execute queries.",{"id":1674,"title":1675,"subtitle":152,"lessons":1676},220,"Design highly available and\u002For fault-tolerant architectures",[1677,1682,1687,1692,1697,1702,1707,1712,1717,1722,1727,1732,1737,1742,1747,1752,1757,1762,1767,1772,1777,1782,1787,1792,1797,1802,1807,1812,1817,1822,1827,1832,1837,1842,1847,1852,1857,1862,1867,1872,1877,1882,1887,1892],{"slug":1678,"title":1679,"focus":1680,"teaser":1681},"amazon-route-53-highly-available-dns-hosting-saa-c03","Amazon Route 53: highly available DNS hosting","How hosted zones, alias records, and DNS caching provide reliable name resolution through Route 53's global infrastructure and affect DNS query costs.","A public hosted zone holds DNS records for a domain, such as example.com. Its records provide authoritative answers: the published information for that domain. To make the zone usable on the internet, configure the domain's parent delegation to use the name servers assigned to the hosted zone. Creating a zone alone does not redirect existing DNS delegation.",{"slug":1683,"title":1684,"focus":1685,"teaser":1686},"amazon-comprehend-managed-text-analysis-saa-c03","Amazon Comprehend: managed text analysis","How Comprehend turns unstructured text into insights with pretrained NLP models, and when applications should use real-time analysis or asynchronous batch jobs.","Amazon Comprehend is a managed natural language processing service. Its pretrained models turn unstructured text, such as reviews and support messages, into structured results without requiring you to train a model or manage inference servers.",{"slug":1688,"title":1689,"focus":1690,"teaser":1691},"amazon-polly-managed-text-to-speech-saa-c03","Amazon Polly: managed text-to-speech","How applications use Polly to synthesize spoken audio from text without managing speech infrastructure, and which use cases fit this capability.","Amazon Polly is a managed text-to-speech service: an application supplies written text and receives synthesized spoken audio. AWS operates the speech models and synthesis infrastructure. Your application still chooses the content, requests synthesis, and handles the resulting audio.",{"slug":1693,"title":1694,"focus":1695,"teaser":1696},"aws-managed-services-ams-managed-operations-model-saa-c03","AWS Managed Services (AMS): managed operations model","How AMS assumes day-to-day infrastructure operations to support workload resilience, when this operating model is useful, and which availability design responsibilities remain with the customer.","AWS Managed Services (AMS) takes on agreed day-to-day operations for your AWS infrastructure. It combines AWS operational expertise, automation, and established procedures for work such as monitoring, incident response, backup operations, and patch management. The exact responsibilities depend on the services and resources covered by your engagement.",{"slug":1698,"title":1699,"focus":1700,"teaser":1701},"ip-addressing-scalable-cidr-allocation-saa-c03","IP Addressing: scalable CIDR allocation","How to allocate non-overlapping VPC and subnet CIDR ranges with enough usable addresses for multi-AZ workloads, deployment surges, and future growth.","A CIDR block describes an entire address range. An IPv4 prefix of \u002Fn contains 2^(32 − n) addresses. For example, 10.40.0.0\u002F24 covers 10.40.0.0 through 10.40.0.255. A smaller prefix number means a larger range. Blocks must start on their boundaries: a \u002F23 spans two third-octet values and starts at an even one, such as 10.40.0.0\u002F23.",{"slug":1703,"title":1704,"focus":1705,"teaser":1706},"ip-routing-paths-between-networks-saa-c03","IP Routing: paths between networks","How forward and return routes through peering connections or transit hubs determine reachability, transitivity, and chargeable network hops.","A network connection and a usable route are different things. A VPC peering connection provides direct private connectivity between two VPCs with non-overlapping address ranges. Accepting the connection does not automatically add the subnet routes needed to use it.",{"slug":1708,"title":1709,"focus":1710,"teaser":1711},"disaster-recovery-recovery-strategies-saa-c03","Disaster recovery: recovery strategies","How backup and restore, pilot light, warm standby, and active-active strategies balance RPO and RTO requirements against cost and operational complexity.","A disaster recovery strategy balances the loss a business can tolerate against the resources it keeps ready. Recovery point objective (RPO) is the maximum acceptable data loss measured in time. Recovery time objective (RTO) is the target maximum time to restore service after a disruption.",{"slug":1713,"title":1714,"focus":1715,"teaser":1716},"failover-transferring-workloads-to-healthy-resources-saa-c03","Failover: transferring workloads to healthy resources","How active-passive and active-active designs detect failures and transfer workloads to healthy capacity across Availability Zones or Regions, accounting for replication and recovery targets.","Failover transfers work from an unhealthy resource to a healthy alternative. It needs three things: failure detection, an alternative able to do the work, and a way to transfer traffic or processing responsibility.",{"slug":1718,"title":1719,"focus":1720,"teaser":1721},"failover-vs-disaster-recovery-saa-c03","Failover vs. disaster recovery","How transferring work to an alternate resource differs from the broader strategy for restoring service after a disaster.","Failover transfers work from an unavailable or unhealthy resource to an alternative capable of doing that work. The resource could be an application server, a database, or an entire deployment. Failover can support everyday availability: moving requests away from one failed server does not require declaring a disaster.",{"slug":1723,"title":1724,"focus":1725,"teaser":1726},"pilot-light-activating-a-minimal-recovery-environment-saa-c03","Pilot Light: activating a minimal recovery environment","How a replicated data core and predefined infrastructure enable workload recovery, with replication lag and activation dependencies determining achievable RPO and RTO.","Pilot light keeps a small, essential core operating in a recovery location while the rest of the workload waits to be activated. In this example, an Amazon RDS database engine that supports Cross-Region read replicas continuously replicates to another Region. Application compute is absent until recovery.",{"slug":1728,"title":1729,"focus":1730,"teaser":1731},"warm-standby-recovering-from-reduced-capacity-saa-c03","Warm Standby: recovering from reduced capacity","How a running, reduced-capacity recovery environment uses replicated data, database promotion, capacity expansion, and traffic redirection to meet measured recovery objectives.","Warm standby keeps a complete application environment running at reduced capacity in a separate recovery location. It can process requests at a limited scale, but normally does not receive production traffic. Recovery turns that working environment into the production environment.",{"slug":1733,"title":1734,"focus":1735,"teaser":1736},"pilot-light-vs-warm-standby-saa-c03","Pilot Light vs Warm Standby","How recovery readiness distinguishes pilot light from warm standby and changes their ongoing cost, activation effort, and recovery time.","Pilot light and warm standby both prepare a recovery location before a disruption. The important difference is not simply how many resources run there. It is whether the recovery application is already functional.",{"slug":1738,"title":1739,"focus":1740,"teaser":1741},"aws-elastic-disaster-recovery-replication-based-server-recovery-saa-c03","AWS Elastic Disaster Recovery: replication-based server recovery","How continuous block-level replication into a staging area and recovery server launches determine achievable RPO, RTO, and standby costs.","AWS Elastic Disaster Recovery protects servers by continuously copying disk changes into an AWS staging area. After an initial synchronization, the AWS Replication Agent sends changed blocks rather than repeatedly copying whole disks.",{"slug":1743,"title":1744,"focus":1745,"teaser":1746},"amazon-rds-connection-pooling-with-rds-proxy-saa-c03","Amazon RDS: connection pooling with RDS Proxy","How RDS Proxy pools database connections, handles authentication and failover, and trades proxy charges against connection overhead and database capacity.","Opening database connections consumes time, memory, and CPU. A burst of application instances can exhaust connections even when each instance does little work. RDS Proxy sits between an application and a supported RDS or Aurora database. Applications connect to its endpoint rather than directly to the database.",{"slug":1748,"title":1749,"focus":1750,"teaser":1751},"immutable-infrastructure-image-based-replacement-saa-c03","Immutable Infrastructure: image-based replacement","How tested, versioned images replace deployed compute while externalized state, health checks, and replacement capacity preserve service availability.","Immutable infrastructure means releasing changes by replacing deployed compute, rather than installing new software on existing production hosts. For an EC2 application, build a new Amazon Machine Image (AMI) containing the approved operating system, packages, and application. A security patch becomes a new image release, not a manual edit to each server.",{"slug":1753,"title":1754,"focus":1755,"teaser":1756},"immutable-infrastructure-vs-infrastructure-as-code-saa-c03","Immutable Infrastructure vs. Infrastructure as Code","Why defining infrastructure as code does not guarantee immutability, and how resource replacement differs from updating existing hosts.","Infrastructure as code (IaC) describes infrastructure in files that a deployment tool uses to create and update resources. It answers: How is the infrastructure defined and managed? Version-controlled definitions make changes reviewable and help teams repeat a deployment.",{"slug":1758,"title":1759,"focus":1760,"teaser":1761},"blue-green-deployment-replacing-the-production-environment-saa-c03","Blue-Green Deployment: replacing the production environment","How a reproducible replacement environment takes over production traffic without modifying the live fleet, and when switching back remains safe.","Blue-green deployment separates preparing a release from sending users to it. Blue serves the current version while green is built alongside it. In this lesson, each environment is an EC2 application fleet, and the release does not install new software on the live blue instances.",{"slug":1763,"title":1764,"focus":1765,"teaser":1766},"blue-green-deployment-vs-immutable-infrastructure-saa-c03","Blue-Green Deployment vs. Immutable Infrastructure","Why a traffic-switching release strategy and a replace-rather-than-modify infrastructure principle are complementary but do not guarantee each other.","Blue-green deployment answers: How does a release take over production traffic? The current environment, blue, serves production while a separate environment, green, holds the next release. You validate green before directing production traffic to it. The defining action is a traffic handover between environments.",{"slug":1768,"title":1769,"focus":1770,"teaser":1771},"reverse-proxy-resilient-backend-access-saa-c03","Reverse Proxy: resilient backend access","How a reverse proxy mediates client connections through backend changes and failures, using database connection pooling and failover to illustrate its benefits and availability limits.","A reverse proxy represents backend servers to their clients. The client connects to the proxy, and the proxy communicates with a backend on its behalf. Client-to-proxy and proxy-to-backend connections are separate, so a backend can change without requiring a new client-facing endpoint.",{"slug":1773,"title":1774,"focus":1775,"teaser":1776},"connection-pooling-reusing-and-bounding-database-connections-saa-c03","Connection Pooling: reusing and bounding database connections","How application-side and proxy-managed pools reuse database connections, limit backend pressure, and manage connection lifecycles through bursts and failures.","Opening a database connection takes work: establishing a network connection, authenticating, and creating a database session. A connection pool keeps connections available for reuse. A request borrows one, uses it, and returns it; the connection can outlive the request.",{"slug":1778,"title":1779,"focus":1780,"teaser":1781},"connection-multiplexing-vs-connection-pooling-saa-c03","Connection Multiplexing vs. Connection Pooling","How reusing pooled connections differs from sharing backend connections among distinct clients, and why application-local pools do not provide fleet-wide multiplexing.","Connection pooling keeps connections available for reuse. Instead of opening a database connection for every operation, application code borrows an existing connection and returns it afterward. The connection outlives any one operation.",{"slug":1783,"title":1784,"focus":1785,"teaser":1786},"service-quotas-managing-quota-headroom-saa-c03","Service Quotas: managing quota headroom","How to verify applied quotas and secure increases in each workload account and Region, including standby environments, without confusing quota headroom with reserved capacity or service-level throttle settings.","Service Quotas helps you discover supported AWS quotas, inspect their values, and request supported increases. A quota limits resources, throughput, or operations—for example, EC2 On-Demand vCPUs or Lambda concurrent executions. Quota headroom is the allowance remaining between relevant usage and the applied limit, measured in the same units and scope.",{"slug":1788,"title":1789,"focus":1790,"teaser":1791},"capacity-planning-failover-capacity-saa-c03","Capacity Planning: failover capacity","How to translate failover demand into regional quota requirements and validate that standby resources can reach the required capacity before recovery deadlines.","A standby Region must support the workload required during recovery, not just its small normal workload. Start with the failover demand: traffic transferred from the failed Region plus traffic the destination already serves. State the required throughput and latency, then use representative load tests to translate that demand into resources. If reduced service is acceptable during recovery, make that an explicit requirement.",{"slug":1793,"title":1794,"focus":1795,"teaser":1796},"exponential-backoff-bounded-retry-policies-saa-c03","Exponential Backoff: bounded retry policies","How to configure capped, jittered retries for transient failures while preserving operation safety and respecting retry budgets across SDK and workflow layers.","Exponential backoff increases the wait between retries after a failure. Use it for failures that may clear without changing the request, such as throttling, selected server errors, or connection failures. Follow the API's documented retry rules and server guidance such as Retry-After. Invalid parameters and permission errors normally need correction, not repetition.",{"slug":1798,"title":1799,"focus":1800,"teaser":1801},"data-durability-protection-against-data-loss-saa-c03","Data Durability: protection against data loss","How redundancy, failure-domain placement, and retained recovery copies determine which causes of permanent data loss a storage design can withstand.","Data durability means preserving data against permanent loss. Storage systems use redundant copies or erasure coding, which distributes enough data and recovery information to reconstruct lost pieces. Integrity checks detect damage, and repair restores redundancy while enough healthy data remains.",{"slug":1803,"title":1804,"focus":1805,"teaser":1806},"data-durability-vs-high-availability-saa-c03","Data Durability vs. High Availability","Why data-preservation targets and service uptime targets are independent, so protection against data loss does not imply uninterrupted access.","Data durability asks whether stored data will survive rather than be permanently lost. High availability asks whether users can successfully use a service when they need it. These are independent design objectives: meeting one does not establish that the other is met.",{"slug":1808,"title":1809,"focus":1810,"teaser":1811},"data-replication-storage-replication-guarantees-saa-c03","Data Replication: storage replication guarantees","How replica placement and write acknowledgment rules determine which failures storage can survive and whether recent writes remain available on a replica.","Replication maintains copies of data and propagates changes between them. To choose a replication configuration, first identify the failure boundary: the resources that one failure can make unavailable together. Separate devices can survive an individual device failure, but copies inside one Availability Zone still share that zone's failure boundary.",{"slug":1813,"title":1814,"focus":1815,"teaser":1816},"data-replication-vs-data-durability-saa-c03","Data Replication vs. Data Durability","Why maintaining synchronized copies is a protection mechanism, while durability describes retaining data despite failures or destructive changes.","Data replication maintains multiple copies of data by propagating changes between them. The copies follow the changing data rather than remaining fixed snapshots. Keeping another copy gives a storage system a way to preserve data when one copy is lost.",{"slug":1818,"title":1819,"focus":1820,"teaser":1821},"amazon-cloudwatch-metric-based-workload-monitoring-saa-c03","Amazon CloudWatch: metric-based workload monitoring","How to select, aggregate, visualize, and alarm on workload metrics to monitor availability and trigger scaling actions.","Amazon CloudWatch metrics are time-ordered measurements. Start with what the workload must deliver: successful requests, acceptable response times, and enough capacity. Monitor request failures and latency for customer impact, then resource utilization for capacity pressure. Low CPU alone does not prove that an application is available.",{"slug":1823,"title":1824,"focus":1825,"teaser":1826},"distributed-tracing-end-to-end-request-visibility-saa-c03","Distributed Tracing: end-to-end request visibility","How spans connected by propagated trace context reveal service dependencies and help locate delays and failures along a request’s path.","Distributed tracing follows a request across application boundaries. An order service can respond slowly because it is waiting for inventory, even when the order service itself has no resource problem. A trace connects the operations involved in that particular request rather than showing each service in isolation.",{"slug":1828,"title":1829,"focus":1830,"teaser":1831},"aws-x-ray-distributed-request-tracing-saa-c03","AWS X-Ray: distributed request tracing","How instrumented applications produce sampled traces whose segments and service maps reveal dependencies, latency bottlenecks, and failing downstream calls.","AWS X-Ray helps you understand a request that crosses application boundaries. A trace brings together the recorded work for that request. A segment describes a service's work, while a subsegment describes a smaller operation, such as an outgoing database call.",{"slug":1833,"title":1834,"focus":1835,"teaser":1836},"aws-x-ray-and-amazon-cloudwatch-traces-versus-metrics-and-logs-saa-c03","AWS X-Ray and Amazon CloudWatch: traces versus metrics and logs","When request-level tracing in X-Ray provides visibility that CloudWatch metrics and logs alone do not, and how these signals complement each other.","CloudWatch metrics are numerical measurements over time, such as request counts, error rates, and latency. They help answer: “Is the workload unhealthy, and how widespread is the change?” Even a latency percentile does not describe the path of an individual request.",{"slug":1838,"title":1839,"focus":1840,"teaser":1841},"infrastructure-as-code-iac-maintaining-desired-state-saa-c03","Infrastructure as code (IaC): maintaining desired state","How version-controlled definitions guide repeatable updates and controlled correction of configuration drift, including the limits of idempotency and drift detection.","Infrastructure as code (IaC) stores infrastructure definitions in files that a deployment tool can use. In a declarative definition, you describe the desired state, such as a database configuration or a security group's allowed connections, rather than listing every API operation needed to create it.",{"slug":1843,"title":1844,"focus":1845,"teaser":1846},"configuration-drift-desired-state-reconciliation-saa-c03","Configuration Drift: desired-state reconciliation","How automated baseline comparisons and controlled remediation keep deployed infrastructure and managed hosts aligned with their intended configuration.","Configuration drift is a mismatch between the intended configuration and what actually exists. A resource can keep working while drifting: an administrator might open an access rule for troubleshooting and forget to restore it. Availability alone does not show that configuration is correct.",{"slug":1848,"title":1849,"focus":1850,"teaser":1851},"aws-cloudformation-maintaining-template-defined-stacks-saa-c03","AWS CloudFormation: maintaining template-defined stacks","How CloudFormation maintains template-defined infrastructure through repeatable stack deployments, change sets, rollback, and drift detection followed by corrective updates.","AWS CloudFormation uses a JSON or YAML template to describe AWS resources, their properties, and their relationships. A stack is the collection of resources CloudFormation manages from that template. CloudFormation works out dependency ordering, rather than requiring you to create each resource manually.",{"slug":1853,"title":1854,"focus":1855,"teaser":1856},"high-availability-and-fault-tolerance-recovery-versus-continuity-saa-c03","High availability and fault tolerance: recovery versus continuity","How permitting brief recovery interruptions differs from requiring uninterrupted operation through specified failures.","High availability means keeping a service usable for its required proportion of time. It can permit brief interruptions while the system recovers. Fault tolerance requires continued operation through specified failures, without interrupting the operation being protected.",{"slug":1858,"title":1859,"focus":1860,"teaser":1861},"high-availability-redundancy-across-failure-domains-saa-c03","High availability: redundancy across failure domains","How independent request paths and sufficient surviving capacity remove single points of failure, and when protection requires multiple Availability Zones or Regions.","A single point of failure is something whose failure can stop the service because every usable request path depends on it. Two application servers do not remove that risk if both require one network appliance or one database. Follow the whole request path and ask whether a working alternative remains when each required component fails.",{"slug":1863,"title":1864,"focus":1865,"teaser":1866},"high-availability-health-driven-traffic-recovery-saa-c03","High availability: health-driven traffic recovery","How health detection, traffic withdrawal, and automated instance replacement restore service without requiring changes to application code.","Health-driven recovery connects three jobs: detect an unhealthy application target, stop selecting it for traffic, and replace it automatically. These jobs can run outside the application, so a suitable existing application does not need new recovery logic in its code.",{"slug":1868,"title":1869,"focus":1870,"teaser":1871},"high-availability-stateful-dependencies-saa-c03","High availability: stateful dependencies","How session, file, and database state constrain replica replacement and how resilient state services support failover when application changes are limited.","An application replica is replaceable only if another replica can obtain the state needed to continue serving users. State includes login sessions, uploaded files, and database records. Starting the same application image does not recreate a shopping cart held only in the failed process's memory.",{"slug":1873,"title":1874,"focus":1875,"teaser":1876},"key-performance-indicators-availability-tied-to-business-outcomes-saa-c03","Key Performance Indicators: availability tied to business outcomes","How to translate business availability requirements into KPIs with explicit calculations, measurement windows, targets, and business-impact interpretations.","A useful availability KPI answers a business question: can customers complete checkout when they need to? Define the journey and what counts as success before choosing a measurement. For example, a successful checkout attempt must confirm an order within five seconds; a healthy server alone does not prove checkout is available.",{"slug":1878,"title":1879,"focus":1880,"teaser":1881},"service-level-indicators-measuring-user-facing-reliability-saa-c03","Service Level Indicators: measuring user-facing reliability","How to translate business requirements into precisely defined indicators of successful, timely user operations that reveal failures infrastructure health checks can miss.","A Service Level Indicator (SLI) measures service behavior that matters to users. Translate a business requirement such as “customers must be able to place orders quickly” into an observable operation: a customer submits a checkout and receives confirmation that the order was saved. Measure that outcome, not simply whether the machines are running.",{"slug":1883,"title":1884,"focus":1885,"teaser":1886},"key-performance-indicators-vs-service-level-indicators-saa-c03","Key Performance Indicators vs Service Level Indicators","How business-decision KPIs differ from service-behavior SLIs, and when the same measurement can serve both roles.","A Key Performance Indicator (KPI) is a selected measurement used to judge progress toward an important objective and support a decision. For an online store, revenue per customer could help leaders decide where to invest. A measurement does not become a KPI just because it is available on a dashboard.",{"slug":1888,"title":1889,"focus":1890,"teaser":1891},"service-level-objectives-setting-business-aligned-reliability-targets-saa-c03","Service Level Objectives: setting business-aligned reliability targets","How to specify measurable reliability targets and evaluation windows that reflect each workload's business impact and acceptable cost.","A service level objective (SLO) defines acceptable service through a measurement, a target, and an evaluation window. Start by identifying the user task and the consequences when it fails: lost sales, delayed work, missed deadlines, or harm. Different tasks within the same application can justify different reliability targets.",{"slug":1893,"title":1894,"focus":1895,"teaser":1896},"service-level-indicators-vs-service-level-objectives-saa-c03","Service Level Indicators vs Service Level Objectives","How to distinguish a measured service outcome from the target and evaluation window used to judge it.","A Service Level Indicator (SLI) measures service behavior. For example, a checkout success SLI measures successful eligible checkout attempts divided by all eligible checkout attempts. A reported value of 99.8% describes what happened; it does not say whether that was good enough.",{"id":1898,"title":1899,"subtitle":152,"subcategories":1900},56,"Design High-Performing Architectures",[1901,1959,2038,2132,2211],{"id":230,"title":1902,"subtitle":152,"lessons":1903},"Determine high-performing and\u002For scalable storage solutions",[1904,1909,1914,1919,1924,1929,1934,1939,1944,1949,1954],{"slug":1905,"title":1906,"focus":1907,"teaser":1908},"hybrid-cloud-storage-local-access-to-cloud-backed-data-saa-c03","Hybrid Cloud Storage: local access to cloud-backed data","How local caching connects applications to cloud capacity, with working-set size, network dependence, and upload behavior shaping performance and resilience.","Hybrid cloud storage connects local applications to cloud-backed data through a coordinated storage system. A local gateway provides a familiar access interface, while cloud storage holds a dataset that can be larger than the local disks.",{"slug":1910,"title":1911,"focus":1912,"teaser":1913},"aws-storage-gateway-cloud-backed-storage-modes-saa-c03","AWS Storage Gateway: cloud-backed storage modes","How file, volume, and tape gateway modes place data locally and in AWS, and how that placement affects application access, performance, and cost.","AWS Storage Gateway gives applications familiar storage interfaces while using AWS for cloud storage. A gateway appliance near the applications supplies local storage and transfers data to AWS. Local access does not mean every byte is always local.",{"slug":1915,"title":1916,"focus":1917,"teaser":1918},"aws-datasync-locations-and-transfer-tasks-saa-c03","AWS DataSync: locations and transfer tasks","How locations, agents, and tasks move and verify files and objects between supported storage systems for migrations and recurring synchronization.","AWS DataSync copies files and objects between supported storage systems. Common endpoints include NFS and SMB shares, object storage, Amazon S3, Amazon EFS, and supported Amazon FSx file systems. Use it for an initial migration or repeated copies of changing data.",{"slug":1920,"title":1921,"focus":1922,"teaser":1923},"aws-datasync-vs-aws-storage-gateway-saa-c03","AWS DataSync vs AWS Storage Gateway","Why moving data with DataSync differs from providing ongoing hybrid storage access through Storage Gateway, and when each approach fits.","AWS DataSync moves data between supported storage systems. Choose it when the result you need is a copy at a destination: for example, migrating an existing file collection to AWS or periodically copying changed files. Applications access the source or destination storage, not a file share served by DataSync.",{"slug":1925,"title":1926,"focus":1927,"teaser":1928},"amazon-s3-glacier-archive-storage-classes-saa-c03","Amazon S3 Glacier: archive storage classes","How Glacier storage classes support economical long-term archives through lifecycle transitions, minimum storage durations, and retrieval options.","The S3 Glacier storage classes reduce storage costs for data that is kept for a long time and read infrequently. Start with the access requirement: must an application read an object immediately, or can it wait for a restore? Lower storage cost is useful only when the retrieval behavior still meets the application's needs.",{"slug":1930,"title":1931,"focus":1932,"teaser":1933},"iops-and-throughput-operation-rate-versus-data-rate-saa-c03","IOPS and throughput: operation rate versus data rate","How operation rate differs from data-transfer rate, and why operation size determines which limit a workload reaches first.","IOPS means input\u002Foutput operations per second: how many reads and writes a storage system completes each second. Storage throughput measures the amount of data transferred each second, commonly in MiB\u002Fs. These describe the same activity in two different ways.",{"slug":1935,"title":1936,"focus":1937,"teaser":1938},"iops-sizing-storage-for-workload-demand-saa-c03","IOPS: sizing storage for workload demand","How workload characteristics and storage-path limits determine the sustainable IOPS a configuration must deliver at acceptable latency.","IOPS is the number of read and write operations completed each second. For sizing, the useful requirement is the operation rate needed during representative busy periods, at an acceptable latency. A daily average can hide the busiest minutes that storage must support.",{"slug":1940,"title":1941,"focus":1942,"teaser":1943},"throughput-sizing-sustained-end-to-end-capacity-saa-c03","Throughput: sizing sustained end-to-end capacity","How to translate workload demands into sustained completion rates and size storage or pipeline stages around their limiting throughput.","Sustained throughput is useful work completed per unit of time over the interval that matters. Choose a measurement boundary: records committed to destination storage, for example, rather than records submitted by a producer. Retries and failed submissions are not additional completed work.",{"slug":1945,"title":1946,"focus":1947,"teaser":1948},"latency-and-throughput-elapsed-time-versus-processing-rate-saa-c03","Latency and throughput: elapsed time versus processing rate","Why meeting a records-per-second or bytes-per-second target does not guarantee that individual records become usable within a latency target.","Throughput measures work completed per unit of time, such as records per second or bytes per second. Latency measures elapsed time for an individual record or operation. A system can complete many records each second without completing any particular record quickly.",{"slug":1950,"title":1951,"focus":1952,"teaser":1953},"high-performance-matching-storage-to-workload-demands-saa-c03","High performance: matching storage to workload demands","How access patterns, latency targets, IOPS, throughput, and end-to-end resource limits guide storage service and configuration choices.","Start with the access pattern: random or sequential access, small or large requests, reads or writes, and how many requests run concurrently. Small random database reads often demand many operations; large sequential scans often demand many bytes per second. Also record whether the application needs block devices, shared files, or objects.",{"slug":1955,"title":1956,"focus":1957,"teaser":1958},"capacity-planning-storage-growth-and-performance-saa-c03","Capacity Planning: storage growth and performance","How to project storage needs in bytes, IOPS, and throughput and assess whether storage scaling limits leave enough headroom for future demand.","Storage capacity is the amount of data you can retain, measured in bytes. Start with current usage and choose a planning horizon, such as eight months. For roughly constant growth, use projected retained bytes = current bytes + net growth per month × months. Net growth means additions minus deletions. When growth accelerates or retention rules change, project each period separately rather than extending an old average.",{"id":1960,"title":1961,"subtitle":152,"lessons":1962},222,"Design high-performing and elastic compute solutions",[1963,1968,1973,1978,1983,1988,1993,1998,2003,2008,2013,2018,2023,2028,2033],{"slug":1964,"title":1965,"focus":1966,"teaser":1967},"amazon-emr-compute-for-distributed-data-processing-saa-c03","Amazon EMR: compute for distributed data processing","How EMR runs distributed Spark and Hadoop workloads, with deployment options that trade infrastructure control for managed scaling.","Amazon EMR provides managed environments for distributed data frameworks, including Apache Spark and Hadoop. You supply processing code and configuration; the framework divides the work across compute resources. Common uses include transforming large datasets, joining records, and producing aggregates.",{"slug":1969,"title":1970,"focus":1971,"teaser":1972},"amazon-emr-and-aws-glue-choosing-a-processing-service-saa-c03","Amazon EMR and AWS Glue: choosing a processing service","When distributed-framework flexibility favors EMR over Glue's managed data integration, including why serverless execution alone does not distinguish them.","Amazon EMR and AWS Glue both process and transform data at scale. The useful distinction is not “large data versus small data” or “Spark versus no Spark.” Both can run distributed Apache Spark processing, which divides work across multiple compute resources.",{"slug":1974,"title":1975,"focus":1976,"teaser":1977},"data-locality-placing-compute-near-data-saa-c03","Data Locality: placing compute near data","How data flows guide placement across Regions, Availability Zones, and edge environments to reduce latency and transfer costs while meeting resilience requirements.","Data locality means placing compute near the data it uses, or placing frequently read data near its consumers. Start by identifying where data originates, where it is stored, and which applications read or write it. Record both the volume moved and how often the movement happens.",{"slug":1979,"title":1980,"focus":1981,"teaser":1982},"aws-wavelength-compute-in-wavelength-zones-saa-c03","AWS Wavelength: compute in Wavelength Zones","How application components deployed in Wavelength Zone subnets use carrier networking to serve mobile users with low latency while connecting to services in the parent AWS Region.","AWS Wavelength places supported AWS compute and storage infrastructure in telecommunications partners’ locations. An application handler running there can serve users on the connected mobile network without sending every interaction to a regional data center.",{"slug":1984,"title":1985,"focus":1986,"teaser":1987},"aws-local-zones-vs-aws-wavelength-choosing-the-right-edge-location-saa-c03","AWS Local Zones vs AWS Wavelength: choosing the right edge location","How Local Zones serving nearby users differ from Wavelength Zones embedded in telecommunications networks in user connectivity and placement suitability.","AWS Local Zones and AWS Wavelength both let you place application compute closer to users than a distant AWS Region. Their important difference is what makes the placement close: a Local Zone serves a nearby geographic area, while a Wavelength Zone places AWS infrastructure inside a telecommunications partner’s network.",{"slug":1989,"title":1990,"focus":1991,"teaser":1992},"aws-wavelength-vs-amazon-cloudfront-application-compute-or-content-delivery-saa-c03","AWS Wavelength vs Amazon CloudFront: application compute or content delivery","When a workload needs application compute within a telecommunications network rather than content delivery through CloudFront edge locations.","AWS Wavelength places AWS compute and storage infrastructure within telecommunications partners’ networks. You can run an application on Amazon EC2 in a Wavelength Zone so that connected mobile devices reach its processing logic over a shorter network path.",{"slug":1994,"title":1995,"focus":1996,"teaser":1997},"aws-auto-scaling-application-scaling-plans-saa-c03","AWS Auto Scaling: application scaling plans","How scaling plans apply utilization targets and capacity limits across supported application resources to balance performance and cost.","An AWS Auto Scaling scaling plan brings scaling settings for supported application resources into one place. You can discover resources through an AWS CloudFormation stack or resource tags, then configure how the selected resources should scale.",{"slug":1999,"title":2000,"focus":2001,"teaser":2002},"aws-lambda-memory-sizing-and-execution-cost-saa-c03","AWS Lambda: memory sizing and execution cost","How memory allocation affects CPU capacity, execution duration, and charges, and how to choose a cost-effective function size using workload measurements.","For an on-demand AWS Lambda function, memory allocation is both a memory limit and a performance setting. Lambda allocates CPU capacity in proportion to configured memory. Increasing memory therefore gives the function more CPU capacity, even when its code does not need more space for data.",{"slug":2004,"title":2005,"focus":2006,"teaser":2007},"aws-fargate-resource-sizing-and-compute-costs-saa-c03","AWS Fargate: resource sizing and compute costs","How requested task or pod resources determine Fargate capacity and charges, and when right-sizing or interruptible Fargate Spot capacity reduces costs.","AWS Fargate provisions capacity for each ECS task or EKS pod from its resource configuration, not from its moment-to-moment CPU activity. Compute charges reflect the provisioned vCPU and memory over the billable duration. An idle application does not receive a smaller compute bill just because it uses little of its allocation.",{"slug":2009,"title":2010,"focus":2011,"teaser":2012},"resource-utilization-interpreting-capacity-pressure-saa-c03","Resource Utilization: interpreting capacity pressure","How representative utilization measurements, saturation signals, and spare capacity reveal when compute scaling or network capacity changes are justified without compromising performance or resilience.","Resource utilization describes how much capacity a workload uses, separately for CPU, memory, storage, and networking. A low CPU reading does not mean the whole instance is underused: memory or network capacity may already be limiting performance. Start with a representative workload cycle, including normal traffic, busy periods, and scheduled jobs.",{"slug":2014,"title":2015,"focus":2016,"teaser":2017},"cpu-architecture-vs-amazon-ec2-instance-types-saa-c03","CPU Architecture vs Amazon EC2 instance types","How the processor execution target differs from an instance family's resource profile and an instance size's resource allocation.","CPU architecture describes the processor execution target that software must support. On Amazon EC2, two important targets are x86-64 and Arm64. The operating-system image, executable binaries, native libraries, and software agents must support the selected architecture.",{"slug":2019,"title":2020,"focus":2021,"teaser":2022},"amazon-ec2-instance-types-choosing-an-instance-family-saa-c03","Amazon EC2 instance types: choosing an instance family","How family resource profiles and hardware compatibility determine which instance types can efficiently run a workload.","An EC2 instance family describes a resource profile: the balance of CPU, memory, storage, networking, and sometimes accelerators. Choose a profile that addresses the workload's limiting resource. Adding CPUs to a workload that is waiting for memory or storage can leave those CPUs idle.",{"slug":2024,"title":2025,"focus":2026,"teaser":2027},"amazon-ec2-instance-types-choosing-an-instance-size-saa-c03","Amazon EC2 instance types: choosing an instance size","How to use workload measurements, resource limits, and burstable CPU behavior to select an instance size without overprovisioning.","An EC2 instance size sets resource allocations within an instance family, including vCPUs and memory. Network and storage performance can also vary by size. Start with a compatible instance family, then choose the smallest size that meets the workload's performance needs with justified headroom: spare capacity for expected variation and growth.",{"slug":2029,"title":2030,"focus":2031,"teaser":2032},"right-sizing-compute-resource-fit-saa-c03","Right-Sizing: compute resource fit","How representative demand measurements determine compute resource type and size, with performance headroom verified through testing.","Right-sizing means choosing compute resources that meet performance requirements without unnecessary capacity. Start with a representative baseline: measurements covering normal activity, busy periods, recurring batch jobs, and relevant seasonal peaks. A quiet afternoon or a long-term average can hide the demand that determines the required size.",{"slug":2034,"title":2035,"focus":2036,"teaser":2037},"aws-compute-optimizer-utilization-based-sizing-recommendations-saa-c03","AWS Compute Optimizer: utilization-based sizing recommendations","How historical utilization informs EC2 instance and Lambda memory recommendations, and how to evaluate their projected performance and cost against workload requirements.","AWS Compute Optimizer analyzes resource configuration and historical utilization to recommend better-sized resources. After you opt in and sufficient utilization data is available, it can recommend EC2 instance types and Lambda memory settings. A recommendation is a candidate configuration, not proof that a change will meet your application's requirements.",{"id":2039,"title":2040,"subtitle":152,"lessons":2041},223,"Determine high-performing database solutions",[2042,2047,2052,2057,2062,2067,2072,2077,2082,2087,2092,2097,2102,2107,2112,2117,2122,2127],{"slug":2043,"title":2044,"focus":2045,"teaser":2046},"database-indexing-choosing-indexes-for-access-patterns-saa-c03","Database Indexing: choosing indexes for access patterns","How query filters, ordering, and selectivity guide index selection while balancing faster reads against storage and write overhead.","An index is an alternative access path to data. Instead of inspecting every row, a database can search index entries and retrieve matching records. This lesson uses conventional B-tree indexes in relational databases, such as supported engines in Amazon RDS and Amazon Aurora; other index types have different capabilities.",{"slug":2048,"title":2049,"focus":2050,"teaser":2051},"denormalization-modeling-data-around-access-patterns-saa-c03","Denormalization: modeling data around access patterns","How to choose duplicated or embedded data that reduces read work while accounting for write amplification and consistency requirements.","Denormalization deliberately combines related data or stores redundant values to reduce retrieval work. A normalized model keeps related entities separate to reduce duplication and update anomalies. For example, an order can reference a customer record, but displaying both may require a join or another lookup.",{"slug":2053,"title":2054,"focus":2055,"teaser":2056},"sharding-partition-keys-and-query-routing-saa-c03","Sharding: partition keys and query routing","How database access patterns guide partitioning and routing choices to scale storage and writes while avoiding hotspots and costly cross-shard queries and transactions.","Sharding divides records across independently managed database resources. Each shard owns a different subset, allowing storage and writes to grow beyond one database writer. Start with access patterns: which records are read together, which are updated together, and which operations dominate traffic?",{"slug":2058,"title":2059,"focus":2060,"teaser":2061},"right-sizing-database-capacity-saa-c03","Right-Sizing: database capacity","How database request patterns translate into instance resources or capacity units that meet performance targets with justified headroom.","Database capacity starts with the requests the database must serve, not just the amount of data it stores. Measure reads and writes per second, item or result sizes, query complexity, and concurrent requests. Include busy periods and overlapping batch work: the same daily request count can arrive steadily or in a short, demanding burst.",{"slug":2063,"title":2064,"focus":2065,"teaser":2066},"connection-multiplexing-sharing-database-connections-through-a-proxy-saa-c03","Connection Multiplexing: sharing database connections through a proxy","How a proxy reassigns backend connections at transaction boundaries, why session pinning limits sharing, and when multiplexing relieves connection pressure rather than database workload bottlenecks.","Connection multiplexing separates a client connection from a physical database connection. Applications connect to a proxy endpoint. The proxy maintains backend connections to the database and assigns a suitable one when a client has work to execute.",{"slug":2068,"title":2069,"focus":2070,"teaser":2071},"amazon-aurora-relational-engine-and-workload-fit-saa-c03","Amazon Aurora: relational engine and workload fit","How Aurora's MySQL and PostgreSQL compatibility, transactional capabilities, and provisioned or serverless capacity options determine workload suitability and cost.","Amazon Aurora is a managed relational database engine with two editions: Aurora MySQL and Aurora PostgreSQL. Choose the edition that matches the application's SQL dialect and database ecosystem. One database does not accept both dialects interchangeably.",{"slug":2073,"title":2074,"focus":2075,"teaser":2076},"heterogeneous-migration-vs-homogeneous-migration-saa-c03","Heterogeneous Migration vs Homogeneous Migration","How changing the database engine, rather than its location or hosting model, distinguishes heterogeneous from homogeneous migration and changes compatibility requirements.","A database engine is the database software that stores data and processes queries, such as PostgreSQL, MySQL, or Oracle Database. A homogeneous migration keeps the same engine. A heterogeneous migration changes to a different engine.",{"slug":2078,"title":2079,"focus":2080,"teaser":2081},"homogeneous-migration-assessing-same-engine-destinations-saa-c03","Homogeneous Migration: assessing same-engine destinations","How compatibility checks determine whether a same-engine destination preserves application behavior while meeting performance and cost requirements.","A same-engine destination reduces conversion work, but it does not prove that the application will behave the same way. PostgreSQL on one server and PostgreSQL on another can differ in version, installed extensions, settings, and permissions. Assess the exact destination configuration, not just its engine name.",{"slug":2083,"title":2084,"focus":2085,"teaser":2086},"heterogeneous-migration-assessing-target-engine-suitability-saa-c03","Heterogeneous Migration: assessing target-engine suitability","How source-engine dependencies determine whether a target engine offers worthwhile performance and cost benefits after schema and application conversion.","A target engine is suitable when it can preserve the application's required behavior and offer worthwhile benefits after conversion. Start by identifying source-engine dependencies: features or assumptions that tie the workload to its current engine. A database with simple tables and portable SQL usually needs less conversion than one whose business rules live in engine-specific stored procedures.",{"slug":2088,"title":2089,"focus":2090,"teaser":2091},"aws-dms-database-migration-workflows-saa-c03","AWS DMS: database migration workflows","How DMS runs homogeneous and heterogeneous migrations through schema preparation, full load, and change capture, using replication capacity suited to the workload.","AWS Database Migration Service (AWS DMS) moves data between supported source and target databases. A homogeneous migration keeps the same database engine, such as PostgreSQL to PostgreSQL. A heterogeneous migration changes engines, such as Oracle to PostgreSQL.",{"slug":2093,"title":2094,"focus":2095,"teaser":2096},"aws-dms-and-aws-sct-data-migration-versus-schema-conversion-saa-c03","AWS DMS and AWS SCT: data migration versus schema conversion","How AWS DMS data migration differs from AWS SCT schema and code conversion, including where DMS built-in schema conversion is an alternative.","A database contains both data, such as customer rows, and schema and code, such as table definitions, views, and stored procedures. Moving the rows and making their surrounding structures work on the target are different jobs.",{"slug":2098,"title":2099,"focus":2100,"teaser":2101},"database-choosing-a-model-for-application-access-patterns-saa-c03","Database: choosing a model for application access patterns","How query patterns, transaction requirements, and capacity variability guide the choice of database model and provisioned or serverless operation.","An access pattern describes how an application retrieves or changes data: which records it needs, how it finds them, and what it returns. Write down concrete operations such as “get a cart by customer ID” or “join orders with customers using different filters.” Choose a database model around these operations, not just around the shape of a sample record.",{"slug":2103,"title":2104,"focus":2105,"teaser":2106},"relational-data-model-schema-design-and-workload-fit-saa-c03","Relational Data Model: schema design and workload fit","How organizing related records into normalized tables supports integrity and flexible joins while creating query-cost and storage trade-offs.","A relational schema defines tables, columns, data types, keys, and constraints. Design tables around the things your application records and their relationships. For a shop, Customers stores customer facts, Orders stores order facts, and OrderItems stores the products and quantities within each order. This logical organization is separate from the servers and storage running the database.",{"slug":2108,"title":2109,"focus":2110,"teaser":2111},"in-memory-databases-workload-fit-saa-c03","In-Memory Databases: workload fit","How memory-resident operation supports latency-sensitive workloads, and how durability and memory-capacity requirements determine its suitability as a cache or primary database.","An in-memory database keeps its working data in RAM for normal operations, rather than fetching that data from disk. This supports low response times and high request rates, especially for small, predictable operations such as session lookups, counters, and leaderboard updates.",{"slug":2113,"title":2114,"focus":2115,"teaser":2116},"amazon-aurora-serverless-automatic-compute-scaling-saa-c03","Amazon Aurora Serverless: automatic compute scaling","How Aurora Serverless scales SQL database compute within configured ACU limits to accommodate variable application demand.","Amazon Aurora Serverless v2 automatically adjusts database compute as application demand changes. Applications still connect to a database endpoint and run SQL using an Aurora MySQL-compatible or Aurora PostgreSQL-compatible engine. Serverless describes how compute is managed, not a different database model.",{"slug":2118,"title":2119,"focus":2120,"teaser":2121},"acid-transactions-database-transaction-guarantees-saa-c03","ACID Transactions: database transaction guarantees","How ACID protects related updates within a transaction boundary, and how engine-specific isolation behavior affects correctness and concurrency.","A transaction is a logical unit of database work that either commits or aborts. For a transfer between accounts, the debit and credit belong inside the same transaction boundary. Begin the transaction, perform both changes, and commit only after the whole operation succeeds. With autocommit enabled, separate statements normally commit separately unless you explicitly group them.",{"slug":2123,"title":2124,"focus":2125,"teaser":2126},"database-scaling-read-and-write-workloads-saa-c03","Database: scaling read and write workloads","How indexing, caching, read replicas, and sharding relieve different database bottlenecks, with trade-offs for consistency and transaction boundaries.","A slow database does not always need more servers. First identify whether time is spent scanning records, repeating the same reads, serving many different reads, or processing writes. Check query plans and workload measurements before choosing a scaling technique.",{"slug":2128,"title":2129,"focus":2130,"teaser":2131},"cache-invalidation-database-cache-freshness-saa-c03","Cache Invalidation: database cache freshness","How to choose expiration and write-triggered invalidation policies based on acceptable staleness and concurrent-update risks.","A database is the source of truth; a cache holds reusable copies. Before choosing a policy, define acceptable staleness: how long the application can safely use an outdated value. A product description can often tolerate some delay. A decision that grants permission or reserves inventory may need an authoritative database check.",{"id":2133,"title":2134,"subtitle":152,"lessons":2135},224,"Determine high-performing and\u002For scalable network architectures",[2136,2141,2146,2151,2156,2161,2166,2171,2176,2181,2186,2191,2196,2201,2206],{"slug":2137,"title":2138,"focus":2139,"teaser":2140},"multi-tier-architecture-tier-placement-and-traffic-paths-saa-c03","Multi-Tier Architecture: tier placement and traffic paths","How to map application tiers to a multi-AZ network topology with load-balanced entry points, private back-end placement, and controlled inter-tier traffic.","A tier is a separately deployed part of an application, not just a folder of code. In this lesson, web servers handle presentation, application servers run business rules, and a database stores persistent data. Separate deployment lets you control access and capacity for each responsibility.",{"slug":2142,"title":2143,"focus":2144,"teaser":2145},"aws-site-to-site-vpn-sizing-vpn-capacity-saa-c03","AWS Site-to-Site VPN: sizing VPN capacity","How tunnel bandwidth limits, failover capacity, ECMP support, and connection charges determine whether to use one VPN connection or scale across several.","An AWS Site-to-Site VPN connection includes two IPsec tunnels. Each tunnel has its own bandwidth limit; the connection is not one unlimited pipe. Check the current limit for the tunnel option you plan to use rather than assuming every VPN tunnel has the same capacity.",{"slug":2147,"title":2148,"focus":2149,"teaser":2150},"aws-direct-connect-sizing-a-connection-saa-c03","AWS Direct Connect: Sizing a connection","How dedicated and hosted connections, available port speeds, utilization, and port-hour and data-transfer charges determine an appropriate connection size.","Sizing AWS Direct Connect means choosing enough bandwidth for your traffic without buying excessive unused capacity. A dedicated connection provides a physical AWS port assigned to one customer at a Direct Connect location. You request it through AWS; a carrier can still provide the path from your premises to that location.",{"slug":2152,"title":2153,"focus":2154,"teaser":2155},"hub-and-spoke-topology-spoke-reachability-saa-c03","Hub-and-Spoke Topology: spoke reachability","How spoke routes, hub routing policies, and return paths enable shared connectivity while keeping selected spokes isolated.","A hub-and-spoke topology can give application networks access to shared services without letting those applications reach one another. Here, Production and Development each attach to AWS Transit Gateway, the routing hub. Shared services occupy a third VPC, and all three VPC address ranges are nonoverlapping.",{"slug":2157,"title":2158,"focus":2159,"teaser":2160},"hub-and-spoke-topology-vs-network-peering-saa-c03","Hub-and-Spoke Topology vs Network Peering","How shared transit differs from direct peering, including why a star of AWS VPC peering connections does not provide transitive connectivity.","Network peering connects two networks directly while keeping them separate networks. With AWS VPC peering, workloads in the paired VPCs can communicate using private IP addresses. Each peering connection provides connectivity for that pair, not a shared router for other VPCs.",{"slug":2162,"title":2163,"focus":2164,"teaser":2165},"aws-transit-gateway-hub-and-spoke-routing-saa-c03","AWS Transit Gateway: hub-and-spoke routing","How attachments, route-table associations, propagation, and peering routes connect VPCs and hybrid networks, and how traffic paths affect costs.","AWS Transit Gateway is a regional routing hub. An attachment connects a network or connection to that hub: a VPC attachment connects a VPC, a VPN attachment connects a Site-to-Site VPN, and a peering attachment connects another transit gateway.",{"slug":2167,"title":2168,"focus":2169,"teaser":2170},"hub-and-spoke-topology-transit-path-trade-offs-saa-c03","Hub-and-Spoke Topology: transit-path trade-offs","How hub placement and traffic paths determine latency, throughput constraints, and the attachment, processing, and transfer costs of shared transit.","A hub-and-spoke topology lets several networks share a transit hub. Sharing simplifies connections, but performance and cost depend on the path each flow actually takes—not how tidy the topology looks.",{"slug":2172,"title":2173,"focus":2174,"teaser":2175},"active-active-architecture-multi-region-serving-topology-saa-c03","Active-Active Architecture: multi-Region serving topology","How independently operable regional stacks serve production traffic concurrently, with health-aware global routing and enough surviving capacity to absorb a Region's failure.","Active-active means multiple environments serve production traffic at the same time. For protection against a regional disruption, those environments must span Regions, not just Availability Zones. Their traffic shares do not have to be equal.",{"slug":2177,"title":2178,"focus":2179,"teaser":2180},"classless-inter-domain-routing-cidr-dividing-address-space-saa-c03","Classless Inter-Domain Routing (CIDR): dividing address space","How prefix lengths determine address counts and boundaries when dividing a parent block into aligned, nonoverlapping ranges with space reserved for expansion.","Classless Inter-Domain Routing (CIDR) describes an address block using an address and a prefix length, such as 10.20.0.0\u002F24. An IPv4 address has 32 bits. The \u002F24 prefix fixes the first 24 bits, leaving 8 bits to vary within the block.",{"slug":2182,"title":2183,"focus":2184,"teaser":2185},"ipv6-scaling-networks-with-dual-stack-saa-c03","IPv6: scaling networks with dual stack","How IPv6 address space supports network growth alongside IPv4, and why dual-stack connectivity requires IPv6-capable endpoints, routes, security rules, and AAAA records.","IPv4 uses 32-bit addresses; IPv6 uses 128-bit addresses. The much larger IPv6 address space gives growing networks room for many subnets and endpoints, reducing the need to conserve addresses through network address translation. It does not remove the need to plan prefixes, routes, and security boundaries.",{"slug":2187,"title":2188,"focus":2189,"teaser":2190},"capacity-planning-network-growth-headroom-saa-c03","Capacity Planning: network growth headroom","How to size address pools and network paths for projected traffic, scale-out, and temporary resource overlap during replacement or failover.","Network headroom is capacity deliberately left available for growth, traffic peaks, and temporary overlap. Start with address demand in each subnet, not just the VPC total. Count private IP allocations, not simply servers: network interfaces, container networking, load balancers, and interface endpoints can also consume addresses. Use the allocation behavior of the services you actually deploy.",{"slug":2192,"title":2193,"focus":2194,"teaser":2195},"aws-outposts-managed-on-premises-compute-capacity-saa-c03","AWS Outposts: managed on-premises compute capacity","How Outposts provides Region-connected AWS compute on premises, and how workload requirements, provisioned capacity, and facility costs determine its suitability.","AWS Outposts places AWS-managed infrastructure in your facility. Supported Amazon EC2 workloads run locally, using familiar AWS APIs and tools. This is useful when processing must stay close to local systems for low latency or when specified application data must remain on premises.",{"slug":2197,"title":2198,"focus":2199,"teaser":2200},"aws-local-zones-placing-application-resources-near-users-saa-c03","AWS Local Zones: placing application resources near users","How Local Zone subnets extend a parent Region's VPC to place latency-sensitive resources near users, accounting for opt-in, service availability, and dependencies on the parent Region.","AWS Local Zones place selected AWS infrastructure near a geographic area, helping applications serve nearby users with lower network latency. Place the latency-sensitive portion of an application there, rather than assuming the whole application must move.",{"slug":2202,"title":2203,"focus":2204,"teaser":2205},"content-based-routing-matching-requests-to-destinations-saa-c03","Content-Based Routing: matching requests to destinations","How host, path, and header conditions select destinations through ordered routing rules with an explicit default route.","Content-based routing selects a destination by examining attributes of a request. For HTTP applications, an Application Load Balancer can use host, path, and HTTP header conditions in its listener rules.",{"slug":2207,"title":2208,"focus":2209,"teaser":2210},"latency-based-routing-selecting-a-regional-endpoint-saa-c03","Latency-Based Routing: selecting a regional endpoint","How measured network latency guides regional endpoint selection, and how endpoint health, DNS caching, and application data paths limit the resulting performance.","Latency-based routing chooses a regional endpoint using expected network delay. It suits an application available in multiple Regions whose endpoints can serve the same application name. Its goal is better responsiveness, not equal traffic distribution or selection of the geographically closest Region.",{"id":2212,"title":2213,"subtitle":152,"lessons":2214},225,"Determine high-performing data ingestion and transformation solutions",[2215,2220,2225,2230,2235,2240,2245,2250,2255,2260,2265,2270,2275,2280,2285,2290,2295,2300,2305,2310,2315,2320,2325,2330,2335,2340,2345,2350,2355,2360,2365,2370,2375,2380,2385,2390,2395,2400,2405,2410,2415,2420,2425,2430,2435,2440,2445,2450],{"slug":2216,"title":2217,"focus":2218,"teaser":2219},"amazon-athena-sql-queries-over-amazon-s3-saa-c03","Amazon Athena: SQL queries over Amazon S3","How Athena queries S3 data through cataloged tables without loading a database, and how data layout affects query speed and scan-based costs.","Amazon Athena is a serverless query service: you submit SQL, and AWS manages the compute that executes it. For S3 queries, the source data stays in Amazon S3; you do not first load it into a database.",{"slug":2221,"title":2222,"focus":2223,"teaser":2224},"amazon-redshift-columnar-warehouse-efficiency-saa-c03","Amazon Redshift: columnar warehouse efficiency","How columnar storage, compression, and parallel scans make Redshift cost-effective for large analytical queries.","Amazon Redshift is a managed data warehouse for SQL analytics over large datasets. Analytical queries often calculate totals, averages, or grouped results across many rows while using only a few columns. Redshift's columnar storage makes that access pattern efficient.",{"slug":2226,"title":2227,"focus":2228,"teaser":2229},"amazon-athena-vs-amazon-redshift-choosing-a-sql-analytics-service-saa-c03","Amazon Athena vs Amazon Redshift: choosing a SQL analytics service","When direct, ad hoc SQL analysis of S3 data favors Athena over Redshift's warehouse-oriented analytics, including their overlapping data lake capabilities.","Amazon Athena is a serverless query service for running SQL directly against data in Amazon S3. It is a natural starting point for ad hoc analysis: questions asked as needed, such as investigating an unexpected change in application logs. You define tables describing the files and their locations, grant access, and query without first loading the data into a warehouse.",{"slug":2231,"title":2232,"focus":2233,"teaser":2234},"amazon-timestream-vs-amazon-redshift-time-series-database-or-analytical-warehouse-saa-c03","Amazon Timestream vs Amazon Redshift: time-series database or analytical warehouse","When timestamp-centered telemetry workloads favor Timestream rather than Redshift's columnar warehouse for cost-effective analytics.","Time-series telemetry records how something changes over time. A temperature reading, for example, has a timestamp, a measured value, and identifying attributes such as device and location. Queries often select a time window, filter a device group, and calculate an average, peak, or trend.",{"slug":2236,"title":2237,"focus":2238,"teaser":2239},"amazon-quicksight-interactive-business-dashboards-saa-c03","Amazon QuickSight: interactive business dashboards","How QuickSight turns connected datasets into interactive, shared dashboards, with SPICE or direct query determining performance and data freshness.","Amazon QuickSight is a managed business intelligence service for exploring data and sharing interactive dashboards. An author connects a data source, creates a dataset, and prepares fields, data types, and calculations for reporting.",{"slug":2241,"title":2242,"focus":2243,"teaser":2244},"amazon-managed-grafana-and-amazon-quicksight-choosing-a-visualization-service-saa-c03","Amazon Managed Grafana and Amazon QuickSight: choosing a visualization service","When to choose Grafana for operational observability dashboards rather than QuickSight for business intelligence and reporting.","Amazon Managed Grafana is the usual choice for operational observability: understanding the health and behavior of applications and infrastructure. Its dashboards help operators answer questions such as “When did latency increase?” and “Which service is showing errors?” AWS manages the Grafana infrastructure so teams can focus on monitoring rather than running Grafana servers.",{"slug":2246,"title":2247,"focus":2248,"teaser":2249},"batch-processing-ingestion-windows-and-frequency-saa-c03","Batch Processing: ingestion windows and frequency","How bounded input windows and ingestion frequency determine data freshness, independently of when batch transformations run.","Batch processing works on a bounded set of inputs: a set with a defined end. An input window determines which records belong to that batch. It might cover one hour of source records, yesterday's transactions, or a fixed collection of uploaded files.",{"slug":2251,"title":2252,"focus":2253,"teaser":2254},"event-streaming-continuous-ingestion-saa-c03","Event Streaming: continuous ingestion","How continuously publishing events decouples data arrival from downstream processing, with ingestion and processing rates determining data freshness.","An event records something that happened, such as a payment failing or a server reporting its status. A producer continuously publishes these records to a stream as they become available.",{"slug":2256,"title":2257,"focus":2258,"teaser":2259},"event-streaming-vs-batch-processing-saa-c03","Event Streaming vs. Batch Processing","How continuous event flows differ from bounded batches when choosing an ingestion pattern for freshness requirements and processing overhead.","Event streaming treats incoming events as a continuous flow. Producers publish records as events occur, and consumers process the flow without waiting for the entire input to be complete. The source can keep producing events indefinitely.",{"slug":2261,"title":2262,"focus":2263,"teaser":2264},"change-data-capture-vs-batch-processing-saa-c03","Change Data Capture vs. Batch Processing","Why CDC determines which changes are captured while batch processing determines how records are grouped for processing, so CDC can feed either streaming or batch pipelines.","Change Data Capture (CDC) identifies changes made to source data, such as inserts, updates, and deletes. It answers: Which source changes are captured for downstream use? A pipeline can capture changes to selected tables rather than repeatedly extracting every row.",{"slug":2266,"title":2267,"focus":2268,"teaser":2269},"incremental-loading-checkpointed-ingestion-saa-c03","Incremental Loading: checkpointed ingestion","How durable change boundaries let successive ingestion runs process only new or changed data without gaps or duplicate effects when batches are retried.","Incremental loading processes changes instead of repeatedly loading the complete source. A pipeline commonly begins with a full load, then processes new rows, updates, or deletion events in later batches. Running hourly or nightly still counts as incremental loading; it does not require streaming.",{"slug":2271,"title":2272,"focus":2273,"teaser":2274},"aws-snow-family-offline-imports-into-amazon-s3-saa-c03","AWS Snow Family: offline imports into Amazon S3","How device sizing, local copying, return shipment, and S3 ingestion determine an offline migration's duration and cost.","An offline import moves data onto a physical Snow device at your site, then ships that device to AWS for import into Amazon S3. Copying finishes before the data reaches S3: delivery, local preparation, return shipment, and AWS ingestion all contribute to the schedule. Confirm current device availability, customer eligibility, and lifecycle restrictions before committing to a migration plan.",{"slug":2276,"title":2277,"focus":2278,"teaser":2279},"aws-snow-family-vs-aws-datasync-offline-shipping-or-online-transfer-saa-c03","AWS Snow Family vs AWS DataSync: offline shipping or online transfer","When physical device shipment is more suitable and economical than network-based transfer, given data volume, bandwidth, deadlines, and migration frequency.","AWS DataSync moves files and objects between supported storage systems over a network, using internet connectivity or AWS Direct Connect. AWS Snow Family offline imports move the bulk data on physical devices: copy locally, return the devices, and wait for AWS to import the data into Amazon S3. Offline describes how the bulk data travels, not an absence of local networking or management work.",{"slug":2281,"title":2282,"focus":2283,"teaser":2284},"extract-transform-load-transformation-processing-models-saa-c03","Extract, Transform, Load: transformation processing models","How data volume, transformation complexity, and freshness requirements guide the choice of batch, streaming, or event-driven transformation services.","Extract, Transform, Load (ETL) reads source data, prepares it, and writes the prepared results to a destination. Transformation includes cleaning values, standardizing formats, joining datasets, and calculating summaries. These responsibilities can run in a scheduled job, a continuously running processor, or code invoked by an event.",{"slug":2286,"title":2287,"focus":2288,"teaser":2289},"aws-glue-serverless-etl-jobs-saa-c03","AWS Glue: serverless ETL jobs","How Glue ETL jobs read cataloged data, apply transformations, and convert source formats such as CSV into analytics-ready Parquet.","AWS Glue ETL jobs prepare data using managed compute. For a Spark ETL job, you configure processing capacity and job logic without managing a cluster of servers. A common pipeline reads CSV files, cleans their records, and writes Parquet files for analytics.",{"slug":2291,"title":2292,"focus":2293,"teaser":2294},"amazon-appflow-vs-aws-glue-saas-flows-and-etl-jobs-saa-c03","Amazon AppFlow vs AWS Glue: SaaS flows and ETL jobs","When managed SaaS transfers with built-in transformations suit Amazon AppFlow rather than the customizable data processing provided by AWS Glue ETL jobs.","Amazon AppFlow is a managed integration service for transferring data between supported SaaS applications and AWS services. You configure a flow: its connections, the data to transfer, and supported built-in transformations. When those capabilities meet the requirement, you avoid building and maintaining a custom transfer application.",{"slug":2296,"title":2297,"focus":2298,"teaser":2299},"latency-meeting-pipeline-freshness-targets-saa-c03","Latency: meeting pipeline freshness targets","How end-to-end latency budgets guide ingestion and transformation choices, including buffering delays and the capacity needed to prevent backlog at peak arrival rates.","A freshness target states how soon data must become usable. Define both ends: for this lesson, time starts when an event occurs at its source and ends when its transformed record can be read from the destination. An ingestion acknowledgment is only an intermediate milestone.",{"slug":2301,"title":2302,"focus":2303,"teaser":2304},"amazon-kinesis-data-streams-sharded-replayable-streams-saa-c03","Amazon Kinesis Data Streams: sharded, replayable streams","How partition keys, shard capacity, retention, and independent consumers shape a scalable streaming architecture with per-key ordering and replay.","Amazon Kinesis Data Streams holds a continuing sequence of records so applications can process events as they arrive. A producer writes records; a consumer reads and processes them. Reading a record does not delete it.",{"slug":2306,"title":2307,"focus":2308,"teaser":2309},"amazon-kinesis-data-firehose-buffered-delivery-streams-saa-c03","Amazon Kinesis Data Firehose: buffered delivery streams","How delivery streams accept source records and use buffering, destination integration, and retries to deliver them reliably.","Amazon Data Firehose, formerly Amazon Kinesis Data Firehose, is a managed delivery service. You create a delivery stream with a source configuration and a destination; Firehose handles buffering and delivery without a fleet of delivery workers for you to operate.",{"slug":2311,"title":2312,"focus":2313,"teaser":2314},"amazon-kinesis-data-firehose-vs-amazon-kinesis-data-streams-saa-c03","Amazon Kinesis Data Firehose vs Amazon Kinesis Data Streams","When to choose managed, buffered destination delivery rather than retained streams with replay and custom consumers.","Amazon Kinesis Data Firehose, now named Amazon Data Firehose, is for managed delivery to supported destinations such as Amazon S3. Producers send records, and Firehose handles destination delivery. Choose it when the main goal is to land incoming data without building and operating a destination-writing consumer.",{"slug":2316,"title":2317,"focus":2318,"teaser":2319},"amazon-kinesis-data-firehose-record-format-conversion-saa-c03","Amazon Kinesis Data Firehose: record format conversion","How Firehose converts JSON records to Parquet or ORC using AWS Glue schemas, with Lambda preprocessing when source records need reshaping.","Amazon Data Firehose, formerly called Amazon Kinesis Data Firehose, can convert incoming JSON records into Apache Parquet or Apache ORC before delivering them to Amazon S3. This is a built-in conversion feature, not a Lambda function you must write.",{"slug":2321,"title":2322,"focus":2323,"teaser":2324},"amazon-managed-service-for-apache-flink-stateful-stream-processing-saa-c03","Amazon Managed Service for Apache Flink: stateful stream processing","How Flink applications compute continuously over incoming events using keyed state, event-time windows, and checkpoints for consistent recovery.","Amazon Managed Service for Apache Flink runs Flink applications that continuously consume events and update results. AWS manages the underlying infrastructure; you define the processing logic, connectors, state, and time behavior.",{"slug":2326,"title":2327,"focus":2328,"teaser":2329},"amazon-managed-service-for-apache-flink-vs-amazon-kinesis-data-firehose-saa-c03","Amazon Managed Service for Apache Flink vs. Amazon Kinesis Data Firehose","When continuous, stateful stream computation requires Flink rather than Firehose's managed delivery and record transformation.","Amazon Managed Service for Apache Flink runs applications that continuously compute over streams. Choose it when a result depends on relationships between events, such as a running total, a time-windowed count, or a join between streams.",{"slug":2331,"title":2332,"focus":2333,"teaser":2334},"amazon-msk-kafka-topics-and-partitions-saa-c03","Amazon MSK: Kafka topics and partitions","How Kafka topics and partitions on Amazon MSK support scalable ingestion, partition-level ordering, and independent consumers that can replay retained records.","Amazon MSK runs managed Apache Kafka clusters. A producer uses Kafka APIs to publish records to a named topic, such as orders. A topic is a stored stream of records, not a destination that removes a record when someone reads it.",{"slug":2336,"title":2337,"focus":2338,"teaser":2339},"amazon-msk-vs-amazon-kinesis-data-streams-saa-c03","Amazon MSK vs Amazon Kinesis Data Streams","How Kafka compatibility, ecosystem requirements, and capacity management distinguish Amazon MSK from Amazon Kinesis Data Streams when choosing a streaming service.","Amazon MSK runs managed Apache Kafka. Amazon Kinesis Data Streams provides streaming through AWS-specific APIs. Both support retained records, replay, and independent consumers, so those needs alone do not distinguish them. The first useful question is whether your applications must speak Kafka.",{"slug":2341,"title":2342,"focus":2343,"teaser":2344},"amazon-kinesis-video-streams-video-ingestion-and-retrieval-saa-c03","Amazon Kinesis Video Streams: video ingestion and retrieval","How device producers send timestamped video fragments into retained streams for live playback, replay, and consumption by analytics applications.","Amazon Kinesis Video Streams receives video from device producers and makes it available to playback and analytics applications. A producer sends encoded media as timestamped fragments: chunks of media that the service can index and retrieve. With retention enabled, consumers can read stored video as well as follow incoming video.",{"slug":2346,"title":2347,"focus":2348,"teaser":2349},"amazon-kinesis-video-streams-vs-amazon-kinesis-data-streams-saa-c03","Amazon Kinesis Video Streams vs Amazon Kinesis Data Streams","When media-aware video ingestion and retrieval require Kinesis Video Streams rather than the general-purpose record streaming of Kinesis Data Streams.","Amazon Kinesis Video Streams is designed to ingest and retrieve time-based media. Choose it when applications need video from devices, access to retained footage, or media playback. It handles video as timestamped media fragments rather than unrelated application records.",{"slug":2351,"title":2352,"focus":2353,"teaser":2354},"data-lakes-a-governed-lake-architecture-saa-c03","Data Lakes: a governed lake architecture","How raw-to-curated dataset zones on Amazon S3 connect ingestion and transformation to cataloged, encrypted, access-controlled analytics.","A data lake separates durable storage from the compute that processes it. Amazon S3 stores objects such as database exports, JSON events, and images; processing and query services use those objects without moving everything into one database first.",{"slug":2356,"title":2357,"focus":2358,"teaser":2359},"schema-on-read-applying-schemas-during-format-conversion-saa-c03","Schema on Read: applying schemas during format conversion","How explicit read-time schemas interpret CSV fields, handle incompatible values, and establish typed records for Parquet output.","Schema on read means applying a structure when a job reads stored data. A CSV file contains text fields, not built-in integer or decimal types. An explicit schema tells the reader which columns to produce and how to interpret their values, rather than relying on type inference.",{"slug":2361,"title":2362,"focus":2363,"teaser":2364},"message-ordering-preserving-per-entity-sequence-in-streams-saa-c03","Message Ordering: preserving per-entity sequence in streams","How partition keys, producer sequencing, and consumer processing preserve each entity’s event order through retries while allowing parallelism across entities.","Per-entity ordering means preserving the sequence for one order, account, or device—not forcing every event into one global sequence. An order-created event must precede cancellation for that order; unrelated orders can progress independently.",{"slug":2366,"title":2367,"focus":2368,"teaser":2369},"checkpointing-recoverable-progress-in-streaming-pipelines-saa-c03","Checkpointing: recoverable progress in streaming pipelines","How durable checkpoints coordinate source positions, saved state, and output writes to support recovery, including retention requirements, duplicate-processing risks, and the trade-off between checkpoint overhead and repeated work.","A checkpoint records enough progress to resume a stream consumer after failure. For stateful processing, it must keep source positions consistent with saved state, such as running totals. Saving a later position with an earlier total would skip updates during recovery. Partitioned streams need positions for each partition; in Kinesis Data Streams, these are tracked per shard.",{"slug":2371,"title":2372,"focus":2373,"teaser":2374},"data-integrity-verifying-transferred-data-saa-c03","Data Integrity: verifying transferred data","How trusted checksums and transfer manifests verify that destination data matches the source and reveal missing, truncated, or altered content.","A successful transfer message does not, by itself, prove that the stored destination data matches the source. A checksum is a value calculated from data bytes. Calculate it at the source, then independently calculate it from the destination data using the same algorithm. Different values mean the compared content differs.",{"slug":2376,"title":2377,"focus":2378,"teaser":2379},"incremental-transfer-change-based-synchronization-saa-c03","Incremental Transfer: change-based synchronization","How change detection, transfer granularity, and durable progress tracking keep a destination current without repeatedly copying the full dataset.","Incremental transfer starts with a baseline: an initial copy of the data you need. Later transfers move new or changed data instead of repeatedly copying everything. A recurring full transfer, by contrast, includes unchanged data again.",{"slug":2381,"title":2382,"focus":2383,"teaser":2384},"parallel-processing-partitioning-and-concurrency-for-data-transfer-saa-c03","Parallel Processing: partitioning and concurrency for data transfer","How independent transfer partitions and bounded concurrency improve throughput without exceeding source, network, or destination capacity.","Parallel processing transfers independent pieces of data at the same time. A partition is one piece of work, such as a file, a group of files, or a database key range. The partitions should cover the intended dataset without accidental gaps or overlaps, and each must be transferable without waiting for another partition to finish.",{"slug":2386,"title":2387,"focus":2388,"teaser":2389},"aws-datasync-transfer-cost-controls-saa-c03","AWS DataSync: transfer cost controls","How task modes, incremental transfers, and associated storage and network charges determine the cost of initial and recurring transfers.","AWS DataSync charges for moving data, but its service fee is only one part of a transfer's total cost. Start by checking which task mode supports your source and destination, then estimate that mode's charges using current AWS pricing.",{"slug":2391,"title":2392,"focus":2393,"teaser":2394},"amazon-managed-grafana-data-source-backed-dashboards-saa-c03","Amazon Managed Grafana: data source-backed dashboards","How Grafana dashboards query connected data sources to visualize operational data without ingesting or storing the underlying data.","Amazon Managed Grafana provides managed Grafana workspaces for visualizing operational data. A dashboard contains panels such as time-series charts, gauges, and tables. Each panel uses queries to retrieve data from a connected data source.",{"slug":2396,"title":2397,"focus":2398,"teaser":2399},"in-memory-caching-reusing-dashboard-query-results-saa-c03","In-Memory Caching: reusing dashboard query results","How cache-aside serves repeated dashboard queries from memory, with cache keys and expiration controlling result reuse and freshness.","A dashboard may request the same sales total many times. In-memory caching keeps a reusable query result in RAM, so later requests can avoid running the database query again. Here, a dashboard application on Amazon EC2 uses Amazon ElastiCache as a shared cache and Amazon RDS as its authoritative data source.",{"slug":2401,"title":2402,"focus":2403,"teaser":2404},"precomputation-materialized-dashboard-aggregates-saa-c03","Precomputation: materialized dashboard aggregates","How preparing reusable aggregates before dashboard queries reduces interactive processing, with refresh timing and reuse determining freshness and total cost.","A sales dashboard may repeatedly calculate the same daily regional totals from detailed transactions. With query-time aggregation, each query performs that grouping and calculation. With precomputation, a refresh job calculates the totals ahead of demand and stores them for repeated use. These stored results are materialized aggregates; saving a query definition alone does not store its results.",{"slug":2406,"title":2407,"focus":2408,"teaser":2409},"in-memory-caching-and-precomputation-reuse-versus-advance-calculation-saa-c03","In-Memory Caching and Precomputation: reuse versus advance calculation","How retaining results for reuse differs from calculating results before they are requested, and why dashboard architectures can use either or both.","In-memory caching retains values in RAM so later requests can reuse them. For a dashboard, retaining a calculated sales total can avoid repeating the same database query or calculation. Caching answers: Can we reuse a result we already have?",{"slug":2411,"title":2412,"focus":2413,"teaser":2414},"row-level-security-viewer-specific-access-in-shared-dashboards-saa-c03","Row-Level Security: viewer-specific access in shared dashboards","How trusted viewer identities and entitlement rules restrict dashboard records and aggregations, including where enforcement must occur for shared connections and imported datasets.","Row-level security (RLS) controls which records a viewer may access. Sharing a dashboard grants access to the dashboard; RLS determines which rows contribute to that viewer's results. Two managers can open the same sales dashboard and see different records and totals.",{"slug":2416,"title":2417,"focus":2418,"teaser":2419},"distributed-processing-workload-execution-models-saa-c03","Distributed Processing: workload execution models","How task independence, cross-worker data exchange, and coordination requirements determine whether a workload needs a distributed processing framework, batch workers, or event-driven functions.","Distributed processing splits work across networked machines. Before choosing compute, ask whether each task can finish using only its own input. Resizing separate images is independent work: one task does not need another task’s intermediate result. Many workers can increase throughput without exchanging data with each other.",{"slug":2421,"title":2422,"focus":2423,"teaser":2424},"batching-batch-size-and-buffering-intervals-saa-c03","Batching: batch size and buffering intervals","How size and time thresholds group records into ingestion requests or larger storage objects to reduce overhead and cost while meeting throughput and latency requirements.","Batching collects several records before sending or processing them together. Each request has overhead, such as connection handling, authentication, and response processing. Sharing that overhead across records can improve throughput and reduce cost per record, at the expense of some waiting.",{"slug":2426,"title":2427,"focus":2428,"teaser":2429},"data-partitioning-choosing-partition-keys-and-granularity-saa-c03","Data Partitioning: choosing partition keys and granularity","How access patterns and data volume guide partition keys and boundaries that enable selective reads and balanced ingestion without excessive small partitions.","A partition key determines which subset receives each record. Start with frequent query filters, not the field with the most distinct values. If reports usually read events for a particular date, event_date is a useful candidate. If they also consistently filter by region, region may be worth adding—but only if each resulting group contains enough data.",{"slug":2431,"title":2432,"focus":2433,"teaser":2434},"backpressure-controlling-flow-through-streaming-pipelines-saa-c03","Backpressure: controlling flow through streaming pipelines","How downstream capacity governs upstream consumption to prevent overload, including where durable streams interrupt feedback and accumulate lag instead.","Backpressure is feedback that makes upstream activity respond to downstream capacity. If a destination cannot keep up, its consumer reduces concurrent work, delays new requests, or pauses reading. The aim is to protect the pipeline from overload, not to process every arrival immediately.",{"slug":2436,"title":2437,"focus":2438,"teaser":2439},"comma-separated-values-parsing-records-into-a-typed-dataset-saa-c03","Comma-Separated Values: parsing records into a typed dataset","How explicit CSV parsing and schema rules preserve field boundaries, identifiers, dates, and missing values when preparing records for format conversion.","CSV parsing recovers field boundaries from text. Agree on the character encoding, delimiter, quote character, escape convention, and whether a header is present. Decode using the agreed encoding, such as UTF-8, rather than relying on reader defaults.",{"slug":2441,"title":2442,"focus":2443,"teaser":2444},"apache-parquet-columnar-file-layout-saa-c03","Apache Parquet: columnar file layout","How writing typed data into Parquet row groups enables readers to select columns and use metadata to skip irrelevant data.","Apache Parquet is a file format, not a database or query engine. A writer takes records with a schema, which describes fields and their types, and writes their values into a structured file. For example, an event date should be represented as a date and an amount as an appropriate numeric type.",{"slug":2446,"title":2447,"focus":2448,"teaser":2449},"apache-parquet-vs-comma-separated-values-saa-c03","Apache Parquet vs. Comma-Separated Values","Why CSV suits flat-text interchange while Parquet suits selective analytical reads, and why conversion requires interpreting field types rather than changing a file extension.","Comma-Separated Values (CSV) represents flat tables as text records with comma-separated fields. Many spreadsheets, databases, and libraries can exchange it, and people can inspect it with a text editor. This makes CSV useful when a receiving system needs flat-text interchange. Producers and consumers still need to agree on how to interpret the fields.",{"slug":2451,"title":2452,"focus":2453,"teaser":2454},"data-compression-vs-columnar-storage-saa-c03","Data Compression vs. Columnar Storage","Why reducing encoded bytes differs from organizing data by column, and why converting CSV to Parquet is not simply compressing a file.","Data compression reduces the bytes needed to represent information. For structured records, lossless compression preserves the original data exactly: decompressing a gzip-compressed CSV file restores its original CSV bytes. Compression effectiveness depends on the input; a smaller result is not guaranteed for every file.",{"id":2456,"title":2457,"subtitle":152,"subcategories":2458},57,"Design Cost-Optimized Architectures",[2459,2528,2672,2756],{"id":2460,"title":2461,"subtitle":152,"lessons":2462},229,"Design cost-optimized network architectures",[2463,2468,2473,2478,2483,2488,2493,2498,2503,2508,2513,2518,2523],{"slug":2464,"title":2465,"focus":2466,"teaser":2467},"network-address-translation-gateway-and-instance-cost-trade-offs-saa-c03","Network Address Translation: gateway and instance cost trade-offs","How to compare the total cost of NAT gateways and NAT instances for a workload, accounting for traffic volume, zonal placement, capacity requirements, and operational responsibility.","A NAT gateway is managed by AWS; a NAT instance is an EC2 instance that you configure to perform translation. Both can provide outbound IPv4 access for private workloads. Compare them over the same period, for the same traffic and availability requirements—not just by their advertised hourly prices.",{"slug":2469,"title":2470,"focus":2471,"teaser":2472},"leased-lines-the-economics-of-cloud-connectivity-saa-c03","Leased Lines: the economics of cloud connectivity","How committed capacity, utilization, and the full cost of a resilient carrier-to-cloud path determine when a leased line is economical.","A leased line is a carrier circuit with contracted capacity and service terms. Its recurring rental pays for the circuit to be available, even when it carries no traffic. Committed capacity does not necessarily mean every fiber or carrier device is exclusive to you.",{"slug":2474,"title":2475,"focus":2476,"teaser":2477},"virtual-private-networks-capacity-and-operating-costs-saa-c03","Virtual Private Networks: capacity and operating costs","How transport dependence, tunnel capacity, and connection and data-transfer charges determine the cost-effectiveness of VPN connectivity.","A VPN tunnel carries protected traffic across an underlying network; it does not create extra bandwidth. For an internet-based VPN, available capacity depends on the internet access links and the path between the endpoints. Congestion, packet loss, and latency can reduce application performance even while the tunnel remains connected.",{"slug":2479,"title":2480,"focus":2481,"teaser":2482},"network-peering-cost-effective-direct-connectivity-saa-c03","Network Peering: cost-effective direct connectivity","How address compatibility, non-transitive routing, mesh growth, and data-transfer charges determine when direct VPC peering is a cost-effective design.","VPC peering connects two VPCs so their workloads can communicate using private IP addresses. It preserves their separate administration and can connect VPCs across accounts or Regions. It supplies network connectivity, not automatic permission to use an application.",{"slug":2484,"title":2485,"focus":2486,"teaser":2487},"dns-name-resolution-for-cloud-endpoints-saa-c03","DNS: name resolution for cloud endpoints","How DNS resolves stable public and private names to cloud endpoints, and how caching and TTL choices affect query volume, cost, and endpoint changes.","DNS separates a resource's name from its network address. For https:\u002F\u002Fapp.example.com\u002Forders, DNS resolves app.example.com, not the HTTPS scheme or the path. The application then connects to an address from the answer.",{"slug":2489,"title":2490,"focus":2491,"teaser":2492},"longest-prefix-match-specificity-versus-route-source-priority-saa-c03","Longest Prefix Match: specificity versus route-source priority","How more-specific learned routes can steer traffic away from broader static routes onto differently priced paths, while platform-specific route-source priorities resolve identical-prefix ties.","Longest prefix match selects the most specific destination prefix that matches a packet's destination IP address. The number after the slash counts the leading bits that must match. A matching \u002F24 describes a smaller address range than a matching \u002F16, so the \u002F24 wins.",{"slug":2494,"title":2495,"focus":2496,"teaser":2497},"aws-global-accelerator-understanding-traffic-costs-saa-c03","AWS Global Accelerator: understanding traffic costs","How accelerator-hour charges, data transfer premiums, and endpoint transfer charges affect the cost of accelerated paths compared with direct internet access.","AWS Global Accelerator adds a paid acceleration layer to an application's network path. To estimate its traffic cost, separate three items: accelerator-hour charges, the data transfer premium, and the endpoint's applicable data transfer charges.",{"slug":2499,"title":2500,"focus":2501,"teaser":2502},"time-to-live-expiration-semantics-saa-c03","Time to Live: expiration semantics","How duration-based and timestamp-based TTLs define expiration, distinguishing the end of permitted reuse in DNS and other caches from eviction or physical deletion.","Time to Live (TTL) defines a lifetime, but a TTL value is meaningful only when you know what expires and how its deadline is calculated. In a cache, expiration normally ends permission to reuse an entry as fresh, without checking its source. It does not necessarily remove the stored bytes.",{"slug":2504,"title":2505,"focus":2506,"teaser":2507},"right-sizing-throughput-capacity-saa-c03","Right-Sizing: throughput capacity","How peak data rates, processing deadlines, and bottlenecks determine sufficient ingestion throughput and network bandwidth.","Throughput is the amount of work completed per second. For ingestion, measure both bytes per second and records per second over representative busy periods. An acceptable daily average can hide a short peak that causes throttling. Record size and uneven traffic across partitions can also limit ingestion.",{"slug":2509,"title":2510,"focus":2511,"teaser":2512},"token-bucket-sustained-rates-and-burst-capacity-saa-c03","Token Bucket: sustained rates and burst capacity","How token consumption, refill rate, and bucket capacity control admitted traffic to protect downstream resources while allowing short bursts.","A token bucket controls how much work reaches a downstream resource. It holds a limited supply of tokens, and each admitted request consumes tokens. Tokens are accounting units, not authentication credentials. In this lesson, each request costs one token.",{"slug":2514,"title":2515,"focus":2516,"teaser":2517},"traffic-shaping-pacing-traffic-through-egress-queues-saa-c03","Traffic Shaping: pacing traffic through egress queues","How buffering and paced packet release smooth bulk transfers over constrained links, and how queue limits affect latency and packet loss.","Traffic shaping controls when packets leave an interface. When a bulk sender produces packets faster than the permitted departure rate, an egress queue temporarily holds them. Releasing those packets over time smooths the burst before it reaches a constrained link. Shaping changes departure timing; it does not increase the link’s capacity.",{"slug":2519,"title":2520,"focus":2521,"teaser":2522},"traffic-shaping-vs-rate-limiting-saa-c03","Traffic Shaping vs. Rate Limiting","How delaying packets in a shaping queue differs from rejecting excess requests through admission-rate controls.","Traffic shaping controls when packets leave a queue. If a packet cannot be transmitted yet under the shaping policy, the shaper buffers it and releases it later. This smooths departures rather than passing every arriving burst straight through.",{"slug":2524,"title":2525,"focus":2526,"teaser":2527},"equal-cost-multipath-routing-aggregate-bandwidth-across-vpn-paths-saa-c03","Equal-Cost Multipath Routing: aggregate bandwidth across VPN paths","How eligible VPN paths share flows, and why single-flow limits and failure headroom constrain bandwidth sizing.","Equal-Cost Multipath Routing (ECMP) forwards traffic across multiple equally preferred routes to the same destination prefix. Here, cost means routing preference, not connection price. Routes need compatible routing attributes; two working tunnels do not automatically qualify.",{"id":2529,"title":2530,"subtitle":152,"lessons":2531},226,"Design cost-optimized storage solutions",[2532,2537,2542,2547,2552,2557,2562,2567,2572,2577,2582,2587,2592,2597,2602,2607,2612,2617,2622,2627,2632,2637,2642,2647,2652,2657,2662,2667],{"slug":2533,"title":2534,"focus":2535,"teaser":2536},"amazon-s3-request-billing-controls-saa-c03","Amazon S3: request billing controls","How upload granularity and Requester Pays change the number of billable requests and who pays for access.","Upload granularity means how much data you put in each object. Uploading 100 small files as separate objects with one PutObject request each makes 100 PUT requests. Combining those files into one archive and uploading it with one PutObject makes one PUT request, assuming no retries.",{"slug":2538,"title":2539,"focus":2540,"teaser":2541},"aws-organizations-consolidated-billing-saa-c03","AWS Organizations: consolidated billing","How the management account pays consolidated member-account charges while preserving account-level cost visibility and enabling eligible volume discounts and commitment-discount sharing.","Consolidated billing in AWS Organizations makes the management account responsible for paying the organization's consolidated AWS charges, including charges incurred by member accounts. It is available with both the consolidated-billing-only and all-features options.",{"slug":2543,"title":2544,"focus":2545,"teaser":2546},"aws-billing-and-cost-management-cost-allocation-saa-c03","AWS Billing and Cost Management: cost allocation","How linked-account charges and activated cost allocation tags attribute consolidated AWS spending to workloads and owners.","Cost allocation connects AWS spending to the workloads and people responsible for it. With AWS Organizations consolidated billing, the management account pays the charges for the organization's member accounts. Consolidation brings charges together without removing their account attribution.",{"slug":2548,"title":2549,"focus":2550,"teaser":2551},"cost-allocation-vs-resource-tagging-saa-c03","Cost Allocation vs. Resource Tagging","Why resource metadata alone does not establish billing attribution, and why cost allocation also includes expenses that resource tags cannot identify.","Resource tagging describes resources using key-value metadata, such as Application=Payments. Cost allocation assigns expenses to products, teams, or other business owners. A tag can supply evidence for that assignment, but describing a resource and attributing its costs are different jobs.",{"slug":2553,"title":2554,"focus":2555,"teaser":2556},"cost-allocation-account-based-and-shared-cost-attribution-saa-c03","Cost Allocation: account-based and shared cost attribution","How to attribute consolidated charges using linked accounts and explicit shared-cost rules, with consistent cost measures and an unallocated category that keeps totals reconciled.","Cost allocation decides which team, product, or department owns a cost. With AWS Organizations consolidated billing, the management account is responsible for paying member-account charges. That payment responsibility does not make every expense a management-team expense.",{"slug":2558,"title":2559,"focus":2560,"teaser":2561},"resource-tagging-cost-allocation-tags-saa-c03","Resource Tagging: cost allocation tags","How consistent resource tags become billing dimensions through cost allocation activation, including management-account ownership, processing delays, and limits on charge coverage.","A cost allocation tag lets you organize eligible AWS charges by a business label, such as department or cost center. Start with a resource tag: a key such as CostCenter and a value such as CC104. The key becomes a billing dimension after activation and processing; its values identify the categories within that dimension.",{"slug":2563,"title":2564,"focus":2565,"teaser":2566},"cost-allocation-tag-based-billing-dimensions-saa-c03","Cost Allocation: tag-based billing dimensions","How activating user-defined and AWS-generated cost allocation tags enables application and team cost reporting, including processing delays and gaps in tag coverage.","Cost allocation tags let you group applicable costs by a tag key and its values. For application and team reporting, choose user-defined keys such as Application and Team. Consistent values let an application’s supported compute, database, and storage costs appear under the same application name.",{"slug":2568,"title":2569,"focus":2570,"teaser":2571},"aws-cost-explorer-cost-and-usage-reports-saa-c03","AWS Cost Explorer: Cost and usage reports","How cost metrics, time granularity, filters, and grouping reveal spending patterns across services, accounts, Regions, and allocation tags.","AWS Cost Explorer provides interactive reports of historical cost and usage. A useful report starts with a question: did spending grow, which service contributed, or which team owns the cost? The cost metric determines what the money shown in the chart means.",{"slug":2573,"title":2574,"focus":2575,"teaser":2576},"aws-cost-explorer-spending-forecasts-saa-c03","AWS Cost Explorer: Spending forecasts","How historical spending produces forecasts, how to interpret prediction intervals, and when changing workloads make projections less reliable.","AWS Cost Explorer forecasts future spending from historical cost and usage data. Its forecasting models use patterns in that history to estimate what spending could look like ahead. A forecast is therefore a projection, not a bill already incurred or a spending limit.",{"slug":2578,"title":2579,"focus":2580,"teaser":2581},"aws-budgets-defining-budget-targets-and-scope-saa-c03","AWS Budgets: defining budget targets and scope","How budget types, periods, amounts, and filters define the costs or usage AWS Budgets monitors.","AWS Budgets monitors a defined measure against a target. A useful budget definition answers four questions: what to measure, over which period, against what amount, and for which portion of your AWS activity. Start with the budget type, because it determines the meaning and units of the target.",{"slug":2583,"title":2584,"focus":2585,"teaser":2586},"aws-budgets-threshold-alerts-and-actions-saa-c03","AWS Budgets: threshold alerts and actions","How actual and forecasted thresholds trigger notifications or budget actions, and why these controls are not a real-time spending cap.","AWS Budgets compares monitored costs with configured thresholds. An actual threshold checks costs already recorded for the budget period. A forecasted threshold checks the estimated total cost by the end of that period, based on available spending history.",{"slug":2588,"title":2589,"focus":2590,"teaser":2591},"aws-budgets-vs-aws-cost-explorer-saa-c03","AWS Budgets vs AWS Cost Explorer","When to choose AWS Budgets for monitoring spending against targets rather than AWS Cost Explorer for analyzing spending patterns.","AWS Budgets monitors spending against a target you define. Choose it for questions such as “Are we staying within our monthly spending target?” or “Can the owner be notified when spending crosses a budget threshold?” The target gives the monitoring a financial reference point.",{"slug":2593,"title":2594,"focus":2595,"teaser":2596},"aws-cost-and-usage-report-configuring-report-exports-saa-c03","AWS Cost and Usage Report: configuring report exports","How report granularity, resource IDs, file format, and S3 delivery settings determine the billing data available for analysis.","The AWS Cost and Usage Report (CUR) exports detailed billing and usage data to Amazon S3. Its settings determine which details your analysis can use later. Start with two independent choices: time granularity and resource IDs.",{"slug":2598,"title":2599,"focus":2600,"teaser":2601},"aws-cost-and-usage-report-analyzing-cost-and-usage-line-items-saa-c03","AWS Cost and Usage Report: analyzing cost and usage line items","How to interpret and aggregate report line items by service, usage type, resource, and account to explain detailed charges.","The AWS Cost and Usage Report (CUR) contains detailed billing records called line items. A row describes a charge, usage, or adjustment for a particular interval and set of billing attributes. One resource can appear in many rows, so counting rows does not tell you how many resources exist.",{"slug":2603,"title":2604,"focus":2605,"teaser":2606},"aws-cost-and-usage-report-vs-aws-cost-explorer-saa-c03","AWS Cost and Usage Report vs AWS Cost Explorer","When detailed billing exports for custom analysis are appropriate instead of Cost Explorer's interactive cost views, and why neither tool depends on the other's exports.","AWS Cost Explorer provides interactive views of AWS costs and usage. Use it to explore spending, compare periods, and identify which services or accounts contributed to a change. You can adjust the view without first building a billing-data analysis system.",{"slug":2608,"title":2609,"focus":2610,"teaser":2611},"storage-tiering-tier-selection-and-total-cost-saa-c03","Storage Tiering: tier selection and total cost","How access frequency, retrieval deadlines, resilience requirements, and tier-specific charges determine an appropriate storage tier.","Storage tiering matches data to a storage class whose access behavior and charges suit the workload. Start with two separate questions: how often will the data be read, and how quickly must it be available when requested? Rarely read data can still have an urgent retrieval deadline.",{"slug":2613,"title":2614,"focus":2615,"teaser":2616},"data-archiving-archive-lifecycles-saa-c03","Data Archiving: archive lifecycles","How archive lifecycles move inactive data into lower-cost storage while preserving its context and retrievability until retention rules permit deletion.","An archive lifecycle defines what happens to information after routine use ends. First identify the data's owner, required retention period, and acceptable retrieval time. These determine when it can move to cheaper storage and when deletion is permitted. Inactive does not mean disposable.",{"slug":2618,"title":2619,"focus":2620,"teaser":2621},"storage-tiering-vs-data-archiving-saa-c03","Storage Tiering vs. Data Archiving","How optimizing data placement differs from preserving inactive data for long-term use, and why archiving can use tiering without being equivalent to it.","Storage tiering asks, “Where should this data live to meet its access needs economically?” It matches data to storage classes based on how often it is accessed and how quickly it must be available. Tiering can apply to active application data as well as inactive records.",{"slug":2623,"title":2624,"focus":2625,"teaser":2626},"storage-tiering-automated-tier-transitions-saa-c03","Storage Tiering: automated tier transitions","How age-based lifecycle rules and access-aware tiering automate data placement, including S3 rule filters, transition restrictions, and noncurrent versions.","S3 Lifecycle automates storage-class changes using rules you configure. An age-based transition happens when an eligible object reaches a specified age, even if someone read it yesterday. Reading an object does not restart its lifecycle clock.",{"slug":2628,"title":2629,"focus":2630,"teaser":2631},"random-i-o-and-sequential-i-o-distinguishing-access-patterns-saa-c03","Random I\u002FO and Sequential I\u002FO: distinguishing access patterns","How nonconsecutive and consecutive storage access differ independently of access frequency or predictability.","Sequential I\u002FO reads or writes consecutive logical storage locations: each request continues where the previous request ended. Random I\u002FO reads or writes nonconsecutive locations, jumping between separated parts of the address space. Both terms describe access order, and both apply to reads and writes.",{"slug":2633,"title":2634,"focus":2635,"teaser":2636},"random-i-o-sizing-storage-for-scattered-access-saa-c03","Random I\u002FO: sizing storage for scattered access","How request size, IOPS, and latency determine the storage performance and cost needed for scattered reads and writes.","For scattered reads and writes, storage capacity alone does not tell you whether an application will run well. Request size is the amount transferred by one operation. IOPS counts input\u002Foutput operations per second, while throughput measures the data transferred per second. Small requests can consume many IOPS without moving much data.",{"slug":2638,"title":2639,"focus":2640,"teaser":2641},"sequential-i-o-throughput-oriented-storage-selection-saa-c03","Sequential I\u002FO: throughput-oriented storage selection","How request size, sustained throughput limits, and access frequency guide cost-effective storage choices for large sequential transfers.","For a large sequential transfer, the main goal is usually throughput: how much data moves each second. IOPS counts operations per second, while request size describes how much data each operation transfers. A high IOPS rating alone does not tell you how quickly a large file will finish transferring.",{"slug":2643,"title":2644,"focus":2645,"teaser":2646},"retrieval-latency-immediate-access-versus-archive-restoration-saa-c03","Retrieval Latency: immediate access versus archive restoration","How a workload’s acceptable wait determines whether data must be immediately readable or can require restoration, distinguishing retrieval delay from download time.","Retrieval latency is the wait between requesting stored data and that data becoming available to read. Define the boundary before comparing storage options: waiting for an archive restoration to finish is different from waiting for the first byte of an ordinary read request.",{"slug":2648,"title":2649,"focus":2650,"teaser":2651},"data-compression-choosing-compression-for-cloud-workloads-saa-c03","Data Compression: choosing compression for cloud workloads","How lossless codec and file-boundary choices balance reduced storage and transfer bytes against processing costs, ingestion latency, and parallel access.","Lossless compression allows the original bytes to be recovered exactly. It is the normal choice for logs, transactions, and analytical records. Repetitive text often compresses well; encrypted data and already compressed media usually offer little additional reduction. Compression is not encryption and provides no confidentiality.",{"slug":2653,"title":2654,"focus":2655,"teaser":2656},"right-sizing-storage-capacity-saa-c03","Right-Sizing: storage capacity","How data growth and storage performance requirements determine provisioned size without paying for unnecessary capacity.","Storage capacity is the amount of data a resource can hold. Right-sizing starts with measured space usage, not the size already allocated. Include application data, indexes, logs, and other files stored on that resource; separately stored backups need their own capacity estimate.",{"slug":2658,"title":2659,"focus":2660,"teaser":2661},"data-egress-transfer-costs-along-network-paths-saa-c03","Data Egress: transfer costs along network paths","How to compare AWS network paths by their inter-Region, cross-AZ, and internet transfer charges while accounting separately for gateway, endpoint, and acceleration fees.","Data egress means data leaving a boundary, not necessarily leaving AWS. Compare paths by recording the source, destination, direction, volume, and route. The diagram follows four independent outbound flows from one application; it omits return traffic and routing details that do not change this comparison.",{"slug":2663,"title":2664,"focus":2665,"teaser":2666},"migration-and-data-transfer-choosing-a-transfer-method-saa-c03","Migration and data transfer: choosing a transfer method","How to choose an online or offline transfer method that preserves data consistency and meets the transfer deadline at the lowest total cost.","An online transfer sends data over a network, using an existing internet connection or a dedicated connection such as AWS Direct Connect. An offline transfer moves the bulk data on physical media for import. Consider offline transfer when usable network capacity cannot move the data in time, but first confirm that a supported physical-transfer option is available for your location and account.",{"slug":2668,"title":2669,"focus":2670,"teaser":2671},"total-cost-of-ownership-comparing-storage-options-saa-c03","Total Cost of Ownership: comparing storage options","How to compare storage options over a common time horizon using equivalent workload requirements and the full costs of usage, operations, and migration.","Total Cost of Ownership (TCO) is the complete cost of a solution over an agreed evaluation period. Before estimating storage costs, give every option the same time horizon and workload assumptions: initial data volume, growth, request frequency, data retrieved, and data transferred.",{"id":2673,"title":2674,"subtitle":152,"lessons":2675},227,"Design cost-optimized compute solutions",[2676,2681,2686,2691,2696,2701,2706,2711,2716,2721,2726,2731,2736,2741,2746,2751],{"slug":2677,"title":2678,"focus":2679,"teaser":2680},"pay-as-you-go-pricing-uncommitted-compute-costs-saa-c03","Pay-as-You-Go Pricing: uncommitted compute costs","How runtime metering, billing increments, and charges for retained resources determine compute costs without a long-term commitment.","Pay-as-you-go compute lets you pay for metered usage without a long-term usage commitment. For an Amazon EC2 On-Demand instance, the starting point is the time the instance runs, not the time its application does useful work. A running instance can incur compute charges even when its CPU is idle.",{"slug":2682,"title":2683,"focus":2684,"teaser":2685},"amazon-ec2-purchasing-options-saa-c03","Amazon EC2: purchasing options","How On-Demand Instances, Reserved Instances, Spot Instances, and Savings Plans differ in commitment, interruption risk, and billing benefits.","An EC2 purchasing option changes how you pay for compute, not what your application does. On-Demand Instances let you pay for compute usage without a long-term commitment. They are useful for short-lived work, unpredictable demand, and workloads you are still measuring. You do not receive a commitment-based discount, but you avoid paying for a long-term commitment you may not use.",{"slug":2687,"title":2688,"focus":2689,"teaser":2690},"commitment-discounts-vs-pay-as-you-go-pricing-saa-c03","Commitment Discounts vs. Pay-as-You-Go Pricing","Why a no-upfront commitment still creates a term obligation, unlike On-Demand purchasing without a long-term commitment.","No Upfront describes when you pay for a commitment, not whether you have one. With a no-upfront commitment offering, you make no initial commitment payment, but you accept recurring charges over the agreed term in exchange for discounted eligible usage.",{"slug":2692,"title":2693,"focus":2694,"teaser":2695},"workload-predictability-choosing-a-safe-compute-commitment-saa-c03","Workload Predictability: choosing a safe compute commitment","How measured demand, operating schedules, and workload lifetime guide commitment coverage versus flexible purchasing, without confusing predictability with Spot interruption tolerance or guaranteed capacity.","Workload predictability is confidence in future compute requirements. Start with measured usage over representative business cycles, including quiet periods, busy periods, and seasonal changes. Amazon CloudWatch provides utilization metrics; billing and usage records help show what compute actually ran. A traffic forecast alone does not establish how much compute you need.",{"slug":2697,"title":2698,"focus":2699,"teaser":2700},"commitment-discounts-committing-to-a-predictable-usage-baseline-saa-c03","Commitment Discounts: committing to a predictable usage baseline","How Reserved Instance and Savings Plans eligibility, term obligations, and unused commitment costs determine how much predictable usage to commit.","A commitment discount is a billing benefit, not an instruction to launch resources. Before choosing how much to commit, identify which usage can receive the benefit. Predictable usage outside the agreement’s eligibility rules cannot consume that commitment.",{"slug":2702,"title":2703,"focus":2704,"teaser":2705},"savings-plans-hourly-commitments-and-compute-discounts-saa-c03","Savings Plans: hourly commitments and compute discounts","How to choose an hourly spending commitment and plan type that match stable compute usage without paying for unused discounts.","Savings Plans exchanges a spending commitment for discounted rates on eligible usage. You commit to a dollar amount per hour for a one-year or three-year term. AWS automatically applies the benefit to matching usage. This changes billing, not application performance, and does not reserve EC2 capacity.",{"slug":2707,"title":2708,"focus":2709,"teaser":2710},"edge-computing-choosing-where-computation-runs-saa-c03","Edge Computing: choosing where computation runs","How moving selected processing closer to data or users changes centralized workload demand and total cost once distributed operating overhead is included.","Edge computing runs selected computations close to where data is produced or used. The location is relative to the workload: equipment-site processing is close to sensors, while distributed cloud infrastructure can be close to web users. Edge computing is an architectural choice, not one particular service.",{"slug":2712,"title":2713,"focus":2714,"teaser":2715},"amazon-ecs-anywhere-running-tasks-on-external-instances-saa-c03","Amazon ECS Anywhere: running tasks on external instances","How ECS manages tasks on customer-owned servers through registered external instances, and how reusing hardware affects costs and operational responsibilities.","Amazon ECS Anywhere lets Amazon ECS manage containers on customer-owned servers or virtual machines outside AWS. A host registered into an ECS cluster becomes an external instance. The ECS control plane stays in AWS; application containers run on your hardware.",{"slug":2717,"title":2718,"focus":2719,"teaser":2720},"amazon-eks-anywhere-kubernetes-on-customer-owned-infrastructure-saa-c03","Amazon EKS Anywhere: Kubernetes on customer-owned infrastructure","How locally hosted control planes and worker nodes enable infrastructure reuse, and which infrastructure costs and operating responsibilities remain with you.","Amazon EKS Anywhere provides software and tools to create and operate Kubernetes clusters on customer-managed infrastructure. In an on-premises deployment, both the control plane and the worker nodes run in your environment. The control plane manages cluster state and schedules workloads; worker nodes run application Pods.",{"slug":2722,"title":2723,"focus":2724,"teaser":2725},"aws-outposts-and-amazon-ecs-anywhere-infrastructure-ownership-saa-c03","AWS Outposts and Amazon ECS Anywhere: infrastructure ownership","How AWS-managed hardware with Outposts differs from running ECS tasks on customer-managed servers with ECS Anywhere, including the resulting responsibility and cost trade-offs.","AWS Outposts places AWS infrastructure at your site. AWS supplies, manages, and maintains the Outposts hardware, which connects to a parent AWS Region. You use supported AWS services locally when workloads need to stay close to local systems or data.",{"slug":2727,"title":2728,"focus":2729,"teaser":2730},"amazon-ecs-anywhere-vs-amazon-eks-anywhere-saa-c03","Amazon ECS Anywhere vs Amazon EKS Anywhere","How AWS-hosted ECS orchestration differs from operating Kubernetes clusters with EKS Anywhere in control-plane location, operational ownership, and cost tradeoffs.","Both services let you run containers on infrastructure you manage, but they do not put orchestration in the same place. The control plane is the management layer that accepts workload definitions and decides where containers should run. The servers that execute those containers form the data plane.",{"slug":2732,"title":2733,"focus":2734,"teaser":2735},"hybrid-cloud-choosing-where-compute-runs-saa-c03","Hybrid Cloud: choosing where compute runs","How to choose between public-cloud compute and local options such as AWS Outposts, ECS Anywhere, and EKS Anywhere based on latency, data locality, existing infrastructure, and total operating cost.","Hybrid cloud connects public-cloud services with local infrastructure. Choose where each workload runs by following its users, data, and dependencies—not by assuming the whole application must run in one place.",{"slug":2737,"title":2738,"focus":2739,"teaser":2740},"virtualization-virtual-hardware-for-cloud-instances-saa-c03","Virtualization: virtual hardware for cloud instances","How hypervisors expose CPU, memory, and devices to virtual machines, and how those virtual hardware configurations affect workload performance, image compatibility, and cost efficiency.","A virtual machine (VM) runs its own guest operating system against a hardware interface supplied by a hypervisor. The guest sees processors, memory, disks, and network interfaces without needing to manage the physical server. Multiple VMs can share a server while remaining logically isolated.",{"slug":2742,"title":2743,"focus":2744,"teaser":2745},"cpu-architecture-selecting-a-processor-for-a-workload-saa-c03","CPU Architecture: selecting a processor for a workload","How software compatibility, processor capabilities, and vCPU-to-core mappings guide architecture selection using measured workload price-performance.","A processor's instruction set architecture defines the instructions software can execute. On Amazon EC2, common targets are x86-64, used by Intel and AMD processors, and Arm64, used by AWS Graviton processors. Before comparing performance, check that the entire software stack supports the target.",{"slug":2747,"title":2748,"focus":2749,"teaser":2750},"osi-model-forwarding-decisions-at-layers-3-4-and-7-saa-c03","OSI Model: forwarding decisions at Layers 3, 4, and 7","How IP routing, transport-flow distribution, and application-aware routing differ, and how those distinctions explain the roles of Gateway, Network, and Application Load Balancers.","The OSI model describes communication using seven conceptual layers. For forwarding decisions, ask which information a component uses. Layer 3 uses IP addressing; Layer 4 adds transport information such as TCP or UDP ports. These are responsibilities, not a requirement for seven separate devices.",{"slug":2752,"title":2753,"focus":2754,"teaser":2755},"high-availability-availability-targets-saa-c03","High availability: availability targets","How user-visible downtime budgets determine the availability investment justified for production and non-production workloads.","Availability means that users can successfully use the service, not merely that its servers are running. Define the important user action first: signing in, submitting an order, or retrieving a report. A working home page does not establish availability if the required transaction fails.",{"id":2757,"title":2758,"subtitle":152,"lessons":2759},228,"Design cost-optimized database solutions",[2760,2765,2770,2775,2780,2785,2790],{"slug":2761,"title":2762,"focus":2763,"teaser":2764},"oltp-versus-olap-matching-database-types-to-workloads-saa-c03","OLTP Versus OLAP: matching database types to workloads","How transactional and analytical access patterns determine cost-effective database choices, including when columnar storage or time-series specialization fits.","Online transaction processing (OLTP) serves many short operations that read or change small amounts of data. Looking up an order, reserving inventory, and recording a payment are transactional work. Predictable response times matter, and related changes may need an atomic transaction: either all changes succeed or none do.",{"slug":2766,"title":2767,"focus":2768,"teaser":2769},"columnar-storage-scan-efficient-analytical-datasets-saa-c03","Columnar Storage: scan-efficient analytical datasets","How converting row-based data into typed Parquet or ORC datasets reduces analytical reads and costs, and when those savings outweigh conversion and update overhead.","Columnar storage groups values by field. Parquet stores records in row groups, with separate column chunks inside each group; ORC uses a similar column-oriented organization. For a report that totals sales by region, a compatible reader can read region and amount without reading addresses or product descriptions.",{"slug":2771,"title":2772,"focus":2773,"teaser":2774},"time-series-data-matching-storage-to-access-patterns-saa-c03","Time-Series Data: matching storage to access patterns","How ingestion volume, time-window queries, retention, and latency requirements determine cost-effective storage for timestamped measurements.","Time-series measurements usually contain a timestamp, a measured value, and dimensions such as device or building identifiers. Storage selection starts with two questions: how quickly must observations be accepted, and how much history must remain available? A timestamp alone does not justify a specialized database.",{"slug":2776,"title":2777,"focus":2778,"teaser":2779},"time-series-data-versus-columnar-storage-saa-c03","Time-Series Data versus Columnar Storage","Why time-series describes a data access pattern while columnar storage describes a physical layout, and how both can apply to the same measurements.","Time-series data consists of observations indexed by time, such as device temperature readings. A record usually includes a timestamp, a measured value, and dimensions that identify its source, such as a device ID. Readings can arrive regularly or irregularly.",{"slug":2781,"title":2782,"focus":2783,"teaser":2784},"amazon-timestream-time-series-storage-economics-saa-c03","Amazon Timestream: time-series storage economics","How time-series access patterns and retention requirements shape costs in Timestream for InfluxDB and the existing-customer LiveAnalytics engine.","Time-series data records how something changes over time: a timestamp, a measurement, and identifying attributes such as device or location. Storage demand grows with arrival rate, record size, and retention. Query demand depends on how much history each request reads and how often requests run. A dashboard repeatedly reading recent measurements has different economics from an occasional report reading years of history.",{"slug":2786,"title":2787,"focus":2788,"teaser":2789},"aws-sct-database-schema-conversion-saa-c03","AWS SCT: Database schema conversion","How AWS SCT assesses source-to-target compatibility, converts schema objects and stored code, and identifies manual changes before applying the converted schema.","AWS Schema Conversion Tool (AWS SCT) is a desktop application that helps translate database definitions between supported database engines. Compatibility depends on the source-to-target pair: a feature that translates to one target engine may need rewriting for another. Check support for the database engines and versions before starting.",{"slug":2791,"title":2792,"focus":2793,"teaser":2794},"change-data-capture-snapshot-to-stream-replication-saa-c03","Change Data Capture: snapshot-to-stream replication","How a consistent initial snapshot and checkpointed change stream keep a target synchronized at the required freshness, including through a low-downtime migration cutover.","Change Data Capture (CDC) captures inserts, updates, and deletes so a target can follow a source database. The initial snapshot supplies existing rows; the change stream supplies what changes afterward. They must share a coordinated source position so writes made during copying are not missed.",{"id":5,"code":13,"slug":6,"dateLastDay":152,"whatChanged":152,"pageSlug":14},1793320645988]