Free AWS Developer Associate Exam Flashcards

Reserved concurrency caps and guarantees the maximum number of simultaneous executions for a function (and isolates it from other functions). Provisioned concurrency pre-initializes a set number of execution environments so they are warm and respond with no cold-start latency. Reserved controls how many can run; provisioned controls how many are already warm.

A cold start is the added latency when Lambda must create a new execution environment (download code, start the runtime, run init code) before handling an event. Reduce it with provisioned concurrency, smaller deployment packages, and by initializing SDK clients and connections outside the handler so they are reused across warm invocations.

Maximum function timeout is 900 seconds (15 minutes). Ephemeral /tmp storage is configurable from 512 MB up to 10,240 MB (10 GB). Invocation payload limit is 6 MB for synchronous calls and 256 KB for asynchronous calls. For long-running or large-data work, offload to Step Functions, ECS/Fargate, or S3.

Synchronous (RequestResponse): caller waits for the result and handles errors/retries itself (e.g., API Gateway). Asynchronous (Event): Lambda queues the event, returns immediately, retries on failure (default two retries), and can route failures to a dead-letter queue or destination. Choose async to decouple and absorb spikes; choose sync when you need the response.

Environment variables pass configuration to a function and are encrypted at rest with KMS. For sensitive values, reference Secrets Manager or SSM Parameter Store at runtime rather than baking secrets into plaintext env vars, and use a customer-managed KMS key when you need encryption-in-transit to the console and tighter access control.

A layer is a .zip archive of libraries, a custom runtime, or other dependencies that you attach to functions to share code and shrink deployment packages. A function can use up to five layers, and the total unzipped size of function plus layers must stay within the deployment package quota. Layers promote reuse and faster deploys.

REST APIs offer the full feature set: usage plans/API keys, request/response transformation, AWS WAF, caching, and edge-optimized endpoints. HTTP APIs are lower latency, lower cost, and simpler, built for Lambda and HTTP backends with JWT/OIDC auth. Choose HTTP API for cost-sensitive proxy APIs; choose REST when you need its advanced features.

API Gateway protects backends with account-level and per-method throttling using a token-bucket model (a steady rate plus a burst limit); exceeding it returns HTTP 429. Usage plans tie API keys to rate and quota limits so you can meter and tier different consumers. Throttling is about protecting capacity; usage plans are about monetizing/limiting clients.

Lambda proxy integration passes the entire raw request to the function and expects a specific JSON response shape, leaving mapping to your code. Non-proxy (custom) integration uses mapping templates (VTL) to transform requests and responses in API Gateway itself. Proxy is simpler and flexible; non-proxy lets you decouple the API contract from the backend.

API Gateway can cache endpoint responses in a dedicated cache cluster keyed by request parameters, reducing calls to the backend and improving latency. You set a TTL, and clients can bypass the cache with a Cache-Control header if authorized. Caching is enabled per stage and is billed by cache size, so it is a deliberate cost/performance trade-off.

On-demand scales automatically and bills per request, ideal for unpredictable or spiky/new workloads with no capacity planning. Provisioned sets read/write capacity units you pay for regardless of use, cheaper for steady, predictable traffic, and can use auto scaling. Pick on-demand for unknown patterns; pick provisioned (optionally with reserved capacity) for stable, high-volume traffic.

DynamoDB distributes data across partitions by hashing the partition key, so a high-cardinality, evenly-accessed key avoids hot partitions and throttling. A poor key (few values or one very popular value) concentrates traffic and causes throttling even when total capacity is sufficient. Good key design, not just more capacity, is the fix for hot keys.

Single-table design stores multiple entity types in one table, using composite keys and overloaded GSIs so related items can be fetched in one query. It minimizes round trips and avoids cross-table joins (which DynamoDB lacks), but requires modeling access patterns up front. The goal is to satisfy each access pattern with a single, efficient query.

A Global Secondary Index has its own partition/sort key and its own capacity, can be created anytime, and is eventually consistent. A Local Secondary Index shares the table's partition key with an alternate sort key, must be created at table creation, and supports strongly consistent reads. Use a GSI for new access patterns; use an LSI for alternate sorts within the same partition.

Query retrieves items by a specific partition key (optionally narrowing by sort key) and reads only matching items, so it is efficient. Scan reads every item in the table or index and then filters, consuming capacity proportional to table size. Prefer Query (or a GSI) for predictable access; treat Scan as a last resort for full-table reads.

Eventually consistent reads (default) may briefly return stale data right after a write but cost half a read capacity unit. Strongly consistent reads always reflect the latest committed write but cost a full RCU and are not available on GSIs. Choose strong consistency only when reading your own recent writes matters; eventual is cheaper and higher throughput.

DynamoDB Streams captures an ordered, time-sequenced log of item-level changes (insert/modify/remove) that you can process with Lambda or Kinesis. It enables change-data-capture patterns such as replication, aggregation, and triggering downstream workflows. Records are kept for 24 hours; you choose what the stream view includes (keys only, new image, old image, or both).

Optimistic locking adds a version attribute and uses a conditional write that succeeds only if the stored version still matches the one you read. If another client updated the item first, the condition fails and you retry with fresh data, preventing lost updates without holding locks. It is the standard way to avoid overwriting concurrent changes in DynamoDB.

S3 Standard suits frequently accessed data; Standard-IA and One Zone-IA cost less for infrequent access (One Zone trades durability across AZs); Glacier classes (Instant/Flexible/Deep Archive) are cheapest for archival with increasing retrieval times. Intelligent-Tiering moves objects automatically based on access patterns. Match the class to access frequency and retrieval-time tolerance to optimize cost.

Multipart upload splits a large object into parts uploaded in parallel and then assembled, improving throughput and resilience (failed parts retry independently). AWS recommends it for objects over 100 MB and requires it above 5 GB for a single PutObject. Configure a lifecycle rule to abort incomplete multipart uploads so abandoned parts do not accrue storage cost.

A presigned URL grants temporary, time-limited access to a specific S3 object using the signer's credentials, so clients can upload or download directly without their own AWS permissions or exposing the bucket. The URL inherits the creator's permissions and expires after a set duration. Use it for secure, direct browser uploads/downloads without proxying data through your app.

Standard queues offer nearly unlimited throughput, at-least-once delivery, and best-effort ordering (duplicates and reordering possible). FIFO queues guarantee exactly-once processing and strict ordering within a message group, with limited throughput (300 messages/second, or 3,000 with batching). Use FIFO when order or de-duplication is required; use standard for maximum scale.

When a consumer receives a message, the visibility timeout hides it from other consumers until it is deleted or the timeout expires (default 30 seconds, max 12 hours). If processing keeps failing past the maxReceiveCount, a redrive policy moves the message to a dead-letter queue for inspection. This prevents one poison message from blocking the queue.

Short polling returns immediately, sampling a subset of servers, so it can return empty responses even when messages exist and generates more (costlier) empty receives. Long polling (WaitTimeSeconds up to 20) waits for a message to arrive before responding, reducing empty receives and API costs. Long polling is the recommended default for efficient consumers.

SNS is pub/sub push: one message fans out to many subscribers (Lambda, SQS, HTTP, email). SQS is a pull-based buffer that decouples and durably stores messages for one consumer group. EventBridge is an event bus that routes events by content-based rules to many targets and integrates with SaaS and AWS services. Combine SNS+SQS (fan-out) for durable parallel delivery.

Standard workflows are durable, long-running (up to one year), exactly-once, and billed per state transition, suited to orchestration and human-in-the-loop. Express workflows are short-lived (up to five minutes), high-volume, at-least-once, and billed by execution count/duration, suited to high-throughput event processing. Choose by duration, volume, and exactly-once needs.

With the EC2 launch type you provision and manage the container host instances (more control, responsible for patching/scaling the cluster). With Fargate, AWS runs containers serverlessly with no instances to manage; you pay per task vCPU/memory. Choose EC2 for fine-grained control or specialized instances; choose Fargate to avoid managing infrastructure.

The task role grants permissions to the application code running inside the container (e.g., reading from S3 or DynamoDB). The task execution role grants the ECS agent permissions to pull images from ECR and write logs to CloudWatch on your behalf. Keep them separate so application permissions follow least privilege independent of platform plumbing.

Elastic Container Registry is a managed, private Docker/OCI image registry integrated with IAM for access control and with ECS/EKS/Lambda for image pulls. Authenticate the Docker client with a token from the ECR API/CLI before pushing or pulling. Use lifecycle policies to expire old images and image scanning to detect vulnerabilities in stored images.

A user pool is a user directory that handles sign-up, sign-in, MFA, and issues JWT tokens (authentication). An identity pool (federated identities) exchanges those tokens or third-party logins for temporary AWS credentials so users can call AWS services directly (authorization to AWS resources). Use a user pool to authenticate users; add an identity pool to grant them AWS access.

AWS SDKs automatically retry throttled or transient errors using exponential backoff with jitter, increasing the wait between attempts to avoid hammering a stressed service. You can tune the maximum retry count and timeouts. Treat HTTP 429/ProvisionedThroughputExceeded and 5xx as retryable; design idempotent operations so retries are safe.

List/Query/Scan APIs return results in pages with a continuation token (NextToken or LastEvaluatedKey); you must loop, passing the token back, until none is returned to get all results. SDK paginators automate this. Forgetting pagination is a common bug that silently returns only the first page of data.

An idempotent operation produces the same result whether executed once or many times, which is essential because SQS, async Lambda, and SDK retries can deliver or invoke more than once. Achieve it with de-duplication keys, conditional writes, or tracking processed message IDs. Without idempotency, retries cause duplicate side effects like double charges.

AppConfig (part of Systems Manager) manages and safely deploys application configuration and feature flags separately from code, with validators and gradual rollout plus automatic rollback on alarms. Applications poll for the latest configuration at runtime. It lets you change behavior or toggle features without redeploying, reducing risk compared to hard-coded config.

An IAM user is a long-term identity with credentials for a person or app; a role is an identity assumed temporarily that delivers short-lived credentials (preferred for services and cross-account access). Policies are JSON documents attached to identities or resources that allow or deny actions. Best practice: use roles and temporary credentials instead of long-lived user keys.

IAM evaluates a request by combining all applicable policies: an explicit Deny always overrides any Allow, and with no matching Allow the default is an implicit deny. So access requires at least one Allow and no Deny across identity, resource, permission boundary, and SCP policies. Remember the order: explicit deny beats everything else.

AWS STS issues short-lived credentials (access key, secret, session token) when an identity assumes a role, scoped by the role's permissions and an expiration. This avoids embedding long-term keys and enables cross-account access and identity federation. EC2/ECS/Lambda use roles so the SDK automatically retrieves and rotates these temporary credentials.

Envelope encryption uses a KMS customer master key (KMS key) to encrypt a data key, which in turn encrypts your actual data. You store the encrypted data key beside the ciphertext and call KMS Decrypt only to unwrap the data key, so large payloads are encrypted locally without sending them to KMS. This is how S3 SSE-KMS and the AWS Encryption SDK work.

Both store configuration/secrets securely, but Secrets Manager adds built-in automatic rotation (e.g., RDS credentials) and cross-region replication, at a per-secret cost. Parameter Store is free for standard parameters and integrates tightly with other services; SecureString parameters use KMS. Use Secrets Manager when you need automatic rotation; Parameter Store for general config and cost-sensitive secrets.

CloudFormation is the general infrastructure-as-code service using JSON/YAML templates with full resource coverage. SAM is a CloudFormation extension with concise shorthand for serverless apps (functions, APIs, tables) plus a CLI to build, locally test, and deploy. SAM transforms into standard CloudFormation at deploy time; use it to write less boilerplate for serverless stacks.

A change set previews exactly which resources an update will add, modify, or delete before you execute it, preventing surprise replacements. Drift detection reports where deployed resources have diverged from the template (e.g., manual console edits). Together they keep stack updates safe and your infrastructure in sync with code.

In-place updates the existing instances one batch at a time (lower cost, brief reduced capacity, slower rollback). Blue/green provisions a new (green) environment, shifts traffic to it, and keeps the old (blue) for instant rollback by re-pointing traffic. Choose blue/green for zero-downtime and fast rollback; in-place when you cannot duplicate infrastructure.

For Lambda/ECS, CodeDeploy shifts traffic to the new version by a strategy: canary moves a small percentage first, waits, then the rest; linear moves equal increments on a schedule; all-at-once switches everything immediately. Canary and linear limit blast radius and can auto-roll-back on CloudWatch alarms; all-at-once is fastest but riskiest.

CodePipeline orchestrates the end-to-end CI/CD workflow as stages and actions. CodeBuild compiles, tests, and packages code per a buildspec.yml, producing artifacts. CodeDeploy delivers those artifacts to EC2, Lambda, or ECS using a deployment strategy. Pipeline is the conductor; CodeBuild is the build step; CodeDeploy is the release step.

Beanstalk offers All at once (fastest, full downtime), Rolling (batches, reduced capacity), Rolling with additional batch (keeps full capacity by adding temporary instances), and Immutable / Blue-green (new instances or environment for safest rollback). The trade-off is speed and cost versus availability and rollback safety during a release.

Metrics are time-series numeric data (CPU, invocations, errors). Logs are text streams from applications and services that you can query and turn into metric filters. Alarms watch a metric against a threshold and trigger actions (SNS, Auto Scaling) when breached. Use metrics+alarms to detect/react, logs to investigate root cause.

You publish custom metrics with PutMetricData for application-specific values not emitted by default. Standard metrics have one-minute granularity; high-resolution custom metrics support one-second granularity for fast detection. Use the EMF (embedded metric format) in logs to emit metrics efficiently from Lambda without extra API calls.

X-Ray traces a request as it flows across services, producing a service map and segments/subsegments that reveal latency, errors, and bottlenecks in distributed and serverless apps. You instrument with the X-Ray SDK or enable active tracing on Lambda/API Gateway; the daemon/agent forwards trace data. Use it to pinpoint which downstream call is slow or failing.

DAX is a DynamoDB-specific in-memory cache that accelerates eventually-consistent reads with no app changes beyond the client. ElastiCache (Redis/Memcached) is a general-purpose cache for any data source and supports custom caching patterns. API Gateway caching stores HTTP responses at the API layer. Pick the cache by what you are accelerating: DynamoDB, arbitrary data, or API responses.

Lambda allocates CPU proportionally to configured memory, so adding memory can make functions finish faster and sometimes cost the same or less despite a higher per-millisecond rate. Use AWS Lambda Power Tuning to find the optimal setting. Also reuse SDK clients and connections across invocations and right-size /tmp and timeout to balance speed and cost.