Free AWS Solutions Architect Exam Flashcards

IAM best practices include: using the root account only for account setup, creating individual IAM users, using groups to assign permissions, applying the principle of least privilege, enabling MFA for privileged users, and rotating credentials regularly. IAM policies should be as restrictive as possible while still allowing required access.

AWS evaluates policies in this order: explicit deny (highest priority), Organization SCPs, resource-based policies, IAM permissions boundaries, session policies, then identity-based policies. Policy types include identity-based (attached to users/groups/roles), resource-based (attached to resources), and permissions boundaries (maximum permissions for an IAM entity).

AWS STS provides temporary security credentials for IAM users or federated users. AssumeRole allows users to assume an IAM role and receive temporary credentials (access key, secret key, session token) valid from 15 minutes to 12 hours. This enables cross-account access and is more secure than sharing long-term credentials.

KMS supports three key types: AWS managed keys (automatically created/managed by AWS), customer managed keys (CMKs you create and control), and customer owned keys (imported keys you manage outside AWS). KMS keys can encrypt data up to 4KB directly; for larger data, use envelope encryption with data keys.

S3 supports server-side encryption (SSE-S3 with Amazon-managed keys, SSE-KMS with AWS KMS keys, SSE-C with customer-provided keys) and client-side encryption (data encrypted before upload). SSE-KMS provides audit trail via CloudTrail. As of January 2023, all new S3 objects are encrypted by default with SSE-S3.

Security groups are stateful firewalls at the instance level (return traffic automatically allowed), support allow rules only, and evaluate all rules before deciding. Network ACLs are stateless firewalls at the subnet level, support allow and deny rules, and evaluate rules in order (lowest number first). Use both for defense in depth.

AWS Shield Standard provides automatic protection against common DDoS attacks at no cost. Shield Advanced adds 24/7 DDoS Response Team, cost protection, and advanced attack mitigation for $3,000/month. AWS WAF protects against application-layer attacks (SQL injection, XSS) with customizable rules for CloudFront, ALB, and API Gateway.

Secrets Manager automatically rotates secrets (RDS, Redshift, DocumentDB), costs $0.40/secret/month plus API calls. Parameter Store offers free standard tier for configuration data and secrets without automatic rotation. Use Secrets Manager for database credentials needing rotation; Parameter Store for general configuration management.

CloudTrail records API calls and account activity for governance and compliance (who did what, when, from where). CloudWatch Logs collects and stores log files from AWS services and applications. Send CloudTrail logs to CloudWatch Logs for real-time monitoring and create metric filters to trigger alarms on specific events.

ACM provisions, manages, and deploys public and private SSL/TLS certificates for AWS services (ELB, CloudFront, API Gateway). Public certificates are free. ACM automatically renews certificates before expiration. For EC2, you must use third-party certificates as ACM certificates cannot be exported for direct EC2 use.

Multi-AZ deployments provide high availability within a region using synchronous replication (RDS Multi-AZ, EFS). Multi-Region deployments provide disaster recovery and global distribution using asynchronous replication (S3 Cross-Region Replication, DynamoDB Global Tables, Aurora Global Database). Multi-Region increases complexity and cost but handles regional failures.

RDS Multi-AZ creates a synchronous standby replica in a different AZ for high availability. Automatic failover occurs within 60-120 seconds if primary fails. The standby cannot serve read traffic (unlike read replicas). DNS endpoint remains the same after failover. Available for MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server.

Aurora stores data in 6 copies across 3 AZs with automatic self-healing storage. Aurora Replicas (up to 15) share the same underlying storage as the primary, enabling fast failover (<30 seconds). Aurora Global Database replicates across regions with <1 second lag. Aurora Serverless v2 automatically scales capacity.

ASG maintains desired number of EC2 instances, replacing unhealthy instances automatically. Configure minimum, maximum, and desired capacity. Launch templates define instance configuration. Scaling policies can be target tracking (maintain metric), step scaling (scale based on alarm thresholds), or scheduled (time-based).

ELB performs health checks on registered targets and routes traffic only to healthy targets. Configure protocol, port, path, threshold counts, and intervals. ALB supports HTTP/HTTPS health checks with response code matching. Unhealthy targets receive no traffic until passing consecutive health checks (healthy threshold).

SQS is a fully managed message queue service that decouples application components. Standard queues offer maximum throughput with at-least-once delivery. FIFO queues guarantee exactly-once processing and message ordering (300 msg/sec without batching). Use dead-letter queues (DLQ) for messages that fail processing repeatedly.

SNS is a pub/sub messaging service that sends messages to multiple subscribers simultaneously (fan-out). Subscribers can be SQS queues, Lambda functions, HTTP endpoints, email, or SMS. Combine SNS with SQS for fan-out pattern: one SNS topic publishes to multiple SQS queues for parallel processing.

Route 53 supports multiple routing policies: Simple (single resource), Weighted (distribute traffic by percentage), Latency (lowest latency region), Failover (active-passive with health checks), Geolocation (by user location), Geoproximity (by resource location with bias), and Multivalue (multiple healthy resources).

CRR automatically replicates S3 objects to a bucket in a different region for disaster recovery and compliance. Requires versioning enabled on both buckets. Replication is asynchronous. Does not replicate existing objects (use S3 Batch Replication), delete markers (unless configured), or objects encrypted with SSE-C.

AWS Backup provides centralized backup management across AWS services (EC2, EBS, RDS, DynamoDB, EFS, FSx, Storage Gateway). Create backup plans with schedules, retention policies, and lifecycle rules. Use backup vaults with encryption and access policies. Supports cross-region and cross-account backup for disaster recovery.

Instance families: General Purpose (M/T) for balanced workloads, Compute Optimized (C) for CPU-intensive tasks, Memory Optimized (R/X/Z) for large datasets, Storage Optimized (I/D/H) for high I/O, Accelerated Computing (P/G/Inf) for ML/graphics. Instance size determines vCPUs, memory, and network performance.

Cluster placement groups pack instances close together in single AZ for low-latency, high-throughput networking (HPC). Spread placement groups place instances on distinct hardware across AZs (max 7 per AZ per group). Partition placement groups divide instances into logical partitions on separate racks (big data workloads).

Optimize Lambda by: increasing memory (which also increases CPU), using provisioned concurrency to eliminate cold starts, keeping functions warm with scheduled invocations, minimizing deployment package size, and placing Lambda in VPC only when necessary (adds latency). Lambda supports up to 10GB memory and 15-minute timeout.

ECS is AWS-native container orchestration integrated with AWS services. EKS is managed Kubernetes for teams with Kubernetes expertise or multi-cloud needs. Fargate is serverless compute for containers (no EC2 management) compatible with both ECS and EKS. Choose Fargate for simplicity, EC2 launch type for control and cost optimization.

S3 Standard (frequent access), S3 Intelligent-Tiering (auto-moves between tiers), S3 Standard-IA/One Zone-IA (infrequent access, retrieval fee), S3 Glacier Instant Retrieval (milliseconds), S3 Glacier Flexible Retrieval (minutes-hours), S3 Glacier Deep Archive (12-48 hours, cheapest). Use S3 Lifecycle policies to transition objects automatically.

gp3 (general purpose SSD, 3000 IOPS baseline, up to 16000 IOPS), gp2 (burstable, 3 IOPS/GB), io2 Block Express (highest performance, up to 256000 IOPS), st1 (throughput HDD, big data), sc1 (cold HDD, infrequent access). Choose io2 for databases, gp3 for general workloads, st1/sc1 for sequential large files.

EFS Performance Modes: General Purpose (low latency, default) and Max I/O (higher latency, higher throughput for parallel workloads). Throughput Modes: Bursting (scales with storage), Provisioned (specify throughput independent of storage), and Elastic (automatically scales). Use Elastic for unpredictable workloads.

FSx for Windows File Server (SMB protocol, Active Directory integration), FSx for Lustre (high-performance computing, ML training, integrates with S3), FSx for NetApp ONTAP (multi-protocol NFS/SMB/iSCSI), FSx for OpenZFS (ZFS file system). Choose based on protocol needs and workload requirements.

On-demand capacity mode automatically scales for unpredictable workloads (pay per request). Provisioned capacity mode requires specifying Read/Write Capacity Units (cheaper for predictable workloads). Enable DynamoDB Accelerator (DAX) for microsecond read latency. Use Global Secondary Indexes for queries on non-key attributes.

Redis supports complex data types, persistence, replication, clustering, pub/sub, and Lua scripting. Memcached is simpler, multi-threaded, and better for simple caching without persistence. Use Redis for sessions, leaderboards, and real-time analytics. Use Memcached for simple caching of database queries.

Redshift is a petabyte-scale data warehouse using columnar storage and massive parallel processing (MPP). Consists of leader node (SQL parsing, query planning) and compute nodes (data storage, query execution). Use Redshift Spectrum to query S3 data directly. Enable Enhanced VPC Routing for data through VPC.

Gateway endpoints (free) support S3 and DynamoDB, route traffic via route table entries. Interface endpoints (powered by PrivateLink, costs apply) support 100+ AWS services, create ENIs in subnets with private IPs. Use endpoints to keep traffic within AWS network, improving security and performance.

CloudFront is a CDN that caches content at edge locations for static/dynamic content delivery. Global Accelerator provides static anycast IPs routing traffic to optimal regional endpoints over AWS global network (no caching). Use CloudFront for cacheable content, Global Accelerator for TCP/UDP applications requiring static IPs or fast failover.

ALB operates at Layer 7 (HTTP/HTTPS), supports path-based and host-based routing, WebSocket, HTTP/2, and gRPC. Features include sticky sessions, health checks, authentication (Cognito, OIDC), Lambda targets, and weighted target groups for blue/green deployments. Use target groups to route to EC2, containers, or Lambda.

NLB operates at Layer 4 (TCP/UDP/TLS), handling millions of requests per second with ultra-low latency. Provides static IPs per AZ and supports Elastic IPs. Preserves source IP address. Use for extreme performance, non-HTTP protocols, or when static IP is required. Can front ALB for static IP with Layer 7 features.

On-Demand (pay per second, no commitment), Reserved Instances (1-3 year commitment, up to 72% discount), Savings Plans (flexible commitment to $/hour, up to 72% discount), Spot Instances (up to 90% discount, can be interrupted with 2-min warning), Dedicated Hosts (physical server, compliance/licensing needs).

Spot Instances offer up to 90% discount for fault-tolerant workloads. Use Spot Fleet to request multiple instance types across AZs for higher availability. Implement graceful handling of spot interruptions (2-minute warning). Ideal for batch processing, CI/CD, big data, containerized workloads, and HPC.

Reserved Instances commit to specific instance type/region for 1-3 years (Standard RI or Convertible RI). Savings Plans commit to consistent compute usage ($/hour) with flexibility to change instance types. Compute Savings Plans apply to EC2, Lambda, and Fargate. EC2 Instance Savings Plans offer highest discount for specific instance family.

Use S3 Lifecycle policies to transition objects to cheaper storage classes (IA after 30 days, Glacier after 90 days). Enable S3 Intelligent-Tiering for unknown access patterns. Delete incomplete multipart uploads. Use S3 Analytics to identify optimal lifecycle transitions. Compress data before uploading.

Compute Optimizer analyzes resource utilization and recommends optimal AWS resources (EC2, EBS, Lambda, ECS on Fargate). Uses machine learning to analyze CloudWatch metrics. Provides estimated monthly savings and performance risk ratings. Free service requiring at least 30 hours of metrics data.

Data transfer IN to AWS is free. Data transfer OUT to internet is charged per GB (tiered pricing). Data transfer between AZs costs $0.01/GB each way. Use VPC endpoints to avoid NAT Gateway charges for AWS service traffic. CloudFront can be cheaper than direct S3 for high-volume downloads.

Use Reserved Instances for predictable database workloads (up to 72% discount). Stop non-production databases when not in use (max 7 days). Right-size instances using Performance Insights and CloudWatch metrics. Use Aurora Serverless v2 for variable workloads. Delete automated backups beyond retention requirements.

Cost Explorer visualizes spending patterns, forecasts future costs, and identifies savings opportunities (Reserved Instance recommendations). AWS Budgets sets custom cost/usage alerts with notifications. Create budget actions to automatically apply IAM policies or SCPs when thresholds are exceeded.

Serverless services (Lambda, Fargate, Aurora Serverless, DynamoDB on-demand) eliminate idle capacity costs by charging only for actual usage. Lambda charges per millisecond of execution. Consider serverless for variable/unpredictable workloads. For consistent high-volume workloads, provisioned capacity may be cheaper.

Consolidated billing combines usage across accounts for volume discounts and easier cost tracking. Share Reserved Instances and Savings Plans across accounts in an Organization. Use Service Control Policies (SCPs) to restrict expensive services. Tag resources consistently for cost allocation reporting.

Implement microservices using ECS/EKS for containers, API Gateway for REST/WebSocket APIs, Lambda for event-driven compute, SQS/SNS for async communication, and DynamoDB for per-service databases. Use AWS App Mesh or Cloud Map for service discovery. Each service scales independently and can use different technologies.

Amazon EventBridge is a serverless event bus connecting applications using events. Create rules to filter events and route to targets (Lambda, SQS, SNS, Step Functions). Use for decoupling services, reacting to AWS service events, or integrating SaaS applications. Schema registry auto-discovers event schemas.

Six pillars: Operational Excellence (automate, anticipate failure), Security (protect data, manage access), Reliability (recover from failures, scale), Performance Efficiency (use resources efficiently), Cost Optimization (eliminate waste), and Sustainability (minimize environmental impact). Use Well-Architected Tool for workload reviews.

Backup & Restore (hours RTO, lowest cost), Pilot Light (minutes RTO, core components running), Warm Standby (minutes RTO, scaled-down production), Multi-Site Active-Active (near-zero RTO, highest cost). RTO = recovery time objective, RPO = recovery point objective. Choose based on business requirements and budget.

Rehost (lift-and-shift to EC2), Replatform (lift-and-reshape, e.g., move to RDS), Repurchase (move to SaaS), Refactor (re-architect for cloud-native), Retain (keep on-premises), Retire (decommission). Use AWS Migration Hub to track progress. AWS Application Discovery Service helps assess on-premises environments.