This is the biggest domain at 34% and it is a breadth test. For each service you need its one-line purpose and the cue that points to it. The exam never asks you to configure anything. Learn the pairs that get confused (SQS vs SNS, EBS vs EFS, RDS vs DynamoDB, Direct Connect vs VPN) and the service categories.
Ways to deploy and operate
Ways to access AWS
| Method | Use |
|---|---|
| AWS Management Console | Web interface. Good for learning, one-off tasks and visual exploration |
| AWS CLI | Commands in a terminal. Scriptable and repeatable |
| SDKs | Libraries for languages (Python, Java, JavaScript, and others) to call AWS from application code |
| APIs | Every action is an API call. The console, CLI and SDKs all call the API |
| AWS CloudShell | Browser-based shell in the console with the CLI preinstalled and your credentials |
| Infrastructure as code (IaC) | Describe resources in a template: AWS CloudFormation (JSON or YAML) or the AWS CDK (real programming languages that generate CloudFormation) |
Access to the CLI, SDKs and API uses access keys (or temporary role credentials). The console uses a sign-in with a password and MFA.
One-time vs repeatable: clicking in the console suits a one-off. Anything that must be repeated, reviewed, versioned or copied across environments should use IaC or scripts. IaC is repeatable, consistent and auditable.
Related provisioning tools: AWS Elastic Beanstalk (upload code, AWS handles deployment, scaling and load balancing), AWS Service Catalog (approved, pre-configured products for users), AWS Launch Wizard (guided sizing and deployment of enterprise workloads such as SQL Server and SAP), AWS Systems Manager (operate and patch fleets, Run Command, Session Manager, Parameter Store), AWS Control Tower (set up and govern a multi-account environment).
Deployment models
| Model | Meaning |
|---|---|
| Cloud (all in) | Everything runs on the cloud. Can also be a cloud-native build |
| On-premises (private cloud) | Everything in your own data centre |
| Hybrid | Mix of cloud and on-premises, connected. Common during migration or when data must stay local |
AWS Outposts puts AWS-managed hardware and services in your own data centre for a consistent hybrid experience.
Connectivity to AWS
| Option | Notes |
|---|---|
| Public internet | Simplest, no setup, variable performance |
| AWS Site-to-Site VPN | Encrypted tunnels over the internet, quick to set up. Use Client VPN for individual remote users |
| AWS Direct Connect | Dedicated private network connection from your site to AWS. Consistent latency, higher bandwidth, lower data-out cost. Takes weeks to set up and is not encrypted by default |
Rule: need speed of setup or low cost, pick VPN. Need consistent, high-bandwidth, private link, pick Direct Connect.
AWS global infrastructure
| Term | Meaning |
|---|---|
| Region | A physical location with multiple AZs. Data stays in a Region unless you move it. Regions are independent |
| Availability Zone (AZ) | One or more discrete data centres with independent power, cooling and networking, connected to other AZs in the Region by fast, low-latency links. AZs don’t share single points of failure |
| Edge location | A site used by CloudFront and Route 53 to cache content and answer DNS close to users. There are many more than Regions |
| Local Zone | Extension of a Region placing compute, storage and database close to a large city for single-digit-millisecond latency |
| Wavelength Zone | AWS compute and storage embedded in a 5G network provider’s data centre for ultra-low latency to mobile devices |
| Outposts | AWS infrastructure in your own facility |
- High availability: run in at least two AZs. If one fails, the other continues.
- Multiple Regions are for disaster recovery and business continuity, lower latency for a global user base, and data sovereignty or residency rules.
- Choosing a Region: compliance and data residency first, then latency to users, then service availability, then price (prices differ by Region).
- New services launch in some Regions first. Not every service exists in every Region. Most services are Regional. IAM, Route 53 and CloudFront are global.
Edge services: Amazon CloudFront is a content delivery network that caches content at edge locations. AWS Global Accelerator gives you static anycast IP addresses and routes user traffic over the AWS global network to healthy endpoints, improving performance and availability for non-cacheable (TCP/UDP) traffic.
Compute
Amazon EC2
EC2 provides virtual servers (instances). You choose the AMI (image), instance type, storage, networking and security groups. You manage the guest OS.
| Instance family | Optimised for | Cue |
|---|---|---|
| General purpose (M, T) | Balanced compute, memory, network | Web servers, small databases. T types are burstable |
| Compute optimised (C) | High-performance CPUs | Batch, gaming servers, media encoding, scientific modelling |
| Memory optimised (R, X) | Large in-memory datasets | In-memory databases, real-time big data |
| Storage optimised (I, D) | High, fast local disk I/O | NoSQL, data warehousing, high IOPS |
| Accelerated computing (P, G) | GPUs and accelerators | ML training, graphics |
Other EC2 facts: Auto Scaling adds or removes instances automatically (elasticity) using scaling policies and keeps a minimum healthy count. Elastic Load Balancing (ELB) spreads traffic across targets in multiple AZs and checks health.
| Load balancer | Layer and use |
|---|---|
| Application (ALB) | HTTP/HTTPS, layer 7, path and host routing |
| Network (NLB) | TCP/UDP, layer 4, very high performance, static IP |
| Gateway (GWLB) | Route traffic through third-party virtual appliances |
Purchasing options (On-Demand, Reserved, Spot, Savings Plans) are covered in the billing notes.
Containers
| Service | What it is |
|---|---|
| Amazon ECS | AWS’s own container orchestration service |
| Amazon EKS | Managed Kubernetes. Use it if you already use Kubernetes or need portability |
| AWS Fargate | Serverless compute for containers: run ECS or EKS containers without managing servers |
| Amazon ECR | Registry that stores container images |
ECS and EKS can run on EC2 instances (you manage them) or on Fargate (AWS manages them).
Serverless and other compute
- AWS Lambda runs code in response to events with no servers to manage. You pay for requests and execution time. Maximum run time is 15 minutes per invocation. Fits short event-driven tasks.
- AWS Elastic Beanstalk deploys web applications from code, handling capacity provisioning, load balancing and scaling. You keep control of the underlying resources.
- Amazon Lightsail is simple, low-cost virtual servers, databases and networking with fixed monthly pricing, for small projects and beginners.
- AWS Batch runs batch jobs at any scale, choosing the right compute.
- AWS Outposts, Local Zones and Wavelength are described above.
Trap: “serverless” means you don’t manage servers. It doesn’t mean there are none. Lambda and Fargate are serverless compute. EC2 is not.
Databases
| Need | Service |
|---|---|
| Managed relational (SQL) databases: MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, Db2 | Amazon RDS |
| Cloud-built relational, MySQL- and PostgreSQL-compatible, higher performance and 6-way replication across 3 AZs | Amazon Aurora (also Aurora Serverless) |
| NoSQL key-value, single-digit millisecond latency at any scale, serverless | Amazon DynamoDB (DAX adds an in-memory cache) |
| In-memory cache or database, microsecond latency | Amazon ElastiCache (Redis OSS, Memcached, Valkey) and Amazon MemoryDB (durable, Redis-compatible primary database) |
| Graph database (relationships, social networks, fraud) | Amazon Neptune |
| Data warehouse, analytic SQL on petabytes | Amazon Redshift |
| Document database, MongoDB-compatible | Amazon DocumentDB |
| Time series, ledger, wide column | Amazon Timestream, Amazon QLDB (ledger), Amazon Keyspaces (Cassandra) |
EC2-hosted vs managed: running a database on EC2 gives full control (OS, custom versions) but you do patching, backups, replication and failover. A managed database (RDS, Aurora, DynamoDB) automates patching, backups, scaling and high availability, so choose it unless you need OS-level control. RDS Multi-AZ gives a standby in another AZ for high availability. Read replicas scale read traffic.
Migration: AWS DMS migrates databases with little downtime and supports continuous replication (homogeneous or heterogeneous). AWS SCT converts the schema and code when the source and target engines differ.
Networking
Amazon VPC
A VPC is your logically isolated virtual network in a Region, spanning all AZs in it.
| Component | Purpose |
|---|---|
| Subnet | A range of IPs in one AZ. Public subnets route to an internet gateway. Private subnets don’t |
| Internet gateway | Lets resources in public subnets talk to the internet |
| NAT gateway | Lets resources in private subnets make outbound connections to the internet, with no inbound from it |
| Route table | Directs where subnet traffic goes |
| Security group / network ACL | Instance-level stateful and subnet-level stateless firewalls |
| VPC peering | Private connection between two VPCs. Transit Gateway is a hub connecting many VPCs and on-premises networks |
| VPC endpoint | Private access to AWS services without using the internet (gateway endpoints for S3 and DynamoDB, interface endpoints using PrivateLink for others) |
| Virtual private gateway | The AWS side of a Site-to-Site VPN |
Other networking services
| Service | Purpose |
|---|---|
| Amazon Route 53 | Highly available DNS, domain registration, health checks and routing policies (simple, weighted, latency, failover, geolocation) |
| Amazon CloudFront | CDN: low-latency delivery of web content, video and APIs from edge locations. Also helps absorb DDoS with Shield |
| AWS Global Accelerator | Static IPs and the AWS backbone for TCP/UDP apps |
| Amazon API Gateway | Create, publish and secure REST, HTTP and WebSocket APIs. Often fronts Lambda |
| AWS Direct Connect, AWS VPN | Hybrid connectivity (see above) |
Storage
Three types of storage
| Type | Service | Notes |
|---|---|---|
| Object | Amazon S3 | Flat store of objects in buckets. Virtually unlimited, 11 nines (99.999999999%) durability, accessed over HTTP. Good for backups, static websites, data lakes, media. Objects up to 5 TB |
| Block | Amazon EBS | Network-attached volumes for one EC2 instance (within the same AZ). Persist when the instance stops. Snapshots are stored in S3. Instance store is temporary local disk on the host. It is lost when the instance stops or fails |
| File | Amazon EFS (Linux, NFS, shared by many instances, elastic, multi-AZ), Amazon FSx (managed third-party file systems: Windows File Server, Lustre, NetApp ONTAP, OpenZFS) |
S3 storage classes
| Class | Use | Cue |
|---|---|---|
| S3 Standard | Frequently accessed data | Default, low latency |
| S3 Intelligent-Tiering | Unknown or changing access patterns | Moves objects between tiers automatically, no retrieval fee |
| S3 Standard-IA | Infrequent access, rapid retrieval, multi-AZ | Backups, long-lived data |
| S3 One Zone-IA | Infrequent access, one AZ only, cheaper | Re-creatable data |
| S3 Glacier Instant Retrieval | Archive needing millisecond access | Rarely accessed, immediate |
| S3 Glacier Flexible Retrieval | Archive, retrieval in minutes to hours | Backups and archives |
| S3 Glacier Deep Archive | Cheapest, retrieval within about 12 hours or more | Compliance archives kept for years |
Lower storage price comes with a retrieval fee, a minimum storage duration and slower access. S3 Lifecycle policies move objects between classes or delete them automatically after a set time. Versioning keeps older versions, and replication copies objects across buckets or Regions. Buckets are private by default, and Block Public Access protects against exposure.
Hybrid and protection
- AWS Storage Gateway connects on-premises applications to cloud storage with local caching (File Gateway, Volume Gateway, Tape Gateway). It is the “cached file system” answer.
- AWS Backup centrally defines backup policies and schedules across services (EBS, RDS, DynamoDB, EFS, FSx and others) and across accounts.
- AWS Elastic Disaster Recovery replicates servers for fast recovery.
- AWS Snow Family moves and processes data at the edge or offline. AWS DataSync and Transfer Family move data online.
AI/ML and analytics
AI and machine learning
| Service | Task |
|---|---|
| Amazon SageMaker AI | Build, train and deploy your own ML models |
| Amazon Bedrock | Use foundation models for generative AI through an API |
| Amazon Rekognition | Image and video analysis (faces, objects, text) |
| Amazon Textract | Extract text and tables from scanned documents |
| Amazon Comprehend | Natural language processing: sentiment, entities, key phrases |
| Amazon Transcribe | Speech to text |
| Amazon Polly | Text to speech |
| Amazon Translate | Language translation |
| Amazon Lex | Build chatbots and voice bots (conversational interfaces) |
| Amazon Kendra | Intelligent enterprise search using natural language |
| Amazon Q | Generative AI assistant for work and developers |
Analytics
| Service | Task |
|---|---|
| Amazon Athena | Run SQL directly on data in S3. Serverless, pay per query |
| Amazon Kinesis | Collect and process real-time streaming data (Data Streams, Firehose, Managed Service for Apache Flink) |
| AWS Glue | Serverless ETL (extract, transform, load) and data catalog |
| Amazon QuickSight | Business intelligence dashboards and visualisation |
| Amazon Redshift | Data warehouse |
| Amazon EMR | Managed big data frameworks (Hadoop, Spark) |
| Amazon OpenSearch Service | Search, log analytics and dashboards |
| Amazon MSK | Managed Apache Kafka |
| AWS Data Exchange | Find and subscribe to third-party datasets |
Other service categories
Application integration
| Service | Job |
|---|---|
| Amazon SQS | Queue. Decouples producers from consumers. Messages are pulled by consumers and held until processed |
| Amazon SNS | Pub/sub notifications. A message is pushed to many subscribers (email, SMS, HTTP, Lambda, SQS) |
| Amazon EventBridge | Event bus that routes events from AWS services, SaaS and apps to targets by rules, and runs schedules |
| AWS Step Functions | Orchestrate workflows of several services as a visual state machine |
Use SNS to fan out one message to many, SQS to buffer work, EventBridge to react to events, Step Functions to coordinate steps.
Business applications and customer engagement
- Amazon Connect: cloud contact centre.
- Amazon SES: send bulk and transactional email.
- AWS Activate for Startups: credits, training and support for startups.
- AWS IQ: find and hire AWS-certified freelancers for projects.
- AWS Managed Services (AMS): AWS operates your infrastructure for you (monitoring, patching, incident handling).
- AWS Support: plans and technical help (see the billing notes).
Developer tools
| Service | Purpose |
|---|---|
| AWS CodeCommit | Managed Git repositories |
| AWS CodeBuild | Compile and test code |
| AWS CodeDeploy | Automate deployments to EC2, Lambda, ECS and on-premises |
| AWS CodePipeline | CI/CD workflow tying the stages together |
| AWS CodeArtifact | Store and share software packages |
| AWS CodeStar | Unified project dashboard for building, testing and deploying |
| AWS Cloud9 | Cloud-based IDE |
| AWS CloudShell | Browser shell with the CLI |
| AWS X-Ray | Trace requests through distributed applications to find bottlenecks and errors |
| AWS AppConfig | Roll out application configuration and feature flags safely, with validation and rollback |
Some of these (CodeStar, Cloud9, and for a time CodeCommit) have been closed to new customers. The exam guide still lists them, so know what they were for.
End-user computing
- Amazon WorkSpaces: managed virtual desktops (Windows or Linux).
- Amazon AppStream 2.0: stream applications to a browser from AWS.
- Amazon WorkSpaces Secure Browser (the in-scope name is WorkSpaces Web): secure browser access to internal web apps and SaaS.
Frontend web and mobile; IoT
- AWS Amplify: build and host full-stack web and mobile apps.
- AWS AppSync: managed GraphQL and real-time APIs.
- AWS Device Farm: test apps on real devices.
- AWS IoT Core: connect and manage IoT devices securely.
- AWS IoT Greengrass: run AWS functionality on edge devices locally.
Management and governance in one place
| Service | Job |
|---|---|
| CloudWatch | Metrics, logs, alarms, dashboards |
| CloudTrail | API audit log |
| Config | Configuration history and compliance rules |
| Systems Manager | Operate and patch fleets, store parameters |
| Auto Scaling | Scaling for EC2 and other resources |
| Compute Optimizer | Rightsizing recommendations |
| Resource Groups and Tag Editor | Group and tag resources in bulk |
| Health Dashboard | Service health and events affecting your account |
| Well-Architected Tool | Workload reviews |
| Organizations / Control Tower | Multi-account management and governance |
Exam checklist
- Console for one-offs, CLI and SDKs for scripts and code, CloudFormation or CDK for repeatable infrastructure.
- Region, AZ, edge location, Local Zone, Wavelength, Outposts: know each in a sentence. Two or more AZs for high availability. Multiple Regions for DR, latency and data residency.
- VPN is fast to set up over the internet. Direct Connect is dedicated and private but takes time.
- EC2 families: C compute, R memory, I storage, P/G GPU, M/T general. Auto Scaling gives elasticity. ELB spreads traffic.
- ECS vs EKS (Kubernetes) vs Fargate (serverless containers) vs Lambda (functions, 15 minutes).
- RDS and Aurora relational, DynamoDB key-value NoSQL, ElastiCache and MemoryDB in memory, Neptune graph, Redshift warehouse. DMS moves data, SCT converts schema.
- S3 object, EBS block (one instance, one AZ), EFS shared Linux files, FSx Windows and other file systems. Instance store is ephemeral.
- S3 classes from Standard to Deep Archive, Lifecycle to move between them, Storage Gateway for hybrid caching, Backup for central policy.
- SQS queue, SNS fan-out, EventBridge events, Step Functions workflows.
- Athena SQL on S3, Glue ETL, Kinesis streaming, QuickSight dashboards, SageMaker custom ML, Rekognition images, Lex bots, Kendra search.