AWS SAA Study Tool

SAA-C03Architectural Decision Engine

54 services

Compute

EC2 Auto Scaling

Triggered by performance metrics. Distinguish from ELB — ELB routes traffic, Auto Scaling adjusts capacity.

Keywords

scale automaticallydynamic demandlaunch templatedesired capacityCPU utilization thresholdscheduled scaling

IF / THEN Elimination

IF "variable load" + "EC2-based" → ELIMINATE fixed instance counts. IF "millisecond spike" → ELIMINATE in favour of Fargate (EC2 boot takes minutes).

⚠ Trap: Auto Scaling does not replace a load balancer — you need both. Scheduled scaling ≠ reactive scaling.

ComputeDocs ↗

AWS Lambda

Max 15 min runtime. Event sources: SQS, SNS, API Gateway, S3, DynamoDB Streams, EventBridge.

Keywords

serverlessevent-drivenno servers to manageshort-livedpay per invocationtriggers from S3/DynamoDB/SQS

IF / THEN Elimination

IF "serverless" + "event-driven" + "short burst" → Lambda. IF runtime > 15 min → ELIMINATE Lambda, use Fargate or EC2.

⚠ Trap: Lambda has a 15-minute hard limit. Long-running batch jobs will silently fail if you choose Lambda.

ComputeDocs ↗

AWS Fargate

Serverless container runtime. No EC2 provisioning. Works with ECS and EKS.

Keywords

containersDockermicroservicesno EC2 to managemillisecond scalingzero opsserverless containers

IF / THEN Elimination

IF "containerised" + "millisecond scaling / zero ops" → Fargate. ELIMINATE bare EC2 (boot time = minutes, not milliseconds).

⚠ Trap: Do not choose EC2 with Auto Scaling for near-instantaneous traffic spikes — boot latency disqualifies it.

Compute

Elastic Beanstalk

PaaS layer over EC2. Developer uploads code, AWS handles the rest. Still uses EC2 under the hood.

Keywords

deploy web app quicklyplatform as a serviceupload codeautomatic provisioningmanaged platform

IF / THEN Elimination

IF "deploy app without managing infra" + "not containers" → Elastic Beanstalk. IF "full control over infrastructure" → ELIMINATE Beanstalk.

⚠ Trap: Beanstalk still runs on EC2 — it abstracts management, not the underlying compute.

ComputeDocs ↗

Elastic Fabric Adapter (EFA)

Network interface for HPC workloads. Enables OS-bypass communication between cluster nodes.

Keywords

HPCtightly coupled clusterMPIultra-low latency inter-nodeOS bypass

IF / THEN Elimination

IF "HPC cluster" + "MPI" + "tightly coupled" → EFA. ELIMINATE standard ENA (lacks OS-bypass fabric protocols required for MPI).

⚠ Trap: Standard ENA and EFA look similar — EFA is the only option for tightly-coupled HPC / MPI architectures.

Storage

Amazon S3

11 nines durability. Not for OS or block storage. Intelligent-Tiering = unknown access patterns.

Keywords

object storagestatic websiteunlimited storagebucketlifecycle policyversioningpresigned URLcross-region replication

IF / THEN Elimination

IF "store objects/files at scale" → S3. IF "block storage" or "OS disk" → ELIMINATE S3 (object store, not mountable).

⚠ Trap: S3 is object storage — you cannot mount it as a file system or use it as a database disk.

Storage

Amazon EBS

Single AZ. Snapshots go to S3. io2 Block Express = up to 256k IOPS. Multi-attach = io1/io2 only.

Keywords

block storageattached to EC2persistent volumeIOPSgp3io2single AZsnapshot

IF / THEN Elimination

IF "block storage for single EC2" → EBS. IF "shared across multiple EC2" → ELIMINATE EBS, use EFS.

⚠ Trap: EBS is single-AZ and single-instance by default. Multi-attach is only available on io1/io2 volumes.

StorageDocs ↗

Amazon EFS

Multi-AZ, shared NFS access. Linux only. More expensive than EBS.

Keywords

shared file systemmultiple EC2NFSLinuxconcurrent accessPOSIXmulti-AZ

IF / THEN Elimination

IF "Linux shared" + "POSIX" + "concurrent EC2 access" → EFS. ELIMINATE EBS (single-AZ, single-attach). ELIMINATE S3 (not POSIX).

⚠ Trap: EFS is Linux/NFS only. Windows workloads need FSx for Windows. Do not confuse with EBS for shared access.

StorageDocs ↗

Amazon FSx for Windows

Fully managed Windows file system. Native AD integration, SMB protocol, NTFS.

Keywords

WindowsSMB protocolActive DirectoryNTFSWindows file serverhigh performance Windows

IF / THEN Elimination

IF "Windows" + "SMB" + "Active Directory" → FSx for Windows. ELIMINATE EFS (Linux/NFS only, cannot process Windows file locks).

⚠ Trap: EFS does not support SMB or Windows natively. FSx for Windows is the only correct answer for Windows file workloads.

StorageDocs ↗

Amazon FSx for Lustre

High-performance parallel file system optimized for compute-intensive sub-millisecond workloads like machine learning, high-performance computing, and financial modeling.

Keywords

high performance computingHPC storagefast parallel processingPOSIX file system back by S3machine learning dataset caching

IF / THEN Elimination

IF "HPC workloads" + "parallel file system processing" + "sub-millisecond throughput" → FSx for Lustre. ELIMINATE EFS (EFS scale lacks the parallel throughput required for heavy HPC computation clusters).

⚠ Trap: Do not choose EFS or FSx for Windows if the problem states a cluster of Linux worker nodes needs massive concurrent scratch storage for ML processing.

Storage

S3 Glacier

Instant Retrieval = ms. Flexible = mins-hours. Deep Archive = 12h cheapest tier.

Keywords

archivelong-term storagerarely accessedcompliance retentionVault LockDeep Archive

IF / THEN Elimination

IF "archive" + "rarely accessed" + "lowest cost" → Glacier. IF "millisecond retrieval" → Glacier Instant. IF "12h acceptable" → Deep Archive.

⚠ Trap: Glacier retrieval is not instant by default — specify the tier. Deep Archive is cheapest but slowest (up to 12h).

StorageDocs ↗

AWS Storage Gateway

Bridges on-prem to S3/EBS. File GW → S3. Volume GW → EBS snapshots. Tape GW → replaces tape backup.

Keywords

on-premises to cloudhybrid storageNFS/SMB on-premFile GatewayVolume GatewayTape Gatewaylocal cacheiSCSI

IF / THEN Elimination

IF "on-premises local cache" + "S3-backed" → Storage Gateway. ELIMINATE direct S3 mount (network latency without local cache crashes operational loops).

⚠ Trap: Do not mount S3 directly over a VPN without local caching hardware — latency makes it unworkable.

StorageDocs ↗

AWS Transfer Family

Fully managed support for file transfers directly into Amazon S3 or Amazon EFS via SFTP, FTPS, and FTP.

Keywords

SFTP migrationFTPS / FTP to S3legacy file transfer systempublic key authentication

IF / THEN Elimination

IF "legacy partner integration" + "SFTP protocol" + "direct cloud storage landing" → AWS Transfer Family.

⚠ Trap: Do not build an EC2 instance running self-managed SFTP software if AWS Transfer Family is an option; it introduces unnecessary administrative overhead.

StorageDocs ↗

AWS Snowball Edge

Physical device for large-scale offline data migration. Storage Optimised variant for bulk transfer.

Keywords

migrate petabytesconstrained bandwidthphysical applianceoffline transferdata centre migration

IF / THEN Elimination

IF "petabytes" + "constrained bandwidth" + "tight timeline" → Snowball. ELIMINATE DataSync/Direct Connect (over-wire takes months with thin pipes).

⚠ Trap: DataSync and Site-to-Site VPN are eliminated when bandwidth is the bottleneck at petabyte scale.

StorageDocs ↗

Amazon Athena

Serverless SQL over S3. No ETL, no provisioning. Pay per query scanned.

Keywords

ad-hoc SQLquery S3serverless queryflat fileshistorical logspay per query

IF / THEN Elimination

IF "ad-hoc SQL" + "flat S3 objects" → Athena. ELIMINATE Redshift and RDS (both require ETL pipelines, schema provisioning, and ongoing instance cost).

⚠ Trap: Athena is for ad-hoc exploration of existing S3 data. For ongoing BI/dashboarding, Redshift is more appropriate.

StorageDocs ↗

S3 Object Lock (Compliance Mode)

Compliance mode blocks deletion even by root. Governance mode allows override with permissions.

Keywords

WORMwrite once read manycompliance retentionprevent deletionroot account blockedregulatory

IF / THEN Elimination

IF "WORM enforced" + "root account blocked" → S3 Object Lock Compliance. ELIMINATE standard versioning/bucket policies (root can still delete).

⚠ Trap: Standard S3 versioning and bucket policies do NOT prevent root account deletion. Only Compliance Mode Object Lock does.

Database

Amazon RDS

Multi-AZ = HA/failover (same region). Read replicas = read throughput. Cannot SSH into the instance.

Keywords

relationalSQLMySQLPostgreSQLmanaged DBMulti-AZread replicaautomated backups

IF / THEN Elimination

IF "relational SQL" + "managed" + "predictable load" → RDS. IF "cross-region DR" → ELIMINATE RDS Multi-AZ (single-region only).

⚠ Trap: RDS Multi-AZ is for HA within one region only. It does NOT protect against full region failure.

DatabaseDocs ↗

Amazon Aurora

Storage auto-scales 10GB–128TB. Global DB = cross-region replication < 1s. Serverless = unpredictable workloads.

Keywords

MySQL/PostgreSQL compatible5x faster6 copies across 3 AZAurora Serverlessglobal databaseauto-scale storage

IF / THEN Elimination

IF "relational" + "unpredictable/spiky" → Aurora Serverless v2. IF "cross-region active-passive DR" → Aurora Global. ELIMINATE RDS for both.

⚠ Trap: Do not choose provisioned RDS for spiky loads — idle compute waste is the trap. Do not choose RDS Multi-AZ for cross-region DR.

Database

Amazon DynamoDB

DAX = in-memory cache for DynamoDB. Global tables = multi-region active-active. Streams trigger Lambda.

Keywords

NoSQLkey-valuesingle-digit millisecondserverlessDAXstreamsglobal tableson-demand capacity

IF / THEN Elimination

IF "NoSQL" + "single-digit ms at any scale" → DynamoDB. IF "needs caching layer" → add DAX. ELIMINATE RDS for key-value workloads.

⚠ Trap: DAX is DynamoDB-specific. ElastiCache is for RDS/general caching. Do not swap them.

DatabaseDocs ↗

DynamoDB Accelerator (DAX)

An in-memory, fully managed, highly available cache for Amazon DynamoDB that delivers up to a 10x performance improvement from milliseconds to microseconds.

Keywords

sub millisecond latencyin memory cache for DynamoDBwrite through cachingheavy read amplification spikes

IF / THEN Elimination

IF "DynamoDB read traffic spikes" + "microsecond response time needed" → DAX. ELIMINATE ElastiCache (ElastiCache requires rewriting the core application layer logic, while DAX handles API call pass-through natively).

⚠ Trap: Do not pick general ElastiCache (Redis/Memcached) if the target architecture is already deployed on DynamoDB tables.

Database

Amazon ElastiCache

Redis: persistence, replication, pub/sub, sorted sets. Memcached: simple, multi-threaded, no persistence.

Keywords

in-memory cacheRedisMemcachedsub-millisecondsession storeleaderboardpub/subreduce DB load

IF / THEN Elimination

IF "reduce DB read load" + "sub-ms latency" → ElastiCache. IF "pub/sub or persistence needed" → Redis. IF "simple cache" → Memcached.

⚠ Trap: Memcached has no persistence or replication. If the question mentions failover or pub/sub, Memcached is the wrong choice.

Database

Amazon Redshift

OLAP, not OLTP. Spectrum queries S3 directly. Leader node + compute nodes architecture.

Keywords

data warehouseOLAPbusiness intelligencepetabyte scaleanalytical queriescolumnar storageRedshift Spectrum

IF / THEN Elimination

IF "analytical queries" + "petabyte scale" + "BI dashboards" → Redshift. IF "transactional OLTP" → ELIMINATE Redshift.

⚠ Trap: Redshift is not for transactional workloads. Using it for OLTP is a classic distractor.

DatabaseDocs ↗

AWS Glue

Serverless data integration service that makes it easy to discover, prepare, and combine data for analytics, machine learning, and application development.

Keywords

serverless ETLData Catalogdiscover and metadataprepare data for analyticsschema discovery

IF / THEN Elimination

IF "serverless ETL pipeline" + "S3 data transformation" → AWS Glue. IF "heavy operational compute clusters needed" → ELIMINATE in favor of EMR.

⚠ Trap: Athena needs a metadata source to query raw text logs efficiently. AWS Glue Data Catalog is almost always the companion service assigned to populate that schema.

DatabaseDocs ↗

Amazon OpenSearch Service

Fully managed alternative to Elasticsearch for log analytics, application monitoring, and interactive text search.

Keywords

operational search indexinglog analytics indexingelk stack alternativeapplication clickstream search

IF / THEN Elimination

IF "interactive text search engine" + "unstructured log search indexing" → OpenSearch. ELIMINATE Athena (Athena runs raw SQL over structured logs but lacks sub-second search indexing capabilities).

⚠ Trap: Redshift and Athena are for structured analytics; OpenSearch is the correct choice for semi-structured text search strings or real-time log analysis dashboards.

Networking

Amazon VPC

NAT GW = private subnet → internet (outbound only). IGW = public subnet ↔ internet. Peering = connect 2 VPCs.

Keywords

isolated networksubnetsCIDRpublic/private subnetroute tableNAT Gatewayinternet gatewayVPC peeringflow logs

IF / THEN Elimination

IF "private subnet needs outbound internet" → NAT Gateway. IF "direct VPC-to-VPC" → VPC Peering. IF "all traffic internal" → no IGW needed.

⚠ Trap: NAT Gateway must live in a PUBLIC subnet, not the private one. A common trap is placing it in the wrong subnet.

NetworkingDocs ↗

NAT Gateway

Managed, highly available. Must be in a public subnet. Allows private instances outbound internet access.

Keywords

private subnet outboundpatch instancesblock inboundmanaged NAToutbound only

IF / THEN Elimination

IF "outbound only" + "managed low maintenance" → NAT Gateway. ELIMINATE NAT Instance (requires manual config, fails if base instance goes down).

⚠ Trap: NAT Instances are self-managed and a single point of failure. NAT Gateway is always preferred unless the question specifically asks about cost for tiny traffic.

NetworkingDocs ↗

VPC Gateway Endpoint

Free. Supports S3 and DynamoDB only. No data processing charges unlike NAT Gateway or Interface Endpoints.

Keywords

S3 access from private subnetDynamoDB accesseliminate NAT costfree endpointno internet transit

IF / THEN Elimination

IF "S3/DynamoDB access" + "lowest cost" + "private subnet" → VPC Gateway Endpoint. ELIMINATE NAT Gateway (charged per GB). ELIMINATE Interface Endpoint (hourly + GB fee).

⚠ Trap: Gateway Endpoints are free. Interface Endpoints (PrivateLink) are not. Mixing these up is a very common exam error.

NetworkingDocs ↗

VPC Interface Endpoint (PrivateLink)

Uses an Elastic Network Interface (ENI) with a private IP from your subnet. Covers most AWS services (SQS, Kinesis, Systems Manager, etc.). Powered by PrivateLink.

Keywords

private access to AWS servicesENI with private IPPrivateLinksecure SaaS accesstraffic stays inside AWS

IF / THEN Elimination

IF "private access to SQS/Kinesis" + "no internet gateway" → Interface Endpoint. IF "S3 or DynamoDB" → ELIMINATE in favor of Gateway Endpoint (which is free).

⚠ Trap: Interface Endpoints cost money per hour and per GB processed. Do not use them for S3 or DynamoDB unless explicit architecture constraints demand ENIs.

NetworkingDocs ↗

AWS Transit Gateway

Acts as a cloud router. Scales across thousands of VPCs and on-prem connections. Simplifies full-mesh peering bottlenecks.

Keywords

hub and spokeconnect multiple VPCs and on-premisesscale network routingeliminate complex peering meshcentralized router

IF / THEN Elimination

IF "mesh network topology" + "tens or hundreds of VPCs" → Transit Gateway. IF "connecting only two VPCs" → ELIMINATE in favor of VPC Peering (cheaper and simpler).

⚠ Trap: VPC Peering does not support transitive routing. If VPC A peers with B, and B with C, A cannot talk to C without Transit Gateway or direct peering.

NetworkingDocs ↗

AWS Global Accelerator

Uses AWS global network and Anycast IPs to route traffic. Optimizes Layer 4 traffic. Distinguish from CloudFront: CloudFront caches content (Layer 7), Global Accelerator optimizes network paths (Layer 4).

Keywords

Anycast IPstatic IP for global routingedge network optimizationreduce latency via AWS backbonenon-HTTP protocol scalinginstant failover across regions

IF / THEN Elimination

IF "global users" + "non-HTTP protocol (UDP/TCP)" + "static IP requirement" → Global Accelerator. IF "web content caching" → ELIMINATE in favor of CloudFront.

⚠ Trap: Do not choose CloudFront if the application relies on non-HTTP protocols or requires fixed, allow-listed static IP addresses.

Networking

Amazon Route 53

Failover = primary/secondary. Latency = lowest latency region. Geolocation = user location. Weighted = A/B.

Keywords

DNSdomain namelatency-based routingfailover routinggeolocationweightedhealth checksalias record

IF / THEN Elimination

IF "route users to nearest region" → Latency routing. IF "active-passive DR" → Failover routing. IF "split traffic" → Weighted routing.

⚠ Trap: Geolocation ≠ Latency-based. Geolocation routes by the user's geographic location; Latency routes by lowest measured network latency.

Networking

Amazon CloudFront

OAC = Origin Access Control, restricts S3 to CloudFront only. Signed URLs = per-file restricted access.

Keywords

CDNcontent deliveryedge locationscacheglobal distributionstatic assetsOACsigned URLslow latency globally

IF / THEN Elimination

IF "global low latency" + "static assets" → CloudFront. IF "restrict S3 to CloudFront only" → OAC. ELIMINATE direct S3 public access (no edge caching).

⚠ Trap: OAI is deprecated — OAC is the current mechanism. CloudFront + S3 requires OAC to prevent direct S3 URL access.

NetworkingDocs ↗

ELB / ALB / NLB

ALB = Layer 7 (HTTP/HTTPS, path/host routing). NLB = Layer 4 (TCP/UDP, static IPs, ultra-low latency).

Keywords

load balancerdistribute traffictarget grouphealth checksticky sessionspath-based routingSSL terminationUDPstatic IP

IF / THEN Elimination

IF "UDP traffic" or "static IPs per AZ" → NLB. IF "path-based routing" or "host-based routing" → ALB. ELIMINATE ALB for UDP or static IP requirements.

⚠ Trap: ALB cannot allocate static IPs and has no UDP support. NLB supports both. This distinction comes up constantly.

Networking

AWS Direct Connect

Not encrypted by default. Combine with VPN for encryption. Takes weeks to provision.

Keywords

dedicated connectionprivate link to AWSbypass internetconsistent bandwidth1Gbps 10Gbpson-premises to AWS

IF / THEN Elimination

IF "consistent low-latency bandwidth" + "on-prem to AWS" → Direct Connect. IF "needs encryption" → add VPN over Direct Connect.

⚠ Trap: Direct Connect is NOT encrypted by default. If the question asks for private AND encrypted, you need a VPN on top.

Networking

AWS Site-to-Site VPN

Encrypted over internet. Fast to provision. VGW on AWS side, CGW on customer side.

Keywords

encrypted tunnelIPSecon-prem to VPCVirtual Private GatewayCustomer Gatewayfast to set up

IF / THEN Elimination

IF "encrypted" + "quick to set up" + "on-prem to VPC" → Site-to-Site VPN. IF "consistent bandwidth" → Direct Connect preferred.

⚠ Trap: VPN goes over the public internet — bandwidth is variable. Direct Connect is the answer when consistent throughput is required.

Security

AWS IAM

Roles = temporary access via STS. SCPs restrict entire AWS Organisations. AssumeRole for cross-account.

Keywords

permissionsrolespoliciesleast privilegeMFAservice rolecross-accountidentity federationSTS

IF / THEN Elimination

IF "cross-account access" → IAM Role + STS AssumeRole. IF "restrict entire org" → SCPs. IF "federated users" → Identity Provider + IAM role.

⚠ Trap: IAM users have permanent credentials. For cross-account or federated access, always use roles (temporary credentials via STS).

SecurityDocs ↗

AWS Organizations & SCPs

SCPs specify the maximum available permissions for IAM users and root accounts in an organization or OU. SCPs do not grant permissions; they act as a filter.

Keywords

consolidated billingmultiple AWS accountsService Control Policiesrestrict root account actionshierarchical OU

IF / THEN Elimination

IF "restrict root user permissions centrally" or "multi-account permission guardrails" → SCPs inside AWS Organizations.

⚠ Trap: SCPs do not apply to the master/management account of the organization—only to member accounts.

SecurityDocs ↗

AWS Resource Access Manager (RAM)

Allows accounts within an organization to securely share specific resources like Route 53 Resolver rules, Transit Gateways, and Subnets without duplication.

Keywords

share resources cross-accountshare Transit Gatewayshare subnets centrallyreduce duplicate infrastructure

IF / THEN Elimination

IF "multi-account" + "share internal network components like subnets/TGWs" → AWS RAM.

⚠ Trap: RAM does not transfer resource ownership; the provisioning account still owns and pays for the base resource architecture.

SecurityDocs ↗

AWS Directory Service

Enables your AWS resources to use existing on-premises Microsoft Active Directory or easily setup a new managed directory inside the cloud infrastructure layer.

Keywords

Active Directory integrationhybrid cloud identity managementAWS Managed Microsoft ADAD Connector

IF / THEN Elimination

IF "on-prem Active Directory trust relationship" + "native Windows SSO mapping" → AWS Managed Microsoft AD. IF "proxy traffic without local caching" → AD Connector.

⚠ Trap: Do not choose simple IAM Users if the architecture explicitly mandates authentication against pre-existing enterprise corporate data stores.

Security

AWS KMS

Manages encryption keys. Integrates with S3, RDS, EBS. CloudHSM = dedicated hardware, you control keys.

Keywords

encryption keyscustomer managed keyenvelope encryptionkey rotationCMKserver-side encryptionCloudTrail audit

IF / THEN Elimination

IF "manage encryption keys" + "AWS integrated" → KMS. IF "dedicated hardware HSM" → CloudHSM. IF "auto key rotation" → KMS CMK rotation enabled.

⚠ Trap: CloudHSM gives you full key control on dedicated hardware — KMS is shared infrastructure. Do not swap them when the question specifies "dedicated hardware".

Security

AWS WAF

Works with ALB, CloudFront, API Gateway. Operates at Layer 7. Shield handles Layer 3/4 DDoS.

Keywords

web application firewallSQL injectionXSSLayer 7block malicious requestsrate limitingACL rules

IF / THEN Elimination

IF "SQL injection" or "XSS" or "Layer 7 attack" → WAF. IF "DDoS volumetric" → Shield. Never swap these.

⚠ Trap: WAF and Shield are complementary, not interchangeable. WAF = application-layer attacks. Shield = volumetric/network DDoS.

Security

AWS Shield

Standard = free, automatic. Advanced = paid, 24/7 DRT team, financial protection, detailed reporting.

Keywords

DDoS protectionvolumetric attacksShield Advancedalways-onLayer 3 Layer 4

IF / THEN Elimination

IF "DDoS protection" + "no app-layer rules needed" → Shield. IF "app-layer attack rules" → WAF.

⚠ Trap: Shield Standard is automatic and free — it does not require configuration. Shield Advanced is the paid tier for enhanced protection.

Security

Amazon GuardDuty

ML-based threat detection. Analyses VPC Flow Logs, CloudTrail, DNS. No agents to install.

Keywords

threat detectionmalicious activityanomaly detectionDNS logsVPC flow logsCloudTrail eventsno agents

IF / THEN Elimination

IF "detect threats automatically" + "no agent" → GuardDuty. Findings → EventBridge → Lambda for auto-remediation.

⚠ Trap: GuardDuty detects threats — it does not prevent them. For prevention, combine with WAF, NACLs, or Security Groups.

Security

AWS Secrets Manager

Auto-rotates secrets. Integrates with RDS, Redshift. Parameter Store = simpler, cheaper, no auto-rotation.

Keywords

store secretsrotate credentialsdatabase passwordsAPI keysautomatic rotationcross-account secrets

IF / THEN Elimination

IF "automatic secret rotation" → Secrets Manager. IF "simple config values, no rotation" → Parameter Store (cheaper).

⚠ Trap: SSM Parameter Store does NOT auto-rotate. If the question mentions rotation, the answer is Secrets Manager.

MessagingDocs ↗

Amazon SQS

Standard = at-least-once, unordered. FIFO = exactly-once, ordered, 3k msg/s. DLQ catches failed messages.

Keywords

decouplequeueasyncmessage bufferconsumer pullvisibility timeoutdead letter queueFIFOat-least-once

IF / THEN Elimination

IF "worker queue / buffer spikes" → SQS. ELIMINATE SNS (SNS is transient push — if consumer is offline, message is lost).

⚠ Trap: SNS does NOT persist messages. If downstream consumers need to pick up messages at their own pace, SQS is required.

Messaging

Amazon SNS

Push-based. One message → many subscribers. Fan-out pattern = SNS → multiple SQS queues.

Keywords

pub/subpush notificationfan outtopicsubscribersemail/SMS/Lambda/SQSimmediate delivery

IF / THEN Elimination

IF "fan-out to multiple consumers" → SNS. IF "durable buffering for each consumer" → SNS → SQS fan-out. ELIMINATE SNS alone for durable workloads.

⚠ Trap: SNS alone has no durability. For fan-out with durability, pair SNS topics with SQS queues per subscriber.

Messaging

Amazon EventBridge

Formerly CloudWatch Events. Schedule → Lambda is the classic pattern. Also connects SaaS event sources.

Keywords

event busscheduled eventscronevent-driven architectureSaaS integrationrulestargets

IF / THEN Elimination

IF "scheduled/cron trigger" → EventBridge. IF "event routing between services" → EventBridge. For simple queuing, SQS is lighter.

⚠ Trap: EventBridge replaced CloudWatch Events. If you see "CloudWatch Events" in answers, it now means EventBridge under the hood.

Messaging

Amazon Kinesis

Data Streams = custom consumers, replay. Firehose = managed delivery to S3/Redshift. Analytics = SQL on streams.

Keywords

real-time streamingdata streamslarge volumeclickstreamIoTshardsKinesis Firehoseanalytics in real-time

IF / THEN Elimination

IF "real-time streaming at volume" → Kinesis. IF "replay messages" → Kinesis Data Streams. IF "deliver to S3/Redshift" → Firehose (no custom code).

⚠ Trap: SQS does not support replay. If the question mentions replaying messages, Kinesis Data Streams is required.

MessagingDocs ↗

Amazon MQ

Managed message broker service for Apache ActiveMQ and RabbitMQ that makes it easy to migrate pre-existing application structures to the cloud without rewriting messaging code layers.

Keywords

managed message brokerRabbitMQActiveMQopen source industry protocolsmigrate JMS architecture

IF / THEN Elimination

IF "legacy messaging migration" + "RabbitMQ/ActiveMQ" + "JMS APIs" → Amazon MQ. ELIMINATE Amazon SQS (SQS uses custom proprietary AWS APIs and requires rewriting application producers/consumers completely).

⚠ Trap: Do not pick SQS or SNS if the question specifies that the engineering tier wants to migrate an existing application with minimal code modifications.

Monitoring

Amazon CloudWatch

Default EC2 metrics = 5 min. Detailed monitoring = 1 min. Custom metrics for RAM/disk (not collected by default).

Keywords

metricslogsalarmsdashboardslog groupscustom metricsCloudWatch agentretention

IF / THEN Elimination

IF "monitor metrics/logs" + "set alarms" → CloudWatch. IF "RAM or disk not showing" → install CloudWatch Agent (these are not default metrics).

⚠ Trap: EC2 RAM and disk usage are NOT collected by CloudWatch by default. You must install the CloudWatch Agent.

Monitoring

AWS CloudTrail

Logs every API call. Management events on by default. Data events (S3/Lambda) cost extra. 90d default, extend to S3.

Keywords

auditAPI callswho did whatgovernancecompliancemanagement eventsdata events90 days default

IF / THEN Elimination

IF "who made this API call" → CloudTrail. IF "what changed in this resource config" → Config. These are complementary — CloudTrail = API calls; Config = state changes.

⚠ Trap: CloudTrail and Config are often confused. CloudTrail = WHO did WHAT via API. Config = WHAT does the resource look like over time.

Monitoring

AWS Config

Tracks resource config state over time. Config rules check compliance. Different from CloudTrail.

Keywords

resource complianceconfiguration historydrift detectionConfig rulesremediationtimeline of changes

IF / THEN Elimination

IF "detect config drift" or "resource compliance over time" → Config. IF "audit API activity" → CloudTrail.

⚠ Trap: Config tracks resource state; CloudTrail tracks API actions. A question about "who opened port 22" → CloudTrail. "Is port 22 open?" → Config.

HA & DR

Multi-AZ Deployment

Synchronous replication, same region. Zero RPO on RDS failover. Automatic, no manual intervention.

Keywords

high availabilityfailoverstandbyautomatic failoversynchronous replicationRDS Multi-AZsame region

IF / THEN Elimination

IF "HA within a region" → Multi-AZ. IF "DR across regions" → Multi-Region. Never use Multi-AZ as a cross-region solution.

⚠ Trap: RDS Multi-AZ does NOT improve read performance. Read replicas do. Multi-AZ is purely for failover.

HA & DR

Multi-Region Architecture

Pilot light = minimal. Warm standby = scaled-down copy. Active-active = full traffic both regions.

Keywords

disaster recoverycross-regionbusiness continuityglobal resiliencepilot lightwarm standbyactive-active

IF / THEN Elimination

IF "survive full region failure" → Multi-Region. ELIMINATE Multi-AZ for cross-region DR scenarios.

⚠ Trap: RDS Multi-AZ is NOT a cross-region solution. Aurora Global Database is required for < 1s cross-region replication.