AWS Questions

Amazon Web Services (AWS) is a global, secure cloud services platform offering over 200 fully-featured services including compute, storage, and databases delivered on-demand with pay-as-you-go pricing.

Core services include Compute (EC2, Lambda), Storage (S3, EBS), Databases (RDS, DynamoDB), and Networking (VPC, Route 53). These form the backbone of most cloud architectures.

IaaS (Infrastructure as a Service) provides raw hardware/networking (EC2). PaaS (Platform as a Service) manages the OS/Middleware so you only manage code (Elastic Beanstalk). SaaS (Software as a Service) is a completed software product (Amazon Chime).

A program allowing customers to use select AWS services for free within certain limits. It includes Always Free services, 12 Months Free for new accounts, and short-term trials.

A Region is a physical geographical location with multiple Availability Zones (AZs). An AZ consists of one or more discrete data centers with redundant power and networking in a Region.

Regions enable global reach and compliance with data residency laws. AZs provide high availability and fault tolerance; if one AZ fails, the others remain operational to sustain the application.

AWS is responsible for 'Security OF the Cloud' (hardware/infrastructure). The Customer is responsible for 'Security IN the Cloud' (data encryption, OS patching, IAM configurations, and network firewalls).

A web-based graphical user interface (GUI) used to manage and access AWS services. It is used for manual resource configuration, monitoring status, and managing billing details.

Primary monitoring is done through Amazon CloudWatch for metrics and logs. For API auditing, AWS CloudTrail is used, and AWS Trusted Advisor provides recommendations for best practices.

Tags are custom metadata in the form of key-value pairs assigned to AWS resources. They are used for cost allocation, resource organization, and automation of security policies.

1. On-Demand (pay-as-you-go). 2. Savings Plans (usage commitment). 3. Reserved Instances (capacity commitment). 4. Spot Instances (spare capacity at high discounts).

DevOps is the combination of cultural philosophies, practices, and tools that increases an organization's ability to deliver applications and services at high velocity through automation and collaboration.

Agile is a software development methodology focusing on iterative delivery and customer feedback. DevOps extends this by automating the integration, testing, and deployment processes between development and operations teams.

AWS provides fully managed services that automate manual tasks. Benefits include rapid scaling, pay-as-you-go pricing, programmable infrastructure via APIs, and strong security integration throughout the CI/CD pipeline.

IaC is the practice of managing and provisioning infrastructure through machine-readable definition files. In AWS, this is primarily done via AWS CloudFormation or the AWS Cloud Development Kit (CDK).

Popular tools include CodeCommit (Source), CodeBuild (Build), CodeDeploy (Deploy), CodePipeline (Orchestration), and CloudFormation (IaC).

A series of automated steps that take code from source to production. Continuous Integration (CI) automates builds/tests; Continuous Delivery/Deployment (CD) automates the release and environment update process.

Implementation uses AWS CodePipeline as the orchestrator. You connect a source (CodeCommit/GitHub), trigger CodeBuild for compilation/testing, and use CodeDeploy to push the artifacts to EC2, Lambda, or ECS.

Create a pipeline in CodePipeline. Define the source stage. Add a build stage with a buildspec.yml file for CodeBuild. Finally, add a deployment stage using an appspec.yml for CodeDeploy.

A fully managed continuous delivery service that automates the release process. It allows you to model, visualize, and automate the steps required to release your software changes.

To provide a consistent, automated release process that enables rapid and reliable delivery of features, bug fixes, and updates to production.

A fully managed build service that compiles source code, runs tests, and produces software packages ready for deployment, eliminating the need to manage your own build servers.

An automated deployment service that simplifies the process of releasing code to EC2, Lambda, or on-premises servers, supporting rolling updates and blue/green deployment strategies.

A secure, managed source control service that hosts private Git repositories. It integrates with IAM for granular access control and supports standard Git commands.

CodeCommit is a managed AWS service with native IAM integration and VPC support. GitHub is a third-party service with a larger community ecosystem and built-in project management features.

By creating a pipeline in CodePipeline. CodeCommit push triggers the pipeline; CodeBuild prepares the build, and CodeDeploy uses the CodeDeploy Agent on EC2 to pull and install the code.

Yes. Jenkins can use the AWS CLI or SDKs to pull from CodeCommit, or you can use SNS to send a trigger to the Jenkins server when a commit is pushed.

Examine deployment logs in the CodeDeploy console, check the CodeDeploy agent logs on the target instance, and verify the appspec.yml syntax and script permissions.

CodePipeline can trigger a build that updates the Lambda function code directly, or it can use CodeDeploy to handle traffic shifting between function versions (blue/green).

By setting up CloudWatch Events to trigger a pipeline on specific actions, and using CloudWatch Alarms to automatically roll back a deployment if error rates exceed thresholds.

Use IAM roles with 'least privilege', encrypt artifacts in S3 using KMS, enable MFA for pipeline changes, and use VPC endpoints for private resource communication.

By configuring a CodePipeline that has no manual approval steps. Once code passes all build and test phases, it is automatically pushed to production by CodeDeploy.

Amazon Elastic Compute Cloud (EC2) provides resizable computing capacity in the cloud. It allows you to launch virtual servers, manage storage, and configure security/networking for your apps.

It is a core compute service that provides virtual machines (instances) where you have full control over the OS and software stack.

A virtual server launched in the AWS cloud with a specific CPU, memory, storage, and operating system configuration.

A set of security credentials used to prove your identity when connecting to an instance. It consists of a public key stored by AWS and a private key file kept by the user.

CPU (vCPUs), RAM, Storage (Instance Store vs EBS), Network performance, and specific workloads (General Purpose, Compute Optimized, Memory Optimized, etc.).

EC2 is a virtual server where you manage the OS; it is billed by the second/hour. Lambda is serverless; you manage only the code, it scales automatically, and you are billed only per invocation.

By using AWS Auto Scaling. You define an Auto Scaling Group (ASG) with policies based on CPU usage or custom metrics that automatically add or remove instances as needed.

A serverless compute service that runs code in response to events and automatically manages the underlying compute resources for you.

When triggered by an event (like an S3 upload or HTTP request), Lambda provisions a container with your code, executes the logic, and then shuts down the container after completion.

The resource containing your code, its configuration (memory, timeout, execution role), and the specific triggers that invoke the execution.

Real-time file processing, data transformation, serverless website backends (API Gateway), automated backups, and running cron-like scheduled tasks.

Lambda scales horizontally by creating multiple concurrent execution environments. It automatically handles thousands of parallel requests without any manual configuration.

Execution timeout (15 minutes), temporary disk space (/tmp 10GB max), memory limits (10GB max), and payload size limits (6MB sync, 256KB async).

The latency seen when an idle function is triggered. AWS must initialize a new container and the code runtime, which adds delay compared to a previously 'warm' container.

Keep the deployment package small, use Provisioned Concurrency to keep environments warm, and avoid VPC attachment unless necessary (though VPC startup is faster now).

A feature that keeps a specified number of execution environments initialized and ready to respond immediately to invocations, eliminating cold start latency.

By using CloudWatch for metrics (Invocations, Duration, Errors, Throttles) and CloudWatch Logs to capture code output and runtime stack traces.

Allocate more memory (which also scales CPU), reuse database connections outside the handler, and use efficient runtimes like Go or Python over Java/C# for faster cold starts.

Scheduled functions run at fixed intervals via EventBridge (Cron). Event-driven functions run in response to resource changes (S3 upload, DynamoDB update, API call).

Lambda offers faster scaling and zero management but has resource/duration limits. Containers (ECS/EKS) offer more control and longer execution but require orchestration management.

An easy-to-use PaaS service for deploying and scaling web applications and services. You upload code, and it handles deployment, capacity provisioning, and load balancing.

It provides a 'pre-configured' environment for platforms like Java, .NET, PHP, Node.js, Python, and Ruby, simplifying the management of the underlying EC2/ELB infrastructure.

By using the EB CLI or the Management Console to upload a source bundle (.zip/.war). EB then creates an environment, provisions resources, and deploys the code.

Use nested stacks for modularity, avoid hard-coding IDs (use parameters/mappings), use Change Sets to preview updates, and keep templates under version control.

Lightweight, standalone, and executable packages that contain everything needed to run an application, including code, runtime, system tools, and libraries.

VMs include a full OS and hardware abstraction; they are heavy. Docker containers share the host's OS kernel and are much lighter, starting in seconds.

Using Amazon ECS (native, simple) or Amazon EKS (Kubernetes-based, complex). Both manage the lifecycle, scaling, and networking of your containers.

Elastic Container Service (ECS) is a highly scalable, fast, container management service that makes it easy to run and manage Docker containers on a cluster.

The smallest unit of deployment in ECS. It is an instantiation of a Task Definition (JSON) that runs one or more containers on a cluster.

A serverless way to run ECS tasks. You don't have to manage EC2 instances; you only pay for the CPU and memory resources requested by your containers.

By using Task Execution Roles (for ECS to pull images/logs) and Task Roles (for the container application to access other AWS services like S3 or DynamoDB).

Elastic Kubernetes Service (EKS) is a managed service that makes it easy to run Kubernetes on AWS without needing to install and operate your own control plane.

It provides a production-grade, highly available Kubernetes environment, managing the master nodes and etcd database automatically for you.

ECS is AWS-native and simpler to use. EKS is based on open-source Kubernetes, offering more flexibility and portability across clouds but with higher complexity.

Kubernetes is the open-source software. EKS is the AWS managed service that takes care of the installation, patching, and scaling of that software.

By using the 'kubectl' command-line tool to apply YAML configuration files or Helm charts to the cluster's API server.

Through 'IAM Roles for Service Accounts' (IRSA), allowing Kubernetes service accounts to be mapped to IAM roles for granular permissions at the pod level.

A simple command-line utility for creating and managing clusters on EKS. It automates much of the boilerplate CloudFormation work required to set up a cluster.

Simple Storage Service (S3) is an object storage service offering industry-leading scalability, data availability, security, and performance.

It stores data as objects within buckets. Features include 99.999999999% durability, lifecycle policies, versioning, and multiple storage classes for cost optimization.

Through the AWS Management Console, AWS CLI, SDKs, or by using Pre-signed URLs for secure, temporary uploads without requiring IAM credentials.

Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, and Glacier Deep Archive.

A feature that keeps multiple variants of an object in the same bucket. It protects against accidental deletion or overwriting by keeping the older versions.

When enabled, deleting an object adds a 'Delete Marker' rather than removing data. You can restore an object by deleting the marker or accessing specific version IDs.

It supports Server-Side Encryption (SSE-S3, SSE-KMS, SSE-C) and Client-Side Encryption, ensuring data is encrypted at rest and in transit.

Using IAM Policies (user-based), Bucket Policies (resource-based), and Access Control Lists (ACLs - object-based).

A JSON-based policy attached directly to a bucket that defines what actions are allowed/denied for specific users or accounts across the entire bucket.

By enabling versioning on source/destination buckets and setting up a replication rule that automatically copies objects to a bucket in another region.

An extremely low-cost S3 storage class designed for data archiving and long-term backup, where data retrieval times range from minutes to hours.

S3 Standard provides millisecond access for active data. Glacier is for 'cold' data with retrieval times ranging from 1 minute to 12 hours.

Elastic Block Store (EBS) provides block-level storage volumes for use with EC2 instances. It is similar to a virtual hard drive attached to a server.

General Purpose SSD (gp2/gp3), Provisioned IOPS SSD (io1/io2), Throughput Optimized HDD (st1), and Cold HDD (sc1).

EBS is block storage for a single instance. EFS is a managed file system (NFS) that can be shared across thousands of EC2 instances simultaneously.

S3 is object storage (infinitely scalable, accessible via URL). EBS is block storage (fixed size, must be attached to an EC2 instance to be used).

A serverless, set-and-forget file system that automatically grows and shrinks as you add or remove files, supporting the NFSv4 protocol.

Managed file systems for specific workloads: FSx for Windows File Server (SMB) and FSx for Lustre (High-performance computing).

To simplify the setup, operation, and scaling of relational databases in the cloud by automating tasks like patching, backups, and failover.

Relational Database Service (RDS) supports engines like MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server.

RDS is relational (SQL) for complex queries and joins. DynamoDB is NoSQL (Key-Value) for high-scale, low-latency applications with simple query patterns.

RDS is a managed version of standard database engines. Aurora is an AWS-native engine built for the cloud that is up to 5x faster than standard MySQL.

A MySQL and PostgreSQL-compatible relational database that provides the performance of commercial databases with the simplicity of open-source ones.

Standard, Memory Optimized, and Burstable classes, tailored for different workload requirements.

Use Read Replicas for read-heavy loads, enable Multi-AZ for high availability, and use Provisioned IOPS storage for high-performance disk access.

A fully managed NoSQL database service that provides fast and predictable performance with seamless scalability, handling over 10 trillion requests per day.

DynamoDB scales horizontally and is serverless. RDS scales vertically (mostly) and requires you to manage the database instance size.

A fully managed data warehouse service that uses SQL to analyze large datasets across your data warehouse, operational database, and data lake.

Business intelligence, complex analytical queries across petabytes of data, and high-performance data warehousing.

A fast, reliable, fully managed graph database service built to handle highly connected datasets (like social networks or fraud detection).

AWS Database Migration Service (DMS) helps migrate databases to AWS quickly and securely. The source database remains fully operational during the migration, minimizing downtime. It works by creating a replication instance that connects to the source and target, handles data format conversions, and synchronizes ongoing changes.

Common strategies include: 1. Lift and Shift (rehosting to EC2), 2. Replatforming (moving to RDS), 3. Homogeneous migration (same engine), and 4. Heterogeneous migration (different engines, using AWS Schema Conversion Tool/SCT).

A Virtual Private Cloud (VPC) is a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. You have complete control over your virtual networking environment, including selection of IP address range and creation of subnets.

It is a private network on the cloud that closely resembles a traditional network that you'd operate in your own data center. It provides advanced security features like Network ACLs and Security Groups to control inbound and outbound traffic.

VPC security is implemented through a multi-layered approach: 1. Network ACLs (stateless subnet-level firewalls), 2. Security Groups (stateful instance-level firewalls), 3. Flow Logs for auditing, and 4. Using Private Subnets for backend resources.

A Public Subnet has a route table entry to an Internet Gateway (IGW), allowing resources to communicate with the internet. A Private Subnet does not have a direct route to the IGW and typically uses a NAT Gateway for outbound-only internet access.

A subnet is a range of IP addresses in your VPC. You can launch AWS resources into a specific subnet. You use subnets to group resources based on security and operational requirements, such as separating web servers from databases.

An Internet Gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet. It serves two purposes: providing a target in your VPC route tables for internet-routable traffic, and performing network address translation (NAT).

A NAT (Network Address Translation) Gateway is a managed service that allows instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating a connection with those instances.

NAT Gateway is a managed AWS service that is highly available, scales automatically, and requires no administrative overhead. A NAT Instance is a single EC2 instance managed by the user, requiring manual patching, scaling, and high-availability configuration.

VPC Peering is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 or IPv6 addresses. Instances in either VPC can communicate with each other as if they are within the same network.

AWS Transit Gateway is a network transit hub that connects VPCs and on-premises networks. You would use it to simplify complex network topologies and centralize connectivity management as the number of VPCs grows, avoiding the complexity of full-mesh VPC peering.

High availability is achieved by: 1. Deploying resources across multiple Availability Zones (AZs), 2. Using Multi-AZ configurations for RDS/NAT Gateways, 3. Implementing Elastic Load Balancing (ELB) to distribute traffic, and 4. Setting up Auto Scaling Groups.

Elastic Load Balancing automatically distributes incoming application traffic across multiple targets, such as Amazon EC2 instances, containers, IP addresses, and Lambda functions. It handles the varying load of your application traffic in a single AZ or across multiple AZs.

The load balancer serves as the single point of contact for clients. It receives incoming traffic and routes it to registered healthy targets based on configured listeners and rules. It continuously monitors the health of its targets to ensure traffic is only sent to functional instances.

There are four types: 1. Application Load Balancer (Layer 7/HTTP/HTTPS), 2. Network Load Balancer (Layer 4/TCP/UDP/TLS), 3. Gateway Load Balancer (Third-party appliances), and 4. Classic Load Balancer (Legacy).

As mentioned, they include ALB for web traffic, NLB for extreme performance/static IPs, GLB for security virtual appliances, and CLB for older EC2-Classic applications.

ALB operates at Layer 7 (Application) and is best for HTTP/HTTPS traffic with advanced routing (path/host-based). NLB operates at Layer 4 (Transport), is optimized for millions of requests per second, supports static/Elastic IPs, and is best for TCP/UDP traffic.

ALB uses listeners and rules to route traffic. Rules can be based on the URL path (e.g., /api vs /images), host headers, HTTP headers, or query parameters. This allows for microservices architecture where different services handle different parts of an application.

SSL termination (or offloading) is the process of decrypting SSL/TLS traffic at the load balancer instead of the application servers. ELB integrates with AWS Certificate Manager (ACM) to manage certificates, reducing the CPU load on backend EC2 instances.

Sticky sessions (session affinity) are configured at the Target Group level. It uses a cookie to bind a user's session to a specific target instance, ensuring that all subsequent requests from that user during the session are sent to the same target.

Cross-Zone Load Balancing allows a load balancer node to distribute traffic evenly across all registered targets in all enabled Availability Zones, rather than just the targets in its own AZ. This ensures an even load distribution even if AZs have an unequal number of instances.

Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service. It is designed to give developers an extremely reliable and cost-effective way to route end users to internet applications by translating names (like www.example.com) into IP addresses.

Beyond DNS, it also handles domain registration and health checking of resources. It supports various routing policies such as Latency-based routing, Geo-location routing, Multi-value answer routing, and Failover routing for disaster recovery.

A bastion host (or jump box) is a special-purpose server on a network specifically designed and configured to withstand attacks. It is typically placed in a public subnet to provide secure shell (SSH) or Remote Desktop (RDP) access to instances in a private subnet.

AWS Site-to-Site VPN is an encrypted tunnel over the public internet; it is quick to set up but subject to internet variability. AWS Direct Connect is a dedicated physical fiber-optic connection between on-premises and AWS; it provides consistent bandwidth and lower latency but takes longer to provision.

Direct Connect is a cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS. Using industry-standard 802.1q VLANs, this dedicated connection can be partitioned into multiple virtual interfaces.

You would use it for large data migrations, high-bandwidth workloads, or when you require predictable network performance. It helps reduce network costs and increases bandwidth throughput while providing a more consistent network experience than internet-based connections.

AWS Global Accelerator is a networking service that improves the availability and performance of your applications with local or global users. It provides static IP addresses that act as a fixed entry point to your application endpoints (ALBs, NLBs, or EC2 instances) across multiple Regions.

Multi-region architecture is implemented using: 1. Route 53 (Latency or Failover routing), 2. S3 Cross-Region Replication, 3. RDS Read Replicas (cross-region), 4. DynamoDB Global Tables, and 5. Global Accelerator for optimized traffic entry.

AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-premises networks without exposing traffic to the public internet. Use cases include accessing SaaS applications privately and sharing internal services across VPCs without VPC peering.

Hybrid cloud is managed using Direct Connect or VPN for connectivity, AWS Storage Gateway for hybrid storage, AWS Outposts for running AWS infrastructure on-premises, and Systems Manager for unified resource management.

Auto Scaling is a method used in cloud computing where the amount of computational resources in a server farm, typically measured by the number of active servers, scales automatically based on the load on the farm.

AWS Auto Scaling monitors your applications and automatically adjusts capacity to maintain steady, predictable performance at the lowest possible cost. It can scale resources for multiple services including EC2, ECS, and DynamoDB.

Vertical scaling (Scaling Up) means increasing the capacity of a single resource (e.g., adding more RAM/CPU to an EC2). Horizontal scaling (Scaling Out) means adding more instances to the pool (e.g., adding more EC2 instances). Horizontal scaling is preferred for high availability.

A launch configuration is an instance configuration template that an Auto Scaling group uses to launch EC2 instances. It includes settings such as the ID of the AMI, the instance type, a key pair, and security groups. Note: AWS now recommends Launch Templates over Launch Configurations.

1. Deploy an ELB to distribute traffic across multiple AZs. 2. Create an Auto Scaling Group across the same AZs. 3. Configure the ASG to perform health checks using the ELB's status. 4. Define scaling policies to handle load spikes automatically.

High availability is ensured by removing single points of failure. This involves using Multi-AZ deployments, Load Balancers, Auto Scaling, and managed services (like S3/DynamoDB) that have built-in redundancy across different physical locations.

Elasticity is the ability to acquire resources as you need them and release them when you don’t. In AWS, this is primarily achieved through Auto Scaling, which allows your infrastructure to grow or shrink dynamically in response to real-time demand.

Stateful applications are handled by storing session data outside the instance (e.g., in ElastiCache or DynamoDB) or using 'Sticky Sessions' on an ELB. For persistent storage, EFS or EBS Multi-Attach can be used to ensure data remains consistent as instances scale.

Benefits include: 1. Consistent environment provisioning, 2. Version control for infrastructure, 3. Quick replication of setups across regions/accounts, 4. Simplified management of complex resource dependencies, and 5. Cost estimation of stacks before deployment.

Templates allow you to define your entire infrastructure as text files (YAML/JSON). This enables 'Infrastructure as Code', where you can treat your hardware setup just like software code: auditing changes, rolling back to previous versions, and automating deployments.

AWS CloudFormation is a service that gives developers and businesses an easy way to create a collection of related AWS and third-party resources, and provision them in an orderly and predictable fashion using templates.

It integrates with CI/CD pipelines to automate the 'Deploy' phase. DevOps teams can use CloudFormation to spin up temporary test environments, ensure that Production and Staging are identical, and manage 'Stack Sets' for multi-account deployments.

A stack is a single unit that manages a collection of AWS resources defined in a CloudFormation template. You can create, update, or delete a collection of resources by creating, updating, or deleting stacks.

Stacks are updated by submitting a modified template or new parameters. CloudFormation compares the new template with the existing stack and applies only the necessary changes. It is recommended to use 'Change Sets' to preview changes before executing them.

Yes. If CloudFormation cannot complete a stack creation or update, it automatically rolls back the stack to the last known stable state by deleting newly created resources or reverting modified ones.

Nested stacks are stacks created as part of other stacks. They allow you to create reusable infrastructure components (e.g., a standard VPC setup) that can be referenced from multiple templates, promoting modularity and reducing code duplication.

The purpose of an IAM role is to grant temporary permissions to AWS services or users without needing to share long-term security credentials (like access keys). Roles are assumed by entities such as EC2 instances, Lambda functions, or federated users.

AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources.

IAM roles are identities that you can create in your account that have specific permissions. An IAM role is similar to an IAM user, but it is not uniquely associated with one person. Instead, it is intended to be 'assumed' by anyone or anything that needs it.

An IAM policy is an object in AWS that, when associated with an identity or resource, defines their permissions. Policies are stored as JSON documents. They specify 'Effect' (Allow/Deny), 'Action' (API calls), and 'Resource' (ARN).

A security group acts as a virtual firewall for your EC2 instances to control incoming and outgoing traffic. Security groups are stateful—if you send a request from your instance, the response traffic is allowed regardless of inbound rules.

Best practices include: 1. Root account protection (MFA/no access keys), 2. Principle of Least Privilege, 3. Enabling CloudTrail and GuardDuty, 4. Rotating credentials regularly, and 5. Encrypting data at rest and in transit.

AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the cryptographic keys used to encrypt your data. It is integrated with most AWS services to handle data-at-rest encryption.

KMS is a shared multi-tenant service that is easy to manage. CloudHSM is a dedicated hardware security module (HSM) under your exclusive control, typically used for compliance requirements that mandate single-tenant hardware for key storage.

AWS Secrets Manager helps you protect secrets needed to access your applications, services, and IT resources. The service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.

The purpose is to remove hardcoded credentials from code. It provides built-in rotation for RDS and other databases and allows for secure, audited access to application secrets through API calls.

In serverless (Lambda), secrets are managed by retrieving them from Secrets Manager or Systems Manager Parameter Store at runtime. For performance, secrets should be cached outside the Lambda handler to avoid repeated API calls on every invocation.

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. It provides 'Standard' (free for all) and 'Advanced' (paid, with protection against sophisticated attacks) tiers.

AWS WAF (Web Application Firewall) helps protect your web applications from common web exploits (like SQL injection or cross-site scripting) that could affect application availability, compromise security, or consume excessive resources.

It is a Layer 7 firewall that lets you create security rules that block common attack patterns. You can deploy WAF on CloudFront, ALB, API Gateway, or AppSync.

At rest: Using KMS to encrypt S3, EBS, and RDS volumes. In transit: Using TLS/SSL certificates managed by ACM (AWS Certificate Manager) for load balancers and CloudFront.

By enforcing HTTPS across all communication channels. This includes using SSL/TLS for web traffic, using encrypted VPN tunnels, and enabling 'Encryption in Transit' features for services like EFS.

MFA (Multi-Factor Authentication) is implemented in IAM. You can require MFA for the Root account and all IAM users. It can be enforced via policies that deny API access unless the session is MFA-authenticated.

Glacier Vault Lock allows you to easily deploy and enforce compliance controls for individual S3 Glacier vaults. Once locked, the policy becomes immutable, ensuring that data cannot be deleted or modified until a retention period expires.

Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. It primarily targets EC2 instances, containers, and Lambda functions.

Security is implemented using: 1. IAM Permissions, 2. Cognito User Pools for authentication, 3. Lambda Authorizers for custom logic, 4. API Keys for usage throttling, and 5. WAF integration to block malicious requests.

Security for serverless (Lambda/API Gateway/S3) involves: 1. Granular IAM execution roles (per function), 2. VPC integration for private resources, 3. API Gateway authorization, and 4. Scanning code and dependencies for vulnerabilities.

Amazon CloudWatch is a monitoring and observability service built for DevOps engineers, developers, site reliability engineers (SREs), and IT managers. It provides data and actionable insights to monitor applications and respond to system-wide performance changes.

CloudWatch collects monitoring and operational data in the form of logs, metrics, and events. It allows you to visualize this data through dashboards, set alarms to react to thresholds, and automate responses to changes in your AWS resources.

Alarms watch a single metric over a specified time period and perform one or more actions based on the value of the metric relative to a threshold. Examples include sending an SNS notification or triggering an Auto Scaling policy.

CloudWatch Logs enables you to centralize the logs from all of your systems, applications, and AWS services that you use. You can then search, filter, and analyze these logs, or even generate metrics from them.

Amazon CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It records every API call made in your account (who, what, when, and from where).

It provides a complete history of API activity. If a resource is deleted or modified, CloudTrail logs identify the exact IAM user or role responsible. This is essential for security analysis and troubleshooting configuration changes.

AWS X-Ray helps developers analyze and debug distributed applications, such as those built using a microservices architecture. It provides a visual 'service map' to trace requests as they travel through different services and identify performance bottlenecks.

AWS Trusted Advisor is an online tool that provides real-time guidance to help you provision your resources following AWS best practices. It scans your account and makes recommendations in five categories: Cost Optimization, Security, Fault Tolerance, Performance, and Service Limits.

Monitoring provides visibility into the health and performance of the system, while logging provides the 'why' behind events. Without them, you cannot maintain high availability, optimize costs, or respond effectively to security incidents or operational failures.

Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service for both high-throughput, push-based, many-to-many messaging between distributed systems/microservices and one-to-one communication with users (SMS, Email, Mobile Push).

Amazon Simple Queue Service (SQS) is a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications. It stores messages until they are processed by a consumer.

SQS's role is to act as a buffer. It ensures that if a producer is faster than a consumer, the messages are not lost. It allows systems to be loosely coupled, so that one component's failure or latency doesn't bring down the whole application.

SNS follows the 'Pub/Sub' model (Push): one message can be sent to multiple subscribers simultaneously. SQS follows the 'Polling' model (Pull): a message is sent to a queue and typically processed by exactly one consumer at a time.

Stateless applications don't store client data on the server; every request contains all information needed. Stateful applications require the server to remember the user's previous interactions. Cloud architectures prefer statelessness to allow for easy horizontal scaling.

Event-driven architecture is handled using services like EventBridge (bus), SNS/SQS (messaging), and Lambda (execution). Events (e.g., a file upload) trigger 'rules' or 'notifications' which then execute specific functions, allowing services to react asynchronously.

Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds by using a network of 'Edge Locations'.

It caches content at edge locations to improve user experience. It also provides security features like WAF integration and Field-Level Encryption, and supports 'Lambda@Edge' to run code closer to the user.

Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale. It acts as the 'front door' for applications to access data, business logic, or functionality from backend services.

AWS Kinesis is a platform for streaming data on AWS. You use it to collect, process, and analyze real-time, streaming data (like website clickstreams, financial transactions, or IoT telemetry) so you can respond in real-time.

Kinesis consists of several capabilities: Data Streams (custom real-time apps), Data Firehose (loading data into S3/Redshift), and Video Streams. It is designed to handle terabytes of data per hour from hundreds of thousands of sources.

It is the easiest way to reliably load streaming data into data lakes, data stores, and analytics tools. It can capture, transform, and load streaming data into Amazon S3, Redshift, OpenSearch, and Splunk, enabling near-real-time analytics.

AWS Step Functions is a low-code, visual workflow service used to orchestrate AWS services, automate business processes, and build serverless applications. It uses state machines to coordinate multiple Lambda functions and other AWS resources.

Use Step Functions for an e-commerce checkout process: 1. Validate payment, 2. If success, update inventory, 3. Send confirmation email. If payment fails, it handles the 'retry' logic or triggers a 'refund' function automatically.

AWS Glue is a fully managed ETL (extract, transform, and load) service. It makes it simple and cost-effective to categorize data, clean it, enrich it, and move it reliably between various data stores and data streams.

It provides a Data Catalog for discovery and a serverless Spark environment to run transformation jobs. It is used to prepare data for analytics (e.g., preparing S3 data for analysis in Amazon Athena or Redshift).

AWS Data Pipeline is a web service that helps you reliably process and move data between different AWS compute and storage services, as well as on-premises data sources, at specified intervals.

Now called Amazon OpenSearch Service, it is used for real-time application monitoring, log analytics, and full-text search. It is frequently used as part of the ELK stack (Elasticsearch, Logstash, Kibana).

QuickSight is a fast, cloud-powered business intelligence service that makes it easy to deliver insights to everyone in your organization. It allows you to create and publish interactive BI dashboards that include ML-powered insights.

Amazon SageMaker is a fully managed service that provides every developer and data scientist with the ability to build, train, and deploy machine learning (ML) models quickly at scale.

Large-scale processing is handled using Amazon EMR (Hadoop/Spark clusters), AWS Glue (serverless ETL), Amazon Kinesis (streaming), and Amazon Redshift (data warehousing) depending on whether the data is batch or real-time.

Backups are performed using: 1. EBS Snapshots, 2. RDS Automated Backups, 3. S3 Versioning and Replication, and 4. AWS Backup (the centralized service for managing backups across services).

AWS Backup is a fully managed backup service that makes it easy to centralize and automate the back up of data across AWS services in the cloud as well as on premises using the AWS Storage Gateway.

DR is implemented via four main strategies: 1. Backup & Restore, 2. Pilot Light (core database running), 3. Warm Standby (scaled-down version), and 4. Multi-Site (Active-Active across regions).

Architecting for resilience involves designing for failure. This includes using Multi-AZ and Multi-Region deployments, implementing loose coupling via SQS, and using health checks with Route 53 to automatically redirect traffic from failed components.

Cost management involves using AWS Cost Explorer for visualization, AWS Budgets to set alerts, Cost and Usage Reports (CUR) for granular analysis, and identifying unutilized resources for deletion.

Optimization strategies: 1. Right-sizing instances, 2. Using Reserved Instances/Savings Plans, 3. Using Spot Instances for non-critical loads, 4. Scheduling instances to stop during off-hours, and 5. Using S3 Lifecycle policies to move data to cheaper storage.

Analysis is conducted by tagging all resources, using Cost Explorer to identify 'spend drivers', and utilizing the 'AWS Pricing Calculator' before deployment to estimate future costs based on expected usage.

Key considerations: 1. Application dependencies, 2. Compliance and regulatory requirements, 3. Data transfer volumes (Network vs Snowball), 4. TCO (Total Cost of Ownership) analysis, and 5. Migration strategy (the 7 R's).

AWS Snowball is a petabyte-scale data transport solution that uses physical storage devices to transfer large amounts of data between your on-premises storage and Amazon S3. It is used when internet-based migration is too slow or costly.

Compliance is ensured by using AWS Artifact for reports, AWS Config for resource auditing, CloudTrail for activity logs, and using 'compliant' regions or services that meet specific standards like HIPAA or PCI DSS.

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It provides a detailed view of the configuration history and allows for automated compliance checking against 'Config Rules'.

The Well-Architected Framework consists of six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability. It provides a consistent set of best practices to evaluate architectures.

It is a set of whitepapers and tools (Well-Architected Tool) designed to help cloud architects build the most secure, high-performing, resilient, and efficient infrastructure possible for their applications.

A typical 3-tier architecture: 1. Presentation Tier (S3/CloudFront or ALB), 2. Application Tier (EC2 Auto Scaling in Private Subnets), 3. Data Tier (RDS Multi-AZ). Tiers are separated by subnets and Security Groups for isolation.

Microservices break an application into small, independent services. AWS supports them via ECS/EKS (containers), Lambda (serverless), and API Gateway (entry point), using SQS/SNS for asynchronous communication between them.

Multi-account architecture is implemented using AWS Organizations. This allows for consolidated billing and logical separation of environments (Dev, Test, Prod) to minimize 'blast radius' and improve security boundaries.

The purpose is to centralize management, simplify billing, and enforce policies (Service Control Policies or SCPs) across multiple AWS accounts from a single master account.

Service discovery is implemented using AWS Cloud Map. It allows services to discover each other via custom names. It integrates with ECS and EKS to automatically register and deregister service instances as they scale.

A global application uses: 1. CloudFront for static content, 2. Global Accelerator for dynamic traffic, 3. Multi-Region active-active setup with Route 53, and 4. Global Databases like DynamoDB Global Tables or Aurora Global Database.

Considerations include: 1. Cold start latency, 2. Execution time limits, 3. Vendor lock-in, 4. Scalability benefits, and 5. Cost model (per request vs per hour). Serverless is ideal for event-driven, intermittent, or highly variable workloads.

Serverless apps are managed using the AWS SAM (Serverless Application Model) or the Serverless Framework. These tools provide CLI and templates to define Lambda, API Gateway, and DynamoDB resources as a single unit.

KPIs include: 1. Request Latency, 2. Error Rate (HTTP 5xx), 3. CPU/Memory Utilization, 4. Disk Throughput/IOPS, and 5. Throttling events in services like Lambda or DynamoDB.

Evaluation is done via the AWS Well-Architected Tool. Improvement involves identifying 'high-risk' findings and applying best practices like migrating to managed services, implementing Auto Scaling, or moving to a serverless model.

Systems Manager (SSM) is a management service that helps you automatically collect software inventory, apply OS patches, create system images, and configure Windows and Linux operating systems on EC2 and on-premises.

AWS Batch enables developers, scientists, and engineers to easily and efficiently run hundreds of thousands of batch computing jobs on AWS. It automatically provisions the optimal quantity and type of compute resources based on the specific requirements of the jobs.

AWS App Mesh is a service mesh that provides application-level networking. It gives you consistent visibility and network traffic controls for every microservice in an application, using the Envoy proxy to manage all communications.

AWS Control Tower provides the easiest way to set up and govern a new, secure, multi-account AWS environment based on best practices. It automates the creation of a 'landing zone' with guardrails for governance and security.

AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS. This helps achieve consistent governance and meet compliance requirements while enabling users to quickly deploy only the approved services they need.

Troubleshooting involves: 1. Analyzing CloudWatch metrics and logs, 2. Tracing requests with AWS X-Ray, 3. Checking Trusted Advisor for performance findings, 4. Using VPC Flow Logs to identify network latency, and 5. Reviewing EC2 'Status Checks'.

Considerations include the workload type (Compute vs Memory vs Storage intensive), the required network throughput, whether the load is consistent or burstable (T series), and the cost-performance balance of Graviton vs Intel/AMD processors.