AWS DVA-C02 β Visual Study Guide v2
Enhanced with ASCII diagrams & visual mnemonics for every confusing topic Built from comprehensive practice exam analysis β March 2026
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β AWS DEVELOPER ASSOCIATE (DVA-C02) EXAM MAP β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β
β βββββββββββ ββββββββββββ βββββββββββ βββββββββββ β
β βCOMPUTE β β STORAGE β β API & β βSECURITY β β
β β β β β βINTEGRATE β β β β
β β Lambda β β S3 β β API GW β β IAM β β
β β ECS β β DynamoDB β β SQS/SNS β β Cognito β β
β β StepFn β β β β Kinesis β β KMS β β
β ββββββ¬βββββ ββββββ¬ββββββ ββββββ¬ββββββ ββββββ¬βββββ β
β β β β β β
β ββββββββββββββ΄βββββββ¬βββββββ΄βββββββββββββββ β
β β β
β βββββββββ΄ββββββββ β
β β DEPLOY/CICD β β
β β CodeDeploy β β
β β CloudForm. β β
β β SAM / CDK β β
β β Beanstalk β β
β βββββββββ¬ββββββββ β
β β β
β βββββββββ΄ββββββββ β
β β MONITORING β β
β β CloudWatch β β
β β X-Ray β β
β βββββββββββββββββ β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββPART 1 β COMPUTE
1. AWS Lambda
1.1 Lambda Concurrency Model
βββββββββββββββββββββββββββββββββββββββββββ
β ACCOUNT CONCURRENCY POOL β
β (Default: 1000) β
βββββββββββββββββββββββββββββββββββββββββββ€
β β
β ββββββββββββββββ ββββββββββββββββ β
β β RESERVED β β RESERVED β β
β β Fn-A: 400 β β Fn-B: 200 β β
β β (guaranteed)β β (guaranteed)β β
β ββββββββββββββββ ββββββββββββββββ β
β β
β ββββββββββββββββββββββββββββββββββββ β
β β UNRESERVED POOL: 400 β β
β β (shared by ALL other functions) β β
β β AWS keeps min 100 unreserved! β β
β ββββββββββββββββββββββββββββββββββββ β
βββββββββββββββββββββββββββββββββββββββββββ
Formula: concurrent_executions = (invocations/sec) x (avg_duration_sec)
Example: 50 req/s x 100s = 5,000 concurrent executions β EXCEEDS 1000!
β Throttle (HTTP 429)
Fix Throttling:
ββββββββββββββββββββββββββββββββββββββββββββββββββββ
β 1. Request service quota increase β
β 2. Configure reserved concurrency per function β
β 3. Use exponential backoff in client β
β 4. Configure DLQ for async invocations β
ββββββββββββββββββββββββββββββββββββββββββββββββββββ1.2 Lambda Invocation Types β Visual
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β LAMBDA INVOCATION TYPES β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β
β ββ SYNCHRONOUS (RequestResponse) ββββββββββββββββββββββββββ β
β β β β
β β Client ββreqβββΆ Lambda βββββββΆ Response βββΆ Client β β
β β (blocks) (waits) β β
β β Used by: API Gateway, ALB, SDK invoke() β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β ββ ASYNCHRONOUS (Event) βββββββββββββββββββββββββββββββββββ β
β β β β
β β Client ββreqβββΆ [Queue] βββΆ Lambda β β
β β βββ202βββ (retries 2x on failure) β β
β β β β
β β βββββ On final failure βββββ β β
β β β βΌ DLQ (SQS or SNS) β β β
β β ββββββββββββββββββββββββββββ β β
β β Used by: S3, SNS, EventBridge, CloudFormation β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β ββ POLL-BASED (Event Source Mapping) ββββββββββββββββββββββ β
β β β β
β β [SQS/Kinesis/DynamoDB] βββpollββ Lambda Service β β
β β β β β
β β invokes Lambda sync β β
β β DLQ goes on SOURCE QUEUE (not Lambda) β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β ββ DRY RUN ββββββββββββββββββββββββββββββββββββββββββββββββ β
β β Validates params & permissions WITHOUT executing β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ1.3 Lambda Execution Lifecycle
COLD START (new container)
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β β
β ββββββββββββββββ βββββββββββββββββββββββββββββββ β
β β INIT PHASE β β INVOKE PHASE β β
β β β β β β
β β β’ Download β β handler(event, context) { β β
β β code ββββΆβ // your logic here β β
β β β’ Start β β } β β
β β runtime β β β β
β β β’ Run init β β β² context.log_stream_name β β
β β code β
β β β² context.aws_request_id β β
β ββββββββββββββββ βββββββββββββββββββββββββββββββ β
β β
= DB connections, SDK clients, cached data β
β These PERSIST across warm invocations! β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
WARM START (reuses container)
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β INIT PHASE: SKIPPED! INVOKE PHASE: Runs handler β
β β
β /tmp still has cached files (512 MB free, max 10 GB) β
β DB connections from INIT still alive β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β
OPTIMIZATION: Put expensive setup OUTSIDE the handler!1.4 Lambda Memory = CPU Scaling
Memory (MB) CPU Power Network
βββββββββββββββββββββββββββββββββββββββββ
128 ββ Low
512 βββββ Medium
1769 βββββββββββββ = 1 vCPU High
3538 βββββββββββββββββ 2 vCPU Very High
10240 ββββββββββββββββββββββββ Max
β‘ You CANNOT set CPU directly β only memory!
β‘ Increase memory β more CPU β faster execution
β‘ Max timeout: 15 minutes (900 seconds)1.5 Lambda Layers & Deployment
ββββββββββββββββββββββββββββββββββββββββ
β Lambda Function β
β βββββββββββββββββββββββββββββββ β
β β Your Code (handler) β β Deployment Limits:
β βββββββββββββββββββββββββββββββ€ β β’ Zip: 50 MB (compressed)
β β Layer 1: numpy β β β’ Unzipped: 250 MB total
β βββββββββββββββββββββββββββββββ€ β (function + all layers)
β β Layer 2: pandas β β β’ Max 5 layers per function
β βββββββββββββββββββββββββββββββ€ β
β β Layer 3: custom-utils β β Layers extract to /opt/
β βββββββββββββββββββββββββββββββ β
ββββββββββββββββββββββββββββββββββββββββ
CloudFormation Inline Code (ZipFile):
ββββββββββββββββββββββββββββββββββββββββ
β ZipFile: | β
β def handler(event, context): β Only Node.js & Python!
β return "hello" β Auto-names file "index"
β β Accepts SOURCE CODE,
β β NOT a zip file path β not a zip file path!
β β NOT for Java, Go, C# β
ββββββββββββββββββββββββββββββββββββββββ1.6 Lambda + VPC
DEFAULT (no VPC config):
ββββββββββββββββββββββββββββββββββββββββββββββ
β Lambda βββββββΆ Internet βββΆ AWS APIs β
β
β βββΆ Private RDS β β
ββββββββββββββββββββββββββββββββββββββββββββββ
WITH VPC CONFIG:
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β VPC β
β βββββββββββββββ β
β β Lambda βββENIβββΆ Private Subnet βββΆ RDS β
β
β β β β
β β β Creates β Need NAT Gateway for internet: β
β β ENIs β Lambda βββΆ NAT GW βββΆ Internet β
β β β NOT β β
β β Elastic IPsβ β Adds cold start latency! β
β βββββββββββββββ Only use when needed! β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββLambda β Pitfall Cheat Sheet
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β LAMBDA PITFALL BUSTER β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β β "Install X-Ray daemon on Lambda" β
β β
Just enable the checkbox / set TracingConfig: Active β
β β
β β "Lambda creates Elastic IPs in VPC" β
β β
Creates ENIs (Elastic Network Interfaces) β
β β
β β "Set concurrency to false" β
β β
Set to 0 (number) to throttle all invocations β
β β
β β "Use InvokeAsync API" β
β β
Use Invoke with InvocationType: "Event" β
β β
β β "Timeout error = throttling" β
β β
Timeout = runs too long; Throttle = too many running β
β β
β β "log_stream_name from Event object" β
β β
It's from the Context object β
β β
β β "AWSLambdaBasicExecutionRole" via resource-based policy β
β β
Attach to the execution role, not resource policy β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ1.7 Lambda Function URLs
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β LAMBDA FUNCTION URLs β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β
β Dedicated HTTPS endpoint β NO API Gateway needed! β
β Format: https://<url-id>.lambda-url.<region>.on.aws β
β β
β AUTH TYPES: β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β β β
β β AWS_IAM β NONE β β
β β ββββββββββββββββββββββββββββββββββββββββββββββββ β β
β β Only IAM-signed β Anyone on internet can invoke β β
β β requests (SigV4) β (publicly accessible) β β
β β β β β
β β Use for: β Use for: β β
β β β’ Internal svc β β’ Third-party WEBHOOKS β
β β
β β β’ Cross-account β β’ Public callbacks β β
β β β β’ Simple public APIs β β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β WEBHOOK PATTERN (exam favorite!): β
β ββββββββββββββββ HTTPS + signature ββββββββββββββββββββ β
β β Third-Party β in headers β Lambda Function β β
β β Platform βββββββββββββββββββββββΆβ URL (NONE) β β
β β (Stripe, β β β β
β β GitHub...) β β 1. Read header β β
β ββββββββββββββββ β 2. Verify sig β β
β β 3. Execute logic β β
β β Platform CANNOT sign AWS SigV4 ββββββββββββββββββββ β
β β So AWS_IAM auth WILL NOT work β
β β
Use NONE + validate signature IN Lambda code β
β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β
β Function URL vs API Gateway: β
β ββββββββββββββββββββββββββββ¬ββββββββββββββββββββββββββββββ β
β β Lambda Function URL β API Gateway β β
β ββββββββββββββββββββββββββββΌββββββββββββββββββββββββββββββ€ β
β β Free (Lambda cost only) β Per-request charges β β
β β Minimal setup β More setup (stages, etc.) β β
β β Auth: IAM or NONE only β IAM, Cognito, Lambda Auth, β β
β β β API Keys β β
β β No caching β Built-in caching β
β β
β β No throttling/quotas β Usage plans + throttle β
β β
β β No WAF β WAF integration β
β β
β β No request transforms β Mapping templates β
β β
β β No custom domain β Custom domains β
β β
β ββββββββββββββββββββββββββββ΄ββββββββββββββββββββββββββββββ β
β β
β β
"Webhook + public HTTPS + least effort" = Function URL β
β β
"Caching, throttling, WAF, transforms" = API Gateway β
β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β
β EXAM TRAP β Don't confuse these: β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β FunctionUrlAuthType = WHO can call the URL β β
β β (NONE = public, IAM = signed) β β
β β β β
β β CodeSigningConfig = Trust check on DEPLOYMENT β β
β β packages (NOT HTTP requests!) β β
β β β β
β β Lambda Authorizer = API Gateway ONLY feature β β
β β (NOT available on Function URLs)β β
β β β β
β β Cognito Authorizer = API Gateway ONLY feature β β
β β (NOT available on Function URLs)β β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β β "Function URL + AWS_IAM for third-party webhook" β
β β
Third-party can't sign SigV4 β use NONE + custom check β
β β
β β "Function URL + CodeSigningConfigArn condition" β
β β
CodeSigning = code packages, NOT request validation β
β β
β β "API Gateway + Lambda Authorizer for webhook" β
β β
Works but NOT least effort (2 components vs 1) β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ2. Amazon ECS
2.1 Task Placement Strategies β Visual
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β ECS TASK PLACEMENT STRATEGIES β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β
β BINPACK (Cost Optimization β pack tightly) β
β ββββββββββββββββββββββββββββββββββββββββββ β
β β Instance A Instance B β β
β β ββββββββββββ ββββ β β
β β βT1ββT2ββT3β βT4β Instance C: β
β β
β β ββββββββββββ ββββ (empty=save $) β β
β ββββββββββββββββββββββββββββββββββββββββββ β
β {"type":"binpack","field":"memory"} β
β β
β SPREAD (High Availability β distribute evenly) β
β ββββββββββββββββββββββββββββββββββββββββββ β
β β AZ-a AZ-b AZ-c β β
β β ββββββββ ββββββββ ββββββββ β β
β β βT1ββT4β βT2ββT5β βT3ββT6β β β
β β ββββββββ ββββββββ ββββββββ β β
β ββββββββββββββββββββββββββββββββββββββββββ β
β {"type":"spread","field":"attribute:ecs.availability-zone"} β
β β
β β spread by instanceId = per instance (NOT per AZ!) β
β β
β RANDOM (Least Config β still honors constraints) β
β ββββββββββββββββββββββββββββββββββββββββββ β
β β Instance A Instance B Instance C β β
β β ββββ ββββββββ ββββ β β
β β βT3β βT1ββT4β βT2β Β―\_(γ) β β
β β ββββ ββββββββ ββββ β β
β ββββββββββββββββββββββββββββββββββββββββββ β
β {"type":"random"} β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ2.2 Task Role vs Execution Role
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β ECS TASK β
β β
β ββββββββββββββββββββ ββββββββββββββββββββββββ β
β β EXECUTION ROLE β β TASK ROLE β β
β β (infrastructure) β β (application logic) β β
β β β β β β
β β β’ Pull images β β β’ Call S3 APIs β β
β β from ECR β β β’ Write to DynamoDB β β
β β β’ Push logs to β β β’ Publish to SNS β β
β β CloudWatch β β β’ Any AWS service β β
β β β’ Access secrets β β your app needs β β
β β β β β β
β β WHO: ECS agent β β WHO: Your container β β
β ββββββββββββββββββββ ββββββββββββββββββββββββ β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
X-Ray on ECS:
βββββββββββββββββββββββββββββββββββββββββββ
β Task Definition β
β ββββββββββββ βββββββββββββββββββββ β
β β App β β X-Ray Daemon β β
β β Containerβ β (sidecar) β β
β β ββββ UDP port 2000 !! β β
β β β β NOT TCP β β
β ββββββββββββ βββββββββββββββββββββ β
β IAM: AWSXRayDaemonWriteAccess β
βββββββββββββββββββββββββββββββββββββββββββ2.3 Container Instance Lifecycle Gotcha
Terminate in RUNNING state:
βββββββββββββββββββββ ββββββββββββββ
β Container InstanceββββββΆβ AUTO β β
No action needed
β (RUNNING) β β deregisteredβ
βββββββββββββββββββββ ββββββββββββββ
Terminate in STOPPED state:
βββββββββββββββββββββ ββββββββββββββββββββββββββ
β Container InstanceββββββΆβ STILL IN CLUSTER! β β Ghost instance
β (STOPPED) β β Must MANUALLY deregisterβ
βββββββββββββββββββββ β via ECS Console/CLI β
ββββββββββββββββββββββββββ3. AWS Step Functions
3.1 State Types β Visual Map
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β STEP FUNCTIONS STATE TYPES β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β β
β ββββββββββββ β
β β START β β
β ββββββ¬ββββββ β
β βΌ β
β ββββββββββββ Do work (Lambda, ECS, Batch, etc.) β
β β TASK ββββ The ONLY state that runs processes β
β ββββββ¬ββββββ synchronously (one after another) β
β βΌ β
β ββββββββββββ Branch based on input conditions β
β β CHOICE ββββΆ if/else routing β
β ββββ¬ββββ¬ββββ β
β βΌ βΌ β
β ββββββββββββ Delay for seconds or until timestamp β
β β WAIT β β
β ββββββ¬ββββββ β
β βΌ β
β ββββββββββββ Run branches concurrently (async) β
β β PARALLEL ββββΆ Each branch independent β
β ββββββ¬ββββββ β
β βΌ β
β ββββββββββββ Iterate over array items β
β β MAP ββββΆ Dynamic parallel processing β
β ββββββ¬ββββββ ItemsPath selects the array β
β βΌ β
β ββββββββββββ Pass-through (inject data / debug) β
β β PASS β Cannot do work! β
β ββββββ¬ββββββ β
β βΌ β
β ββββββββββββ ββββββββββββ β
β β SUCCEED β β FAIL β Terminal states β
β ββββββββββββ ββββββββββββ (no retries from Fail!) β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ3.2 Input/Output Processing Pipeline
This is the #1 most confusing Step Functions topic!
Raw Input
β
βΌ
ββββββββββββ Filters what part of input the state sees
βInputPath β e.g., "$.order" β state only sees the order object
ββββββ¬ββββββ
βΌ
ββββββββββββ Reshapes input, adds static values
βParametersβ e.g., {"orderId.$": "$.id", "source": "web"}
ββββββ¬ββββββ
βΌ
ββββββββββββ
β STATE β Does work β produces a RESULT
ββββββ€ββββββ
βΌ
βββββββββββββ Filters/transforms the raw result
βResultSelectorβ
ββββββ¬βββββββ
βΌ
ββββββββββββ β
WHERE to put the result relative to input
βResultPathβ
ββββββ¬ββββββ "$.taskResult" β input.taskResult = result
β "$" β result REPLACES entire input
βΌ null β result DISCARDED, input passes through
ββββββββββββ
βOutputPathβ Final filter on what goes to next state
ββββββ¬ββββββ
βΌ
Output to Next State
β
β
β
EXAM KEY: ResultPath is the one that COMBINES input + result β
β
β
3.3 Error Handling: Retry + Catch
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β TASK STATE β
β β
β "Retry": [ Retry FIRST β
β { β
β "ErrorEquals": ["States.Timeout"], β
β "IntervalSeconds": 3, βββ wait before 1st retry β
β "MaxAttempts": 2, βββ try 2 more times β
β "BackoffRate": 2.0 βββ 3s, 6s, 12s... β
β } β
β ] β
β β
β "Catch": [ Then CATCH β
β { β
β "ErrorEquals": ["States.ALL"], β
β "Next": "HandleError", βββ fallback state β
β "ResultPath": "$.error" βββ preserve input + β
β } error info β
β ] β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
Flow: Error β Retry (up to MaxAttempts) β still failing β Catch β Next state
Retry + Catch are in state machine definition, NOT application code!PART 2 β STORAGE
4. Amazon S3
4.1 Server-Side Encryption Decision Tree
"How should I encrypt objects in S3?"
βββββββββββββββββββββββββ
β Who manages the keys? β
βββββββββββββ¬ββββββββββββ
β
βββββββββββββββββββΌβββββββββββββββββββ
βΌ βΌ βΌ
βββββββββββ ββββββββββββ ββββββββββββ
β AWS S3 β β AWS KMS β β CUSTOMER β
β manages β β manages β β provides β
ββββββ¬βββββ ββββββ¬ββββββ ββββββ¬ββββββ
βΌ βΌ βΌ
βββββββββββ ββββββββββββ ββββββββββββ
β SSE-S3 β β SSE-KMS β β SSE-C β
βββββββββββ ββββββββββββ ββββββββββββ
Header: Header: Headers (ALL 3 required):
x-amz-server-side- x-amz-server-side- x-amz-server-side-encryption-
encryption: AES256 encryption: aws:kms customer-algorithm: AES256
x-amz-server-side-encryption-
Optional: customer-key: <base64-key>
x-amz-server-side- x-amz-server-side-encryption-
encryption-aws-kms- customer-key-MD5: <md5>
key-id: <ARN>
(omit = default key)
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β ENFORCE encryption via bucket policy: β
β Deny s3:PutObject unless header present β
β β Action is s3:PutObject, NOT s3:PostObject β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ4.2 SSE-KMS Throttling β Why Performance Drops
Normal S3 uploads (SSE-S3):
Client ββPutObjectβββΆ S3 ββ(encrypts internally)βββΆ Stored β
Fast!
S3 with SSE-KMS:
Client ββPutObjectβββΆ S3 ββGenerateDataKeyβββΆ KMS ββkeyβββΆ S3 βββΆ Stored
β
Counts against KMS quota!
(5,500 - 30,000 API ops/sec per region)
100,000+ objects/sec uploads βββΆ EXCEEDS KMS quota βββΆ THROTTLED!
β‘ This is the #1 cause of SSE-KMS performance degradation
β‘ S3 itself does NOT throttle β it's the KMS API quota
β‘ Fix: Request KMS quota increase, or use SSE-S3 if KMS not required4.3 CORS β When You Need It
SAME ORIGIN (no CORS needed):
ββββββββββββββββββββ ββββββββββββββββββββ
β Website: ββββββββββΆβ Same S3 Bucket β β
β bucket-a.s3... β β bucket-a.s3... β
ββββββββββββββββββββ ββββββββββββββββββββ
CROSS ORIGIN (CORS required!):
ββββββββββββββββββββ ββββββββββββββββββββ
β Website: ββββJSββββΆβ Different S3 β β Blocked!
β bucket-a.s3... β fetch β bucket-b.s3... β
ββββββββββββββββββββ ββββββββββββββββββββ
Fix: Configure CORS on bucket-b:
{
"AllowedOrigins": ["https://bucket-a.s3..."],
"AllowedMethods": ["GET"],
"AllowedHeaders": ["*"]
}
S3 website ββJSβββΆ API Gateway (non-proxy Lambda)?
Fix: Enable CORS on API Gateway (not S3!)
S3 website ββJSβββΆ API Gateway (Lambda proxy)?
Fix: Return CORS headers FROM the Lambda function itself!5. Amazon DynamoDB
5.1 RCU/WCU Calculation β Visual Formula
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β DynamoDB CAPACITY CALCULATOR β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β
β READ CAPACITY UNITS (RCU): β
β βββββββββββββββββββββββββ β
β β
β 1 RCU = 1 strongly consistent read/sec for items β€ 4 KB β
β = 2 eventually consistent reads/sec for items β€ 4 KB β
β β
β Formula: β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β β β
β β reads/sec Γ ceil(item_size / 4 KB) β β
β β RCU = ββββββββββββββββββββββββββββββββββββββ β β
β β consistency_factor β β
β β β β
β β Strongly Consistent: factor = 1 β β
β β Eventually Consistent: factor = 2 βββ HALF cost β β
β β Transactional: factor = 0.5 βββ DOUBLE cost β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β EXAMPLE: 150 eventually consistent reads/sec, item = 3.5 KB β
β ββββββββ β
β Item rounds up: ceil(3.5/4) = 1 β
β RCU = 150 Γ 1 / 2 = 75 RCU β
β
β β
β EXAMPLE: 10 strongly consistent reads/sec, item = 6 KB β
β ββββββββ β
β Item rounds up: ceil(6/4) = 2 β
β RCU = 10 Γ 2 / 1 = 20 RCU β
β
β β
β WRITE CAPACITY UNITS (WCU): β
β ββββββββββββββββββββββββββ β
β 1 WCU = 1 write/sec for items β€ 1 KB β
β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β WCU = writes/sec Γ ceil(item_size / 1 KB) β β
β β Transactional: multiply by 2 β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ5.2 GSI vs LSI β Side by Side
βββββββββββββββββββββββββββββ¬ββββββββββββββββββββββββββββββ
β LOCAL SECONDARY β GLOBAL SECONDARY β
β INDEX (LSI) β INDEX (GSI) β
βββββββββββββββββββββββββββββΌββββββββββββββββββββββββββββββ€
β β β
β SAME partition key β DIFFERENT partition key β
β DIFFERENT sort key β DIFFERENT sort key β
β β β
β Created at TABLE β Created ANYTIME β
β CREATION only β β β
β β β
β Shares TABLE's β Has OWN provisioned β
β read/write capacity β read/write capacity β
β β β GSI WCU must be β₯ β
β β base table WCU! β
β β β
β Strong OR Eventually β EVENTUALLY consistent β
β consistent β ONLY β
β β β
β Max: 5 per table β Max: 20 per table β
β 10 GB per partition key β No size limit β
β β β
β Use when you need a β Use when you need to β
β different sort order on β query by a completely β
β same partition key β different attribute β
βββββββββββββββββββββββββββββ΄ββββββββββββββββββββββββββββββ
β‘ ProvisionedThroughputExceededException on writes?
β Check if GSI write capacity < base table write capacity!5.3 DynamoDB Streams + Lambda Architecture
ββββββββββββββββ ββββββββββββββββββββββββ βββββββββββββββββ
β DynamoDB β β DynamoDB Stream β β Lambda β
β Table ββββββΆβ βββββββ Function β
β β β ββββββββββββββββ βpoll β β
β INSERT βββββββββββΆβ βR1ββR2ββR3ββR4β ββββββΆβ Process β
β UPDATE βββββββββββΆβ ββββββββββββββββ β β changes β
β DELETE βββββββββββΆβ β β β
β β β 24-hour retention β β β IAM Role: β
ββββββββββββββββ β β β AWSLambda β
β StreamViewType: β β DynamoDB β
β β’ KEYS_ONLY β β ExecutionRoleβ
β β’ NEW_IMAGE β βββββββββββββββββ
β β’ OLD_IMAGE β
β β’ NEW_AND_OLD_IMAGES β
ββββββββββββββββββββββββ
β If Lambda runs less than once per 24h β DATA LOSS (records expire!)
β Lambda polls synchronously (event source mapping)
β Create event source mapping, not SNS subscription5.4 Query vs Scan β Visual
TABLE: Users
ββββββββββββ¬βββββββββββ¬βββββββββ¬βββββββββββ
β PK β SK β Name β Status β
β (userId) β (date) β β β
ββββββββββββΌβββββββββββΌβββββββββΌβββββββββββ€
β U001 β 2026-01 β Alice β active β βββ QUERY finds this
β U001 β 2026-02 β Alice β active β βββ instantly with PK
β U002 β 2026-01 β Bob β inactive β
β U003 β 2026-01 β Carol β active β
β U003 β 2026-02 β Carol β active β
β ... β ... β ... β ... β βββ 1 million rows
ββββββββββββ΄βββββββββββ΄βββββββββ΄βββββββββββ
QUERY (PK = "U001"): SCAN (no filter):
β’ Reads 2 items β
β’ Reads ALL 1M items β
β’ Fast, efficient β’ Slow, expensive
β’ Uses partition key β’ Full table read
β’ Returns matching items β’ Filter applied AFTER read
β‘ ALWAYS use Query when you know the partition key
β‘ To optimize Scan: use parallel scan with rate limiting
β‘ Reduce page size (Limit parameter) to lower impact5.5 DAX vs ElastiCache
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β When to use DAX vs ElastiCache? β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β β
β DAX (DynamoDB Accelerator) β
β ββββββββββββββββββββββββββββββββββββββββ β
β β β’ Sits IN FRONT of DynamoDB β β
β β β’ Drop-in replacement (same API) β β
β β β’ Microsecond reads β β
β β β’ Eventually consistent ONLY β β
β β β’ Best for: read-heavy DynamoDB β β
β β workloads with hot keys β β
β ββββββββββββββββββββββββββββββββββββββββ β
β App βββΆ DAX ββ(cache miss)βββΆ DynamoDB β
β β
β ElastiCache (Redis/Memcached) β
β ββββββββββββββββββββββββββββββββββββββββ β
β β β’ General-purpose cache β β
β β β’ Your app manages cache logic β β
β β β’ Supports complex data types β β
β β β’ Can cache aggregated/computed data β β
β β β’ Best for: computed results, β β
β β session data, multi-source caching β β
β ββββββββββββββββββββββββββββββββββββββββ β
β App βββΆ ElastiCache ββ(cache miss)βββΆ compute/query β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ5.6 Transactions vs Batch Operations
TransactWriteItems (all-or-nothing):
βββββββββββββββββββββββββββββββββββββββββββ
β Put item A ββ β
β Update B ββββΆ ALL succeed or NONE β ATOMIC β
β Delete C β β Supports UpdateItem β
β Check D ββ (up to 25 actions) β 2x WCU cost
βββββββββββββββββββββββββββββββββββββββββββ
BatchWriteItem (best-effort):
βββββββββββββββββββββββββββββββββββββββββββ
β Put item A βββΆ Success β
β Put item B βββΆ FAIL (in Unprocessed) β NOT atomic β
β Delete C βββΆ Success β NO UpdateItem β
β (up to 25 items) β Lower cost
βββββββββββββββββββββββββββββββββββββββββββ
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β BATCH OPERATIONS β UnprocessedKeys/Items (exam favorite!) β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β
β BatchGetItem returns PARTIAL results when: β
β β’ Response exceeds 16 MB limit β
β β’ Provisioned throughput exceeded β
β β’ > 1 MB per partition requested β
β β’ Internal processing failure β
β β
β Unread items returned in: UnprocessedKeys β
β (BatchWriteItem uses: UnprocessedItems) β
β β
β HOW TO HANDLE: β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β β
Exponential backoff + jitter (random delay) β β
β β wait = base * 2^attempt + random(0, base) β β
β β Reduces call frequency, avoids thundering β β
β β herd, gives server time to recover β β
β β β β
β β β
Use AWS SDK (has built-in retry logic!) β β
β β SDK automatically retries with backoff β β
β β No custom retry code needed β β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β WRONG APPROACHES: β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β β Immediately retry β still throttled, fails β β
β β β Increase RCUs β partial results still happen β β
β β due to 16 MB size limit (not just throughput)β β
β β β Create GSI β doesn't change batch behavior β β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β LIMITS: β
β BatchGetItem: 100 items, 16 MB max β
β BatchWriteItem: 25 items, 16 MB max β
β Transactions: 100 items, 4 MB max (all-or-nothing) β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββPART 3 β API & INTEGRATION
6. Amazon API Gateway
6.1 Integration Types
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β API GATEWAY INTEGRATION TYPES β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β β
β LAMBDA PROXY (most common) β
β ββββββββββββββββββββββββββββββββββββββββββββββββ β
β β Client βββΆ API GW ββraw requestβββΆ Lambda β β
β β β β β
β β Lambda MUST return: βΌ β β
β β { β β
β β "statusCode": 200, β β
β β "headers": {...}, βββ wrong format β β
β β "body": "..." = 502 error! β β
β β } β β
β ββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β LAMBDA CUSTOM (mapping templates) β
β ββββββββββββββββββββββββββββββββββββββββββββββββ β
β β Client βββΆ API GW ββtransformedβββΆ Lambda β β
β β β β β
β β Mapping Template Mapping β β
β β (request transform) Template β β
β β (response) β β
β β β
Use for SOAPβREST, XMLβJSON transforms β β
β β β
CORS configured in API GW console β β
β ββββββββββββββββββββββββββββββββββββββββββββββββ β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ6.2 Error Codes β What They Mean
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β API GATEWAY ERROR DECODER β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β β
β Client ββrequestβββΆ API Gateway βββΆ Lambda / Backend β
β β β
β 4xx = CLIENT error β 5xx = SERVER error β
β β β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β 400 Bad Request β Malformed request β β
β β 403 Forbidden β WAF filtered / IAM denied β β
β β 429 Too Many Reqs β Throttled (usage plan/account) β β
β ββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββ€ β
β β 502 Bad Gateway β Lambda returned WRONG format β β
β β β (not JSON proxy response) β β
β β 503 Unavailable β Service temporarily unavailable β β
β β 504 Gateway Timeoutβ Backend > 29 second timeout β β
β ββββββββββββββββββββββββ΄ββββββββββββββββββββββββββββββββββ β
β β
β β
502 = fix Lambda response format β
β β
504 = reduce Lambda execution time or increase timeout β
β β
All endpoints are HTTPS ONLY (no HTTP support!) β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ6.3 Caching & Invalidation
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β API GATEWAY CACHING β
β β
β Client ββGET /itemsβββΆ [CACHE] ββHITβββΆ Cached Response β
β β β
β MISS β
β β β
β βΌ β
β Lambda/Backend β
β β β
β Response stored in cache β
β (TTL: 300s default, max 3600s) β
β β
β INVALIDATE CACHE: β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β Header: Cache-Control: max-age=0 β β
β β β NOT "Cache-Control: no-cache" β β
β β β β
β β Requires IAM permission: β β
β β execute-api:InvalidateCache β β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β Metrics (only visible when caching ENABLED): β
β β’ CacheHitCount β
β β’ CacheMissCount β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ6.4 Authentication Decision Tree
"How should I authenticate API Gateway?"
ββββββββββββββββββββββββββββββββββββ
β What kind of caller? β
ββββββββββββββββ¬ββββββββββββββββββββ
β
βββββββββββββΌβββββββββββββ¬βββββββββββββββββ
βΌ βΌ βΌ βΌ
IAM user/ Bearer Headers + Cognito
role? token? query params? users?
β β β β
βΌ βΌ βΌ βΌ
AWS_IAM Lambda Lambda Cognito
+ Resource Authorizer Authorizer User Pool
Policy (TOKEN) (REQUEST) Authorizer
(for cross-
account)
β API Keys = IDENTIFICATION only, NOT authorization!
β Usage Plans + API Keys = throttling + quotas + monetization6.5 Stages & Stage Variables
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β API GATEWAY STAGES β
β β
β Same API, different stages: β
β β
β /prod ββstage var: fn=AccountService:v1βββΆ Lambda v1 β
β β
β /beta ββstage var: fn=AccountService:v2βββΆ Lambda v2 β
β β
β β
Internal team tests on /beta β
β β
Users continue on /prod β
β β
Promote by updating stage variable β
β β
β URLs: β
β https://{id}.execute-api.{region}.amazonaws.com/prod/ β
β https://{id}.execute-api.{region}.amazonaws.com/beta/ β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ7. Amazon SQS
7.1 Message Lifecycle β Visual
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β SQS MESSAGE LIFECYCLE β
β β
β Producer Queue Consumer β
β ββββββββ βββββ ββββββββ β
β β
β SendMessage βββΆ [msg visible in queue] β
β β β
β ReceiveMessage βββββββββββββΆ Consumer gets msg β
β β β β
β ββββββ΄βββββββββββββββ β β
β β VISIBILITY TIMEOUT β Processing... β
β β (default: 30s) β β β
β β msg INVISIBLE β β β
β β to other consumers β β β
β ββββββ¬βββββββββββββββ β β
β β β β
β βββββββββββ΄βββββββββββ ββββββββββββ΄ββββββββ β
β β Timeout EXPIRES β β DeleteMessage β β
β β before delete? β β (success!) β β
β β β β msg removed β
β β
β β msg becomes β ββββββββββββββββββββ β
β β VISIBLE AGAIN β β β
β β = duplicate! β β
β ββββββββββββββββββββββ β
β β
β β
Set visibility timeout β₯ max processing time β
β β
For Lambda: visibility timeout β₯ 6x Lambda timeout β
β β
β After N failed attempts βββΆ Dead Letter Queue (DLQ) β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ7.2 Standard vs FIFO
βββββββββββββββββββββββββββ¬ββββββββββββββββββββββββββββββ
β STANDARD β FIFO β
βββββββββββββββββββββββββββΌββββββββββββββββββββββββββββββ€
β Unlimited throughput β 300 TPS (3,000 w/ batch) β
β At-least-once β Exactly-once β
β Best-effort ordering β Strict FIFO ordering β
β No deduplication β Content-based OR β
β β MessageDeduplicationId β
β β (5-min dedup interval) β
β Queue name: anything β Queue name MUST end β
β β with .fifo β
βββββββββββββββββββββββββββΌββββββββββββββββββββββββββββββ€
β Use for: β Use for: β
β β’ High throughput β β’ Financial transactions β
β β’ Duplicates OK β β’ Order matters β
β β’ Simple decoupling β β’ No duplicates β
βββββββββββββββββββββββββββ΄ββββββββββββββββββββββββββββββ8. Amazon Kinesis Data Streams
8.1 Resharding β Visual
SPLIT SHARD (increase capacity β costs more)
ββββββββββββββββββ ββββββββββββββ
β Hot Shard β βββββββΆβ Child A β More throughput
β (overloaded) β ββββββββββββββ€
β β βββββββΆβ Child B β
ββββββββββββββββββ ββββββββββββββ
MERGE SHARDS (decrease capacity β save money)
ββββββββββββββββββ
β Cold Shard A β βββ ββββββββββββββ
β (underused) β βββββΆβ Merged β Less cost
ββββββββββββββββββ€ β β Shard β
β Cold Shard B β βββ ββββββββββββββ
β (underused) β
ββββββββββββββββββ
β‘ Split HOT shards, Merge COLD shards
β‘ Default retention: 24 hours (max 365 days)
β‘ PutRecord + SequenceNumberForOrdering = strict order
β‘ PutRecords (batch) does NOT guarantee orderPART 4 β SECURITY & IDENTITY
9. AWS KMS β Envelope Encryption
9.1 The Full Flow (Most Tested Topic!)
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β ENVELOPE ENCRYPTION β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β
β ENCRYPT: β
β ββββββββ β
β β
β Step 1: Call GenerateDataKey API β
β ββββββββββββ ββββββββββββββββββββββββββββ β
β β Your βββGenerateDataKeyβββΆβ AWS KMS β β
β β App β β β β
β β βββββββββββββββββββ β Returns TWO things: β β
β β β ββββββββββββββββ β 1. Plaintext data key β β
β β β β Plaintext β β 2. Encrypted data key β β
β β β β Data Key π β β (encrypted with CMK) β β
β β β ββββββββββββββββ€ ββββββββββββββββββββββββββββ β
β β β β Encrypted β β
β β β β Data Key π β β
β β β ββββββββββββββββ β
β ββββββββββββ β
β β
β Step 2: Encrypt your data with PLAINTEXT key β
β βββββββββββββββ π ββββββββββββββββββββ β
β β Your Data βββencryptβββΆβ Encrypted Data β β
β β (plaintext) β β (ciphertext) β β
β βββββββββββββββ ββββββββββββββββββββ β
β β
β Step 3: β
β
β
ERASE plaintext key from memory! β
β
β
β
β (This is the critical security step) β
β β
β Step 4: Store together: β
β ββββββββββββββββββββββββββββββββββββββββ β
β β Encrypted Data + Encrypted Key π β β S3, disk, etc. β
β ββββββββββββββββββββββββββββββββββββββββ β
β β
β β
β DECRYPT: β
β ββββββββ β
β β
β Step 1: Send encrypted data key to KMS β
β ββββββββββββ ββββββββββββββββββββββββββββ β
β β Your βββDecrypt APIβββββββΆβ AWS KMS β β
β β App β (encrypted keyπ) β β β
β β βββββββββββββββββββ β Returns: β β
β β β Plaintext key π β Plaintext data key β β
β ββββββββββββ ββββββββββββββββββββββββββββ β
β β
β Step 2: Decrypt your data with plaintext key β
β ββββββββββββββββββββ π βββββββββββββββ β
β β Encrypted Data βββdecryptββΆβ Your Data β β
β ββββββββββββββββββββ βββββββββββββββ β
β β
β Step 3: β
β
β
ERASE plaintext key from memory! β
β
β
β
β β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β KMS can only directly encrypt β€ 4 KB β
β β For larger data β MUST use envelope encryption β
β β NEVER encrypt with the ciphertext key β
β β ERASE the plaintext key, NOT the encrypted key β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ9.2 KMS vs CloudHSM
ββββββββββββββββββββββββββββ¬βββββββββββββββββββββββββββ
β AWS KMS β AWS CloudHSM β
ββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββ€
β Multi-tenant HSMs β Single-tenant HSMs β
β AWS manages HSMs β YOU manage HSMs β
β Symmetric + Asymmetric β Full control of keys β
β FIPS 140-2 Level 2 β FIPS 140-2 Level 3 β
β
β Integrated with 100+ β Custom key store for KMS β
β AWS services β β
β β Use for: β
β Use for: most cases β β’ Regulatory compliance β
β β β’ RSA key generation β
β β β’ Exclusive HSM control β
ββββββββββββββββββββββββββββ΄βββββββββββββββββββββββββββ10. Amazon Cognito
10.1 User Pools vs Identity Pools β The Big Picture
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β COGNITO ARCHITECTURE β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β USER POOL β β
β β (Authentication) β β
β β β β
β β User ββsign up/sign inβββΆ User Pool β β
β β β β β
β β Returns: β β
β β β’ ID Token (user identity) β β
β β β’ Access Token (API access) β β
β β β’ Refresh Token β β
β β β β
β β Features: β β
β β β’ User directory (username/password) β β
β β β’ Social login (Google, Facebook, Apple) β β
β β β’ MFA, adaptive authentication β β
β β β’ Hosted UI (customizable with logo) β β
β β β’ β Cannot grant AWS service credentials β β
β βββββββββββββββββββββββββββββ¬ββββββββββββββββββββββββββββββ β
β β β
β Token passed to β
β β β
β βΌ β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β IDENTITY POOL β β
β β (Authorization) β β
β β β β
β β Token βββΆ Identity Pool βββΆ STS βββΆ Temp AWS Creds β β
β β β β
β β Features: β β
β β β’ Exchanges tokens for AWS credentials β β
β β β’ β
Unauthenticated (guest) access β β
β β β’ β
Federated (Google, Facebook, SAML, OIDC) β β
β β β’ β
Developer-authenticated identities β β
β β β’ Maps to IAM roles (auth vs unauth) β β
β β β’ Returns Cognito ID for unique user identification β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β EXTERNAL IdP + IDENTITY POOL (mobile app federation): β
β βββββββββββββ OAuth/OIDC ββββββββββββββββ returns β
β β Identity β token β Identity β COGNITO ID β
β β Provider ββββββββββββββΆβ Pool βββββββββββββΆ β
β β (Google, β β β (unique user ID) β
β β Facebook β ββββββββββββββββ β β
β β SAML...) β βΌ β
β βββββββββββββ GetCredentialsForIdentityβ
β β β
β Temp AWS Credentials β
β (S3, DynamoDB, SNS...) β
β β
β β
"What is returned?" β COGNITO ID (not key pair/SDK/API) β
β β
Cognito ID = unique identifier across all IdPs β
β β
Cognito Key Pair, Cognito SDK, Cognito API = distractors! β
β β
β COGNITO SYNC: Cross-device data sync (key-value) β
β β’ Max 1 MB/dataset, 20 datasets/identity β
β β’ Push sync for notifications β
β β’ β AppSync (multi-user real-time collaboration) β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
EXAM CHEAT:
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β "User sign-up / sign-in" β User Pool β
β "Temporary AWS credentials" β Identity Pool β
β "Guest / unauthenticated access" β Identity Pool β
β "Social login + access S3" β User Pool + Id Pool β
β "API Gateway authorizer" β User Pool (NOT IdP!) β
β "Cross-device sync (single user)" β Cognito Sync β
β "Multi-user real-time shared" β AppSync β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ10.2 User Pool vs Identity Pool for API Gateway β Deep Dive
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β β
β
β
#1 EXAM TRAP: User Pool vs Identity Pool β
β
β
β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β
β FLOW 1: User Pool + API Gateway (MOST COMMON EXAM PATTERN) β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β User ββsign inβββΆ User Pool ββJWTβββΆ Browser/App β
β β β
β stores JWT in β
β localStorage β
β β β
β Authorization: <JWT> β
β β β
β βΌ β
β ββββββββββββββββββββββββββββββββββββ β
β β API GATEWAY β β
β β ββββββββββββββββββββββββββββββ β β
β β β COGNITO USER POOL β β β
β β β AUTHORIZER β β β
β β β β β β
β β β β’ Validates JWT natively β β β
β β β β’ NO Lambda needed! β β β
β β β β’ Token source: header nameβ β β
β β β (e.g., "Authorization") β β β
β β β β’ Uses User Pool ID β β β
β β ββββββββββββββββββββββββββββββ β β
β ββββββββββββββββββββββββββββββββββββ β
β β
β Steps: β
β 1. Create Cognito User Pool β
β 2. Create authorizer in API GW using User Pool ID β
β 3. Set header name (token source) pointing to User Pool β
β β Identity Pool is NOT needed for this flow! β
β β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β FLOW 2: Identity Pool + Direct AWS Access (DIFFERENT USE CASE) β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β User ββsign inβββΆ User Pool ββJWTβββΆ Identity Pool β
β β β
β exchanges JWT for β
β temp AWS credentials β
β (via STS AssumeRole) β
β β β
β βΌ β
β ββββββββββββββββββββββββ β
β β AWS Services DIRECTLY β β
β β β’ S3.putObject() β β
β β β’ DynamoDB.getItem() β β
β β β’ SNS.publish() β β
β ββββββββββββββββββββββββ β
β β
β β Identity Pool does NOT have a native API GW authorizer! β
β β If you MUST use Identity Pool tokens with API GW: β
β β Use a Lambda Authorizer (not Cognito Authorizer) β
β β But this is rarely the correct exam answer β
β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β
β EXAM DECISION MATRIX: β
β ββββββββββββββββββββββββββββββββββββ¬βββββββββββββββββββββββββ β
β β Question Pattern β Answer β β
β ββββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββ€ β
β β JWT authorizer for API Gateway β User Pool β β
β β React/JS app + JWT + API GW β User Pool β β
β β Token source header for API GW β User Pool authorizer β β
β β Cognito authorizer in API GW β Uses User Pool ID β β
β β App calls S3/DDB from browser β Identity Pool β β
β β Guest access to AWS resources β Identity Pool β β
β β Federated access to AWS APIs β Identity Pool β β
β β Identity Pool + API Gateway? β Lambda Authorizer β β
β ββββββββββββββββββββββββββββββββββββ΄βββββββββββββββββββββββββ β
β β
β β
"Header token source" + "API Gateway" = ALWAYS User Pool β
β β
"Temporary AWS credentials" = ALWAYS Identity Pool β
β β
Identity Pool has NO native API Gateway integration β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ11. IAM β Key Patterns
11.1 STS API Quick Reference
ββββββββββββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββββ
β STS API β When to Use β
ββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€
β AssumeRole β Cross-account, role switch β
β AssumeRoleWithWebIdentity β OIDC federation (Google..) β
β AssumeRoleWithSAML β SAML 2.0 (Active Directory) β
β GetSessionToken β MFA-protected API calls β
β
β GetFederationToken β Proxy apps for temp creds β
β DecodeAuthorizationMessage β Decode UnauthorizedOp error β
ββββββββββββββββββββββββββββββββββ΄βββββββββββββββββββββββββββββββ
β
GetSessionToken is the ONLY one that supports MFA!
Custom Identity Broker (non-SAML LDAP):
ββββββββββββ βββββββββββββ ββββββββ
β User ββββββββΆβ Broker ββββββββΆβ STS ββββΆ Temp Creds
β (LDAP) β auth β (your app)β assumeβ β
ββββββββββββ βββββββββββββ role ββββββββ11.2 Cross-Account Access Pattern
ββββββββββββββββββββββββ ββββββββββββββββββββββββ
β PRODUCTION ACCOUNT β β DEVELOPMENT ACCOUNT β
β β β β
β 1. Create IAM Role β β 3. Create IAM Policyβ
β Trust: Dev Acct β β Allow: sts: β
β β β AssumeRole β
β 2. Attach S3 access β β on Prod Role ARN β
β policy to Role β β β
β β β 4. Attach to Dev β
β S3 Bucket βββββββββββββββββββββββ IAM Users β
ββββββββββββββββββββββββ assumes ββββββββββββββββββββββββ
role
β Role created in account WITH the resource (Production)
β STS policy created in account NEEDING access (Development)PART 5 β DEPLOYMENT & CI/CD
12. AWS CodeDeploy
12.1 Deployment Types by Platform
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β CODEDEPLOY DEPLOYMENT MATRIX β
ββββββββββββββββ¬βββββββββββββββ¬βββββββββββββββ¬βββββββββββββββββββββ€
β Platform β In-Place β Blue/Green β Agent Required? β
ββββββββββββββββΌβββββββββββββββΌβββββββββββββββΌβββββββββββββββββββββ€
β EC2 β β
β β
β β
YES (required) β
β On-Premises β β
β β β β
YES (required) β
β Lambda β β β β
(always) β β NO β
β ECS β β β β
(always) β β NO β
ββββββββββββββββ΄βββββββββββββββ΄βββββββββββββββ΄βββββββββββββββββββββ
β
CodeDeploy Agent:
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β β’ Must be installed & running on EC2 / On-Premises instances β
β β’ Agent polls CodeDeploy for deployment instructions β
β β’ Can be installed via SSM Run Command (at scale) β
β β’ NOT needed for Lambda or ECS (managed by AWS) β
β β’ DownloadBundle error? β Check agent is running + β
β instance role has S3 permissions β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
EC2/On-Prem Lifecycle Hooks:
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β # Hook β Managed By β Scriptable in AppSpec β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β 1 ApplicationStop β User (AppSpec) β β
YES β
β 2 DownloadBundle β AGENT ONLY β
β β NO β never! β
β 3 BeforeInstall β User (AppSpec) β β
YES β
β 4 Install β AGENT ONLY β
β β NO β never! β
β 5 AfterInstall β User (AppSpec) β β
YES β
β 6 ApplicationStart β User (AppSpec) β β
YES β
β 7 ValidateService β User (AppSpec) β β
YES β
β β
β β
DownloadBundle + Install are AGENT-MANAGED: β
β You CANNOT configure or write scripts for them in AppSpec! β
β Any answer saying "configure DownloadBundle in AppSpec" = β β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
DownloadBundle Failures:
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β "UnknownError: not opened for reading" β
β ββββββββββββββββββββββββββββββββββββββββ β
β Root cause: EC2 instance IAM profile lacks S3 read permissions β
β Fix: Add s3:Get*, s3:List* to the instance profile/role β
β β
β Exam traps (all WRONG answers for this error): β
β β "S3 versioning not enabled" β NOT required for CodeDeploy β
β β "Not supported in this region" β Works in ALL regions β
β β "Wrong AppSpec config for DownloadBundle" β
β β DownloadBundle is AGENT-MANAGED, not in AppSpec! β
β β
β β
CORRECT: Instance IAM profile missing S3 permissions β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ12.2 Traffic Shifting (Lambda / ECS)
CANARY (two increments):
ββββββββββββββββββββββββββββββββββββββββ
Time 0: ββββββββββ 10% β new version
Time +5m: ββββββββββ 100% β new version (if healthy)
LINEAR (equal increments):
ββββββββββββββββββββββββββββββββββββββββ
Time 0: ββββββββββ 10%
Time +10m: ββββββββββ 20%
Time +20m: ββββββββββ 30%
...gradually until 100%
ALL-AT-ONCE:
ββββββββββββββββββββββββββββββββββββββββ
Time 0: ββββββββββ 100% immediately
Automatic Rollback:
βββββββββββββββββββββββββββββββββββββββββββββ
β Deployment fails β CodeDeploy redeploys β
β last known good version with NEW β
β deployment ID (not restored old one) β
βββββββββββββββββββββββββββββββββββββββββββββ12.3 Manual Approval (CodePipeline)
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β CODEPIPELINE MANUAL APPROVAL β
β β
β Source βββΆ Build βββΆ ββββββββββββββββ βββΆ Deploy β
β β MANUAL β β
β β APPROVAL βΈ β β
β ββββββββββββββββ β
β β
β β
Add a Manual Approval action between stages β
β β
Pipeline PAUSES until approved or rejected (or times out) β
β β
Configurable timeout (default: 7 days) β
β β
Can send SNS notification to approvers β
β β
IAM permission needed: codepipeline:PutApprovalResult β
β β
β Use cases: β
β β’ Gate production deployments for human review β
β β’ Require sign-off before deploying to sensitive environments β
β β’ Compliance / change-management approvals β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ13. CloudFormation & SAM
13.1 SAM CLI Workflow
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β SAM DEPLOYMENT FLOW β
β β
β sam init sam build sam deploy β
β ββββββββββ ββββββββββ ββββββββββββββββββββ β
β βScaffoldββββββββΆβInstall ββββββββΆβPackage (zip+S3) β β
β βproject β βdeps & β β+ Deploy via β β
β βtemplateβ βartifactsβ β CloudFormation β β
β ββββββββββ ββββββββββ ββββββββββββββββββββ β
β β
β β sam deploy = package + deploy (combined!) β
β β sam init NOT needed if project already exists β
β β
β CloudFormation CLI equivalent: β
β aws cloudformation package β aws cloudformation deploy β
β (two separate commands needed!) β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β‘ SAM requires: Transform: AWS::Serverless-2016-10-31
β‘ Cross-stack refs: Export in Outputs + Fn::ImportValue
β‘ Dynamic SSM refs: {{resolve:ssm-secure:paramName:version}}13.2 CloudFormation Helper Scripts
EC2 Instance Bootstrap:
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β β
β cfn-init βββββββΆ Install packages, create files, β
β start services (from metadata) β
β β β
β cfn-signal βββββΆ "Hey CloudFormation, I'm ready!" β
β (signals WaitCondition/CreationPolicy) β
β β β
β cfn-hup ββββββββΆ Daemon that detects metadata changes β
β and re-runs cfn-init β
β β β
β cfn-get-metadata βΆ Retrieve metadata from template β
β β
β β
Use cfn-init for repeatable setup (not user-data alone) β
β β
cfn-signal confirms instance provisioned successfully β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ13.3 AWS CDK
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β CDK: Infrastructure as CODE (Python, TypeScript...) β
β CloudFormation: Infrastructure as TEMPLATE (YAML/JSON)β
β β
β CDK Workflow: β
β Write code βββΆ cdk synth βββΆ CloudFormation templateβ
β (compile) βββΆ cdk deploy β
β β
β β
cdk bootstrap: FIRST command in new account/regionβ
β (creates S3 bucket for assets) β
β NoSuchBucket error? β Run cdk bootstrap! β
β β
β Local testing with SAM: β
β cdk synth βββΆ sam local invoke (specify template) β
β β
β β
β
β
CDK + SAM LOCAL TESTING (exam favorite!) β
β
β
β
β β
β Step 1: cdk synth --stack MyStack β
β ββββΆ cdk.out/MyStack.template.json β
β β
β Step 2: sam local invoke \ β
β -t cdk.out/MyStack.template.json \ β
β MyFunctionLogicalId β
β ββββΆ Spins Docker, invokes Lambda locally β
β β
β β
NEEDED: cdk synth + sam local invoke β
β β NOT needed: cdk bootstrap (deployment infra!) β
β β NOT needed: sam package (S3 upload, not local!) β
β β NOT needed: sam deploy / cdk deploy (deploys!) β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββ14. Elastic Beanstalk
14.1 Deployment Strategies Comparison
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β BEANSTALK DEPLOYMENT STRATEGIES β
ββββββββββββββββ¬βββββββββββ¬ββββββββββ¬ββββββββββββ¬ββββββββββββββββββ€
β β Downtime β Speed β Capacity β Rollback β
ββββββββββββββββΌβββββββββββΌββββββββββΌββββββββββββΌββββββββββββββββββ€
β All-at-once β YES β β Fastest β Reduced β Manual redeploy β
β Rolling β No β Medium β Reduced β β Manual redeploy β
β Rolling+Batchβ No β Medium β Full β
β Manual redeploy β
β Immutable β No β Slower β Full β
β Terminate new β
β
β Blue/Green β No β Variableβ Full β
β CNAME swap β
β
ββββββββββββββββ΄βββββββββββ΄ββββββββββ΄ββββββββββββ΄ββββββββββββββββββ
Blue/Green: Best for major platform upgrades (Java 7β8)
Immutable: Best for quick rollback without CNAME complexity
Config files:
ββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β .ebextensions/*.config β Custom AWS resources β
β env.yaml β Environment manifest β
β Dockerrun.aws.json β Multi-container Docker β
β cron.yaml β Periodic worker tasks β
β .ebextensions/xray.config β Enable X-Ray daemon β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββPART 6 β MONITORING & OBSERVABILITY
15. AWS X-Ray β Deep Dive
15.1 X-Ray Anatomy (Most Confusing Topic!)
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β X-RAY TRACE β
β β
β A TRACE = end-to-end journey of a single request β
β β
β βββββββββββββββββββββ TRACE βββββββββββββββββββββββββββββ β
β β β β
β β βββββββββ SEGMENT (API Gateway) βββββββββββββββ β β
β β β Service: API Gateway β β β
β β β Duration: 1.2s β β β
β β β Status: 200 β β β
β β ββββββββββββββββββββββββββββββββββββββββββββββββ β β
β β β β β
β β βΌ β β
β β βββββββββ SEGMENT (Lambda) ββββββββββββββββββββ β β
β β β Service: MyFunction β β β
β β β Duration: 0.8s β β β
β β β β β β
β β β ββββ SUBSEGMENT (DynamoDB call) βββββ β β β
β β β β Namespace: aws β β β
β β β β Operation: PutItem β β β
β β β β Duration: 0.05s β β β
β β β β Table: Orders β β β
β β β ββββββββββββββββββββββββββββββββββββββ β β
β β β β β
β β β ββββ SUBSEGMENT (HTTP call) βββββββββ β β
β β β β Namespace: remote β β β
β β β β URL: https://api.stripe.com β β β
β β β β Duration: 0.3s β β β
β β β ββββββββββββββββββββββββββββββββββββββ β β
β β β β β
β β β ββββ SUBSEGMENT (custom) ββββββββββββ β β
β β β β Name: "sendRequest" βββ YOUR β β β
β β β β Duration: 0.4s arbitrary β β β
β β β β subsegment β β β
β β β ββββββββββββββββββββββββββββββββββββββ β β
β β β β β
β β ββββββββββββββββββββββββββββββββββββββββββββββββ β β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β NAMESPACE tells you the type of downstream call: β
β β’ "aws" β AWS SDK call (DynamoDB, S3, SQS) β
β β’ "remote" β External HTTP API call β
β β’ (none) β Custom subsegment (your own code) β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ15.2 Annotations vs Metadata
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β ANNOTATIONS vs METADATA β
βββββββββββββββββββββββββββββββ¬ββββββββββββββββββββββββββββββββββββ€
β ANNOTATIONS β METADATA β
βββββββββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββββ€
β Key-value pairs β Key-value pairs β
β Values: strings/numbers β Values: ANY type (objects, lists)β
β β β
β β
INDEXED for search β
β β NOT indexed β
β β β
β Can filter traces in β Cannot filter or search β
β console & GetTraceSummariesβ Just stored with trace β
β β β
β Use for: grouping traces, β Use for: storing debug data β
β searching by customer_id, β you DON'T need to search by β
β environment, version β β
βββββββββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββββ€
β xray.putAnnotation( β xray.putMetadata( β
β "userId", "U123") β "response", {...}) β
βββββββββββββββββββββββββββββββ΄ββββββββββββββββββββββββββββββββββββ
Trace Analysis APIs:
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β GetTraceSummaries β Filter by annotations β
β Returns trace IDs β
β β
β BatchGetTraces β Get FULL traces by ID β
β No filtering capability β
β β
β Flow: GetTraceSummaries (filter) β BatchGetTraces β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ15.3 X-Ray Service Map
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β X-RAY SERVICE MAP β
β β
β ββββββββββ βββββββββββ ββββββββββββ β
β β Client βββββββΆβ API GW βββββββΆβ Lambda β β
β β β 1.2s β 200 OK β 0.8s β Function β β
β ββββββββββ βββββββββββ ββββββ¬ββββββ β
β β β
β ββββββββββββΌβββββββββ β
β βΌ βΌ βΌ β
β ββββββββββ ββββββββββ βββββββββ β
β βDynamoDBβ β S3 β βStripe β β
β β 50ms β β 120ms β β 300ms β β
β β β
β β β
β β β slowβ β
β ββββββββββ ββββββββββ βββββββββ β
β β
β β
Visual representation of your distributed application β
β β
Shows latency, error rates, request counts per service β
β β
Helps identify which downstream service is the bottleneckβ
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ15.4 X-Ray IAM Policies
WHO needs WHAT policy?
ββββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββββββββββ
β Role β Policy Needed β
ββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββ€
β X-Ray daemon on EC2 β AWSXRayDaemonWriteAccess β
β X-Ray on ECS sidecar β AWSXRayDaemonWriteAccess β
β X-Ray on Beanstalk β AWSXRayDaemonWriteAccess β
β Lambda with X-Ray β Just enable! (auto-configured) β
β View service map/ β AWSXrayReadOnlyAccess β
β traces in console β β
β Custom debug tool β GetTraceSummaries + BatchGetTracesβ
β Full access β AWSXrayFullAccess β
ββββββββββββββββββββββββββ΄βββββββββββββββββββββββββββββββββββββ16. CloudWatch
16.1 Embedded Metric Format (EMF)
Traditional approach (complex):
Lambda ββPutMetricData APIβββΆ CloudWatch Metrics (extra code!)
EMF approach (simple):
Lambda ββstructured logβββΆ CloudWatch Logs ββauto-extractβββΆ Metrics!
{
"_aws": {
"Timestamp": 1234567890,
"CloudWatchMetrics": [{
"Namespace": "MyApp",
"Dimensions": [["Service"]],
"Metrics": [{"Name": "ProcessingTime", "Unit": "Milliseconds"}]
}]
},
"Service": "PaymentService",
"ProcessingTime": 150 βββ This becomes a CloudWatch metric!
}
β
Use Amazon's open-source EMF libraries (not Lambda Insights)
β
Automatically extracts custom metrics from structured logs
β
Can set alarms on the extracted metricsPART 7 β CACHING STRATEGIES
17. ElastiCache Patterns
17.1 Lazy Loading vs Write-Through vs Write-Behind
LAZY LOADING (Cache-Aside):
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β β
β App ββGETβββΆ Cache ββHITβββΆ Return data β
β
β β β
β MISS β
β β β
β βΌ β
β Database ββdataβββΆ App β
β β β
β Write to cache β
β for next time β
β β
β β
Only requested data cached (no waste) β
β β Cache miss = slow (3 trips) β
β β Data can be STALE β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
WRITE-THROUGH:
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β β
β App ββWRITEβββΆ Cache ββANDβββΆ Database β
β (simultaneously) β
β β
β App ββREADβββΆ Cache ββHIT (always!)βββΆ Return β
β
β β
β β
Data always FRESH β
β β Write penalty (write to cache AND DB) β
β β Caches ALL data (even data never read = waste) β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β
BEST PRACTICE: Write-Through + TTL
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Write-Through ensures freshness β
β TTL auto-expires unread data β prevents waste β
β = FRESH data + MINIMAL waste β
β
β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ17.2 Redis vs Memcached
ββββββββββββββββββββββββββββ¬ββββββββββββββββββββββββββ
β REDIS β MEMCACHED β
ββββββββββββββββββββββββββββΌββββββββββββββββββββββββββ€
β β
Replication (Multi-AZ)β β No replication β
β β
Persistence (AOF/RDB) β β No persistence β
β β
Complex data types β Simple key-value only β
β (lists, sets, sorted) β β
β β
Pub/Sub messaging β β
Multi-threaded β
β Single-threaded β β
Large cache pools β
β β β
β Use for: β Use for: β
β β’ HA with failover β β’ Simple caching β
β β’ Data must survive β β’ Max throughput needed β
β restarts β β’ Data loss acceptable β
β β’ Leaderboards, queues β β
ββββββββββββββββββββββββββββ΄ββββββββββββββββββββββββββPART 8 β QUICK REFERENCE TABLES
18. Service Limits & Defaults
ββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββββββββββββββββ
β Service β Key Limits β
ββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββ€
β Lambda β 15 min timeout, 10 GB memory β
β β 1,000 concurrent (soft), 250 MB unzipped β
β β /tmp: 512 MB free, max 10 GB β
β β 5 layers, max 5 env vars size 4 KB β
ββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββ€
β API Gateway β 29s integration timeout β
β β 10,000 req/s (account), cache TTL 0-3600sβ
ββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββ€
β DynamoDB β 400 KB max item, 1 RCU = 4 KB strong β
β β 1 WCU = 1 KB, Streams: 24h retention β
β β 5 LSI (at creation), 20 GSI (anytime) β
ββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββ€
β SQS Standard β Unlimited TPS, at-least-once β
β SQS FIFO β 300 TPS (3,000 batch), exactly-once β
β SQS Visibility β Default 30s, max 12h β
β SQS Retention β Default 4 days, max 14 days β
ββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββ€
β Kinesis β 24h default retention (max 365 days) β
β KMS β 4 KB direct encrypt, 5,500-30,000 ops/s β
β Cognito Sync β 1 MB/dataset, 20 datasets/identity β
β Step Functions β 25,000 execution history events β
ββββββββββββββββββββββββ΄βββββββββββββββββββββββββββββββββββββββββββ19. Error Code Cheat Sheet
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β ERROR β ROOT CAUSE β FIX β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β β
β API Gateway 502 β Lambda wrong response format β
β FIX: Return proper JSON proxy response β
β β
β API Gateway 504 β Backend exceeded 29s timeout β
β FIX: Optimize Lambda or use async β
β β
β Lambda 429 β Throttled (concurrency limit) β
β FIX: Reserved concurrency + backoff β
β β
β DynamoDB Provisioned β
β ThroughputExceeded β Hot partition or low capacity β
β FIX: Exponential backoff + better PK β
β β
β AccessDeniedException β
β (Lambdaβservice) β Execution role missing permissions β
β FIX: Update execution role policy β
β β
β UnauthorizedOp β IAM policy missing β
β (EC2 CLI) FIX: sts:DecodeAuthorizationMessage β
β β
β InvalidInstanceID β Wrong region in CLI config β
β NotFound FIX: Match CLI region to instance region β
β β
β NoSuchBucket (CDK) β CDK not bootstrapped in account β
β FIX: Run cdk bootstrap β
β β
β Unable to import β Missing modules in Lambda package β
β module (Lambda) FIX: Install locally + zip + upload β
β β
β RequestError β Missing proxy config in CodeBuild β
β timeout (CodeBuild) FIX: Add proxy element to buildspec.yml β
β β
β DownloadBundle β EC2 IAM profile lacks S3 access β
β "not opened for FIX: Add S3 permissions to instance role β
β reading" error β NOT: S3 versioning, region, or AppSpec β
β (CodeDeploy) β DownloadBundle = agent-managed, not β
β configurable in AppSpec file! β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ20. Exam Strategy β Answer Elimination
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β ANSWER ELIMINATION FRAMEWORK β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ£
β β
β STEP 1: Read the question for KEY PHRASES β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β "Least effort" β Managed service, built-in featureβ β
β β "Most secure" β IAM roles, least privilege, encryptβ β
β β "Cost-effective" β Query>Scan, binpack, on-demand β β
β β "Without code change"β ALB OIDC, CloudFront, API cache β β
β β "Near real-time" β DynamoDB Streams, Kinesis β β
β β "Exactly-once" β SQS FIFO, NOT Standard β β
β β "Cross-account" β AssumeRole + trust policy β β
β β "MFA protected" β GetSessionToken (only STS API!) β β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β STEP 2: Eliminate OBVIOUS wrong answers β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β β "Use EC2" when serverless is better β β
β β β "Store access keys in code" β β
β β β "Use root user credentials" β β
β β β "Disable encryption" or "use HTTP" β β
β β β "AppSpec.yml" for CodeBuild (it's buildspec.yml!) β β
β β β "Lambda Authorizer" for API Gateway when topic is β β
β β clearly about Cognito User Pools or IAM auth β β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β STEP 3: Between two remaining options, ask: β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β 1. Does this follow least privilege? β β
β β 2. Does this use a managed/native service? β β
β β 3. Does this address the ROOT CAUSE? β β
β β 4. Is this the SIMPLEST path meeting ALL requirements? β β
β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β
β SERVICE CONFUSION MATRIX: β
β ββββββββββββββββββββββββββββ¬ββββββββββββββββββββββββββββ β
β β If question says... β Don't pick... β β
β ββββββββββββββββββββββββββββΌββββββββββββββββββββββββββββ€ β
β β "Simple decoupling" β Kinesis (use SQS) β β
β β "Serverless deploy" β Raw CloudFormation (SAM!) β β
β β "Coordinate Lambdas" β Direct invoke (Step Fn!) β β
β β "Feature flags" β Lambda+SSM (AppConfig!) β β
β β "Distributed tracing" β CloudWatch (X-Ray!) β β
β β "API auditing" β X-Ray (CloudTrail!) β β
β β "npm repo" β ECR (CodeArtifact!) β β
β β "Cross-device sync" β AppSync (Cognito Sync!) β β
β β "Multi-user realtime" β Cognito Sync (AppSync!) β β
β β "Infra as code in Python"β CloudFormation (CDK!) β β
β β "DB credential rotation" β Param Store (Secrets Mgr!)β β
β β "3rd-party webhook" β API GW (Fn URL+NONE!) β β
β β "JWT auth for API GW" β Identity Pool (User Pool!)β β
β β "Public HTTPS for Lambda"β API GW overkill (Fn URL!) β β
β ββββββββββββββββββββββββββββ΄ββββββββββββββββββββββββββββ β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ21. Additional Services β Quick Cards
ββββββββββββββββ SSM Parameter Store βββββββββββββββββββ
β Standard: Free, 4 KB, no policies β
β Advanced: Paid, 8 KB, supports policies: β
β β’ ExpirationNotification β
β β’ NoChangeNotification (rotation monitoring!) β
β β’ Expiration β
β SecureString: Encrypted with KMS β
β CloudFormation: {{resolve:ssm-secure:name:version}} β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
ββββββββββββββββ Secrets Manager βββββββββββββββββββββββ
β β
Auto-rotation of secrets (Lambda-based) β
β β
Native RDS integration β
β Best for: DB credentials needing periodic rotation β
β More expensive than Parameter Store β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
ββββββββββββββββ AppConfig βββββββββββββββββββββββββββββ
β Feature flags & configuration profiles β
β Gradual rollout without code deployment β
β Preferred over Lambda + Parameter Store β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
ββββββββββββββββ SQS Extended Client βββββββββββββββββββ
β Messages > 256 KB (up to 2 GB) β
β Uses S3 to store message payloads β
β β
Only available for Java SDK β
β β NOT via CLI, Console, HTTP API, or other SDKs β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
ββββββββββββββββ EC2 Metadata ββββββββββββββββββββββββββ
β http://169.254.169.254/latest/meta-data/ β
β http://169.254.169.254/latest/user-data/ β
β β
user-data = run scripts at launch β
β β
metadata = query instance details β
β β Cannot run scripts via metadata! β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
ββββββββββββββββ ALB βββββββββββββββββββββββββββββββββββ
β Layer 7, supports OIDC auth on HTTPS:443 β
β β
No code changes for authentication! β
β X-Forwarded-For header = client's real IP β
β Multi-value headers for duplicate query params β
β NLB = Layer 4, NO OIDC, NO Lambda targets β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
ββββββββββββββββ CloudFront ββββββββββββββββββββββββββββ
β β
β CACHE UPDATE STRATEGIES: β
β βββββββββββββββββββββββ¬βββββββββββ¬βββββββββββββββ β
β β Strategy β Fast? β Cost? β β
β βββββββββββββββββββββββΌβββββββββββΌβββββββββββββββ€ β
β β Versioned file namesβ β
YES β β
FREE β β
β β (img_v2.jpg) β β β
BEST ANSWERβ β
β βββββββββββββββββββββββΌβββββββββββΌβββββββββββββββ€ β
β β Invalidation β β
YES β β COSTS $$ β β
β β β β ($0.005/path)β β
β βββββββββββββββββββββββΌβββββββββββΌβββββββββββββββ€ β
β β Wait for TTL expire β β SLOW β β
FREE β β
β βββββββββββββββββββββββΌβββββββββββΌβββββββββββββββ€ β
β β Disable/re-enable β β SLOW β β DOWNTIME β β
β β distribution β no clear β β β
β βββββββββββββββββββββββ΄βββββββββββ΄βββββββββββββββ β
β β
β β
"Fast + cost-efficient" = versioned file names β
β β
"Immediate" = invalidation OR versioned names β
β β
Invalidation: 1st 1000/month free, then charges β
β β
β CloudFront-Viewer-Country header for geo-routing β
β CloudFront Functions for lightweight edge logic β
β Lambda@Edge for heavier processing β
β OAC: Restrict S3 access to CloudFront only β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββ ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β β
β "When in doubt, choose the answer that is: β
β β
Most secure (least privilege) β
β β
Least effort (managed service) β
β β
Addresses root cause (not symptoms) β
β β
Simplest path meeting ALL requirements" β
β β
β Good luck! π β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββAWS DVA-C02 Visual Study Guide v2 β March 2026