> ## Content Index
> Fetch the complete content index at: https://www.petercai.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# My AWS Architect Associate exam cheat sheet
- URL: https://www.petercai.com/aws-architect-associate-cheat-sheet/
- Published: 2024-09-13T12:00:00.000Z
- Updated: 2024-09-13T12:00:00.000Z
- Description: A study guide I built while I was studying for the AWS Architect Associate exam at the end of 2023.
- Author: Peter Cai
- Tags: #Import 2026-08-11 22:26

I took the AWS Architect Associate exam recently to renew my certification. The exam requires a deep understanding of key architecture and design principles and core AWS services, but there's a long tail of services that you need to have a passing familiarity with. Below is the complete list of notes I took while studying.

## New services I didn't recognize since I last took the exam:

- **AWS Backup**: centralized policy-based account-wide and multi-account org aware backup service and policy governance.
- **Control Tower**: multi account governance and blueprints with policy management and violation detection. Set up and manage multi-account environments.
- **AWS Service Catalog**: centrally manage deployed IT services with curated infrastructure-as-code templates for AWS products. self service provisioning, access controls
- **AWS Security Hub**: consolidated view of security status, alerting, and automated security checks
- **Amazon GuardDuty**: continuous threat detection
- **Amazon Inspector**: automated vulnerability management - scan and identify vulnerabilities and unintended network exposure
- **Amazon Detective**: conduct faster and more effective investigations
- **Amazon X-Ray**: Analyze and debug production and distributed applications
- **AWS Config**: Assess, audit, and evaluate configurations of your resources
- **AWS Shield**: DDoS protection. Shield Advanced $3000/mo for 24/7
- **Amazon Macie**: discover and protect sensitive data. Works with S3.
- **AWS Glue**: serverless data integration service for multiple data sources for analytics, ML. visual ETL interface
- **AWS License Manager**: manage licenses
- **AWS Athena**: query things with SQL or python, serverless. Works with s3, and various formats like csv/json/apache/orc.
- **Amazon Fraud Detector**: AWS AI service that is built to detect fraud in your data.
- **AWS Artifact**: single source to get compliance-related information
- **AWS AppSync**: simple GraphQL interface for development
- **AWS Global Accelerator**: a service that improves the availability and performance of your applications with local or global users.
- **AWS Compute Optimizer**: automate the collection of metrics for underutilized and underperforming compute instances. Generates recommendations to save money.
- **Elastic Map Reduce**: mapreduce: Spark, Hive, Presto, and other big data workloads.
- **AWS Batch**: batch computation workloads on managed compute infrastructure.
- **Amazon Forecast**: time series forecasting service that uses machine learning and provides business insights.
- **Neptune**: fully managed graph database
- **Amazon Timestream**: Fast, scalable, serverless time series database
- **Amazon Keyspaces**: Cassandra compatible database
- **Amazon Managed Grafana**: easily scale, operate, deploy grafana. Query/correlate/visuzlie metrics, logs, and traces.
- **Amazon Managed Service for Prometheus**: Serverless, managed monitoring for your containerized systems for EKS or self-managed cluster
- **Amazon Elastic Kubernetes Service (EKS)**: managed Kubernetes service
- **DynamoDB Accelerator (DAX)**: fully managed in-memory cache for dynamodb.
- **DynamoDB Standard-IA**: infrequently-accessed data for 60% cost reduction
- **DynamoDB global tables**: fully managed multi region multi-active single-digit-ms-latency eventually-consistent database
- **Amazon Managed Streaming for Apache Kafka (MSK)**: hosted kafka
- **AWS Data Pipeline**: managed ETL service, define data driven workflows. Works well with EC2/EMR
- **Systems Manager**: run commands, remotely connect, and install/schedule patches on fleets of EC2\. install agents on ec2 or on-prem.
- **Amplify**: quickly deploy web or mobile apps, supports react/vue.js.

## Security:

- **AWS Network Firewall**: The AWS Network Firewall infrastructure is managed by AWS. Can filter traffic BEFORE it reaches igw. Can include IPS. Hardware firewall requirements can be met with this.
- **AWS Firewall Manager**: Manage firewalls for multiple accounts
- **AWS WAF**: web application firewall that protects web applications. configure rules that allow, block, or monitor (count) web requests based on conditions, works with cloudfront, ALB, API GW, AppSync.
- **AWS Audit Manager**: continuous auditing compliance for HIPAA/GDPR/PCI.
- **Security Hub**: place for all your security stuff and alerts

## Governance:

- **Trusted advisor**: auditing for best practices - cost, performance, security, fault tolerance, and whether service limits will be hit soon.
- **AWS Budgets**: cost/usage/RI/savings plan budgeting and alerts. 2 free every month
- **AWS Resource Access Manager (RAM)**: share aws resources
- **IAM**: roles are given to services. Users are assigned to user groups. Policies are attached to users or groups.

## ML/AI stuff:

- **Amazon Kendra**: create an intelligent search service powered by machine learning.
- **Amazon Textract**: uses machine learning to automatically extract text, handwriting, and data from scanned documents
- **Amazon Polly**: text to speech
- **Amazon Comprehend**: NLP
- **Amazon Rekognition**: analyze images and videos

## EC2 stuff:

- **EBS Multi-Attach**: attach a provisioned-io volume (io1, io2) to multiple instances
- **Amazon Data Lifecycle Manager**: automated, policy-based lifecycle management for EBS snapshots and AMIs.
- **io2 Block Express volumes**: next gen highest performance and sub-ms io latency block storage at no additional cost. Only available with C6in, C7g, M6in, M6idn, M7g, R5b, R6in, R6idn, R7g, Trn1, X2idn, and X2iedn instances.

## Cloudfront / S3:

- **Cloudfront Origin access identity**: used to identify within cloudfront and S3
- **Cloudfront signed urls**: distribute paid content with dynamic URLs with access control like expiry time
- **Cloudfront signed cookies**: restrict access to lots of private files or when you want static urls

## Storage/hybrid/migration stuff:

- **Storage gateway**: hybrid cloud storage service. Is a VM.
  - **S3 File Gateway**: NFS/SMB to S3
    - Cached file gateway for unlimited storage.
  - **FSx File Gateway**: SMB to S3 with NTFS support (shadow copies, ACLs, etc). Migrate NAS
  - **Tape gateway**: iSCSI-based VTL tape backups to S3
  - **Volume Gateway**: iSCSI block storage volumes to EBS
- **DataSync**: migrate data between NFS/SMB shares and AWS storage. One-time migration after installing agent. To EFS or FSx.
- **Migration Hub**: tool for organizing migration steps
- **Snow**:
  - **Snowball**: many terabytes of data to move.
- **AWS Database Migration service (DMS)**: On prem to cloud or RDS-to-RDS
- **Application Discovery Service**: discover applications to migrate.
- **Application Migration Service (AWS MGN)**: automate and replicate source service into AWS for non-disruptive cutover
- **AWS Server Migration Service (AWS SMS)**: replicate servers into AMIs. Minimize downtime.

## VPC stuff:

- **NAT gateway**: 5-45gbps, single AZ, redundant, automatic public ip address. For multi-AZ availability, need a NAT gateway per AZ.
- **NACL**: stateless first line of defense subnet firewall, can be used to deny traffic. Default allows all. Use to ban IPs. Custom NACLs deny all by default.
  - Every subnet must be associated with exactly 1 NACL
- **VPC endpoint**: virtual device that allows communication with internal AWS services
  - **Interface endpoint**: elastic network interface with a private ip address, serves as an entry point for traffic headed to a supported AWS service
  - **Gateway endpoint**: a virtual device that supports connection to S3 and dynamodb
- **PrivateLink**: peering for VPCs to many customer VPCs. Service VPC has a NLB and client VPC connects via an ENI. Between regions OK, transitive peering not OK.
- **AWS VPN Cloud Hub**: connect VPN sites together, similar to VPC peering. All traffic encrypted.
- **Direct Connect**: connect on prem DC with VPC. Dedicated network connection to AWS. Unlike a VPN it doesn't run through the public internet.
  - **Dedicated connection**: physical ethernet connection for a single customer
  - **Hosted connection**: physical ethernet connection provisioned by a Direct Connect partner like Verizon.
- **Transit Gateway**: connects VPCs and on-prem networks through a central hub. "Cloud router." Simplifies network topology.
  - Allows transitive peering
  - Works on regional basis
  - Works with direct connect and VPNs
  - Supports IP multicast
- **AWS Wavelength**: mobile 5G edge computing embedded in 5G networks.

## Monitoring:

- Standard cloudwatch metric interval is 5 minutes. Detailed monitoring delivers every minute
- Cloudwatch logs insights: SQL