I took the AWS Architect Associate exam recently to renew my certification. The exam requires a deep understanding of key architecture and design principles and core AWS services, but there's a long tail of services that you need to have a passing familiarity with. Below is the complete list of notes I took while studying.

New services I didn't recognize since I last took the exam:

• AWS Backup: centralized policy-based account-wide and multi-account org aware backup service and policy governance.
• Control Tower: multi account governance and blueprints with policy management and violation detection. Set up and manage multi-account environments.
• AWS Service Catalog: centrally manage deployed IT services with curated infrastructure-as-code templates for AWS products. self service provisioning, access controls
• AWS Security Hub: consolidated view of security status, alerting, and automated security checks
• Amazon GuardDuty: continuous threat detection
• Amazon Inspector: automated vulnerability management - scan and identify vulnerabilities and unintended network exposure
• Amazon Detective: conduct faster and more effective investigations
• Amazon X-Ray: Analyze and debug production and distributed applications
• AWS Config: Assess, audit, and evaluate configurations of your resources
• AWS Shield: DDoS protection. Shield Advanced $3000/mo for 24/7
• Amazon Macie: discover and protect sensitive data. Works with S3.
• AWS Glue: serverless data integration service for multiple data sources for analytics, ML. visual ETL interface
• AWS License Manager: manage licenses
• AWS Athena: query things with SQL or python, serverless. Works with s3, and various formats like csv/json/apache/orc.
• Amazon Fraud Detector: AWS AI service that is built to detect fraud in your data.
• AWS Artifact: single source to get compliance-related information
• AWS AppSync: simple GraphQL interface for development
• AWS Global Accelerator: a service that improves the availability and performance of your applications with local or global users.
• AWS Compute Optimizer: automate the collection of metrics for underutilized and underperforming compute instances. Generates recommendations to save money.
• Elastic Map Reduce: mapreduce: Spark, Hive, Presto, and other big data workloads.
• AWS Batch: batch computation workloads on managed compute infrastructure.
• Amazon Forecast: time series forecasting service that uses machine learning and provides business insights.
• Neptune: fully managed graph database
• Amazon Timestream: Fast, scalable, serverless time series database
• Amazon Keyspaces: Cassandra compatible database
• Amazon Managed Grafana: easily scale, operate, deploy grafana. Query/correlate/visuzlie metrics, logs, and traces.
• Amazon Managed Service for Prometheus: Serverless, managed monitoring for your containerized systems for EKS or self-managed cluster
• Amazon Elastic Kubernetes Service (EKS): managed Kubernetes service
• DynamoDB Accelerator (DAX): fully managed in-memory cache for dynamodb.
• DynamoDB Standard-IA: infrequently-accessed data for 60% cost reduction
• DynamoDB global tables: fully managed multi region multi-active single-digit-ms-latency eventually-consistent database
• Amazon Managed Streaming for Apache Kafka (MSK): hosted kafka
• AWS Data Pipeline: managed ETL service, define data driven workflows. Works well with EC2/EMR
• Systems Manager: run commands, remotely connect, and install/schedule patches on fleets of EC2. install agents on ec2 or on-prem.
• Amplify: quickly deploy web or mobile apps, supports react/vue.js.

Security:

• AWS Network Firewall: The AWS Network Firewall infrastructure is managed by AWS. Can filter traffic BEFORE it reaches igw. Can include IPS. Hardware firewall requirements can be met with this.
• AWS Firewall Manager: Manage firewalls for multiple accounts
• AWS WAF: web application firewall that protects web applications. configure rules that allow, block, or monitor (count) web requests based on conditions, works with cloudfront, ALB, API GW, AppSync.
• AWS Audit Manager: continuous auditing compliance for HIPAA/GDPR/PCI.
• Security Hub: place for all your security stuff and alerts

Governance:

• Trusted advisor: auditing for best practices - cost, performance, security, fault tolerance, and whether service limits will be hit soon.
• AWS Budgets: cost/usage/RI/savings plan budgeting and alerts. 2 free every month
• AWS Resource Access Manager (RAM): share aws resources
• IAM: roles are given to services. Users are assigned to user groups. Policies are attached to users or groups.

ML/AI stuff:

• Amazon Kendra: create an intelligent search service powered by machine learning.
• Amazon Textract: uses machine learning to automatically extract text, handwriting, and data from scanned documents
• Amazon Polly: text to speech
• Amazon Comprehend: NLP
• Amazon Rekognition: analyze images and videos

EC2 stuff:

• EBS Multi-Attach: attach a provisioned-io volume (io1, io2) to multiple instances
• Amazon Data Lifecycle Manager: automated, policy-based lifecycle management for EBS snapshots and AMIs.
• io2 Block Express volumes: next gen highest performance and sub-ms io latency block storage at no additional cost. Only available with C6in, C7g, M6in, M6idn, M7g, R5b, R6in, R6idn, R7g, Trn1, X2idn, and X2iedn instances.

Cloudfront / S3:

• Cloudfront Origin access identity: used to identify within cloudfront and S3
• Cloudfront signed urls: distribute paid content with dynamic URLs with access control like expiry time
• Cloudfront signed cookies: restrict access to lots of private files or when you want static urls

Storage/hybrid/migration stuff:

• Storage gateway: hybrid cloud storage service. Is a VM.
  • S3 File Gateway: NFS/SMB to S3
    • Cached file gateway for unlimited storage.
  • FSx File Gateway: SMB to S3 with NTFS support (shadow copies, ACLs, etc). Migrate NAS
  • Tape gateway: iSCSI-based VTL tape backups to S3
  • Volume Gateway: iSCSI block storage volumes to EBS
• DataSync: migrate data between NFS/SMB shares and AWS storage. One-time migration after installing agent. To EFS or FSx.
• Migration Hub: tool for organizing migration steps
• Snow:
  • Snowball: many terabytes of data to move.
• AWS Database Migration service (DMS): On prem to cloud or RDS-to-RDS
• Application Discovery Service: discover applications to migrate.
• Application Migration Service (AWS MGN): automate and replicate source service into AWS for non-disruptive cutover
• AWS Server Migration Service (AWS SMS): replicate servers into AMIs. Minimize downtime.

VPC stuff:

• NAT gateway: 5-45gbps, single AZ, redundant, automatic public ip address. For multi-AZ availability, need a NAT gateway per AZ.
• NACL: stateless first line of defense subnet firewall, can be used to deny traffic. Default allows all. Use to ban IPs. Custom NACLs deny all by default.
  • Every subnet must be associated with exactly 1 NACL
• VPC endpoint: virtual device that allows communication with internal AWS services
  • Interface endpoint: elastic network interface with a private ip address, serves as an entry point for traffic headed to a supported AWS service
  • Gateway endpoint: a virtual device that supports connection to S3 and dynamodb
• PrivateLink: peering for VPCs to many customer VPCs. Service VPC has a NLB and client VPC connects via an ENI. Between regions OK, transitive peering not OK.
• AWS VPN Cloud Hub: connect VPN sites together, similar to VPC peering. All traffic encrypted.
• Direct Connect: connect on prem DC with VPC. Dedicated network connection to AWS. Unlike a VPN it doesn't run through the public internet.
  • Dedicated connection: physical ethernet connection for a single customer
  • Hosted connection: physical ethernet connection provisioned by a Direct Connect partner like Verizon.
• Transit Gateway: connects VPCs and on-prem networks through a central hub. "Cloud router." Simplifies network topology.
  • Allows transitive peering
  • Works on regional basis
  • Works with direct connect and VPNs
  • Supports IP multicast
• AWS Wavelength: mobile 5G edge computing embedded in 5G networks.

Monitoring:

• Standard cloudwatch metric interval is 5 minutes. Detailed monitoring delivers every minute
• Cloudwatch logs insights: SQL