AWS Data Engineer study guide
AWS Data Engineer · Work through your exam, one topic at a time.
AWS Certified Data Engineer – Associate (commonly referenced as DEA-C01) is AWS's associate-level credential for engineers who build, operate, and maintain data pipelines on AWS. It sits between the foundational cloud certifications and the professional-level exams: candidates are expected to be comfortable with core AWS services and with SQL, and to reason about ingestion, transformation, storage, cataloging, orchestration, and access control as one connected system rather than as isolated products. The exam is organized into four domains that mirror the data lifecycle: Data Ingestion and Transformation, Data Store Management, Data Operations and Support, and Data Security and Governance. Ingestion and transformation carries the largest share of the scored content, so pipeline design, ETL versus ELT trade-offs, and batch versus streaming decisions deserve the most preparation time. The AWS Data Engineer study guide has 4 sections and about 1,291 words.
01Data Ingestion and Transformation
Ingestion splits into batch, streaming, and transfer. Batch: AWS Glue jobs, Step Functions, Amazon MWAA, AWS DMS.
332 words, about 2 min02Data Store Management
You must be able to choose and physically design a store: S3 data lakes, Redshift warehouses, DynamoDB key-value tables, and the Glue Data Catalog (optionally with Lake Formation) as the shared metastore. Open table formats (Iceberg, Hudi, Delta) add ACID and upserts on S3.
319 words, about 2 min03Data Operations and Support
Operations means running pipelines predictably: observability, orchestration, retries/idempotency, and performance tuning. Observability: CloudWatch metrics, logs, and alarms for Glue, Lambda, Kinesis, and Redshift; CloudTrail for API-level audit of who changed what; AWS Config for resource configuration history; EventBridge for Glue/Lambda state-change events that trigger alerts or corrective workflows.
306 words, about 2 min04Data Security and Governance
Governance has four layers: identity (IAM roles, least privilege, trust and permission policies), resource policy (S3 bucket policies, KMS key policies), network (VPC endpoints - gateway endpoints for S3 and DynamoDB, interface endpoints for Glue, Kinesis, and Redshift), and data-level controls (Lake Formation, Macie, encryption). Encryption at rest: SSE-S3, SSE-KMS (auditable, allows key policies and grants), SSE-C (customer-provided keys), and client-side.
334 words, about 2 min