AWS Developer flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Lambda async retry count

Asynchronous Lambda invocations are retried twice by default when the function errors, and the event is discarded after those retries or once the maximum event age is exceeded.

DynamoDB item size limit

A single DynamoDB item, including all attribute names and values, cannot exceed 400 KB, which caps how much data one partition-key record can hold.

SQS visibility timeout

After a consumer receives a message, SQS hides it for the visibility timeout; if the message is not deleted within that window it becomes visible again and can be delivered to another consumer.

SQS FIFO throughput limits

A FIFO queue processes up to 300 messages per second per message group without batching, rising to 3,000 per second when batches are used, while preserving strict ordering.

Step Functions Standard versus Express

Standard workflows can run up to one year and keep exactly-once execution history, while Express workflows run at most five minutes with at-least-once execution at much higher event rates.

API Gateway Lambda proxy integration

With AWS_PROXY integration the entire HTTP request, including headers, path, query string and body, is passed to Lambda as one event, and the Lambda response defines status code and headers.

Lambda memory and timeout

Lambda functions can be configured with 128 MB to 10,240 MB of memory and a maximum timeout of 15 minutes; CPU allocation scales proportionally with the chosen memory setting.

DynamoDB Streams retention

DynamoDB Streams records item-level changes for 24 hours, and consumers such as Lambda read them using a stream view type of keys only, new image, old image, or both.

IAM policy evaluation logic

AWS evaluates all applicable policies together: an explicit deny always wins, an allow in any policy grants access, and the absence of any allow results in an implicit deny.

IAM role temporary credentials

Assuming a role calls AWS STS, which returns short-lived credentials with an expiration; the caller never stores long-term access keys, and permissions come from the role's policies.

KMS envelope encryption

KMS encrypts data with a data key, and the plaintext data key encrypts the payload; the encrypted data key is stored with the ciphertext and decrypted only through KMS.

Cognito user pool versus identity pool

User pools handle sign-up, sign-in and issuing JSON web tokens, while identity pools exchange those tokens for temporary AWS credentials through STS so users can call AWS services directly.

Secrets Manager rotation

Secrets Manager can automatically rotate database and other credentials on a schedule by invoking a Lambda rotation function, without requiring application redeployment or hard-coded credential changes.

SSE-KMS S3 permission requirement

When uploading or downloading objects encrypted with SSE-KMS, the caller needs kms:GenerateDataKey and kms:Decrypt permissions on the key in addition to the relevant S3 object permissions.

Gateway versus interface endpoint

Gateway VPC endpoints route traffic to S3 and DynamoDB through route table entries, while interface endpoints use elastic network interfaces with security groups and support most other AWS services through PrivateLink.

Lambda resource-based policy

A Lambda resource-based policy grants other accounts or AWS services permission to invoke the function, and it is separate from the execution role, which controls what the function can access.

SAM template transform

Serverless Application Model templates declare resources such as AWS::Serverless::Function and include the AWS::Serverless-2016-10-31 transform, which CloudFormation expands into standard Lambda, IAM and API Gateway resources.

Lambda alias weighted routing

An alias points to one or two numbered versions and can send a percentage of traffic to a second version, enabling canary releases before shifting all traffic to the new version.

Elastic Beanstalk immutable deployment

Immutable deployments launch a fresh set of instances in a new auto scaling group, deploy and health-check the new version there, then swap the instances in, allowing fast rollback.

CodeDeploy AppSpec hooks

For EC2 and on-premises deployments, the AppSpec file defines lifecycle event hooks such as BeforeInstall, AfterInstall, ApplicationStart and ValidateService, each mapped to scripts in the revision bundle.

CodeBuild buildspec phases

A buildspec.yml file defines phases including install, pre_build, build and post_build, plus artifacts and cache sections that tell CodeBuild what to run and what output to publish.

CloudFormation change sets

A change set previews how a stack update will modify existing resources, letting you review replacements and deletions before executing the change so unintended data loss is avoided.

CodePipeline artifact store

CodePipeline stages pass output artifacts, stored in an S3 artifact bucket, to later stage actions; each action declares input and output artifacts that must match across the pipeline definition.

CDK synthesis output

The AWS CDK app is synthesized into a CloudFormation template during cdk synth or cdk deploy; constructs are reusable components, and L2 constructs provide sensible secure defaults.

Lambda throttle error code

When concurrency limits are exceeded, Lambda rejects invocations with a 429 TooManyRequestsException; asynchronous invocations are retried, while synchronous callers receive the error directly.

Provisioned concurrency purpose

Provisioned concurrency keeps a specified number of execution environments initialized and ready, eliminating cold starts for that capacity while it remains allocated and billed continuously.

Lambda destinations for async

For asynchronous invocations, Lambda can send success and failure records to destinations such as SQS, SNS, EventBridge or another Lambda, replacing the older dead-letter queue pattern.

API Gateway 502 response cause

A 502 from API Gateway with a Lambda proxy integration usually means the function returned a malformed response, such as a missing statusCode field or a non-serializable body.

X-Ray sampling rule

X-Ray sampling rules control what percentage of requests are traced and can match on request path, method, host or service name, keeping tracing volume and cost predictable.

CloudWatch Logs metric filter

A metric filter scans log events for a pattern, such as the word ERROR, and increments a custom CloudWatch metric each time the pattern matches, enabling alarms on log content.

DynamoDB exponential backoff

When DynamoDB returns ProvisionedThroughputExceededException, the SDK retries with exponential backoff and jitter, spreading requests so a throttled partition can recover instead of staying saturated.

SQS long polling benefit

Setting WaitTimeSeconds up to 20 on ReceiveMessage makes SQS hold the request open until a message arrives, reducing empty responses, request count and overall cost compared with short polling.