AWS SAP Specialty flashcards
AWS SAP Specialty · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- SCP effect on permissions
- Service control policies define the maximum permissions available to accounts in an organization. They never grant permissions; an action must be allowed by the SCP and by an identity or resource policy.
- SCP deny precedence
- If any SCP along the path from root to the account denies an action, that action is blocked even when another SCP or IAM policy allows it. Deny always wins.
- Consolidated billing benefit
- All member accounts roll usage into the management account, combining volume for tiered pricing and sharing Reserved Instance and Savings Plan discounts across the organization.
- Cross-account role assumption
- The target account role trust policy names the source principal; the caller needs sts:AssumeRole permission and receives temporary credentials scoped to that role session.
- VPC sharing with RAM
- The owning account shares subnets through AWS RAM. Participants launch resources into those subnets but cannot modify shared route tables, gateways, or subnet configuration.
- Control Tower guardrails
- Preventive guardrails are implemented as service control policies that block actions; detective guardrails are AWS Config rules that detect and flag noncompliant resources.
- Transit Gateway hub model
- A central Transit Gateway connects many VPCs and on-premises networks, replacing full-mesh peering. Shared services and inspection VPCs centralize egress and security.
- IAM Identity Center federation
- A central identity source is connected once, and permission sets are assigned to users or groups per account. Users get role sessions instead of per-account IAM users.
- Multi-AZ versus multi-Region
- Multi-AZ protects against a single data center failure within a Region using synchronous replication. Multi-Region protects against Region-scale failure using asynchronous replication and higher cost.
- DR strategy ladder
- Backup and restore has the highest RTO and RPO, then pilot light, then warm standby, then multi-site active-active with near-zero RTO and RPO.
- SQS standard versus FIFO
- Standard queues provide at-least-once delivery with best-effort ordering and high throughput. FIFO queues provide exactly-once processing and strict ordering at lower throughput.
- EventBridge versus SNS versus SQS
- EventBridge routes and filters events from AWS and SaaS sources, SNS pushes fan-out to many subscribers, and SQS buffers messages for pull-based consumers.
- Lambda runtime limit
- An individual Lambda invocation can run up to 15 minutes. Longer workloads need Step Functions orchestration, containers on ECS or EKS, or EC2.
- EBS versus EFS versus S3
- EBS is block storage bound to one Availability Zone and one attachment set. EFS is shared NFS across AZs. S3 is durable object storage accessed over HTTP APIs.
- Aurora Global Database
- A primary Region replicates to secondary Regions with sub-second typical lag, enabling fast cross-Region reads and promotion during disaster recovery.
- VPC endpoint purpose
- Interface endpoints use PrivateLink to reach AWS services privately inside the VPC; gateway endpoints route S3 and DynamoDB traffic without NAT gateways or internet exposure.
- Well-Architected pillars
- The six pillars are operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Trade-offs between them are documented per workload.
- Target tracking scaling
- Target tracking adjusts capacity automatically to hold a chosen metric at a target value, such as average CPU at 50 percent, and is usually simpler than step scaling.
- Composite CloudWatch alarms
- Composite alarms combine multiple alarm states using AND or OR logic, reducing alert noise and triggering only when several conditions are simultaneously true.
- Memory metric requirement
- EC2 memory utilization is not a default CloudWatch metric. The CloudWatch agent must be installed to publish memory and disk metrics for alarms and rightsizing.
- Compute Optimizer role
- AWS Compute Optimizer analyzes utilization metrics and recommends rightsizing for EC2 instances, Auto Scaling groups, EBS volumes, and Lambda functions to reduce cost.
- Savings Plans versus Spot
- Savings Plans commit to consistent compute spend for discounts across families and Regions. Spot capacity offers deep discounts but can be reclaimed with short notice for fault-tolerant work.
- Config conformance packs
- A conformance pack bundles AWS Config managed and custom rules as a single deployable unit, enabling continuous compliance evaluation across accounts and Regions.
- X-Ray service map
- X-Ray traces requests across distributed services and builds a service map showing latency, errors, and downstream dependencies to locate performance bottlenecks.
- Canary deployment rollback
- CodeDeploy or Lambda weighted aliases shift a small traffic percentage to the new version; CloudWatch alarms trigger automatic rollback if error or latency thresholds breach.
- Fault Injection Service
- AWS Fault Injection Service runs controlled experiments such as instance termination or network latency to validate resilience and runbooks before real failures occur.
- The seven Rs
- Migration strategies are retire, retain, rehost, relocate, replatform, repurchase, and refactor. Each application is assessed and assigned one strategy.
- Application Migration Service
- AWS Application Migration Service continuously replicates source servers and launches test or cutover instances in AWS, enabling lift-and-shift rehost migrations with minimal downtime.
- DMS with Schema Conversion Tool
- DMS migrates data with change data capture for near-zero-downtime cutover. Schema Conversion Tool converts incompatible schema and stored procedures for heterogeneous engines.
- Snowball versus DataSync
- Snowball Edge moves large datasets offline when network bandwidth is limited. DataSync transfers files online over the network with scheduling, verification, and incremental sync.
- Strangler fig modernization
- New functionality is built as services that gradually replace parts of a legacy system, which keeps running until remaining features are migrated and decommissioned.
- Migration wave planning
- Applications are grouped into waves by dependency and business priority. Low-risk, low-dependency applications migrate first to validate the landing zone and runbooks.