AWS Solutions Architect flashcards
AWS Solutions Architect · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- IAM explicit deny
- An explicit Deny in any applicable policy overrides every Allow, including administrator access and resource-based grants; policy evaluation returns deny immediately.
- Service control policy scope
- SCPs cap the maximum permissions available to member accounts in AWS Organizations; they never grant permissions and do not affect the management account.
- Security group vs NACL
- Security groups are stateful, allow-only filters attached to elastic network interfaces; network ACLs are stateless, support allow and deny rules, and are evaluated per subnet in rule-number order.
- KMS key policy requirement
- A KMS key policy must delegate to IAM before identity-based policies can use the key; otherwise only the principals named directly in the key policy have access.
- S3 SSE-KMS audit trail
- SSE-KMS logs key usage to CloudTrail and supports separate permissions per key, while SSE-S3 uses AWS-managed keys with no per-key access control or detailed audit trail.
- Gateway vs interface endpoint
- Gateway endpoints for S3 and DynamoDB use route table entries and carry no hourly charge; interface endpoints create ENIs with security groups and bill hourly plus per GB.
- Secrets Manager rotation
- Secrets Manager rotates credentials automatically on a schedule by invoking a Lambda rotation function; SSM Parameter Store SecureString only stores the secret and requires custom rotation code.
- Cognito identity pool role
- Identity pools exchange authenticated or guest tokens for temporary AWS credentials through STS, scoped by an IAM role and its attached policy.
- RTO versus RPO
- RTO is the maximum tolerable downtime before service resumes; RPO is the maximum tolerable data loss measured backwards from the failure. Both drive disaster recovery design.
- Warm standby strategy
- A scaled-down but fully functional copy of production runs in another Region and is scaled up on failover; it costs more than pilot light but delivers a lower RTO.
- RDS Multi-AZ failover
- RDS Multi-AZ keeps a synchronous standby in another Availability Zone and fails over automatically, typically in 60 to 120 seconds, using the same DNS endpoint.
- SQS visibility timeout
- A received message stays hidden for the visibility timeout; if the consumer does not delete it in time, the message becomes visible again and is redelivered.
- SQS FIFO deduplication
- FIFO queues deliver exactly-once processing within a five-minute deduplication interval using a message deduplication ID, and preserve strict ordering within each message group.
- Route 53 failover routing
- Failover routing sends traffic to a primary record while its health check passes and diverts to a secondary record once that check reports unhealthy.
- DynamoDB global tables
- Global tables replicate a DynamoDB table into multiple Regions with last-writer-wins conflict resolution, enabling multi-Region active-active reads and writes.
- S3 One Zone-IA risk
- One Zone-IA stores objects in a single Availability Zone, so an AZ failure destroys the data; it suits reproducible data that does not need resilience.
- Aurora storage replication
- Aurora keeps six copies of data across three Availability Zones, supports up to 15 read replicas, and exposes a reader endpoint that load-balances incoming connections.
- gp3 versus gp2
- gp3 delivers a 3,000 IOPS and 125 MB/s baseline independent of volume size, while gp2 performance scales with capacity at 3 IOPS per GiB.
- Cluster placement group
- Cluster placement groups pack instances close together inside a single Availability Zone for low latency and high throughput, typical of HPC and tightly coupled workloads.
- ALB versus NLB
- ALB routes Layer 7 requests by host, path, or header and terminates TLS; NLB handles Layer 4 at extreme throughput, preserves source IP, and provides static IP addresses.
- CloudFront origin groups
- Origin groups pair a primary and a secondary origin so CloudFront fails over automatically when the primary returns configured error codes or times out.
- CloudFront Functions vs Lambda@Edge
- CloudFront Functions run lightweight JavaScript at viewer events in sub-millisecond time; Lambda@Edge handles heavier logic at viewer and origin request events in Node.js or Python.
- S3 multipart upload
- Multipart upload splits an object into parts transferred in parallel, improving speed and allowing resume; it is recommended above 100 MB and required above 5 GB.
- DynamoDB hot partitions
- Low-cardinality partition keys concentrate traffic on a few partitions; high-cardinality keys combined with on-demand mode or adaptive capacity spread the load.
- Compute Savings Plans
- Compute Savings Plans commit to hourly spend for one or three years and apply automatically to EC2, Fargate, and Lambda across families and Regions, saving up to 66 percent.
- EC2 Instance Savings Plans
- These plans lock to one instance family in one Region in exchange for deeper discounts of up to 72 percent, trading flexibility for a lower hourly rate.
- Spot Instance interruption
- Spot Instances offer up to 90 percent off but can be reclaimed with a two-minute warning, so they suit stateless, checkpointed, or fault-tolerant workloads.
- S3 Intelligent-Tiering
- Intelligent-Tiering moves objects between access tiers automatically based on observed access patterns, charging a small monitoring fee instead of retrieval fees for tier changes.
- Glacier minimum storage duration
- S3 Glacier classes bill a minimum storage period, 90 days for Glacier tiers and 180 days for Deep Archive, even if objects are deleted earlier.
- NAT Gateway cost driver
- A NAT Gateway bills an hourly charge plus per-GB data processing; routing S3 and DynamoDB traffic through a free gateway endpoint avoids those processing charges entirely.
- Data transfer into AWS
- Inbound data transfer to AWS is generally free, while outbound transfer to the internet is billed per GB, so egress volume typically dominates cost design.
- EBS snapshot incrementality
- EBS snapshots are incremental after the first full copy and billed only for changed blocks; deleting a snapshot retains blocks still referenced by later snapshots.