Pass the AWS Solutions Architect Associate Exam. Architecture Decisions, Not Memorization. Réussir l'examen AWS Solutions Architect Associate. Des décisions d'architecture, pas de la mémorisation.

Core IAM Concepts

• Users — long-term credentials (access key + secret). Avoid for apps.
• Groups — attach policies to groups, not individual users
• Roles — temporary credentials via STS. Use for EC2, Lambda, cross-account
• Policies — JSON documents defining Allow/Deny. Explicit Deny always wins
• Permission boundary — caps the maximum permissions a role/user can have
• MFA — enforce via IAM policy condition aws:MultiFactorAuthPresent

Policy Evaluation Logic

• Default = implicit Deny (nothing is allowed until explicitly permitted)
• Explicit Allow on identity policy → access granted
• Explicit Deny anywhere → always overrides any Allow
• SCPs in Organizations act as guardrails — they restrict what even an admin can do
• Resource-based policies (S3 bucket policies) + identity policies both evaluated
• For cross-account: need Allow in both the role's trust policy AND identity policy

User Pools

• User directory — handles sign-up, sign-in, password reset
• Federate with social IDPs (Google, Facebook, Apple) and enterprise SAML/OIDC
• Returns JSON Web Tokens (JWT): ID token, access token, refresh token
• Use for: application authentication, securing API Gateway endpoints

Identity Pools (Federated Identities)

• Provides temporary AWS credentials via STS to grant users direct access to AWS resources
• Users can be authenticated (via User Pool, social, SAML) or unauthenticated (guest)
• Use for: allowing app users to directly upload to S3, write to DynamoDB, invoke Lambda
• Flow: User Pool JWT → Identity Pool → STS → temporary credentials → AWS resource

VPC Connectivity

• Internet Gateway — allows public subnets to reach internet
• NAT Gateway — allows private subnets outbound internet (no inbound). Managed, HA within AZ. Place in public subnet.
• VPC Peering — direct connection between VPCs (same or cross-account/region). Not transitive.
• Transit Gateway — hub-and-spoke. Connects many VPCs + on-prem. Transitive routing supported.
• VPN Gateway — connects on-premises network to VPC over IPsec
• Direct Connect — dedicated private line to AWS. Not internet-based. More consistent bandwidth.

VPC Endpoints

• Gateway Endpoint — free, for S3 and DynamoDB only. Route table entry.
• Interface Endpoint (PrivateLink) — ENI in your subnet, for most AWS services. Costs money. Works across VPCs.
• Use endpoints so traffic to S3/DynamoDB never leaves AWS network
• PrivateLink — expose your own service to other VPCs without peering

KMS — Key Management Service

• CMK (Customer Master Key) — the key that encrypts your data keys
• Envelope encryption — KMS encrypts a data key, data key encrypts your data. KMS never sees raw data.
• AWS-managed keys — free, automatic rotation every year
• Customer-managed keys — you control rotation, access policies, deletion
• KMS keys are regional — cannot be moved or exported
• CloudHSM — dedicated hardware, you control the key material. FIPS 140-2 Level 3.

S3 Encryption Options

• SSE-S3 — AWS manages keys (AES-256). Default. Lowest overhead.
• SSE-KMS — KMS manages keys. You get audit trail in CloudTrail. Control via KMS policy.
• SSE-C — you provide the key with each request. AWS does not store the key.
• Client-side — you encrypt before upload. AWS never sees plaintext.

AWS Shield

• Standard — free, automatic. Protects against common L3/L4 DDoS attacks
• Advanced — $3,000/month. 24/7 DRT team, financial protection, L7 protection with WAF

AWS WAF

• Layer 7 (HTTP) firewall. Works with CloudFront, ALB, API Gateway, AppSync
• Rules: IP sets, geo-match, rate-based, managed rule groups (OWASP Top 10)
• Can block SQL injection, XSS, bad bots

Network Firewall

• Stateful firewall at VPC level
• Deep packet inspection, intrusion detection
• Deploy in dedicated firewall subnets; route all traffic through it

Detection

• CloudTrail — logs every API call (who did what, when, from where). Management + data events. Store in S3.
• GuardDuty — ML-based threat detection. Analyzes CloudTrail, VPC Flow Logs, DNS logs. No agents needed.
• Macie — discovers and protects sensitive data (PII, financial) in S3 using ML
• Security Hub — aggregates findings from GuardDuty, Inspector, Macie into one dashboard
• Inspector — automated vulnerability scans for EC2, Lambda, container images

Governance

• Config — records configuration changes over time. Rules check compliance. Remediate with SSM Automation.
• Organizations — manage multiple AWS accounts. Consolidated billing. Apply SCPs to OUs.
• SCPs (Service Control Policies) — guardrails on what accounts can do. Even administrators are bound by SCPs. Do not grant permissions — only restrict.
• Control Tower — sets up a multi-account environment with guardrails automatically (uses Organizations + Config)

S3 Object Lock

• Implements Write Once, Read Many (WORM) policy — objects cannot be deleted or overwritten
• Compliance Mode — no one (including root account) can delete or alter the object or shorten the retention period. Unbreakable.
• Governance Mode — most users cannot delete/modify, but users with s3:BypassGovernanceRetention permission can. Useful for internal audits.
• Legal Hold — blocks deletion regardless of retention period. Can be placed/removed by users with s3:PutObjectLegalHold. No expiry date.
• Must enable Object Lock at bucket creation. Requires versioning.

Glacier Vault Lock

• Locks a Glacier vault's access policy permanently using a Vault Lock policy
• Once locked (initiated → confirmed), the policy cannot be changed or deleted — even by an AWS administrator
• Use for: SEC Rule 17a-4, HIPAA, financial record compliance requirements
• Difference from S3 Object Lock: applies to entire Glacier vault, not individual objects

RTO vs RPO

• RTO (Recovery Time Objective) — how long you can be down. Max acceptable downtime.
• RPO (Recovery Point Objective) — how much data you can lose. Max acceptable data age at recovery.
• Lower RTO/RPO = more expensive architecture
• RTO 0 = active-active multi-region. RPO 0 = synchronous replication.

DR Strategies (cheapest → fastest)

• Backup & Restore — highest RPO/RTO, lowest cost. Restore from S3/Glacier.
• Pilot Light — minimal core systems running. Scale up on disaster.
• Warm Standby — scaled-down version running. Scale up quickly.
• Active-Active (Multi-site) — full production in 2+ regions. RTO ≈ 0.

ALB L7

• HTTP/HTTPS/gRPC
• Path-based routing (/api/* → service A)
• Host-based routing (api.example.com)
• Target groups: EC2, ECS, Lambda, IPs
• Sticky sessions, WebSocket, redirect rules

NLB L4

• TCP/UDP/TLS
• Millions of requests/second, ultra-low latency
• Static IP per AZ (or Elastic IP) — required for IP whitelisting
• Preserves source IP
• Use for: gaming, IoT, real-time

GWLB L3

• Inline traffic inspection
• Routes traffic through 3rd-party network appliances (firewalls, IDS)
• Transparent to source and destination
• GENEVE protocol on port 6081

Scaling Policies

• Target Tracking — maintain a metric at a target (e.g., CPU at 60%). Simplest. Recommended.
• Step Scaling — add/remove capacity in steps based on alarm thresholds
• Simple Scaling — single CloudWatch alarm triggers single action. Has cooldown period.
• Scheduled — scale at known times (e.g., add capacity every Monday 8am)
• Predictive — ML forecasts future load, pre-scales

Key Concepts

• Launch Template — defines AMI, instance type, SG, user data for new instances
• Cooldown period — prevents launching/terminating instances too rapidly after a scaling event
• Lifecycle hooks — pause instance launch/terminate for custom actions (e.g., drain connections, run scripts)
• Warm pool — pre-initialized instances ready to launch quickly
• Termination policy: default terminates instance from AZ with most instances, oldest launch template first

RDS Multi-AZ vs Read Replicas

Aurora

• 6 copies of data across 3 AZs — survives losing 2 copies for writes, 3 for reads
• Up to 15 read replicas (RDS max: 5)
• Aurora Global Database — 1 primary region, up to 5 read-only secondary regions. Replication <1 second. Promote secondary for DR.
• Aurora Serverless v2 — scales compute instantly in fine-grained increments. Great for unpredictable workloads.
• Writer endpoint, reader endpoint, custom endpoints

SQS — Simple Queue Service

• Pull-based. Consumers poll the queue.
• Standard — at-least-once, best-effort ordering, unlimited throughput
• FIFO — exactly-once, strict ordering, 3,000 msgs/sec with batching
• Visibility timeout — hides message while being processed (default 30s). Extend if processing takes longer.
• DLQ (Dead Letter Queue) — receives messages that fail processing after max retries
• Retention: 1 min to 14 days (default 4 days)
• Max message size: 256 KB

SNS vs EventBridge

• SNS — push-based pub/sub. 1 topic → many subscribers (SQS, Lambda, email, HTTP). Fan-out pattern.
• SNS FIFO — strictly ordered, deduplication, SQS FIFO subscribers only
• EventBridge — event bus. Rules filter and route events to targets. Supports SaaS sources (Zendesk, Datadog). More powerful than SNS for complex routing.
• Fan-out pattern: SNS → multiple SQS queues → separate Lambda functions. Each queue processes independently.

Cluster

• All instances in same AZ, physically close
• 10 Gbps network between instances
• Risk: AZ failure takes all instances
• Use for: HPC, big data, low-latency tightly coupled workloads

Spread

• Each instance on separate hardware rack
• Max 7 instances per AZ per group
• Lowest risk of simultaneous failure
• Use for: critical instances that must not fail together

Partition

• Groups of instances on separate racks (partitions)
• Up to 7 partitions per AZ, hundreds of instances
• Instances in same partition share rack
• Use for: Hadoop, Cassandra, Kafka — rack-aware apps

ENA — Elastic Network Adapter

• Standard enhanced networking — up to 100 Gbps
• Enabled by default on most modern instance types (C5, M5, R5, etc.)
• Best for: high-throughput traditional workloads, web servers, databases
• Uses standard TCP/IP networking stack (OS kernel involved)

EFA — Elastic Fabric Adapter

• Adds OS-bypass capability for node-to-node communication — bypasses the OS kernel
• Dramatically lower latency, higher throughput for inter-node traffic
• Required for: tightly coupled HPC workloads using MPI (Message Passing Interface) and distributed ML training
• EFA includes all ENA capabilities — it's a superset
• Supported on specific instance types (C5n, P4d, Hpc6a, etc.)

ElastiCache: Redis vs Memcached

CloudFront Caching

• CDN — caches content at 450+ edge locations globally
• Cache behaviors — different TTLs/origins per path pattern
• Origin Shield — centralized caching layer in front of origin. Reduces origin load.
• Invalidations — purge cached files (first 1,000 paths/month free)
• Signed URLs — single file access control. Signed Cookies — multiple files.
• Lambda@Edge — run code at edge (viewer request/response, origin request/response)

Global Accelerator

• 2 static anycast IPs (whitelistable). Routes users to nearest AWS edge.
• Traffic travels AWS backbone — not public internet — from edge to origin
• Works with ALB, NLB, EC2, Elastic IPs
• Health checks + instant failover (sub-30s)
• Best for: TCP/UDP apps, gaming, VoIP, APIs needing static IPs

Global Accelerator vs CloudFront

• Both use AWS edge locations and global backbone
• CloudFront — caches content at edge. HTTP only. Best for static/cacheable content.
• Global Accelerator — no caching. Any TCP/UDP. Routes to origin. Best for dynamic content, non-HTTP, fixed IPs.

Data Streams

• Real-time streaming, millisecond latency
• Ordered within shard, replay-able (up to 365 days)
• You manage shards (capacity planning)
• Multiple consumers possible simultaneously
• Use for: real-time analytics, event sourcing

Data Firehose

• Near real-time delivery (60s batch or 1 MB buffer)
• Fully managed — no shards to manage
• Destinations: S3, Redshift, OpenSearch, Splunk
• Can transform data with Lambda
• Use for: log delivery to S3, analytics pipelines

Data Analytics

• Run SQL queries on streaming data in real-time
• Source: Data Streams or Firehose
• Output: Data Streams, Firehose, Lambda
• Use for: real-time dashboards, anomaly detection

Amazon Athena

• Serverless interactive query service — analyze data directly in S3 using standard SQL
• No infrastructure to provision or manage. Pay per query ($5/TB scanned).
• Supports: CSV, JSON, Parquet, ORC, Avro. Use columnar formats (Parquet/ORC) + partitioning to reduce cost.
• Works with AWS Glue Data Catalog as the metadata/schema layer
• Use for: ad-hoc queries on S3 data lake, log analysis (CloudTrail, ALB logs, VPC Flow Logs), one-time analysis

Redshift Spectrum

• Extends an existing Amazon Redshift cluster to query data in S3 without loading it first
• Runs queries against exabytes of unstructured data in S3 — no ETL required
• Requires an existing Redshift cluster (not serverless by itself)
• Use for: joining S3 data lake with Redshift warehouse tables, running complex analytics across hot (Redshift) + cold (S3) data

Lambda

• Max execution: 15 minutes. Memory: 128 MB – 10 GB. Ephemeral storage: up to 10 GB (/tmp).
• Reserved concurrency — caps max concurrent executions for a function
• Provisioned concurrency — pre-warms instances to eliminate cold starts
• Triggered by: API Gateway, ALB, SQS, SNS, S3, DynamoDB Streams, EventBridge, Kinesis
• VPC Lambda: needs NAT Gateway to access internet. Uses ENIs — takes a few seconds to initialize (improved with Hyperplane ENIs)

ECS / EKS / Fargate

• ECS — AWS container orchestration. EC2 launch type (you manage) or Fargate (serverless).
• EKS — managed Kubernetes. More control, more complexity. Also supports Fargate.
• Fargate — no EC2 to manage. Pay per vCPU/memory per second. Right-size per task.
• ECR — Elastic Container Registry. Stores Docker images. Integrates with ECS/EKS/Lambda.
• ECS task role — IAM role attached to individual tasks (not the EC2 host)

Right-Sizing

• AWS Compute Optimizer — ML-based recommendations for EC2, EBS, Lambda, ECS. Analyzes actual utilization over 14 days.
• Trusted Advisor — identifies idle/underutilized instances, low-utilization load balancers
• Downsize over-provisioned instances. Upgrade instance family for better price/performance ratio.
• ARM-based (Graviton) instances: up to 40% better price/performance for many workloads

Serverless Cost Model

• Lambda — pay per invocation + duration (ms). Free tier: 1M requests/month forever.
• Fargate — pay per vCPU and memory per second. No idle EC2 cost.
• DynamoDB on-demand — pay per read/write request. No capacity planning.
• Serverless is cheapest for variable/spiky workloads. Reserved EC2 beats Lambda for constant high-throughput.

Cost Explorer

• Visualize spending over time
• Filter by service, account, tag, region
• RI recommendations built in
• 12-month forecast

AWS Budgets

• Set cost, usage, reservation, or Savings Plans budgets
• Alert when actual or forecasted spend exceeds threshold
• Email, SNS, or Chatbot notifications
• First 2 budgets free

Trusted Advisor

• Cost, performance, security, fault tolerance, service limits
• Basic (free): 7 core checks
• Business/Enterprise support: all checks + API
• Flags idle resources, unused EIPs, low-utilization EC2