sultanops

Cost and Good Architecture

2026-11-02T00:00:00Z

You've come a long way since part one. In this final part we answer two questions that apply to everything we built: how much does it cost? and is it designed well? Then we turn it all into a file you can rebuild with one command.

Where does the network money go?

Most people plan for servers and storage, then get surprised by data transfer. Prices here are approximate for US Regions:

Data going into AWS is free, and within a zone over private addresses too. You pay when it crosses a boundary: between zones, between Regions, or out to the internet.

Direction	Approx. price per GB
Into AWS from the internet	Free
Inside one Availability Zone, using private IPs	Free
Between Availability Zones	$0.01 in each direction
Between Regions	From about $0.02, and it varies by Region
Out to the internet	About $0.09 and falling with volume, with the first 100 GB a month free

Small numbers add up quickly. Six things that cut them:

Use private IPs inside the VPC instead of public ones, and note that every public IPv4 address also has an hourly charge.
Put CloudFront in front of your application. Data from AWS to CloudFront is free, and out through it costs less than going out directly.
Add a gateway endpoint for S3 and DynamoDB. It's free, and it spares you NAT charges per GB.
One NAT gateway per Availability Zone, so traffic doesn't cross zones to reach it.
Keep chatty services close. Balance this against availability, though, as splitting across zones is worth paying for.
Compress what you send, and cache it as far forward as you can.

Where's the caching?

Each layer saves work for the ones behind it, so the further forward the better, and we've seen them all:

Layer	Tool	Saves
The edge	CloudFront	The whole trip, for content that's the same for everyone
The API	API Gateway cache	The function and the database
The application	ElastiCache	Heavy queries and calculations
The database	DAX or a read replica	Reads from the main database

Tools that watch your bill

Tool	What it does
Cost Explorer	Charts your spending by service, account and tag, forecasts it, and recommends Savings Plans
Budgets	Alerts you when you reach or are forecast to reach a limit, and monitoring is free
Cost Anomaly Detection	Uses machine learning to spot unusual spending, at no charge
Cost Optimization Hub	Gathers recommendations for savings in one place: resizing, idle resources and more
Compute Optimizer	Recommends suitable sizes based on your actual use
Cost and Usage Report	The most detailed data on your costs and usage, delivered as files to S3 for you to analyze. AWS Data Exports creates similar exports with the columns you choose

And the first step is tags: without an env or team tag, you won't know who's spending what. And tags only reach your cost reports once you activate them as cost allocation tags in the billing console.

Quick savings

Action	Where we saw it
Resize oversized servers	Part three
Commit with Savings Plans, and use Spot for what tolerates interruption	Part four
Stop dev servers at night, for example with Instance Scheduler on AWS	This part
Lifecycle rules for S3	Part sixteen
Set a retention period on logs	Part twenty-five
Delete orphaned disks, snapshots and load balancers	Part five

The Well-Architected Framework

AWS has summarized what it's learned from its customers in six pillars. Consider it a review for any design:

Pillar	The question	We covered it in
Operational excellence	Can you run it and improve it?	Monitoring and templates
Security	Are data and access protected?	IAM and encryption
Reliability	Does it survive failures and recover?	Scaling and recovery
Performance efficiency	Are you using the right resources?	Caching and choosing a database
Cost optimization	Are you paying for what you don't need?	This part
Sustainability	Are you reducing your consumption and its impact?	Right sizing and Graviton

The pillars pull against each other at times: more copies mean better reliability and higher cost. The aim isn't to max out everything, but to make the trade-off knowingly.

AWS Well-Architected Tool: a free tool in the console that asks you questions about your workload and shows the risks.
Trusted Advisor: checks your account against best practices. On the free plan you get service limits and a few security and fault-tolerance checks, and the rest need a paid support plan. Note that AWS is changing its support plans, with Developer and Business ending on January 1, 2027 in favor of Business Support+.

CloudFormation: your infrastructure in a file

So far we've created everything by hand or by command. What if you could describe it all in a file? AWS CloudFormation reads a template and builds a stack of resources, in the right order, and:

Repeatable: the same environment for development, testing and production.
Reviewable: the template sits in Git like code, and you review its changes.
Controlled: a change set shows what will change before it happens, and drift detection reveals manual changes.
Clean: deleting a stack deletes everything in it, so nothing's left billing you.
Free: you pay only for the resources it creates.

Infrastructure Composer lets you draw a template visually, and AWS CDK writes it in Python or TypeScript. A service role lets a developer deploy a stack without having permission over the resources themselves.

Systems Manager: running your servers

AWS Systems Manager manages fleets of servers through an agent, already installed on Amazon Linux, and an IAM role:

Tool	What it does
Session Manager	A terminal with no SSH port and no keys, with sessions logged
Run Command	One command across a thousand servers
Patch Manager	Applies updates on a schedule
Maintenance Windows	Sets when these things are allowed to happen
Automation	Ready documents for common tasks, like Config remediation

Applications you can't change

Not every application can be rewritten, and you can often make an old one more reliable from the outside, without touching its code:

Problem	Solution
One server that can fail	An Auto Scaling group of one with a health check, or automatic recovery, which brings it back on new hardware with the same addresses
Load that overwhelms it	CloudFront in front of it, for whatever can be cached
Too many database connections	RDS Proxy, which only needs a new endpoint
A database that can go down	Multi-AZ, which keeps the same endpoint
Clients allowing fixed addresses through their firewalls	The two static addresses of Global Accelerator

Services worth knowing

A last group that deserves a line each:

Service	What it's for
SES	Sending email, for transactions and marketing, with protection for your reputation
AWS Batch	Batch jobs at any scale, on EC2 or Fargate, with no 15-minute limit like Lambda
AWS Outposts	AWS servers in your own data center, for when the data must stay with you
Amazon AppFlow	Moving data from SaaS applications such as Salesforce into S3 or Redshift, with no code
AWS Amplify	Quickly building and hosting web and mobile applications
Service Catalog	A catalog of approved services, so teams deploy only what's allowed
License Manager	Tracks software licenses, such as Oracle and SAP, across accounts
Device Farm	Testing apps on real phones and tablets hosted by AWS

If you read older articles, Amazon Pinpoint reached its end of support on October 30, 2026. AWS points to SES for email, and to AWS End User Messaging for SMS and push notifications. AWS Proton also reached its end of support, on October 7, 2026, though the exam guide still lists it.

High performance computing

When you need thousands of processors working together:

Need	Tools
Compute	A cluster placement group, with Enhanced Networking or EFA, and Spot where possible
Storage	FSx for Lustre, Instance Store and S3
Orchestration	AWS Batch or AWS ParallelCluster
Moving data	Direct Connect or DataSync

Hands-on: a whole stack from a file, and a budget you'll keep

Write a small template with a bucket and an SNS topic. From CloudShell:

Bash

cat > stack.yaml <<'EOF'
AWSTemplateFormatVersion: "2010-09-09"
Description: A small stack from the AWS series
Parameters:
  Env:
    Type: String
    Default: dev
Resources:
  Files:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled
      Tags:
        - Key: env
          Value: !Ref Env
  Alerts:
    Type: AWS::SNS::Topic
Outputs:
  BucketName:
    Value: !Ref Files
EOF

aws cloudformation deploy --stack-name series-stack --template-file stack.yaml

aws cloudformation describe-stack-resources --stack-name series-stack \
  --query "StackResources[].[LogicalResourceId,ResourceType,ResourceStatus]" \
  --output table

CloudFormation built both resources and named them itself. Now change one value. It updates only what changed, without touching the rest:

Bash

aws cloudformation deploy --stack-name series-stack \
  --template-file stack.yaml --parameter-overrides Env=prod

BUCKET=$(aws cloudformation describe-stacks --stack-name series-stack \
  --query "Stacks[0].Outputs[0].OutputValue" --output text)

aws s3api get-bucket-tagging --bucket $BUCKET \
  --query "TagSet[?Key=='env'].Value" --output text

It prints prod. Now the nicest part, deleting everything with one command:

Bash

aws cloudformation delete-stack --stack-name series-stack
aws cloudformation wait stack-delete-complete --stack-name series-stack
echo "Everything is gone"

Finally, one thing to keep: a budget of $10 a month that warns you when you're forecast to exceed 80% of it. Replace the email address with yours:

Bash

EMAIL=you@example.com
ACCOUNT=$(aws sts get-caller-identity --query Account --output text)

cat > budget.json <<'EOF'
{
  "BudgetName": "series-monthly",
  "BudgetLimit": {"Amount": "10", "Unit": "USD"},
  "TimeUnit": "MONTHLY",
  "BudgetType": "COST"
}
EOF

cat > notify.json <<EOF
[{
  "Notification": {
    "NotificationType": "FORECASTED",
    "ComparisonOperator": "GREATER_THAN",
    "Threshold": 80,
    "ThresholdType": "PERCENTAGE"
  },
  "Subscribers": [{"SubscriptionType": "EMAIL", "Address": "$EMAIL"}]
}]
EOF

aws budgets create-budget --account-id $ACCOUNT \
  --budget file://budget.json \
  --notifications-with-subscribers file://notify.json

aws budgets describe-budgets --account-id $ACCOUNT \
  --query "Budgets[].[BudgetName,BudgetLimit.Amount,BudgetLimit.Unit]" --output table

If you get AccessDenied, your IAM user may need billing access, which the root user enables from the account settings.

Summary

Data transfer is the hidden cost: between zones, between Regions, and out to the internet.
Budgets and Cost Anomaly Detection warn you before the bill does.
The Well-Architected Framework has six pillars, and the point is to make trade-offs knowingly.
CloudFormation turns your infrastructure into a reviewable, deletable file.
Systems Manager manages your servers without SSH.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 7

Two EC2 servers in the same Availability Zone exchange terabytes a month by calling each other's public IP addresses, and the transfer shows up on the bill. What's the simplest fix?

Show the answer

Correct answer: B

Data between servers in one Availability Zone is free over private addresses, while traffic through a public address is charged.

A: Crossing zones is charged in each direction.
C: A NAT gateway adds a charge for every gigabyte.
D: The size of the server doesn't change what the transfer costs.

Review: Where does the network money go? in this part, and EC2 On-Demand Instance Pricing on the AWS site.

Question 2 of 7

A small team wants an email when this month's AWS spending is forecast to pass its limit, not after the bill arrives. What fits?

Show the answer

Correct answer: A

A budget can alert on forecasted spending as well as actual spending, and the monitoring itself is free.

B: This charts your spending and forecasts it, but someone has to go and look.
C: This recommends suitable sizes, and sends no spending alerts.
D: This records settings, not spending.

Review: Tools that watch your bill in this part, and Managing your costs with AWS Budgets in the AWS docs.

Question 3 of 7

A team wants to review one workload's design against AWS's best practices, by answering questions about it and seeing the risks. What fits?

Show the answer

Correct answer: D

The tool asks you questions about your workload, and shows you the risks. It's free in the console.

A: This scans what you run for known vulnerabilities, and doesn't review a design.
B: This checks your account's resources by itself, and doesn't ask about a workload.
C: This records who called what.

Review: The Well-Architected Framework in this part, and AWS Well-Architected Tool FAQs on the AWS site.

Question 4 of 7

A team wants the same environment in development and production from one file in Git, to see what an update will change before it happens, and to know if someone edits a resource by hand. What fits?

Show the answer

Correct answer: C

A template builds the same stack every time and sits in Git. Change sets show what will change, and drift detection reveals manual edits.

A: This runs commands on servers, and doesn't describe infrastructure.
B: This repeats a server's contents, not the network and other resources around it.
D: This records settings and judges them, but doesn't build anything.

Review: CloudFormation: your infrastructure in a file in this part, and Update CloudFormation stacks using change sets and Detect unmanaged configuration changes to stacks and resources with drift detection in the AWS docs.

Question 5 of 7

A company must apply security updates across 500 EC2 servers, only during a Saturday night slot, and with no SSH access. Which two tools fit? (Choose two.)

Show the answer

Correct answer: B + E

Patch Manager applies the updates, and Maintenance Windows sets when they're allowed to happen.

A: This gives you a terminal, one session at a time.
C: This stores settings and simple secrets.
D: This recommends suitable sizes based on your use.

Review: Systems Manager: running your servers in this part, and AWS Systems Manager Patch Manager and AWS Systems Manager Maintenance Windows in the AWS docs.

Question 6 of 7

A finance team wants the cost of each team in detailed files it can analyze itself. Resources are already tagged with team, but the tag doesn't appear in the reports. Which two steps fit? (Choose two.)

Show the answer

Correct answer: B + E

Tags only reach cost reports once they're activated, and the Cost and Usage Report delivers the most detailed data as files in S3.

A: This records resource settings, not costs.
C: This recommends suitable sizes.
D: This records operations inside resources, not costs.

Review: Tools that watch your bill in this part, and What are AWS Cost and Usage Reports? and Organizing and tracking costs using AWS cost allocation tags in the AWS docs.

Question 7 of 7

An old application runs on one EC2 server, and its clients connect to that server's address. The code can't be changed. If the hardware fails, the server must come back by itself with the same addresses. What fits?

Show the answer

Correct answer: C

Recovery brings the server back on new hardware, keeping its instance ID and its private, public and Elastic IP addresses.

A: This is a rewrite, and the code can't change.
B: The replacement is a new server, with new addresses.
D: You'd have to restore it by hand, onto a new server with new addresses.

Review: Applications you can't change in this part, and Automatic instance recovery in the AWS docs.

What you've learned

Twenty-nine parts in nine sections. Look at what you can do now:

Section	You can now
Fundamentals	Understand the global infrastructure and control permissions
Servers and their storage	Run a server, choose its pricing and keep its data
High availability and scaling	Build an application that survives failures and grows by itself
Databases	Choose the right database and speed it up
Networking and content delivery	Design a private network and deliver content around the world
Object storage	Store anything in S3 at the right price, and securely
Modern applications	Separate services, and run containers and serverless
Data and AI	Analyze your data and add AI to your application
Security and operations	Monitor, protect, recover and control your costs

Where to go from here

Build something real. A small project of your own teaches you more than any article, even a little site with an API.
Try the comprehensive test. It picks random questions from every part, so you can see what's stuck and what to review.
Read the FAQs. Each service's FAQ page is a short, rich and accurate summary.
Consider a certification. Solutions Architect Associate covers most of what's in this series, and the exam tests how you choose between services. Read each question for its deciding phrase, such as "lowest cost" or "least operational effort", and eliminate the wrong answers first. Its official exam guide lists every domain and service.
Follow the changes. AWS changes quickly, and several things in this series changed even as it was being written. Check the docs before any decision.

Thanks for coming along to the end, and good luck with what you build.

Disaster Recovery and Migration

2026-11-02T00:00:00Z

In part seven our application survived losing an Availability Zone. But what if the disaster is bigger: a whole Region down, a mistaken DELETE, or ransomware? And this part's other half: what if your application isn't on AWS yet, and you want to bring it over?

RPO and RTO

Before any technical decision, you need two numbers from the business:

RPO looks backward from the disaster to the last good copy, and RTO looks forward to when service returns.

Number	The question	Example
RPO (Recovery Point Objective)	How much data can we afford to lose?	Backing up every hour means losing up to an hour of data
RTO (Recovery Time Objective)	How long can we stay down?	Up to four hours of downtime

The smaller the two numbers, the higher the cost. So the question isn't "what's best?", but "what is an hour of downtime worth to us?"

Four strategies

These are for recovering in another Region, ordered from the cheapest to the most expensive. The difference between them is how much is running there before the disaster:

What's running in the other Region before the disaster: the more that's ready, the faster you recover and the more you pay.

Strategy	Approx. RPO	Approx. RTO	Suits
Backup and restore	Hours	Up to 24 hours	Non-critical systems
Pilot light	Minutes	Tens of minutes	The core data must always be ready
Warm standby	Seconds	Minutes	Important systems with a limited budget
Multi-site (active-active)	Close to zero	Close to zero	Where a minute of downtime costs a fortune

Backup and restore: backups copied to another Region, with everything built from them in a disaster. A template helps, as we'll see in the next part.
Pilot light: the data is replicating, such as an Aurora Global Database or S3 replication, and the servers are ready but stopped.
Warm standby: a small full copy is running and can take traffic right away, then it grows with Auto Scaling.
Multi-site: both Regions serve users all the time, such as with Route 53 and Global Tables.

Tips that make the difference

Test your recovery. A backup you've never restored is only a hope. Run drills, and take advantage of AWS Fault Injection Service to cause failures deliberately.
Automate. Build the environment from templates, because in a disaster nobody remembers the steps.
Protect your backups from yourself. Put them in another account and another Region, because an attacker who gets into your account will go for them first.
Think of Elastic Disaster Recovery. AWS DRS continuously replicates your servers to cheap storage, and launches them only when needed, with an RPO of seconds and an RTO of minutes.
Check the quotas in the standby Region. Quotas are per Region, so a small standby can hit its limit just when it has to grow. Raise them there in advance, from the Service Quotas console.

AWS Backup: everything in one place

Each service has its own backups, but AWS Backup manages them centrally, for EC2, EBS, S3, RDS, Aurora, DynamoDB, EFS, FSx and others:

Part	What it does
Backup plan	A schedule and a retention period, such as daily for 35 days, then moving to cold storage
Vault	Where the backups are stored, encrypted with KMS
Tags	Back up anything tagged `backup=daily`, so new resources join by themselves
Copies	To another Region or another account, for real disaster protection
Vault Lock	Stops anyone, even the root user in compliance mode, from deleting backups before they expire

Vault Lock is your strongest defense against ransomware and against someone with stolen administrator credentials.

Migrating databases: DMS

AWS DMS (Database Migration Service) moves a database while it stays in use: it copies the existing data, then keeps sending changes (known as CDC) until you're ready to switch over.

Type	Example	Tools
Same engine	MySQL on a server to RDS for MySQL	DMS alone is enough
Different engine	Oracle to Aurora PostgreSQL	DMS Schema Conversion or SCT, to convert the tables and code first, then DMS for the data

Sources and targets are many, including on-premises databases, RDS, S3, DynamoDB, Redshift and OpenSearch. It can run in Multi-AZ, with a standby instance in another zone, or as Serverless so you don't have to size it.

Moving to RDS or Aurora

If you're moving MySQL or PostgreSQL, you have simpler routes:

Method	Downtime	When
Snapshot from RDS to Aurora	Yes, during the move	Downtime is acceptable
Aurora read replica, then promote it	Very short	From RDS, with no real downtime
Backup from S3	Yes	Coming from outside RDS: Percona XtraBackup for MySQL
DMS	Very short	Continuous replication from anywhere

Migrating servers and whole data centers

You want	Use
Moving servers as they are (lift and shift)	AWS Transform MGN
Importing one virtual machine image	VM Import/Export
Moving VMware as it is	Amazon Elastic VMware Service, or VMware Cloud on AWS from Broadcom
Help planning a large migration	AWS Transform
Moving files	DataSync
Putting Java or .NET applications in containers	App2Container

AWS Transform MGN was known as Application Migration Service until 2026. An agent on your server replicates its disks continuously to low-cost AWS resources, you test as often as you like, then you switch over in minutes. It's usually the fastest way out of a data center.

And if you have huge amounts of data, we did the math in part eighteen.

Hands-on: delete the data and bring it back

We'll play out a small disaster: a table, a backup, a mistaken delete, then a restore. From CloudShell, create the table with one order:

Bash

aws dynamodb create-table --table-name series-orders \
  --attribute-definitions AttributeName=id,AttributeType=S \
  --key-schema AttributeName=id,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST \
  --query TableDescription.TableStatus

aws dynamodb wait table-exists --table-name series-orders

aws dynamodb put-item --table-name series-orders \
  --item '{"id":{"S":"1001"},"total":{"N":"120"}}'

TABLE_ARN=$(aws dynamodb describe-table --table-name series-orders \
  --query Table.TableArn --output text)

AWS Backup needs a role and a vault:

Bash

cat > trust.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "backup.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}
EOF

ROLE_ARN=$(aws iam create-role --role-name series-backup-role \
  --assume-role-policy-document file://trust.json \
  --query Role.Arn --output text)

aws iam attach-role-policy --role-name series-backup-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup
aws iam attach-role-policy --role-name series-backup-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores

aws backup create-backup-vault --backup-vault-name series-vault \
  --query BackupVaultName --output text

Start a backup, then wait for it. If you get a role error, wait a few seconds and repeat the first command. This usually takes a few minutes:

Bash

JOB=$(aws backup start-backup-job --backup-vault-name series-vault \
  --resource-arn $TABLE_ARN --iam-role-arn $ROLE_ARN \
  --query BackupJobId --output text)

while true; do
  STATE=$(aws backup describe-backup-job --backup-job-id $JOB \
    --query State --output text)
  echo $STATE
  case $STATE in COMPLETED|FAILED|ABORTED|EXPIRED) break ;; esac
  sleep 15
done

POINT=$(aws backup describe-backup-job --backup-job-id $JOB \
  --query RecoveryPointArn --output text)

Now the disaster. The order is gone:

Bash

aws dynamodb delete-item --table-name series-orders \
  --key '{"id":{"S":"1001"}}'

aws dynamodb get-item --table-name series-orders \
  --key '{"id":{"S":"1001"}}'

The second command prints nothing. Restore the backup to a new table, and note the time it takes, because this is your real RTO:

Bash

RESTORE=$(aws backup start-restore-job --recovery-point-arn $POINT \
  --iam-role-arn $ROLE_ARN \
  --metadata targetTableName=series-orders-restored,encryptionType=Default \
  --query RestoreJobId --output text)

while true; do
  STATE=$(aws backup describe-restore-job --restore-job-id $RESTORE \
    --query Status --output text)
  echo $STATE
  case $STATE in COMPLETED|FAILED|ABORTED) break ;; esac
  sleep 15
done

aws dynamodb get-item --table-name series-orders-restored \
  --key '{"id":{"S":"1001"}}' --query Item

The order's back. Anything written after the backup is lost, and that's your RPO.

Bash

aws backup delete-recovery-point --backup-vault-name series-vault \
  --recovery-point-arn $POINT
aws backup delete-backup-vault --backup-vault-name series-vault

aws dynamodb delete-table --table-name series-orders \
  --query TableDescription.TableStatus
aws dynamodb delete-table --table-name series-orders-restored \
  --query TableDescription.TableStatus

aws iam detach-role-policy --role-name series-backup-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup
aws iam detach-role-policy --role-name series-backup-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores
aws iam delete-role --role-name series-backup-role

Summary

RPO is the data you lose, RTO is the time you're down, and the business decides both.
The four strategies: backup, pilot light, warm standby and multi-site, with cost rising as they improve.
AWS Backup manages backups centrally, and Vault Lock protects them.
DMS moves databases while they run, and AWS Transform MGN moves servers.
Test your recovery, or you don't have any.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 6

A company backs up its database every six hours, and a full restore takes two hours. In the worst case, what are its RPO and RTO?

Show the answer

Correct answer: D

RPO is the data you can lose, which is up to the six hours since the last backup. RTO is the time you're down, which is the two hours of restoring.

A: This swaps the two numbers.
B: The numbers measure different things, so they don't add together.
C: Anything written since the last backup is lost, so the RPO isn't zero.

Review: RPO and RTO in this part, and Business Continuity Plan (BCP) in the AWS docs.

Question 2 of 6

An application must recover in another Region within an hour and lose only minutes of data, at the lowest cost that meets this. Which strategy fits?

Show the answer

Correct answer: B

Pilot light keeps the data replicating with the servers ready but stopped, which gets you back in tens of minutes for little running cost.

A: Recovery can take up to 24 hours, and you'd lose hours of data.
C: This also meets the need, but you'd pay for a full copy running all the time.
D: This meets it too, at by far the highest cost.

Review: Four strategies in this part, and Disaster recovery options in the cloud in the AWS docs.

Question 3 of 6

A company fears ransomware: an attacker with stolen administrator credentials could delete its backups. Which step protects them best?

Show the answer

Correct answer: A

In compliance mode nobody can delete a backup before it expires, not even the root user.

B: An administrator can simply change the policy.
C: Encrypted backups can still be deleted.
D: You'd hear about the deletion, but the backups would already be gone.

Review: AWS Backup: everything in one place in this part, and AWS Backup Vault Lock in the AWS docs.

Question 4 of 6

A company wants to move 200 servers from its data center to AWS as they are, test them there as often as it likes, and cut over in minutes. What fits?

Show the answer

Correct answer: C

An agent on each server replicates its disks continuously to AWS, so you can test at will, then switch over in minutes.

A: This moves databases, not whole servers.
B: This moves files.
D: This imports virtual machine images, with no continuous replication.

Review: Migrating servers and whole data centers in this part, and What Is AWS Transform MGN? in the AWS docs.

Question 5 of 6

A company is moving a busy Oracle database to Aurora PostgreSQL, with very little downtime. Which two tools does it need? (Choose two.)

Show the answer

Correct answer: C + E

The engines differ, so the tables and code are converted first. DMS then copies the data and keeps sending changes until you're ready to switch.

A: This moves servers as they are, so the database would stay on Oracle.
B: This moves files, and can't keep a live database in sync.
D: Aurora read replicas come from RDS for MySQL or PostgreSQL, not from Oracle.

Review: Migrating databases: DMS in this part, and What is AWS Database Migration Service? and Converting database schemas using DMS Schema Conversion in the AWS docs.

Question 6 of 6

In a recovery drill, a warm standby in a second Region starts to grow, but new servers fail to launch because of an account limit that's lower there than in the main Region. What should the team do?

Show the answer

Correct answer: A

Quotas are per Region, so the standby needs limits high enough for production capacity before a disaster. You raise them from the Service Quotas console.

B: This keeps even less running, and would hit the same limit when it grows.
C: This protects data, and doesn't change the limit.
D: Quotas are per Region, so this doesn't help the standby.

Review: Tips that make the difference in this part, and Disaster recovery options in the cloud and What is Service Quotas? in the AWS docs.

Your application is now built, protected and recoverable. One last question remains: how much does it cost, and is it designed well? In part twenty-nine we close the series with cost and good architecture.

Encryption, Secrets and Threat Protection

2026-11-02T00:00:00Z

In part twenty-six we controlled who gets in. This part assumes the worst: a disk gets stolen, a password leaks, or someone attacks your site. What protects you then?

You want	Use
Encryption keys you control	KMS
Settings and simple secrets	Parameter Store
Passwords that rotate by themselves	Secrets Manager
HTTPS certificates	ACM
Stopping web attacks	WAF
Withstanding DDoS attacks	Shield
Detecting threats in your account	GuardDuty
Finding vulnerabilities in what you run	Inspector
Finding sensitive data in S3	Macie

AWS KMS: the key safe

We saw the types of encryption in S3. Behind most of them is KMS (Key Management Service): keys are created and used inside it and never leave it unencrypted, access is controlled by policies, and every use is recorded in CloudTrail.

Envelope encryption

KMS doesn't encrypt your large files itself. It makes a data key that encrypts the file, and it encrypts that data key with your master key:

The data key encrypts the file, and an encrypted copy of it is stored beside the file. Only KMS can open that copy, so the file is useless without permission.

So even whoever steals the disk gets encrypted data with an encrypted key next to it. To decrypt, you need permission to ask KMS to open the data key, and that's where your control sits.

Types of keys

Type	Who controls it	Monthly cost	Rotation
AWS owned	AWS, and you never see it	Free	By the service
AWS managed (such as `aws/ebs`)	AWS, and you can view and audit it	Free	Yearly, and it can't be changed
Customer managed	You entirely	$1 per key, plus API calls	Optional, yearly by default, or from 90 to 2,560 days

Most keys are symmetric, one key for encrypting and decrypting that never leaves KMS. There are also asymmetric pairs, where the public key leaves KMS, for signing or for encryption by parties outside AWS.

Deleting a key is irreversible, because it destroys everything encrypted with it. So KMS imposes a waiting period of 7 to 30 days, during which you can cancel. To stop a key from being used in the meantime, disable it.

Key policies

Every KMS key has a key policy, and unlike other resources, IAM alone isn't enough without it. The default policy lets the account's IAM policies grant access to the key.

This matters when copying encrypted data:

To another Region: keys are Regional, so copying a snapshot re-encrypts it with a key in the destination Region.
To another account: share the snapshot, and allow that account in the policy of a customer managed key. AWS managed keys, such as aws/ebs, can't be shared, so a snapshot encrypted with one must first be copied with your own key.

Multi-Region keys

Multi-Region keys share the same key material and ID across Regions, so something encrypted in one Region can be decrypted in another without re-encrypting. They're not for everything, as AWS recommends single-Region keys by default. They suit cases such as client-side encryption of a field in Global Tables or Aurora Global.

CloudHSM: your own hardware

With KMS, AWS manages the hardware holding your keys. If a regulation requires a hardware security module dedicated to you, AWS CloudHSM gives you a single-tenant cluster of FIPS-validated HSMs. AWS handles provisioning and backups, while you control the keys and users yourself. Choose it only when you must, because you take on more responsibility than with KMS.

Where do you keep passwords?

Not in code, and not in Git. You have two services:

	Parameter Store	Secrets Manager
Suits	Settings and simple secrets	Secrets that must rotate
Encryption	Optional, with KMS, using `SecureString`	Always, with KMS
Rotation	Not built in	Built in, with a Lambda function, and integrated with RDS and Aurora
Replicas in other Regions	No	Yes
Price	Standard is free	$0.40 per secret per month, plus API calls

Parameter Store

Its names form a hierarchy, such as /shop/prod/db-url, so an application can fetch a whole path, and IAM can allow /shop/prod/* only.

	Standard	Advanced
Max size	4 KB	8 KB
Count per Region	10,000	100,000
Policies, such as expiry	No	Yes
Price	Free	$0.05 per parameter per month

Secrets Manager

The point here is rotation: the password changes on a schedule you set, and the function updates it in the database too. Your application asks for the current value each time, so it doesn't notice. We saw in part eight that RDS can manage its password here for you.

ACM: certificates without the hassle

AWS Certificate Manager issues public TLS certificates for free when used with services like load balancers, CloudFront and API Gateway, and it renews them by itself.

Validation: prove you own the domain by DNS, and it's best with Route 53, or by email.
Validity: public certificates now last 198 days, under new industry rules, and renewal happens automatically about 45 days before expiry. The period will shorten further in the coming years, which is more reason to leave it to automation.
Imported certificates: you can import your own, but ACM doesn't renew those, so set an alert on their expiry.
Other servers: a normal ACM certificate can't be installed on your own server. If you need that, there are exportable certificates, for a fee.

Stopping attacks

Here's how the protection layers sit together in a typical design:

Attacks are absorbed at the edge, and the load balancer's security group accepts traffic only from CloudFront, so nobody can go around it.

Service	Layer	What it does	Cost
WAF	Application (7)	Rules on requests: SQL injection, XSS, country, IP lists, and rate limits	Per rule and request
Shield Standard	Network (3 and 4)	Protection from common DDoS attacks	Free and automatic
Shield Advanced	Up to 7	A specialist response team, cost protection during attacks	A monthly subscription, and it's expensive
Firewall Manager	Management	Applies WAF, Shield, security group and other rules across all your organization's accounts	Per policy

WAF attaches to CloudFront, Application Load Balancer, API Gateway and AppSync, but not to a Network Load Balancer. If you need a fixed IP with WAF, put Global Accelerator in front of the load balancer. Rate-based rules are simple and effective: block any address sending more than a set number of requests.

Withstanding DDoS

The earlier parts gave you most of what's needed already:

CloudFront and Route 53 absorb attacks at the edge, far from your servers.
Auto Scaling grows if something gets through, though watch the cost.
A security group allows the load balancer only from CloudFront, so nobody can skip it.
WAF with rate limits and Bot Control for attacks that look like normal requests.

Blocking one address: where?

Your design	Where to block	Why
EC2 with a public IP	A network ACL	Security groups only allow; they can't deny
A load balancer	A network ACL on its subnet, or WAF	The server sees only the load balancer
CloudFront in front	WAF on CloudFront, or geo restriction	A network ACL won't help, because requests arrive from CloudFront's addresses

For protection at the VPC boundary, there's also Network Firewall, which we covered in part fourteen.

Detecting threats

Prevention isn't everything. You also need something to tell you when something's wrong:

Service	The question it answers	Works from
GuardDuty	Is something suspicious happening in my account?	CloudTrail, VPC Flow Logs and DNS logs, with no agents
Inspector	Does what I run have known vulnerabilities?	EC2 servers, ECR images and Lambda functions
Macie	Is there sensitive data somewhere it shouldn't be?	S3
Security Hub	How's my security overall?	Gathers and prioritizes the findings of the others
Detective	Why did this finding happen?	Collects logs by itself and links them together, to find the root cause

GuardDuty catches things like crypto mining, or credentials used from a strange place. Send its findings through EventBridge to SNS or Lambda so you act on them. It's one click to enable, so turn it on from the start in any serious account, as it has a free trial period.

Compliance documents: AWS Artifact

An auditor asks for proof that AWS itself meets ISO or PCI standards? AWS Artifact gives you those reports on demand and free of charge, and it's also where you review and accept agreements with AWS. It covers AWS's side of the shared responsibility model, and proving your side is still up to you.

Hands-on: a key, a parameter and a secret

From CloudShell, create a key with an easy name, and encrypt some text:

Bash

KEY_ID=$(aws kms create-key --description "Series demo key" \
  --query KeyMetadata.KeyId --output text)
aws kms create-alias --alias-name alias/series-demo --target-key-id $KEY_ID

CIPHER=$(aws kms encrypt --key-id alias/series-demo \
  --plaintext "my secret note" --cli-binary-format raw-in-base64-out \
  --query CiphertextBlob --output text)

echo $CIPHER

You'll see unreadable text. Decrypt it. For a symmetric key, there's no need to say which key:

Bash

aws kms decrypt --ciphertext-blob "$CIPHER" \
  --query Plaintext --output text | base64 -d; echo

Now see where the real control lies. Disable the key, and try again:

Bash

aws kms disable-key --key-id $KEY_ID

aws kms decrypt --ciphertext-blob "$CIPHER" \
  --query Plaintext --output text

aws kms enable-key --key-id $KEY_ID

You'll get a DisabledException. The data hasn't changed, but it's useless without the key. Now keep a password in Parameter Store, encrypted with the same key, and read it with and without decryption:

Bash

aws ssm put-parameter --name /series/prod/db-password \
  --type SecureString --key-id alias/series-demo --value "S3cret-pass"

aws ssm get-parameter --name /series/prod/db-password \
  --query Parameter.Value --output text

aws ssm get-parameter --name /series/prod/db-password --with-decryption \
  --query Parameter.Value --output text

aws ssm get-parameters-by-path --path /series/prod \
  --query "Parameters[].Name"

And a secret in Secrets Manager, in the way your application would read it:

Bash

aws secretsmanager create-secret --name series/api-key \
  --secret-string '{"key":"abc123"}' --query Name --output text

aws secretsmanager get-secret-value --secret-id series/api-key \
  --query SecretString --output text

Finally, what did all of this leave behind? CloudTrail has recorded who used the key, though it can take a few minutes:

Bash

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=Decrypt \
  --max-results 3 --query "Events[].[EventName,Username,EventTime]" --output table

Bash

aws secretsmanager delete-secret --secret-id series/api-key \
  --force-delete-without-recovery
aws ssm delete-parameter --name /series/prod/db-password
aws kms delete-alias --alias-name alias/series-demo
aws kms schedule-key-deletion --key-id $KEY_ID --pending-window-in-days 7

Summary

KMS keeps your keys safe, uses envelope encryption, and records every use.
Keys are Regional, and AWS managed keys can't be shared across accounts.
Parameter Store for settings, and Secrets Manager for what must rotate.
ACM certificates are free and renew themselves, and CloudFront needs them in us-east-1.
WAF and Shield stop attacks, and GuardDuty, Inspector and Macie detect what gets through.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 7

An application's database password must change every 30 days, both in the database and where the application reads it, with no code release each time. What fits?

Show the answer

Correct answer: A

Secrets Manager changes the password on a schedule and updates the database too. The application asks for the current value each time, so it doesn't notice.

B: This stores the value encrypted, but has no built-in rotation.
C: This rotates an encryption key, not a database password.
D: Someone would have to change it by hand on every server.

Review: Secrets Manager in this part, and Rotate AWS Secrets Manager secrets in the AWS docs.

Question 2 of 7

A team wants to share an encrypted EBS snapshot with another account, but the snapshot is encrypted with the aws/ebs key. What should it do?

Show the answer

Correct answer: C

AWS managed keys can't be shared, so the snapshot has to be re-encrypted with your own key first. The other account then needs access to both the snapshot and the key.

A: AWS managed keys can't be shared with other accounts.
B: Only unencrypted snapshots can be shared publicly, and this would expose the data to anyone.
D: An encrypted snapshot can't simply be switched to unencrypted.

Review: Key policies in this part, and Share an Amazon EBS snapshot with other AWS accounts in the AWS docs.

Question 3 of 7

A site runs on an ALB in Frankfurt with CloudFront in front of it. The team requested an ACM certificate in Frankfurt, but can't select it in CloudFront. What should it do?

Show the answer

Correct answer: D

CloudFront needs its certificate in us-east-1, wherever your application is. The ALB keeps using the one in its own Region.

A: A normal ACM certificate can't be exported.
B: The application can stay where it is, and only CloudFront's certificate has to be there.
C: A renewal doesn't change a certificate's Region.

Review: ACM: certificates without the hassle in this part, and Requirements for using SSL/TLS certificates with CloudFront in the AWS docs.

Question 4 of 7

A site sits behind CloudFront, and one address is flooding it with requests. Where should the team block that address?

Show the answer

Correct answer: B

CloudFront is the first to see the visitor's address, so the block belongs there. An IP set or a rate-based rule in WAF does the job.

A: Requests reach the subnet from CloudFront's addresses, so the attacker's address never appears there.
C: A security group only allows, and can't deny.
D: This is automatic protection from common network attacks, with no address lists of your own.

Review: Blocking one address: where? in this part, and Using AWS WAF with Amazon CloudFront in the AWS docs.

Question 5 of 7

A company wants to find known software vulnerabilities in its EC2 servers and ECR images, and to find personal data sitting in its S3 buckets. Which two services fit? (Choose two.)

Show the answer

Correct answer: A + E

Inspector scans what you run for known vulnerabilities, and Macie finds sensitive data in S3.

B: This detects suspicious activity in an account, such as stolen credentials being used.
C: This protects against DDoS attacks.
D: This filters web requests.

Review: Detecting threats in this part, and What is Amazon Inspector? and What is Amazon Macie? in the AWS docs.

Question 6 of 7

A regulator requires a bank's encryption keys to live in a hardware security module dedicated to it, validated to FIPS, that only the bank controls. What fits?

Show the answer

Correct answer: C

CloudHSM gives you a cluster of HSMs dedicated to you, and you control the keys and users yourself.

A: AWS manages this key and the hardware, and you can't change its permissions.
B: You control this key's policy, but AWS manages the hardware behind it.
D: This stores secrets such as passwords, and isn't a hardware module.

Review: CloudHSM: your own hardware in this part, and What is AWS CloudHSM? in the AWS docs.

Question 7 of 7

An auditor asks a company for AWS's own PCI compliance report. Separately, the security team needs to investigate the root cause of a GuardDuty finding. Which two services fit? (Choose two.)

Show the answer

Correct answer: A + D

Artifact gives you AWS's compliance reports on demand, and Detective links the logs together to find the root cause of a finding.

B: This finds sensitive data in S3.
C: This records and judges your own resources' settings, not AWS's compliance.
E: This looks for known vulnerabilities in what you run.

Review: Compliance documents: AWS Artifact and Detecting threats in this part, and What is AWS Artifact? and What is Amazon Detective? in the AWS docs.

You've protected yourself from people. What about a whole Region going down, or having to bring a data center over to AWS? In part twenty-eight we cover disaster recovery and migration.

Advanced Identity: Organizations and Identity Center

2026-11-02T00:00:00Z

In part two we had one account and a few users. Now imagine a company with fifty accounts and five hundred employees: creating a user in each account for each person would be a nightmare, and one mistake could reach everything.

This part covers the tools for that scale, and it completes IAM with what we left out at the start.

AWS Organizations

Organizations gathers many accounts under one management account, arranged in organizational units (OUs).

Accounts sit in organizational units under one root, and a policy attached to a unit applies to every account beneath it.

Why many accounts, not one big account?

Isolation: a mistake or breach in the development account doesn't reach production.
Clear costs: each account shows its team's bill.
Limits: each account has its own service quotas.

And what do you get from Organizations?

Consolidated billing: one invoice, and combined usage reaches volume discounts faster. Savings Plans and Reserved Instances can also be shared across accounts.
Centralized management: creating accounts by API, and one CloudTrail trail for everyone.
Policies: rules applying to whole groups of accounts.

Organization policies

Policy	What it does
SCP	Sets the maximum for what users and roles in an account can do
RCP	Sets the maximum for what can be done to resources in an account
Declarative policies	Fix a service's baseline settings across accounts
Tag policies	Standardize tags, such as requiring a particular spelling for `CostCenter`

Service Control Policies (SCPs)

The key point: an SCP doesn't grant anything. It only sets a limit, and each user still needs an IAM permission. It's a ceiling on what's allowed:

Attached to an OU, it applies to everything beneath it, and each level must allow the action.
It doesn't affect the management account, so don't run workloads there.
It applies to everyone in a member account, including that account's root user.

For example, this SCP blocks work outside two Regions, except for global services:

JSON

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "OnlyTwoRegions",
    "Effect": "Deny",
    "NotAction": ["iam:*", "organizations:*", "route53:*", "cloudfront:*", "support:*"],
    "Resource": "*",
    "Condition": {
      "StringNotEquals": { "aws:RequestedRegion": ["me-central-1", "eu-west-1"] }
    }
  }]
}

Conditions in IAM policies

A policy's Condition element narrows when a permission applies. Some common ones:

Condition	Use
`aws:SourceIp`	Only from the office network
`aws:RequestedRegion`	Only in specific Regions
`aws:MultiFactorAuthPresent`	Only if signed in with MFA
`aws:ResourceTag` and `aws:PrincipalTag`	A user's tag must match a resource's tag
`aws:PrincipalOrgID`	Only from accounts in your organization

The last one is a gift for shared buckets. Instead of listing fifty accounts in a bucket policy, one line allows your whole organization:

JSON

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::shared-files/*",
  "Condition": { "StringEquals": { "aws:PrincipalOrgID": "o-a1b2c3d4e5" } }
}

A classic S3 mistake

S3 actions work at two levels, and each needs its own ARN:

Action	Applies to	ARN
`s3:ListBucket`	The bucket	`arn:aws:s3:::my-bucket`
`s3:GetObject`	The object	`arn:aws:s3:::my-bucket/*`

Put the wrong one in and you get AccessDenied, however right the policy looks. We'll test this in the hands-on.

A role or a resource policy?

To let a user in account A reach something in account B, you have two ways:

	Assuming a role	A resource policy
How	The user becomes the role in B	The resource in B allows the user directly
Their original permissions	They give them up while in the role	They keep them
Suits	Working entirely inside the other account	Reading from a table in A and writing to a bucket in B at once
Available on	All services	Only those supporting it, such as S3, SNS, SQS and Lambda

Behind every assumed role is AWS STS (Security Token Service). It hands out the temporary credentials, which expire by themselves. This is how cross-account access works without sharing long-term keys: a user or service calls AssumeRole, STS checks the role's trust policy, and returns keys that work for a limited time.

Permissions boundaries

You want team leads to create roles for their services, without being able to give anyone more than they should have. A permissions boundary sets the maximum for a particular user or role, and like an SCP, it grants nothing.

The effective permissions are what's allowed by the identity policy and the boundary and the SCP together. It's a good way to delegate safely.

How does AWS decide?

Every request goes through this reasoning. This is a simplified version:

A simplified picture of how AWS decides: any explicit Deny ends it, and every layer that applies has to allow the action.

Remember three rules: an explicit Deny always wins, anything not allowed is denied, and within one account, a resource policy can grant access by itself in many cases.

Instead of a user in every account, IAM Identity Center gives each employee one sign-in and a portal listing the accounts and roles available to them, and they get temporary credentials with no permanent keys.

Part	What it does
Identity source	Its own directory, Active Directory, or an external provider such as Okta or Microsoft Entra ID
Permission sets	A set of policies that becomes a role in each account you assign it to
Assignment	"The developers group gets the Admin set on the dev account, and ReadOnly on production"
Applications	Single sign-on to SAML applications too

For the CLI, aws configure sso signs you in through your browser and gives you temporary credentials. This is the recommended way for people to work with AWS these days, in place of IAM users with long-term keys.

Federation: identities from outside

Federation means people or systems sign in with an identity that lives outside AWS and receive temporary credentials, with no IAM user to create. Your choice depends on who's signing in:

Who	Use
Employees across many accounts	Identity Center, as above, which is what AWS recommends
One standalone account, or systems such as GitHub Actions	An identity provider in IAM using SAML 2.0 or OIDC, with a role to assume
Your application's users	Cognito identity pools

Active Directory on AWS

Many companies keep their users in Microsoft Active Directory. AWS Directory Service connects it to AWS:

Option	How it works	Suits
Managed Microsoft AD	A real AD managed in AWS, and it can trust yours	AD-dependent applications running on AWS
AD Connector	A proxy that passes requests to your AD and stores nothing	Keeping the users in your own AD
Simple AD	A small Samba-based directory	Closed to new customers since July 2026

AWS Control Tower

Setting all of this up by hand takes weeks. Control Tower builds a best-practice landing zone over Organizations, including log and audit accounts, and it adds:

Account Factory: creating new accounts with ready settings.
Controls: preventive through SCPs, detective through Config, and proactive that check resources before they're created.
A dashboard: showing who's compliant at a glance.

If you're starting a multi-account environment from scratch, start here.

Hands-on: testing policies without touching anything

The policy simulator evaluates a policy without creating anything or running the action, which is great for learning. From CloudShell, write a policy allowing S3 and EC2, and a boundary allowing S3 only:

Bash

cat > identity.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:*", "ec2:*"],
    "Resource": "*"
  }]
}
EOF

cat > boundary.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": "*"
  }]
}
EOF

Test three actions with the policy alone:

Bash

aws iam simulate-custom-policy --policy-input-list file://identity.json \
  --action-names s3:GetObject ec2:RunInstances iam:CreateUser \
  --query "EvaluationResults[].[EvalActionName,EvalDecision]" --output table

S3 and EC2 show allowed, and IAM shows implicitDeny, because nothing allows it. Now add the boundary:

Bash

aws iam simulate-custom-policy --policy-input-list file://identity.json \
  --permissions-boundary-policy-input-list file://boundary.json \
  --action-names s3:GetObject ec2:RunInstances \
  --query "EvaluationResults[].[EvalActionName,EvalDecision]" --output table

EC2 has now become implicitDeny, even though the policy allows it. Now see that Deny always wins, by adding an explicit deny on deleting buckets:

Bash

cat > deny.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Action": "s3:DeleteBucket",
    "Resource": "*"
  }]
}
EOF

aws iam simulate-custom-policy \
  --policy-input-list file://identity.json file://deny.json \
  --action-names s3:GetObject s3:DeleteBucket \
  --query "EvaluationResults[].[EvalActionName,EvalDecision]" --output table

s3:GetObject stays allowed, and s3:DeleteBucket shows explicitDeny, even though the first policy allows s3:*. Try a condition next: access from the office network only, testing from two addresses:

Bash

cat > office.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:GetObject",
    "Resource": "*",
    "Condition": { "IpAddress": { "aws:SourceIp": "203.0.113.0/24" } }
  }]
}
EOF

for ip in 203.0.113.10 198.51.100.7; do
  aws iam simulate-custom-policy --policy-input-list file://office.json \
    --action-names s3:GetObject \
    --context-entries "ContextKeyName=aws:SourceIp,ContextKeyValues=$ip,ContextKeyType=ip" \
    --query "EvaluationResults[0].EvalDecision" --output text
done

The first address is allowed, and the second is implicitDeny. Finally, the classic S3 mistake, a list permission with the object's ARN:

Bash

cat > list.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:ListBucket",
    "Resource": "arn:aws:s3:::shop/*"
  }]
}
EOF

aws iam simulate-custom-policy --policy-input-list file://list.json \
  --action-names s3:ListBucket --resource-arns arn:aws:s3:::shop \
  --query "EvaluationResults[0].EvalDecision" --output text

It gives implicitDeny. The policy looks right, but the permission applies to the bucket, not to what's in it. Change the resource to arn:aws:s3:::shop and try again, and you'll get allowed.

Summary

Organizations gathers accounts under one bill, and SCPs set a ceiling that grants nothing.
Conditions narrow permissions by network, Region, MFA and tags, and aws:PrincipalOrgID opens access to your organization only.
A role gives up your original permissions, and a resource policy keeps them.
A permissions boundary delegates safely, and an explicit Deny always wins.
Identity Center gives one sign-in with temporary credentials, and Control Tower builds it all from best practices.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 7

A company wants to make sure nobody in its development accounts can launch anything outside two Regions, not even those accounts' administrators. What fits?

Show the answer

Correct answer: C

An SCP sets a ceiling for every user and role in the accounts beneath it, including the root user. It grants nothing, so people still need their own IAM permissions.

A: An account's administrators could simply change these.
B: This limits one user or role at a time, and an administrator could remove it.
D: This marks resources as non-compliant, and stops nothing.

Review: Service Control Policies (SCPs) in this part, and Service control policies (SCPs) in the AWS docs.

Question 2 of 7

A company wants team leads to create roles for their own services, without being able to hand out more than S3 and DynamoDB access. What fits?

Show the answer

Correct answer: A

A permissions boundary sets the maximum for a user or role and grants nothing itself, so a role can never go beyond it, whatever policy it's given.

B: This limits the whole account, while other work in it may need other services.
C: A written rule stops nobody.
D: These give people access to accounts, and don't limit the roles they create.

Review: Permissions boundaries in this part, and Permissions boundaries for IAM entities in the AWS docs.

Question 3 of 7

A company with 50 accounts and 500 employees keeps its users in Microsoft Entra ID. It wants one sign-in, no long-term keys, and different access per account. What fits?

Show the answer

Correct answer: D

Employees sign in once and see the accounts and roles available to them, with temporary credentials. A permission set becomes a role in each account you assign it to.

A: This means thousands of users and long-term keys to manage.
B: This loses track of who did what, and shares long-term keys.
C: This builds a landing zone and creates accounts, and doesn't give people their sign-in by itself.

Review: IAM Identity Center: one sign-in in this part, and Manage AWS accounts with permission sets in the AWS docs.

Question 4 of 7

An application in account A must read from a DynamoDB table in account A and write to an S3 bucket in account B at the same time, using one identity. What fits?

Show the answer

Correct answer: B

With a resource policy the application keeps its own permissions, so it can use the table in A and the bucket in B at once.

A: While in that role it gives up its original permissions, so it loses the table in A.
C: An SCP grants nothing.
D: A boundary grants nothing.

Review: A role or a resource policy? in this part, and Cross account resource access in IAM in the AWS docs.

Question 5 of 7

A role must list the objects in a bucket named reports and read them. Which two statements belong in its policy? (Choose two.)

Show the answer

Correct answer: B + D

S3 actions work at two levels: listing applies to the bucket and reading applies to the objects, so each needs its own ARN.

A: Listing applies to the bucket, so this ARN gives AccessDenied.
C: Reading applies to objects, so this ARN gives AccessDenied.
E: This works, but it gives far more than needed, on every bucket.

Review: A classic S3 mistake in this part, and Grant read and write access to Amazon S3 bucket objects in the AWS docs.

Question 6 of 7

A nightly job in account A must work entirely inside account B for a few minutes. The security team forbids long-term keys. What fits?

Show the answer

Correct answer: D

The job calls AssumeRole, and STS checks the role's trust policy and returns temporary credentials, so there are no long-term keys to store.

A: These are the long-term keys the team forbids.
B: Roles aren't copied between accounts, and access still needs a trust policy.
C: An SCP grants nothing.

Review: A role or a resource policy? in this part, and Temporary security credentials in IAM in the AWS docs.

Question 7 of 7

A GitHub Actions pipeline deploys to one AWS account, and its access keys are stored as repository secrets. The team wants to stop storing keys. What fits?

Show the answer

Correct answer: B

The pipeline proves who it is with a token from GitHub and gets temporary credentials through the role, so there are no keys to store.

A: This shortens the keys' life, and they're still stored.
C: This is for people signing in, not for systems such as a pipeline.
D: This is for your application's users, not for access to your AWS account.

Review: Federation: identities from outside in this part, and Identity providers and federation into AWS in the AWS docs.

You've controlled who reaches your data. What if someone reaches it anyway, or attacks your site from outside? In part twenty-seven we cover encryption, secrets and threat protection.

Monitoring and Auditing: CloudWatch, CloudTrail and Config

2026-11-02T00:00:00Z

Over the previous parts we built an application with many pieces. Building it is the easy half. The hard half comes at three in the morning: is it down? Since when? And who changed that setting yesterday?

This last section is about running what you've built, and it starts with three questions, each with its own service:

The question	The service
Is it healthy right now?	CloudWatch
Who did this, and when?	CloudTrail
Are the settings as they should be, and how have they changed?	Config

And a fourth service reacts to all of them: EventBridge.

CloudWatch metrics

A metric is a number measured over time, such as CPU usage or the count of errors. Most AWS services send their metrics by themselves, grouped in namespaces and distinguished by dimensions, such as the server ID.

Point	Details
EC2 default	Every 5 minutes, or every minute if you turn on detailed monitoring
Custom metrics	You send what you like, such as the number of failed orders, down to one-second resolution
History	One-minute data stays for 15 days, 5-minute data for 63 days, and hourly data for 455 days
Metric Streams	Sends metrics continuously through Firehose to S3 or another monitoring tool

Dashboards put the charts you care about on one page, and they can gather metrics across Regions and accounts.

CloudWatch Logs

Everything your application prints can land here, organized into log groups that usually represent one application, and within them log streams. Lambda, ECS, API Gateway, VPC Flow Logs and others send logs directly, and on EC2 or on-premises servers you use the same agent.

Logs are kept forever by default, and you pay for that. Set a retention period on each group, from one day to ten years.

Logs Insights searches through them with a simple query language. This one gets the latest errors:

Output

fields @timestamp, @message
| filter @message like /ERROR/
| sort @timestamp desc
| limit 20

To send logs elsewhere you have two routes:

Route	Timing	Suits
Export to S3	A batch job, and not immediate	Cheap long-term archiving
Subscription filter	Near real time	Sending to Lambda, Kinesis or Firehose, such as for OpenSearch

CloudWatch alarms

A chart nobody's looking at is no use. An alarm watches a metric and does something when it crosses a limit.

An alarm watches a metric, and when it crosses the limit, it notifies someone, adds capacity or acts on the server.

An alarm is in one of three states: OK, ALARM or INSUFFICIENT_DATA. Some useful additions:

EC2 actions: stop, reboot, terminate or recover. Recovery moves the server to new hardware if the underlying host fails, keeping its IP addresses and settings.
Composite alarms: one alarm for "high CPU and many errors", which reduces false alerts.
Testing: set-alarm-state puts an alarm in any state, so you can check the alert path without breaking anything. We'll try it in the hands-on.

Ready-made insights

Tool	What it shows
Container Insights	Metrics and logs from ECS and EKS
Lambda Insights	Function performance, including memory and cold starts
Contributor Insights	Top contributors, such as the IP addresses sending the most requests
Application Insights	Sets up monitoring for a whole application and points out likely problems

EventBridge: reacting to events

Almost everything that happens in AWS is an event: a server changed state, a bucket was created, or an alarm went off. EventBridge receives these events on a bus, and rules send matching ones to a target.

Events arrive on a bus from anywhere, and rules send each one that matches to the service that handles it.

Use	Example
Reacting to a change	A server stopped, so notify the team
A schedule	Run a function every night; EventBridge Scheduler is the service for this now
Connecting your services	The orders service publishes an event, and whoever's interested takes it
Partner events	Events arriving from SaaS applications on a partner bus

Features worth knowing: archive and replay to send old events again, the schema registry that describes the shape of events, and resource policies so that another account can send to your bus.

For most targets, such as Lambda, SQS and SNS, access is granted by a resource policy on the target. For others, such as starting an ECS task, EventBridge uses an IAM role.

CloudTrail: who did what

Every call to AWS, from the console, the CLI or a service, gets recorded by CloudTrail: who, what, when, and from where. It's on by default, and it's the first place to look when something changes mysteriously or disappears.

Event type	What it covers	Default
Management events	Changes to resources, such as creating a server or changing a policy	On, with 90 days free in Event history
Data events	Operations inside resources, such as reading from S3 or invoking Lambda	Off, because of their volume
Insights events	Unusual activity, such as a sudden burst of delete calls	Off, at additional cost

To keep them longer than 90 days, create a trail that writes to S3, across all Regions and even the whole organization, and analyze it with Athena. Note that CloudTrail Lake closed to new customers in 2026, so a trail is the way to go.

A powerful pattern combines it with EventBridge: anyone deleting a table, or a sign-in with the root user, immediately triggers an alert. CloudTrail records it, EventBridge matches it, and SNS tells you.

AWS Config: your settings over time

CloudTrail tells you who called what. Config tells you what a resource looks like: it records the configuration of your resources and every change to it, so you can ask what a security group looked like last Tuesday.

Config rules then judge these settings:

Rules: managed ones ready to use, such as "no public S3 buckets", or custom ones.
Prevention: it doesn't stop anything. It marks a resource as non-compliant, and that's it.
Remediation: a rule can run a Systems Manager Automation document to fix the problem automatically.
Notifications: through EventBridge or SNS.
Scope and cost: it works per Region, and you pay per recorded item and per rule evaluation.

X-Ray: following one request

A request in a modern application can pass through an API, three functions and a database. Metrics tell you something is slow, and AWS X-Ray tells you where. It collects traces of each request as it passes through your services, including its calls to databases and other APIs, and shows you which step is slow or failing.

Other views

Tool	What it shows
AWS Health Dashboard	Whether AWS itself has a problem affecting your services and resources, with no setup and at no cost
Managed Grafana	Dashboards for metrics, logs and traces from several sources, using the popular Grafana tool
Managed Service for Prometheus	Container metrics through the open-source Prometheus tools, with no servers to run

Which one, when?

Let's take one load balancer:

	Example
CloudWatch	Number of requests, 5xx errors, and a dashboard or an alarm on them
CloudTrail	Who changed its listener rules, and when
Config	Its current security group, its certificate, and how they've changed; and is it following your rules?

Hands-on: an alarm that emails you

We'll watch a made-up metric for failed orders. From CloudShell, replace the email address with yours:

Bash

EMAIL=you@example.com

TOPIC_ARN=$(aws sns create-topic --name series-alerts \
  --query TopicArn --output text)

aws sns subscribe --topic-arn $TOPIC_ARN \
  --protocol email --notification-endpoint $EMAIL

Open your email and press Confirm subscription. Then create an alarm that goes off if more than five orders fail in a minute:

Bash

aws cloudwatch put-metric-alarm --alarm-name series-failed-orders \
  --namespace Series/Shop --metric-name FailedOrders \
  --statistic Sum --period 60 --evaluation-periods 1 \
  --threshold 5 --comparison-operator GreaterThanThreshold \
  --treat-missing-data notBreaching \
  --alarm-actions $TOPIC_ARN

Now send the application's reading, as if 12 orders had just failed:

Bash

aws cloudwatch put-metric-data --namespace Series/Shop \
  --metric-name FailedOrders --value 12

Wait two or three minutes and check the alarm's state. An email should arrive at the same time:

Bash

aws cloudwatch describe-alarms --alarm-names series-failed-orders \
  --query "MetricAlarms[0].[StateValue,StateReason]" --output text

You don't have to break anything to test an alert path. Try it when the alarm has gone back to OK, and another email arrives:

Bash

aws cloudwatch set-alarm-state --alarm-name series-failed-orders \
  --state-value ALARM --state-reason "Testing the alert"

Finally, play detective. Who created this alarm? CloudTrail knows, though events can take a few minutes to appear:

Bash

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=PutMetricAlarm \
  --max-results 1 \
  --query "Events[0].[EventName,Username,EventTime]" --output text

Bash

aws cloudwatch delete-alarms --alarm-names series-failed-orders
aws sns delete-topic --topic-arn $TOPIC_ARN

Summary

CloudWatch for metrics, logs and alarms, and memory needs the agent.
Set a retention period on your logs, because they're kept forever by default.
EventBridge routes events to whoever handles them, and runs things on a schedule.
CloudTrail records who did what, and Config records the settings and judges them.
Test your alert path before you need it.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 7

A team wants an alarm when memory on its EC2 servers passes 90%, but it can't find a memory metric in CloudWatch. What should it do?

Show the answer

Correct answer: B

The default metrics come from outside the server, so they don't include memory. The agent sends it from inside, and then you can put an alarm on it.

A: This sends the same metrics more often, and memory still isn't among them.
C: This records who called what, not how a server is performing.
D: This records resource settings, not what's happening inside a server.

Review: CloudWatch metrics in this part, and Metrics collected by the CloudWatch agent in the AWS docs.

Question 2 of 7

An outage began right after someone changed a security group last night. The team wants to know who made the change, and from where. Where should it look first?

Show the answer

Correct answer: D

CloudTrail records who called what, when and from where. Management events like this one stay there for 90 days, with nothing to set up.

A: These show numbers over time, not who did anything.
B: These show the traffic that was accepted or rejected, not who changed a rule.
C: This searches logs your applications send, not the calls made to AWS.

Review: CloudTrail: who did what in this part, and Working with CloudTrail event history in the AWS docs.

Question 3 of 7

A company wants to notice when any S3 bucket becomes public, and to fix it automatically. What fits?

Show the answer

Correct answer: A

A Config rule judges each bucket's settings and marks it as non-compliant, and a remediation can run a Systems Manager Automation document to fix it. On its own, a rule prevents nothing.

B: Size says nothing about who can reach the bucket.
C: This spots unusual activity, and doesn't judge or fix settings.
D: This searches logs when you ask, and fixes nothing.

Review: AWS Config: your settings over time in this part, and Remediating Noncompliant Resources with AWS Config in the AWS docs.

Question 4 of 7

The security team wants an immediate alert whenever someone deletes a DynamoDB table or signs in with the root user. What fits?

Show the answer

Correct answer: C

CloudTrail records the call, EventBridge matches it, and SNS tells you right away.

A: This finds them eventually, which could be days too late.
B: A dashboard nobody's looking at alerts nobody.
D: This judges settings, and doesn't react to a deleted table or a sign-in.

Review: CloudTrail: who did what in this part, and AWS service events delivered via AWS CloudTrail in the AWS docs.

Question 5 of 7

A team's CloudWatch Logs bill keeps growing because old logs are never removed, and another system must receive error lines within seconds. Which two changes fit? (Choose two.)

Show the answer

Correct answer: A + D

Logs are kept forever by default, so a retention period removes the old ones. A subscription filter delivers matching lines in near real time.

B: This is a batch job that isn't immediate, and the originals stay and keep costing money.
C: This sends EC2 metrics more often, and has nothing to do with logs.
E: This records operations inside resources, and has nothing to do with your log bill or error lines.

Review: CloudWatch Logs in this part, and Working with log groups and log streams and Real-time processing of log data with subscriptions in the AWS docs.

Question 6 of 7

A checkout request passes through API Gateway, three Lambda functions and a DynamoDB table, and sometimes takes five seconds. Each service's metrics look normal on their own. What shows which step is slow?

Show the answer

Correct answer: C

X-Ray follows each request across your services and their calls, and shows which step is slow or failing.

A: This records who called which API, not how long each step of a request took.
B: This records resource settings.
D: This shows top contributors, such as the addresses sending the most requests, not a request's path.

Review: X-Ray: following one request in this part, and What is AWS X-Ray? in the AWS docs.

Question 7 of 7

Errors suddenly rise on an application in one Region, with nothing changed on the team's side. They want to know quickly whether AWS itself has a problem affecting their resources. Where should they look?

Show the answer

Correct answer: B

It shows the events affecting AWS services and your resources, with no setup and at no cost.

A: This shows the calls made in your account, and those didn't change here.
C: This shows how your settings changed, and those didn't change here.
D: This checks your account against best practices, and doesn't report outages.

Review: Other views in this part, and What is AWS Health? in the AWS docs.

You now know what's happening in one account. But companies have dozens of accounts and hundreds of employees. In part twenty-six we manage them with Organizations and Identity Center.

Ready-Made AI Services

2026-11-02T00:00:00Z

In part twenty-three we got answers from data that's already organized. But a lot of your data isn't: photos, voice calls and scanned invoices. Understanding them used to need a machine learning team. Today, much of it is one API call.

AWS offers three levels, and most people should start from the top:

The further down you go, the more control you get over the model, and the more expertise and work it takes.

You want	Use
Understanding images and video	Rekognition
Speech to text	Transcribe
Text to speech	Polly
Translation	Translate
A chatbot or a phone system	Lex and Connect
Understanding text: sentiment and entities	Comprehend
Extracting text and tables from documents	Textract
Recommendations	Personalize
Generative models over your data	Bedrock
Training a model of your own	SageMaker AI

Images: Rekognition

Rekognition analyzes images and video without any training on your part:

Labels: what's in the image, such as a car, a beach or a crowd.
Text: reading words in images, such as signs.
Content moderation: catching inappropriate images before they're published, and you can train it further on your own examples.
Faces: detecting, comparing and searching for them.

Note that the Streaming Video and Batch Image Content Moderation features closed to new customers on April 30, 2026. Other features aren't affected, and you can process frames or batches yourself through the image API.

Speech: Transcribe and Polly

Transcribe turns speech into text, from a file in S3 or a live stream. It can tell speakers apart, add your own vocabulary such as product names, and hide personal data on supported languages.

Polly does the opposite, turning text into speech. You can control pronunciation in two ways:

Lexicons: teach it to read AWS as "Amazon Web Services".
SSML: tags in the text that add pauses, emphasis or even a whisper.

Translate

Amazon Translate translates between 75 languages, in real time or in batches from S3. Add custom terminology to keep your brand names and terms as they are. Pairing it with Polly and Transcribe gets you a whole translated conversation.

Conversation: Lex and Connect

Lex builds chatbots and voice bots. You define what the user may want, an intent, and the details you need to carry it out, called slots.

Connect is a contact center in the cloud: phone numbers, queues, flows and agents, with no equipment, and you pay by usage. Together they might work like this:

A customer calls the number on Connect.
They say "I want to change my appointment", and Lex understands the intent and asks for the date.
A Lambda function updates the appointment in your system.
If the bot gets stuck, Connect transfers the call to an agent.

Text: Comprehend

Comprehend reads text and extracts its meaning: language, sentiment, entities such as people and places, key phrases and personal data. And you can train it to classify your own categories, such as the type of support ticket.

Comprehend Medical does this for clinical text: conditions, medications, doses and tests, and it detects protected health information.

Its Topic Modeling, Event Detection and Prompt Safety Classification features closed to new customers on April 30, 2026.

Documents: Textract

Textract goes beyond reading text from a scanned file: it understands structure, so it returns forms as field-and-value pairs, and tables as rows and columns. It also has dedicated paths for invoices, receipts and identity documents.

Recommendations: Personalize

Personalize builds "you might also like" from your users' behavior: you give it who viewed or bought what, and you get an API that returns recommendations in real time, or in batches for email campaigns. You don't need to design a model yourself.

Search over your documents: what about Kendra?

You may read about Amazon Kendra, an intelligent search service for internal documents. It stopped accepting new customers on July 30, 2026, and AWS points to Bedrock Knowledge Bases as the alternative, which brings us to the next section.

Generative models: Amazon Bedrock

Bedrock gives you foundation models from many providers, such as Anthropic, Amazon, Meta and Mistral, through one API, with no servers. You pay per token, meaning by the amount of text going in and out. The Converse API has a single form across models, so changing a model is a matter of changing one parameter.

You no longer need to enable models one at a time, since access is now controlled with IAM. The exception is Anthropic's models, which need a one-time form before first use.

Knowledge Bases: answers from your documents

A model doesn't know your company's policies. Instead of training it, you find the relevant passages and hand them to it with the question. This is called RAG, and Knowledge Bases handles it for you:

The Knowledge Base finds the passages closest to the question in your documents, and the model answers from them instead of from its memory.

The rest of the toolbox

Tool	What it does
Guardrails	Blocks unwanted topics, hides personal data and helps reduce made-up answers
AgentCore	Runs and manages agents that take actions, with any framework and model
Batch and caching	Lower the cost of large workloads and repeated prompts

Bedrock Agents Classic closed to new customers in favor of AgentCore, so don't start with it if you see it in an older article.

Your own model: SageMaker AI

When ready-made isn't enough, such as predicting risks from data only you have, Amazon SageMaker AI (formerly SageMaker) covers the journey: notebooks, data preparation, training, then an endpoint serving predictions. JumpStart gives you hundreds of ready models to start from.

Don't confuse it with the new Amazon SageMaker, an umbrella that gathers data, analytics and AI in one studio. Also, several of its add-ons, such as Ground Truth, Clarify and Model Monitor, closed to new customers in mid-2026, so check a feature's status before relying on it.

Bedrock or SageMaker AI?

	Bedrock	SageMaker AI
Starts from	A ready model	Your data, or a model you customize
Management	Serverless	You choose the compute, or use serverless customization
You pay	Per token	Mostly for compute
Expertise	A developer is enough	Machine learning helps a lot

AWS's own advice: start with Bedrock using prompts and Knowledge Bases, and move to SageMaker AI when you need to change the model's behavior.

And Arabic?

If your application serves Arabic speakers, check this first, because not all services are equal:

Service	Arabic support
Translate	Yes
Comprehend	Yes, including sentiment
Transcribe	Gulf (`ar-AE`) and Modern Standard (`ar-SA`), though hiding personal data isn't supported for them
Polly	Zeina in Modern Standard, and Hala and Zayd in Gulf
Textract	No: English, French, German, Italian, Portuguese and Spanish only
Bedrock	Depends on the model, so try yours on your own text

Chaining services

The real strength lies in connecting them with what you've already learned. Imagine call recordings landing in S3, where each step triggers the next through events or Step Functions:

Each service does one job and hands its result to the next, without any model to train.

Without any machine learning, a manager now reads a summary of every call and sees which ones ended badly.

Hands-on: a review passes through four services

We'll take a customer review, analyze it, translate it, voice it and reply to it. Everything is a direct call with nothing to set up. These services aren't in every Region, so if a command reports that it can't connect, add --region us-east-1 to it. From CloudShell:

Bash

REVIEW="The app is great, but delivery was very slow and support never replied."

aws comprehend detect-dominant-language --text "$REVIEW" \
  --query "Languages[0]"

aws comprehend detect-sentiment --language-code en --text "$REVIEW" \
  --query "[Sentiment,SentimentScore]"

aws comprehend detect-key-phrases --language-code en --text "$REVIEW" \
  --query "KeyPhrases[].Text"

You'll see the language, the sentiment with its scores, and the key phrases. Now translate it to Arabic, then check that Comprehend understands the translation too:

Bash

ARABIC=$(aws translate translate-text --text "$REVIEW" \
  --source-language-code en --target-language-code ar \
  --query TranslatedText --output text)

echo "$ARABIC"

aws comprehend detect-sentiment --language-code ar --text "$ARABIC" \
  --query Sentiment --output text

Voice the translation with Polly:

Bash

aws polly synthesize-speech --voice-id Zeina --output-format mp3 \
  --text "$ARABIC" review.mp3

ls -lh review.mp3

To listen, from the CloudShell Actions menu choose Download file, and enter review.mp3.

Finally, ask a model on Bedrock to reply to the customer. The first command looks up the identifier of a low-cost Amazon Nova Lite model in your Region. If it prints None, add --region us-east-1 to both commands:

Bash

MODEL=$(aws bedrock list-inference-profiles \
  --query "inferenceProfileSummaries[?contains(inferenceProfileId,'nova') && contains(inferenceProfileId,'lite')].inferenceProfileId | [0]" \
  --output text)
echo $MODEL

aws bedrock-runtime converse --model-id $MODEL \
  --messages "[{\"role\":\"user\",\"content\":[{\"text\":\"Reply to this customer in two short sentences: $REVIEW\"}]}]" \
  --query "output.message.content[0].text" --output text

Got a photo? Upload it from Actions, then Upload file, and ask Rekognition what's in it:

Bash

aws rekognition detect-labels --image-bytes fileb://photo.jpg \
  --max-labels 5 --query "Labels[].[Name,Confidence]" --output table

Summary

Start from the ready-made services, then Bedrock, and only then SageMaker AI.
Rekognition for images, Transcribe and Polly for speech, Translate for translation, and Comprehend for text.
Textract reads structured documents, but it doesn't support Arabic.
Knowledge Bases answers from your documents without training a model, and it's the alternative to Kendra.
Connecting these services with events is where the real value is.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 5

An insurer receives thousands of scanned claim forms in English. It wants each form's fields, values and tables in its database, with no model to train. Which service fits?

Show the answer

Correct answer: B

Textract understands a document's structure, so it returns forms as field-and-value pairs, and tables as rows and columns.

A: This can read words in an image, but it doesn't understand forms and tables.
C: This extracts meaning from text you already have, and doesn't read scanned files.
D: This turns speech into text.

Review: Documents: Textract in this part, and What is Amazon Textract? in the AWS docs.

Question 2 of 5

A company new to AWS wants an assistant that answers employees' questions from its internal policy documents. It has no machine learning team. What fits?

Show the answer

Correct answer: D

Knowledge Bases finds the relevant passages and hands them to a model along with the question, so there's nothing to train.

A: This no longer accepts new customers, and AWS points to Knowledge Bases instead.
B: This needs machine learning expertise, and answering from documents doesn't need a trained model.
C: This builds bots around intents you define, and doesn't answer from documents by itself.

Review: Knowledge Bases: answers from your documents in this part, and Retrieve data and generate AI responses with Amazon Bedrock Knowledge Bases in the AWS docs.

Question 3 of 5

A bank's data scientists want to predict loan risk from years of its own repayment records, and no ready-made service does this. What fits?

Show the answer

Correct answer: A

This is predicting from data only the bank has, which needs a model of its own. SageMaker AI covers preparing the data, training, then serving predictions from an endpoint.

B: This starts from a ready model, and doesn't train a prediction model on the bank's records.
C: This builds recommendations from user behavior, such as "you might also like".
D: This extracts meaning from text, such as sentiment and entities.

Review: Your own model: SageMaker AI in this part, and Amazon Bedrock or Amazon SageMaker AI? in the AWS docs.

Question 4 of 5

A call center stores its recordings in S3, in English. A manager wants to know which calls ended badly, without any machine learning work. Which chain fits?

Show the answer

Correct answer: C

Transcribe turns each recording into text, and Comprehend's sentiment analysis shows which calls were negative.

A: Polly does the opposite of what's needed, turning text into speech.
B: Rekognition analyzes images and video, and Translate only changes the language.
D: Textract reads documents, and Personalize builds recommendations.

Review: Chaining services in this part, and What is Amazon Transcribe? and Sentiment in the AWS docs.

Question 5 of 5

A Saudi online store wants to detect the sentiment of its Arabic reviews directly, and translate them into English for its head office. Which two services fit? (Choose two.)

Show the answer

Correct answer: C + E

Comprehend supports Arabic, including sentiment, and Translate handles the translation.

A: This reads documents, and it doesn't support Arabic.
B: This voices text, and doesn't analyze or translate it.
D: This analyzes images and video.

Review: And Arabic? in this part, and Languages supported in Amazon Comprehend and Supported languages and language codes in the AWS docs.

This completes the data and AI section. Your application is big now, and it has a lot running in it. How do you know it's healthy, and who changed what? In part twenty-five we start the final section, with monitoring and auditing through CloudWatch, CloudTrail and Config.

Analyzing Data: Athena, Redshift and Glue

2026-11-02T00:00:00Z

The application we finished designing in part twenty-two produces a lot of data: orders, logs and events. Then someone asks: "Which city grew the most this year?"

You could run that on your production database and slow it down for your customers. Instead, AWS has a set of services built for analysis, and this part is a guide to them.

You want	Use
SQL on files in S3, with no servers	Athena
A data warehouse for heavy, frequent reports	Redshift
A catalog of your data, and cleaning and converting it	Glue
Permissions over a whole data lake	Lake Formation
Text search and log analysis	OpenSearch
Big Spark or Hadoop jobs	EMR
Dashboards for your team	Quick Sight
Analyzing a stream as it arrives	Managed Flink
Managed Apache Kafka	MSK

Two kinds of work

The questions an application asks are different from the questions a business asks:

	Running the application (OLTP)	Analysis (OLAP)
Example	Fetch order 1001	Total sales per city over three years
Rows touched	A few	Millions
Who asks	Millions of customers	A few analysts
Services	RDS and DynamoDB	Athena and Redshift

The secret of analytics services is storing data by column. To add up one column, there's no need to read the rest:

To add up the amount column, row storage goes through every field, while column storage reads that column alone.

Amazon Athena: SQL on S3

Athena lets you query files in S3 directly with SQL. There's nothing to run: you describe the files as a table, and the data stays where it is.

You pay about $5 per TB of data scanned, with a 10 MB minimum per query. Creating tables and failed queries cost nothing. It suits occasional questions and analyzing logs, such as those from a load balancer or S3, and it's also where AWS points you now that S3 Select is closed to new customers.

Read less, pay less

Since the price depends on what's read, reading less means both a lower bill and a faster answer:

Columnar formats: convert files to Parquet or ORC, so a query reads only its columns.
Partitions: split the data into paths such as year=2025/, so a query skips the rest.
Compression: the smaller the data, the less gets scanned.
Larger files: thousands of tiny files slow things down, so merge them.

With the data split by year, a query about 2025 reads one folder and skips the others, so you pay only for what it read.

Federated queries

Your data isn't all in S3? Federated Query lets Athena reach other sources, such as DynamoDB or RDS, through a connector that runs as a Lambda function in your account. One query can even join them with your files.

Amazon Redshift: the warehouse

When reports become heavy and frequent, with many joins and many users, you need a data warehouse. Redshift is based on PostgreSQL, stores data by column, and splits a query across many nodes in parallel.

	Serverless	Provisioned
You choose	Nothing; capacity adjusts itself	The type and number of nodes
You pay for	Compute time when queries run	Each node per hour
Suits	Changing or intermittent load	Steady load, or needing Multi-AZ

Getting data in

Method	When
`COPY` from S3	The usual way: loads in bulk and in parallel
Data Firehose	A stream that lands in S3, then gets loaded with `COPY`
Zero-ETL	Automatically replicating from sources like Aurora, RDS and DynamoDB, with no pipeline to build
`INSERT` row by row	Avoid it for large amounts; it's very slow

Things worth knowing

Redshift Spectrum: query files in S3 from Redshift without loading them, and join them with your tables.
Snapshots: automatic and incremental, and you can copy them to another Region to recover from a disaster.
Multi-AZ: available on provisioned RA3 clusters, with nodes in two Availability Zones behind one endpoint.

Athena or Redshift?

	Athena	Redshift
The data is in	S3	The warehouse, plus S3 with Spectrum
Setup	None	Little, with Serverless
You pay for	Data scanned	Compute time
Suits	Occasional questions and logs	Heavy, repeated reports and dashboards

Start with Athena, and move to Redshift when your queries become frequent enough for it to pay off.

AWS Glue: preparing the data

Analysis assumes the data is clean and organized, which is rarely the case. Glue is a serverless set of tools for that:

Part	What it does
Data Catalog	A central list of your tables and their columns, used by Athena, Redshift Spectrum and EMR
Crawlers	Scan S3 and work out the columns, then add them to the catalog
ETL jobs	Spark code that extracts, transforms and loads data, such as CSV to Parquet
Job bookmarks	Remember what's been processed, so a job doesn't repeat old files
DataBrew	Cleans data visually, with no code

A common pattern: a file lands in S3, an event starts a Glue job, and it converts the file to Parquet in another folder. Note that Glue Ray jobs closed to new customers on April 30, 2026, while Spark jobs carry on as usual.

You may also read about AWS Data Pipeline, an older service for moving and processing data on a schedule. It's closed to new customers and in maintenance mode, so use Glue or Step Functions for new work.

Lake Formation: permissions for the lake

S3 with Parquet files and a catalog is what's called a data lake. As it grows, managing access through bucket policies gets hard, because S3 knows about files, not columns.

Lake Formation gives you one place to grant access by database, table, column and even row: the sales team sees orders without card numbers, for example. These permissions apply through services like Athena, Redshift and EMR.

Search, big jobs and dashboards

OpenSearch

A database is good at finding by key. OpenSearch is good at finding by any word in any field, and at analyzing logs. It comes as managed clusters where you control the sizes, or as Serverless for changing load.

It's usually a copy of your data, not the source. Two common patterns:

Search over a table: DynamoDB Streams, then Lambda, then OpenSearch. You search there, then fetch the full item from the table.
Log analysis: CloudWatch Logs, then Firehose, then OpenSearch.

Amazon EMR

Do you have existing Spark or Hadoop jobs? EMR runs them, and you can choose to run it on EC2, on EKS or as Serverless. On EC2 there are three kinds of nodes:

Node	Role	Purchase option
Primary	Coordinates the cluster	On-Demand or Reserved
Core	Runs tasks and stores data	On-Demand or Reserved
Task	Runs tasks only, and is optional	Spot is ideal

Quick Sight

Amazon Quick Sight builds dashboards from Athena, Redshift, RDS, S3 and others. Its name was QuickSight, and since October 2025 it has been part of a broader suite called Amazon Quick, though the API still uses the old name.

SPICE: an in-memory engine that makes dashboards fast, without burdening the source on every view.
An analysis or a dashboard: you edit in an analysis, and publish it as a read-only dashboard.
Row-level security: each manager sees only their own region's data.

Streams: Flink and Kafka

Kinesis and Firehose deliver the data. What if you want to analyze it as it arrives, such as spotting a suspicious pattern within seconds?

Managed Service for Apache Flink (formerly Kinesis Data Analytics) runs Flink applications that read from a Kinesis stream or from MSK, without you managing the cluster.

Amazon MSK is a managed Apache Kafka, the most popular streaming platform in the open-source world. It comes as provisioned clusters with Standard or Express brokers, or as Serverless.

	Kinesis Data Streams	Amazon MSK
Split into	Shards	Topics and partitions
APIs	AWS's own	Standard Kafka
Record size	1 MiB by default, up to 10 MiB	1 MB by default, and configurable
Choose it if	You want the simplest option on AWS	You have Kafka applications and tools

How does the data arrive?

Choosing a way in starts with how often the data arrives, and how large it is:

The data	Use
Files from a server or NAS, on a schedule	DataSync
Files from partners over SFTP	Transfer Family
Small records, continuously, with several readers	Kinesis Data Streams or MSK
Small records, continuously, landing in storage	Data Firehose
Rows changing in a database	Zero-ETL or DMS
Data sets from other companies	AWS Data Exchange, where you subscribe to them

Secure each way in the same manner: least-privilege IAM roles, encryption in transit and at rest, and private paths such as VPC endpoints instead of the public internet where you can.

The complete picture

Here's how the pieces meet in a typical pipeline:

Data lands raw in S3, Glue converts it to Parquet, Athena answers from it and Quick Sight displays the result. Redshift can take Athena's place for heavy reports.

Hands-on: Parquet cuts what a query reads

We'll generate a file of 200,000 orders and put the same question to it twice. From CloudShell:

Bash

BUCKET=series-data-$RANDOM$RANDOM
aws s3 mb s3://$BUCKET

awk 'BEGIN {
  srand(7)
  split("Riyadh Jeddah Dammam Abha Tabuk", city, " ")
  for (i = 1; i <= 200000; i++)
    printf "%d,%s,%d,%.2f\n", i, city[int(rand()*5)+1], 2024+int(rand()*3), rand()*500
}' > sales.csv

head -3 sales.csv
aws s3 cp sales.csv s3://$BUCKET/raw/sales.csv

This function runs a query, waits for it, then prints its state, the bytes it scanned and its result:

Bash

run_sql() {
  ID=$(aws athena start-query-execution --query-string "$1" \
    --result-configuration OutputLocation=s3://$BUCKET/results/ \
    --query QueryExecutionId --output text)
  while true; do
    STATE=$(aws athena get-query-execution --query-execution-id $ID \
      --query QueryExecution.Status.State --output text)
    [ "$STATE" = QUEUED ] || [ "$STATE" = RUNNING ] || break
    sleep 1
  done
  aws athena get-query-execution --query-execution-id $ID \
    --query "QueryExecution.[Status.State,Statistics.DataScannedInBytes]" \
    --output text
  aws athena get-query-results --query-execution-id $ID \
    --query "ResultSet.Rows[*].Data[*].VarCharValue" --output text
}

Describe the file as a table. Nothing moves, and the data stays in S3:

Bash

run_sql "CREATE DATABASE series_data"

run_sql "CREATE EXTERNAL TABLE series_data.sales_csv (
  order_id INT, city STRING, year INT, amount DOUBLE
)
ROW FORMAT DELIMITED FIELDS TERMINATED BY ','
LOCATION 's3://$BUCKET/raw/'"

Ask the question:

Bash

run_sql "SELECT city, ROUND(SUM(amount)) AS total
FROM series_data.sales_csv WHERE year = 2025
GROUP BY city ORDER BY total DESC"

You get the total for each city, and the first line shows the whole file was scanned, a little over 5 MB, even though the question concerns one year and two columns. Now create a partitioned Parquet copy with one query:

Bash

run_sql "CREATE TABLE series_data.sales_parquet WITH (
  format = 'PARQUET',
  external_location = 's3://$BUCKET/parquet/',
  partitioned_by = ARRAY['year']
) AS SELECT order_id, city, amount, year FROM series_data.sales_csv"

aws s3 ls s3://$BUCKET/parquet/

You'll see a folder for each year. Ask the same question of the new table:

Bash

run_sql "SELECT city, ROUND(SUM(amount)) AS total
FROM series_data.sales_parquet WHERE year = 2025
GROUP BY city ORDER BY total DESC"

The numbers match, but the scanned bytes are a small fraction of the first figure. On terabytes, that difference is your bill.

Bash

run_sql "DROP TABLE series_data.sales_parquet"
run_sql "DROP TABLE series_data.sales_csv"
run_sql "DROP DATABASE series_data"
aws s3 rb s3://$BUCKET --force

Summary

Separate analysis from your production database, and store data by column.
Athena queries S3 with no servers, and Parquet and partitions lower its cost.
Redshift is for heavy, repeated reports, and Serverless is an easy start.
Glue catalogs and converts your data, and Lake Formation controls who sees which column.
OpenSearch is for search, EMR for Spark jobs, Quick Sight for dashboards, and Flink and MSK for streams.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 6

A retail chain's analysts run heavy reports all day, with many joins across years of sales, and dozens of dashboards refresh from them. Which service was built for this?

Show the answer

Correct answer: C

This is a data warehouse's job. Redshift stores data by column and splits each query across many nodes, so heavy, repeated reports run fast.

A: This suits occasional questions, and with this many queries you'd pay for every scan.
B: This takes load off production, but it still stores data by row and isn't built for this scale of analysis.
D: This is for text search and log analysis.

Review: Athena or Redshift? in this part, and What is Amazon Redshift? in the AWS docs.

Question 2 of 6

Partners drop CSV files into an S3 bucket every day. A team wants them converted to Parquet on a schedule, with no servers to run and without reprocessing files already converted. What fits?

Show the answer

Correct answer: A

A Glue ETL job runs Spark with no servers to manage, and job bookmarks remember what's been processed, so each run handles only the new files.

B: A crawler works out the columns and updates the catalog, and doesn't convert anything.
C: This could do the conversion, but it's a cluster you'd have to run.
D: This moves files between classes, and doesn't change their format.

Review: AWS Glue: preparing the data in this part, and Tracking processed data using job bookmarks in the AWS docs.

Question 3 of 6

A company's data lake holds an orders table in S3, queried through Athena. The sales team must see the table, but not its card number column. What fits?

Show the answer

Correct answer: D

Lake Formation grants access down to the column and row, and those permissions apply through services like Athena.

A: S3 knows about files, not the columns inside them.
B: A crawler only describes the data, and controls nobody's access.
C: This gives a team its own door to a bucket, and still works at the level of files.

Review: Lake Formation: permissions for the lake in this part, and Data filtering and cell-level security in Lake Formation in the AWS docs.

Question 4 of 6

A store keeps its products in DynamoDB. Customers want to search for any word in a product's name or description, and the table must stay the source of truth. What fits?

Show the answer

Correct answer: B

OpenSearch finds any word in any field. Streams and Lambda keep it up to date, so you search there, then fetch the full item from the table.

A: An index finds items by key, not by any word inside a long text.
C: This reads the whole table for every search, so it's slow and costly.
D: This speeds up reads by key, and adds no text search.

Review: OpenSearch in this part, and Loading streaming data into Amazon OpenSearch Service in the AWS docs.

Question 5 of 6

A team's Athena bill is high. Its queries usually read two columns from one month of data, but everything sits in S3 as one big folder of CSV files. Which two changes lower the cost? (Choose two.)

Show the answer

Correct answer: B + E

Athena charges for the data it scans. Parquet lets a query read only its columns, and partitions let it skip the other months.

A: Files in this class have to be restored before they can be read.
C: The price depends on what's read, not on when.
D: This keeps old versions, and changes nothing about what a query reads.

Review: Read less, pay less in this part, and Use columnar storage formats and Partition your data in the AWS docs.

Question 6 of 6

An analytics team wants weather data from a commercial provider in its data lake, kept current through a subscription, without building a custom feed. What fits?

Show the answer

Correct answer: A

Data Exchange is where you find other companies' data sets and subscribe to them.

B: This receives files over SFTP and the like, so the provider would still have to send them to you.
C: This describes data you already have, and doesn't bring in new data.
D: You'd have to write what feeds it, which is the work the team wants to avoid.

Review: How does the data arrive? in this part, and What is AWS Data Exchange? in the AWS docs.

You now understand the data you hold. Can you get more out of it, such as reading documents, understanding speech or generating text? In part twenty-four we go through AWS's ready-made AI services.

Designing Serverless Applications

2026-11-02T00:00:00Z

In part twenty-one we built an API from three pieces. A real application needs more: a process with several steps that can fail halfway through, users who sign in, and things that should happen after a request without keeping anyone waiting.

This part completes the picture with two more services, then applies everything to two designs.

Step Functions: workflows

An order involves checking stock, then taking payment, then shipping. You could have each function call the next, but then where do retries live? What happens if the payment fails after the stock was reserved? And who can tell you where order 1001 is right now?

Step Functions moves that logic out of your code, into a state machine: a definition of the steps and what happens after each one, which you can see as a drawing in the console.

The workflow knows the order of the steps and where each failure goes, while each step stays small and simple.

Each step can call a Lambda function or many AWS services directly, and the definition handles what you'd otherwise write by hand:

Ability	What it does
Retry	Retries a failed step, waiting longer each time
Catch	Sends a failure to a step that handles it, such as a refund
Choice	Picks a path according to the data
Parallel and Map	Runs branches together, or one step for each item in a list
Wait	Pauses for a period, or for a human approval that takes days

This is what retrying the payment and catching its failure looks like:

JSON

"TakePayment": {
  "Type": "Task",
  "Resource": "arn:aws:states:::lambda:invoke",
  "Parameters": { "FunctionName": "take-payment", "Payload.$": "$" },
  "Retry": [{
    "ErrorEquals": ["States.TaskFailed"],
    "IntervalSeconds": 2,
    "BackoffRate": 2,
    "MaxAttempts": 3
  }],
  "Catch": [{
    "ErrorEquals": ["States.ALL"],
    "Next": "CancelOrder"
  }],
  "Next": "Ship"
}

	Standard	Express
Maximum duration	One year	Five minutes
Execution	Exactly once	At least once
Billed by	State transition, with 4,000 free each month	Number of requests, duration and memory
Suits	Long processes such as orders and approvals	Short, very frequent events

Cognito: your users

IAM is for your team and your services, not for a million people using your application. Amazon Cognito gives your application its own users, and it has two parts that are easy to confuse:

	User Pool	Identity Pool
Question it answers	Who is this user?	What can they do in AWS?
Gives	A token after signing in	Temporary AWS keys
Used for	Your application and your API	Direct access to S3 or DynamoDB

User Pools handle sign-up and sign-in, password resets, multi-factor authentication, and signing in with accounts like Google or a corporate identity. API Gateway and the Application Load Balancer can check its tokens directly. New pools use the Essentials plan by default, and there's also a cheaper Lite with fewer features, and Plus with advanced protection.

Identity Pools exchange a token for temporary keys tied to an IAM role, and a policy variable limits them to the user's own data. For example, each user reaches only their folder in S3:

JSON

{
  "Effect": "Allow",
  "Action": ["s3:GetObject", "s3:PutObject"],
  "Resource": "arn:aws:s3:::recipe-photos/users/${cognito-identity.amazonaws.com:sub}/*"
}

Design one: a mobile app

Let's design an app for sharing recipes: users sign in, write recipes, upload photos, and popular recipes get read many times more often than they're written. Each requirement has its piece:

Requirement	Solution
Users sign in	A Cognito User Pool
An API for reading and writing recipes	API Gateway, Lambda and DynamoDB
Uploading photos directly	An Identity Pool with temporary keys to S3
Huge numbers of reads on the same recipes	DAX in front of the table
Repeated identical requests	API Gateway caching, on a REST API

The User Pool signs the user in and issues a token. API Gateway checks it, and the Identity Pool exchanges it for temporary keys limited to the user's own folder.

Why does the photo go directly to S3, instead of through the API? Because API Gateway has a 10 MB limit, and because you'd pay for Lambda's time just to pass bytes along. Signed links from part seventeen are another good option here, when you don't need Identity Pools.

And notice where each cache sits: API Gateway's stops the request before it reaches the function, so it suits responses that don't change per user. DAX lets the function run, then spares the table from the read.

Design two: a global website

Now a travel guide read around the world: static pages, a small API, a welcome email when someone registers, and thumbnails for the photos users upload.

CloudFront serves the pages and passes API calls along. Everything after a write happens through events: a new user triggers the email, and a new image triggers the thumbnail.

Follow it piece by piece:

Pages: a private S3 bucket with CloudFront and OAC in front of it, so the bucket stays closed and the site is fast everywhere.
API: API Gateway, Lambda and DynamoDB, and Global Tables place data close to users in each Region.
Welcome email: the API doesn't send it. A new user is written to the table, DynamoDB Streams triggers a function, and it sends through SES. If email fails, registration isn't affected.
Thumbnails: a photo landing in S3 triggers a Lambda function that writes a smaller copy. To handle bursts, or to reach several services, put SQS or SNS in between.

There's not a single server here, and when no one's visiting, the bill is close to storage costs alone. The point in the last two flows is the same: the request finishes quickly, and everything else happens through events.

Microservices

When an application grows, teams split it into small services, each with its own job, database and release schedule. There are two ways for them to talk:

Style	Tools	Suits
Synchronous	API Gateway or a load balancer	You need the answer now, such as a price
Asynchronous	SQS, SNS, Kinesis and Lambda triggers	The work can come later, such as an invoice

And each service can choose what suits it: Lambda for scattered requests, Fargate for steady load, and EC2 for special requirements. All of this has a price, though: more deployments, more to monitor, and failures harder to trace across services. So don't start here for a small application, and split only when you really need to.

A cheap win: CloudFront in front of what you have

Not every improvement needs a rewrite. Imagine an application on an Auto Scaling group that distributes large update files. On release day, all your users download at once: servers multiply, and your data transfer bill jumps.

Put CloudFront in front of it, and change nothing else. The files don't change, so they suit caching very well: most requests stop at the edge, the group barely has to grow, and data going out through CloudFront costs less than going out directly. A few minutes' work can pay back more than a redesign.

Design principles

Principle	Why
Make processing safe to repeat	SQS, SNS and asynchronous Lambda deliver at least once
A dead-letter queue for anything asynchronous	A silent failure is the worst kind
One role per function, with the least privilege	A flaw in one doesn't open everything
Small functions with one job	Easier to test, and quicker to start
Calculate the cost	With heavy, constant load, containers can come out cheaper
Observe everything	Requests pass through many services, and we cover the tools in part twenty-five

You also don't have to start from nothing. The AWS Serverless Application Repository lets you find ready-made serverless applications, set a few values, and deploy them in a few clicks.

Hands-on: a file triggers a function

In part fifteen we promised to apply S3 events. We'll make the thumbnail flow, with one simplification: instead of an image library, the function converts a text file to capitals. The flow is exactly the same. From CloudShell:

Bash

BUCKET=series-events-$RANDOM$RANDOM
aws s3 mb s3://$BUCKET

cat > trust.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "lambda.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}
EOF

ROLE_ARN=$(aws iam create-role --role-name series-events-role \
  --assume-role-policy-document file://trust.json \
  --query Role.Arn --output text)

aws iam attach-role-policy --role-name series-events-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

aws iam put-role-policy --role-name series-events-role \
  --policy-name bucket-access --policy-document "{
    \"Version\": \"2012-10-17\",
    \"Statement\": [{
      \"Effect\": \"Allow\",
      \"Action\": [\"s3:GetObject\", \"s3:PutObject\"],
      \"Resource\": \"arn:aws:s3:::$BUCKET/*\"
    }]
  }"

Write the function, and create it. If you get an error about the role, wait a few seconds and repeat the command:

Bash

cat > app.py <<'EOF'
from urllib.parse import unquote_plus
import boto3

s3 = boto3.client("s3")

def handler(event, context):
    for record in event["Records"]:
        bucket = record["s3"]["bucket"]["name"]
        key = unquote_plus(record["s3"]["object"]["key"])
        body = s3.get_object(Bucket=bucket, Key=key)["Body"].read().decode()
        name = key.split("/")[-1]
        s3.put_object(Bucket=bucket, Key=f"processed/{name}", Body=body.upper())
EOF

zip -q function.zip app.py

FN_ARN=$(aws lambda create-function --function-name series-events \
  --runtime python3.13 --handler app.handler --role $ROLE_ARN \
  --zip-file fileb://function.zip \
  --query FunctionArn --output text)

aws lambda wait function-active-v2 --function-name series-events

Allow S3 to invoke the function, then tell the bucket to send it events from the uploads/ folder only:

Bash

aws lambda add-permission --function-name series-events \
  --statement-id s3-trigger --action lambda:InvokeFunction \
  --principal s3.amazonaws.com --source-arn arn:aws:s3:::$BUCKET \
  --query Statement --output text > /dev/null

cat > notify.json <<EOF
{
  "LambdaFunctionConfigurations": [{
    "LambdaFunctionArn": "$FN_ARN",
    "Events": ["s3:ObjectCreated:*"],
    "Filter": {"Key": {"FilterRules": [{"Name": "prefix", "Value": "uploads/"}]}}
  }]
}
EOF

aws s3api put-bucket-notification-configuration --bucket $BUCKET \
  --notification-configuration file://notify.json

Upload a file, wait a few seconds, then read the result:

Bash

echo "hello from s3" > note.txt
aws s3 cp note.txt s3://$BUCKET/uploads/note.txt

Bash

aws s3 cp s3://$BUCKET/processed/note.txt -

It prints HELLO FROM S3. You uploaded a file, and code ran by itself.

Clean up before moving on:

Bash

aws s3 rb s3://$BUCKET --force
aws lambda delete-function --function-name series-events
aws logs delete-log-group --log-group-name /aws/lambda/series-events
aws iam delete-role-policy --role-name series-events-role \
  --policy-name bucket-access
aws iam detach-role-policy --role-name series-events-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
aws iam delete-role --role-name series-events-role

Hands-on: a workflow that decides

We'll write a state machine that looks at an order's amount: a negative amount fails, a large amount goes to review, and the rest is approved. It only uses internal steps, so it needs a role with no permissions:

Bash

cat > trust.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "states.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}
EOF

FLOW_ROLE=$(aws iam create-role --role-name series-flow-role \
  --assume-role-policy-document file://trust.json \
  --query Role.Arn --output text)

cat > flow.json <<'EOF'
{
  "StartAt": "CheckAmount",
  "States": {
    "CheckAmount": {
      "Type": "Choice",
      "Choices": [
        {"Variable": "$.amount", "NumericLessThanEquals": 0, "Next": "Rejected"},
        {"Variable": "$.amount", "NumericGreaterThan": 1000, "Next": "NeedsReview"}
      ],
      "Default": "Approved"
    },
    "NeedsReview": {"Type": "Pass", "Result": {"status": "review"}, "End": true},
    "Approved": {"Type": "Pass", "Result": {"status": "approved"}, "End": true},
    "Rejected": {"Type": "Fail", "Error": "InvalidAmount", "Cause": "The amount must be positive"}
  }
}
EOF

Create it. Here too, if you get an error about the role, wait a few seconds and repeat:

Bash

FLOW_ARN=$(aws stepfunctions create-state-machine --name series-order \
  --definition file://flow.json --role-arn $FLOW_ROLE \
  --query stateMachineArn --output text)

Run it with three orders:

Bash

try_order() {
  RUN=$(aws stepfunctions start-execution --state-machine-arn $FLOW_ARN \
    --input "$1" --query executionArn --output text)
  sleep 2
  aws stepfunctions describe-execution --execution-arn $RUN \
    --query "[status,output]" --output text
}

try_order '{"amount": 250}'
try_order '{"amount": 5000}'
try_order '{"amount": -5}'

You'll get approved, then review, then FAILED. Now open Step Functions in the console, choose series-order, then any of the executions. You'll see the drawing with the path taken in color, which is what you'd look at when an order gets stuck in production.

Bash

aws stepfunctions delete-state-machine --state-machine-arn $FLOW_ARN
aws iam delete-role --role-name series-flow-role

Summary

Step Functions takes steps, retries and failures out of your code into a visible workflow.
A User Pool answers who the user is, and an Identity Pool gives them temporary keys to AWS.
A good design finishes the request quickly, and leaves everything else to events.
Have large files go directly to S3, and put caching where it stops the most work.
Microservices have a price, so split only when you really need to.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 5

An order goes through stock, payment and shipping. Failed steps must retry, a failed payment must trigger a refund, and large orders wait days for a manager's approval. The team also wants to see where each order is. What fits?

Show the answer

Correct answer: D

A Standard workflow can last up to a year, its definition holds the retries, failures and waiting, and the console shows you each execution's path as a drawing.

A: These run for at most five minutes, so they can't wait for days.
B: The retries and failure handling end up in your code, and nothing shows you where an order is.
C: This delivers to every subscriber at once, with no order between the steps.

Review: Step Functions: workflows in this part, and Choosing workflow type in Step Functions in the AWS docs.

Question 2 of 5

Users sign in to a mobile app through a Cognito User Pool. They should upload photos directly to S3, and each must only reach their own folder. What gives the app access to S3?

Show the answer

Correct answer: A

The Identity Pool swaps the token for temporary keys tied to an IAM role, and a policy variable limits them to that user's folder.

B: A User Pool token says who the user is, and it isn't a set of AWS keys.
C: IAM is for your team and services, not for huge numbers of app users.
D: Anyone could pull these keys out of the app, and they'd work for everyone's folders.

Review: Cognito: your users in this part, and Amazon Cognito identity pools and IAM roles in the AWS docs.

Question 3 of 5

A sign-up API sends a welcome email before it responds. When the email service is slow, sign-ups are slow too, and when it fails, sign-ups fail. New users are written to DynamoDB. What's the best design?

Show the answer

Correct answer: B

The request finishes once the user is written, and the email happens through an event, so a failed email doesn't affect the sign-up.

A: Users would wait even longer, and failures would still reach them.
C: This removes cold starts, and the slowness comes from the email.
D: Retrying inside the request makes users wait even longer.

Review: Design two: a global website in this part, and DynamoDB Streams and AWS Lambda triggers in the AWS docs.

Question 4 of 5

An application on an Auto Scaling group distributes large update files. On release day the group grows sharply and the data transfer bill jumps. What gives the biggest improvement with the least change?

Show the answer

Correct answer: C

The files don't change, so they suit caching very well. Most requests stop at the edge, the group barely has to grow, and data going out through CloudFront costs less than going out directly.

A: The servers would still handle every download, and the same data would still go out.
B: This is a rewrite, and API Gateway's 10 MB limit is too small for large files.
D: This shortens the road but doesn't cache, so every download still reaches the servers.

Review: A cheap win: CloudFront in front of what you have in this part, and What is Amazon CloudFront? in the AWS docs.

Question 5 of 5

An SNS topic invokes a Lambda function asynchronously. Some customers were charged twice, and events that failed repeatedly vanished with no trace. Which two changes address these? (Choose two.)

Show the answer

Correct answer: A + E

An event can be delivered more than once, so a duplicate has to be harmless. And a dead-letter queue keeps what failed so you can inspect it, rather than losing it silently.

B: This makes the function faster, and duplicates still arrive.
C: This eases cold starts, and has nothing to do with either problem.
D: This keeps environments ready, and has nothing to do with either problem.

Review: Design principles in this part, and How Lambda handles errors and retries with asynchronous invocation and Capturing records of Lambda asynchronous invocations in the AWS docs.

This completes the modern applications section. Your application now generates a lot of data, but what does it tell you? In part twenty-three we start the data and AI section, analyzing data with Athena, Redshift and Glue.

Serverless: Lambda, API Gateway and DynamoDB

2026-11-02T00:00:00Z

In part twenty we stopped managing servers, but tasks still run around the clock, waiting for visitors who may never come. What if your code only ran when a request arrived, and you paid nothing otherwise?

That's serverless. There are still servers, of course, but provisioning, updating and scaling them are no longer your problem.

	EC2	Fargate	Lambda
You manage	The system and the application	The image and the application	The code
You pay for	Running time	Running time	Each request and its duration
When idle	You pay	You pay	Almost nothing
Scaling	You set it up	You set it up	By itself
Runs for	As long as you like	As long as you like	Up to 15 minutes per request

AWS Lambda

Lambda runs a function you write when an event triggers it. It does its work, then stops.

An event starts the function, it does its work and stops. You pay only for the time it ran.

It supports Python, Node.js, Java, .NET and Ruby directly, and any other language through a custom runtime or a container image. This is what a function looks like in Python:

Python

def handler(event, context):
    name = event.get("name", "world")
    return {"message": f"Hello {name}"}

The event carries the details of what happened, and its shape depends on the source: an S3 event contains the bucket and the key, for example, and an API event contains the path and the headers.

What does it cost?

You pay for the number of requests, and for the duration multiplied by memory, in GB-seconds. Prices below are for x86 in US Regions, and the free tier covers 1 million requests and 400,000 GB-seconds every month.

An example: a function with 512 MB of memory that runs for 200 milliseconds, 5 million times a month:

Item	Calculation	Cost
Duration	5,000,000 x 0.2 s x 0.5 GB = 500,000 GB-s, minus 400,000 free	$1.67
Requests	5 million minus 1 million free, at $0.20 per million	$0.80
Total		about $2.47

Five million requests for less than a coffee. But the calculation can flip: with heavy, constant load, a server or container can come out cheaper, so do the math.

Limits to know

Limit	Value
Memory	128 MB to 10,240 MB, and CPU rises with it
Duration	15 minutes per request
Temporary storage	`/tmp`, from 512 MB to 10 GB
Package size	50 MB zipped, 250 MB unzipped, or a 10 GB container image
Concurrency	1,000 per Region by default, and it may be lower in new accounts
Payload	6 MB for synchronous calls, 1 MB for asynchronous

If your work takes longer than 15 minutes, split it up with Step Functions, or use a container.

Concurrency

Each execution environment serves one request at a time, so 100 simultaneous requests need 100 environments. That number is your concurrency, and all functions in a Region share one limit. What happens when you reach it?

Synchronous calls, as from an API, get a 429 error.
Asynchronous calls, as from S3, are held and retried for up to 6 hours, then sent to a dead-letter queue or a failure destination if you've set one.

The hidden trap is that one busy function can consume the whole limit and throttle your others. Reserved concurrency sets aside a share for a function, which is also a ceiling for it, so it neither gets starved nor starves others.

Cold starts

When a request arrives with no environment ready, Lambda creates one and loads your code first. This is a cold start, and it may add from a fraction of a second to several seconds, depending on the language and the size of the code. Then the environment stays around for a while and serves later requests quickly. This setup time is billed too, since August 2025.

Tool	How it works	Cost
Provisioned Concurrency	Keeps a number of environments ready at all times, so there's no cold start for them	You pay for them while ready
SnapStart	Saves a snapshot after setup and restores from it, for Java 11+, Python 3.12+ and .NET 8+	Free for Java; charged for Python and .NET

The two can't be combined on one function. SnapStart lowers startup time but doesn't guarantee to remove it, so if you need very low, steady latency, use Provisioned Concurrency.

Lambda inside a VPC

By default a function runs outside your VPC, so it can reach the internet and public AWS services, but not your private RDS. Attach it to your VPC and it can reach them, with two things to note:

It loses its internet access, unless the subnet goes through a NAT gateway or you use endpoints.
A thousand environments can open a thousand connections to the database. This is what RDS Proxy solves, by reusing a few connections.

Code at the edge

We mentioned two ways of running short code on CloudFront. Here's the difference:

	CloudFront Functions	Lambda@Edge
Languages	JavaScript	Node.js and Python
Duration	Under a millisecond	Up to 30 seconds on origin events
Network access	No	Yes
Events	Viewer request and response	Those, plus origin request and response
Good for	Redirects, headers and cache keys	Heavier logic and calling other services

Amazon DynamoDB

Lambda scales in seconds to thousands of copies, and a traditional database doesn't like that. DynamoDB is a serverless key-value database: no servers, no connections to manage, millisecond responses at any size, and data replicated across several Availability Zones automatically.

Tables, items and keys

A table contains items, each with attributes, and two items don't need to have the same attributes. The maximum size of an item is 400 KB. What's fixed is the primary key:

`customer` (partition key)	`order_id` (sort key)	`total`	`status`	`coupon`
sara	1001	120	shipped
sara	1002	40	new	SAVE10
omar	1003	75	new

Partition key: decides where the item is stored. Choose one with many varied values, so that the load spreads out.
Sort key: optional, and it orders items sharing the same partition key, so you can ask for "Sara's latest orders".

This is the big difference from relational databases: there are no joins, and you fetch items by their key. So start from your queries and design the table to suit them. If you need to query by another attribute, such as status, add a global secondary index.

Capacity modes

Mode	How it works	When
On-demand	Scales by itself, and you pay per request	Unknown or changing load; start here
Provisioned	You set reads and writes per second, optionally with auto scaling	Steady, predictable load, which comes out cheaper

Provisioned capacity is counted in units. One read capacity unit (RCU) is one strongly consistent read per second of an item up to 4 KB, or two eventually consistent ones. One write capacity unit (WCU) is one write per second of an item up to 1 KB. So reading 80 items of 3 KB per second with strong consistency needs 80 RCUs, and writing 100 items of 512 bytes per second needs 100 WCUs.

Additions worth knowing

Feature	What it does
DAX	A cache in front of the table, taking reads from milliseconds to microseconds
Streams	A log of every change, kept for 24 hours, which can trigger Lambda
Global Tables	Copies in several Regions, all accepting writes
TTL	Automatically deletes items after a time you set, such as old sessions
Point-in-time recovery	Restores the table to any second within the last 1 to 35 days
S3 integration	Exports a table to S3 for analysis, or imports from S3 into a new table

Where does DAX stand against ElastiCache? DAX is a transparent cache for DynamoDB, with almost no code change. ElastiCache is more general, for example for storing calculated results that your application manages itself.

Global Tables are eventually consistent by default, so a write in one Region reaches the others after a short delay. If you need a read in any Region to see the latest write, there's a strong consistency mode, which needs exactly three Regions and has some limitations.

API Gateway: the front door

A function has no web address by default. API Gateway receives the request over HTTPS and passes it on to the function, handling on your behalf what you don't want to write yourself: authentication, throttling, versions and more.

The classic serverless API: every part scales with requests, and with no traffic you pay almost nothing.

Type	Suits
HTTP API	Most APIs: simpler and cheaper, with a fixed 30-second limit
REST API	More features: caching, API keys and request validation
WebSocket API	Two-way connections, such as chat

A REST API also comes in three kinds: Edge-optimized through CloudFront for users around the world, Regional for users close by, and Private for inside your VPC only.

Behind it you can put a Lambda function, any HTTP address, or an AWS service directly. For instance, it can send a request straight to SQS, with no function in between. And for a single simple endpoint, Lambda also offers function URLs: a direct HTTPS link to the function, without these extras.

Who can call your API?

Method	Suits
IAM	Your own services and applications inside AWS
Cognito	Your application's users; we'll cover it in the next part
Lambda authorizer	Your own logic, such as a token from another system

Throttling

API Gateway protects what's behind it by limiting requests, and it applies its limits from the most specific down: per client, per method, then for the whole account in the Region. Past the limit, the client gets a 429 and can retry. On a REST API, usage plans with API keys give each client its own rate and quota, which suits an API you sell.

Hands-on: a working API

We'll build a page visit counter from the diagram's three pieces. Everything here falls within the free tier for an experiment like this. From CloudShell, create the table:

Bash

aws dynamodb create-table --table-name series-visits \
  --attribute-definitions AttributeName=page,AttributeType=S \
  --key-schema AttributeName=page,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST \
  --query TableDescription.TableStatus

aws dynamodb wait table-exists --table-name series-visits

TABLE_ARN=$(aws dynamodb describe-table --table-name series-visits \
  --query Table.TableArn --output text)

Give the function a role that can write logs and update this table only:

Bash

cat > trust.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "lambda.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}
EOF

ROLE_ARN=$(aws iam create-role --role-name series-visits-role \
  --assume-role-policy-document file://trust.json \
  --query Role.Arn --output text)

aws iam attach-role-policy --role-name series-visits-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

aws iam put-role-policy --role-name series-visits-role \
  --policy-name table-access --policy-document "{
    \"Version\": \"2012-10-17\",
    \"Statement\": [{
      \"Effect\": \"Allow\",
      \"Action\": \"dynamodb:UpdateItem\",
      \"Resource\": \"$TABLE_ARN\"
    }]
  }"

Write the function. It adds one to the counter for the requested path, and an update like this is safe even with simultaneous requests:

Bash

cat > app.py <<'EOF'
import json
import os
import boto3

table = boto3.resource("dynamodb").Table(os.environ["TABLE"])

def handler(event, context):
    page = event.get("rawPath", "/")
    result = table.update_item(
        Key={"page": page},
        UpdateExpression="ADD visits :one",
        ExpressionAttributeValues={":one": 1},
        ReturnValues="UPDATED_NEW",
    )
    visits = int(result["Attributes"]["visits"])
    return {
        "statusCode": 200,
        "headers": {"content-type": "application/json"},
        "body": json.dumps({"page": page, "visits": visits}),
    }
EOF

zip -q function.zip app.py

Create the function. A new role takes a few seconds to take effect, so if you get an error about the role, wait a little and repeat the command:

Bash

FN_ARN=$(aws lambda create-function --function-name series-visits \
  --runtime python3.13 --handler app.handler --role $ROLE_ARN \
  --zip-file fileb://function.zip \
  --environment "Variables={TABLE=series-visits}" \
  --query FunctionArn --output text)

aws lambda wait function-active-v2 --function-name series-visits

Now the front door. This command creates an HTTP API that sends every path to the function, and then we allow it to invoke the function:

Bash

API_ID=$(aws apigatewayv2 create-api --name series-visits \
  --protocol-type HTTP --target $FN_ARN \
  --query ApiId --output text)

ACCOUNT=$(aws sts get-caller-identity --query Account --output text)

aws lambda add-permission --function-name series-visits \
  --statement-id api-gateway --action lambda:InvokeFunction \
  --principal apigateway.amazonaws.com \
  --source-arn "arn:aws:execute-api:$AWS_REGION:$ACCOUNT:$API_ID/*" \
  --query Statement --output text > /dev/null

URL=$(aws apigatewayv2 get-api --api-id $API_ID \
  --query ApiEndpoint --output text)
echo $URL

Try it. You can also open the link in your browser:

Bash

curl -s $URL/home; echo
curl -s $URL/home; echo
curl -s $URL/about; echo

The counter goes up: home reaches 2 and about is at 1. Look at the data in the table:

Bash

aws dynamodb scan --table-name series-visits \
  --query "Items[].[page.S,visits.N]" --output table

Finally, see the cold start in the function's logs:

Bash

aws logs tail /aws/lambda/series-visits --since 10m | grep REPORT

Only the first request has an Init Duration field, which is the time taken to set up the environment, and the requests after it are much faster. If the logs are empty, wait a few seconds and try again.

Bash

aws apigatewayv2 delete-api --api-id $API_ID
aws lambda delete-function --function-name series-visits
aws dynamodb delete-table --table-name series-visits \
  --query TableDescription.TableStatus
aws logs delete-log-group --log-group-name /aws/lambda/series-visits

aws iam delete-role-policy --role-name series-visits-role \
  --policy-name table-access
aws iam detach-role-policy --role-name series-visits-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
aws iam delete-role --role-name series-visits-role

Summary

Serverless means you write code and data, and pay only for use.
Lambda runs up to 15 minutes, and you pay per request and per GB-second.
Cold starts are eased with Provisioned Concurrency or SnapStart, and reserved concurrency protects functions from each other.
DynamoDB fetches items by key, so design the table around your queries.
API Gateway is the front door, handling authentication and throttling; start with an HTTP API.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 6

A Lambda function is attached to a VPC so it can reach a private RDS database. That works, but now its calls to a payment provider on the internet time out. What fixes this?

Show the answer

Correct answer: C

Once attached to a VPC, a function loses its internet access unless its subnet goes through a NAT gateway.

A: A public subnet gives the function neither internet access nor a public address.
B: There's no path to the internet, so more time won't help.
D: This handles database connections, and the problem is the path out.

Review: Lambda inside a VPC in this part, and Enable internet access for VPC-connected Lambda Event Functions in the AWS docs.

Question 2 of 6

An orders table has customer as its partition key and order_id as its sort key. The team now needs all orders whose status is new, quickly and often. What should it do?

Show the answer

Correct answer: D

A global secondary index organizes the data by a different key, so you can query by status directly.

A: This reads every item each time, so it gets slower and costlier as the table grows.
B: DynamoDB has no joins.
C: This speeds up reads you can already do, and doesn't add a new way to query.

Review: Tables, items and keys in this part, and Using Global Secondary Indexes in DynamoDB in the AWS docs.

Question 3 of 6

A product page reads the same DynamoDB items millions of times a day. The team wants reads to take microseconds, with the fewest code changes. What fits?

Show the answer

Correct answer: A

DAX is a cache in front of the table that works with DynamoDB's API, so it takes only minimal changes.

B: This can be fast too, but your application has to manage what goes in and out of the cache.
C: This places copies in several Regions, and doesn't bring reads down to microseconds.
D: This is a log of changes, and doesn't speed up reads.

Review: Additions worth knowing in this part, and In-memory acceleration with DynamoDB Accelerator (DAX) in the AWS docs.

Question 4 of 6

A company is selling access to its API. It needs API keys for each customer, throttling per client, and cached responses. Which option fits?

Show the answer

Correct answer: B

REST APIs have all of these. HTTP APIs are simpler and cheaper because they leave such features out.

A: This has neither API keys nor caching.
C: This is for two-way connections, such as chat.
D: This is a direct link to a function, without any of these extras.

Review: API Gateway: the front door in this part, and Choose between REST APIs and HTTP APIs in the AWS docs.

Question 5 of 6

A report function sometimes uses up the Region's whole concurrency limit, and the checkout function starts returning 429. Checkout also has to answer with steady, very low latency. Which two settings fit the checkout function? (Choose two.)

Show the answer

Correct answer: A + C

Reserved concurrency sets aside a share for checkout that no other function can take, and Provisioned Concurrency keeps environments ready so they have no cold start.

B: This lowers startup time without guaranteeing to remove it, and can't be combined with Provisioned Concurrency.
D: This adds temporary disk space, and has nothing to do with either problem.
E: CPU rises with memory, so this would make responses slower.

Review: Concurrency and Cold starts in this part, and Configuring reserved concurrency for an Event Function and Configuring provisioned concurrency for an Event Function in the AWS docs.

Question 6 of 6

An application reads 50 items per second from a DynamoDB table in provisioned mode. Each item is 6 KB, and the reads must be strongly consistent. How many read capacity units does it need?

Show the answer

Correct answer: C

One RCU covers one strongly consistent read per second of up to 4 KB, so a 6 KB item needs two. Fifty reads per second need 100.

A: This counts each read as half a unit, which doesn't cover a 6 KB item.
B: This would be enough if the same reads were eventually consistent.
D: This multiplies by the item's size, while units are counted per 4 KB.

Review: Capacity modes in this part, and DynamoDB provisioned capacity mode in the AWS docs.

You now have the building blocks. How do you build a complete application from them, with users, long workflows and events flowing between the services? That's what we'll cover in part twenty-two.

Containers: ECS, Fargate and EKS

2026-11-02T00:00:00Z

In part nineteen we separated the services from each other. Each service still needs somewhere to run, and on an EC2 server that means an image, updates, libraries and the famous sentence: "it works on my machine".

Containers solve this: you package the application with everything it needs in one unit, and it runs the same way on your laptop and in production.

What's a container?

A container is an isolated process with its own files and libraries, which shares the host's operating system instead of carrying its own.

Each virtual machine carries a full operating system. Containers share the host's system, so they are lighter and start in seconds.

	Virtual machine	Container
Contains	A full operating system and the application	The application and its libraries
Size	Gigabytes	Often megabytes
Startup	Minutes	Seconds
Isolation	Stronger, with a separate system	Lighter, with a shared kernel

Image, container and registry

Three words you'll keep hearing:

Image: a read-only package of the application and its libraries, like a recipe.
Container: a running copy of an image. One image can run as a thousand containers.
Registry: where images are stored, such as Docker Hub or Amazon ECR.

The most common tool for building images is Docker. You write what the image contains in a Dockerfile:

dockerfile

FROM nginx:alpine
COPY index.html /usr/share/nginx/html/

Then you build it, try it on your machine, and push it to a registry:

Bash

docker build -t shop .
docker run -p 8080:80 shop
docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/shop

Amazon ECR: your images' home

ECR (Elastic Container Registry) is AWS's image registry, with storage on S3 behind the scenes:

Private repositories: access to them goes through IAM, so a server or task needs permission to pull.
Public repositories: anyone can pull from them, through the ECR Public Gallery.
Extras: image scanning for vulnerabilities, versions with tags, and lifecycle rules that delete old images.

Amazon ECS: AWS's way of running containers

ECS (Elastic Container Service) takes your images and runs them, keeps them running, and places them behind a load balancer. It's AWS's own service, simpler than Kubernetes, and the service itself has no extra charge. You pay for the capacity it runs on.

Four terms cover the whole service:

Term	Meaning	Comparable to
Cluster	A logical group that tasks run in	Your fleet of servers
Task definition	A recipe: the image, CPU, memory, ports and roles	A launch template
Task	One or more running containers from that recipe	A server
Service	Keeps a set number of tasks running, and replaces failed ones	An Auto Scaling group

The service keeps the number of tasks you asked for across Availability Zones, and the load balancer sends visitors to whichever tasks are healthy.

Who runs the containers?

Containers need computing capacity, and you have three options:

Option	Who manages the servers	Suits
Fargate	AWS entirely, with no servers to see	Most applications; start here
Managed Instances	AWS manages them, and you choose the instance types	Needing GPUs or specific instances without the management
EC2	You, through an Auto Scaling group	Full control, or reducing the cost of steady load

With Fargate you state the CPU and memory for a task, and pay for those while it runs. Fargate Spot cuts the price sharply for tasks that can tolerate interruption, in the same way as Spot servers.

Two IAM roles, and confusing them is a classic

Every Fargate task can have two roles, and they do different jobs:

Role	Who uses it	Example
Task execution role	ECS itself, to prepare the task	Pulling the image from ECR and sending logs to CloudWatch
Task role	Your code inside the container	Reading from S3 or writing to DynamoDB

If the task fails at startup with a pull error, look at the execution role. If your code gets AccessDenied while it's running, look at the task role. And give each service its own task role, not one shared role.

Network and load balancing

On Fargate each task gets its own network interface and private IP, so it has its own security group like a server. Put an Application Load Balancer in front of the service, and it registers new tasks automatically and removes failed ones. It suits most web applications, and you'd choose a Network Load Balancer for very high throughput or fixed IP addresses.

Storage

A container's disk disappears with it. To share files between tasks, mount EFS, which works on both Fargate and EC2. And for anything that matters, store it outside the container in S3 or a database.

Scaling

Service Auto Scaling changes the number of tasks based on average CPU or memory, requests per task from the load balancer, or a schedule. The policies are the same ones we saw in part seven.

On Fargate that's all you need. With EC2 there's a second layer, because you need servers for the new tasks to land on. A capacity provider links the service to an Auto Scaling group and adds servers when tasks need them.

Not just web services

Tasks don't have to stay running. Three common patterns:

Pattern	How it works
Reacting to an event	A file lands in S3, EventBridge starts a Fargate task to process it, and it stops when done
Scheduled work	EventBridge Scheduler starts a task every night for a batch job
Queue workers	A service pulls from SQS, and scales by the number of messages waiting

ECS Express Mode: the short way

Just want a web application from an image, without setting up every piece? ECS Express Mode takes an image and two roles, and creates the Fargate service, load balancer, health checks, scaling and a link. All of it stays in your account, so you can customize it later.

Amazon EKS: Kubernetes

Kubernetes is an open-source system for running containers, widely used across clouds and data centers. EKS (Elastic Kubernetes Service) runs its control plane for you, across several Availability Zones, at $0.10 per hour per cluster for versions under standard support, on top of the capacity. A version that's past that period costs $0.60 per hour.

Terms differ from ECS: a task is a Pod, and a server is a Node.

Node option	How it works
EKS Auto Mode	AWS provisions, updates and scales the nodes; it's what AWS recommends going forward
Managed node groups	AWS creates and updates the servers, and you choose them
Self-managed nodes	You handle everything, for special requirements
Fargate	Each Pod runs in isolation without nodes; still available, though Auto Mode is preferred

For storage, EKS uses CSI drivers to mount EBS, EFS or FSx.

ECS or EKS?

	ECS	EKS
Complexity	Fewer concepts, and quick to learn	A big system with a lot to learn
Portability	AWS only	The same tools work elsewhere
Ecosystem	Close integration with AWS	A huge open-source ecosystem
Cost of the service itself	Free	Per hour per cluster
Choose it if	You're starting out, and your work is on AWS	Your team knows Kubernetes, or you run across several clouds

If nothing is pushing you toward Kubernetes, start with ECS on Fargate.

Containers on your own servers

Need the same tools outside AWS, such as in your data center?

Option	What it does
ECS Anywhere	Registers your own servers or virtual machines in an ECS cluster
EKS Hybrid Nodes	Adds your own servers as nodes in an EKS cluster
EKS Anywhere	Runs Kubernetes clusters on your own infrastructure, for isolated environments
EKS Distro	The Kubernetes components behind EKS, for you to run and support yourself

Hands-on: a service replaces a stopped task

We'll run a public Nginx image on Fargate, with no build needed. From CloudShell, create the cluster and write the recipe. An image from a public registry with no logs doesn't need an execution role:

Bash

aws ecs create-cluster --cluster-name series-cluster \
  --query cluster.status

cat > task.json <<'EOF'
{
  "family": "web",
  "requiresCompatibilities": ["FARGATE"],
  "networkMode": "awsvpc",
  "cpu": "256",
  "memory": "512",
  "containerDefinitions": [{
    "name": "web",
    "image": "public.ecr.aws/nginx/nginx:latest",
    "portMappings": [{"containerPort": 80}],
    "essential": true
  }]
}
EOF

aws ecs register-task-definition --cli-input-json file://task.json \
  --query taskDefinition.family

Prepare the network: the default VPC, a subnet, and a security group that allows port 80 from your CloudShell only:

Bash

VPC=$(aws ec2 describe-vpcs --filters Name=isDefault,Values=true \
  --query "Vpcs[0].VpcId" --output text)
SUBNET=$(aws ec2 describe-subnets --filters Name=vpc-id,Values=$VPC \
  --query "Subnets[0].SubnetId" --output text)

SG=$(aws ec2 create-security-group --group-name series-web \
  --description "Series web task" --vpc-id $VPC \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id $SG \
  --protocol tcp --port 80 \
  --cidr $(curl -s https://checkip.amazonaws.com)/32

NET="awsvpcConfiguration={subnets=[$SUBNET],securityGroups=[$SG],assignPublicIp=ENABLED}"

Run a single task. If this is your first use of ECS and you get an error about the service-linked role, wait a little and repeat the command:

Bash

TASK=$(aws ecs run-task --cluster series-cluster --task-definition web \
  --launch-type FARGATE --network-configuration "$NET" \
  --query "tasks[0].taskArn" --output text)

aws ecs wait tasks-running --cluster series-cluster --tasks $TASK

Get its address and try it:

Bash

ENI=$(aws ecs describe-tasks --cluster series-cluster --tasks $TASK \
  --query "tasks[0].attachments[0].details[?name=='networkInterfaceId'].value" \
  --output text)
IP=$(aws ec2 describe-network-interfaces --network-interface-ids $ENI \
  --query "NetworkInterfaces[0].Association.PublicIp" --output text)

curl -s http://$IP | grep -i "<title>"

You'll see <title>Welcome to nginx!</title>. Your first container is running, with no server you can see. Now stop it, and it stays stopped, because nothing is looking after it:

Bash

aws ecs stop-task --cluster series-cluster --task $TASK \
  --query task.lastStatus

Create a service that keeps one task running:

Bash

aws ecs create-service --cluster series-cluster --service-name web \
  --task-definition web --desired-count 1 --launch-type FARGATE \
  --network-configuration "$NET" --query service.status

aws ecs wait services-stable --cluster series-cluster --services web

FIRST=$(aws ecs list-tasks --cluster series-cluster --service-name web \
  --query "taskArns[0]" --output text)
echo $FIRST

aws ecs stop-task --cluster series-cluster --task $FIRST \
  --query task.lastStatus

Wait a minute, then list the tasks:

Bash

aws ecs list-tasks --cluster series-cluster --service-name web \
  --query taskArns

The ID has changed. The service noticed the task was gone and started another without you lifting a finger.

Bash

aws ecs delete-service --cluster series-cluster --service web --force \
  --query service.status
aws ecs wait services-inactive --cluster series-cluster --services web
aws ecs delete-cluster --cluster series-cluster --query cluster.status
aws ecs deregister-task-definition --task-definition web:1 \
  --query taskDefinition.status
aws ec2 delete-security-group --group-id $SG

Summary

A container packages the application and its libraries, and shares the host's system, so it's light and fast.
ECR stores images, and ECS runs them through a task definition, tasks and a service.
Fargate spares you from managing servers, and it's the best starting point.
The execution role belongs to ECS, and the task role belongs to your code.
EKS is for those who need Kubernetes, and ECS Express Mode is the short way for a web application.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 6

A Fargate task starts normally and serves traffic, but when its code writes to DynamoDB it gets AccessDenied. Where should the team add the permission?

Show the answer

Correct answer: D

The task role belongs to your code inside the container. The task's normal start shows the execution role is already doing its job.

A: ECS uses this one to prepare the task, such as pulling the image and sending logs.
B: A security group controls network traffic, and this error is about permissions.
C: Fargate has no servers for you to attach anything to, so instance profiles aren't available.

Review: Two IAM roles, and confusing them is a classic in this part, and Amazon ECS task IAM role in the AWS docs.

Question 2 of 6

A company runs its applications on Kubernetes in its own data center and on another cloud. Its team knows the Kubernetes tools well and wants to keep using them on AWS. What fits?

Show the answer

Correct answer: B

EKS runs the Kubernetes control plane for you, and the team's tools keep working, here and elsewhere.

A: This is a fine start for most applications, but it's AWS's own system, not Kubernetes.
C: This builds an ECS web service from an image, and it isn't Kubernetes either.
D: This runs functions in response to events, and has no Kubernetes in it.

Review: ECS or EKS? in this part, and What is Amazon EKS? in the AWS docs.

Question 3 of 6

A batch job runs in a container every night for about two hours, and nothing needs to run for the rest of the day. What fits at the lowest cost?

Show the answer

Correct answer: C

The schedule starts a task that stops when it's done, and on Fargate you pay only while it runs.

A: You'd pay for a task 24 hours a day, for two hours of work.
B: A Lambda run ends at 15 minutes, far short of two hours.
D: You'd pay for the server around the clock, and have to manage it too.

Review: Not just web services in this part, and Using Amazon EventBridge Scheduler to schedule Amazon ECS tasks in the AWS docs.

Question 4 of 6

Several Fargate tasks in one service need to read and write the same uploaded files, and the files must survive when a task stops. What should the team mount?

Show the answer

Correct answer: A

EFS is a shared file system that tasks can mount on both Fargate and EC2, and the files live outside any one task.

B: A container's disk disappears with it, and isn't shared with other tasks.
C: This is a temporary disk on a server, and Fargate gives you no server to attach it to.
D: This stores container images, not application files.

Review: Storage in this part, and Use Amazon EFS volumes with Amazon ECS in the AWS docs.

Question 5 of 6

An ECS service runs on EC2 servers in an Auto Scaling group. At peak times the service needs more tasks, and those new tasks need servers to land on. Which two features handle this? (Choose two.)

Show the answer

Correct answer: A + E

Service Auto Scaling changes the number of tasks, and a capacity provider adds servers when tasks need them. On EC2 you need both layers.

B: This lets ECS pull images and send logs, and has nothing to do with scaling.
C: This looks for vulnerabilities in images.
D: This spreads traffic across the tasks that exist, and doesn't add any.

Review: Scaling in this part, and Automatically scale your Amazon ECS service and Amazon ECS capacity providers for EC2 workloads in the AWS docs.

Question 6 of 6

A company runs its containers on ECS in AWS. Some must now run on servers in its own factory, and the team wants to keep using the same ECS tools. What fits?

Show the answer

Correct answer: B

ECS Anywhere registers your own servers or virtual machines in an ECS cluster, so the team keeps its tools.

A: These are Kubernetes components to run and support yourself, and the team uses ECS.
C: This runs tasks on AWS capacity at a lower price, not on your servers.
D: This runs in AWS, and no longer accepts new customers.

Review: Containers on your own servers in this part, and Amazon ECS clusters for external instances in the AWS docs.

Containers still run and cost money while waiting. What if your code only ran when there was something to do, and you paid nothing otherwise? In part twenty-one we build an API with Lambda, API Gateway and DynamoDB.

Connecting Services: SQS, SNS and Kinesis

2026-11-02T00:00:00Z

So far the pieces of our application call each other directly. That's fine until a sale starts and the invoice service can't keep up, and suddenly the customer is staring at a spinner because of a service they've never heard of.

This section is about modern applications, and it starts with the idea behind most of them: separate the services, so that each one works at its own pace and a failure in one doesn't bring down the others.

Here's a map of this part:

You want	Use
A job taken by one worker, with nothing lost	SQS
One event reaching many parties at once	SNS
A continuous stream that several parties read and replay	Kinesis Data Streams
A stream loaded into S3 or similar without writing code	Data Firehose
An existing application built on RabbitMQ or ActiveMQ	Amazon MQ

Why separate services?

When services call each other directly, one slow service holds up the customer. A queue lets each side work at its own pace.

A direct call means both sides must be up, and fast, at the same moment. With a queue in between you get three things:

Failures stay contained. If the invoice service stops, messages wait in the queue until it comes back.
Peaks are absorbed. A thousand orders in a minute don't reach the database all at once.
Each side scales alone. You add invoice workers without touching the store.

SQS: the queue

SQS (Simple Queue Service) is a fully managed queue with no servers to run. A producer sends messages, they wait in the queue, and a consumer pulls them, works on them, then deletes them.

Note the direction: consumers ask the queue for messages. The queue doesn't push them to anyone.

Feature	Value
Throughput	No practical limit on a standard queue
Message size	Up to 1 MiB
Retention	4 days by default, from one minute to 14 days
Delivery	At least once, so a message can arrive twice
Order	Best effort, not guaranteed

The last two points affect your code. Since a message can arrive twice, make processing it twice harmless. An order number you check before charging is enough.

For anything larger than a message, store the file in S3 and send its path in the message.

Visibility timeout

What stops two consumers taking the same message? When one receives it, SQS hides it from the others for a period, called the visibility timeout. The consumer must delete it before that period ends.

A received message is hidden, not removed. If the consumer doesn't delete it before the timeout ends, it appears again for another consumer.

This is the mechanism that keeps you from losing work: if the server crashes halfway through, the message comes back by itself.

Choose the period to suit your processing time. It's 30 seconds by default, and it can go up to 12 hours:

Too short: the message appears again while it's still being worked on, and it gets processed twice.
Too long: if a consumer fails, the message waits a long time before anyone retries it.

If a job takes longer than usual, the consumer can extend the period for that message with ChangeMessageVisibility.

Long polling

By default, asking an empty queue returns an empty response right away, so your consumers fill your bill with pointless requests. With long polling, the request waits up to 20 seconds for a message. That means fewer requests, a lower cost and faster delivery, so always turn it on.

Dead-letter queues

What about a message that always fails, because of a bug or bad data? It will come back forever. Attach a dead-letter queue (DLQ): after a number of failed attempts you choose, the message moves there, so you can inspect it without it blocking anything. Then you can redrive it to the original queue once you've fixed the problem.

Keep the retention in the dead-letter queue longer than the original, so messages don't expire before you see them.

FIFO queues

When order matters, as with transactions on one account, use a FIFO queue. Its name must end in .fifo.

	Standard	FIFO
Order	Not guaranteed	Guaranteed within a message group
Duplicates	Possible	Removed within a 5-minute window
Throughput	No practical limit	300 messages per second, or 3,000 with batching

The order is per message group, so with one group for each customer, different customers' messages can be processed in parallel. If you need more throughput, high throughput mode raises the limit by far, and the figure varies by Region.

Scaling with the queue

A classic pattern: an Auto Scaling group of workers grows and shrinks according to the queue's length. The ApproximateNumberOfMessagesVisible metric tells you how many messages are waiting, so a growing queue adds workers.

It also protects your database. Instead of a spike of orders hitting RDS directly, they go into a queue, and workers write them at a pace the database can handle. This only suits work that doesn't need an immediate answer, so the customer is told "we received your order", not "your order is complete".

Security

Messages are encrypted in transit over HTTPS, and at rest with SSE-SQS by default, or with your own KMS key. Who can reach the queue is decided by IAM policies, plus an access policy on the queue itself, which you need for other accounts or for services like SNS and S3 to send to it. We'll write one in the hands-on.

A queue suits a job that one party does. But when a customer places an order, the shipping, invoicing and analytics services all want to know. You don't want your application to know about each of them, and to change every time you add one.

SNS (Simple Notification Service) works by publishing and subscribing: your application publishes one message to a topic, and SNS delivers it to every subscriber, right away. A standard topic can have up to 12.5 million subscriptions.

Subscriber type	Example
SQS	A service that processes at its own pace
Lambda	A small function that runs per message
HTTP or HTTPS	A webhook in another system
Data Firehose	Storing every message in S3
Email, SMS, mobile push	Notifying people directly

Unlike a queue, SNS doesn't store messages. If a subscriber is down it retries for a while, but it's not somewhere messages wait.

Message size is 256 KiB by default, and you can raise it on a topic up to 1 MiB, though this limits the topic to 100 subscriptions and to SQS, Lambda and Firehose subscribers only.

The most important pattern here combines the two services: SNS spreads the message, and a queue for each service keeps it until that service is ready.

The app publishes once, SNS copies the message to every queue, and each service reads from its own queue. The filter sends only physical orders to shipping.

Why this combination?

Nothing is lost: if the shipping service stops, its messages wait in its queue.
Each service has its own pace, retries and dead-letter queue.
Adding a service is easy: a new queue subscribes to the topic, with no change to the publisher.

The same goes for S3 events: S3 doesn't accept two rules with overlapping prefixes for the same event type. So to reach several destinations, send the event to one SNS topic and fan it out from there.

Filtering messages

By default every subscriber receives everything. A filter policy on the subscription lets the shipping queue receive only what concerns it:

JSON

{ "type": ["physical"] }

Messages with type set to digital won't reach it, and you don't pay to process them.

FIFO topics

For order across a fan-out, SNS has FIFO topics, whose names also end in .fifo, with order and duplicate removal like FIFO queues. These are limited to 100 subscriptions per topic, and they suit cases like sending the same sequence of updates to several queues.

Kinesis Data Streams: a stream that stays

Imagine a million sensors sending readings every second, and three parties who want to read them: one for instant alerts, one for dashboards, and one for archiving. A queue doesn't suit this, because a message is gone once it's processed.

Kinesis Data Streams is a stream: records stay in it for the retention period, whether they've been read or not, and each consumer reads from its own position, so it can go back and replay them.

Producers write to shards, records with the same key stay in order inside one shard, and several consumers read the same data, each at its own position.

Shards: the stream is split into shards. With provisioned capacity, each one takes 1 MB per second of writes and 2 MB per second of reads.
Partition key: decides which shard a record goes to. Records with the same key stay in order, so a sensor's number works well as a key.
Retention: 24 hours by default, up to 365 days.
Record size: 1 MiB by default, and you can raise it up to 10 MiB per stream.

Capacity modes

Mode	How it works	When
On-demand	Starts at 4 MB per second of writes and scales by itself, and you pay for the data	Unknown or changing load; start here
Provisioned	You set the number of shards and pay for each per hour	Steady, known load, which can be cheaper

The ceiling for on-demand depends on the Region: up to 10 GB per second of writes in the largest Regions, and 200 MB per second in others.

Video has its own service: Kinesis Video Streams takes live video from devices such as cameras, stores it, and lets you watch it or process it, live or later.

Data Firehose: to storage with no code

Very often all you want is for the stream to land somewhere. Amazon Data Firehose (formerly Kinesis Data Firehose) takes data, collects it, and delivers it with no code or servers:

Sources: your application directly, a Kinesis stream, or others like SNS and CloudWatch Logs.
Processing: optionally transforms records with a Lambda function, and can convert them to Parquet.
Destinations: S3, Redshift, OpenSearch, Snowflake, Apache Iceberg tables, or an HTTP endpoint.
Buffering: it collects data until it reaches a size or a period, such as 5 MiB or 5 minutes for S3, and whichever comes first triggers delivery. So it suits near-real-time loading, not an instant reaction.

	Kinesis Data Streams	Data Firehose
Purpose	A stream your consumers read	A pipe that delivers to storage
Consumers	You write them	The destination is managed for you
Replay	Yes, within the retention period	No
Timing	Immediate	Depends on the buffering you set

Which one do I choose?

	SQS	SNS	Kinesis Data Streams
Model	Consumers pull	Pushes to subscribers	Consumers pull
Readers of a message	One, then it's deleted	Every subscriber	Everyone, within the retention period
Stored?	Up to 14 days	No	Up to 365 days
Order	With FIFO	With FIFO	Within a shard
Typical use	Background jobs	Notifications and fan-out	Analytics, logs and streaming data

A quick rule: a job? SQS. An event many want to know about? SNS. A stream of data many read and replay? Kinesis.

There's also EventBridge, which routes events by rules from AWS services and other applications, and we'll cover it in part twenty-five.

Amazon MQ: for what already exists

SQS and SNS are AWS's own services with their own APIs. If you're moving an application built on open protocols such as AMQP, MQTT or STOMP, you won't want to rewrite it. Amazon MQ runs a familiar broker as a managed service, in two engines:

Engine	High availability
ActiveMQ	Two brokers in two Availability Zones, active and standby, with shared storage on EFS
RabbitMQ	A cluster of three nodes across Availability Zones, behind one endpoint

Note that it runs on brokers you choose the size of, so it doesn't scale without limit like SQS and SNS. For a new application, start with those two.

Hands-on: a fan-out with a filter

We'll build the design from the diagram with two queues. From CloudShell, create the topic and the queues:

Bash

TOPIC_ARN=$(aws sns create-topic --name orders \
  --query TopicArn --output text)

SHIP_URL=$(aws sqs create-queue --queue-name shipping \
  --query QueueUrl --output text)
BILL_URL=$(aws sqs create-queue --queue-name billing \
  --query QueueUrl --output text)

SHIP_ARN=$(aws sqs get-queue-attributes --queue-url $SHIP_URL \
  --attribute-names QueueArn --query Attributes.QueueArn --output text)
BILL_ARN=$(aws sqs get-queue-attributes --queue-url $BILL_URL \
  --attribute-names QueueArn --query Attributes.QueueArn --output text)

Queues are private, so allow only this topic to send to them:

Bash

allow_topic() {
  POLICY=$(jq -nc --arg q "$2" --arg t "$TOPIC_ARN" '{
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Principal: {Service: "sns.amazonaws.com"},
      Action: "sqs:SendMessage",
      Resource: $q,
      Condition: {ArnEquals: {"aws:SourceArn": $t}}
    }]
  }')
  aws sqs set-queue-attributes --queue-url "$1" \
    --attributes "$(jq -nc --arg p "$POLICY" '{Policy: $p}')"
}

allow_topic $SHIP_URL $SHIP_ARN
allow_topic $BILL_URL $BILL_ARN

Subscribe the queues to the topic: billing gets everything, and shipping gets physical orders only:

Bash

aws sns subscribe --topic-arn $TOPIC_ARN \
  --protocol sqs --notification-endpoint $BILL_ARN \
  --attributes RawMessageDelivery=true

aws sns subscribe --topic-arn $TOPIC_ARN \
  --protocol sqs --notification-endpoint $SHIP_ARN \
  --attributes '{"RawMessageDelivery":"true","FilterPolicy":"{\"type\":[\"physical\"]}"}'

Publish two orders, one physical and one digital:

Bash

aws sns publish --topic-arn $TOPIC_ARN --message "order 1: a book" \
  --message-attributes '{"type":{"DataType":"String","StringValue":"physical"}}'

aws sns publish --topic-arn $TOPIC_ARN --message "order 2: an e-book" \
  --message-attributes '{"type":{"DataType":"String","StringValue":"digital"}}'

Give it a few seconds, then count the messages in each queue:

Bash

for url in $BILL_URL $SHIP_URL; do
  aws sqs get-queue-attributes --queue-url $url \
    --attribute-names ApproximateNumberOfMessages \
    --query Attributes.ApproximateNumberOfMessages --output text
done

You'll see 2 for billing and 1 for shipping, so the filter worked. Now try the visibility timeout. Receive the shipping message, then try again straight away:

Bash

aws sqs receive-message --queue-url $SHIP_URL --wait-time-seconds 5 \
  --query "Messages[0].Body" --output text

aws sqs receive-message --queue-url $SHIP_URL --wait-time-seconds 5 \
  --query "Messages[0].Body" --output text

The first prints order 1: a book, and the second waits five seconds and prints None, because the message is hidden. We didn't delete it, so wait 30 seconds and receive it again, this time deleting it to finish the job:

Bash

HANDLE=$(aws sqs receive-message --queue-url $SHIP_URL --wait-time-seconds 20 \
  --query "Messages[0].ReceiptHandle" --output text)

aws sqs delete-message --queue-url $SHIP_URL --receipt-handle "$HANDLE"

Now the message is gone for good.

Bash

aws sns delete-topic --topic-arn $TOPIC_ARN
aws sqs delete-queue --queue-url $SHIP_URL
aws sqs delete-queue --queue-url $BILL_URL

Summary

Separating services contains failures, absorbs peaks and lets each side scale alone.
SQS is a queue: a message goes to one consumer, who must delete it before the visibility timeout ends.
Always add long polling and a dead-letter queue, and make processing safe to repeat.
SNS delivers one message to many, and fan-out with SQS guarantees none of them miss it.
Kinesis Data Streams keeps data for several readers to replay, and Firehose delivers it to storage without code.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 6

A ticket site's order page writes straight to RDS. When a big concert goes on sale, the database overloads and orders fail. Customers can accept seeing "we received your order", with the confirmation following a minute later. What absorbs the peak?

Show the answer

Correct answer: B

The queue holds the orders, and workers write them at a pace the database can handle. It suits this case because the customer doesn't need the final answer immediately.

A: Replicas serve reads, and the overload here comes from writes.
C: SNS delivers right away and doesn't store messages, so the peak would still arrive all at once.
D: The standby takes no load, so the overload stays.

Review: Scaling with the queue in this part, and What is Amazon Simple Queue Service? in the AWS docs.

Question 2 of 6

A worker takes about two minutes to produce each invoice, and the queue's visibility timeout is still at its default. Customers are receiving the same invoice several times. What should the team change?

Show the answer

Correct answer: A

After 30 seconds the message reappears while the first worker is still on it, so another worker takes it too. The timeout has to be longer than the work.

B: This cuts empty responses, and doesn't change when a message reappears.
C: This catches messages that keep failing, and these ones are succeeding, repeatedly.
D: More workers would only pick up the reappearing messages faster.

Review: Visibility timeout in this part, and Amazon SQS visibility timeout in the AWS docs.

Question 3 of 6

When an order is placed, the shipping, billing and analytics services all need to know. Any of them may be down for hours, and adding a new service shouldn't mean changing the publisher. What fits?

Show the answer

Correct answer: D

SNS delivers one message to every subscriber, and each service's queue holds it until that service is ready. A new service simply subscribes a new queue.

A: Each message goes to only one consumer, so the other services would miss it.
B: The publisher would need changing with every new service.
C: SNS only retries for a while and doesn't store messages, so a long outage could lose them.

Review: Fan-out: SNS with SQS in this part, and What is Amazon SNS? in the AWS docs.

Question 4 of 6

A wind farm's sensors send readings every second. Three separate applications read the same data in real time, and after fixing a bug, one of them must re-read the last three days. Which option fits?

Show the answer

Correct answer: C

Records stay in the stream for the retention period whether they've been read or not, and each consumer reads from its own position, so one can go back without disturbing the others. The default retention is only 24 hours.

A: A message goes to one consumer, and it's gone once deleted.
B: SNS doesn't store messages, so there's nothing to re-read.
D: This buffers data and delivers it to storage, so it offers neither instant reads nor replay.

Review: Kinesis Data Streams: a stream that stays in this part, and Change the data retention period in the AWS docs.

Question 5 of 6

A bank processes transactions through a queue. Within each account they must run in order with duplicates removed, while different accounts should be processed in parallel. Which two choices fit? (Choose two.)

Show the answer

Correct answer: B + D

A FIFO queue keeps order within a message group and removes duplicates within a 5-minute window, and a group for each account lets different accounts run in parallel.

A: This doesn't guarantee order, and a message can arrive twice.
C: This forces every transaction into one line, so nothing runs in parallel.
E: This gives workers more time, and has no effect on order.

Review: FIFO queues in this part, and FIFO queue delivery logic in Amazon SQS in the AWS docs.

Question 6 of 6

A factory wants to send live video from its security cameras to AWS, store it, and analyze it later. Which service was built for this?

Show the answer

Correct answer: D

It takes live video from devices, stores it, and lets you watch or process it, live or later.

A: This delivers records to storage, and isn't built for live video from devices.
B: A message holds up to 1 MiB, which doesn't suit video.
C: This pushes short messages to subscribers, and stores nothing.

Review: Kinesis Data Streams: a stream that stays in this part, and What is Amazon Kinesis Video Streams? in the AWS docs.

The services are now separated, but where does the code itself run? So far our answer has been an EC2 server, with all the setup that entails. In part twenty we package applications in containers and run them with ECS, Fargate and EKS.

More Storage and Transfer Services

2026-11-02T00:00:00Z

In the previous parts we covered S3 in detail. But there are cases it doesn't solve: a Windows application needing a shared folder, servers in your office wanting to reach the cloud, a partner sending files over SFTP, or huge data that has to move.

Here's this part's map:

You want	Use
A Windows file system or very high performance	Amazon FSx
Your office servers reaching cloud storage	Storage Gateway
Moving and syncing large data on a schedule	DataSync
Partners uploading files over SFTP	Transfer Family
Physically moving massive amounts	Data Transfer Terminal

Amazon FSx: ready-made file systems

We've seen EFS for a shared Linux file system. FSx runs well-known file systems for you as a managed service, so you don't have to manage them yourself:

Type	Protocol	Good for
FSx for Windows	SMB	Windows applications and shared folders, tied into Active Directory
FSx for Lustre	Lustre	High-performance computing and model training, integrates with S3, Linux devices only
FSx for NetApp ONTAP	NFS, SMB and iSCSI	Moving NetApp systems, and different operating systems on the same data
FSx for OpenZFS	NFS	Linux workloads, moving ZFS systems, instant snapshots and clones

FSx for Lustre has two options: Scratch is cheap and fast for temporary data, but the data has no copies, so a failed disk loses it. Persistent is for long-term data, with copies inside the Availability Zone.

Storage Gateway: your office and the cloud

Have servers in your office and want to benefit from the cloud without changing your applications? Storage Gateway is software you run on-site as a virtual machine. It presents ordinary storage to your applications, while the data actually lives in AWS, with a local cache for recent files.

Applications in your office see ordinary storage through the gateway, which keeps the data in S3, EBS snapshots or Glacier.

Type	Your apps see it as	Where the data is	Example
S3 File Gateway	An NFS or SMB folder	Objects in S3	Shared folders and file backups
Volume Gateway	An iSCSI disk	S3 with EBS snapshots	Disks for existing servers, cached or with a full local copy
Tape Gateway	A virtual tape library	S3, then Glacier	Backup software that relies on tape

There's a fourth type called FSx File Gateway that's no longer available to new customers, and AWS advises connecting to FSx directly.

Moving data

DataSync

DataSync moves and syncs large data on a schedule:

From where to where: from NFS, SMB or HDFS servers or object storage, to S3, EFS or FSx, and between AWS services themselves.
Agent: you run an agent on-site to move from your office, and don't need one between AWS services.
It moves only what changed on each run, preserves permissions and dates, and verifies data integrity.

Transfer Family

Have partners or older systems sending files over SFTP, FTPS, FTP or AS2, and don't want to run a server for them? Transfer Family gives you a managed receiving endpoint, and the files go to S3 or EFS. Users come from within the service, Active Directory or your own identity system.

Note that FTP is unencrypted, so it's available only inside a VPC. You pay by the hour for each endpoint, even without use.

When your data outgrows the internet

Before choosing how to move data, do the math. These are theoretical times at the line's full speed, and reality is slower:

Size	100 Mbps	1 Gbps	10 Gbps
1 TB	22 hours	2 hours	13 minutes
10 TB	9 days	22 hours	2 hours
100 TB	93 days	9 days	22 hours
1 PB	2.5 years	93 days	9 days

You have these options for large amounts:

DataSync if your line can take it, with ongoing sync.
Direct Connect if the transfer is large and continuous, as explained in part fourteen.
Data Transfer Terminal: physical sites you visit with your own storage devices, connecting them to AWS's network at high speed.

Comparing storage services

Service	Type	Good for
S3	Object	Files, photos, backups and static sites
S3 Glacier	Object archive	Data that's rarely requested
EBS	Network disk	A disk for one server, and databases
Instance Store	Temporary local disk	Top speed for temporary data
EFS	Linux files	A folder shared between several servers
FSx for Windows	SMB files	Shared folders for Windows applications
FSx for Lustre	High-performance files	High-performance computing and model training
FSx for ONTAP	Multi-protocol files	Moving NetApp systems
FSx for OpenZFS	NFS files	Linux workloads and moving ZFS systems
Storage Gateway	Bridge	Your office reaching cloud storage
DataSync	Transfer	Scheduled sync
Transfer Family	Transfer	Receiving files over SFTP and friends

Hands-on: syncing with DataSync

We'll move files between two buckets, which needs no agent. From CloudShell, prepare two buckets and some files:

Bash

SRC=series-src-$RANDOM$RANDOM
DST=series-dst-$RANDOM$RANDOM

aws s3 mb s3://$SRC
aws s3 mb s3://$DST

for i in 1 2 3; do
  echo "file $i" > file$i.txt
  aws s3 cp file$i.txt s3://$SRC/
done

echo "source: $SRC  destination: $DST"

Open DataSync in the console and choose Create task:

Source: create a new location of type S3, select the series-src-... bucket, and choose to create an IAM role automatically.
Destination: the same with the series-dst-... bucket.
Settings: name the task series-sync, choose Enhanced if a mode option appears, and leave the rest as it is.
Run: create the task, then choose Start.

When it finishes, check the destination:

Bash

aws s3 ls s3://$DST/

Now add one file and run the task again:

Bash

echo "file 4" > file4.txt
aws s3 cp file4.txt s3://$SRC/

On the new run's page you'll find one file transferred, because DataSync moves only what changed. That's what sets it apart from a full copy every time.

Bash

aws s3 rb s3://$SRC --force
aws s3 rb s3://$DST --force

Summary

FSx offers ready-made file systems: Windows, Lustre, ONTAP and OpenZFS.
Storage Gateway lets your office see the cloud as ordinary storage.
DataSync is for scheduled sync, and Transfer Family for receiving over SFTP.
Work out the transfer time before deciding, and note that Snowball is closed to new customers.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 5

A company is moving a Windows application that keeps its files on a shared SMB folder, with users signing in through Active Directory. It wants a managed service with no file servers to run. What fits?

Show the answer

Correct answer: A

This gives Windows applications a real SMB file share tied into Active Directory, and AWS runs it for you.

B: EFS is a shared file system for Linux, over NFS.
C: This is for high-performance computing, and works with Linux devices only.
D: S3 is reached through an API, and isn't a folder an application can open over SMB.

Review: Amazon FSx: ready-made file systems in this part, and What is FSx for Windows File Server? in the AWS docs.

Question 2 of 5

A research team runs a three-day simulation on a Linux cluster. It reads its input from S3, needs very high throughput, and saves its results back to S3, so a failed file system would only mean a re-run. Which option costs the least?

Show the answer

Correct answer: C

Lustre is built for this speed and integrates with S3, and Scratch is the cheap option for temporary data, since nothing here depends on the data surviving a failure.

A: This is for SMB file shares, not high-performance Linux clusters.
B: This suits long-term data, and you'd pay for copies the team doesn't need.
D: This is a general shared folder, and isn't built for this level of performance.

Review: Amazon FSx: ready-made file systems in this part, and Deployment and storage class options for FSx for Lustre file systems in the AWS docs.

Question 3 of 5

A hospital's backup software writes to physical tapes, and staff are tired of storing and shipping them. It wants the backups in AWS, without changing the backup software. What fits?

Show the answer

Correct answer: B

This presents a virtual tape library to the backup software, and the data goes to S3 and then Glacier.

A: This shows applications an NFS or SMB folder, while this software writes to tape.
C: This shows servers an iSCSI disk, not a tape library.
D: This receives files over protocols such as SFTP, which tape-based software doesn't use.

Review: Storage Gateway: your office and the cloud in this part, and What is Tape Gateway? in the AWS docs.

Question 4 of 5

A new AWS customer has 100 TB on its own storage devices, which must be in S3 within two weeks. Its only line runs at 100 Mbps. What fits?

Show the answer

Correct answer: D

The team takes its own storage devices to a physical AWS site with a high-speed connection and uploads from there, so the slow line no longer matters.

A: At full speed, 100 TB over this line takes about 93 days.
B: This is closed to new customers.
C: Setting it up takes weeks and sometimes months, so it could miss the deadline.

Review: When your data outgrows the internet in this part, and What is Data Transfer Terminal? in the AWS docs.

Question 5 of 5

A company is leaving its data center. Its 30 TB NFS server must be copied to AWS and kept in sync until the cutover, and its partners send daily files over SFTP and can't change how they do it. Which two services fit? (Choose two.)

Show the answer

Correct answer: B + E

DataSync copies the NFS data, and on each later run moves only what changed. Transfer Family gives partners a managed SFTP endpoint, with their files going to S3 or EFS.

A: This is for backup software that writes to tape.
C: This is a high-performance file system, and doesn't move data out of a data center.
D: This shows on-site servers an iSCSI disk, and the company is leaving its site.

Review: DataSync and Transfer Family in this part, and How AWS DataSync works and What is AWS Transfer Family? in the AWS docs.

That completes the storage section. You now have a strong application with a database, a network and storage, but its pieces are all wired directly together. In part nineteen we start the modern applications section, separating them with SQS, SNS and Kinesis.

S3: Security and Encryption

2026-11-02T00:00:00Z

In part fifteen we learned that everything is private by default, and that Block Public Access protects you from opening things by mistake. This part covers the remaining layers: encryption, sharing files safely, and protecting data even from the account's own administrators.

Encryption at rest

You have two questions: where does encryption happen? and who holds the key?

With SSE, S3 encrypts the file after it arrives; with client-side encryption, S3 never sees the file unencrypted.

Type	Who holds the key	When to choose it
SSE-S3	S3 entirely	The default for every new object, and enough for most cases
SSE-KMS	KMS, with you controlling its permissions	You want a record of every use of the key, and finer control
DSSE-KMS	KMS, with two layers of encryption	Regulations requiring two layers
SSE-C	You, sending it with every request	Blocked by default on new buckets since April 2026
Client-side	You entirely	You never want AWS to see the data

Watch out with SSE-KMS

Every read or write calls KMS, and KMS has a limit on requests per second depending on the Region. If you have heavy load, turn on S3 Bucket Keys: an intermediate key at the bucket level that greatly reduces KMS requests, and with them the cost.

Anyone reading the object also needs permission on S3 and on the KMS key together. This is a well-known cause of AccessDenied errors even when the S3 policy is right.

Encryption in transit

S3 accepts both HTTP and HTTPS. To enforce HTTPS, deny any unencrypted request using the aws:SecureTransport condition:

JSON

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": [
      "arn:aws:s3:::my-bucket",
      "arn:aws:s3:::my-bucket/*"
    ],
    "Condition": { "Bool": { "aws:SecureTransport": "false" } }
  }]
}

In the same way you can enforce a particular type of encryption on every upload. The policy is evaluated before default encryption, so a denied request never reaches it.

Want a customer to download their invoice without opening the bucket or giving them an account? A pre-signed URL is a link carrying a signature and an expiry:

It carries the signer's permissions, so if they can't read the file, the link won't work.
It works for downloads and uploads, such as sending a photo from the browser directly to S3 without going through your server.
Its lifetime is limited, and if signed with a temporary role it ends when the session does.

CORS: when the browser stops you

CORS is a protection in the browser, not in S3. An origin is the protocol, domain and port. So if a page at https://app.example.com requests a file from https://my-bucket.s3.amazonaws.com, the browser treats them as two different origins, and asks the bucket: do you allow this?

If you get a CORS error in the browser, add the settings to the bucket:

JSON

[{
  "AllowedOrigins": ["https://app.example.com"],
  "AllowedMethods": ["GET", "PUT"],
  "AllowedHeaders": ["*"],
  "MaxAgeSeconds": 3000
}]

Protection from deletion

Even correct permissions don't protect you from a mistake, a compromised account or ransomware. You have three layers:

Tool	What it does	Notes
MFA Delete	Requires an MFA code to permanently delete a version or suspend versioning	Only the root user can enable it, through commands
Object Lock	Blocks deleting or changing a version for a period	Versioning must be on
Glacier Vault Lock	Locks the policy of an older Glacier vault for good	For older vaults; Object Lock is better for anything new

Object Lock modes

Mode	Who can delete before the period ends
Governance	Only users with a special permission
Compliance	Nobody, not even the root user

There's also Legal Hold: a lock with no set period that stays until you remove it, useful for legal cases.

Logs and monitoring

Access logs: record every request in a different bucket. Don't use the same bucket, because every log entry generates another, growing endlessly and growing your bill.
CloudTrail: records management operations, plus data operations if you turn them on. We cover it in part twenty-five.

Access Points: a door for each team

If many teams use one big bucket, the bucket policy becomes long and risky. Access Points give each team a door with its own name and policy:

A finance access point allows the finance team on finance/* only.
A sales access point allows the sales team on sales/* only.
You can also make an access point accept traffic only from inside one VPC.

Hands-on: encryption, a signed link and enforcing HTTPS

We'll carry on with the same bucket in BUCKET. Upload a file and check its default encryption, then upload one with KMS:

Bash

echo "secret invoice" > invoice.txt
aws s3 cp invoice.txt s3://$BUCKET/invoice.txt

aws s3api head-object --bucket $BUCKET --key invoice.txt \
  --query ServerSideEncryption

aws s3 cp invoice.txt s3://$BUCKET/invoice-kms.txt --sse aws:kms

aws s3api head-object --bucket $BUCKET --key invoice-kms.txt \
  --query "[ServerSideEncryption,SSEKMSKeyId]"

The first shows AES256, meaning SSE-S3, and the second aws:kms with the key's ID.

Now create a signed link valid for 60 seconds, and try it:

Bash

URL=$(aws s3 presign s3://$BUCKET/invoice.txt --expires-in 60)

curl -s "$URL"

It prints the file's contents, even though the bucket is private. Wait a minute and repeat the same curl command, and it returns AccessDenied with a message that the request has expired.

Now enforce HTTPS on the bucket:

Bash

aws s3api put-bucket-policy --bucket $BUCKET --policy '{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyHttp",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": ["arn:aws:s3:::'$BUCKET'", "arn:aws:s3:::'$BUCKET'/*"],
    "Condition": {"Bool": {"aws:SecureTransport": "false"}}
  }]
}'

URL=$(aws s3 presign s3://$BUCKET/invoice.txt --expires-in 300)

curl -s -o /dev/null -w "https: %{http_code}\n" "$URL"
curl -s -o /dev/null -w "http: %{http_code}\n" "${URL/https:/http:}"

The same link returns 200 over HTTPS and 403 over HTTP.

Summary

Every new object is encrypted with SSE-S3 automatically; choose SSE-KMS for control and a record, along with Bucket Keys.
Enforce HTTPS with the aws:SecureTransport condition.
Signed links share a private file temporarily without opening the bucket.
CORS comes from the browser, and you solve it in the bucket's settings.
Object Lock protects you from deletion, even from root in Compliance mode.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 5

A role has s3:GetObject on a bucket. It can read objects encrypted with SSE-S3, but gets AccessDenied on those encrypted with SSE-KMS and a customer managed key. What's missing?

Show the answer

Correct answer: B

Reading an SSE-KMS object needs permission on S3 and on the KMS key together, which is why this error appears even when the S3 policy is right.

A: These lower the number of KMS requests and the cost, and don't grant any permission.
C: CORS is a browser rule, and has nothing to do with a role's permissions.
D: This enforces HTTPS, and it denies rather than grants.

Review: Watch out with SSE-KMS in this part, and Using server-side encryption with AWS KMS keys in the AWS docs.

Question 2 of 5

An online store wants each customer to download their invoice from a private bucket, using a link that stops working after 15 minutes. Customers have no AWS accounts. What fits?

Show the answer

Correct answer: D

A pre-signed URL carries a signature and an expiry and works with the signer's permissions, so the bucket stays private.

A: Anyone could read any invoice this way, at any time.
B: Creating and managing users for customers is heavy, and there's no need for it.
C: This is a browser permission between sites, and doesn't open private files to anyone.

Review: Sharing a private file: signed links in this part, and Download and upload objects with presigned URLs in the AWS docs.

Question 3 of 5

A page at https://app.example.com loads JSON from a bucket using JavaScript. The browser console shows a CORS error, yet the same request from curl succeeds. What should the team do?

Show the answer

Correct answer: A

CORS is a browser protection. The browser asks the bucket whether this origin is allowed, while curl doesn't ask, which is why only the browser complained.

B: The request already succeeds from curl, so access isn't the problem.
C: Encryption has nothing to do with the origins a browser accepts.
D: This keeps old versions, and changes nothing the browser checks.

Review: CORS: when the browser stops you in this part, and Using cross-origin resource sharing (CORS) in the AWS docs.

Question 4 of 5

A bank must keep records for seven years in a way that nobody can delete them during that time, not even the root user. What fits?

Show the answer

Correct answer: C

In Compliance mode, no user can delete or overwrite a locked version until its period ends, including the root user, and the period can't be shortened.

A: This only asks for an MFA code, so the root user holding that device can still delete.
B: Users with a special permission can still delete in this mode.
D: Someone with enough permissions can simply change the policy.

Review: Object Lock modes in this part, and Locking objects with Object Lock in the AWS docs.

Question 5 of 5

An audit sets two requirements for a bucket: requests must only be accepted over HTTPS, and there must be a record of every use of the encryption key. Which two changes meet these? (Choose two.)

Show the answer

Correct answer: C + E

The policy rejects any unencrypted request, and with SSE-KMS you can audit the use of the key in CloudTrail.

A: This stops public access, and doesn't look at HTTP or HTTPS.
B: S3 holds the key entirely here, so you get no record of each use.
D: This protects against deletion, and meets neither requirement.

Review: Encryption at rest and Encryption in transit in this part, and Security best practices for Amazon S3 and Using server-side encryption with AWS KMS keys in the AWS docs.

S3 isn't the only option. What if you have a Windows system, an office wanting to reach cloud storage, or millions of files to move? In part eighteen we cover the remaining storage and transfer services.

S3: Storage Classes and Lifecycle

2026-11-02T00:00:00Z

In part fifteen we stored everything the default way. But think about your application: a product photo is requested every second, while a five-year-old invoice is opened only during an audit. Why pay the same for both?

Storage classes give you that choice: the less a file is accessed, the less it costs to store, and the more it costs or the longer it takes to retrieve.

Durability and availability

Two terms you need to tell apart:

Durability: will the file be lost? 99.999999999% for all classes, noting that classes in a single Availability Zone lose their data if that zone is destroyed.
Availability: can you reach it right now? This varies by class, such as 99.99% for Standard.

The classes

Class	Suits	Retrieval	Minimum period	Approx. price
Standard	Frequently requested data	Instant	None	0.023
Intelligent-Tiering	Unknown access patterns	Instant in the automatic tiers	None	By tier
Standard-IA	About once a month	Instant, with a retrieval fee	30 days	0.0125
One Zone-IA	Data you can recreate	Instant, with a fee	30 days	0.01
Glacier Instant Retrieval	Once every three months	Instant, with a higher fee	90 days	0.004
Glacier Flexible Retrieval	Once or twice a year	Minutes to hours	90 days	0.0036
Glacier Deep Archive	Less than once a year	12 to 48 hours	180 days	0.00099

Prices are in dollars per gigabyte per month, approximate for US Regions, so check the pricing page for yours.

All these classes keep data in three or more Availability Zones, except One Zone-IA. There's also S3 Express One Zone: very high performance with single-digit millisecond latency, in one Availability Zone, using a special type of bucket, at a higher price. It suits analytics and model training that need great speed.

Intelligent-Tiering: when you don't know

If you can't tell how often a file will be requested, this class moves it by itself according to use:

Tier	When	Retrieval
Frequent Access	At the start	Instant
Infrequent Access	After 30 days without access	Instant
Archive Instant Access	After 90 days without access	Instant
Archive Access	Optional, from 90 days	Hours
Deep Archive Access	Optional, from 180 days	Up to 12 hours

You pay a small monitoring fee per object with no retrieval fees, and if a file is requested it returns to the first tier.

Glacier Flexible and Deep Archive: request before reading

In these classes you can't read a file directly. You must first request its restore, choosing a speed:

Class	Expedited	Standard	Bulk
Flexible Retrieval	1 to 5 minutes	3 to 5 hours	5 to 12 hours
Deep Archive	Not available	12 hours	48 hours

Lifecycle

You don't need to move files by hand. Lifecycle rules do it automatically according to a file's age. Take an application's logs, for example:

A single rule moves the file through the classes as it ages, then deletes it after seven years.

A rule has two kinds of action, and you apply it to a specific prefix or tag:

Action	Examples
Transition	Move the file to a cheaper class after a number of days
Expiration	Delete the file after a period, or old versions, or uploads that never finished

A few things to watch for:

Moves only go down the stairs, and the minimum before Standard-IA is 30 days.
Files smaller than 128 KB don't move by default, because moving them costs more than it saves.
The move itself has a fee per thousand objects, so watch out for millions of small files.

How do you know what to choose?

You don't need to guess. You have tools that read your actual use:

Storage Class Analysis: watches access to a prefix or bucket, and suggests when to move from Standard to Standard-IA.
Storage Lens: a dashboard across all your accounts: sizes, growth, and buckets with incomplete uploads or no encryption. It has free metrics and paid advanced ones.

If you have millions of files and want to do something to all of them at once, such as changing class or copying, S3 Batch Operations runs it on a list from S3 Inventory, with a report of the results.

On the other side, if you share huge data with another party, Requester Pays has them pay the request and download costs instead of you.

And if you upload millions of small files you won't read one by one, such as logs, bundle them into one archive first. Every PUT is a paid request, so one large upload can cost far less than a million small ones.

Hands-on: classes and a lifecycle rule

We'll carry on with the bucket from the previous part. If your CloudShell session ended, set its name in BUCKET again. Upload a file to a specific class, and check the class:

Bash

echo "monthly report" > report.txt

aws s3 cp report.txt s3://$BUCKET/reports/report.txt --storage-class STANDARD_IA

aws s3api head-object --bucket $BUCKET --key reports/report.txt \
  --query StorageClass

Now add the lifecycle rule from the diagram to the logs/ prefix:

Bash

aws s3api put-bucket-lifecycle-configuration --bucket $BUCKET \
  --lifecycle-configuration '{
  "Rules": [{
    "ID": "logs-rule",
    "Status": "Enabled",
    "Filter": {"Prefix": "logs/"},
    "Transitions": [
      {"Days": 30, "StorageClass": "STANDARD_IA"},
      {"Days": 90, "StorageClass": "GLACIER"},
      {"Days": 365, "StorageClass": "DEEP_ARCHIVE"}
    ],
    "Expiration": {"Days": 2555},
    "AbortIncompleteMultipartUpload": {"DaysAfterInitiation": 7}
  }]
}'

aws s3api get-bucket-lifecycle-configuration --bucket $BUCKET \
  --query "Rules[0].Transitions" --output table

Here's the fun part: upload a file to Glacier and try to read it:

Bash

echo "old invoice" > old.txt
aws s3 cp old.txt s3://$BUCKET/archive/old.txt --storage-class GLACIER

aws s3 cp s3://$BUCKET/archive/old.txt -

It returns an InvalidObjectState error, because the file is stored but can't be read directly. Request a restore:

Bash

aws s3api restore-object --bucket $BUCKET --key archive/old.txt \
  --restore-request '{"Days": 1, "GlacierJobParameters": {"Tier": "Standard"}}'

aws s3api head-object --bucket $BUCKET --key archive/old.txt \
  --query "[StorageClass,Restore]"

You'll see ongoing-request="true". After 3 to 5 hours it becomes false, and a temporary copy is available to read for one day.

Summary

The less the access, the lower the storage price, and the higher the cost or time of retrieval.
If you don't know the access pattern, Intelligent-Tiering moves files by itself.
Watch out for the minimum storage period, the minimum billable size and retrieval fees.
Lifecycle rules move and delete files automatically, and always add a rule for incomplete uploads.
Storage Lens and Storage Class Analysis let you decide with numbers, not guesses.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 5

A startup is launching a new data platform. Some files may sit untouched for months and then be read heavily, and nobody can predict which. It wants lower storage costs, with no retrieval fees and no rules to maintain. Which class fits?

Show the answer

Correct answer: D

It watches each file's use and moves it between tiers by itself, for a small monitoring fee and with no retrieval fees.

A: This charges for every retrieval, so a heavily read file can end up costing more.
B: This also charges for retrieval, and keeps data in a single Availability Zone.
C: Files here need a restore before reading, which can take hours.

Review: Intelligent-Tiering: when you don't know in this part, and Managing storage costs with Amazon S3 Intelligent-Tiering in the AWS docs.

Question 2 of 5

A video service keeps low-resolution copies of its films, which it can regenerate from the originals at any time. Each is read about once a month and must open instantly. Which class costs the least while meeting this?

Show the answer

Correct answer: B

The copies can be regenerated, so losing them with a zone isn't a disaster, and there's no need to pay for three zones. Retrieval stays instant.

A: This works, but at a higher price for protection this data doesn't need.
C: A restore here takes 12 to 48 hours.
D: Files here need a restore before reading, which takes minutes to hours.

Review: The classes in this part, and Understanding and managing Amazon S3 storage classes in the AWS docs.

Question 3 of 5

A company's application logs must stay instantly readable for 30 days, then be archived cheaply for a year, then be removed. The team doesn't want any scripts to run. What fits?

Show the answer

Correct answer: A

A lifecycle rule moves files to a cheaper class at the age you set and deletes them later, with nothing for you to run.

B: This works, but it's code you have to write and maintain.
C: This shows you numbers, and doesn't move or delete anything.
D: This makes more copies, and neither archives nor removes the originals.

Review: Lifecycle in this part, and Managing the lifecycle of objects in the AWS docs.

Question 4 of 5

An auditor's script tries to read a 20 MB file stored in Glacier Flexible Retrieval, and gets an InvalidObjectState error. The auditor needs the file within 10 minutes. What should the team do?

Show the answer

Correct answer: C

In this class a file has to be restored before it can be read, and Expedited typically makes a file this size available in 1 to 5 minutes.

A: A missing permission returns AccessDenied, not this error.
B: This is the cheapest option, but it takes 5 to 12 hours.
D: Lifecycle moves only go down the stairs, never back up to Standard.

Review: Glacier Flexible and Deep Archive: request before reading in this part, and Understanding archive retrieval options in the AWS docs.

Question 5 of 5

To save money, a team uploaded millions of 10 KB images to Standard-IA. The application reads them all day, and the bill went up. Which two reasons explain this? (Choose two.)

Show the answer

Correct answer: B + C

A 10 KB image is billed as 128 KB in this class, and its low storage price only pays off for data that's rarely read. Data this small and this busy belongs in Standard.

A: The monitoring fee belongs to Intelligent-Tiering.
D: It costs less per gigabyte, which is why it looks attractive.
E: It uses three or more zones just like Standard, so the extra cost doesn't come from there.

Review: The classes in this part, and Understanding and managing Amazon S3 storage classes in the AWS docs.

Your data is now in the right place at the right price, but who can reach it? In part seventeen we cover encryption, signed links and locks against deletion.

S3: Object Storage Basics

2026-11-02T00:00:00Z

In part five we saw storage tied to servers. But photos, videos, backups and logs don't need a server at all. They need somewhere that keeps them safe and delivers them on request, however large they get. That's S3.

S3 (Simple Storage Service) is one of AWS's oldest and most used services. There's no space to reserve, and you pay for what you store. AWS designs it for 99.999999999% durability, meaning the chance of losing a file is close to nil.

You'll see it everywhere: backups, user files, static sites, logs and data lakes for analysis.

Object storage versus disks

	Block (EBS)	File (EFS)	Object (S3)
Looks like	A disk	A shared folder	A key and a file through an API
Reached by	Usually one server	Several servers	Anyone allowed, over HTTP
Changing a file	Part of it	Part of it	You replace the whole object
Size	You reserve it	Grows by itself	No practical limit

The point that matters for design: S3 isn't a disk you mount and run a database from, but it's ideal for any file you read or write as a whole.

Buckets and objects

A bucket holds objects, and each object has a key, data, information about it, tags and a version.

A bucket:

Lives in one Region you choose, even though S3 appears as a global service in the console.
Must have a name unique across all AWS accounts, using lowercase letters, numbers and hyphens.

An object:

Can be up to 50 TB.
Its key is its full path, such as photos/2026/trip.jpg.
There are no real folders. photos/2026/ is part of the name, and the console merely displays it as a folder.

Who can reach it?

Everything in S3 is private by default. When someone requests an object, AWS combines all the rules: they get through if a rule allows them and no rule denies them.

Tool	Attached to	Used for
IAM policy	The user or role	Permissions for your people and services
Bucket policy	The bucket	Public access, other accounts and enforcing rules
Block Public Access	The bucket or account	A safety lock that stops public access whatever the policies say

For example: an EC2 server reading from S3? Give it an IAM role. Another account reading? A bucket policy allows it. This policy makes a whole bucket publicly readable, which is what a static site needs:

JSON

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::my-site-bucket/*"
  }]
}

Versioning

Once it's on, replacing an object creates a new version rather than wiping the old one:

Writing over a file: the old version stays, and you can go back to it.
Deleting: adds a delete marker, and the data stays. Remove the marker and the file returns.
Suspending: doesn't wipe existing versions.

You pay for every version, so pair it with lifecycle rules to clean up old ones.

Replication

S3 automatically copies new objects to another bucket, even in another account. Versioning must be on at both ends.

Type	Good for
Between Regions (CRR)	Compliance, being close to users, and disaster recovery
Within a Region (SRR)	Gathering logs in one place, or copying production to a test environment

Note that existing objects move only with Batch Replication, replication doesn't pass along a chain of buckets, and permanently deleting a version isn't replicated, which protects you from malicious deletes.

Hosting a static site

S3 can serve a complete HTML site: turn on Static website hosting, set index.html, and make the objects public with a policy like the one above.

That website link only works over HTTP, though. The better choice in production is a private bucket with CloudFront and OAC in front of it, giving you HTTPS and higher speed without opening the bucket.

Reacting to events

S3 can send a notification when something happens, such as a photo being uploaded. It sends it to SQS, SNS or Lambda directly, or to EventBridge if you want advanced filtering and more destinations. The classic example: for every photo uploaded, a Lambda function makes a thumbnail. We'll apply this in part twenty-two.

Performance

S3 handles at least 3,500 writes and 5,500 reads per second per prefix, so spreading keys across several prefixes increases capacity. You also have tools for large files and long distances:

Tool	What it does
Multipart upload	Uploads a file in parts in parallel, and if a part fails you repeat only that part. Preferred above 100 MB, required above 5 GB
Transfer Acceleration	Uploads pass through the nearest edge location, then AWS's network, for long distances
Byte-range fetches	Download a specific part of a file, to speed up parallel downloads or fetch only what you need

Hands-on: versioning rescues a deleted file

From CloudShell, create a bucket with a unique name and upload a page:

Bash

BUCKET=series-files-$RANDOM$RANDOM
aws s3 mb s3://$BUCKET

echo "<h1>Version 1</h1>" > index.html
aws s3 cp index.html s3://$BUCKET/
aws s3 ls s3://$BUCKET/

Try reaching the file from the internet. It returns 403, because everything is private:

Bash

curl -s -o /dev/null -w "%{http_code}\n" \
  https://$BUCKET.s3.$AWS_REGION.amazonaws.com/index.html

Now turn on versioning, write over the file, then delete it:

Bash

aws s3api put-bucket-versioning --bucket $BUCKET \
  --versioning-configuration Status=Enabled

echo "<h1>Version 2</h1>" > index.html
aws s3 cp index.html s3://$BUCKET/

aws s3 rm s3://$BUCKET/index.html
aws s3 ls s3://$BUCKET/

The file has gone from the list. But look at what really happened:

Bash

aws s3api list-object-versions --bucket $BUCKET --prefix index.html \
  --query "{Versions:Versions[].[VersionId,IsLatest],Markers:DeleteMarkers[].[VersionId,IsLatest]}"

Both versions are there, with a delete marker on top. Delete the marker and the file returns:

Bash

MARKER=$(aws s3api list-object-versions --bucket $BUCKET --prefix index.html \
  --query "DeleteMarkers[0].VersionId" --output text)

aws s3api delete-object --bucket $BUCKET --key index.html --version-id $MARKER

aws s3 cp s3://$BUCKET/index.html -

It prints Version 2. The file is back as if it had never been deleted.

Summary

S3 is object storage with no practical limit, and you pay for what you store.
A bucket sits in one Region with a unique name, and a key is an object's full path.
Everything is private by default, so keep Block Public Access on.
Versioning protects you from accidental deletes and overwrites, and replication copies objects to another bucket.
For a static site in production: a private bucket with CloudFront.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 5

A design agency keeps client files in S3. Last week a staff member deleted some files by mistake, and a script overwrote others. The agency wants to be able to get both kinds back from now on, with the least effort. What should it turn on?

Show the answer

Correct answer: C

With versioning on, a delete only adds a marker and an overwrite creates a new version, so the old data stays and you can go back to it.

A: This stops public access, and does nothing about deletes or overwrites.
B: This needs versioning on anyway, and adds a second bucket to pay for.
D: This speeds up uploads over long distances, and keeps no old copies.

Review: Versioning in this part, and Retaining multiple versions of objects with S3 Versioning in the AWS docs.

Question 2 of 5

A company keeps its marketing site in S3. It wants the site served over HTTPS on its own domain, with the bucket staying private. What fits?

Show the answer

Correct answer: A

CloudFront gives you HTTPS on your own domain, and OAC lets only CloudFront read from the bucket, so the bucket stays closed.

B: The website endpoint only works over HTTP, and the bucket has to be public.
C: The website endpoint needs public objects, so with the lock on visitors get 403.
D: This adds a server to run and patch for a site that doesn't need one.

Review: Hosting a static site in this part, and Website endpoints in the AWS docs.

Question 3 of 5

A film studio uploads 40 GB video files to S3 over an unstable connection. Uploads often fail near the end and have to start over. What solves this?

Show the answer

Correct answer: D

Multipart upload sends a file in parts, in parallel, and if one part fails you repeat only that part. It's also required for anything above 5 GB.

A: These are for downloading part of a file, not for uploading.
B: This shortens the path over long distances, but a failed upload would still start over.
C: This keeps old versions, and doesn't help an upload finish.

Review: Performance in this part, and Uploading and copying objects using multipart upload in the AWS docs.

Question 4 of 5

A regulator requires a company to keep a copy of its records bucket in a second Region, including the files already in the bucket. Versioning is on at both ends. What should it set up?

Show the answer

Correct answer: B

A replication rule copies only new objects, so existing ones need Batch Replication. Together they give you a full copy in the second Region that stays current.

A: This copies only the objects written after the rule is set.
C: This keeps the copy in the same Region, which doesn't meet the requirement.
D: Lifecycle rules change a file's class or delete it, and don't move it between Regions.

Review: Replication in this part, and Replicating objects within and across Regions in the AWS docs.

Question 5 of 5

A server on EC2 must read from a private bucket, and an analytics team in another AWS account must read from it too. Block Public Access has to stay on. Which two steps fit? (Choose two.)

Show the answer

Correct answer: A + D

A role gives the server temporary credentials with no keys to store, and a bucket policy is how you let another account in. Neither of them makes anything public.

B: Keys in a file can leak, and a role avoids them altogether.
C: This exposes the data to everyone, and the lock would stop it anyway.
E: This adds copies to manage, and a volume isn't how another account reads your data.

Review: Who can reach it? in this part, and Example 2: Bucket owner granting cross-account bucket permissions and Use an IAM role to grant permissions to applications running on Amazon EC2 instances in the AWS docs.

But does every file deserve the same price? A file untouched for two years shouldn't cost you the same as a photo requested every second. In part sixteen we save a lot with storage classes and lifecycle rules.

VPC: Connecting Networks

2026-11-02T00:00:00Z

In part thirteen we built an isolated network. But real applications rarely stay alone: you have a second VPC for another team, servers that need S3 and an office that needs to reach the database.

Here's this part's map, to come back to whenever you're unsure:

You want	Use
Two VPCs talking to each other	VPC peering
A private subnet reaching S3 or DynamoDB without NAT	Gateway endpoint
Reaching other AWS services or a partner's service privately	Interface endpoint
Your office reaching AWS quickly over the internet	Site-to-Site VPN
Employees' devices reaching the network	Client VPN
A steady, large line between your office and AWS	Direct Connect
Many networks and offices	Transit Gateway

VPC peering

Peering connects two VPCs directly, as if they were one network. It works even between different accounts or different Regions. Its rules:

Ranges can't overlap. This is what we warned you about in the previous part.
It isn't transitive. If A connects to B and B connects to C, A can't reach C.
You need a route on both sides. You add one in each network's route table.

There's no hourly charge; you pay only for data transfer.

VPC endpoints: AWS services without the internet

By default, your private server's request to S3 goes out through NAT, and you pay for every gigabyte, even though the destination is already inside AWS. Endpoints give you a private, direct path:

Instead of the paid path through NAT, the private server reaches S3 through a free gateway endpoint, without going out to the internet.

	Gateway endpoint	Interface endpoint
Services	S3 and DynamoDB only	Most AWS services, and partners' services
How it works	A route in the route table	A network interface with a private address in your subnet
Cost	Free	Per hour per zone, and per gigabyte
From your office	Not reachable	Reachable through VPN or Direct Connect

An interface endpoint is built on PrivateLink, which also lets you offer your own service to other networks through an NLB, with no peering and even if their ranges overlap.

Connecting your office: Site-to-Site VPN

Site-to-Site VPN connects your office network to the VPC over the internet through an encrypted tunnel, and you can set it up quickly. It has three pieces:

Customer gateway: represents your office device and its public address.
Virtual private gateway: the VPN gateway on AWS's side, attached to the VPC.
VPN connection: the connection itself, which comes with two tunnels for availability.

Then turn on route propagation in the route table so the VPC learns the office's routes. Each tunnel gives you up to 1.25 Gbps, or up to 5 with Transit Gateway.

VPN CloudHub: connects several offices to each other through the same gateway.
Client VPN: for employees' devices rather than offices.

If you want a VPN fully under your control on your own server, see the WireGuard article.

Direct Connect: a private line

Direct Connect is a real private line between your site and AWS through a Direct Connect location, so it doesn't cross the public internet. Its speed is steady, and outgoing data transfer is cheaper.

Dedicated: a port just for you, from 1 to 400 Gbps.
Hosted: through a partner, with speeds starting far lower.
Direct Connect Gateway: connects you to VPCs in several Regions.

Watch out for three things: setup takes weeks and sometimes months, the line isn't encrypted automatically, so use MACsec or a VPN on top, and one line is a single point of failure, so for your most important systems have two lines in two locations, or a backup VPN.

	Site-to-Site VPN	Direct Connect
Path	The internet, encrypted	A private line
Setup	Minutes or hours	Weeks or months
Speed	1.25 Gbps per tunnel, or 5 with Transit Gateway	1 to 400 Gbps
Performance	Varies with the internet	Steady
Cost	Low	Higher at first, cheaper for large transfers

Transit Gateway: one hub

As networks multiply, peering becomes tiring: since it isn't transitive, you need a link for every pair:

Five networks need ten peering links, or only five links to a single Transit Gateway hub.

Transit Gateway is a central hub you connect networks to, and each one reaches the others through it:

It connects everything: VPCs, VPN connections, Direct Connect and Transit Gateways in other Regions.
Its own route tables: you decide who talks to whom, for example separating production from development.
Across accounts: you share it with other accounts through the RAM service.
Higher VPN speed: it spreads traffic across several tunnels.

You pay by the hour for each attachment, and for data. For two or three networks, peering is simpler and cheaper.

Network costs

Data transfer is the item that most often surprises people. These are approximate rates for US Regions, so check yours:

Traffic	Cost per gigabyte
Into AWS	Free
Within one Availability Zone, by private address	Free
Between Availability Zones	About $0.01 in each direction
Between Regions	About $0.02
Out to the internet	About $0.09, falling with volume
Through a NAT Gateway	About $0.045 extra
S3 through a gateway endpoint	Free

How to save:

Use private addresses between servers, not public ones.
Keep services that talk a lot in the same Availability Zone, if your availability design allows it.
Turn on a gateway endpoint for S3.
Serve content through CloudFront, since transfer from your origin to it is free.

Layers of protection

Layer	Service	Protects against
Subnet	NACL	Addresses you want to block
Server	Security group	Any port and source you didn't allow
Web application	WAF	Web attacks such as SQL injection
Large attacks	Shield	DDoS
The whole VPC	Network Firewall	Inspecting traffic and domains at the boundary

As for IPv6: you can add it to a VPC, but all its addresses are public. If you want servers to go out with nobody coming in, use an egress-only internet gateway, which is like NAT for IPv6.

Hands-on: an endpoint and peering

We'll continue with the network from part thirteen, after deleting the NAT Gateway, so private-server has no route to the internet. The commands use the variables VPC and RT_PRIVATE; if your CloudShell session ended, set them by hand from the VPC page.

Gateway endpoint

Give private-server an IAM role with AmazonS3ReadOnlyAccess, as we explained in part two. On the server, try:

Bash

aws s3 ls --cli-connect-timeout 5

It times out after several attempts, because there's no route to S3. Now add an endpoint from CloudShell:

Bash

aws ec2 create-vpc-endpoint --vpc-id $VPC \
  --service-name com.amazonaws.$AWS_REGION.s3 \
  --route-table-ids $RT_PRIVATE

aws ec2 describe-route-tables --route-table-ids $RT_PRIVATE \
  --query "RouteTables[0].Routes[].[DestinationCidrBlock,DestinationPrefixListId,GatewayId]" \
  --output table

You'll see a new route starting with pl- and pointing to vpce-. Repeat aws s3 ls on the server, and it returns at once with your buckets, or empty if you have none, with no internet at all.

VPC peering

Now we'll connect this network to the default one, which holds web-1 from part three. Get its private address:

Bash

aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=web-1" "Name=instance-state-name,Values=running" \
  --query "Reservations[0].Instances[0].PrivateIpAddress" --output text

From private-server, try curl -m 5 http://WEB-PRIVATE-IP, and it times out. Now create the connection and accept it:

Bash

DEFAULT_VPC=$(aws ec2 describe-vpcs --filters Name=isDefault,Values=true \
  --query "Vpcs[0].VpcId" --output text)

PEER=$(aws ec2 create-vpc-peering-connection \
  --vpc-id $VPC --peer-vpc-id $DEFAULT_VPC \
  --query VpcPeeringConnection.VpcPeeringConnectionId --output text)

aws ec2 accept-vpc-peering-connection --vpc-peering-connection-id $PEER

The connection alone isn't enough, so add a route on both sides:

Bash

aws ec2 create-route --route-table-id $RT_PRIVATE \
  --destination-cidr-block 172.31.0.0/16 --vpc-peering-connection-id $PEER

DEFAULT_RT=$(aws ec2 describe-route-tables \
  --filters Name=vpc-id,Values=$DEFAULT_VPC Name=association.main,Values=true \
  --query "RouteTables[0].RouteTableId" --output text)

aws ec2 create-route --route-table-id $DEFAULT_RT \
  --destination-cidr-block 10.0.0.0/16 --vpc-peering-connection-id $PEER

Repeat curl from private-server, and web-1's page comes back over the private address.

Bash

aws ec2 delete-route --route-table-id $DEFAULT_RT \
  --destination-cidr-block 10.0.0.0/16

aws ec2 delete-vpc-peering-connection --vpc-peering-connection-id $PEER

Summary

Peering is for two networks and isn't transitive; Transit Gateway is for when networks multiply.
A gateway endpoint is free for S3 and DynamoDB; an interface endpoint covers the other services.
VPN is quick to set up over the internet; Direct Connect is a private line that takes time.
Data transfer is among the biggest surprises on a bill, so plan for it from the start.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 5

An order-processing application in a private subnet writes heavily to DynamoDB, and the team finds most of its NAT Gateway bill comes from this traffic. What cuts this cost with the least effort?

Show the answer

Correct answer: C

A gateway endpoint adds a route to DynamoDB that skips NAT, with no extra charge and no code changes.

A: This exposes servers that should stay private, and public addresses cost money too.
B: DynamoDB isn't a VPC you can peer with.
D: This links your own site to AWS, and has nothing to do with traffic inside the VPC.

Review: VPC endpoints: AWS services without the internet in this part, and Gateway endpoints for Amazon DynamoDB in the AWS docs.

Question 2 of 5

A payments team runs an internal API behind a Network Load Balancer. Forty other VPCs need to call it, some of their ranges overlap with its own, and they mustn't reach anything else on its network. What fits?

Show the answer

Correct answer: B

With PrivateLink, each consumer gets a private interface in its own subnet that leads only to that service, so overlapping ranges cause no conflict.

A: Peering doesn't work with overlapping ranges, and it connects whole networks.
C: Gateway endpoints are only for S3 and DynamoDB.
D: This puts an internal API on the internet.

Review: VPC endpoints: AWS services without the internet in this part, and AWS PrivateLink in the AWS docs.

Question 3 of 5

A small company must connect its office network to a VPC by next week. Traffic is light, the budget is tight, and the data has to be encrypted. Which option fits?

Show the answer

Correct answer: A

Site-to-Site VPN crosses the internet through an encrypted tunnel, and can be set up quickly at low cost.

B: Setting it up takes weeks or months, and it costs more at first.
C: This is for individual employees' devices, rather than a whole office network.
D: This connects VPCs to each other, and can't reach an office.

Review: Connecting your office: Site-to-Site VPN in this part, and What is AWS Site-to-Site VPN? in the AWS docs.

Question 4 of 5

A company is growing to 30 VPCs across several accounts, plus three offices connected by VPN. It wants every network to connect in one place, with production kept apart from development. What fits with the least operational overhead?

Show the answer

Correct answer: D

Transit Gateway is a central hub for VPCs and VPNs, its route tables decide who talks to whom, and it can be shared across accounts through RAM.

A: Thirty networks would need 435 connections, each with its own routes.
B: This connects offices to each other through one gateway, not a set of VPCs.
C: Peering isn't transitive, so the others couldn't reach each other through it.

Review: Transit Gateway: one hub in this part, and What is AWS Transit Gateway for Amazon VPC? in the AWS docs.

Question 5 of 5

A bank reaches AWS over a single 10 Gbps Direct Connect line. An audit finds two problems: the line is a single point of failure, and its traffic isn't encrypted. Which two actions address these? (Choose two.)

Show the answer

Correct answer: A + C

A second line in a second location keeps the bank connected if a line or a whole location fails. MACsec or a VPN on top adds the encryption the line doesn't have by default.

B: A faster line is still one line, and still unencrypted.
D: This reaches S3 and DynamoDB from inside a VPC, and has nothing to do with the line.
E: This is still one line, and a partner doesn't encrypt it for you.

Review: Direct Connect: a private line in this part, and Encryption in AWS Direct Connect and AWS Direct Connect Resiliency Toolkit in the AWS docs.

That completes the networking section. You now know the visitor's path from your site's name to its data, and what's left is a place to store anything at any size. That's the next section's subject, starting in part fifteen with the basics of S3.

VPC: Your Private Network

2026-11-02T00:00:00Z

Every server we've launched in this series has been inside a network you didn't build: the default VPC that AWS creates in each Region. It's fine for experiments, but a real application needs a design where the database stays hidden and each layer has its own place.

What is a VPC?

A VPC (Virtual Private Cloud) is your private network within one Region. It spans all of that Region's Availability Zones, and nothing gets in or out unless you allow it. This is the common design:

Servers sit in private subnets and go out to the internet through NAT in the public subnet, then the internet gateway, and nobody outside can start a connection to them.

Address ranges: how to read CIDR

You write an address range in CIDR form, such as 10.0.0.0/16. The number after the slash says how many of the 32 bits are fixed, so the smaller the number, the bigger the range:

CIDR	Addresses	Common use
`/32`	1	A single address
`/28`	16	The smallest VPC or subnet
`/24`	256	A subnet
`/16`	65,536	The largest VPC
`/0`	All addresses	`0.0.0.0/0` means anywhere

Use the private ranges: 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16. The default VPC uses 172.31.0.0/16.

Subnets

A subnet is a slice of the VPC's range, and here's what matters most:

It lives in one Availability Zone. For high availability you need subnets in at least two zones.
AWS reserves 5 addresses in each one: the first four and the last. So /24 gives you 251 addresses, not 256.
"Public" and "private" aren't settings. A subnet becomes public when its route table has a route to an internet gateway.

Route tables and the internet gateway

An internet gateway connects the VPC to the internet. A route table decides where each packet goes. A public subnet's table looks like this:

Destination	Target	Meaning
`10.0.0.0/16`	`local`	Inside the VPC, which is always there
`0.0.0.0/0`	`igw-...`	Everything else goes to the internet

For anyone to reach the server from outside, it also needs a public address. Remember from part four that all public IPv4 addresses cost money.

NAT Gateway: out without in

A server in a private subnet sometimes needs to go out, for example to download updates, but you don't want anyone coming in. That's the job of a NAT Gateway: it sits in the public subnet, sends the private servers' requests out under its own address, and accepts no connection started from outside.

The private subnet's table has 0.0.0.0/0 pointing to nat-... instead of the internet gateway. There are a few forms:

Form	How it works
Zonal NAT Gateway	You need one in each Availability Zone, otherwise private subnets elsewhere lose access if its zone fails
Regional NAT Gateway	Newer. It expands automatically to the zones holding your servers, and is billed for each active zone
NAT instance	An EC2 server you manage yourself: you pay for the server instead of per gigabyte, its bandwidth depends on its size, it has no automatic failover, and you must turn off its source/destination check. It can be cheaper for very small workloads, but AWS recommends NAT gateways

How do you reach a private server?

It has no public address, so how do you get in?

Method	How	Notes
Bastion host	A public server you SSH through	Old: keys, an open port and an extra server to secure
EC2 Instance Connect Endpoint	A point inside your network that connects you with no public address	Free, and we'll use it in the hands-on
Session Manager	A terminal through the SSM service, with no port 22	Needs an IAM role, and logs sessions

Two firewalls: security groups and NACLs

You know the security group, which surrounds the server. There's a second firewall called a NACL that surrounds the subnet:

	Security group	NACL
Level	The server	The subnet
Rules	Allow only	Allow and deny
State	Remembers the connection, so the reply goes out automatically	Doesn't remember, so you must allow the reply too
Evaluation	All rules	In order, and the first match decides
Default	In blocked, out allowed	The default allows everything; a new one denies everything

Since a NACL doesn't remember connections, you must allow the server's replies through ephemeral ports (usually 1024-65535), and this causes a lot of mistakes.

The practical rule: leave the default NACL alone and work with security groups. Use a NACL when you want to block an address range quickly, since a security group can't deny.

Flow Logs

When a request doesn't arrive and you don't know why, Flow Logs record the details of each connection at the VPC, subnet or interface level, and send them to CloudWatch Logs or S3. A line looks like this:

Output

2 123456789012 eni-0abc 203.0.113.7 10.0.1.5 49152 22 6 5 300 1730000000 1730000060 REJECT OK

That means: from 203.0.113.7 to 10.0.1.5 on port 22, and it was rejected. How to diagnose:

Inbound rejected: the problem is the security group or the NACL.
Inbound accepted and outbound rejected: the problem is the NACL, because a security group allows the reply automatically.

Hands-on: build a VPC from scratch

We'll build a network with public and private subnets, and see for ourselves that the whole difference is in the route table. All commands are from CloudShell. First, the network and subnets:

Bash

VPC=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=series-vpc}]' \
  --query Vpc.VpcId --output text)

AZ=$(aws ec2 describe-availability-zones \
  --query "AvailabilityZones[0].ZoneName" --output text)

PUBLIC=$(aws ec2 create-subnet --vpc-id $VPC --cidr-block 10.0.1.0/24 \
  --availability-zone $AZ --query Subnet.SubnetId --output text)

PRIVATE=$(aws ec2 create-subnet --vpc-id $VPC --cidr-block 10.0.11.0/24 \
  --availability-zone $AZ --query Subnet.SubnetId --output text)

Now the internet gateway, and a route table for the public subnet only:

Bash

IGW=$(aws ec2 create-internet-gateway \
  --query InternetGateway.InternetGatewayId --output text)
aws ec2 attach-internet-gateway --vpc-id $VPC --internet-gateway-id $IGW

RT_PUBLIC=$(aws ec2 create-route-table --vpc-id $VPC \
  --query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id $RT_PUBLIC \
  --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW
aws ec2 associate-route-table --route-table-id $RT_PUBLIC --subnet-id $PUBLIC

A security group allowing traffic only from inside the network, and an entry point so we can reach the servers without opening a port to the world:

Bash

SG=$(aws ec2 create-security-group --group-name series-sg \
  --description "SSH and ping from inside the VPC" --vpc-id $VPC \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id $SG \
  --protocol tcp --port 22 --cidr 10.0.0.0/16
aws ec2 authorize-security-group-ingress --group-id $SG \
  --protocol icmp --port -1 --cidr 10.0.0.0/16

aws ec2 create-instance-connect-endpoint --subnet-id $PRIVATE \
  --security-group-ids $SG --no-preserve-client-ip

And a server in each subnet:

Bash

AMI=$(aws ssm get-parameter \
  --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 \
  --query Parameter.Value --output text)

aws ec2 run-instances --image-id $AMI --instance-type t3.micro \
  --subnet-id $PUBLIC --security-group-ids $SG --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=public-server}]'

aws ec2 run-instances --image-id $AMI --instance-type t3.micro \
  --subnet-id $PRIVATE --security-group-ids $SG \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=private-server}]'

Wait a few minutes for the entry point to be ready. Then in EC2 select a server, choose Connect, and under EC2 Instance Connect pick the option that connects through the endpoint. On each server, try:

Bash

curl -m 5 https://checkip.amazonaws.com

public-server: prints its public address.
private-server: times out with no answer, because it has no route to the internet.

From the private server, try ping on the public server's private address, and it replies, because the local route connects them.

Add a NAT Gateway

Now let the private server go out. This step is billed by the hour, so delete it after experimenting:

Bash

ALLOC=$(aws ec2 allocate-address --domain vpc \
  --query AllocationId --output text)

NAT=$(aws ec2 create-nat-gateway --subnet-id $PUBLIC --allocation-id $ALLOC \
  --query NatGateway.NatGatewayId --output text)
aws ec2 wait nat-gateway-available --nat-gateway-ids $NAT

RT_PRIVATE=$(aws ec2 create-route-table --vpc-id $VPC \
  --query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id $RT_PRIVATE \
  --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NAT
aws ec2 associate-route-table --route-table-id $RT_PRIVATE --subnet-id $PRIVATE

Repeat the same curl command on private-server. This time it prints an address, which is the NAT Gateway's, not the server's. The server went out to the internet, and still nobody can start a connection to it.

Summary

A VPC is your private network in a Region, split into subnets across Availability Zones.
A subnet is public if its table has a route to an internet gateway, otherwise it's private.
A NAT Gateway lets private subnets go out with nobody coming in, but watch its cost.
Security groups remember connections and only allow; NACLs don't remember and can deny.
Flow Logs tell you where a connection was rejected.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 6

A new server has a public address, and its security group allows HTTPS from anywhere, yet nobody can reach it from the internet. The VPC has an internet gateway attached, and the subnet's route table has only the local route. What's missing?

Show the answer

Correct answer: A

A subnet becomes public when its route table points to an internet gateway. Without that route, packets have no way out, even with a public address.

B: NAT lets private servers go out, and accepts no connection started from outside.
C: A security group remembers the connection, so the reply goes out automatically.
D: Peering connects two VPCs, and gives no path to the internet.

Review: Route tables and the internet gateway in this part, and Enable internet access for a VPC using an internet gateway in the AWS docs.

Question 2 of 6

A team is planning a subnet that must hold 30 servers. Address space is tight, so it wants the smallest block that fits. Which one should it pick?

Show the answer

Correct answer: D

AWS reserves 5 addresses in every subnet. A /27 has 32, which leaves 27, so it falls short. A /26 has 64, which leaves 59.

A: The smallest subnet AWS allows is /28, so this can't even be created.
B: This leaves only 11 usable addresses.
C: This leaves 27 usable addresses, three short of what's needed.

Review: Subnets in this part, and Subnet CIDR blocks in the AWS docs.

Question 3 of 6

An application runs in private subnets across two Availability Zones, sharing one zonal NAT Gateway in the first zone. In an outage of that zone, the servers in the second zone stayed healthy but lost internet access. What fixes this?

Show the answer

Correct answer: B

A zonal NAT Gateway lives in one zone, so that zone's failure cuts off everyone relying on it. With one in each zone, a failure stays in its own zone. A Regional NAT Gateway gets you the same result automatically.

A: A VPC has one internet gateway, and private subnets don't route to it.
C: More addresses don't move it out of the failed zone.
D: A NAT Gateway sits in a public subnet, and this would cut it off from the internet.

Review: NAT Gateway: out without in in this part, and NAT gateway basics in the AWS docs.

Question 4 of 6

To block an abusive address range, a team creates a new NACL with a deny rule for that range and an inbound allow rule for port 443. Now no visitor can load the site. Flow Logs show the requests as ACCEPT and the replies as REJECT. What should the team do?

Show the answer

Correct answer: C

A NACL doesn't remember connections, and a new one denies everything you haven't allowed, so the replies need their own rule. Inbound accepted with outbound rejected points straight at the NACL.

A: A security group can only allow, so it can't hold a deny rule.
B: A security group remembers the connection, so it was already letting the reply out.
D: This would block the requests as well.

Review: Two firewalls: security groups and NACLs and Flow Logs in this part, and Custom network ACLs for your VPC in the AWS docs.

Question 5 of 6

Engineers need a terminal on servers in a private subnet. The servers must keep having no public addresses, and the team doesn't want another server to patch and secure. Which two options fit? (Choose two.)

Show the answer

Correct answer: C + E

Both reach the server with no public address and no extra server to run. Session Manager also needs no port 22, and it logs sessions.

A: This is the extra server the team wants to avoid.
B: A NAT Gateway only lets traffic out, and accepts no connection started from outside.
D: This gives the servers public addresses, which is what must be avoided.

Review: How do you reach a private server? in this part, and Session Manager and EC2 Instance Connect Endpoint in the AWS docs.

Question 6 of 6

A team sets up a NAT instance in a public subnet and points the private subnet's route table to it, yet private servers still can't reach the internet. The security groups allow the traffic. What did it most likely forget?

Show the answer

Correct answer: B

An EC2 server normally has to be the source or destination of its traffic. A NAT instance passes on traffic for others, so this check has to be off.

A: Private servers go out through the NAT instance's address, and don't need their own.
C: The public subnet only needs its route to the internet gateway, and this adds nothing.
D: Gateway endpoints reach S3 and DynamoDB, not the internet.

Review: NAT Gateway: out without in in this part, and Enable private resources to communicate outside the VPC in the AWS docs.

Your network is now ready, but isolated. In part fourteen we connect it to other networks, to AWS services and to your office.

CloudFront and Global Accelerator: Closer to Your Visitors

2026-11-02T00:00:00Z

In part eleven your site got a name, but its server is still in one place. A distant visitor's request crosses continents and many networks on the public internet, and every request takes time.

You have two services for this problem: CloudFront keeps a copy near the visitor, and Global Accelerator shortens the road itself.

CloudFront: a copy near every visitor

CloudFront is a content delivery network (CDN). It uses the edge locations spread around the world: the first visitor to request a file makes CloudFront fetch it from your origin and keep it, and later visitors in the same area get it directly from the edge location.

Each visitor reaches the nearest edge location, which goes back to the origin only if it has no valid copy.

What do you gain?

Higher speed: the answer comes from somewhere close.
Less load on the origin: most requests end at the edge.
Protection: it comes with Shield Standard against DDoS attacks, and you can add WAF.
Free HTTPS: with an ACM certificate, and TLS handled at the edge.

Origins

The origin is where the content originally lives. The key point is that visitors shouldn't be able to skip CloudFront and reach it directly:

Origin	Good for	How to keep it private
S3 bucket	Static sites and files	OAC lets only CloudFront read from it
ALB	Dynamic applications	VPC origins keep the load balancer in a private network
EC2 server	An application on a server	VPC origins, or a security group allowing only CloudFront's ranges
Any HTTP server	Even outside AWS	A secret header the server checks

We cover S3 in detail in the object storage section.

What gets cached, and for how long?

Cache key: the URL by default. The more headers or cookies you add to it, the lower the chance of finding a ready copy, so keep it minimal.
Lifetime: from the origin's Cache-Control header, or from CloudFront's settings.
Behaviors: rules by path, such as /images/* with a long lifetime and /api/* with no caching. One domain can serve both static and dynamic content.

Clearing the cache

If you change a file, the old copy stays until it expires. You have two solutions:

Invalidation: you ask CloudFront to clear paths, such as /*. The first 1,000 paths each month are free.
A version in the file name: such as main.css?v=12, so a new version is a new URL. This is the better solution for static files.

Extra features

Geo restriction: allow or block certain countries, for example for content licensed to one country.
Signed URLs: for paid or private content, with a link that expires.
CloudFront Functions and Lambda@Edge: short code running at the edge, such as redirects and header changes.

Pricing

You have two options, and prices can change, so check them before deciding:

Pay as you go: you pay for outgoing data and requests, at rates that vary by area. Each month you get 1 TB and 10 million requests free. Price classes let you leave out the most expensive areas in exchange for less coverage.
Flat-rate plans: Free, Pro, Business and Premium, with a monthly price per distribution and no surprises, including other services such as WAF.

Data moving from S3 or an ALB to CloudFront is free.

CloudFront or S3 replication between Regions?

	CloudFront	S3 Cross-Region Replication
Coverage	All edge locations	The Regions you choose
Data	Temporary copies until they expire	Full copies kept continuously up to date
Good for	Static content for the whole world	Changing data you want close in specific Regions

Global Accelerator: a faster road

Some traffic can't be cached: a game over UDP, a voice call or a payment request. It has to reach your application itself, and on the public internet it passes through many networks with unsteady delays.

Global Accelerator brings the visitor onto AWS's private network at the nearest edge location, and carries on along it to your application.

Instead of crossing the whole public internet, the request enters AWS's network at the nearest edge location and carries on along it.

Two static addresses through Anycast

On the ordinary internet (Unicast), each address has one machine. With Anycast, several places share the same address, and the network takes you to the nearest.

Global Accelerator gives you two static addresses of this kind, pointing at ALBs, NLBs, EC2 servers or Elastic IPs, even across Regions. That gives you:

Addresses that don't change: your customers can allow them in their firewalls.
Fast failover: it follows the application's health and moves traffic, with no waiting for DNS caches on people's devices.
Traffic control: you set each Region's share, so you can try a new version in one of them.
Protection: Shield Standard, and your application isn't exposed directly.

It costs a fixed hourly fee plus an extra data charge, so it has no free allowance like CloudFront's.

Which should you choose?

	CloudFront	Global Accelerator
Protocols	HTTP and HTTPS	Any TCP or UDP
Caches?	Yes	No, it only carries the request
Addresses	Change, so you use a domain name	Two static addresses
Good for	Sites, images, video and APIs	Games, calls and IoT, or a need for static addresses

If your application is HTTP, start with CloudFront.

The full picture so far

The visitor's path now looks like this: Route 53 gives them the address, then CloudFront answers from the nearest location if it has a copy, otherwise it passes the request to the ALB, which spreads it across Auto Scaling servers that read from ElastiCache and RDS.

Hands-on: see the cache for yourself

We'll put CloudFront in front of your web-1 server from part three, since it allows HTTP from anywhere. From CloudShell:

Bash

ORIGIN=$(aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=web-1" "Name=instance-state-name,Values=running" \
  --query "Reservations[0].Instances[0].PublicDnsName" --output text)

aws cloudfront create-distribution \
  --origin-domain-name "$ORIGIN" \
  --query "Distribution.[Id,DomainName]" --output table

Note the ID and domain from the table, and wait until it's ready, which takes a few minutes:

Bash

aws cloudfront wait distribution-deployed --id YOUR-DISTRIBUTION-ID

Now request the page three times and look at the headers:

Bash

for i in 1 2 3; do
  curl -s -o /dev/null -D - https://YOUR-DOMAIN.cloudfront.net \
    | grep -iE "^(x-cache|age|x-amz-cf-pop)"
  echo
  sleep 2
done

The first request returns Miss from cloudfront, and later ones Hit from cloudfront with a growing age. x-amz-cf-pop shows the edge location that answered you.

Now change the page on the server through EC2 Instance Connect:

Bash

echo "<h1>New version</h1>" | sudo tee /usr/share/nginx/html/index.html

Open the CloudFront link and you'll find the old page, because it's still cached. Clear it from CloudShell:

Bash

aws cloudfront create-invalidation \
  --distribution-id YOUR-DISTRIBUTION-ID --paths "/*"

Moments later the new page appears.

Summary

CloudFront keeps copies near visitors, so the site gets faster and the origin gets less load.
Keep your origin private through OAC or VPC origins, so nobody can skip CloudFront.
A version in the file name beats clearing the cache every time.
Global Accelerator doesn't cache, but carries any TCP or UDP over AWS's network with two static addresses.
If your application is HTTP, start with CloudFront.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 5

A multiplayer game sends its traffic over UDP to servers in two Regions. Players complain of unsteady delays, and some partners can only allow fixed addresses through their firewalls. Which service fits?

Show the answer

Correct answer: B

Global Accelerator carries any TCP or UDP over AWS's network from the nearest edge location, and gives you two static addresses that can go in a firewall.

A: CloudFront serves HTTP and HTTPS, not a game's UDP traffic.
C: This only picks a Region, so the traffic still crosses the public internet, and the addresses aren't static.
D: This copies S3 objects, and has nothing to do with live game traffic.

Review: Global Accelerator: a faster road in this part, and AWS Global Accelerator FAQs on the AWS site.

Question 2 of 5

An online academy keeps its course files in S3 and serves them through CloudFront. Visitors can still open the files directly from the bucket's URL, skipping CloudFront altogether. What closes this gap?

Show the answer

Correct answer: C

With OAC, CloudFront signs its requests to S3 and the bucket policy accepts only those, so the bucket stays closed to everyone else.

A: This limits countries inside CloudFront, and the bucket's URL stays open.
B: This controls who gets through CloudFront, and the bucket's URL stays open.
D: This clears copies from the cache, and changes nothing about who can reach the bucket.

Review: Origins in this part, and Restrict access to an Amazon S3 origin in the AWS docs.

Question 3 of 5

One domain serves product images under /images/* and a live API under /api/*. The images should stay cached for a month, while API responses must never be cached. What's the simplest way to do this with CloudFront?

Show the answer

Correct answer: D

A behavior applies its own rules to a path pattern, so one distribution on one domain can keep images for a long time and pass the API straight through.

A: This splits the site across two domains for no need.
B: Invalidations take time and aren't made for every request, and the paths stop being free after the monthly allowance.
C: This doesn't cache anything, so it does nothing for the images.

Review: What gets cached, and for how long? in this part, and Cache behavior settings in the AWS docs.

Question 4 of 5

A team changes main.css several times a day. Visitors sometimes see old styles, and the team is tired of invalidating the cache after each release. What's the better long-term solution?

Show the answer

Correct answer: A

A new version means a new URL, so visitors get the new copy at once, with no waiting for the old one to expire and no invalidations to run.

B: Visitors would keep the old copy for even longer.
C: This gives up the speed, and puts the load back on the origin.
D: This adds more copies to keep in sync, and the old one stays in the cache.

Review: Clearing the cache in this part, and Use file versioning to update or remove content in the AWS docs.

Question 5 of 5

A news site finds that most CloudFront requests still reach its origin, even for articles that rarely change. The cache key includes all cookies and headers, and the origin sends Cache-Control: max-age=60. Which two changes raise the share of requests answered from the edge? (Choose two.)

Show the answer

Correct answer: B + D

Every extra value in the key splits one page into many copies, and a short lifetime sends requests back to the origin soon after. With both fixed, more visitors find a ready copy.

A: This empties the cache, so the problem gets worse.
C: This doesn't cache, so requests would still reach the origin.
E: It would have the same key and lifetime, so the same problem would repeat.

Review: What gets cached, and for how long? in this part, and Increase the proportion of requests that are served directly from the CloudFront caches in the AWS docs.

All this brings the visitor to your network's door, but how is the network itself built? In part thirteen we open up the VPC and build one from scratch.

DNS and Route 53: Your Site's Address

2026-11-02T00:00:00Z

The load balancer in our application from part seven has a name like web-alb-1234567890.eu-central-1.elb.amazonaws.com. Nobody is going to type that. Visitors want shop.example.com, and what connects the two is DNS.

This section is about the visitor's path to your application: the name in this part, speed in the next, then the private network everything lives in.

How DNS works

DNS is the internet's phone book: you ask with a name and it answers with an address. No single server knows everything, so the answer comes through a chain:

The resolver goes through the root servers, then the .com servers, then the domain's name servers, and brings the address back to the browser.

Your browser asks the resolver, usually from your internet provider or a public service such as 1.1.1.1.
The resolver asks the root servers, which point it to the .com servers.
The .com servers point it to the domain's name servers.
The domain's name servers give the final answer.
The resolver returns the address to the browser and keeps it for the TTL, so the next person asking gets an instant answer.

These are the terms you'll come across:

Term	Meaning
Domain	`example.com`: the name you own
Subdomain	`blog.example.com`: a name under it
Registrar	The company you buy the name from
Hosted zone	The container holding a domain's records
Record	One entry: a name pointing to a value
TTL	How long a resolver may remember the answer

Route 53

Route 53 is AWS's DNS service, named after DNS's port 53. It has three jobs: holding your domain's records and answering for them, registering domains, and watching your application's health and directing visitors accordingly. AWS commits to 100% availability for it.

Hosted zones

Type	Answers whom	Example
Public	Anyone on the internet	`example.com`
Private	Only inside the VPCs you choose	`db.series.internal`

Each costs about half a dollar a month, plus a small charge for queries.

Record types

Type	Points to	Example
A	An IPv4 address	`blog.example.com` to `192.0.2.10`
AAAA	An IPv6 address	`blog.example.com` to `2001:db8::10`
CNAME	Another name	`www.example.com` to `example.com`
NS	The domain's name servers	`ns-1.awsdns-01.org`
MX	Mail servers	`mail.example.com`
TXT	Free text, such as proof of domain ownership	`v=spf1 ...`

CNAME or Alias?

Here's a common problem: a CNAME can't be used on the root domain example.com, yet you want it to point at your load balancer. The solution is an Alias, a special type in Route 53:

	CNAME	Alias
Points to	Any name	AWS resources such as ALB, CloudFront and API Gateway
Root domain	Not allowed	Allowed
Queries	Charged	Free for AWS resources
TTL	You set it	Route 53 sets it
Target health	Not followed	Can be followed

The rule is simple: if the target is on AWS, use an Alias. Note that it can't point to an EC2 server's DNS name.

Choosing a TTL

A long TTL: fewer queries and lower cost, but any change takes time to spread.
A short TTL: changes spread quickly, but queries increase.

Routing policies

"Routing" here doesn't mean traffic passes through Route 53. It only chooses which answer to give, and the visitor then connects directly to that address.

Policy	How it answers	Common use
Simple	One record, which can hold several values	A single server
Weighted	By percentages you set	Trying a new version on 10% of visitors
Latency	The Region with the lowest delay for the visitor	An application in several Regions
Failover	The primary while it's healthy, otherwise the secondary	Disaster recovery
Geolocation	By the visitor's country or continent	Language or content by country
Geoproximity	By distance, with each site's reach grown or shrunk	Gradually shifting traffic between areas
IP-based	By the visitor's IP range	Networks you know about
Multivalue	Up to 8 healthy records	Simple spreading, not a replacement for a load balancer

Health checks

For Failover and the others to work, Route 53 has to know who's healthy:

Type	How it checks
Endpoint	Checkers around the world request your address over HTTP, HTTPS or TCP
Calculated	Combines the results of several checks into one
CloudWatch alarm	Relies on an alarm, which is the solution for private resources

The checkers come from the internet, so they can't reach a server in a private network, and your security group has to allow their ranges if you're checking a public target.

A domain bought elsewhere

Buying a domain and managing its records are two separate things. If you bought yours from another company and want Route 53 to answer for it:

Create a public hosted zone with the domain's name.
Copy the four name servers from its NS record.
Paste them into the domain's settings at the company you bought it from.

Once the change spreads, Route 53 is the one answering.

If you have a network in your office, you can connect its DNS with AWS through Resolver endpoints: inbound lets your network ask about AWS's private names, and outbound lets AWS ask about your network's names. This needs a connection between the two networks, which is the subject of part fourteen.

Hands-on: weighted routing without buying a domain

A private hosted zone lets you try all this without a real domain. We'll use your web-1 server from part three, inside the default network. From CloudShell, create the private domain:

Bash

VPC_ID=$(aws ec2 describe-vpcs --filters Name=isDefault,Values=true \
  --query "Vpcs[0].VpcId" --output text)

ZONE_ID=$(aws route53 create-hosted-zone --name series.internal \
  --caller-reference "demo-$(date +%s)" \
  --vpc VPCRegion=$AWS_REGION,VPCId=$VPC_ID \
  --query HostedZone.Id --output text)

Now add two records for the same name, 80% for the old version and 20% for the new. The addresses are made up, because DNS only answers and doesn't connect to them:

Bash

CHANGES='{"Changes":[
  {"Action":"CREATE","ResourceRecordSet":{"Name":"app.series.internal","Type":"A","TTL":5,
    "SetIdentifier":"old","Weight":80,"ResourceRecords":[{"Value":"10.0.0.80"}]}},
  {"Action":"CREATE","ResourceRecordSet":{"Name":"app.series.internal","Type":"A","TTL":5,
    "SetIdentifier":"new","Weight":20,"ResourceRecords":[{"Value":"10.0.0.20"}]}}
]}'

aws route53 change-resource-record-sets \
  --hosted-zone-id "$ZONE_ID" --change-batch "$CHANGES"

Sign in to the server through EC2 Instance Connect and ask 20 times. It takes two minutes, because we wait for the TTL to expire each time:

Bash

sudo dnf install -y bind-utils

for i in $(seq 1 20); do
  dig +short app.series.internal
  sleep 6
done | sort | uniq -c

You'll see a split close to 16 and 4. Try dig +trace aws.amazon.com as well, and you'll see the chain from the diagram step by step.

If you have a domain, add an A record of the Alias kind pointing at your load balancer, and your site now has your name.

Bash

aws route53 change-resource-record-sets \
  --hosted-zone-id "$ZONE_ID" --change-batch "${CHANGES//CREATE/DELETE}"

aws route53 delete-hosted-zone --id "$ZONE_ID"

Summary

DNS turns a name into an address through a chain, and the answer is kept for the TTL.
Route 53 holds your records, and a hosted zone can be public or private.
If the target is on AWS, use an Alias, which works on the root domain.
Routing policies only choose the answer; traffic doesn't pass through them.
Health checks are what make Failover work.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 5

A bakery's site runs behind an Application Load Balancer, and the owner wants anyone typing the bare domain example.com to reach it. The load balancer's addresses can change at any time. Which record fits?

Show the answer

Correct answer: D

An Alias works on the root domain and follows the load balancer's changing addresses for you, and queries to AWS resources like this one are free.

A: A CNAME isn't allowed on the root domain.
B: Once the addresses change, the record points to the wrong place.
C: A TXT record holds free text, and browsers don't use it to find a server.

Review: CNAME or Alias? in this part, and Choosing between alias and non-alias records in the AWS docs.

Question 2 of 5

A streaming service runs in two Regions, Frankfurt and Bahrain. Its license requires visitors from Saudi Arabia to always get the Bahrain copy, even when Frankfurt would answer them faster. Which routing policy fits?

Show the answer

Correct answer: A

Geolocation chooses by where the visitor is rather than by speed, which is what a licensing rule needs.

B: This sends the visitor to the fastest Region, which could be Frankfurt.
C: This splits traffic by percentages, whatever the visitor's country.
D: This returns several healthy records, with no regard for country.

Review: Routing policies in this part, and Geolocation routing in the AWS docs.

Question 3 of 5

An internal application uses a Failover record in a private hosted zone. Its primary servers have only private addresses, and must stay that way. How should Route 53 learn whether the primary is healthy?

Show the answer

Correct answer: C

Route 53's checkers come from the internet, so they can't reach a private address. A CloudWatch alarm can watch a metric from the servers, and the health check follows the alarm.

A: The checkers are outside the network, and can't reach a private address.
B: This breaks the requirement that the servers stay private.
D: This only combines other checks, and those still can't reach the servers.

Review: Health checks in this part, and Configuring failover in a private hosted zone in the AWS docs.

Question 4 of 5

A startup bought its domain from another company and wants to keep the registration there, while Route 53 answers for the domain's records. What does it need to do?

Show the answer

Correct answer: B

Buying a name and answering for it are separate things. Once the registrar lists Route 53's name servers, Route 53 is the one answering.

A: A transfer is optional, and isn't needed to manage the records.
C: A private zone only answers inside the VPCs you choose, not for the public.
D: This lets an office network ask about private names, and has nothing to do with public answers.

Review: A domain bought elsewhere in this part, and Making Route 53 the DNS service for a domain that's in use in the AWS docs.

Question 5 of 5

A team wants to send 10% of visitors to a new version of its application, and to pull that traffic back within minutes if anything goes wrong. Which two steps fit? (Choose two.)

Show the answer

Correct answer: A + E

Weighted records split the answers by the shares you set, and a short TTL means a change reaches visitors quickly, since resolvers only remember an answer for that long.

B: This chooses by place, not by a share of visitors.
C: Resolvers would keep the old answer for up to a day, so going back would be slow.
D: A Simple record gives you no way to set a share.

Review: Routing policies and Choosing a TTL in this part, and Weighted routing in the AWS docs.

Your site now has a name, but its server is still in one place and the distant visitor is still waiting. In part twelve we bring it closer with CloudFront and Global Accelerator.

Which Database Should You Choose?

2026-11-02T00:00:00Z

In part eight and part nine we covered RDS, Aurora and ElastiCache. But open the AWS menu and you'll find more than ten database services, and that's where people get lost.

The right question isn't "what's the best database?", because there's no single answer. The question is: what suits this particular data?

Questions to start with

Before opening any service, answer these:

Question	Why it matters
What shape is the data?	Linked tables, varied documents, relationships or readings over time
How will you read it?	By key, with complex queries joining tables, by searching text or by aggregating millions of rows
How much reading versus writing?	Heavy reads can be solved with a cache and replicas; heavy writes need a different design
How big, and how fast is it growing?	Ordinary gigabytes, or data that grows without a ceiling
How accurate must it be?	A money transfer needs strict transactions; a like count can tolerate delay
How much can you manage?	A small team prefers a service that scales by itself
What does your team know?	Existing knowledge spares you many mistakes

Types of database

Type	Shape of the data	AWS service	Example
Relational	Linked tables and transactions	RDS and Aurora	Orders, accounts, invoices
Key-value	A value fetched by its key, at huge scale	DynamoDB	Carts and user profiles
Document	JSON with varied fields	DocumentDB and DynamoDB	Catalogs and content
In-memory	Fast data	ElastiCache and MemoryDB	Caching and sessions
Wide-column	Cassandra-style rows with heavy writes	Keyspaces	Existing Cassandra systems
Graph	Connections between things	Neptune	Social networks and fraud detection
Time series	Readings over time	Timestream for InfluxDB	Sensors and metrics
Search	Text you search inside	OpenSearch	Site search and logs
Analytics	Aggregation over huge data	Redshift	Management reports
Files	Files of any kind	S3 with Athena	Logs and archives

Relational or NoSQL?

This is the first decision, and the real difference is in how you think:

	Relational (SQL)	NoSQL
Design	Design the tables, then write any query	Define the queries first, then design around them
Queries	Flexible, with table joins	Limited, and fast along the path you designed
Transactions	Strong	Varies by service
Scaling	Reads are easy; writes usually mean a bigger server	Horizontal, with steady performance as it grows

Services you'll come across

DynamoDB: serverless key-value with steady performance at any size. We cover it in part twenty-one.
DocumentDB: documents compatible with MongoDB, which suits you if you're moving an existing MongoDB application.
MemoryDB: fast memory like Valkey but with durable data, so you can use it as a primary database and not just a cache.
Keyspaces: compatible with Apache Cassandra, with no servers to manage.
Neptune: for data whose value lies in relationships, such as "friends of my friends who bought this".
Timestream for InfluxDB: for sensor readings and metrics. The older LiveAnalytics edition is closed to new customers.
OpenSearch: text search and log analysis, usually a copy of your data rather than the main source.
Redshift: a data warehouse for huge reports. We cover it in part twenty-three.

How to decide

Go through the questions from top to bottom, and the first "yes" is your starting point:

Start at the top: each "yes" gives you a service to begin with, and if nothing applies, a relational database is the default.

This is a starting guide, not a law. One application usually uses more than one type, with each kind of data going where it fits.

A data layer that grows with your application

You don't need all this from day one. Imagine an online store growing over time:

Launch: a single RDS database is enough. Once you take real orders, turn on Multi-AZ.
More visitors, heavier reads: add ElastiCache for main pages and sessions.
Reports start slowing the site: send them to a read replica.
Product search is weak: add OpenSearch and fill it from the database.
Management wants years of analysis: move the data to S3 with Athena or Redshift.
Visitors from around the world: move to Aurora Global Database.

Each step came after a real problem you measured, not before it. Every extra service means more cost, more complexity and one more thing that can fail.

Common mistakes

Choosing NoSQL because it "scales": then discovering you need queries you didn't design for.
Running reports on the production database: one heavy query slows the whole site.
Storing files inside the database: put them in S3 and keep the link in the database.
Treating the cache as a source of truth: if it's lost, nothing important should go with it.
Multi-AZ in development: double the cost, usually for no benefit.

Summary

Ask about the shape of the data and how you'll read it before any service name.
Start relational unless you have a clear reason not to.
One application uses more than one type, with each kind of data going where it fits.
Add each service when you measure a real problem, not before.

Test yourself

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Question 1 of 5

A clinic is building a booking system with appointments, patients and payments. The data is linked, payments need strict transactions, and the small team doesn't yet know all the reports it will need. Where should it start?

Show the answer

Correct answer: B

Linked data, transactions and queries you can't fully predict all point to a relational database. It's the sensible default unless there's a clear reason otherwise.

A: You'd design around known queries up front, and new reports would be hard to add.
C: A cache isn't a source of truth, so it can't be where payments live.
D: Neptune suits deep webs of connections, not ordinary linked tables.

Review: Relational or NoSQL? in this part, and Choosing an AWS database service in the AWS docs.

Question 2 of 5

A social app wants to suggest "people you may know" by following friends of friends across several hops, with fast responses. Which service fits best?

Show the answer

Correct answer: D

The value here is in the relationships themselves, and Neptune is built to walk through large numbers of them with low latency.

A: This works for one or two hops, but joins get heavy as the hops increase.
B: You could store ready-made lists, but something still has to work them out.
C: This is for readings over time, and has nothing to do with relationships.

Review: Services you'll come across in this part, and Choosing an AWS database service in the AWS docs.

Question 3 of 5

Ten thousand sensors send a temperature reading every minute, and engineers want hourly averages for each sensor over the last week. Which service was built for this?

Show the answer

Correct answer: A

These are readings over time, which is what a time series database is built to store and aggregate.

B: This is for connections between things.
C: This is for JSON documents with varied fields.
D: This is mainly for searching text and analyzing logs.

Review: Types of database in this part, and What is Timestream for InfluxDB? in the AWS docs.

Question 4 of 5

A company wants to move an existing MongoDB application to a managed AWS service with the fewest code changes. Which service fits?

Show the answer

Correct answer: C

DocumentDB is compatible with MongoDB, so the application's document model and much of its code can stay as they are.

A: This has a different API and data model, so the data access code would be rewritten.
B: This is compatible with Cassandra, not MongoDB.
D: This is relational, so the documents would need redesigning as tables.

Review: Services you'll come across in this part, and What is Amazon DocumentDB? in the AWS docs.

Question 5 of 5

A sales team wants reports across five years of orders, which means billions of rows, and the queries must not slow down the production database. Which two approaches fit? (Choose two.)

Show the answer

Correct answer: B + E

Both move heavy analysis away from production. Redshift suits frequent, heavy reports, and Athena suits occasional questions without any servers to run.

A: One heavy query can still hurt anything else running then, and it's a relational database that isn't built for this scale of analysis.
C: A cache is a temporary copy, and far too small and costly for five years of data.
D: The standby in a Multi-AZ instance can't be read from.

Review: Common mistakes in this part, and What is Amazon Athena? in the AWS docs.

That completes the databases section. Your application now runs, scales and keeps its data safe, but how do visitors reach it by your site's name? That's the next section's subject, starting in part eleven with DNS and Route 53.

sultanops

Cost and Good Architecture

Where does the network money go? #

Where's the caching? #

Tools that watch your bill #

Quick savings #

The Well-Architected Framework #

CloudFormation: your infrastructure in a file #

Systems Manager: running your servers #

Applications you can't change #

Services worth knowing #

High performance computing #

Hands-on: a whole stack from a file, and a budget you'll keep #

Summary #

Test yourself #

What you've learned #

Where to go from here #

Disaster Recovery and Migration

RPO and RTO #

Four strategies #

Tips that make the difference #

AWS Backup: everything in one place #

Migrating databases: DMS #

Moving to RDS or Aurora #

Migrating servers and whole data centers #

Hands-on: delete the data and bring it back #

Summary #

Test yourself #

Encryption, Secrets and Threat Protection

AWS KMS: the key safe #

Envelope encryption #

Types of keys #

Key policies #

Multi-Region keys #

CloudHSM: your own hardware #

Where do you keep passwords? #

Parameter Store #

Secrets Manager #

ACM: certificates without the hassle #

Stopping attacks #

Withstanding DDoS #

Blocking one address: where? #

Detecting threats #

Compliance documents: AWS Artifact #

Hands-on: a key, a parameter and a secret #

Summary #

Test yourself #

Advanced Identity: Organizations and Identity Center

AWS Organizations #

Organization policies #

Service Control Policies (SCPs) #

Conditions in IAM policies #

A classic S3 mistake #

A role or a resource policy? #

Permissions boundaries #

How does AWS decide? #

IAM Identity Center: one sign-in #

Federation: identities from outside #

Active Directory on AWS #

AWS Control Tower #

Hands-on: testing policies without touching anything #

Summary #

Test yourself #

Monitoring and Auditing: CloudWatch, CloudTrail and Config

CloudWatch metrics #

CloudWatch Logs #

CloudWatch alarms #

Ready-made insights #

EventBridge: reacting to events #

CloudTrail: who did what #

AWS Config: your settings over time #

X-Ray: following one request #

Other views #

Which one, when? #

Hands-on: an alarm that emails you #

Summary #

Test yourself #

Ready-Made AI Services

Images: Rekognition #

Speech: Transcribe and Polly #

Where does the network money go?

Where's the caching?

Tools that watch your bill

Quick savings

The Well-Architected Framework

CloudFormation: your infrastructure in a file

Systems Manager: running your servers

Applications you can't change

Services worth knowing

High performance computing

Hands-on: a whole stack from a file, and a budget you'll keep

Summary

Test yourself

What you've learned

Where to go from here

RPO and RTO

Four strategies

Tips that make the difference

AWS Backup: everything in one place

Migrating databases: DMS

Moving to RDS or Aurora

Migrating servers and whole data centers

Hands-on: delete the data and bring it back

Summary

Test yourself

AWS KMS: the key safe

Envelope encryption

Types of keys

Key policies

Multi-Region keys

CloudHSM: your own hardware

Where do you keep passwords?

Parameter Store

Secrets Manager

ACM: certificates without the hassle

Stopping attacks

Withstanding DDoS

Blocking one address: where?

Detecting threats

Compliance documents: AWS Artifact

Hands-on: a key, a parameter and a secret

Summary

Test yourself

AWS Organizations

Organization policies

Service Control Policies (SCPs)

Conditions in IAM policies

A classic S3 mistake

A role or a resource policy?

Permissions boundaries

How does AWS decide?

IAM Identity Center: one sign-in

Federation: identities from outside

Active Directory on AWS

AWS Control Tower

Hands-on: testing policies without touching anything

Summary

Test yourself

CloudWatch metrics

CloudWatch Logs

CloudWatch alarms

Ready-made insights

EventBridge: reacting to events

CloudTrail: who did what

AWS Config: your settings over time

X-Ray: following one request

Other views

Which one, when?

Hands-on: an alarm that emails you

Summary

Test yourself

Images: Rekognition

Speech: Transcribe and Polly

Translate

Conversation: Lex and Connect

Text: Comprehend

Documents: Textract

Recommendations: Personalize

Search over your documents: what about Kendra?

Generative models: Amazon Bedrock