Solutions Architecture

Every single thing that happens in AWS — launching a server, reading a file, deleting a database — starts with the same two questions: who are you? and are you allowed to do that? IAM (Identity and Access Management) is the service that…

• Users, groups, roles
• Policy JSON anatomy
• How AWS decides yes or no
• The policy types table
• STS and roles: how the costume gets put on
• Cross-account access
• IAM Identity Center (the artist formerly known as AWS SSO)
• MFA and the root account

Real companies don't run one AWS account — they run dozens: one per team, per environment, per project, because accounts are the strongest isolation boundary AWS offers. AWS Organizations is how you herd them: one management account at t…

• Core concepts

First, what is Active Directory? If you've never worked in a Windows shop: Active Directory (AD) is Microsoft's on-premises system that acts as the corporate phonebook plus the master keyring. It stores every user, computer, and group in…

• The three options (the table to memorize)
• How the exam distinguishes them
• The common pairing pattern

• 1. Overview
• 2. AWS Responsibility: "Security OF the Cloud"

• Boxes in boxes
• Public vs private: it's all about the route

• WAF — the Layer 7 bouncer
• Shield — the riot police (DDoS)

• The core distinction (THE thing to know)
• The classic flow (draw this in your head)

• Secrets Manager — rotation is the whole point
• Parameter Store (SSM Parameter Store) — free and hierarchical

• Site-to-Site VPN
• Direct Connect (DX)

• KMS key types
• Envelope encryption — the ≤4KB rule

• CloudWatch — "how is it doing?"
• CloudTrail — "WHO did WHAT?"

• OSI layers in 60 seconds (you need this to pick the right LB)
• The four load balancers

• Three API types
• Endpoint types (where does it live?)

• SQS — the mailbox (queue, PULL, one message → ONE worker)
• SNS — the megaphone (PUSH, one → MANY)

• EventBridge: the event router of AWS
• Step Functions: the workflow orchestrator

• Hard limits — where half the traps live
• Three ways a Lambda gets invoked

• ECS vocabulary — learn these four words cold
• Launch types: EC2 vs Fargate

• Record types
• Hosted zones

• Backups & encryption
• RDS Proxy

• The four strategies
• The supporting cast

• Template anatomy (know the section names)
• Features → scenarios (this is the exam meat)

• Storage classes and THE 3-filter algorithm
• The two "special" classes and their exact signals

• EBS: your network-attached hard drive
• EFS: the shared network folder

• The four specialists
• FSx for Windows File Server

• Instance families: which car?
• Purchasing options: which contract?

• THE tested table: deployment policies
• THE RDS trap

• DynamoDB vs RDS — the first fork in every question
• Keys and hot partitions

• Redis vs Memcached — the only table you need
• The session store pattern

• OLTP vs OLAP
• The zoo — one call each

• CloudFront (CDN — Content Delivery Network)
• Global Accelerator

• What you can attach
• Cost reality check

• Storage Gateway — the ongoing hybrid bridge
• DataSync — the moving company

• The device lineup
• The process

• The tool zoo

• Trusted Advisor's five pillars

• The six pillars
• The exam angle (this is the real payoff)

• The greatest-hits trap list
• Must-know combos (the exam's favorite Lego sets)

• Migration & messaging
• Certificates & network odds-and-ends