Domain 3 — Cloud Technology and Services

3.1 Ways of deploying and operating

Four ways to reach AWS

The distinction the exam draws is one-time versus repeatable. A task done once, by hand, exploring — the console. A thing that must be built identically in three environments — infrastructure as code. If a question stresses consistency, repeatability or eliminating configuration drift, the answer is CloudFormation.

Deployment models

• Cloud — everything runs in the cloud, built there or migrated there
• Hybrid — cloud resources connected to infrastructure you still run yourself. AWS Outposts places AWS infrastructure in your own data centre
• On-premises — your own facilities, sometimes called a private cloud

3.2 The global infrastructure

"An AWS Region is a physical location in the world where we have multiple Availability Zones. Availability Zones consist of one or more discrete data centers, each with redundant power, networking, and connectivity, housed in separate facilities."

Three levels, and the exam tests the relationships between them.

Region — a physical location containing multiple Availability Zones. You choose a Region for reasons the exam names explicitly: data sovereignty (law requiring data stay in a country), latency (be near your users), disaster recovery and business continuity, and price, which varies by Region.

Availability Zone — one or more discrete data centres inside a Region, each with its own power, networking and connectivity, in separate facilities. That separation is the point: Availability Zones do not share single points of failure. Running across several is how you get high availability, and it is the answer to almost any "how do I survive a data centre failure" question.

Edge location — where content is cached close to users. This is what Amazon CloudFront, the content delivery network, uses. Edge locations serve cached content with lower latency; they are not where your application runs.

The hierarchy to hold: Region contains Availability Zones; Availability Zones contain data centres; edge locations are separate and far more numerous.

Multiple Availability Zones give high availability inside one Region. Multiple Regions give disaster recovery, lower latency for distant users, and data sovereignty. A question about surviving a data centre fire is multi-AZ; a question about serving Europe and Asia, or about keeping data in one country, is multi-Region.

3.3 Compute

Amazon EC2 instance types

The instance type determines the hardware of the host. AWS groups current instance types into six families:

A question describing a workload is asking you to match it to a family.

Also worth knowing: burstable performance instances (the T family) provide a baseline CPU level with the ability to burst above it, governed by CPU credits — earned while below baseline, spent while bursting. Suitable for workloads that are quiet most of the time and occasionally busy: small websites, dev and test environments, code repositories.

How you pay for EC2 — the most examined table in this domain

AWS's own guidance on choosing, which is effectively the answer key:

• Can't commit to a configuration but can commit to spend → Savings Plans
• Need guaranteed capacity → Reserved Instances or Capacity Reservations
• Flexible about when it runs, and can tolerate interruption → Spot
• Compliance requirements, or existing server-bound licences → Dedicated Hosts or Dedicated Instances

The distinction that catches people: Savings Plans commit to money per hour, Reserved Instances commit to a configuration. Spot is about interruptibility, not commitment.

Containers and serverless

• Amazon ECS — AWS's own container orchestration
• Amazon EKS — managed Kubernetes, for teams already using Kubernetes
• Amazon ECR — the registry where container images are stored
• AWS Fargate — serverless compute for containers: run them without managing servers. Works with ECS and EKS
• AWS Lambda — run code without any server at all, billed for the time it runs, triggered by events

The confusion to avoid: Fargate is a way to run containers without servers; Lambda is a way to run code without containers or servers.

Scaling and load balancing

Auto Scaling adds and removes capacity as demand changes — this is what delivers elasticity in practice. A load balancer distributes incoming traffic across multiple targets, which serves both availability and scale. They work together: the load balancer spreads traffic, Auto Scaling changes how many things it is spread across.

Worth noting: the exam guide asks you to identify the purposes of load balancers, but Elastic Load Balancing is not on its in-scope service list. Expect the concept rather than the product name — a question about spreading traffic across instances, not about which ELB type to choose.

Other compute: AWS Elastic Beanstalk deploys and manages an application without you configuring the infrastructure; Amazon Lightsail is a simplified bundle for straightforward workloads; AWS Batch runs batch jobs; AWS Outposts puts AWS hardware in your own data centre.

3.4 Databases

Managed or on EC2

You can run a database yourself on an EC2 instance or use a managed service. AWS publishes the split, and it is worth learning as a table because it is the shared responsibility model applied to one service:

Read the middle column carefully: on EC2, AWS handles the hardware and you still handle the operating system and everything above it. That is the line the exam tests. AWS recommends RDS as the default for most relational deployments; choose EC2 only when you need control of the operating system or an engine RDS does not offer.

Multi-AZ deployments

A Multi-AZ deployment provisions a standby replica in a different Availability Zone and replicates to it synchronously. It exists for availability and failover, not for performance — in a Multi-AZ instance deployment the standby does not serve read traffic. Read replicas are the separate feature for scaling reads.

That distinction is a reliable exam question: Multi-AZ is for failover, read replicas are for read scaling.

The families

Migrating a database: AWS Database Migration Service (AWS DMS) moves the data, with the source staying usable during the move. AWS Schema Conversion Tool (AWS SCT) converts the schema when the target engine differs from the source. Same engine → DMS alone. Different engine → SCT then DMS.

3.5 Networking

The VPC

A VPC is your own logically isolated virtual network in AWS. Inside it:

• Subnets — ranges of IP addresses. Use them to separate the tiers of an application. Private subnets hold instances that should not be reachable from the internet directly
• Gateways — an internet gateway connects a VPC to the internet; a NAT gateway lets instances in a private subnet reach out without being reachable
• Route tables — which traffic goes where

Security groups against network ACLs — a guaranteed question

AWS's guidance: use security groups as the primary control; add network ACLs for stateless, coarse-grained control at the subnet boundary — as a secondary guard rail, and as defence in depth if an instance is ever launched without the right security group.

Two things to remember above all: security groups are stateful and allow-only; network ACLs are stateless and can deny.

Connecting and delivering

• Amazon Route 53 — DNS and domain registration; routes users to applications
• Amazon CloudFront — content delivery network using edge locations
• AWS VPN — encrypted connection over the public internet
• AWS Direct Connect — a dedicated private physical connection between your premises and AWS, not over the internet
• AWS PrivateLink — reach AWS services over private IP addresses without an internet gateway or NAT device
• AWS Transit Gateway — connects many VPCs and on-premises networks through one hub
• AWS Global Accelerator — improves availability and performance using the AWS global network

VPN against Direct Connect: VPN is encrypted over the public internet and quick to set up; Direct Connect is a dedicated physical link — consistent performance, longer to provision.

3.6 Storage

Three shapes of storage

• Object storage — Amazon S3. Whole objects in a flat namespace, reached over an API. For files, backups, static websites, data lakes
• Block storage — Amazon EBS volumes attached to an EC2 instance, and instance store, temporary storage on disks physically attached to the host. EBS persists independently of the instance; instance store does not
• File storage — Amazon EFS, a serverless, elastic file system using the NFS protocol, shared across EC2, ECS, EKS, Lambda and Fargate. It grows and shrinks automatically and comes in Regional (across several Availability Zones) and One Zone flavours. Note: EFS is not supported with Windows-based EC2 instances — that is what sends you to Amazon FSx, which offers Windows File Server, Lustre and others

Instance store — exactly when the data survives

"Lost when the instance stops" is the usual shorthand and it is not precise enough for the exam, because a reboot is different from a stop:

On stop, hibernate or terminate, every block is cryptographically erased.

Two more constraints: instance store volumes are attached only at launch — you cannot add one later — and you cannot detach one and move it to another instance. If data must outlive the instance, copy it to EBS, S3 or EFS.

The exam framing: instance store is for buffers, caches and scratch data. Anything valuable goes on EBS.

S3 storage classes

Every class is designed for the same 99.999999999% durability except Reduced Redundancy. What differs is availability, how many Availability Zones, minimum storage duration and retrieval cost.

Three traps:

1. S3 One Zone-IA and S3 Express One Zone are the only classes not resilient to losing an Availability Zone. Everything else survives it. 2. Glacier Flexible Retrieval and Deep Archive are not available in real time — you must restore an object before reading it. Glacier Instant Retrieval is millisecond access despite the Glacier name. 3. Intelligent-Tiering has no retrieval fees but does charge a small monitoring fee per object, and objects under 128 KB are never moved out of the Frequent Access tier.

Lifecycle policies and backup

Lifecycle policies move objects between classes automatically as they age — upload to Standard, transition to Standard-IA after 30 days, to Glacier after 90, delete after seven years. That is the intended answer whenever a question describes data that becomes less valuable over time.

AWS Backup centralises backup across services. AWS Storage Gateway gives on-premises applications cached access to cloud storage — the hybrid answer.

3.7 AI/ML and analytics

Machine learning — the pattern is that each service does one recognisable human task:

Transcribe and Polly are opposites and get swapped in questions: Transcribe listens, Polly speaks.

Analytics:

• Amazon Athena — SQL queries directly against data in S3, no server
• Amazon Kinesis — streaming data, in real time
• AWS Glue — extract, transform, load, and the data catalogue
• Amazon Quick Sight — dashboards and business intelligence
• Amazon Redshift — data warehouse, for large-scale analytics
• Amazon EMR — big data frameworks such as Spark and Hadoop
• Amazon OpenSearch Service — search and log analytics

A note on names. The exam guide's in-scope list writes Amazon Quick Sight as two words; the product pages write QuickSight as one. AWS is inconsistent with itself here, so recognise both and do not treat either spelling as a distractor. Amazon SageMaker AI is the current name in the exam guide's own list — older material calls it simply SageMaker.

3.8 The other categories

Messaging and integration — the trio that gets confused:

• Amazon SQS — a hosted queue that decouples distributed components. Messages are typically processed by a single subscriber, which suits workflows where order and not losing anything matter
• Amazon SNS — publishers send to topics, and multiple subscribers receive. Supported endpoints include SQS, Lambda, HTTP, email, SMS and mobile push. Suits immediate notifications and alarms
• Amazon EventBridge — an event bus routing events between AWS services and applications by rule
• AWS Step Functions — coordinates several services into a workflow

AWS's own comparison: SNS does publisher-subscriber messaging and has no queues; SQS has queues and does not do publisher-subscriber.

The pattern worth recognising is fanout: SNS publishes to a topic, and several SQS queues subscribe to it. One message reaches many consumers, and the queues mean nothing is lost while a consumer is offline. A question describing "notify several systems, and none of them may miss a message" is describing SNS and SQS together, not one or the other.

Queue = SQS. Notify many = SNS. Both together = fanout. Route by rule = EventBridge.

Business applications — Amazon Connect (cloud contact centre), Amazon SES (sending email).

Developer tools — AWS CodeBuild (compiles and tests), AWS CodePipeline (the CI/CD pipeline), AWS X-Ray (traces a request through a distributed application to find where it slowed down).

End-user computing — Amazon WorkSpaces (virtual desktops), Amazon AppStream 2.0 (streams a single application), Amazon WorkSpaces Secure Browser (a browser delivered as a service).

Frontend and mobile — AWS Amplify builds and deploys frontend and mobile applications.

IoT — AWS IoT Core connects and manages devices.

Customer enablement — AWS Support, covered in Domain 4.

Practise this with AWS Cloud Practitioner questions

More of this guide