---
# System prepended metadata

title: Learning Notes for AWS Certified Cloud Practitioner (CLF-C02)

---

<!-- 
<b style="color: #BE77FF"></b> 
<b style="color: #7D7DFF"></b>
-->

# Learning Notes for AWS Certified Cloud Practitioner (CLF-C02)

> [!Important] 
> This is the learning notes from [AWS Skill Builder Exam Prep Plan: AWS Certified Cloud Practitioner (CLF-C02 - English)](https://skillbuilder.aws/learning-plan/8UUCEZGNX4/exam-prep-plan-aws-certified-cloud-practitioner-clfc02--english/1J2VTQSGU2), written by me at 2025. Some details might change over time, but the core concepts and services should not.

> [!Note]
> This note includes additional explanations and wording refinements generated with the help of GPT, it's not entirely self-created.

<br>

## Table of contents
This note covers the four domains from the course, along with some additional research and notes I made:

- **<div style="color: #BE77FF">Domain 1</div>** Cloud Concepts
- **<div style="color: #BE77FF">Domain 2</div>** Security and Compliance
- **<div style="color: #BE77FF">Domain 3</div>** Cloud Technology and Services
- **<div style="color: #BE77FF">Domain 4</div>** Billing, Pricing, and Support
- **<div style="color: #BE77FF">AWS Services</div>**


<br>

## <b style="color: #BE77FF">Domain 1</b> Cloud Concepts

### What is Cloud for
- Cloud computing provides on-demand access to computing power, storage, and other IT resources through a cloud provider.
- It allows us to deploy applications and services without having to manage the underlying hardware or physical infrastructure ourselves.

<hr>

### The five main concepts of Cloud Computing
The following are the main concepts of a Cloud Computing:

- <b style="color: #7D7DFF">On-demand service</b>
Able to quickly get computing resources whenever needed, without waiting or long setup.
- <b style="color: #7D7DFF">Access to the network</b>
Cloud services are reachable over the internet, we're able to use them anytime, anywhere.
- <b style="color: #7D7DFF">Resource pooling</b>
The provider shares a pool of servers and storage among many users, while still keeping each user’s data separate.
- <b style="color: #7D7DFF">Elasticity</b>
Resources can automatically scale up when demand increases and scale down when demand drops.
- <b style="color: #7D7DFF">Resource usage monitored and billed</b>
The usage is tracked, and we only pay for what we actually consume.

<hr>

### Proper Nouns related to Cloud Computing

- <b style="color: #7D7DFF">High availability</b>
If one machine or service goes down, another is ready to take over, keeping downtime to a minimum.
- <b style="color: #7D7DFF">Fault tolerance</b>
Multiple machines run together, so if the main one fails, others continue the work without interruption.
- <b style="color: #7D7DFF">Disaster recovery</b>
A planned process to restore services and data after a major failure or outage.

<hr>

### Scaling
The scaling in Cloud Computing appears in two forms: <b style="color: #CA8EFF">vertical</b> and <b style="color: #CA8EFF">horizontal</b>.
- <b style="color: #7D7DFF">Vertical scaling</b> means increasing the capacity of a single machine, such as adding more CPU, RAM, or storage to handle greater workloads.
- <b style="color: #7D7DFF">Horizontal scaling</b> means adding more machines or instances to distribute the workload across multiple resources(using load balancer).
![Screenshot 2025-09-09 at 1.58.48 PM](https://hackmd.io/_uploads/rJPXMSp5ee.png)

<hr>

### AWS Cloud Adoption Framework
The benefit of migrating to AWS is that it provides <b style="color: #B15BFF">7R strategies</b> for moving workloads to the cloud:
1. <b style="color: #7D7DFF">Rehosting</b> (Lift and Shift) – Move applications to AWS without major changes. Quickest migration method.
2. <b style="color: #7D7DFF">Replatforming</b> (Lift, Tinker, and Shift) – Make some optimizations (e.g., database migration) without changing the core architecture.
3. <b style="color: #7D7DFF">Repurchasing</b> (Drop and Shop) – Replace existing applications with a SaaS solution.
4. <b style="color: #7D7DFF">Refactoring / Re-architecting</b> – Redesign applications to take full advantage of cloud-native features.
5. <b style="color: #7D7DFF">Retire</b> – Decommission applications that are no longer useful.
6. <b style="color: #7D7DFF">Retain</b> (Revisit) – Keep certain applications on-premises temporarily or indefinitely.
7. <b style="color: #7D7DFF">Relocate</b> – Move applications to AWS using VMware Cloud on AWS or similar tools with minimal changes.

<hr>

### Cloud Economics
When using AWS, there are four main types of costs:

- <b style="color: #7D7DFF">Operational expenses(OpEx)</b> – The day-to-day costs of running services, like paying for servers, storage, and bandwidth.
- <b style="color: #7D7DFF">Capital expenses(CapEx)</b> – Big upfront costs, like buying our own hardware or building a data center.
- <b style="color: #7D7DFF">Labor costs</b> – The money you spend on people, such as IT staff or cloud engineers, to manage and maintain your systems.
- <b style="color: #7D7DFF">Software licensing costs</b> – Fees for software needed to run, like databases, operating systems, or other commercial applications.

> [!Tip] 
> By using AWS, most CapEx is already covered by AWS.

<hr>

### AWS Cloud Adoption Framework(<b style="color: #CA8EFF">AWS CAF</b>)
CAF helps organizations adopt cloud successfully by looking at both business and technical aspects. It has six Perspectives:
- <b style="color: #7D7DFF">Business</b> – Align cloud adoption with business goals.
- <b style="color: #7D7DFF">People</b> – Build skills and manage organizational change.
- <b style="color: #7D7DFF">Governance</b> – Manage finance, compliance, and risk.
- <b style="color: #7D7DFF">Platform</b> – Plan and build the cloud infrastructure.
- <b style="color: #7D7DFF">Security</b> – Protect data, manage identities, and reduce risk.
- <b style="color: #7D7DFF">Operations</b> – Keep systems running, automate, and improve continuously.

<hr>

### AWS Well-Architected Framework (<b style="color: #CA8EFF">AWS WAF</b>)
WAF provides best practices to design secure, reliable, and efficient systems in AWS. It has six Pillars:
- <b style="color: #7D7DFF">Operational Excellence</b> – Improve operations with automation and monitoring.
- <b style="color: #7D7DFF">Security</b> – Safeguard data, applications, and systems.
- <b style="color: #7D7DFF">Reliability</b> – Design for fault tolerance and quick recovery.
- <b style="color: #7D7DFF">Performance Efficiency</b> – Use resources effectively and scale as needed.
- <b style="color: #7D7DFF">Cost Optimization</b> – Avoid unnecessary costs, pay only for what you use.
- <b style="color: #7D7DFF">Sustainability</b> – Reduce environmental impact through efficient usage.

<br>

## <b style="color: #BE77FF">Domain 2</b> Security and Compliance

### AWS Shared Responsibility Model

In AWS, user is responsible for security <b style="color: #7D7DFF">IN</b> the cloud, and AWS is responsible for security <b style="color: #7D7DFF">OF</b> the cloud.
![Screenshot 2025-09-10 at 4.55.20 PM](https://hackmd.io/_uploads/HyEz6n09ex.png)

- AWS is responsible for security of the cloud, which includes <b style="color: #7D7DFF">managing and protecting the physical infrastructure</b>, <b style="color: #7D7DFF">global network</b>, and core services like <b style="color: #7D7DFF">compute</b>, <b style="color: #7D7DFF">storage</b>, and <b style="color: #7D7DFF">databases</b>. 
- Custumor are responsible for security in the cloud, which covers their <b style="color: #7D7DFF">data</b>, <b style="color: #7D7DFF">applications</b>, <b style="color: #7D7DFF">access management</b>, <b style="color: #7D7DFF">system configurations</b>, and <b style="color: #7D7DFF">encryption settings</b>.

> [!Important]
> While AWS manages many security aspects, not all services are fully managed. For example, using Amazon EC2 requires customers to handle OS patching, firewall settings, and application security themselves. 
> We should check the shared responsibility model for each service to know which parts AWS covers and which parts we must managed by ourselves.

<hr>

### Cloud Security, Governance, and Compliance
- <b style="color: #7D7DFF">Cloud security</b> ensures the protection of data, applications, and infrastructure in the cloud.
- <b style="color: #7D7DFF">Governance</b> provides control and visibility over cloud resources, ensuring they are used according to organizational policies. 
- <b style="color: #7D7DFF">Compliance</b> ensures that workloads in AWS meet industry regulations and standards.

<hr>

### Access Management Capabilities
The most important access management capability in AWS is <b style="color: #7D7DFF">Identity and Access Management(IAM)</b>. IAM provides the ability to manage different users’ roles, policies, and groups, allowing them to perform corresponding actions. Here’s the definition of IAM components:
- <b style="color: #7D7DFF">IAM user</b>: An individual user created under IAM.
- <b style="color: #7D7DFF">IAM group</b>: A collection of IAM users that can be managed as a single entity.
- <b style="color: #7D7DFF">IAM policy</b>: A document that defines permissions and specifies what actions are allowed or denied.
- <b style="color: #7D7DFF">IAM role</b>: An IAM identity that can be assumed by trusted entities to gain temporary access to permissions.

<hr>

### Managed & Unmanaged Policies
Policies in AWS IAM contain two types: <b style="color: #7D7DFF">managed</b> and <b style="color: #7D7DFF">unmanaged</b>. 
- <b style="color: #7D7DFF">Managed policies</b> are typically predefined policy sets created by AWS.
- <b style="color: #7D7DFF">Unmanaged (inline) policies</b> are created by an IAM administrator or root user to meet specific needs for particular users.

<hr>

### Virtual Private Cloud (VPC)
A <b style="color: #7D7DFF">Virtual Private Cloud(VPC)</b> is a virtual network in AWS where we can launch AWS resources, such as EC2 instances, in an isolated and secure environment. It is logically isolated from other virtual networks in AWS.

A VPC can be divided into subnets to organize resources. For controlling network traffic, Security Groups act as a whitelist (allow rules only), and any traffic not explicitly allowed is denied by default. If explicitly deny specific traffic is needed, we must use a <b style="color: #7D7DFF">Network Access Control List(NACL)</b>.

<hr>

### Additional places to know better for AWS security
In order to move further in AWS security, places like <b style="color: #7D7DFF">AWS Marketplace</b> or <b style="color: #7D7DFF">AWS Knowledge Center</b> are good for getting more information. It is also recommended to view AWS Forums to get a better understanding of real-world use cases, troubleshooting tips, and best practices shared by the AWS community.

<br>

## <b style="color: #BE77FF">Domain 3</b> Cloud Technology and Services

### Methods of deployment and operating in AWS Cloud

- <b style="color: #7D7DFF">Public Cloud</b>
Provides services that are **publicly available** for anyone to use, such as AWS EC2, S3, or Lambda.
- <b style="color: #7D7DFF">Private Cloud</b>
Dedicated services that are **hosted on-premises or in a private network**, giving full control over infrastructure and security.
- <b style="color: #7D7DFF">Hybrid Cloud</b>
A hybrid cloud is a **combination of public and private clouds**, allowing workloads to run across both environments while sharing data and applications.
- <b style="color: #7D7DFF">Multi Cloud</b>
Multi-cloud is similar to public cloud but **uses multiple public cloud providers simultaneously**, which can improve redundancy, flexibility, and avoid vendor lock-in.
<hr>

### Global Infrastructure
AWS offers **globally resilient services, regional resilient services, and zonal resilient services.**

- <b style="color: #7D7DFF">Globally resilient services</b>
Services that operate across multiple regions and are not tied to one location.
Example: IAM, Route 53, CloudFront.
- <b style="color: #7D7DFF">Regional resilient services</b>
Services that are deployed within a region and automatically spread across multiple Availability Zones for durability.
Example: S3, DynamoDB, Amazon VPC.
- <b style="color: #7D7DFF">Zonal resilient services</b>
Services that run within a single Availability Zone, and if that AZ fails, the service is impacted unless configured for redundancy.
Example: EC2 instance, EBS volume.
<hr>

### AWS Global Accelerator
AWS Global Accelerator is a networking service that improves availability and performance of applications with users distributed globally.
- Uses the AWS global network to route traffic to the nearest healthy endpoint (EC2, ALB, NLB, etc.).
- Provides two static IP addresses that act as a fixed entry point to your application.
- Focus on improvesing performance for non-HTTP/S applications (like TCP/UDP traffic, gaming, VoIP, IoT).
> [!Important] Difference in Global Accelerator v.s. CloudFront
> **CloudFront**
> - Optimized for HTTP/S content delivery.
> - Best for caching and accelerating web content.
> - Uses changing domain names.
> 
> **Global Accelerator**
> - Works for any TCP/UDP traffic.
> - Best for applications needing low-latency networking, especially non-HTTP.
> - Global Accelerator → Gives two static IPs for stable entry points.
<hr>

### VPC Endpoint
A VPC endpoint enables private connections between VPC and supported AWS services, without requiring an internet gateway, NAT device, VPN, or Direct Connect. Traffic stays within the AWS network, not over the public internet. There are two types of endpoint:
- Interface Endpoint → powered by PrivateLink, creates an ENI in the subnet.
- Gateway Endpoint → target for a specific route table, currently supports Amazon S3 and DynamoDB.
<hr>

### Cloud Storage
AWS offers three main types of storage services, each optimized for different use cases:
- <b style="color: #7D7DFF">Object storage</b>: Stores data as objects (files + metadata). It is highly scalable, durable, and ideal for unstructured data.
- <b style="color: #7D7DFF">File storag</b>: Provides shared file-level storage that multiple instances can access via standard file protocols (NFS/SMB).
- <b style="color: #7D7DFF">Block storage</b>: Attaches volumes at the block level to EC2 instances (like virtual hard drives).
<hr>

### AWS Storage Gateway
AWS Storage Gateway is a <b style="color: #7D7DFF">hybrid cloud storage service</b> that connects on-premises environments with AWS cloud storage. It allows local applications to access AWS storage in a seamless way. There are three main types of models:
- <b style="color: #7D7DFF">File Gateway</b> → Stores and retrieves objects in Amazon S3 using standard file protocols (NFS/SMB).
- <b style="color: #7D7DFF">Volume Gateway</b> → Presents cloud-backed iSCSI block storage volumes; can be cached (frequent data local, rest in AWS) or stored (entire dataset local, backup in AWS).
- <b style="color: #7D7DFF">Tape Gateway</b> → Replaces physical tape libraries with virtual tapes in Amazon S3/Glacier, often for backups and archiving.

<br>

## <b style="color: #BE77FF">Domain 4</b> Billing, Pricing, and Support

### AWS cost optimization
There are several most important notes for AWS cost optimization:
- <b style="color: #7D7DFF">Right-sizing</b>
- <b style="color: #7D7DFF">Increasing elasticity</b>
- <b style="color: #7D7DFF">Choose the right pricing model</b>

### Different pricing models in AWS
The main AWS pricing models are the following, each designed for different usage patterns and workloads:
- <b style="color: #7D7DFF">Reserved Instances (RIs)</b>:
    - Commit to use an instance type in a <b style="color: #7D7DFF">specific region</b> for 1 or 3 years.
    - Up to 72% cheaper than On-Demand.
    - Best for steady-state workloads (e.g., databases, long-running apps).
- <b style="color: #7D7DFF">On-Demand Instance</b>:
    - Pay by the second or hour with <b style="color: #7D7DFF">no long-term</b> commitment.
    - Flexible, easy to start/stop.
    - Best for <b style="color: #7D7DFF">short-term</b>, unpredictable, or testing workloads.
- <b style="color: #7D7DFF">Spot Instance</b>:
    - Use <b style="color: #7D7DFF">spare AWS capacity</b> at up to 90% discount.
    - Instance may be terminated if capacity is needed back.
    - Best for <b style="color: #7D7DFF">fault-tolerant</b>, flexible workloads (e.g., big data, batch jobs, CI/CD).
- <b style="color: #7D7DFF">Dedicated instances</b>:
    - Run on hardware dedicated to a single customer, but may share host hardware with other instances from the same account.
    - Best for <b style="color: #7D7DFF">compliance or licensing requirements</b>.
- <b style="color: #7D7DFF">Capacity reaervations</b>:
    - Reserve capacity in a <b style="color: #7D7DFF">specific AZ</b> without long-term commitment.
    - Best for <b style="color: #7D7DFF">short-term</b>, business-critical events that require guaranteed capacity.
- <b style="color: #7D7DFF">Dedicated hosts</b>:
    - Physical servers fully dedicated.
    - Provides visibility into sockets/cores → useful for software licensing (BYOL).
    - Best for compliance-heavy workloads requiring physical isolation.
<br>

## <div style="color: #BE77FF">AWS Services</div>
<!-- Storage -->
### <img src="https://icon.icepanel.io/AWS/svg/Storage/Snowball-Edge.svg" style="min-width:15px; max-width:30px;" /> AWS Snowball Edge
AWS Snowball Edge is a <b style="color: #7D7DFF">data transfer</b> and <b style="color: #7D7DFF">edge computing</b> device that helps organizations move large amounts of data into and out of AWS securely. It is designed to handle data migration and edge processing in environments where network connectivity is limited or unreliable.
- Used for <b style="color: #7D7DFF">petabyte-scale</b> data migration to and from AWS without relying solely on the internet.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Storage/Snowcone.svg" style="min-width:15px; max-width:30px;" /> AWS Snowcone
A small, portable <b style="color: #7D7DFF">edge computing</b> and <b style="color: #7D7DFF">data transfer</b> device for rugged or constrained environments.
- <b style="color: #7D7DFF">Smallest</b> in the AWS Snow Family.
- Storage capacity: <b style="color: #7D7DFF">8TB HDD</b> or <b style="color: #7D7DFF">14TB SSD</b>.
- Data can be <b style="color: #7D7DFF">shipped physically</b> or <b style="color: #7D7DFF">transferred online</b> with AWS DataSync.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Storage/Snowmobile.svg" style="min-width:15px; max-width:30px;" /> AWS Snowmobile
A <b style="color: #7D7DFF">petabyte-scale</b> data transfer service where AWS delivers a <b style="color: #7D7DFF">secure truck-sized storage container</b> to migrate extremely large amounts of data into AWS.
- Used for <b style="color: #7D7DFF">exabyte-scale data</b> migration (up to 100 PB per Snowmobile).
- Tamper-resistant and GPS-tracked during transport.

<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Storage/Simple-Storage-Service.svg" style="min-width:15px; max-width:30px;" /> AWS S3 (Simple Storage Service)
Amazon S3 is an <b style="color: #7D7DFF">object storage service</b> that provides <b style="color: #7D7DFF">highly scalable</b>, <b style="color: #7D7DFF">durable</b>, and <b style="color: #7D7DFF">secure storage</b> for any amount of data. It is often used for backups, static website hosting, data lakes, and application data storage.
- Virtually <b style="color: #7D7DFF">unlimited</b> storage capacity.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Storage/Elastic-Block-Store.svg" style="min-width:15px; max-width:30px;" /> Amazon EBS (Elastic Block Store)
Amazon EBS provides <b style="color: #7D7DFF">block-level storage</b> volumes for use with Amazon EC2 instances. It is designed for workloads that require persistent storage and low-latency performance.
- Can create <b style="color: #7D7DFF">snapshots</b> to back up volumes to Amazon S3.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Storage/EFS.svg" style="min-width:15px; max-width:30px;" /> Amazon EFS (Elastic File System)
Amazon EFS provides <b style="color: #7D7DFF">scalable file storage</b> that can be mounted on multiple EC2 instances at the same time. It is fully managed and grows/shrinks automatically with storage usage.
- Scales <b style="color: #7D7DFF">automatically</b>.
- <b style="color: #7D7DFF">Serverless</b>.
- Gives EC2 instances the ability to <b style="color: #7D7DFF">share access</b> to data in different Availability Zones in the same AWS Region.
<hr>

<!-- Database -->
### <img src="https://icon.icepanel.io/AWS/svg/Database/RDS.svg" style="min-width:15px; max-width:30px;" /> Amazon RDS (Relational Database Service)
Amazon RDS is a managed <b style="color: #7D7DFF">relational database</b> service that supports multiple database engines such as MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server.
- <b style="color: #7D7DFF">Traditional</b> relational database with managed operations.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Database/Aurora.svg" style="min-width:15px; max-width:30px;" /> Amazon Aurora
Amazon Aurora is a <b style="color: #7D7DFF">MySQL-compatible</b> and <b style="color: #7D7DFF">PostgreSQL-compatible</b> relational database built by AWS for high performance and availability.
- 5x faster than MySQL and 3x <b style="color: #7D7DFF">faster than</b> PostgreSQL on the same hardware.
- Automatically replicates data across multiple AZs.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Database/DynamoDB.svg" style="min-width:15px; max-width:30px;" /> Amazon DynamoDB
Amazon DynamoDB is a fully managed <b style="color: #7D7DFF">NoSQL database</b> that provides <b style="color: #7D7DFF">single-digit millisecond performance</b> at any scale.
- <b style="color: #7D7DFF">Key-value</b> and <b style="color: #7D7DFF">document-based</b> storage.
- <b style="color: #7D7DFF">Serverless</b> (scales automatically, no servers to manage).
- The best caching product to use with DynamoDB is <b style="color: #7D7DFF">DAX</b>.
<hr>

<!-- Compute -->
### <img src="https://icon.icepanel.io/AWS/svg/Compute/Lightsail.svg" style="min-width:15px; max-width:30px;" /> AWS Lightsail
Amazon Lightsail is a <b style="color: #7D7DFF">simplified cloud platform</b> for <b style="color: #7D7DFF">small applications</b>, offering <b style="color: #7D7DFF">compute</b>, <b style="color: #7D7DFF">storage</b>, and <b style="color: #7D7DFF">networking</b>.
- Provides easy-to-launch virtual servers with pre-configured OS and apps.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Compute/EC2.svg" style="min-width:15px; max-width:30px;" /> Amazon EC2
Amazon EC2 is a <b style="color: #7D7DFF">virtual machine</b> launched on AWS hardware. AWS takes care of the hardware, whereas we focus on setting up Amazon EC2 to match the application needs.
- Supports a wide range of instance types optimized for <b style="color: #7D7DFF">compute</b>, <b style="color: #7D7DFF">memory</b>, <b style="color: #7D7DFF">storage</b>, or <b style="color: #7D7DFF">GPU</b>.
- Integrated with other AWS services (e.g., <b style="color: #7D7DFF">VPC</b>, <b style="color: #7D7DFF">EBS</b>, <b style="color: #7D7DFF">IAM</b>, <b style="color: #7D7DFF">CloudWatch</b>).
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Containers/Elastic-Container-Service.svg" style="min-width:15px; max-width:30px;" /> Amazon ECS (Elastic Container Service)
Amazon ECS is AWS’s <b style="color: #7D7DFF">native container orchestration service</b> for running and managing <b style="color: #7D7DFF">Docker containers</b>.
- AWS-native experience — simpler to set up and manage compared with Kubernetes.
- Integrates with <b style="color: #7D7DFF">ALB/NLB</b>, <b style="color: #7D7DFF">CloudWatch</b>, <b style="color: #7D7DFF">IAM</b>, and <b style="color: #7D7DFF">Service Discovery</b>.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Containers/Elastic-Kubernetes-Service.svg" style="min-width:15px; max-width:30px;" /> Amazon EKS (Elastic Kubernetes Service)
Amazon EKS is a managed <b style="color: #7D7DFF">Kubernetes service</b> that provides a managed control plane for running upstream Kubernetes on AWS. It lets teams run standard <b style="color: #7D7DFF">Kubernetes clusters</b> (kubectl, Helm, operators) while integrating with AWS compute (EC2 or Fargate), networking, and IAM.
- Worker nodes can be EC2 instances that managed or run on Fargate for serverless node management.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Compute/Lambda.svg" style="min-width:15px; max-width:30px;" /> AWS Lambda
AWS Lambda is a <b style="color: #7D7DFF">serverless compute service</b> that lets you run code without provisioning or managing servers.
- Executes code in <b style="color: #7D7DFF">response to events</b>, such as <b style="color: #7D7DFF">S3 uploads</b>, <b style="color: #7D7DFF">DynamoDB updates</b>, or <b style="color: #7D7DFF">API Gateway requests</b>.
- Integrates with many AWS services, enabling <b style="color: #7D7DFF">serverless architectures</b>.
<hr>


<!-- Analytics -->
### <img src="https://icon.icepanel.io/AWS/svg/Analytics/QuickSight.svg" style="min-width:15px; max-width:30px;" /> AWS QuickSight
Amazon QuickSight is a business intelligence(BI) service for creating visualizations, dashboards, and reports.
- Can connect to multiple data sources (S3, RDS, Redshift, etc.).
- Supports interactive dashboards and data analysis.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Analytics/Athena.svg" style="min-width:15px; max-width:30px;" /> Amazon Athena
A serverless interactive query service to analyze data directly in Amazon S3 using SQL.
- No infrastructure to manage, pay-per-query.
- Supports standard SQL queries.
- Common use case: ad-hoc analysis of S3 data (CSV, JSON, Parquet).
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Analytics/Kinesis.svg" style="min-width:15px; max-width:30px;" /> Amazon Kinesis
A real-time data streaming service for collecting, processing, and analyzing streaming data.
- Kinesis Data Streams → capture real-time data (logs, IoT, clickstreams).
- Kinesis Data Firehose → load data into S3, Redshift, Elasticsearch
- Kinesis Data Analytics → SQL queries on streaming data.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Analytics/Glue.svg" style="min-width:15px; max-width:30px;" /> AWS Glue
A serverless data integration (ETL) service for preparing and transforming data.
- Automates ETL (Extract, Transform, Load).
- Glue Data Catalog → metadata store for analytics.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Analytics/Redshift.svg" style="min-width:15px; max-width:30px;" /> Amazon Redshift
Amazon Redshift is a fully managed data warehouse service for <b style="color: #7D7DFF">analyzing large volumes of structured data</b> using SQL.
- Optimized for analytics and reporting, not transaction processing.
- Can <b style="color: #7D7DFF">handle petabyte-scale data</b>.
- Integrates with <b style="color: #7D7DFF">business intelligence(BI)</b> tools.
<hr>

<!-- Security Identity Compliance -->
### <img src="https://icon.icepanel.io/AWS/svg/Security-Identity-Compliance/Identity-and-Access-Management.svg" style="min-width:15px; max-width:30px;" /> Identity and Access Management(IAM)
IAM is the most important access management service in AWS. It allows us to manage <b style="color: #7D7DFF">users</b>, <b style="color: #7D7DFF">groups</b>, <b style="color: #7D7DFF">roles</b>, and <b style="color: #7D7DFF">policies</b>, giving them appropriate permissions to perform specific actions. IAM is essential for security, governance, and compliance in AWS.
- Access is controlled through <b style="color: #7D7DFF">policies</b> attached to users, groups, or roles.
- IAM roles are commonly used for <b style="color: #7D7DFF">cross-account access</b>, EC2 instances, or Lambda functions.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Security-Identity-Compliance/GuardDuty.svg" style="min-width:15px; max-width:30px;" /> AWS GuardDuty
Amazon GuardDuty is a <b style="color: #7D7DFF">threat detection</b> service that continuously monitors AWS accounts, workloads, and data stored in <b style="color: #7D7DFF">Amazon S3</b> for malicious or unauthorized activity.
- The ways it detect threat contains <b style="color: #7D7DFF">machine learning</b>, <b style="color: #7D7DFF">anomaly detection</b>, and <b style="color: #7D7DFF">threat intelligence</b>.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Security-Identity-Compliance/Macie.svg" style="min-width:15px; max-width:30px;" /> AWS Macie
Amazon Macie is a <b style="color: #7D7DFF">data security</b> and privacy service that uses machine learning to <b style="color: #7D7DFF">discover</b>, <b style="color: #7D7DFF">classify</b>, and <b style="color: #7D7DFF">protect</b> sensitive data in AWS.
- Focused on identifying sensitive data such as PII and financial information.
- Automatically classifies data stored in <b style="color: #7D7DFF">Amazon S3</b>.
- Useful for compliance.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Security-Identity-Compliance/WAF.svg" style="min-width:15px; max-width:30px;" /> AWS WAF
AWS WAF helps protect web applications from common web exploits and bots.
- Protects <b style="color: #7D7DFF">against SQL injection</b> and <b style="color: #7D7DFF">cross-site scripting(XSS)</b>.
- Can be deployed with Amazon CloudFront, Application Load Balancer, or API Gateway.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Security-Identity-Compliance/Cognito.svg" style="min-width:15px; max-width:30px;" /> Amazon Cognito
Amazon Cognito provides authentication, authorization, and user management for web and mobile applications.
- Supports <b style="color: #7D7DFF">sign-in with social identity providers</b>(Google, Facebook, etc.) and <b style="color: #7D7DFF">SAML-based</b> providers.
- Integrates with AWS IAM for fine-grained access control.
- Provides user pools for user directories and identity pools for <b style="color: #7D7DFF">temporary AWS credentials</b>.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Security-Identity-Compliance/Security-Hub.svg" style="min-width:15px; max-width:30px;" /> AWS Security Hub
AWS Security Hub gives a comprehensive view of <b style="color: #7D7DFF">high-priority security alerts</b> and <b style="color: #7D7DFF">compliance status</b> across AWS accounts.
- Aggregates findings from GuardDuty, Inspector, Macie, and other products.
- Provide <b style="color: #7D7DFF">dashboard view</b> of overall sucurity issues.
- Compliance checks against standards like CIS AWS Foundations, PCI DSS, and others.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Security-Identity-Compliance/Inspector.svg" style="min-width:15px; max-width:30px;" /> Amazon Inspector
Amazon Inspector is an automated <b style="color: #7D7DFF">vulnerability management</b> service that scans AWS workloads.
- Supports <b style="color: #7D7DFF">EC2 instances</b> and container images in Amazon ECR.
- Provides <b style="color: #7D7DFF">risk scores</b> based on the severity of findings.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Security-Identity-Compliance/Secrets-Manager.svg" style="min-width:15px; max-width:30px;" /> AWS Secrets Manager
AWS Secrets Manager helps manage, rotate, and retrieve database credentials, API keys, and other secrets securely.
- Encrypted using <b style="color: #7D7DFF">AWS KMS</b>.
- Eliminates the need to hardcode secrets in applications.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Security-Identity-Compliance/Shield.svg" style="min-width:15px; max-width:30px;" /> AWS Shield
AWS Shield provides <b style="color: #7D7DFF">DDoS(Distributed Denial of Service) protection</b> for applications running on AWS.
- Two tiers: AWS Shield <b style="color: #7D7DFF">Standard</b>(automatic, free) and AWS Shield <b style="color: #7D7DFF">Advanced</b>(paid, with enhanced protection).
- Protects against infrastructure and application layer DDoS attacks.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Security-Identity-Compliance/Artifact.svg" style="min-width:15px; max-width:30px;" /> AWS Artifact
AWS Artifact is a self-service portal that provides on-demand access to AWS compliance reports and agreements.
- Includes <b style="color: #7D7DFF">audit reports</b> like <b style="color: #7D7DFF">SOC</b>, <b style="color: #7D7DFF">ISO</b>, <b style="color: #7D7DFF">PCI DSS</b>, and <b style="color: #7D7DFF">GDPR</b> certifications.
- Helps customers meet compliance and regulatory requirements.
- Can <b style="color: #7D7DFF">download</b> AWS compliance documentation for audits or internal review.
<hr>

<!-- Business Apllications -->
### <img src="https://icon.icepanel.io/AWS/svg/Business-Applications/Connect.svg" style="min-width:15px; max-width:30px;" /> AWS Connect
Amazon Connect is a cloud-based <b style="color: #7D7DFF">contact center service</b> that allows businesses to provide customer support.
- Supports <b style="color: #7D7DFF">voice</b>, <b style="color: #7D7DFF">chat</b>, and <b style="color: #7D7DFF">task management</b>.
- Can integrate with <b style="color: #7D7DFF">CRM systems</b>, <b style="color: #7D7DFF">Lambda functions</b>, and <b style="color: #7D7DFF">analytics tools</b>.
<hr>

<!-- Management Governance -->
### <img src="https://icon.icepanel.io/AWS/svg/Management-Governance/Trusted-Advisor.svg" style="min-width:15px; max-width:30px;" /> AWS Trusted Advisor
AWS Trusted Advisor is a tool that provides <b style="color: #7D7DFF">real-time guidance</b> to help optimize the AWS environment.
- Checks for <b style="color: #7D7DFF">cost optimization</b>, <b style="color: #7D7DFF">security</b>, <b style="color: #7D7DFF">fault tolerance</b>, <b style="color: #7D7DFF">performance</b>, and <b style="color: #7D7DFF">service limits</b>.
- Provides recommendations like deleting unused resources or enabling MFA.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Management-Governance/CloudWatch.svg" style="min-width:15px; max-width:30px;" /> AWS CloudWatch
AWS CloudWatch is a <b style="color: #7D7DFF">monitoring</b> and <b style="color: #7D7DFF">observability service</b> for AWS resources and applications.
- Monitors metrics, logs, and events from AWS resources such as <b style="color: #7D7DFF">EC2</b>, <b style="color: #7D7DFF">RDS</b>, <b style="color: #7D7DFF">Lambda</b>.
- Supports alarms, dashboards, and automated actions based on metrics thresholds.
- Helps track <b style="color: #7D7DFF">performance</b>, <b style="color: #7D7DFF">operational health</b>, and <b style="color: #7D7DFF">resource utilization</b>.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Management-Governance/CloudTrail.svg" style="min-width:15px; max-width:30px;" /> AWS CloudTrail
AWS CloudTrail is a logging and auditing service that records API calls and activities in AWS account.
- Records <b style="color: #7D7DFF">who</b> did <b style="color: #7D7DFF">what</b>, <b style="color: #7D7DFF">when</b>, and <b style="color: #7D7DFF">from where</b> for AWS API calls.
- Logs can be delivered to <b style="color: #7D7DFF">S3</b>, <b style="color: #7D7DFF">CloudWatch Logs</b>, or <b style="color: #7D7DFF">EventBridge</b>.
- Enables <b style="color: #7D7DFF">tracking of changes</b> in <b style="color: #7D7DFF">IAM</b>, <b style="color: #7D7DFF">EC2</b>, <b style="color: #7D7DFF">S3</b>, and other services.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Management-Governance/Personal-Health-Dashboard.svg" style="min-width:15px; max-width:30px;" /> AWS Personal Health Dashboard
AWS Personal Health Dashboard provides personalized alerts and guidance for AWS resources and services.
- Shows <b style="color: #7D7DFF">account-specific</b> events, such as <b style="color: #7D7DFF">service disruptions</b>, <b style="color: #7D7DFF">planned maintenance</b>, or <b style="color: #7D7DFF">issues</b> affecting your resources.
- Alerts can be delivered via <b style="color: #7D7DFF">AWS Management Console</b>, <b style="color: #7D7DFF">email</b>, or <b style="color: #7D7DFF">EventBridge</b>.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Management-Governance/Organizations.svg" style="min-width:15px; max-width:30px;" /> AWS Organization
AWS Organizations helps you centrally manage multiple AWS accounts and apply governance across them.
- Enables <b style="color: #7D7DFF">centralized billing</b> for all accounts in the organization.
- Can apply <b style="color: #7D7DFF">Service Control Policies(SCPs)</b> to enforce permissions across accounts.
- Supports account grouping and management for <b style="color: #7D7DFF">large organizations</b>.
<hr>

<!-- App-Integration -->
### <img src="https://icon.icepanel.io/AWS/svg/App-Integration/Simple-Queue-Service.svg" style="min-width:15px; max-width:30px;" /> Amazon Simple Queue Service(SQS)
A fully managed <b style="color: #7D7DFF">message queuing service</b> that <b style="color: #7D7DFF">decouples</b> distributed systems.
- Message queue model → producer sends messages to queue, consumers poll and process them.
- Standard Queue → unlimited throughput, at-least-once delivery, best-effort ordering.
- FIFO Queue → exactly-once processing, ordered messages.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/App-Integration/Simple-Notification-Service.svg" style="min-width:15px; max-width:30px;" /> Amazon Simple Notification Service(SNS)
A fully managed <b style="color: #7D7DFF">pub/sub messaging service</b> that delivers messages to multiple subscribers at once.
- Publish/subscribe model → one publisher, many subscribers.
- Supports multiple protocols: email, SMS, Lambda, SQS, HTTP endpoints.
- Often used for <b style="color: #7D7DFF">fan-out messaging</b> (one message → many targets).
<hr>

<!-- Artificial Intelligence -->
### <img src="https://icon.icepanel.io/AWS/svg/Machine-Learning/Translate.svg" style="min-width:15px; max-width:30px;" /> Amazon Translate
Neural language translation service.
- Real-time or batch translation.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Machine-Learning/Polly.svg" style="min-width:15px; max-width:30px;" /> Amazon Polly
Converts text into lifelike speech.
- Supports multiple languages and voices.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Machine-Learning/Lex.svg" style="min-width:15px; max-width:30px;" /> Amazon Lex
Service for building chatbots and voice assistants.
- It is the same tech as Alexa.
- It can be integrates with Lambda.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Machine-Learning/Comprehend.svg" style="min-width:15px; max-width:30px;" /> Amazon Comprehend
A NLP (Natural Language Processing) service.
- It detects sentiment, key phrases, language, topics.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Machine-Learning/Forecast.svg" style="min-width:15px; max-width:30px;" /> Amazon Forecast
Time-series forecasting using ML.
- Based on Amazon.com’s technology.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Machine-Learning/CodeGuru.svg" style="min-width:15px; max-width:30px;" /> Amazon CodeGuru
ML-powered code review and performance profiling tool.
- Finds bugs, security issues, performance bottlenecks.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Machine-Learning/Rekognition.svg" style="min-width:15px; max-width:30px;" /> Amazon Rekognition
Image and video analysis with computer vision.
- Detects faces, objects, inappropriate content.
<hr>

<!-- Machine Learning -->
### <img src="https://icon.icepanel.io/AWS/svg/Machine-Learning/SageMaker.svg" style="min-width:15px; max-width:30px;" /> AWS SageMaker
A fully managed service for building, training, and deploying ML models.
- End-to-end ML pipeline.
- Supports Jupyter notebooks, training, deployment.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Machine-Learning/CodeWhisperer.svg" style="min-width:15px; max-width:30px;" /> Amazon CodeWhisperer
An AI coding assistant that generates code suggestions in real time.
- Similar to GitHub Copilot, it's an AI code generation tool.
<hr>

<!-- Cloud Financial Management -->
### <img src="https://icon.icepanel.io/AWS/svg/Cloud-Financial-Management/Cost-Explorer.svg" style="min-width:15px; max-width:30px;" /> AWS Cost Explorer
A visualization and analysis tool to view and understand AWS spending over time.
- Provides interactive charts and filtering by service, region, linked accounts.
- Can forecast future costs based on usage trends.
- Helps identify cost drivers and usage patterns.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Cloud-Financial-Management/Cost-Explorer.svg" style="min-width:15px; max-width:30px;" /> AWS Budgets
A custom budgeting tool to set cost or usage thresholds and receive alerts.
- Can track costs, usage, RI/Savings Plans utilization.
- Alerts sent via email or SNS when thresholds are exceeded.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Cloud-Financial-Management/Cost-and-Usage-Report.svg" style="min-width:15px; max-width:30px;" /> AWS Cost & Usage Report (CUR)
The most detailed report of AWS usage and billing.
- Provides hourly, daily, or monthly usage data at the line-item level.
- Delivered in CSV/Parquet format to an Amazon S3 bucket.
- Can be integrated with Athena, Redshift, or QuickSight for analysis.
<hr>

### <img src="https://icon.icepanel.io/AWS/svg/Storage/Simple-Storage-Service-Glacier.svg" style="min-width:15px; max-width:30px;" /> Amazon S3 Glacier (and S3 Glacier Deep Archive)
A low-cost archival storage class within S3 for infrequently accessed data.
- Designed for long-term backup and archival.
- Retrieval options: Expedited, Standard, Bulk (minutes to hours).
- Even cheaper option: Glacier Deep Archive (retrieval in 12–48 hours).
<hr>

https://icon.icepanel.io/AWS/svg/Cloud-Financial-Management/Cost-Explorer.svg

<br>

## Notes Reference
- AWS Architecture Icons (unmodified, for study purposes only).
- Diagrams redrawn based on AWS Skill Builder training content.