A Region is a large geographic area; an AZ is one or more physically separate data centers within that region, with independent power/cooling, connected to other AZs via fast private links.

No real isolation — a mistake or compromise in one area (dev, staging, one team) has a blast radius spanning the entire account, including production.

Sets a maximum-possible-permissions ceiling for an account/OU — it never grants anything on its own; an IAM policy inside the account still has to separately grant the actual permission.

It has ultimate authority over every member account — mixing that high-privilege control plane with ordinary application risk is unnecessary privilege concentration.

A compromised workload account's own local logs could be tampered with or deleted — a separate account the workload has no delete permission on guarantees a tamper-evident trail.

Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, Sustainability.

For EC2 you patch the guest OS yourself; for Lambda AWS handles the OS entirely — your data and access configuration are always your responsibility regardless.

An SCP can only allow/deny an API call outright; a Tag Policy reports non-compliance without necessarily blocking the action — often the more practical, gradual enforcement path.

A silently-hit quota (e.g. EC2 instance limit) can look identical to an unrelated outage — new instances simply fail to launch with no obvious signal why.

A role provides temporary, automatically-expiring credentials via STS; a user's access keys are long-lived, standing credentials that can leak.

SCP deny wins first, then any explicit Deny anywhere wins, then any explicit Allow grants access, and everything else is implicitly denied by default.

Identity-based is attached to a user/group/role, answering "what can this identity do"; resource-based is attached directly to a resource, answering "who can access this resource" — and can grant cross-account access.

Without it, every pod on a node shares the same broad node-level IAM permissions — IRSA lets each Kubernetes ServiceAccount assume its own narrowly-scoped role.

A ceiling for ONE specific IAM user/role (not an entire account/OU like an SCP) — used to safely delegate role-creation ability to a less-trusted process.

One policy, using a variable comparing the principal's tag to the resource's tag, automatically scopes correctly for every team/resource pair — no new policy needed per new team.

Exactly one place to revoke access (the IdP) instead of hunting down and deleting IAM users across every account when someone leaves.

Pre-provisioned emergency credentials for when normal federated access is itself unavailable — must have automatic, immediate alerting on every use.

Burstable performance — earns CPU credits, throttles hard once credits run out.

Bakes configuration in ahead of time so new instances are ready to serve traffic the moment they boot, instead of waiting through a slow bootstrap script during every scale-out.

Stopped: still exists, root EBS volume persists, can restart with the same ID. Terminated: gone permanently, root volume deleted by default.

Requires a session token via a PUT request first — closes the SSRF-to-credential-theft attack path that IMDSv1's simple unauthenticated GET allowed (as in the 2019 Capital One breach).

Steep discount in exchange for only a 2-minute interruption notice — a strong fit for stateless, horizontally-redundant fleets, a poor fit for non-redundant stateful workloads.

Multi-AZ spreads fault tolerance; ELB health checks catch application-level failures (deadlocks, 500s) that EC2 status checks (hardware/OS only) would miss entirely.

Reduce cold-start lag for ASGs by keeping pre-initialized instances ready, instead of booting and bootstrapping fully from scratch during a demand spike.

Eliminates the need for any open inbound port, authenticating and authorizing entirely through IAM, fully logged in CloudTrail.

Two VPCs with overlapping CIDR blocks can never be connected via Peering or Transit Gateway — routing can't distinguish which VPC an address belongs to.

Its route table configuration — public routes 0.0.0.0/0 to an Internet Gateway, private routes it to a NAT Gateway, isolated has no internet route at all.

A shared NAT Gateway reintroduces a single point of failure — that AZ's outage removes outbound internet access for every other AZ's private subnets too.

Security Groups are stateful (return traffic auto-allowed), instance-level, allow-only. NACLs are stateless (return traffic needs its own rule), subnet-level, allow+deny.

Automatically stays correct as an Auto Scaling Group's instances scale in/out — no manual updates needed as IPs change.

Each peering connection is a direct, point-to-point link only — A peered with B peered with C does NOT let A reach C through B.

Avoids the N² mesh of pairwise peering connections as VPC count grows — a hub-and-spoke model instead.

Gateway Endpoints (S3/DynamoDB only) are free route table entries. Interface Endpoints (via PrivateLink, everything else) are actual ENIs with a private IP and small cost.

Automatically evaluates the entire path (route tables, SGs, NACLs, Transit Gateway routing) and names the exact blocking component in seconds — Flow Logs require manual correlation.

Makes overlapping CIDR allocations structurally impossible by construction, since VPCs request blocks FROM a centrally tracked pool.

Strong read-after-write consistency for ALL operations (since 2020) — a PUT followed by a GET always returns the latest version.

A structural safety net overriding even a future accidental public-granting bucket policy — most real S3 data exposures trace back to a missing version of this control.

Versioning lets a sufficiently privileged admin still permanently delete a version; Object Lock COMPLIANCE mode makes it structurally impossible for ANYONE, including root, until retention expires.

A physical, network-attached-disk constraint — this is exactly why EBS data doesn't automatically survive an AZ failure without a snapshot.

IOPS/throughput are provisioned independently of volume size — no need to over-provision capacity just to get more speed.

When MANY instances need genuine, concurrent, multi-AZ shared file access with real POSIX semantics — EBS structurally can't provide this (one-instance, or narrowly-Multi-Attach with no file-level coordination).

Eliminates the lazy-loading latency penalty a volume created from a snapshot would otherwise have on first access to each block.

No — it's a synchronous failover target only, not readable. Use a dedicated Read Replica instead.

Aurora's storage layer replicates 6 ways across 3 AZs BELOW the database engine, using quorum-based writes — resulting in single-digit-ms replica lag vs RDS's binlog-based tens-to-hundreds of ms.

It's a managed service — Parameter Groups are the only sanctioned way to change engine-level configuration.

Prevents connection exhaustion from serverless (Lambda) workloads opening far more direct connections than the database can handle, by pooling and multiplexing.

No flag exists to encrypt an existing unencrypted instance in place — requires a snapshot-copy-with-KMS-key, then restore-as-new-instance migration.

Redshift for sustained, high-concurrency, performance-critical analytical workloads justifying dedicated warehouse cost; Athena for infrequent, ad hoc queries directly against S3 with zero standing infrastructure.

No — Fargate is a serverless compute engine that EKS (and ECS) can both run on top of; orchestrator and compute engine are two independent decisions.

An ECS Service (keeps a desired task count running); a Task Definition maps to a Pod spec, a Task maps to a running Pod.

On EC2, Service Auto Scaling (task count) and Cluster Auto Scaling (instance count) are separate mechanisms that must both scale together; Fargate has no underlying cluster capacity to manage.

No warm execution environment is available — AWS must provision a new one and initialize the runtime before running the invocation.

Reserved sets a ceiling (protects other functions' share); Provisioned sets a floor (pre-warmed environments, eliminating cold starts at a standing cost).

Fargate tasks have no underlying EC2 instance to SSH into at all — ECS Exec provides IAM-authenticated shell access with zero open ports.

It's silently discarded — no error surfaces anywhere and no record of the failure is retained.

ALB (Layer 7) does content-based routing on path/host/header; NLB (Layer 4) offers static IPs and extreme throughput for non-HTTP or allowlist-driven needs.

Without it, making the bucket public enough for CloudFront also makes it public enough for anyone to bypass CloudFront and hit S3 directly.

Client/resolver TTL caching means some clients keep using a stale, unhealthy IP until their local cache expires.

An AWS-specific extension letting a domain's APEX/root point at an AWS resource (like an ALB) — standard DNS forbids a CNAME at the zone apex.

To implement a canary deployment or gradual traffic migration at the DNS layer, splitting traffic by percentage across endpoints.

Sub-millisecond execution and meaningfully cheaper — Lambda@Edge's fuller capability is unnecessary overhead for something as simple as a header rewrite.

KMS key policies are a separate, mandatory gate — the key policy must also explicitly allow the principal, a deliberate extra defense-in-depth layer.

KMS generates a data key in both plaintext and KMS-encrypted form; the plaintext key encrypts the actual data locally (fast), and only the encrypted data key is stored.

Secrets Manager provides native automatic rotation (via a Lambda function correctly sequencing credential change); Parameter Store has none built in.

Management events (control-plane, e.g. bucket creation) are logged by default and free; data events (e.g. individual GetObject calls) require explicit enablement and cost extra.

Terminating destroys volatile forensic evidence (processes, connections, memory state) needed to understand how the compromise happened.

VPC Flow Logs, CloudTrail logs, and DNS logs, using machine learning and threat-intelligence feeds — zero custom rule-writing required.

Automatically builds a visual behavior graph correlating CloudTrail/Flow Log activity, avoiding manual multi-source log correlation during an investigation.

AWS's hypervisor has no visibility inside the guest OS's memory — only the CloudWatch Agent, running inside the instance, can observe and report it.

Combine multiple correlated symptom alarms (errors up AND latency up) into a single page, reducing alert-fatigue-inducing duplicate pages for one real incident.

Writing structured JSON to logs is essentially free and adds no synchronous API call latency to the application's hot path.

Learns a metric's own normal daily/weekly seasonal pattern, avoiding the tradeoff where one static threshold is either too loose during peaks or too tight during quiet periods.

A throttled invocation is rejected BEFORE the function code ever runs, due to concurrency limits — it can never appear in the Errors metric.

Synthetics proactively catches a broken flow regardless of real traffic volume; RUM shows what real users actually experience but only after they encounter a problem.

A Change Set — preview exactly what will change before actually applying it.

Deploys the same template across many accounts/regions from one place — with auto-deployment, new accounts under an OU automatically receive the baseline.

State is natively tracked by AWS as part of the stack resource — no state file that can go missing, get corrupted, or need locking.

Standard: best-effort ordering, at-least-once delivery, near-unlimited throughput. FIFO: strict ordering, exactly-once processing, capped throughput.

If processing takes longer than the timeout, the message becomes visible to a second consumer while the first is still working on it.

One event reliably delivered to MULTIPLE independent consumers, each with its own queue — a slow/failing consumer never blocks the others.

When routing decisions need to depend on the actual CONTENT of an event, not just which topic it was published to.

Kinesis retains and allows REPLAY of data by multiple independent consumers; SQS deletes a message once successfully processed.

Backup & Restore (hours, cheapest) → Pilot Light (tens of minutes) → Warm Standby (minutes) → Multi-Site Active-Active (near-zero, most expensive).

Aurora Global Database — kept running continuously while compute is pre-built as IaC but not running until failover.

A new resource created with the right tag is automatically covered by the backup plan, with zero additional configuration — governance by construction.

Rehost, Replatform, Repurchase, Refactor/Re-architect, Retire, Retain.

Discovery routinely surfaces systems with zero actual users still running — retiring them is a real, immediate cost win requiring no migration effort.

Migration plans based on incomplete/outdated inventories miss critical dependencies discovered painfully mid-migration instead of during planning.

Automatically halts the chaos experiment if it starts causing genuine, unacceptable customer impact, tied to a real CloudWatch alarm.

HTTP APIs cost roughly 70% less per million requests and include native JWT authorization — REST APIs' extra features (caching, usage plans, WAF, request validation) are only worth the added cost when a project actually needs one of them.

A user pool authenticates — it proves who a user is and issues JWTs. An identity pool authorizes — it exchanges a valid token for temporary AWS credentials via STS, scoped by an IAM role.

It only selects which usage plan (throttle/quota tier) applies to a caller — it grants no identity or authorization on its own and must be paired with a real authorizer.

Only when its cache TTL (5 minutes by default) expires or is explicitly invalidated — a revoked token can still succeed against the cache until then.

Duration and volume: Standard for long-running (up to a year), exactly-once, fully-audited workflows; Express for high-volume, sub-5-minute workloads where per-state-transition Standard pricing would be far more expensive.

A rule does many-to-many routing across a bus to up to five targets per match; a pipe is one source to one target with no bus in the middle, built for point-to-point delivery with inline filtering/enrichment.

Public clients on unreliable networks retry requests they never got a response for; without a deduplication check keyed on a client-generated ID, that retry silently repeats a side effect (like creating a duplicate order).

It removes Lambda's payload-size limits and cold-start latency from the upload path entirely, since the identity pool's temporary, sub-scoped credentials let the client talk to S3 directly with no compute relaying bytes it never needed to touch.

Almost never for genuinely new work — MQ exists specifically for migrating an application that already speaks AMQP/JMS/MQTT/STOMP without rewriting its messaging code; greenfield projects default to SQS/SNS/EventBridge.

Beanstalk continuously reconciles the environment against its own stored configuration — a manual change outside that configuration gets silently reverted on the next update.

Blue/Green via swap-environment-URLs — the previous environment stays fully intact, so rollback is a single instant CNAME swap rather than a new deployment action.

It tells CloudFormation to expand SAM's simplified resource types (like AWS::Serverless::Function) into their full plain-CloudFormation equivalents before deploying — a SAM template is still just a CloudFormation template underneath.

The alias is the indirection that makes traffic shifting possible — pointing at a version directly bypasses that indirection, so a canary/linear rollout would require reconfiguring every caller instead of just the alias's routing weights.

A canary still exposes some percentage of real traffic to the new version during its shift window; a PreTraffic hook runs entirely before any real traffic is shifted, so a failure there blocks the deployment before any customer is affected at all.

Both stopped onboarding new customers years ago (CodeCommit mid-2024, Cloud9 July 2024) and aren't receiving new features — current guidance points new projects to a third-party Git host and the AWS Toolkit/CloudShell instead.

An environment variable is visible to anyone with read access to the function's configuration, with no access audit trail — a Secrets Manager GetSecretValue call is IAM-gated and logged to CloudTrail.

The SSM Agent on the managed node initiates the connection outbound to the Systems Manager service — there's no inbound network path required at all, unlike SSH.

CloudTrail logging every StartSession/TerminateSession API call (who, when, which instance) plus session log streaming to CloudWatch Logs/S3 capturing the actual command input/output.

Without a concurrency limit and error threshold, a bad script or bad patch can hit every target simultaneously — rate control caps the blast radius the same way a canary deployment does for application traffic.

It gives time to catch a vendor's own bad patch reported elsewhere before it reaches production — a small, deliberate exposure window traded for patching safety.

It tunnels a local port through the same IAM-authenticated, agent-initiated channel Session Manager already uses, directly to the private endpoint — no standing bastion EC2 instance to provision, patch, or monitor.

A nonzero score means the recommendation is a genuine reliability tradeoff, not a risk-free cost win — Compute Optimizer produces recommendations for a human to evaluate, not automatic changes.

A broken AMI reaching the "Available" distribution stage — the pipeline launches a temporary test instance and runs every component's validation before an image is ever eligible for production Auto Scaling Groups to launch from.

A tag has to be explicitly activated as a cost allocation tag in the Billing console before it becomes a queryable cost dimension — the tag existing on a resource alone isn't sufficient.

An actual-spend alert only fires once the threshold is already crossed, often near or after the billing period closes; a forecasted-spend alert catches a runaway trend mid-cycle, while there's still time to act.

An RI commits to a specific instance configuration (family, size, region); a Savings Plan commits to a dollar-per-hour spend rate, applying automatically to whatever eligible usage occurs.

Layer them — Standard RIs/EC2 Instance Savings Plans for the stable baseline, Compute Savings Plans for the variable remainder, and Spot for interruption-tolerant burst — rather than committing to one exclusively.

It can strand the existing RI, leaving it paying for capacity nobody uses anymore — right-sizing and commitment coverage need to be reviewed together, not as two disconnected processes.

Consolidated billing shares RI/Savings Plan discounts automatically across every account in the Organization by default — purchasing per account risks one account under-buying while a sibling over-buys the same coverage.

Showback reports cost back to a team for visibility with no financial consequence; chargeback actually bills that cost against the team's budget as a real transaction — chargeback should only start once tagging coverage is reliable.

A growing company should expect growing spend — unit economics (cost per customer/transaction) shows whether spend is growing faster or slower than the value it produces, which raw totals can't distinguish.

Different applications carry wildly different business value, technical complexity, and remaining useful life — the 6 R's are meant to be applied per application based on that mix, not uniformly.

The agent-based collector installs on individual servers for detailed per-process data; the Agentless Collector deploys once against VMware vCenter and discovers hundreds of VMs without installing anything on each one.

It was rebranded to AWS Transform MGN, reflecting its role as the replication engine powering AWS Transform, the newer agentic migration platform — functionally the same rehosting service under a new name.

The source system keeps running fully unmodified right up until cutover, and a test launch can validate the converted target instance without ever disrupting the still-running source — any problem found gets fixed and re-tested with zero production impact before the real cutover happens.

No — the Snow Family closed to new customers on that date; only existing customers can still order the remaining Snowball Edge Storage Optimized device. New customers should default to DataSync or AWS Data Transfer Terminal instead.

Snowball ships a device to the customer and back; Data Transfer Terminal has the customer bring their own storage hardware to a physical facility and transfer over on-site high-throughput network connectivity — the hardware never leaves the customer's possession.

An untested rollback plan improvised under real incident pressure is how migrations turn into outages — the source system remains a legitimate rollback target only if the revert mechanics were planned and rehearsed in advance.

A lift-and-shift is migrated as-is by design, carrying forward whatever sizing existed on-premises — which is very often oversized relative to actual cloud utilization patterns, making it a near-guaranteed source of quick Compute Optimizer wins post-migration.

Athena, Redshift Spectrum, and EMR can all query the same underlying S3 data through the same catalog entry — it's the single source of truth for schema that keeps every consuming engine consistent, rather than each maintaining separate metadata.

Athena bills per byte scanned; converting data to a columnar format (Parquet/ORC) and partitioning it by a query-relevant column lets a filtered query skip scanning irrelevant data entirely, cutting both cost and latency.

Only when multiple independent consumers need their own pace of access, or replay of recent history is required — Firehose delivers and forgets, with no concept of multiple consumers or replayability.

Columnar storage dramatically accelerates aggregate, scan-heavy analytical queries across many rows, at the cost of being a poor fit for OLTP's single-row read/write pattern — the two are optimized for opposite access patterns.

They replace hand-built CDC pipelines for near-real-time analytics on transactional data — the mechanism is Change Data Capture streaming changes from the source database into the target (e.g., Aurora into Redshift) automatically, with no additional AWS charge for the integration itself.

The same dual-gate pattern as KMS (Part 9) — IAM alone can't enforce column/row-level restrictions; Lake Formation adds a data-specific fine-grained authorization layer that IAM policies alone don't provide.

If a transformation bug is discovered later, a corrected job can simply re-run against still-intact raw data — mutating raw data in place turns a fixable bug into an unrecoverable data-loss incident.

A pre-built service like Rekognition, Textract, or Comprehend solves the common problem shape with zero training data or training time via a direct API call — custom training is only justified when the problem genuinely doesn't fit any pre-built or Bedrock option.

Training-serving skew — computing a feature one way during training and a subtly different way during real-time inference — by giving both paths the same single, shared feature computation and storage layer.

A model that always predicts the majority class ("not fraud") can score very high accuracy while being completely useless — precision, recall, F1, or AUC (matched to the real cost of a false positive vs a false negative) reflect actual usefulness better.

RAG supplies an organization's own data as retrieved context at query time, with the model itself unchanged; fine-tuning actually adjusts the model's weights — RAG is the default for "the model needs to know our data," fine-tuning is reserved for "the model needs to behave differently."

A shadow-tested challenger model runs against real traffic and logs its predictions for offline comparison, but its output never actually reaches a real user or downstream decision — an A/B test, by contrast, does serve some real traffic to the challenger.

Data drift (incoming request patterns diverging from training data) and model quality drift (declining prediction accuracy) — a model silently getting worse at its job produces no obvious error-rate or latency spike for a standard alarm to catch.

It's a deliberate checkpoint between "training finished" and "serving production traffic," preventing an automatic deployment straight from a training job — the same purpose CodeDeploy approval gates (Part 15) serve for infrastructure changes.