EC2, S3, VPC, IAM, RDS, Lambda & SAA-C03 exam prep
*bleep* Congratulations, trainee — you're about to rent a server you've never touched, in a building you've never seen.
One server is a single point of failure. Configure an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). Understand scaling policies (target tracking vs step), health checks, and how the ALB distributes traffic across Availability Zones.
Deploy a Lambda function triggered by API Gateway. Compare the serverless cost model (pay per invocation + duration, scales to zero) against always-on EC2. Learn cold starts, memory/CPU coupling, and the 15-minute timeout limit.
Build a Docker image, push it to ECR, and run it on ECS Fargate. Understand task definitions, services, and why Fargate removes the need to manage EC2 hosts.
Launch a real-looking EC2 instance from the browser sandbox. Choose an AMI, instance size, and see the on-demand cost.
A t3.micro is pegged at 100% CPU. Choose the correct general-purpose m6i instance for a memory-bound workload.
S3 is your infinite filing cabinet. Create buckets, understand Standard vs Standard-IA vs Glacier vs Intelligent-Tiering, and set up lifecycle policies that automatically move objects to cheaper tiers over time.
Lock down a bucket with a resource policy, enable SSE-KMS encryption, and turn on Block Public Access. Understand the difference between bucket policies, IAM policies, and (legacy) ACLs.
Attach EBS volumes to a single EC2, mount EFS across many EC2s simultaneously, and understand the trade-offs between IOPS and throughput. Learn snapshots for backup and migration.
Every data lake, backup, and application asset on AWS usually passes through S3 at some point. Start by creating a bucket in a specific region and understand why bucket names must be globally unique.
Now that the bucket exists, upload a dataset. Learn how S3 stores objects under keys, and why a folder-like prefix is just a naming convention in S3.
S3 bucket policies and ACLs can accidentally expose data. AWS provides a safety switch: Block Public Access. Turn it on to prevent public reads.
Regulatory requirements often demand encryption at rest. Set the default encryption on a bucket so every object is automatically encrypted without the uploader doing anything.
A VPC is your private slice of AWS. Build one from scratch: choose a CIDR block, carve out public vs private subnets across AZs, attach an Internet Gateway, and wire up route tables.
Your private EC2s want to download updates but stay invisible to the internet — enter the NAT Gateway. Then peer two VPCs and compare Direct Connect vs Site-to-Site VPN for hybrid connectivity.
Serve an S3 static site worldwide through CloudFront, and set up Route 53 (AWS's phone book) with health checks and DNS failover routing.
A VPC is your private network in the cloud. Create a VPC, a public subnet, and an internet gateway so an EC2 instance can reach the internet.
Security groups are stateful firewalls for EC2. Allow only HTTPS and SSH to a web server, and understand why overly permissive rules are dangerous.
Launch an RDS instance with no patching headaches. Configure Multi-AZ for high availability (synchronous standby) and add read replicas (asynchronous) for read scaling.
Design a DynamoDB table. Choose partition keys that avoid hot partitions, add Global Secondary Indexes for new access patterns, and use DAX for microsecond caching.
Put Redis in front of RDS to cut latency and database load. Compare lazy-loading vs write-through caching patterns and understand TTL/eviction.
IAM answers "who can do what". Create users, groups and roles, write a least-privilege JSON policy, never use the root account, and enable MFA.
Use AWS Organizations Service Control Policies to cap what whole accounts can do, apply permission boundaries to delegate safely, and assume cross-account roles with STS.
Protect an ALB with WAF rules, understand Shield Standard vs Advanced for DDoS, enable GuardDuty threat detection, and centralize findings in Security Hub.
CloudWatch is your cloud alarm system. Create alarms for CPU and billing, build a custom dashboard, and query logs with Logs Insights.
Compare On-Demand vs Reserved vs Spot pricing, pick Savings Plans for steady workloads, and use Cost Explorer to hunt down waste.
Build a fan-out pattern with SNS → SQS so producers and consumers scale independently. Add a Dead Letter Queue to catch poison messages.
Build a multi-step workflow as a state machine. Handle retries, catch error states, and choose between Standard and Express workflows.
Write a CloudFormation template that deploys EC2 + S3 declaratively. Understand stacks, parameters, outputs, and drift detection.
Deploy the same 3-tier app with AWS CDK (TypeScript) and Terraform (HCL). Compare imperative constructs vs declarative providers and state management.
Design an active-passive multi-region architecture. Define RTO (how fast you recover) vs RPO (how much data you can lose) targets and pick the right strategy.
Configure AWS Backup for RDS and EBS, then choose between Backup & Restore, Pilot Light, Warm Standby, and Multi-Site Active/Active.
Review the 6 pillars — Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability — and apply the Well-Architected Tool to a sample workload.
Deploy a production-grade web app: ALB → EC2 ASG → RDS Multi-AZ, secured with IAM + WAF, monitored with CloudWatch, deployed via CloudFormation, with S3 + CloudFront for static assets.
Build a mini data lake: encrypted S3 bucket, Block Public Access, and a least-privilege IAM user that can only upload to it.
Design and build a resilient, secure, and fast production web application. This mission chains together every major service you have learned: DNS, CDN, load balancing, auto scaling, managed databases, caching, and secrets.
IAM users represent humans or applications that interact with AWS. Create a dedicated user for an ETL script instead of using the root account.
A common exam and interview question: write the smallest IAM policy that lets an ETL uploader put objects into exactly one bucket.
In AWS, an explicit Deny always overrides an Allow. Attach a policy that allows broad access but denies a specific bucket, and observe the effective result.
You are the cloud security engineer for BleepxBank. A pre-configured environment is loaded with realistic transaction data, a DynamoDB customer table, an ETL Lambda, and an intentionally insecure public website bucket. Find and fix the critical misconfigurations before the auditor arrives.