AWS SAA-C03 Emergency Knowledge Deck

Vocabulary-style flashcards covering the core services, security, Networking, Storage, and Architecture concepts for the AWS SAA-C03 exam.

IAM

Identity and access management for AWS that controls WHO can do WHAT on WHICH resources based on permissions and the principle of least privilege.

IAM user vs IAM role

User = long-term identity for a person/app with credentials. Role = temporary credentials assumed by users/services/accounts; preferred for EC2/apps and cross-account access.

Explicit DENY

A policy statement that always beats an ALLOW during IAM policy evaluation.

AWS STS

Security Token Service that issues temporary credentials for role assumption, federation, and cross-account access.

AWS Organizations

Service used to centrally manage multiple AWS accounts, organizational units, consolidated billing, and governance.

Service Control Policy (SCP)

Organization-level permission guardrail that sets maximum permissions for member accounts/OUs; does not grant permissions itself.

AWS RAM

Resource Access Manager; used to share supported AWS resources such as subnets across accounts without duplicating them.

Security group

STATEFUL virtual firewall attached to ENIs/instances that supports allow rules only; return traffic is automatically allowed.

Network ACL (NACL)

STATELESS subnet-level firewall that has allow and deny rules evaluated by the lowest rule number first.

AWS KMS

Managed encryption key service used to create/control keys and audit use via CloudTrail; integrated with many AWS services for encryption at rest.

AWS CloudHSM

Dedicated single-tenant hardware security modules for strict compliance or direct control of cryptographic keys; requires more management than KMS.

AWS Secrets Manager

Service that securely stores secrets such as DB passwords/API keys and supports automatic rotation.

Cognito user pool vs identity pool

User pool = authenticate users / user directory. Identity pool = give authenticated/guest users temporary AWS credentials to access AWS resources.

AWS WAF

Web application firewall that filters Layer $7$ HTTP(S) requests using rules such as IP addresses or SQL injection patterns.

AWS Shield

Managed DDoS protection; Standard provides a baseline, while Advanced provides enhanced protection and cost protections.

Amazon GuardDuty

Threat detection service using analytics/ML on AWS logs to find suspicious behavior or compromised credentials; it is not a vulnerability scanner.

Amazon Inspector

Automated vulnerability management and scanning for software vulnerabilities (CVEs) in EC2, ECR container images, and Lambda.

Amazon Macie

Service that uses ML and pattern matching to discover and classify sensitive data such as PII in Amazon S3.

AWS Artifact

A portal for downloading AWS compliance documentation such as SOC or ISO reports.

NAT Gateway

Component placed in a public subnet that lets resources in private subnets initiate outbound IPv4 internet access while preventing unsolicited inbound connections.

Gateway endpoint

A free-style VPC endpoint specifically for S3 and DynamoDB that is route-table based and incurs no hourly charge.

Interface endpoint / PrivateLink

An ENI with a private IP used to access many AWS services privately across VPCs; typically incurs hourly and data charges.

AWS Transit Gateway

Hub-and-spoke networking service used to connect hundreds of VPCs and on-premises networks centrally.

AWS Direct Connect

Dedicated private network connection from on-premises to AWS providing predictable bandwidth/latency; it is NOT encrypted by default.

Application Load Balancer (ALB)

Layer $7$ HTTP/HTTPS load balancer that supports host, path, and header routing for targets like EC2, containers, and Lambda.

Network Load Balancer (NLB)

Layer $4$ TCP/UDP/TLS load balancer designed for extremely high performance, low latency, and static IP support.

EC2 On-Demand

Pay-as-you-go purchasing option with no long-term commitment; best for short-term, unpredictable, non-interruptible workloads.

Spot Instances

Deeply discounted spare EC2 capacity that can be interrupted; best for fault-tolerant, flexible workloads.

Dedicated Hosts

Physical EC2 server dedicated to a single customer; used for server-bound software licenses or specific physical isolation compliance.

AWS Lambda

Serverless event-driven functions that automatically scale and have a maximum execution duration of $15$ minutes.

AWS Fargate

Serverless compute engine for ECS/EKS containers that allows running containers without managing EC2 servers.

S3 Standard

General-purpose object storage for frequently accessed data with multi-AZ resilience and no retrieval fees.

S3 Intelligent-Tiering

Storage class that automatically moves objects between access tiers based on patterns; best for unpredictable access.

S3 One Zone-IA

Infrequent access storage class kept in one AZ; cheaper than Standard-IA but not resilient to AZ loss.

S3 Glacier Deep Archive

Lowest-cost storage for long-term archive data accessed extremely rarely, with retrieval times generally in hours.

S3 Object Lock

WORM (Write Once Read Many) protection preventing object deletion or overwrite for a retention period; used for regulatory compliance.

Amazon EBS

Block storage volumes for EC2 instances that live in one AZ and can persist independently of the instance.

Amazon EFS

Managed elastic shared file storage using NFS for Linux workloads that can be mounted concurrently by many EC2 instances across AZs.

RDS Multi-AZ

High availability feature that synchronously replicates data to a standby in another AZ with automatic failover.

RDS read replica

Asynchronous replica used primarily for read scaling and can be promoted to a standalone database for disaster recovery.

Amazon DynamoDB

Serverless managed NoSQL key-value/document database providing single-digit-millisecond performance at massive scale.

DAX

DynamoDB Accelerator; a managed in-memory cache specifically for DynamoDB to reduce read latency to microseconds.

Amazon ElastiCache

Managed in-memory cache (Redis/Valkey or Memcached) used to reduce database load and application latency.

Amazon Redshift

Managed petabyte-scale data warehouse for OLAP/analytics over large structured datasets.

SQS FIFO

Message queue that preserves exact ordering and provides exactly-once processing behavior; names must end in .fifo.

SQS visibility timeout

The period during which a message is invisible to other consumers after being received; if not deleted, it becomes visible again.

Amazon SNS

Push-based pub/sub service that can fan out a single message to many subscribers like SQS, Lambda, or email.

AWS Step Functions

Serverless workflow orchestration using state machines to coordinate multiple AWS services with branching and error handling.

Route 53 latency routing

DNS routing policy that directs users to the AWS Region or resource providing the lowest network latency.

RPO

Recovery Point Objective; the maximum acceptable DATA LOSS measured in time (e.g., can lose at most $5$ minutes of data).

RTO

Recovery Time Objective; the maximum acceptable DOWNTIME or time to restore service (e.g., back online within $30$ minutes).

Pilot light DR

Disaster recovery strategy where core critical components and data are kept running in a DR Region, while the rest is scaled up after a disaster.

CloudWatch vs CloudTrail vs Config

CloudWatch = performance metrics/logs; CloudTrail = API/audit activity; Config = resource configuration history and compliance.

Amazon Athena

Serverless interactive SQL query service used to analyze data directly in Amazon S3; users pay per data scanned.

AWS Glue

Serverless data integration service used for ETL (Extract, Transform, Load) and maintaining a Data Catalog.

Amazon Kinesis

Managed service for real-time streaming data ingestion and processing of high-volume clickstream or IoT events.

AWS Snow Family

Physical devices used for offline data transfer or edge processing when network bandwidth is limited or unavailable.

Six Well-Architected pillars

Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.