saa-co3 exam clues

least operational overhead

serverless/ managed

survive an az failure

multi-az

survive region failure

multi-region

scale database reads

read replicas/ cache

auto db failover

multi-az

decouple/ buffer messages

sqs

fan out/ push notis

sns

route events using rules

eventbridge

private subnet outbound internet

nat gateway

private access to s3/ dynamodb

gateway endpoint

global cached content

cloudfront

static global ips

global accelerator

cheapest interruptible compute

spot instances

predictable long term use

savings plans/ reserved

audit aws api activity

cloudtrail

metrics/logs/alarms

cloudwatch

config/ compliance history

config

temp aws permissions

iam role

ec2 needs s3

attach iam role to ec2

cross acc access

assume an iam role in other acc

multiple aws account access

iam identity center

existing corporate identities

federation, iam, directory service

control max perms

scp

grant access to s3 bucket

bucket policy

grant perms to iam principal

identity based iam policy

one resource usable across aws services

resource based policy

encrypt data using aws managed keys

kms

exlcusive control of dedicated hsm

cloudHSM

rotate keys automatically

secrets manager

store ordinary config values

parameter store

detect suspicious aws activity

guardduty

sensivite data in s3

macie

scan ec2, ecr, lambda for vulnerabilities

inspector

investigate security findings

detective

filter malicious http reqs

waf

protect against ddos

shield

centralize security findings

security hub

view/ download aws compliance reports

artifacts

record aws api calls

cloudtrail

encrypt traffic in transit

acm

manage firewall rules across accs

firewall manager

inspect and filter vpc netowrk traffic

aws network firewall

direct internet access

igw + public ip

outbount intenert

nat gateway in public subnet

internet cant initiate connections to private instances

nat gateway

highly available nat across az

one nat gateway per az

priv access to s3 or dynamodb

gateway vpc endpoint

priv access to most other aws services

interface endpoint

stateful instance level firewall

security group

stateless subnet level firewall

network acl

connect two vpcs simply

vpc peering

connect many vpcs centrally

transit gateway

vpcs have overlapping cidrs

private link

encrypted on prem to aws connection

site to site vpn

conssitent private connection

direct connect

direct connect encruption needed

direct connect + vpn

employees need remote access to aws vpc

client vpn

capture information about ip traffic

vpc flow logs

dns service/ domain registratoin

route53

resolve dns between on premises and aws

route 53 resolver endpoints

auto create private connections from many branches

cloud wan or transit gateway

http/ https routing

application load balancer

route by url path or hostname

alb

route req to lambda or containers

alb