CertifyDeck
Start for free
All cheat sheets
CLF-C02 · CHEAT SHEET

AWS Certified Cloud Practitioner

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Cloud Concepts

24–24%

Define the benefits of the AWS Cloud

  • The AWS value proposition is summed up in six advantages: trade fixed for variable expense, benefit from massive economies of scale, stop guessing capacity, increase speed and agility, stop spending money running data centers, and go global in minutes. You pay only for what you consume, and resources are available in minutes rather than weeks.
  • The AWS global infrastructure is organised into Regions that are isolated from each other, each with multiple Availability Zones. You can deploy in several Regions with a few clicks to bring applications closer to users and cut latency, choose a Region to meet legal requirements (AWS does not replicate resources across Regions on its own), and deliver content from edge locations with Amazon CloudFront.
  • High availability comes from spreading a workload across several isolated Availability Zones in a Region, so the failure of one location does not stop the application. Elasticity avoids over-provisioning: resources grow and shrink with demand. Agility means getting resources in minutes and experimenting at low cost and in little time.

Identify design principles of the AWS Cloud

  • The AWS Well-Architected Framework gathers best practices and questions to evaluate workloads across six pillars. Its general principles include stop guessing capacity, test at production scale, automate, evolutionary architectures, data-driven decisions and game days. Reviews are blame-free conversations, not audits, and AWS Well-Architected Tool documents them.
  • The framework has six pillars: operational excellence (run workloads and improve processes), security (protect data, systems and assets), reliability (work correctly and consistently and recover from failure), performance efficiency (use resources efficiently as demand changes), cost optimization (deliver value at the lowest price point) and sustainability (reduce energy use).
  • The pillars differ by goal: reliability limits the impact of failures (scale horizontally, self-heal); performance efficiency selects and tunes resources to respond well (caching, compression); cost optimization seeks the lowest price per unit of value; sustainability cuts energy and resources per unit of work; operational excellence improves how workloads are run.

Understand the benefits of and strategies for migration to the AWS Cloud

  • The AWS CAF proposes an iterative, incremental journey in four phases: Envision (identify opportunities tied to outcomes), Align (find capability gaps), Launch (pilots in production) and Scale (expand the value). In large migrations, AWS recommends rehost, relocate or replatform first and modernize afterwards, because refactoring during the migration is the most complex option.
  • AWS offers resources for each migration stage: Migration Evaluator builds a data-driven business case from the on-premises estate; the AWS Migration Acceleration Program (MAP) combines methodology, tools, training, partners and funding; AWS Professional Services and AWS Partners provide experts; and services such as AWS DataSync and AWS DMS move files and databases.
  • The AWS CAF groups its foundational capabilities into six perspectives: Business, People, Governance, Platform, Security and Operations, each with its own stakeholders. It targets four business outcomes: reduced business risk, improved ESG performance, increased revenue from new products and markets, and increased operational efficiency.
  • The 7 Rs of migration are retire, retain, rehost, relocate, repurchase, replatform and refactor. Rehost moves without changes; replatform adds optimizations such as moving to Amazon RDS; retain keeps the application at the source. For databases, AWS DMS migrates between the same or different engines and can replicate ongoing changes to keep source and target in sync until cutover.

Understand concepts of cloud economics

  • In cloud economics you pay as you go, without long-term contracts or fees when you stop using a service; you save by committing to usage (Savings Plans) and pay less per unit as usage grows. The AWS Cloud Value Framework measures value beyond TCO: staff productivity, operational resilience, business agility and sustainability.
  • Moving to the cloud saves money because you pay only for what you use: environments that are not needed all day can be stopped. Migration strategies also affect cost: repurchase (SaaS) typically reduces maintenance, infrastructure and licensing costs, and replatform can lower costs with managed services, AWS Graviton processors or a move from Windows to Linux.
  • In your own data center, servers and facilities are fixed costs paid up front whether or not they are used. On AWS they become variable costs: you pay only for what you consume, and IT capital expenditure can become operational expense. This reduces the risk of buying assets that are no longer needed and of holding idle capacity.
  • An on-premises environment needs upfront investment in hardware, software licenses and facilities, plus ongoing spending on power, cooling, staff and maintenance across the equipment's whole lifecycle. Scaling requires planning, buying and installing hardware that cannot be scaled back down. In the cloud, the provider maintains the physical infrastructure and you pay as you go.
  • With License Included, AWS holds the software license and its cost is part of the resource price; with BYOL you reuse licenses you already own. Per-socket or per-core licenses fit EC2 Dedicated Hosts, and AWS License Manager tracks license usage and lets you switch between BYOL and AWS provided licenses without redeploying workloads.

2. Security and Compliance

30–30%

Understand the AWS shared responsibility model

  • Security and compliance are split between AWS and the customer: AWS handles security of the cloud and the customer handles security in the cloud. The split depends on the services chosen, how they are integrated and the applicable regulations, and it also covers IT controls, whose management, operation and verification are shared.
  • The model has two parts: security of the cloud (AWS protects hardware, software, networking and facilities) and security in the cloud (the customer). Controls are grouped as inherited, such as physical and environmental controls; shared, such as patch management, configuration management and training; and customer specific, such as zoning data within specific security environments.
  • The customer is responsible for security in the cloud: its data and encryption, asset classification, IAM permissions, network and security group configuration and, on Amazon EC2, the guest operating system with its patches and the software installed. It must also demonstrate its own regulatory compliance, because AWS reports cover only the AWS side.
  • AWS is responsible for security of the cloud: the hardware, software, networking and facilities that run its services, from the host operating system and virtualization layer down to physical security. That includes power, cooling, data center access control, secure media decommissioning and, in multi-tenant services such as DynamoDB, applying patches.
  • Shared controls apply to both the infrastructure and the customer layer, each in its own scope: in patch management AWS patches its infrastructure and the customer patches its guest OS and applications; configuration management works the same way; and each party trains its own employees. In services such as Amazon RDS, AWS releases patches and the customer chooses the maintenance window.

Understand AWS Cloud security, governance, and compliance concepts

  • Governance on AWS combines several pieces: AWS Organizations manages accounts centrally, and its service control policies limit maximum permissions without granting them; AWS Control Tower sets up a landing zone with controls based on best practices; and AWS Config records configuration history and uses rules to evaluate whether resources comply.
  • Encryption makes data unreadable without the decryption key and, together with access controls, reduces the risk of unauthorized access at rest and in transit. AWS KMS creates and controls keys in hardware security modules operated by AWS, each key use is logged in CloudTrail, and Amazon S3 encrypts new objects by default.
  • AWS CloudTrail records who took which API action, on which resource and when; VPC Flow Logs capture IP traffic for network interfaces; S3 server access logs and Elastic Load Balancing access logs record requests to buckets and load balancers; CloudWatch Logs centralizes and queries logs; and Amazon Security Lake gathers security data from many sources into a data lake using the OCSF schema.
  • AWS Artifact is the self-service portal for downloading AWS compliance reports (SOC, ISO, PCI) on demand and for reviewing, accepting and tracking agreements such as the BAA, including for a whole organization. The AWS Services in Scope by Compliance Program page shows which services each program covers; a service that is not listed can still be used, but the customer must assess its data.
  • Compliance obligations depend on the country and the industry. With AWS Regions, customers decide where their data is stored, which matters for rules such as the GDPR. AWS separates certifications assessed by third-party auditors (ISO 27001, SOC 2) from laws such as HIPAA, which have no certification for cloud providers; for HIPAA, AWS offers a Business Associate Addendum.

Identify AWS access management capabilities

  • AWS Identity and Access Management (IAM) controls who is authenticated and what they are authorized to do in an AWS account. IAM roles deliver temporary credentials, for example to applications on EC2, instead of long-term keys. In AWS Organizations, SCPs set the maximum permissions for member accounts, but they never grant permissions on their own.
  • The root user is created with the account and has complete access to all its services and resources, including billing, so it should not be used for daily work. AWS recommends protecting it carefully: use a business-managed group email address, do not share its credentials, and give the email inbox and the phone number, which can recover root access, to different people.
  • The principle of least privilege means granting only the permissions each task needs, by specifying actions, resources and conditions. Teams can start with broader permissions and reduce them over time: IAM last accessed information reveals unused permissions, and IAM Access Analyzer generates fine-grained policies from activity recorded in AWS CloudTrail.
  • AWS IAM Identity Center connects workforce users, created in it or synchronized from an existing identity provider, to their AWS accounts and applications through the AWS access portal. The organization instance, in the management account, is the best practice and lets administrators use permission sets to define job functions and assign them across many accounts.
  • Access keys are long-term credentials for the CLI or API, and AWS recommends preferring temporary credentials. The IAM password policy sets complexity and expiration for IAM users but does not cover the root user or access keys. AWS Secrets Manager stores and rotates secrets such as database credentials, and Systems Manager Parameter Store keeps configuration data.

Identify components and resources for security

  • AWS offers managed security services for each need: AWS KMS creates and controls encryption keys, ACM issues and renews SSL/TLS certificates, Amazon Macie discovers sensitive data in S3, Amazon Inspector looks for software vulnerabilities and Amazon Detective helps investigate the root cause of findings.
  • AWS Artifact provides on-demand downloads of AWS compliance reports (ISO, PCI, SOC) and lets you review and accept agreements with AWS. Independent auditors assess these certifications, but customers remain responsible for their own compliance. The Well-Architected Security pillar gathers the best practices for designing secure workloads.
  • AWS WAF filters HTTP(S) requests to resources such as CloudFront or an Application Load Balancer. AWS Shield Standard protects all customers at no charge against the most common DDoS attacks, and Shield Advanced extends that protection. Firewall Manager applies rules across an organization's accounts and GuardDuty detects threats by analyzing logs.
  • AWS Marketplace is a curated digital catalog where you find, buy and deploy third-party security products, such as firewalls, intrusion detection or rules for AWS WAF. They are delivered as AMIs, SaaS or CloudFormation templates, support options such as free trials or BYOL, and charges appear on the AWS bill.
  • AWS publishes security information in several places: the AWS Security Center (aws.amazon.com/security) gathers services, partner solutions and learning resources; the AWS Security Blog covers new features, samples and workshops; Security Bulletins report vulnerabilities in AWS services; and the AWS Knowledge Center on re:Post answers the most frequent questions.

3. Cloud Technology and Services

34–34%

Define methods of deploying and operating in the AWS Cloud

  • On AWS you can provision in several ways: with infrastructure as code templates (CloudFormation), by uploading code so that Elastic Beanstalk creates and scales the environment, or by creating resources one by one from the console or CLI. To operate servers at scale, AWS Systems Manager patches and runs commands on AWS and on premises.
  • AWS services can be accessed in several ways: the AWS Management Console, a web application with every service console; the AWS CLI, commands in a shell for scripting; the AWS SDKs, to call the APIs from application code; and AWS CloudShell, a pre-authenticated browser shell that needs no installation.
  • AWS distinguishes three deployment models: cloud, where all parts of the application run in the cloud; hybrid, which connects cloud resources with existing infrastructure outside the cloud; and on-premises or private cloud, with virtualized resources in your own facilities, which gives dedicated resources but few cloud benefits.
  • The console suits interactive, occasional tasks. Programmatic access is for automation: the AWS CLI for shell scripts and the AWS SDKs to call services from application code. Infrastructure as code (CloudFormation, or the AWS CDK with languages such as TypeScript or Python) creates consistent, repeatable and version-controlled environments.
  • For a one-off task that will not be repeated, the console or a single CLI command is usually enough. When the same infrastructure must be created several times identically, use a repeatable infrastructure as code process: a CloudFormation template is reused, versioned like code, and avoids the errors of manual runbooks.

Define the AWS global infrastructure

  • An AWS Region is a separate geographic area isolated from the others; regional resources exist only in the Region where they are created. Each Region has several Availability Zones, made of one or more separate data centers with redundant power and networking. Edge locations bring content closer to users.
  • High availability on AWS relies on not depending on a single location: AWS recommends deploying applications across multiple Availability Zones so they keep running if one fails. Elastic Load Balancing spreads traffic across targets in several zones, checks their health and sends requests only to healthy ones.
  • Using multiple Regions lets you recover if an entire Region is affected (strategies such as pilot light, warm standby or active/active), bring the application closer to users in different geographies and comply with data residency laws. When choosing a Region, weigh compliance, latency, cost and available services; compliance takes precedence.
  • Edge locations are points of the AWS global network close to users. Amazon CloudFront uses them to cache content and route each request to the location with the lowest latency; if the content is not cached, it fetches it from the origin, such as an S3 bucket. The result is faster delivery to users around the world.
  • An AWS Region is a geographic location that groups several isolated Availability Zones, and each AZ consists of one or more data centers with redundant power, networking and connectivity. Edge locations are points of presence around the world that Amazon CloudFront uses to serve cached content close to users and reduce latency.

Identify AWS compute services

  • AWS offers several compute options: Amazon EC2 for virtual servers with full control, Amazon Lightsail for simple virtual private servers at a predictable monthly price, AWS Elastic Beanstalk to deploy code while AWS manages capacity, load balancing, scaling and health, AWS Lambda for serverless code, and AWS Batch for batch jobs.
  • The EC2 instance type is chosen by workload: general purpose balances compute, memory and networking (web servers); compute optimized suits CPU-bound jobs such as transcoding or batch; memory optimized handles large in-memory data; storage optimized delivers heavy local storage I/O; and accelerated computing uses GPUs or other accelerators.
  • Amazon ECS is AWS's own fully managed container orchestrator; Amazon EKS is the managed Kubernetes service, where AWS manages the control plane and Kubernetes applications run unchanged. Amazon ECR is the managed registry that stores the images, and containers can run on EC2 or on AWS Fargate.
  • AWS Lambda runs code in response to events without provisioning servers, scales automatically and charges only for the compute time consumed. AWS Fargate is the serverless engine for Amazon ECS containers: you define the CPU and memory of each task and AWS takes care of the servers, with no EC2 clusters to manage.
  • Elasticity is the ability to acquire resources when needed and release them when they are no longer needed, automatically. Amazon EC2 Auto Scaling provides it by launching and terminating instances according to demand, within a minimum and maximum, and it replaces unhealthy instances. This avoids paying for idle capacity sized for the peak without losing performance at busy times.

Identify AWS database services

  • AWS offers purpose-built databases: relational (Amazon RDS, Aurora), key-value (DynamoDB), in-memory (ElastiCache, MemoryDB), MongoDB-compatible document (DocumentDB), Cassandra-compatible wide column (Keyspaces), graph for highly connected data (Neptune), and a data warehouse for analytics (Redshift). The choice follows the data model and the use case.
  • Databases are migrated to AWS with AWS DMS, which copies the data and can replicate ongoing changes to keep source and target in sync and reduce downtime. If the target engine is the same, no schema conversion is needed; if it changes (for example, from Oracle to Aurora PostgreSQL), the schema is converted first with DMS Schema Conversion or AWS SCT.
  • With a managed database such as Amazon RDS, AWS handles installation, OS and engine patching, backups, scaling and high availability; the customer still tunes its queries. A database installed on Amazon EC2 gives full control over the instance and operating system, but the customer takes on all of those tasks.
  • Amazon RDS manages relational databases on familiar engines (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, Db2) and handles backups, patching and failure recovery. Amazon Aurora is its own MySQL- and PostgreSQL-compatible engine, with storage that grows automatically. Multi-AZ adds high availability with a standby instance, and read replicas scale read queries.
  • Amazon DynamoDB is a serverless, fully managed NoSQL database with key-value and document models and single-digit millisecond performance at any scale; it does not support JOINs like a relational database. Global tables replicate data multi-actively across Regions, DynamoDB Streams captures changes and DAX adds an in-memory cache.

Identify AWS network services

  • AWS network services include Amazon VPC for isolated networks, AWS Site-to-Site VPN for encrypted tunnels to on-premises networks, AWS Direct Connect for a dedicated private connection, AWS Transit Gateway as a hub between many VPCs and sites, Amazon CloudFront to deliver content from edge locations, AWS Global Accelerator to improve availability with static IPs and Amazon Route 53 for DNS.
  • A VPC is an isolated virtual network in which you create subnets, each inside a single Availability Zone. Route tables decide where traffic goes: a subnet is public if it has a route to an internet gateway and private if it does not. A NAT gateway gives private subnets outbound internet access without accepting inbound connections, and a virtual private gateway terminates a Site-to-Site VPN.
  • In a VPC, security groups are the primary control: they act at instance level, have allow rules only and are stateful. Network ACLs act at subnet level, support allow and deny rules, are evaluated in order and are stateless, so they serve as an extra layer. Amazon Inspector continually scans EC2, ECR images and Lambda for software vulnerabilities and network exposure.
  • Amazon Route 53 is a highly available DNS service with three functions: registering domains, routing internet traffic to resources, and checking their health to steer traffic away from failing ones. Its routing policies can split traffic by weight, send users to the lowest-latency Region, decide by location, or perform active-passive failover.
  • AWS Direct Connect links an on-premises network to AWS over a dedicated connection that does not use the public internet. AWS Site-to-Site VPN creates encrypted IPsec tunnels over the internet between a data center or branch office and a VPC, and AWS Client VPN is a managed service for individual remote users who connect with an OpenVPN client. Direct Connect and Site-to-Site VPN can be combined for end-to-end encryption.

Identify AWS storage services

  • AWS offers object storage (Amazon S3), block storage (Amazon EBS), file storage (Amazon EFS and Amazon FSx), hybrid storage (AWS Storage Gateway) and data protection services such as AWS Backup and AWS Elastic Disaster Recovery, which replicates servers so they can be recovered with little data loss. S3 Object Lock prevents objects from being deleted or overwritten for a period and helps meet WORM requirements.
  • Object storage keeps data in a flat structure, with metadata and a unique identifier for each object, and scales almost without limit. Amazon S3 is used for data lakes, static websites, mobile applications, backup and restore, archiving, IoT devices and big data analytics. Block storage suits low-latency structured data, and file storage suits hierarchical shared file access.
  • Every S3 object has a storage class: S3 Standard for frequently accessed data, S3 Intelligent-Tiering for unknown or changing patterns, S3 Standard-IA and S3 One Zone-IA (single zone, cheaper, only for data that can be re-created) for infrequent access, and the S3 Glacier classes for archiving. Glacier Flexible Retrieval and Glacier Deep Archive data is not available for real-time access.
  • Amazon EBS provides persistent block volumes that attach to EC2 instances like a local hard drive; volume data is replicated within an Availability Zone and snapshots serve as backups. Instance store is temporary block storage on the host's disks, included in the instance price, and its data is lost when the instance is stopped, hibernated or terminated.
  • Amazon EFS is serverless, elastic file storage for Linux workloads, accessed over NFS from EC2, containers and Lambda, that grows and shrinks on its own. Amazon FSx offers well-known managed file systems: FSx for Windows File Server (SMB, NTFS, Active Directory), FSx for Lustre (HPC and machine learning, integrated with S3), FSx for NetApp ONTAP and FSx for OpenZFS.

Identify AWS artificial intelligence and machine learning (AI/ML) services and analytics services

  • AWS offers pretrained AI services that need no ML expertise: Amazon Comprehend analyzes text, Amazon Rekognition analyzes images and video, Amazon Transcribe converts speech to text, Amazon Polly converts text to speech, Amazon Translate translates, Amazon Textract extracts data from documents and Amazon Lex builds chatbots. Amazon Bedrock gives API access to foundation models, and Amazon SageMaker AI is used to build, train and deploy custom models.
  • AWS covers the whole analytics cycle: Amazon Kinesis captures and processes real-time streaming data, AWS Glue prepares and catalogs data with serverless ETL, Amazon Athena queries S3 data with SQL, Amazon Redshift is the petabyte-scale data warehouse, Amazon EMR runs big data frameworks such as Apache Spark, Amazon OpenSearch Service analyzes logs and Amazon Quick Sight publishes BI dashboards.
  • Amazon SageMaker AI is the fully managed service that data scientists and developers use to build, train and deploy their own ML models. Amazon Lex builds chatbots and conversational interfaces for voice and text with speech recognition and natural language understanding. Other services handle specific tasks: Rekognition (images and video), Personalize (recommendations), Textract (documents) and Kendra (enterprise search).
  • Amazon Athena queries data stored in Amazon S3 with standard SQL, serverless and paid per query. Amazon Kinesis captures and processes real-time streaming data such as clickstreams or IoT telemetry. AWS Glue is a serverless ETL service that discovers data and catalogs it in the AWS Glue Data Catalog. Amazon Quick Sight, formerly QuickSight and now part of Amazon Quick, builds and shares interactive BI dashboards.

Identify services from other in-scope AWS service categories

  • Amazon SQS is a fully managed message queue that stores messages to decouple components; consumers receive them when they are ready. Amazon SNS is a publish/subscribe service that pushes each message on a topic to many subscribers, such as queues, Lambda functions, email or SMS. Amazon EventBridge is a serverless event bus that routes events from applications, AWS services and SaaS applications by using rules.
  • Amazon Connect, whose contact center product is now called Amazon Connect Customer, is a cloud contact center that connects customers with agents through voice, chat and SMS, with intelligent routing and real-time metrics. Amazon SES is a platform for sending and receiving email with your own domains: transactional email, marketing email and newsletters, and processing of incoming mail.
  • Every AWS customer has Basic Support at no cost: 24/7 customer service, documentation, whitepapers, AWS re:Post, core Trusted Advisor checks and AWS Health. Paid plans add technical support from experts with response times and the full set of Trusted Advisor checks; Enterprise Support, intended for business-critical workloads, includes a designated Technical Account Manager.
  • AWS CodeBuild is a fully managed build service that compiles code, runs tests and produces artifacts without your own servers. AWS CodePipeline is a continuous delivery service that models and automates the stages of a software release. AWS X-Ray collects data about the requests an application serves, including calls to downstream services, and shows a trace map to find errors and bottlenecks.
  • Amazon WorkSpaces provisions virtual cloud desktops running Windows or Linux, either persistent (Personal) or non-persistent (Pools). Amazon WorkSpaces Applications, formerly Amazon AppStream 2.0, streams desktop applications to any device, including through an HTML5 browser, without storing data on the device. Amazon WorkSpaces Secure Browser gives access to internal websites and SaaS from the local browser, without a VPN.

4. Billing, Pricing, and Support

12–12%

Compare AWS pricing models

  • EC2 offers several purchasing options: On-Demand (per-second billing, no commitment), Savings Plans and Reserved Instances (one- or three-year commitment for a discount), Spot (interruptible spare capacity), Dedicated Hosts (a physical server with socket and core visibility for your own licenses), Dedicated Instances (single-tenant hardware) and Capacity Reservations (assured capacity in one zone).
  • Amazon S3 offers storage classes by access pattern: S3 Standard for frequently used data, Intelligent-Tiering for unknown patterns, Standard-IA and One Zone-IA for rarely accessed data with millisecond access (One Zone-IA in a single zone and for re-creatable data) and the Glacier classes for archives, with Deep Archive as the lowest-cost option.
  • On-Demand fits short or unpredictable workloads that cannot be interrupted. Spot is the cheapest when the workload is flexible and tolerates interruption, such as batch or analytics jobs. For steady usage, Savings Plans and Reserved Instances give discounts for commitment: Compute Savings Plans keeps applying across instance families and Regions and covers Fargate and Lambda; Dedicated Hosts suit your own licenses.
  • Reserved Instances offer flexibility in two ways. By class: Standard gives a larger discount but cannot be exchanged, and Convertible can be exchanged during the term for another family, platform or tenancy. By scope: regional applies the discount in any zone of its Region and to any size in the family (Linux/Unix, default tenancy) without reserving capacity; zonal does reserve capacity.
  • With AWS Organizations consolidated billing, all accounts count as one for billing: a Reserved Instance benefit applies first to the account that bought it, and any remainder can be used by matching usage in other accounts. The management account can turn that sharing off per account, or restrict it to groups of accounts, in the billing preferences.

Understand resources for billing, budget, and cost management

  • AWS Billing and Cost Management brings billing together: the Bills page lets you download invoices and see the detail of each charge, and there are pages for payments, payment methods, credits and preferences. All account owners get account and billing support at no cost: for questions or disputes about a bill, open an Account and billing case in the AWS Support Center.
  • Official pricing information lives on each service's pricing page, which is what AWS applies when it charges. To read it programmatically there is AWS Price List: the Query API looks up prices by attribute at the SKU level, and the Bulk API downloads JSON or CSV files per service and Region. AWS Pricing Calculator uses that data to build estimates.
  • AWS Organizations centrally manages multiple AWS accounts: you can create them programmatically, group them into organizational units (OUs) and apply policies such as service control policies (SCPs), which set the maximum permissions for member accounts. It also simplifies billing with a single payment method and one consolidated bill for all the accounts.
  • A cost allocation tag is a key-value label on a resource that AWS uses to organize costs by business category, such as cost center, application or owner. To appear in Cost Explorer and in reports, it must be activated in the Billing and Cost Management console; in an organization, only the management account can do this.
  • AWS Budgets sets cost or usage amounts, or utilization and coverage targets for Reserved Instances and Savings Plans, and alerts by email or Amazon SNS when actual or forecasted spend crosses them; it can also run actions such as applying an IAM policy. AWS Cost Explorer analyzes historical costs and usage with graphs, filters and grouping, shows trends and forecasts future spend.

Identify AWS technical resources and AWS Support options

  • Official AWS websites group resources with different purposes: the AWS Solutions Library offers solutions and guidance vetted by AWS architects, with deployable code; AWS Decision Guides compare services and explain the criteria for choosing; and the AWS Architecture Center publishes reference architectures and the AWS Well-Architected Framework.
  • AWS gives Basic Support to every customer and offers three paid plans: Business Support+, with 24/7 access to engineers, third-party software support and the AWS Support API; Enterprise Support, which adds a designated Technical Account Manager; and Unified Operations, for mission-critical workloads, with designated Domain Specialist Engineers, 24/7 monitoring and Incident Management Engineers.
  • The AWS Partner Network (APN) is the global community of organizations that use AWS technologies, programs and tools to build solutions and services. ISVs develop software that runs on AWS (Software Path), and system integrators deliver consulting, professional or managed services (Services Path). Customers find them with the AWS Partner Solutions Finder.
  • AWS Support Center is the console for creating and managing support cases. Every customer can open account and billing cases and service quota increase requests; technical cases need a paid plan. IAM users have no access by default: they must be granted permissions, for example with the AWSSupportAccess managed policy.
  • Each service's documentation (user guides, API and CLI references) lives on docs.aws.amazon.com. Whitepapers, decision guides and architecture diagrams are on the AWS Whitepapers & Guides page, which includes the Overview of Amazon Web Services. Announcements appear on What's New with AWS, and technical articles on AWS Blogs.
Practice this certification