CertifyDeck
Start for free
All cheat sheets
MLA-C02 · CHEAT SHEET

AWS Certified Machine Learning Engineer - Associate

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Data Preparation for ML and AI

28–28%

Collect and store data

  • SageMaker AI trains on data in Amazon S3, Amazon EFS or Amazon FSx for Lustre: File mode downloads the whole dataset, FastFile mode streams it on demand with file access, and EFS or FSx are mounted through a VPC. To extract data from operational databases without affecting them, DynamoDB export to S3 consumes no read capacity and RDS snapshot export writes Parquet to S3 in the background.
  • The S3 storage class is chosen by access pattern and resilience: Intelligent-Tiering for unknown access patterns, IA classes for rarely used data (One Zone-IA only if it can be re-created), Express One Zone for the lowest latency and Glacier classes for archives. For regulatory immutability, S3 Object Lock in compliance mode prevents anyone, including the root user, from deleting or overwriting versions during retention.
  • Ingestion capacity problems often come from poorly distributed keys: in Kinesis Data Streams and in DynamoDB, including global secondary indexes, a low-cardinality partition key creates hot partitions that adding capacity does not fix. In Amazon S3, request rates scale per prefix and gradually, so spread the load across prefixes and retry 503 Slow Down errors.
  • Amazon Data Firehose delivers streaming data to Amazon S3 and other destinations without writing applications, buffering it by size or time, and can read directly from Kinesis Data Streams or an Amazon MSK topic. For stateful, time-windowed computation use Amazon Managed Service for Apache Flink, and when several applications read the same stream, enhanced fan-out gives each one dedicated read throughput.
  • Choose the format by how the data is read: Parquet and ORC are columnar, compress by column and let engines skip blocks, so they reduce the data that Athena and other engines read; convert with CTAS, AWS Glue or Amazon Data Firehose format conversion, which accepts only JSON input. SageMaker AI built-in algorithms require specific formats, such as CSV with no header and the target in the first column.

Perform data transformation, feature engineering, and pre-processing

  • AWS Glue is a serverless data integration service that runs Apache Spark ETL jobs and uses job bookmarks to process only new data. AWS Glue DataBrew cleans and normalizes data without code through reusable recipes, and EMR Serverless runs Spark without managing clusters. SageMaker Data Wrangler, now integrated into SageMaker Canvas, prepares data with little code and exports the flow to S3, Pipelines or Feature Store.
  • SageMaker Feature Store organizes features in feature groups with a record identifier and an event time. The online store keeps only the latest record for low-latency lookups and supports TTL; the offline store in Amazon S3 keeps the full history for training and batch inference. Training sets without data leakage are built with point-in-time joins on the offline store.
  • Amazon Data Firehose can invoke a Lambda function that transforms each batch and marks records as Ok, Dropped or ProcessingFailed, and it can convert JSON to Parquet or ORC using an AWS Glue Data Catalog schema. Lambda keeps state across invocations with tumbling windows on Kinesis. AWS Glue streaming jobs use Spark Structured Streaming, process data in windows and use checkpoints instead of job bookmarks.
  • Normalization brings numeric values into a [0,1] range and standardization gives them mean 0 and standard deviation 1, so high-magnitude variables do not dominate the model. Binning turns a numeric value into categorical ranges when its relationship with the target is not linear, and a log transformation reduces skew. SageMaker Data Wrangler and AWS Glue DataBrew provide these transformations without code.
  • Amazon Bedrock embeddings models turn text, images or both into vectors; multimodal models place them in a shared semantic space so images can be searched by text. A smaller output dimension can be chosen to reduce storage and latency, but the vector index must use the same dimension. Similarity is computed by the vector database, and large indexing volumes are best handled with batch jobs.

Validate data quality and manage bias

  • AWS Glue Data Quality defines rules in DQDL and evaluates them on Data Catalog tables (with rule recommendations) or inside ETL jobs, where it can isolate failing records before loading. Its analyzers and ML-based anomaly detection learn trends and seasonality. In DataBrew, rulesets are validated by profile jobs, which emit events that EventBridge can filter.
  • Amazon SageMaker Ground Truth labels data with private or vendor workforces, consolidates annotations from several workers and offers active-learning automated labeling for built-in tasks. Verification jobs rate labels and adjustment jobs correct them. To pre-label large volumes with a foundation model, Amazon Bedrock batch inference processes prompts from S3.
  • SageMaker Clarify pre-training metrics such as Class Imbalance and DPL detect underrepresentation and label differences between groups without a model. To mitigate bias: split by key or with stratification in Data Wrangler, shuffle the data every epoch with ShuffleConfig, and augment images with color, rotation and crop transformations.
  • SageMaker Clarify computes bias metrics on tabular data: numeric facets are split with a threshold and categorical ones by value. For text or images, build a table of per-item attributes (for example, the language detected with Amazon Comprehend). JS compares multiclass distributions symmetrically, and CDD conditions disparity on subgroups to rule out Simpson's paradox.
  • Data Wrangler balances classes with random oversampling, random undersampling or SMOTE, which interpolates synthetic samples from numeric features only and copies non-numeric ones. Without changing the data, XGBoost uses scale_pos_weight and multi-label Image Classification uses use_weighted_loss. To evaluate the rare class, use a stratified split and metrics such as balanced accuracy instead of overall accuracy.

2. ML Model and Foundation Model (FM) Development

24–24%

Choose appropriate modeling approaches for ML and AI solutions

  • Amazon Bedrock Evaluations compares models in three ways: programmatic jobs with built-in or custom datasets, a judge model that scores with metrics such as correctness, faithfulness or logical coherence, and human work teams for subjective criteria. Judge-model jobs accept responses from models outside Amazon Bedrock. Before evaluating, filter candidates by modality, context window, latency and cost.
  • Amazon Bedrock offers supervised fine-tuning with labeled data, reinforcement fine-tuning with reward functions (for example in AWS Lambda) when success is verifiable and labeling is expensive, and distillation to move a large model's knowledge into a smaller one, even from invocation logs. On SageMaker AI, PEFT techniques such as LoRA make tuning cheaper and faster by updating fewer parameters.
  • Choose the model from the problem and its constraints: SageMaker AI offers built-in algorithms per task type (XGBoost for tabular data, DeepAR for time series, Random Cut Forest for anomalies), and SageMaker JumpStart provides pretrained models and solution templates. When explainability is critical, prefer an inherently interpretable model; when accuracy comes first, use a complex model explained with SageMaker Clarify.
  • The higher the level, the less effort and the less control: AI services such as Amazon Translate or Amazon Textract need no ML expertise; Amazon Bedrock gives serverless access to foundation models with prompting and RAG; SageMaker AI supports training and customization with full control, and self-managed infrastructure gives maximum flexibility. A common path is to start in Bedrock and move to SageMaker AI as customization grows.
  • Amazon Bedrock Knowledge Bases covers several RAG patterns: managed knowledge bases with connectors, ACL-aware filtering and MCP access through AgentCore Gateway; customer-managed knowledge bases with your own vector store; structured data stores in Amazon Redshift, where questions become SQL; and GraphRAG with Amazon Neptune Analytics to connect entities across documents.

Train, fine-tune, and customize models for ML and AI solutions

  • SageMaker AI provides built-in algorithms per problem type: XGBoost, LightGBM or Linear Learner for tabular data, DeepAR to forecast many related time series, Factorization Machines for sparse data such as click prediction, IP Insights to relate entities to IPv4 addresses, and Random Cut Forest for anomalies. Each algorithm requires specific input formats, such as recordIO-protobuf.
  • Script mode runs your own training code in SageMaker AI managed containers (PyTorch, TensorFlow, scikit-learn, XGBoost) without building Docker images. Dependencies are installed from requirements.txt, each channel's data arrives in SM_CHANNEL_<NAME>, and the model saved to SM_MODEL_DIR is packaged as model.tar.gz. Extending or building an image only pays off when the managed container is not enough.
  • SageMaker AI automatic model tuning (AMT) launches training jobs with Bayesian, Random, Grid (categorical values only) or Hyperband strategies, the last of which stops weak configurations and reallocates epochs. Use logarithmic scaling for ranges spanning several orders of magnitude, limit the number of hyperparameters, and reuse previous jobs with warm start (TRANSFER_LEARNING when the data changes).
  • To train faster on SageMaker AI: use data parallelism when the model fits on one GPU and model parallelism when it does not; use early stopping in tuning (TrainingJobEarlyStoppingType set to AUTO, with the metric emitted every epoch) or Hyperband; and use managed warm pools to reuse instances across consecutive jobs with the same configuration.
  • Overfitting means good training results but poor validation results; fix it with more regularization, less complexity (for example a lower XGBoost max_depth), fewer epochs or early stopping. Underfitting means poor results on both; add features and reduce regularization. Catastrophic forgetting when fine-tuning foundation models is mitigated by mixing domain data with general-purpose data.

Analyze and evaluate the performance of ML and AI systems

  • Managed MLflow on SageMaker AI logs the parameters, metrics and artifacts of every run, lets you compare runs and promote the best model to SageMaker Model Registry. In Bedrock, Prompt Management keeps point-in-time prompt versions and variants to compare, and Bedrock evaluations reuse the same dataset in Amazon S3 so each test can be rerun.
  • Data drift is detected by comparing captured traffic with a baseline of statistics and constraints computed on the training data; model quality drift requires merging predictions with actual labels that arrive later. CloudWatch anomaly detection alarms learn the seasonality of a metric and avoid static thresholds.
  • A shadow variant receives a copy of the traffic sent to the production variant on the same endpoint, and its responses never reach the caller, so it is tested on live traffic with no user impact. The test dashboard compares operational metrics; to compare predictions, turn on data capture. When promoting it with its own instances, test with 100 percent traffic sampling.
  • Shapley values (SHAP) assign each feature its contribution to a specific prediction and, aggregated, give global importance; partial dependence plots show the average effect of a feature. SHAP explanations depend on the chosen baseline. In RAG, RetrieveAndGenerate in Amazon Bedrock Knowledge Bases returns citations that link each part of the answer to its source.
  • With your own algorithm, metric definitions (a name and a regular expression) make SageMaker AI send training and validation loss to CloudWatch in real time. TensorBoard in SageMaker AI shows gradient and weight distributions to diagnose vanishing or exploding gradients. If validation worsens while training improves, the model is overfitting: add regularization or stop earlier.

3. Deployment and Orchestration of ML and AI Workflows

24–24%

Manage deployment infrastructure for ML and AI model types

  • The deployment target depends on where and how inference runs. Inference Recommender automates load testing to pick the instance type and count with the best cost and performance; Serverless Inference removes instance management but does not support GPUs or VPC configuration; and SageMaker Neo compiles models for edge devices, which run the model locally with the Neo runtime.
  • Multi-model endpoints share one container and load many same-framework models from S3 on demand, at the cost of cold starts; multi-container endpoints host containers with different frameworks, invoked directly or in sequence. For orchestration, SageMaker Pipelines is the purpose-built ML service, Step Functions integrates SageMaker AI jobs, and Amazon MWAA runs Airflow DAGs without managing infrastructure.
  • SageMaker AI offers four inference strategies: real-time for low latency with sustained traffic, Serverless Inference for intermittent traffic (with Provisioned Concurrency for predictable bursts), Asynchronous Inference for large payloads and long processing with a queue and scale to zero, and batch transform for whole datasets in S3 without a persistent endpoint.
  • Amazon Bedrock offers several ways to consume a foundation model: on demand, through cross-Region inference profiles (geographic for data residency or global), Provisioned Throughput for a fixed, hourly-billed throughput level, batch inference for prompt sets in S3, and Bedrock Marketplace, which deploys specialized models to SageMaker AI endpoints reachable through the Bedrock APIs.
  • A model trained outside AWS is hosted on SageMaker AI as a tar.gz in S3 with a prebuilt container (plus requirements.txt) or with your own container that meets the contract: a server on port 8080 with /invocations and /ping. Amazon Bedrock Custom Model Import brings customized foundation models in Hugging Face format (safetensors, config and tokenizer) in from S3 for on-demand invocation.

Provision and configure resources for ML and AI workloads based on existing architecture and requirements

  • For intermittent traffic, SageMaker AI Serverless Inference charges only for use and scales to zero; with predictable bursts, Provisioned Concurrency avoids cold starts and can be scheduled with Application Auto Scaling. Asynchronous Inference queues large payloads and scales to zero. In Amazon Bedrock, Provisioned Throughput gives fixed hourly throughput, cheaper the longer the commitment.
  • In CloudFormation, Export and Fn::ImportValue share outputs between stacks in the same account and Region through a strong reference that blocks deleting or changing imported values; Fn::GetStackOutput is a weak reference. Step Functions orchestrates SageMaker AI jobs with the .sync pattern, and in SageMaker Pipelines the Callback step uses Amazon SQS and a token to wait for external processes.
  • SageMaker AI always uses containers: prebuilt images, prebuilt images with requirements.txt or extended, or your own containers. A custom inference container must serve /invocations and /ping on port 8080, read the model from /opt/ml/model, use the exec form of ENTRYPOINT to receive SIGTERM, and provide a /ping check that reports real failures so the instance gets replaced.
  • The CreateModel VpcConfig parameter connects containers to VPC subnets and security groups through network interfaces. Without internet access, an S3 VPC endpoint is needed and, for resources outside AWS, a NAT gateway. Clients invoke the endpoint privately through a SageMaker AI Runtime interface endpoint, and network isolation stops the container from making any network calls.
  • With Boto3 or the AWS CLI, a model-based deployment follows create_model, create_endpoint_config and create_endpoint; with inference components, create_inference_component assigns resources and copies to each model on a shared endpoint. The SageMaker Python SDK uses ModelBuilder and deploy(). UpdateEndpoint applies a new configuration without changing the endpoint name.

Implement automated orchestration and continuous integration and continuous delivery (CI/CD) pipelines for MLOps and AI workloads

  • SageMaker AI deployment guardrails update real-time and asynchronous endpoints with blue/green deployments (all at once, canary or linear) or with rolling deployments in batches. During the baking period, CloudWatch alarms listed in AutoRollbackConfiguration watch the new fleet and, if any trips, traffic returns to the old fleet. Rolling deployments reduce the extra capacity needed for large models.
  • AWS CodeConnections (formerly AWS CodeStar Connections) links CodePipeline, CodeBuild and CodeDeploy to third-party repositories such as GitHub or Bitbucket; a connection created with the CLI or CloudFormation stays PENDING until it is completed in the console. Typical CodeBuild failures: privileged mode missing when building Docker images, or the UseConnection permission missing from the service role in Git clone mode.
  • In SageMaker Pipelines, Processing, Training, Tuning and Transform steps launch SageMaker AI jobs; the Transform step runs batch inference over a whole dataset. Step caching, off by default and with an expiry, reuses successful runs with the same configuration. Managed spot training lowers cost; with checkpoints in Amazon S3 the job resumes after an interruption, and it never falls back to On-Demand.
  • Automated testing combines code tests in CodeBuild, with test reports in report groups, and quality gates in SageMaker Pipelines: a Condition step reads metrics with JsonGet and a Fail step stops the execution. QualityCheck and ClarifyCheck steps compare data and models with the baselines of the latest approved model version and fail when violations are found.
  • SageMaker Pipelines is an Amazon EventBridge target: a rule driven by an event pattern (for example, new objects in Amazon S3) or by a schedule calls StartPipelineExecution and passes static parameters or dynamic ones parsed from the event. With the Python SDK, PipelineSchedule and put_triggers create EventBridge Scheduler schedules. For drift-driven retraining, skip_check and register_new_baseline control baselines.

4. Operating, Monitoring, and Securing ML and AI Solutions

24–24%

Monitor ML and AI model inference and performance

  • CloudWatch generative AI observability provides prebuilt views of invocations, latency, tokens, errors and throttling for Bedrock models; to see each prompt's content you must enable model invocation logging. Bedrock evaluations score responses with an LLM as a judge, including your own production responses. For classic models, a scheduled pipeline compares data with the baseline and alerts through SNS.
  • SageMaker AI sends job, pipeline and step state change events to EventBridge; failures include the reason and can trigger SNS, Lambda or Step Functions. In CloudWatch, ModelLatency measures time inside the container, OverheadLatency the time SageMaker AI adds, and MidStreamErrors failures during streaming. CloudWatch anomaly detection learns expected bands that include seasonality.
  • Data drift is detected by comparing inputs captured in production with a baseline computed from the training data; unlike model quality, it needs no labels. SageMaker Clarify also detects feature attribution drift with the NDCG score. As a lightweight option, statistics are published as custom metrics with CloudWatch anomaly detection alarms.
  • In SageMaker AI, an A/B test hosts several models as production variants of one endpoint and splits traffic by their weights; TargetVariant forces a specific variant per request. CloudWatch publishes per-variant metrics, and UpdateEndpointWeightsAndCapacities changes the weights without updating the endpoint. A shadow test, by contrast, does not return the new model's responses to users.
  • AgentCore publishes runtime and gateway metrics to CloudWatch (system and user errors per tool, latency, target execution time) and, with ADOT instrumentation, sessions, traces and spans to find where coordination between agents breaks. AgentCore Evaluations scores sessions continuously with online evaluation. In ConverseStream, a max_tokens stopReason reveals a response truncated without an error.

Optimize and manage ML and AI infrastructure costs and performance

  • Pick the instance family from the model and the latency need: CPU often suffices for traditional ML and batch work, compute optimized or GPU instances fit demanding real-time inference, and AWS Inferentia (with the AWS Neuron SDK) gives better price-performance than GPUs for deep learning. SageMaker AI Inference Recommender load tests configurations and reports cost, latency and throughput.
  • In SageMaker AI, compare ModelLatency (container time) with OverheadLatency (service overhead) in CloudWatch to locate latency. AgentCore Observability stores metrics, spans and logs in CloudWatch; to see traces, enable CloudWatch Transaction Search and instrument the agent with the ADOT SDK. AWS X-Ray shows in its trace map which service in the request path adds latency.
  • CloudWatch dashboards bring metrics and alarms into one view; with cross-account observability, a monitoring account graphs metrics from several accounts. For Amazon Bedrock, the Model Invocations view shows invocations, latency and tokens by model, and metric math can compute output tokens per second to separate a slower model from longer responses.
  • For reliability, deploy multiple instances per production endpoint and, in a VPC, subnets in at least two Availability Zones. SageMaker AI auto scaling recommends target tracking, scheduled actions for predictable peaks, and step scaling when advanced logic is needed, such as scaling out from zero instances with inference components.
  • AWS Budgets sets limits and can run actions, such as applying an IAM policy or an SCP, when an actual or forecasted threshold is exceeded. AWS Cost Anomaly Detection uses machine learning to detect unusual spend and point to its root cause. To split Amazon Bedrock costs by team, tag application inference profiles and activate those cost allocation tags.

Secure ML and AI workloads and model endpoints

  • Amazon Inspector scans Amazon ECR images (OS and language packages) and, with continuous scanning, rescans them when new CVEs are published. In CI/CD, its plugins or the CodePipeline InspectorScan action generate an SBOM and fail the build when a severity threshold is exceeded. Inspector Code Security checks source code with SAST, SCA and IaC analysis.
  • A SageMaker AI execution role should be limited to the exact ARNs each job uses: input bucket and objects, output path and ECR repository. Tags with ResourceTag conditions separate each team's resources without editing policies. For artifacts shared across accounts, the sagemaker:ModelPackageArn session tag lets a bucket policy allow reads only during a model package deployment.
  • Applications should use IAM roles with temporary credentials and permissions limited to specific resources, such as the ARN of an Amazon Bedrock model. Condition keys enforce configuration: sagemaker:VpcSubnets, sagemaker:NetworkIsolation or sagemaker:VolumeKmsKey on SageMaker AI jobs, and bedrock:GuardrailIdentifier to require a guardrail on every inference request.
  • CloudTrail records who calls the SageMaker AI and Amazon Bedrock APIs; InvokeModel and Converse are management events, while InvokeAgent or Retrieve are data events that must be enabled with advanced event selectors. Bedrock model invocation logging stores prompts and responses in S3 or CloudWatch Logs, and AWS Config managed rules evaluate the configuration of SageMaker AI resources.
  • Many SageMaker AI access errors come from iam:PassRole: whoever creates a job or model needs permission to pass the execution role to the service, ideally scoped with iam:PassedToService. If S3 data uses a customer managed KMS key, the execution role also needs kms:Decrypt in the key policy. In Amazon Bedrock, enforcing a guardrail with bedrock:GuardrailIdentifier can cause AccessDenied errors in RetrieveAndGenerate or InvokeAgent.
Practice this certification