Everything from the map above, on one page. Dashed topics are optional. The hours are rough estimates for reading plus hands-on practice.
Stage 1 · Beginner Foundations
Set up a safe account, learn how AWS is organised and how it bills you, and get comfortable with identity and the command line. Everything later builds on IAM, so don't rush it.
Cloud computing and AWS global infrastructure
Cloud computing means renting computing, storage and services on demand instead of buying servers. AWS groups its data centres into Regions (such as us-east-1 in N. Virginia or ap-south-1 in Mumbai). Each Region has several isolated Availability Zones (AZs), each made up of one or more data centres with their own power and networking. Edge locations around the world serve cached content for CloudFront and DNS for Route 53.
Choosing a Region is a trade-off between latency to your users, price (it differs between Regions), which services are available and data residency rules. Spreading an application across two or more AZs is the basic way to survive a data-centre failure.
What to learn
- IaaS vs PaaS vs SaaS, and the benefits of the cloud (elasticity, pay-as-you-go, global reach)
- Regions, Availability Zones and edge locations, and how to choose a Region
- Global services (IAM, Route 53, CloudFront) vs Regional services (EC2, VPC, RDS)
- The AWS Management Console: switching Regions, finding services, the search bar
Free resources
Practice
Pick the Region closest to you and write down three services that are Regional and two that are global. Then find out how many AZs your Region has.
Account setup, root user, MFA and budgets
The email address you sign up with is the root user. It can do anything, including closing the account, so protect it with MFA and stop using it for daily work. Create an everyday administrator instead, ideally through IAM Identity Center, which gives you short-lived sign-ins rather than permanent passwords and keys.
Since July 2025, new accounts start on the Free plan: $100 in credits straight away (up to $200 if you complete some starter activities), lasting six months or until the credits run out, after which you upgrade to the Paid plan. Many services also have always-free monthly allowances. Set a budget alert on day one so a forgotten resource can never surprise you.
What to learn
- Turn on MFA for the root user and store its recovery details safely
- Create an admin user with IAM Identity Center (or an IAM user as a fallback)
- Create a monthly cost budget with an email alert in AWS Budgets
- Understand the Free plan, its credits and always-free limits
- Know the tasks that need the root user (closing the account, changing the support plan)
Free resources
Practice
Secure a fresh account: root MFA on, an admin sign-in that isn't root, and a $5 monthly budget that emails you at 80%.
Tools on this site
IAM: users, roles and policies
Identity and Access Management decides who can do what. Policies are JSON documents of Effect, Action, Resource and optional Condition. Everything is denied by default, an Allow grants access, and an explicit Deny always wins. Attach policies to users and groups for people, and to roles for anything that runs code.
A role has two parts: a trust policy (who may assume it: EC2, Lambda, another account, GitHub Actions) and permission policies (what it may do once assumed). Roles hand out temporary credentials, which is why "never put access keys in code" is the golden rule. Grant least privilege, then tighten it further with IAM Access Analyzer.
What to learn
- Users, groups, roles and the difference between them
- Read and write a policy: Effect, Action, Resource, Condition, wildcards
- Policy evaluation: default deny, explicit deny, identity vs resource-based policies
- Trust policies and assuming a role (STS temporary credentials)
- AWS managed vs customer managed vs inline policies
- Use IAM Access Analyzer and the policy simulator
Free resources
Practice
Write a policy that lets a user read objects from one S3 bucket only, under one prefix. Test it with the policy simulator, then prove an explicit Deny on one object overrides it.
Tools on this site
AWS CLI, profiles and CloudShell
Anything you can click in the console you can script with the AWS CLI. Configure it with aws configure sso so it signs in through IAM Identity Center and gets short-lived credentials. Use named profiles to switch between accounts, and --query (JMESPath) with --output table to read the results. CloudShell gives you a ready-made terminal in the browser, already signed in.
What to learn
- Install AWS CLI v2 and sign in with
aws configure sso / aws sso login
- Named profiles (
--profile, AWS_PROFILE) and default Regions
- Filter output with
--query and choose --output json|table|text
- Check who you are with
aws sts get-caller-identity
Free resources
Practice
List every S3 bucket with its Region in a table, using one CLI command and --query.
Shared responsibility and pricing models
Under the shared responsibility model, AWS secures the cloud itself (hardware, facilities, the hypervisor) and you secure what you put in it (your data, IAM, OS patches on EC2, network rules). The more managed the service, the more AWS takes on: you patch an EC2 instance's OS, but not Lambda's.
For compute you can pay On-Demand (no commitment), commit for one or three years with Savings Plans or Reserved Instances for big discounts, or use Spot capacity at up to 90% off if your work can be interrupted. Data transfer into AWS is free, but data going out to the internet and between AZs costs money.
What to learn
- Who is responsible for what, for EC2 vs RDS vs Lambda vs S3
- On-Demand, Savings Plans, Reserved Instances and Spot
- What data transfer costs (internet egress, cross-AZ, NAT gateway)
- Estimate a design with the AWS Pricing Calculator
- Support plans and what the free Basic plan includes
Free resources
Practice
Use the Pricing Calculator to compare one t4g.small instance for a year On-Demand vs with a 1-year Savings Plan.
Linux and networking basics
If you are new to servers, a little groundwork makes the rest of AWS much easier: connecting over SSH, Linux file permissions, how IP addresses and CIDR blocks work, ports, DNS and the basics of HTTP. You'll meet all of these again in EC2, VPC and load balancers.
What to learn
- SSH keys,
ssh, scp, and basic shell commands
- File permissions (
chmod 600, 755) and users
- IP addresses, CIDR notation (
10.0.0.0/16) and private ranges
- TCP/UDP ports, DNS records and how an HTTP request works
Free resources
Practice
Work out how many hosts fit in a /24, a /20 and a /28, then check your answers with the CIDR calculator.
Tools on this site
Am I ready? Stage 1 quiz
What is an Availability Zone?
- A country where AWS operates
- A CloudFront cache location
- One or more isolated data centres inside a Region
- A group of AWS accounts
Each Region contains several AZs with independent power and networking, close enough for fast links between them.
An IAM policy allows s3:* on a bucket, and another attached policy denies s3:DeleteObject. Can the user delete objects?
- Yes, because Allow is evaluated first
- No, an explicit Deny always wins
- Only if they use the console
- Yes, because
s3:* is more specific
IAM starts from an implicit deny, Allows open access, and any explicit Deny overrides every Allow.
Your app on EC2 needs to read from DynamoDB. What's the right way to give it credentials?
- Put an access key in an environment variable
- Hard-code the root user's keys
- Store a key in the code and rotate it monthly
- Attach an IAM role to the instance
An instance role gives the app temporary credentials that rotate automatically, with no secrets stored anywhere.
Under the shared responsibility model, who patches the operating system of an EC2 instance?
- You, the customer
- AWS
- Both, on alternate months
- Nobody, EC2 has no OS
With EC2 you manage the guest OS. With managed services like RDS or Lambda, AWS patches it.
Which pricing option fits a batch job that can be stopped and restarted at any time?
- Dedicated Hosts
- On-Demand
- Spot Instances
- A 3-year Reserved Instance
Spot uses spare capacity at a large discount, but AWS can reclaim it with two minutes' notice, which is fine for interruptible work.
Stage 2 · Core services Compute, network, storage and databases
The building blocks that almost every AWS system uses. Build each one by hand at least once, then delete it so you aren't charged.
EC2: virtual servers
Amazon EC2 runs virtual machines called instances. You choose an AMI (the disk image), an instance type (family and size: t burstable, m general purpose, c compute, r memory, with a g suffix for Graviton/ARM), storage and a security group. Disks are usually EBS volumes, which persist independently of the instance. User data scripts run on first boot to install your software.
Instead of opening SSH to the internet, connect with Session Manager, which needs no open ports or key pairs. Require IMDSv2 for the instance metadata service: it protects the instance role's credentials from SSRF attacks.
What to learn
- Instance families and sizes, and Graviton (ARM) vs x86
- AMIs, launch templates and user data
- EBS volume types (gp3, io2), snapshots, and instance store
- Connect with Session Manager or EC2 Instance Connect instead of open SSH
- Instance roles and IMDSv2
- Stop vs terminate, and what each costs
Free resources
Practice
Launch a small Linux instance whose user data installs nginx and serves "Hello from EC2". Connect with Session Manager, then terminate it.
Tools on this site
VPC networking
A VPC is your private network in a Region, defined by a CIDR block such as 10.0.0.0/16. You split it into subnets, each in one AZ. A subnet is public if its route table sends 0.0.0.0/0 to an internet gateway, and private if it doesn't. Private instances reach the internet through a NAT gateway, which costs money per hour and per GB, so use VPC endpoints for AWS services where you can. Gateway endpoints for S3 and DynamoDB are free.
Security groups are stateful, allow-only firewalls on each network interface: if a request is allowed in, the reply is allowed out. Network ACLs are stateless allow/deny rules on whole subnets. AWS reserves 5 IP addresses in every subnet.
What to learn
- Plan CIDR blocks so VPCs never overlap (you may want to peer them later)
- Public vs private subnets, route tables, internet gateway
- NAT gateway, and VPC endpoints (gateway and interface)
- Security groups vs network ACLs, and referencing one security group from another
- VPC peering and Transit Gateway basics
- VPC Flow Logs for troubleshooting
Free resources
Practice
Build a VPC by hand with one public and one private subnet in each of two AZs. Put a web server in a public subnet and make sure an instance in a private subnet can only be reached from the web server's security group.
Tools on this site
S3 object storage
Amazon S3 stores files ("objects") in buckets, with 11 nines of durability. Objects are addressed by key, and the folders you see are just key prefixes. Block Public Access is on by default and every new object is encrypted. Use storage classes to save money: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA and the Glacier classes for archives. Lifecycle rules move or delete objects automatically.
Access is controlled by IAM policies and bucket policies. To let someone download or upload a single object for a short time, generate a presigned URL instead of making anything public. Turn on versioning to recover from accidental deletes.
What to learn
- Buckets, keys, prefixes, and bucket naming rules
- Storage classes and lifecycle rules
- Bucket policies, Block Public Access, and presigned URLs
- Versioning, replication, and Object Lock
- Encryption options (SSE-S3, SSE-KMS)
- Event notifications to Lambda, SQS or EventBridge
Free resources
Practice
Create a versioned bucket with a lifecycle rule that moves objects to Standard-IA after 30 days and deletes old versions after 90. Share one file with a presigned URL that expires in 10 minutes.
Load balancing and Auto Scaling
An Application Load Balancer (layer 7) spreads HTTP(S) traffic across target groups and can route by path or host name. A Network Load Balancer (layer 4) handles TCP/UDP at very high throughput with static IPs. Both use health checks to stop sending traffic to unhealthy targets.
An Auto Scaling group keeps a fleet of instances between a minimum and a maximum size, replaces unhealthy ones and scales with demand, typically with a target tracking policy such as "keep average CPU at 50%". Together with a load balancer across several AZs, this is the classic highly available web tier.
What to learn
- ALB vs NLB vs Gateway Load Balancer
- Listeners, rules, target groups and health checks
- HTTPS on the load balancer with an ACM certificate
- Auto Scaling groups, launch templates, and scaling policies
- Read 502/503/504 errors from a load balancer
Free resources
Practice
Put two instances in an Auto Scaling group behind an ALB across two AZs. Terminate one by hand and watch the group replace it while the site stays up.
Tools on this site
Route 53 DNS
Route 53 is AWS's DNS service and domain registrar. A hosted zone holds the records for a domain. Besides the usual A, AAAA, CNAME, MX and TXT records, Route 53 has alias records, which point to AWS resources such as a load balancer or CloudFront, work at the zone apex (example.com itself) and cost nothing to query. Routing policies (weighted, latency, failover, geolocation) and health checks let DNS steer traffic.
What to learn
- Hosted zones (public and private) and record types
- Alias records vs CNAME, and the zone apex
- TTLs and how DNS caching affects changes
- Routing policies and health checks
Free resources
Practice
If you own a domain, create a hosted zone for it and add a TXT record. Check it with dig TXT yourdomain.com.
RDS and Aurora (relational databases)
Amazon RDS runs PostgreSQL, MySQL, MariaDB, SQL Server, Oracle and Db2 for you: it handles provisioning, patching, backups and failover. Multi-AZ keeps a standby copy in another AZ for high availability, while read replicas add read capacity. Don't confuse the two. Aurora is AWS's MySQL- and PostgreSQL-compatible engine with storage replicated six ways across three AZs, and has a serverless option that scales automatically.
What to learn
- Create a database in a private subnet, reachable only from your app's security group
- Multi-AZ vs read replicas
- Automated backups, snapshots and point-in-time recovery
- Aurora and Aurora Serverless v2
- Store the database password in Secrets Manager
Free resources
Practice
Create a small PostgreSQL instance in a private subnet, connect to it from an EC2 instance in the same VPC, take a manual snapshot and restore it to a new instance.
DynamoDB (NoSQL)
DynamoDB is a serverless key-value and document database with single-digit-millisecond reads at any scale. Every item has a partition key (and optionally a sort key), and you design tables around your access patterns rather than normalising. Global secondary indexes add other ways to query. Choose on-demand capacity to pay per request, or provisioned capacity for steady workloads.
What to learn
- Partition and sort keys, items and attributes
GetItem/Query vs Scan, and why scans are expensive- Global and local secondary indexes
- On-demand vs provisioned capacity
- TTL, Streams and conditional writes
Free resources
Practice
Design a table for a URL shortener: look up a long URL by short code, and list a user's links newest first. Create it and query both patterns with the CLI.
Tools on this site
CloudWatch monitoring and logs
CloudWatch collects metrics from AWS services (CPU, request counts, errors), stores logs from your applications and Lambda functions, and raises alarms that can notify you or trigger scaling. Some numbers, such as memory and disk use on EC2, need the CloudWatch agent. Logs Insights lets you search and aggregate logs with a query language.
What to learn
- Metrics, namespaces, dimensions and statistics
- Alarms with SNS email notifications
- Log groups, retention settings, and Logs Insights queries
- Dashboards, and the CloudWatch agent for memory and disk
Free resources
Practice
Create an alarm that emails you when an EC2 instance's CPU is above 70% for 5 minutes, then trigger it with a stress test.
Tools on this site
Am I ready? Stage 2 quiz
What makes a subnet "public"?
- It has "public" in its name
- Its route table sends 0.0.0.0/0 to an internet gateway
- It has a NAT gateway inside it
- Its network ACL allows all traffic
Public just means there's a route to an internet gateway. Instances still need a public IP and security group rules to be reachable.
Your RDS database must survive the loss of an Availability Zone with automatic failover. What do you enable?
- A read replica in the same AZ
- Daily snapshots
- A bigger instance type
- Multi-AZ
Multi-AZ keeps a synchronous standby in another AZ and fails over automatically. Read replicas are for scaling reads.
A security group allows inbound HTTPS. Do you need an outbound rule for the response?
- No, security groups are stateful
- Yes, always
- Only for IPv6
- Only if a NAT gateway is used
Security groups track connections, so replies to allowed requests are allowed automatically. Network ACLs are stateless and do need both directions.
How do you let a user download one private S3 object for 15 minutes?
- Make the bucket public for 15 minutes
- Email them your access keys
- Generate a presigned URL
- Copy the object to a new public bucket
A presigned URL grants temporary access to one object using the signer's permissions, and nothing becomes public.
Which Route 53 record lets example.com (the zone apex) point at a CloudFront distribution?
- A CNAME record
- An alias record
- An MX record
- A PTR record
CNAMEs aren't allowed at the zone apex. Alias records are a Route 53 feature that works there and is free to query.
Stage 3 · Intermediate Building applications
Put the building blocks together into real projects: static sites, serverless APIs, event-driven systems and containers, deployed automatically from Git.
Project: static website with S3 + CloudFront
The classic first AWS project, and exactly how a site like this one can be hosted. Store the files in a private S3 bucket, serve them through CloudFront using Origin Access Control so only CloudFront can read the bucket, add a free TLS certificate from ACM (it must be created in us-east-1 for CloudFront) and point your domain at it with a Route 53 alias record. After each upload, invalidate the cache or use versioned file names.
What to learn
- A private bucket with Origin Access Control instead of S3 website hosting
- ACM certificate in us-east-1 and DNS validation
- Default root object, custom error pages (404) and HTTPS redirects
- Cache behaviours, TTLs and invalidations
- Deploy with
aws s3 sync from CI
Free resources
Practice
Host a small site on your own domain over HTTPS with S3 + CloudFront, then add a GitHub Actions workflow that deploys on every push to main.
Tools on this site
Lambda and serverless
AWS Lambda runs your function in response to an event (an HTTP request, a file landing in S3, a message on a queue, a schedule) and bills by the millisecond, with nothing to manage when it's idle. A function can run for up to 15 minutes with 128 MB to 10 GB of memory, and CPU grows with memory. It assumes an execution role for its permissions and writes logs to CloudWatch.
Watch out for cold starts (the first request to a new execution environment is slower), keep package sizes small, and initialise SDK clients outside the handler so later invocations reuse them.
What to learn
- Handlers, events and the execution role
- Memory, timeout and concurrency settings
- Triggers: API Gateway, S3, SQS, EventBridge schedules
- Environment variables, layers and container images
- Cold starts and how to reduce them
- Error handling: retries and dead-letter queues / destinations
Free resources
Practice
Write a function that resizes images uploaded to one bucket and saves thumbnails to another, and make sure it can't trigger itself in a loop.
Tools on this site
API Gateway
API Gateway puts a managed HTTPS front door on your Lambda functions or other back ends. HTTP APIs are the cheaper, simpler choice for most Lambda back ends. REST APIs add features such as usage plans, API keys, request validation and caching. There are also WebSocket APIs. It handles throttling, CORS, custom domains and authorisation with JWTs (for example from Cognito) or Lambda authorisers.
What to learn
- HTTP API vs REST API vs WebSocket API
- Routes, integrations and Lambda proxy events
- CORS, stages and custom domains
- JWT authorisers and throttling
Free resources
Practice
Build a small to-do API: an HTTP API with GET/POST/DELETE routes backed by Lambda and DynamoDB. Test it with the API tester.
Tools on this site
SQS, SNS and EventBridge
Decoupling services with messages makes systems more resilient. SQS is a queue: producers add messages, consumers process them at their own pace, and failures go to a dead-letter queue. SNS is publish/subscribe: one message fans out to many subscribers (queues, Lambda, email). EventBridge routes events from AWS services, SaaS apps and your own code to targets based on rules, and EventBridge Scheduler runs things on a schedule.
What to learn
- SQS standard vs FIFO queues, and the visibility timeout
- Dead-letter queues and retries
- SNS topics and the fan-out pattern (SNS → several SQS queues)
- EventBridge buses, rules, event patterns and Scheduler
- Idempotent consumers (messages may arrive more than once)
Free resources
Practice
When an order is placed, publish one SNS message that fans out to two SQS queues (email and invoicing), each processed by its own Lambda, with a dead-letter queue for failures.
Tools on this site
Containers: ECR and ECS on Fargate
Package your app as a Docker image, push it to ECR (AWS's private registry) and run it on ECS. A task definition describes the containers (image, CPU, memory, environment, ports), and a service keeps the right number of tasks running behind a load balancer. With Fargate you don't manage any servers at all. EKS (managed Kubernetes) is the alternative when you need Kubernetes itself, and App Runner is the simplest option for a single web service.
What to learn
- Build, tag and push an image to ECR
- Task definitions, task role vs execution role
- Services, deployments and ALB integration
- Fargate vs EC2 launch type
- Secrets and environment variables in task definitions
- When to pick ECS, EKS, App Runner or Lambda
Free resources
Practice
Containerise a small web app, push it to ECR and run two Fargate tasks behind an ALB. Deploy a new version and watch the rolling update.
Tools on this site
Cognito authentication
Amazon Cognito user pools handle sign-up, sign-in, MFA and social logins for your users, and issue JWTs (ID, access and refresh tokens) that your API checks. Identity pools exchange those logins for temporary AWS credentials, so a mobile app can, for example, upload straight to S3.
What to learn
- User pools vs identity pools
- The hosted sign-in pages and OAuth 2.0 flows
- ID, access and refresh tokens, and how to verify them
- Protect an API Gateway route with a Cognito JWT authoriser
Free resources
Practice
Add sign-in to your to-do API: only signed-in users can call it, and each user only sees their own items.
Tools on this site
KMS, Secrets Manager and Parameter Store
KMS manages the encryption keys behind most AWS encryption. Services use envelope encryption: your data is encrypted with a data key, and the data key is encrypted with your KMS key. Store passwords and API keys in Secrets Manager, which can rotate database passwords automatically, or in Systems Manager Parameter Store (SecureString parameters), which is cheaper and good for configuration.
What to learn
- AWS managed vs customer managed KMS keys, and key policies
- Envelope encryption
- Secrets Manager rotation
- Parameter Store hierarchies and SecureString
- Read a secret from Lambda or ECS at runtime instead of baking it into code
Free resources
Practice
Move a hard-coded database password into Secrets Manager and change your app to read it at startup with its IAM role.
Tools on this site
CI/CD to AWS
Deploy automatically on every merge. From GitHub Actions, sign in to AWS with OIDC: GitHub gives each run a short-lived token and AWS swaps it for temporary credentials of an IAM role whose trust policy names your repository and branch. No access keys are stored anywhere. AWS's own pipeline services are CodePipeline, CodeBuild and CodeDeploy.
What to learn
- Create the GitHub OIDC identity provider and a deploy role in IAM
- Limit the role's trust policy to one repository and branch
- Build, test and deploy stages, and environments with approvals
- CodePipeline, CodeBuild and CodeDeploy basics
Free resources
Practice
Give your static-site or container project a pipeline that tests every pull request and deploys main using an OIDC role, with no stored AWS keys.
Tools on this site
Am I ready? Stage 3 quiz
In which Region must the ACM certificate for a CloudFront distribution be created?
- The Region of your S3 bucket
- Any Region
- us-east-1 (N. Virginia)
- The Region closest to your users
CloudFront is a global service and only uses ACM certificates from us-east-1.
What is the maximum run time of one Lambda invocation?
- 15 minutes
- 5 minutes
- 1 hour
- Unlimited
Longer jobs belong on ECS/Fargate, Step Functions or Batch.
One event must trigger three independent consumers, each with its own retries. Which pattern fits?
- One SQS queue read by all three
- Three cron jobs polling a database
- A single Lambda calling the others in sequence
- SNS (or EventBridge) fanning out to three SQS queues
Fan-out gives every consumer its own copy and its own queue, so a slow or failing consumer doesn't affect the others.
In an ECS task definition, which role does your application code use to call DynamoDB?
- The task execution role
- The task role
- The EC2 instance role
- The service-linked role
The execution role lets ECS pull images and write logs. The task role is what your code assumes.
What is the safest way for GitHub Actions to deploy to AWS?
- An IAM user's access keys in repository secrets
- The root user's keys, encrypted
- An IAM role assumed via OIDC, trusted only for your repo and branch
- A public S3 bucket that the workflow writes to
OIDC gives each run short-lived credentials, and there is no long-lived secret that could leak.
Stage 4 · Advanced Architecting and operating
Design systems that are reliable, secure and cost-effective, manage everything as code, and prepare for the certification exam.
Infrastructure as code: CloudFormation, CDK, Terraform
Clicking in the console doesn't scale and can't be reviewed. With infrastructure as code, your whole environment lives in Git. CloudFormation is AWS's native engine: templates in YAML or JSON create stacks, and change sets preview updates. The CDK lets you write the same thing in TypeScript, Python or Java and generates CloudFormation for you. Terraform works across many clouds and keeps its own state file, which for teams belongs in S3 with locking.
What to learn
- CloudFormation templates, parameters, outputs and change sets
- Drift detection, and why manual changes cause problems
- CDK constructs,
cdk synth and cdk deploy
- Terraform providers, plan/apply and remote state
- Rebuild your stage 2 VPC entirely from code
Free resources
Practice
Recreate your static-site project (bucket, CloudFront, certificate, DNS) in CDK or Terraform, delete the hand-made version and deploy it from code.
Tools on this site
Well-Architected, high availability and disaster recovery
The Well-Architected Framework is AWS's checklist for good design, organised into six pillars: operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability. For reliability, design for failure: run across several AZs, remove single points of failure and automate recovery.
Disaster recovery is planned around two numbers: RPO (how much data you can lose) and RTO (how long you can be down). The strategies, from cheapest to fastest, are backup and restore, pilot light, warm standby and multi-site active/active.
What to learn
- The six pillars and their key questions
- Multi-AZ vs multi-Region designs
- RPO and RTO, and the four DR strategies
- AWS Backup and cross-Region copies
- Read the Solutions Architect exam guide's design domains
Free resources
Practice
Run a Well-Architected review of one of your projects with the free Well-Architected Tool in the console and fix the two highest-risk items.
Security and compliance services
CloudTrail records every API call in your account: who did what, and when. AWS Config tracks resource configurations and flags rule violations. GuardDuty detects threats such as stolen credentials or crypto-mining, and Security Hub collects findings in one place. At the edge, WAF blocks malicious web requests, and Shield Standard protects against common DDoS attacks at no extra cost. Inspector scans for vulnerabilities and Macie finds sensitive data in S3.
What to learn
- CloudTrail trails and finding who changed something
- AWS Config rules and conformance packs
- GuardDuty and Security Hub
- WAF rules in front of CloudFront or an ALB, and Shield
- Inspector and Macie
Free resources
Practice
Use CloudTrail event history to find out who last modified a security group, then turn on GuardDuty and look at its sample findings.
Tools on this site
Multi-account: Organizations and Identity Center
Real companies separate workloads into many accounts (production, staging, security, logs) under AWS Organizations. Service control policies set guardrails that even account admins can't break, such as "nobody may leave the EU Regions". IAM Identity Center gives people single sign-on into every account, and Control Tower sets up a well-governed multi-account landing zone for you.
What to learn
- Organizations, organizational units and consolidated billing
- Service control policies (SCPs)
- IAM Identity Center permission sets
- Cross-account roles
- What Control Tower sets up
Free resources
Practice
Create an organisation with a separate sandbox account, and add an SCP that blocks every Region except the one you use.
Cost optimisation
Cost is an architecture concern. Cost Explorer shows where money goes, tags with cost allocation let you split it by project, and Budgets warn you before it's too late. Compute Optimizer suggests right-sized instances, and Savings Plans cut steady compute costs. Common surprises are idle resources, NAT gateway data charges, unattached EBS volumes and old snapshots, and logs kept forever.
What to learn
- Cost Explorer, cost allocation tags and the Cost and Usage Report
- Right-sizing with Compute Optimizer, and Graviton for better price/performance
- Savings Plans vs Reserved Instances vs Spot
- S3 Intelligent-Tiering and lifecycle rules, log retention
- Find and remove idle resources
Free resources
Practice
Tag everything from your projects with project=…, activate the tag for cost allocation and find your most expensive project in Cost Explorer.
Caching: ElastiCache and CloudFront
Caching is the cheapest way to make things faster. ElastiCache (Valkey, Redis OSS or Memcached) keeps hot data and sessions in memory in front of your database, DynamoDB Accelerator (DAX) does the same for DynamoDB, and CloudFront caches responses at the edge, including API responses with the right cache policy.
What to learn
- Cache-aside vs write-through, and TTLs
- ElastiCache for sessions and database query results
- CloudFront cache policies and origin request policies
- Cache invalidation strategies
Free resources
Practice
Add a 60-second cache in front of a slow API endpoint and measure the difference in response times.
Kubernetes on EKS
If your team already uses Kubernetes, EKS runs the control plane for you. You run workloads on managed node groups, on Karpenter-provisioned nodes or on Fargate, and use the AWS Load Balancer Controller for ingress. It is more powerful and more complex than ECS, so learn it when you need Kubernetes specifically.
What to learn
- Kubernetes basics: pods, deployments, services, ingress
- Create a cluster with
eksctl or IaC
- Pod identity / IAM roles for service accounts
- Node groups, Karpenter and Fargate profiles
Free resources
Practice
Deploy your containerised app to EKS with an ingress, then delete the cluster (EKS clusters are charged per hour).
Tools on this site
Certification exam preparation
Certifications aren't required to use AWS, but they structure your learning and help on a CV. Cloud Practitioner (65 questions, 90 minutes, US$100) covers concepts and is a good first step. Solutions Architect – Associate (65 questions, 130 minutes, US$150) is the most popular technical exam and focuses on design trade-offs. Developer – Associate focuses on building and deploying with AWS services. Check the official pages for current details before you book.
What to learn
- Read the official exam guide and list the domains and their weights
- Take the free official practice question set on Skill Builder
- Review every wrong answer and read the related docs
- Do a timed practice exam and aim for a comfortable margin
- Book the exam (online or at a test centre)
Free resources
Practice
Score at least 80% on a full practice exam twice in a row before booking the real one.
Am I ready? Stage 4 quiz
A company can lose at most 1 hour of data and be down at most 15 minutes, at the lowest cost. Which DR strategy fits best?
- Backup and restore
- Multi-site active/active
- No DR, rely on Multi-AZ only
- Warm standby
A 15-minute RTO rules out restoring from backups, and active/active costs far more than needed. A scaled-down, always-running copy (warm standby) meets both numbers.
Which service tells you who deleted an S3 bucket yesterday?
- CloudWatch metrics
- CloudTrail
- GuardDuty
- Trusted Advisor
CloudTrail logs every API call with the identity, time and source IP.
How do you stop every account in your organisation from using Regions outside Europe, even for account admins?
- A service control policy in AWS Organizations
- An IAM policy on each user
- A security group rule
- Tags on every resource
SCPs set the maximum permissions for whole accounts. Nothing inside the account can grant more.
What does CloudFormation drift detection find?
- Syntax errors in templates
- Cost overruns
- Resources that were changed outside CloudFormation
- Unused IAM users
Drift is the difference between what the template says and what's actually deployed, usually caused by manual console changes.
A steady workload runs 24/7 on EC2 and will for years. What's usually the biggest saving with no code changes?
- Spot Instances
- A larger instance type
- A Compute Savings Plan
- Moving to a different Region
Savings Plans give large discounts for a 1- or 3-year commitment. Spot can be interrupted, so it doesn't suit an always-on workload without changes.