SAP-C03 cheat sheet — every exam topic on one page

Architecture Design and Implementation Built for the Cloud

SAP-C03 Event-Driven, Serverless and Multi-Tenant Architecture

• Assume at-least-once delivery: claim a stable idempotency key with a conditional write before any side effect, and keep retries on.
• Ordering costs throughput, so scope it to the entity that needs it: a per-entity message group or partition key keeps order and parallelism; a single shared key loses parallelism and a random key loses order.
• Ordered fan-out is SNS FIFO to SQS FIFO; content routing, SaaS HTTPS targets and replay point to EventBridge; many independent readers with replay point to Kinesis.
• SQS with Lambda: visibility timeout at least six times the function timeout, plus ReportBatchItemFailures. Kinesis with Lambda: parallelization factor for speed, bisect plus retry and age limits plus an on-failure destination for poison records, enhanced fan-out for a latency-critical consumer.
• A stateless tier keeps nothing on the instance: sessions go to ElastiCache, job state to DynamoDB and files to S3. Affinity and longer lifetimes delay state loss but never remove it.
• Athena scans less with Parquet and partitions; partition projection gives fast planning and instantly queryable partitions without crawlers.
• Standard workflows: long, exactly-once, auditable. Express: short, high-volume, idempotent. Durable functions: code-first, deterministic, steps checkpointed and replayed.
• EventBridge forwards cross-account events one hop only; non-bus targets are same-Region; direct cross-account targets need the role in the bus account and a target resource policy.
• WebSocket connections close after 10 idle minutes and 2 hours regardless of settings; clean the connection table on $disconnect and on GoneException.
• Isolation is per tier: silo where contracts demand, pool elsewhere, and enforce pooled isolation below the application with read-only Cognito tenant attributes, LeadingKeys session-tag policies, RLS with a non-owner role, and per-tenant keys or encryption-context conditions.

SAP-C03 Containers, Auto Scaling, Ingress and Edge: ECS, EKS, Fargate, VPC Lattice, ECR, Load Balancers and CloudFront

• Existing Kubernetes tooling plus no control plane to run means Amazon EKS; no Kubernetes skills and no servers means Amazon ECS on Fargate.
• One task role per task definition gives per-service least privilege; the task execution role is only for pulling images, secrets and logs.
• Fargate cannot run GPUs, DaemonSets or privileged containers; add EC2 capacity for them. Put a capacity provider's base on regular FARGATE, because Fargate Spot never falls back.
• Fargate Spot sends SIGTERM; catch it and raise stopTimeout (default 30 seconds, maximum 120) so work can finish or checkpoint.
• Service Connect is for ECS-only meshes and needs client redeployments to see new endpoints; VPC Lattice covers mixed compute, many accounts and overlapping CIDRs, with IAM auth policies that need SigV4-signed requests.
• ECR enhanced scanning (Amazon Inspector) adds language packages and continuous rescans; continuous filters win over scan-on-push filters, and unmatched repositories are not scanned.
• Reserved concurrency guarantees and caps; provisioned concurrency removes cold starts on a version or alias; SQS consumers are capped with event-source maximum concurrency.
• Target-track a metric that falls as capacity grows: ALBRequestCountPerTarget or backlog per task, not total RequestCount or raw queue depth; HPA needs resource requests.
• NLB for non-HTTP protocols, static IPs and PrivateLink; ALB for Layer 7 routing and gRPC; REST API for usage plans, keys and WAF; HTTP API for cheaper JWT-authorized APIs.
• CloudFront Functions with KeyValueStore for light viewer-side logic; Lambda@Edge for network calls, body access and origin events; keep cache keys to what changes the response.

SAP-C03 AI and ML Integration: Multi-Account Bedrock, AgentCore Agents, SageMaker AI Inference and RAG Design

• A central AI gateway gives one place for per-team quotas, the model allow-list and usage reporting, but only an SCP denying direct Bedrock inference makes it the sole path; direct per-account access isolates quotas and billing with nothing shared to run.
• Govern models by denying bedrock:InvokeModel (and the streaming action) on unapproved model ARNs in an SCP; denying aws-marketplace:Subscribe does not stop the first, auto-subscribing invocation.
• With a Region-restricting SCP, geographic inference profiles need every destination Region allowed; global profiles need aws:RequestedRegion = unspecified and can process data outside the geography.
• Model calls use the bedrock-runtime endpoint and knowledge base queries use bedrock-agent-runtime; bedrock and bedrock-agent are control-plane endpoints.
• AgentCore Runtime runs existing agent code for up to 8 hours per session in an isolated microVM; VPC network mode is how the agent reaches private resources, while the AgentCore interface endpoint is for inbound calls.
• Gateway turns OpenAPI, Smithy and Lambda targets into MCP tools with managed inbound and outbound auth; semantic tool search is enabled at gateway creation.
• Code Interpreter runs code in a sandbox, Browser acts on websites without APIs, and AgentCore long-term memory extracts facts and preferences that persist across sessions.
• SageMaker AI: real-time for steady synchronous traffic, serverless for bursty small CPU requests, asynchronous for large or long requests with scale to zero, batch transform for datasets; multi-model endpoints for many same-framework models, inference components for per-model resources and scaling.
• Chunking is fixed once a data source exists, so change it with a new data source, sync, then delete the old one; hierarchical chunking searches small chunks and returns their larger parents.
• Tenant isolation in a shared knowledge base comes from metadata on every document plus a backend-set filter from the authenticated identity, never from implicit filtering, guardrails or prompt instructions.

SAP-C03 Hybrid Cloud Integration: Direct Connect Resiliency, Hybrid DNS, Data Sync, Legacy Integration and Hybrid Compute

• Only maximum resiliency (two connections at each of two Direct Connect locations on separate devices) is still redundant after a whole location fails; size the surviving connections for the full load.
• Set a LAG's minimum links so a degraded LAG goes down and BGP moves its traffic, instead of one surviving link dropping packets.
• Longest prefix wins before route source. On a transit gateway, static routes (including a static VPN) outrank Direct Connect gateway routes; on a virtual private gateway, Direct Connect BGP routes outrank VPN static routes.
• Local preference communities 7224:7300/7200/7100 steer AWS-to-on-premises traffic and beat AS path; the customer routers' local preference steers the other direction; active/active needs equal attributes.
• MACsec suits dedicated connections at line rate (never hosted ones); private IP VPN needs a transit VIF to a transit gateway; VPN over a public VIF uses public IP addresses. VPN ECMP needs BGP and never spans attachment types.
• DataSync copies from storage that stays in use; S3 File Gateway turns shares into S3 objects; stored volumes keep all data local while cached volumes keep only hot data; Tape Gateway replaces tape; FSx File Gateway is closed to new customers.
• Objects written to a bucket outside a file gateway appear after automated cache refresh or RefreshCache; give each writable share its own prefix.
• Transfer Family: internet-facing VPC endpoints carry your Elastic IPs (including BYOIP), Directory Service with AD Connector reuses AD passwords, managed workflows decrypt and copy without code, SFTP connectors push to partner servers.
• Amazon MQ moves JMS/OpenWire (ActiveMQ) or AMQP 0-9-1 (RabbitMQ) apps without code changes; REST API mapping templates reshape bodies, Lambda handles parsing and lookups, and EventBridge Pipes read MQ queues (virtual topics for topics).
• Inbound endpoints answer from zones associated with their own VPC; system rules carve subdomains out of forwarding rules; Profiles share DNS bundles through RAM; private zones never fall back to a public zone of the same name.

SAP-C03 Network Architecture: Multi-VPC Connectivity, IPAM, Network Security, IPv6 and Global Routing

• Many VPCs across many accounts: a transit gateway per Region in a network account, shared through AWS RAM, with Regions joined by peering attachments that need static routes. Two VPCs and nothing else: VPC peering is cheapest.
• PrivateLink exposes one service behind an NLB to many consumers, tolerates overlapping CIDRs, restricts access with allowed principals, serves other Regions through supported Regions, and lines zones up by AZ ID.
• A transit gateway looks up each packet in the table associated with its entry attachment; isolate spokes by propagating only shared attachments into their tables, and use blackhole routes to stop hairpins through an egress VPC.
• VPC sharing: the owner runs subnets, routes and network ACLs; participants run their own resources and security groups. Centralized interface endpoints need private DNS off plus private hosted zones associated with every spoke, while S3 and DynamoDB gateway endpoints must stay in each VPC.
• IPAM pools shared through RAM allocate non-overlapping CIDRs; only an SCP on ec2:CreateVpc and ec2:AssociateVpcCidrBlock with ec2:Ipv4IpamPoolId makes their use mandatory. Subnets cannot be resized, so add a secondary CIDR and new subnets.
• Security groups are stateful allow lists; network ACLs are stateless, ordered and can deny. Inbound ACCEPT then outbound REJECT in flow logs means a missing NACL ephemeral-port rule; packet contents need Traffic Mirroring.
• Stateful inspection behind a transit gateway needs appliance mode on the inspection VPC attachment; Network Firewall domain lists filter by SNI even for direct-IP connections, which DNS Firewall cannot; third-party appliances go behind a Gateway Load Balancer.
• AWS WAF with managed rule groups and rate-based rules protects ALBs, CloudFront and API Gateway without code changes; AWS Firewall Manager (with AWS Config) enforces an organization-wide baseline on resources created later.
• IPv6 migration: egress-only internet gateway for private subnets, IPv6 rules in every custom NACL, a dual-stack load balancer with an alias AAAA record; IPv6-only subnets reach IPv4 via DNS64 and a 64:ff9b::/96 route to a NAT gateway.
• Latency routing for speed, geolocation for hard location rules, nested by alias; CloudWatch alarm health checks for private endpoints; Global Accelerator for static IPs, fast DNS-independent failover, traffic dials and custom routing.

SAP-C03 Data, Storage and Database Architecture: Iceberg Lakehouses, Streaming, Global Databases, Caching and Data Sharing

• Row-level deletes, atomic commits and time travel on S3 mean Apache Iceberg; S3 Tables or Glue Data Catalog table optimizers remove the compaction and snapshot-expiry work that streaming writes make necessary.
• Iceberg partition evolution is a metadata change done with Spark: new data uses the new layout, nothing is rewritten, and queries on the source column keep pruning.
• Redshift Spectrum is billed by bytes scanned: Parquet plus partitions on the filtered column is the cost fix, not more nodes or views.
• Lake Formation data filters combine row filters and column exclusion on one table; LF-Tags inherited from databases scale grants to thousands of tables but never filter rows.
• Kafka clients and connectors map to Amazon MSK and MSK Connect; sliding windows need Managed Service for Apache Flink; many throttled Kinesis consumers need enhanced fan-out.
• DynamoDB to Redshift without code or read capacity is a zero-ETL integration; scheduled, field-mapped SaaS ingestion is Amazon AppFlow, and Glue zero-ETL is the other no-code path that replicates supported SaaS apps into Redshift or a lakehouse.
• A Multi-AZ DB instance standby serves no reads, a Multi-AZ DB cluster has two readable standbys, and read replicas are asynchronous with manual promotion.
• Aurora Global Database switchover loses no data and suits drills; failover is for outages and loses the replication lag, which rds.global_db_rpo on the primary can bound.
• DynamoDB MRSC gives strong reads in any Region and zero RPO, but needs exactly three Regions and a new empty table; MREC resolves conflicts with last writer wins.
• DAX caches only eventually consistent reads, writes refresh its item cache but never its query cache, and replicated or direct writes bypass it entirely.

Security, Compliance, and Governance

SAP-C03 Identity Security Architecture: Identity Center Federation, Cognito, EKS Pod Identity, Least Privilege, ABAC and Data Perimeters

• With an external IdP, IAM Identity Center needs SAML 2.0 for sign-in and SCIM for provisioning; it never creates users just in time from an assertion.
• A permission set is defined once and provisioned as a role in every assigned account; customer managed policy references need a same-named policy on the same path in each account.
• Delegate Identity Center administration to a member account, but keep management-account access on dedicated permission sets assigned to individual users.
• Cognito user pools say who the user is (tokens); identity pools hand out temporary AWS credentials; scoped API methods need the access token, not the ID token.
• EKS Pod Identity reuses one role across clusters with no OIDC provider and adds namespace session tags, but it does not run on Fargate, where IRSA is the choice.
• OIDC tokens federate through an IAM OIDC provider (always restrict sub), X.509 certificates through IAM Roles Anywhere (imported CRLs only), and outbound JWTs come from sts:GetWebIdentityToken.
• External IDs must be generated by the vendor and unique per customer; trusting the vendor account plus aws:PrincipalArn survives a role rebuild.
• Permissions boundaries and session policies only limit, and role chaining caps sessions at one hour; delegated role creation also needs a protected boundary and PassRole restricted to the developers' own roles.
• ABAC compares PrincipalTag with ResourceTag (RequestTag on create), is only safe when tagging is locked down, and needs TransitiveTagKeys to cross a role chain.
• VPC endpoint policies with aws:ResourceOrgID stop exfiltration whatever credentials are used; exempt service principals with aws:PrincipalIsAWSService and forward access sessions with aws:ViaAWSService; external access analyzers are Regional.

SAP-C03 Encryption and Key Management: KMS Keys and Rotation, ACM and Private CA, CloudHSM and Post-Quantum Cryptography

• Customer managed symmetric KMS keys rotate automatically on a custom 90 to 2,560 day period (or on demand); AWS managed keys rotate yearly and cannot change; asymmetric, HMAC and custom key store keys rotate manually with a new key and an alias.
• Rotation keeps old key material, so old data stays readable without re-encryption; it never helps when a plaintext data key has leaked, which needs the data re-encrypted under new data keys.
• Cross-account key use needs both the key policy and the caller's IAM policy; AWS managed keys cannot be shared, aliases are account-scoped, SCPs never grant, and service-linked roles get access through grants.
• Removing the default key policy's IAM delegation is the way to keep IAM administrators from ever using a key; kms:ViaService, kms:CallerAccount and encryption context conditions narrow how a key is used.
• S3 Bucket Keys cut KMS requests without code changes but switch the encryption context to the bucket ARN; DSSE-KMS gives two layers; SSE-KMS replication needs the encrypted-objects setting, a destination key and role permissions on both keys.
• Multi-Region keys share material and key ID for client-side encryption across Regions, but each replica has its own key policy and services such as S3 re-encrypt anyway.
• ACM certificates are Regional (CloudFront uses us-east-1) and renew automatically only when ACM issued them with DNS validation; Private CA shared through AWS RAM gives every account private certificates, and short-lived mode suits high-volume certificates of up to 7 days.
• The listener security policy alone sets TLS versions (TLS13-1-3 for TLS 1.3 only); HTTPS target groups keep traffic encrypted to the targets.
• KMS HSMs are already FIPS 140-3 Level 3; choose CloudHSM for single-tenant exclusive control or PKCS#11/JCE/OpenSSL, an external key store when material may never be in AWS, and imported material when you generate it but need KMS latency and availability.
• Post-quantum priorities: hybrid ML-KEM key exchange on TLS against harvest-now-decrypt-later, ML-DSA for long-lived signatures (EXTERNAL_MU above 4 KB), and no re-encryption of AES-256 data at rest.

SAP-C03 Multi-Account Governance: Control Tower, SCPs and RCPs, Centralized Logging, Config Compliance and Patching

• Shape OUs around guardrails (Security, Infrastructure, Workloads Prod/NonProd, Sandbox, Policy Staging, Suspended) so each policy set is attached once; keep the management account empty because SCPs and RCPs never restrict it.
• A Control Tower landing zone separates the log archive account (evidence) from the audit account (security engineers); fix drift by re-registering the OU, and turn on auto-enrollment for accounts moved into registered OUs later.
• Preventive controls (SCPs/RCPs) block API calls from every tool, detective controls (Config rules) report existing resources, proactive controls (CloudFormation hooks) fail stacks before provisioning.
• Account Factory for console requests, AFC blueprints for CloudFormation without a pipeline, AFT for Git pull requests and Terraform; anything created outside Control Tower needs enrolling.
• With an SCP allow list, every level from root to account must allow an action; SCPs never restrict the management account, service-linked roles or principals outside the organization.
• RCPs cap what any caller can do to S3, KMS, STS, SQS, Secrets Manager and other supported resources; exempt AWS service principals with aws:PrincipalIsAWSService and named partners with aws:PrincipalAccount in the same condition block.
• Organization trails, Config conformance packs and auto-enabled security services cover new accounts automatically and cannot be changed by members; most security services are Regional, so configure each Region.
• CloudWatch cross-account observability views data in place; Logs centralization rules copy it to a central account; Bedrock invocation logs are written in the same account and Region and centralized afterwards.
• Config aggregators are read-only views; remediation runs Automation runbooks in member accounts under a role that must exist there.
• Inspector finds vulnerabilities continuously (hybrid mode adds agentless EC2 scanning); Patch Manager baselines decide what is approved and Quick Setup patch policies decide where and when it is installed.

SAP-C03 Compliance Architecture: Data Residency, Audit Trails, Object Lock, AWS Artifact and Threat Modeling

• Only SSE-KMS with a customer managed key gives both CloudTrail-logged key use and a key the company can disable; deny requests where aws:SecureTransport is false to enforce TLS.
• RDS encryption at rest is fixed at creation: encrypt an existing database through an encrypted snapshot copy and restore; use rds.force_ssl and pgAudit for TLS and read auditing on RDS for PostgreSQL.
• Macie automated discovery samples the whole organization continuously; proving that data is absent needs a one-time job at 100% sampling depth; custom data identifiers catch company-specific formats.
• Object Lock compliance mode stops everyone, including root; governance mode and legal holds can be lifted by privileged users; an event hold starts retention at a business event.
• CloudTrail Event history keeps 90 days; use an organization trail to a log archive bucket, keep queried logs readable, then archive, and remember the 128 KB lifecycle default.
• Integrity validation detects tampering, Object Lock prevents deletion: regulated trails need both. Object- and item-level access needs data events scoped with advanced event selectors.
• CloudTrail never records Bedrock prompts; invocation logging does, to a same-account, same-Region destination. Agent and knowledge base calls are data events.
• Landing zone Region deny covers the whole estate; CT.MULTISERVICE.PV.1 sets per-OU Regions; custom Region SCPs must exempt global services with NotAction.
• Region deny exempts CloudFront and networking paths; Control Tower data residency controls close them, and a geographic Bedrock inference profile keeps AI processing in its geography.
• AWS Artifact covers AWS's side (reports, BAAs, ISV reports); Config conformance packs, history and Security Hub CSPM cover yours; Audit Manager and CloudTrail Lake are closed to new customers.

SAP-C03 Responsible AI Controls: Amazon Bedrock Guardrails, AgentCore Identity and Policy, and Human Approval with Step Functions

• Denied topics match meaning, word filters match exact strings; sensitive information filters BLOCK or mask, and masking never reaches model invocation logs (use CloudWatch Logs data protection).
• Prompt attack detection is input-only; input tags limit evaluation to user text, and filter action NONE (not strength NONE) is detect mode for tuning.
• The Standard tier adds languages and code-aware detection but needs a guardrail profile (cross-Region guardrail inference); a single-Region rule means Classic with no profile.
• Asynchronous streaming is fastest but can show harmful chunks briefly and cannot mask; synchronous is the safe default.
• Contextual grounding needs grounding_source and query qualifiers; Automated Reasoning gives rule-based, detect-only findings and is not supported in enforcements.
• ApplyGuardrail brings one guardrail to SageMaker AI, self-hosted and third-party models, with source INPUT and OUTPUT calls.
• GuardrailIdentifier enforcement also needs bedrock:ApplyGuardrail and breaks RetrieveAndGenerate and InvokeAgent; Bedrock policy enforcement covers every call per Region, and layered guardrails apply together with the strictest setting winning.
• AgentCore Identity: JWT authorizers check discovery URL, audiences, clients, scopes and claims; the token vault binds tokens to agent and user; the gateway execution role is the ceiling for every IAM-role target.
• Policy in AgentCore evaluates Cedar rules on principal, tool and inputs at the gateway; roll out in LOG_ONLY and restrict UpdateGateway.
• Human approval = Standard workflow + .waitForTaskToken + SendTaskSuccess/Failure from the same account, with TimeoutSeconds and Catch for escalation and no task token for the agent.

Cost-Optimized Architecture Design

SAP-C03 Pricing Models: Savings Plans, Reserved and Spot Capacity, Graviton, Step Functions, Rightsizing and AI Cost Optimization

• Commit to the floor that runs every hour, run uninterruptible peaks On-Demand and interruptible work on Spot; capacity reservations are a separate decision from discounts.
• Compute Savings Plans follow the fleet across families, Regions, Fargate and Lambda; EC2 Instance Savings Plans give more discount but stay in one family and Region.
• Savings Plans commitments are hourly, measured at Savings Plans rates, never apply to Spot, and cannot be reduced, exchanged or sold.
• On-Demand Capacity Reservations guarantee capacity with no term and are discounted by Savings Plans and regional RIs; Capacity Blocks for ML reserve accelerators for a future window.
• Spot needs diversified pools, price-capacity-optimized allocation, an On-Demand base where required and Capacity Rebalancing; a maximum price never prevents interruptions.
• Step Functions type is fixed at creation: Express for short, high-volume, idempotent work; Standard for long waits and callbacks; Distributed Map can run Express children under a Standard parent.
• Default Lambda suits bursty, idle-heavy traffic; Lambda Managed Instances suit steady volume and let EC2 commitments apply; arm64 lowers Lambda cost with a setting change.
• Rightsize with Compute Optimizer (CloudWatch agent for memory, free 32-day lookback for monthly peaks, preferred instances) before buying commitment.
• Bedrock: Flex for cheaper synchronous latency-tolerant calls, batch for S3 jobs, Reserved for fixed-price capacity with overflow, prompt caching for repeated prefixes, response caching for repeated questions.
• SageMaker AI Savings Plans are separate from Compute Savings Plans; Inferentia2 lowers inference cost without a commitment.

SAP-C03 Data Transfer and Network Cost Optimization: CloudFront, VPC Endpoints, NAT, Transit Gateway and Replication

• Transfer from AWS origins to CloudFront is free and CloudFront rates are below S3/EC2 internet egress, so cacheable content belongs behind CloudFront.
• Cache key = only what changes the response; forward everything else with an origin request policy, compress at the edge and give versioned assets long TTLs.
• Origin Shield is set per origin, in the Region nearest that origin; keep dynamic paths off it and enable it on every origin in an origin group.
• A price class narrows the edges you pay for without blocking anyone; geographic restriction blocks viewers.
• S3 and DynamoDB gateway endpoints are free but same-Region only; interface endpoints cost per AZ-hour plus a per-GB rate far below NAT processing.
• Run one NAT gateway per AZ with same-AZ routes, and keep traffic in-zone with MSK rack awareness, PreferClose routing and NLB cross-zone off.
• Transit Gateway charges processing on data sent from VPC, VPN and DX attachments; peer heavy VPC pairs directly and keep the hub for the rest.
• PrivateLink: the consumer pays its endpoint, the provider pays its NLB, and overlapping CIDRs are fine.
• Replicate only what needs a copy: S3 filters, a cheaper destination class and RTC only on rules that need the SLA; global table writes cost roughly writes x replicas.
• For AI, the global Bedrock inference profile is cheapest when residency allows; replicate model artifacts once to each Region that reads them.

SAP-C03 Cost Allocation and Visibility: Tagging Enforcement, CUR 2.0, Cost Categories, Split Costs, Bedrock Chargeback, Budgets and Anomaly Detection

• Tags reach billing tools only after the management account activates them as cost allocation tags; activation is not retroactive, but a backfill can restate up to 12 months for resources that carried the tag.
• Activated Organizations account tags label all metered usage in the account, including credits, refunds and charges that cannot be tagged at resource level, and need no second account-to-owner mapping.
• SCP with Null aws:RequestTag makes a key mandatory at creation; a tag policy with enforced_for makes its value valid; AWS Config required-tags finds existing resources that lack the key.
• Tag policy compliance never evaluates resources without the key, and report_required_tag_for is enforced only through IaC integrations.
• Cost Explorer resource-level daily data covers only the last 14 days and is enabled per service from the management account; older or finer questions are answered from CUR 2.0 in Athena.
• AWS Data Exports delivers CUR 2.0 and FOCUS tables to S3, and its SQL query can drop columns and filter rows before files leave AWS.
• Cost category rules are first-match in order, inherited value rules follow new tag values automatically, and split charge results appear only on the cost category details page, never in CUR or Cost Explorer.
• Split cost allocation data for ECS and EKS is opted in by the payer and delivered only in CUR; the EKS Prometheus option charges the higher of requests and actual use.
• Bedrock chargeback uses tagged application inference profiles when callers can change the model ID, or IAM principal tags plus caller identity data in CUR 2.0 when they cannot.
• Budgets watch fixed amounts (forecasted thresholds warn early; only SCP actions reach other accounts, from the management account); Cost Anomaly Detection watches patterns, with individual alerts over SNS for immediacy.

SAP-C03 Storage and Database Cost Optimization: S3 Tiering and Lifecycle, EFS, EBS gp3, DynamoDB, Aurora I/O-Optimized, Database Savings Plans, Backup and Log Costs

• Unknown or changing access with synchronous reads: S3 Intelligent-Tiering's automatic tiers; activate its Archive and Deep Archive Access tiers only if the application can restore asynchronously.
• Known access pattern: Lifecycle to the cheapest class that meets each band's retrieval time; monthly reads suit the IA classes (One Zone-IA when data is reproducible), quarterly reads Glacier Instant Retrieval, hours Glacier Flexible Retrieval, 12 hours Deep Archive.
• Tiny objects and archives don't mix: per-object transition requests and 40 KB of archive metadata outweigh the saving; new Lifecycle rules skip objects under 128 KB by default.
• Versioned buckets: NoncurrentVersionTransition and NoncurrentVersionExpiration for old versions, AbortIncompleteMultipartUpload for orphaned parts; plain Transition and Expiration act on current versions.
• EFS: set the IA timer longer than the access interval and use Transition into Standard On first access for files that become hot again.
• EBS: gp3 by default (3,000 IOPS and 125 MiB/s included, IOPS and throughput bought independently, throughput at most 0.25 MiB/s per IOPS); io2 only for io2-only needs; sc1/st1 for sequential data within their per-volume caps.
• DynamoDB reserved capacity covers only provisioned capacity on Standard-class tables; Standard-IA suits storage-dominated tables.
• Aurora I/O-Optimized pays off when I/O is about 25% or more of spend and can be entered only once every 30 days; Serverless v2 pauses only with a 0 ACU minimum and no open connections.
• Reserved DB instances for a fixed engine, Region and family (deepest with 3-year All Upfront); Database Savings Plans for an estate that will change; never both on the same usage.
• Cold backups: AWS Backup needs 90 days in cold and skips RDS/Aurora; archived EBS snapshots are full copies, so archive only large, long-kept snapshots from schedules of 28 days or more.

Resilience, Migration, and Business Continuity

SAP-C03 Migration Strategies: Discovery, Wave Planning, AWS Transform MGN, DMS, DataSync and Modernization

• Assign a strategy per application: rehost the bulk to meet a deadline, replatform where a managed service removes work, refactor only what justifies it, retire what nobody uses (archive the data first).
• Build waves from utilization and server-to-server connection data (AWS Transform discovery tool), not from an inventory alone; keep chatty dependency groups together and start with a pilot wave.
• Application Discovery Service, Migration Hub and Refactor Spaces are closed to new customers; AWS Application Migration Service is now AWS Transform MGN.
• MGN agents need outbound TCP 443 to MGN and outbound TCP 1500 to the staging subnet; use private IP and no public IP to keep replication on Direct Connect, plus MGN and S3 interface endpoints when there is no internet at all.
• MGN right-sizing overrides the launch template's instance type; post-launch actions run SSM documents; revert keeps replication, finalize cutover discards it.
• DMS full load plus CDC gives minutes of downtime; for huge databases, load natively from a recorded SCN/LSN and run a CDC-only task.
• DMS creates only tables and primary keys: apply converted schema first, disable FKs and triggers for the full load, add secondary indexes before cached changes apply.
• Limited LOB mode truncates; full or inline LOB mode migrates LOBs whole and needs a primary key or unique index on the source.
• Babelfish for Aurora PostgreSQL removes SQL Server licensing while a TDS client and T-SQL code stay unchanged; RDS Custom fits vendors that need host access.
• Refactor incrementally: ALB or API Gateway facade with fast rollback, an anti-corruption layer, an outbox for reliable events and a saga with compensating actions across services.

SAP-C03 Disaster Recovery Architectures: Elastic Disaster Recovery, ARC, Resilience Hub and Multi-Region Failover

• RPO decides how data moves (periodic copies vs continuous replication); RTO decides how much compute already runs. Pick the cheapest strategy that meets both, per tier.
• If compute takes longer to become useful than the RTO allows, only running capacity (warm standby) meets it; scaling at failover needs Capacity Reservations to be certain.
• Elastic Disaster Recovery: agent → TCP 1500 → replication servers in a staging subnet; launch settings shape the recovered instance; default settings affect only new servers.
• DRS point-in-time: 10-minute and hourly rules are fixed, the daily rule keeps 1–365 days; use isolated drills to find the last clean snapshot after ransomware.
• DRS recovery plans run ordered steps with waits as a drill or recovery in one account and Region; failback uses the Failback Client on premises or reversed replication for EC2 sources.
• Resilience Hub estimates RTO/RPO per disruption type against a policy; FIS experiments with alarms and timed SOPs prove it, and a pipeline assessment stops breaching releases.
• Automation runbooks codify recovery; aws:approve does not run inside multi-account/Region executions, so approve in a parent runbook and fan out with aws:executeAutomation.
• Route 53 checkers cannot reach private IPs (use CloudWatch alarm checks); calculated checks combine dependencies; failover sets fail open, so chain a nested pair for a maintenance page.
• ARC routing controls flip DNS through any of five cluster endpoints; assertion rules keep a Region on, gating rules require a master switch; Region switch orchestrates multi-account failover with evaluation every 30 minutes and recovery-time reports.
• Container DR is one cluster per Region: GitOps or shared task definitions, ECR replication (plus backfill for old images), replica secrets and EKS Pod Identity instead of per-cluster IRSA trust.

SAP-C03 Backup Governance, Ransomware Protection and Chaos Engineering

• An Organizations backup policy creates an immutable plan in every account, but the vaults (in every Region it uses) and the IAM role must already exist there; deploy them with an auto-deploying StackSet.
• Lock parent backup-policy values with @@operators_allowed_for_child_policies set to @@none on the nodes to protect, not on the top-level plans key.
• Cross-account copy needs the management-account opt-in, a named destination vault allowing backup:CopyIntoBackupVault, and customer managed keys for resource types that keep source encryption; never the Default vault.
• Standard vault: copy into the target account, then restore. Logically air-gapped vault shared via AWS RAM: restore directly; multi-party approval recovers access if the owning account is lost.
• Backup Audit Manager (with AWS Config) reports compliance; restore testing proves restores and their duration; EventBridge plus Lambda and PutRestoreValidationResult proves the data.
• Compliance-mode Vault Lock is permanent after its grace time, even for root and AWS; min/max retention reject non-conforming new jobs and never change existing recovery points.
• S3 Object Lock protects versions: governance mode can be bypassed with permission, compliance mode cannot be shortened, legal holds have no expiry, and default retention covers only new versions.
• EBS snapshot lock prevents deletion (compliance mode can only be extended after cooling-off); Recycle Bin recovers deleted snapshots.
• Self-healing health checks must be shallow; use ELB health checks on the Auto Scaling group, lifecycle hooks for variable warm-up, and EC2 automatic recovery to keep the same instance.
• FIS stop conditions are CloudWatch alarms that end an experiment for good without undoing completed actions; Route 53 failover time is about interval times threshold plus TTL.

Operational Excellence and Automation

SAP-C03 Infrastructure as Code: CloudFormation, CDK, Policy as Code and StackSets

• The CDK is imperative code that synthesizes declarative CloudFormation, so CDK apps keep change sets, drift detection, Hooks and StackSets. Teams that stay in YAML can iterate with Fn::ForEach from the AWS::LanguageExtensions transform.
• CDK logical IDs come from the construct path: moving or renaming a construct replaces the resource unless you pin the ID with overrideLogicalId or use stack refactoring. Use node.defaultChild escape hatches for properties an L2 lacks.
• Bootstrap every account and Region you deploy to; trust is set on the target with --trust (deploy) or --trust-for-lookup (synthesis lookups only), and --cloudformation-execution-policies replaces the default AdministratorAccess. Re-list all trusted accounts when you change trust.
• Stack policies stop updates, termination protection stops stack deletion, and DeletionPolicy and UpdateReplacePolicy only decide what happens to a resource after it leaves the stack (Snapshot on both keeps a final copy without paying for old instances).
• Drift detection is read-only evidence; a normal redeploy leaves drift on unchanged resources; a drift-aware change set (REVERT_DRIFT) reverts it while keeping AWS-managed values such as scaled desired capacity.
• Hooks block bad templates before provisioning but only for their targets (add CLOUD_CONTROL for Cloud Control API tools) and only in the accounts and Regions where they are activated; roll them out in WARN before FAIL.
• CDK aspects validate or mutate every construct at synth time, including third-party constructs, but do not cross Stage boundaries. Config proactive mode never blocks or remediates; detective rules with SSM Automation remediation fix out-of-band changes.
• SCPs bind every principal in member accounts: use them to make the pipeline role the only writer, to require the approved CloudFormation service role (cloudformation:RoleARN), and to stop administrators disabling Hooks, Config or CloudTrail.
• Use secretsmanager dynamic references (not in UserData, Init metadata or custom resources), generate secrets with GenerateSecretString or ManageMasterUserPassword, and remember CloudFormation cannot create SecureString parameters.
• Cross-account secrets need the full ARN, a resource policy and a customer managed KMS key (also in each replica Region). Service-managed StackSets skip the management account, and strict concurrency caps parallelism at failure tolerance + 1.

SAP-C03 CI/CD and DevSecOps Pipelines: CodePipeline V2, Cross-Account Promotion, Scanning, Signing, Bedrock Evaluations and Rollback

• V2 pipelines add trigger filters (branch, file path, Git tag, with exclude winning over include), pipeline-level variables with defaults, stage conditions and stage rollback.
• SUPERSEDED (default) can skip intermediate runs, QUEUED deploys every run in order, and PARALLEL runs independently with no queue and no stage rollback.
• Entry conditions can Fail or Skip (Skip only with LambdaInvoke or VariableCheck); every rule in a condition must succeed. Manual approval is for decisions a named person must record.
• Stage rollback reuses the revisions and variables of the last successful execution from the current pipeline structure version; retry reuses the failing revisions.
• Cross-account pipelines need a customer managed key on the artifact store, an action roleArn in the target account, and for CloudFormation a stack service role; artifacts cross accounts only if produced in the pipeline account.
• Cross-Region actions need an artifactStores map with a store and a Regional key per Region; CodePipeline copies the artifacts.
• Build once and deploy by image digest; aws:PrincipalOrgID in an ECR repository policy covers future accounts, and template configuration files vary settings without rebuilding.
• The InspectorScan action fails on thresholds before deploy (SourceCodeScan before the build, ECRImageScan after it); external CI uses the SBOM Generator and Scan API so images never leave a vulnerable host.
• ECR managed signing works across accounts but not across Regions; Lambda code signing only blocks untrusted code in Enforce mode.
• Bedrock evaluations are pre-release checks (programmatic, judge, human, RAG retrieve-only or retrieve-and-generate, or your own inference responses); guardrails protect at run time.

SAP-C03 Observability and Monitoring: OpenTelemetry, Container Insights, Cross-Account Logs, Alarms, AI Metrics, RUM and SLOs

• OpenTelemetry (ADOT SDKs plus an ADOT Collector or the CloudWatch agent OTLP receiver) is the standard; the X-Ray SDKs and daemon are in maintenance mode, and mixed estates need both W3C and X-Ray propagators.
• Transaction Search stores every span in aws/spans for attribute search; the indexing percentage only decides how many become X-Ray trace summaries, while sampling decides what is recorded at all.
• Container Insights with enhanced observability: EKS via the CloudWatch Observability add-on; ECS via the cluster setting, where the account setting affects only new clusters.
• FireLens routes and filters logs before ingestion; non-blocking log driver mode keeps the application running when delivery throttles, at the risk of dropped lines.
• Cross-account log streaming needs a destination (role plus access policy, aws:PrincipalOrgID for organizations) in the same Region as the log group; account-level subscription policies cover future log groups but only in their own account and Region.
• Archive to S3 via Firehose with Lifecycle to Glacier Deep Archive when 12 to 48 hour retrieval is fine; compliance-mode Object Lock for immutability; the Infrequent Access log class cannot feed subscriptions and cannot be changed later.
• Composite alarms page once and keep child states visible; actions suppressors with WaitPeriod and ExtensionPeriod mute deployments; treat missing data as breaching for heartbeats.
• Alarms cannot start Automation runbooks directly; use an EventBridge rule on the state change. Use OpsCenter OpsItems for tracked work, since Incident Manager is closed to new customers.
• Bedrock: TimeToFirstToken for perceived wait, output tokens per second for generation speed; SageMaker AI: ModelLatency versus OverheadLatency; input drift warns before labels arrive.
• Canaries find breakage with no users; RUM measures real users; request-based SLOs and burn-rate alarms with thresholds well above 1 page on fast budget consumption.

SAP-C03 Operational Automation and Resilience: Auto Scaling, Self-Healing, Safe Remediation and Runbooks

• EventBridge is the hub: alarm state changes and AWS Health events reach rules that start Automation runbooks; organizational view plus a delegated administrator gives one Health feed for every account.
• A stop and start moves an EBS-backed instance to new hardware; a reboot does not.
• Quotas are per account and per Region: alarm on usage divided by SERVICE_QUOTA(), use quota request templates for new accounts, and raise DR Region quotas in advance.
• Only Capacity Reservations and zonal RIs reserve capacity; Savings Plans discount Capacity Reservations, and targeted reservations need the launch template to target them.
• Retries need backoff, jitter (Step Functions JitterStrategy FULL, SDK standard or adaptive mode), caps and idempotent writes; adaptive mode adds client-side rate limiting.
• A circuit breaker needs shared state, an expiry checked on read (TTL deletes late) and a half-open single probe; bulkheads isolate pools, Lambda concurrency and tenants (SQS fair queues).
• Safe remediation uses MaxConcurrency and MaxErrors, Distributed Map tolerated failures, and API destination invocation rate limits with a DLQ.
• Target tracking scales out if any policy asks and in only if all agree; use default instance warmup, scale-in protection, and DisableScaleIn plus step scaling for custom scale-in, never edited alarms.
• Predictive scaling: forecast only to evaluate, IncreaseMaxCapacity with MaxCapacityBuffer to exceed the maximum, keep target tracking alongside; scheduled actions take an IANA time zone; warm pools need a lifecycle hook for long user data.
• Recovery: combine health check types (ELB, EBS, custom SetInstanceHealth), launch-before-terminate maintenance policies and termination lifecycle hooks; ECS restart policies handle exits, health checks handle hangs; Lambda retry settings differ for async, stream and SQS invocations.