CLF-C02 flashcards

Cloud Concepts

• The AWS value proposition: on-demand resources with pay-as-you-go pricing replace owning and operating your own hardware.
• CapEx to OpEx: large upfront hardware investment becomes a variable expense that tracks actual usage; commitment discounts lower rates but bill the committed amount even when idle.
• Economies of scale: aggregated usage from all customers lowers AWS's costs, passed on as lower prices to everyone — unlike volume tiers, commitments, or Region choice, which depend on your own decisions.
• Moving to EC2 removes facility and hardware costs; guest OS patching, software licenses, and usage charges such as data transfer out remain yours.
• Elasticity = automatically acquiring AND releasing resources as demand changes; manual additions and scale-out-only policies are not elastic.
• Scalability = the ability to grow to meet demand; it does not have to be automatic or bidirectional.
• High availability = surviving component failure with minimal downtime via redundancy across Availability Zones; restoring a backup is recovery with downtime, and a single-AZ load balancer is not HA.
• Agility = the business benefit of provisioning in minutes: faster experiments, faster time to market, cheap failure.
• Global infrastructure delivers speed of deployment and global reach; data stays in the Region you choose unless you replicate it, and services and prices vary by Region.
• Edge locations cache content near viewers but do not run the application in another geography or protect a single-AZ origin from a zone outage; entering a new market means a Region there.
• Speed of deployment is about launching in a new geography quickly; agility is about how fast the organization experiments and ships.

• The AWS Well-Architected Framework has exactly six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability
• The AWS Well-Architected Tool is a free console service that reviews workloads against the framework and produces an improvement plan; lenses (from the Lens Catalog, or custom) add domain-specific questions, while milestones only save a snapshot of the review; unlike Trusted Advisor (automated account checks), Compute Optimizer (compute right-sizing) or Config conformance packs (resource settings vs rules), it reviews a workload's design
• Operational excellence principles include Safely automate where possible, Make frequent small reversible changes, Anticipate failure, and Learn from all operational events and metrics
• Security's principles include a strong identity foundation and Maintain traceability; security protects against unauthorized access, reliability against component failure
• Reliability = keep working and recover from failure (failover, Multi-AZ, backups, Stop guessing capacity); performance efficiency = right resources and low latency when nothing is broken
• Cost optimization is measured in money, operational excellence in process quality; pricing commitments such as Savings Plans change only the price, so they are never a sustainability action
• Sustainability targets environmental impact — maximize utilization, adopt more efficient hardware like Graviton, use managed services, choose Regions with sustainability goals in mind, and align SLAs with sustainability goals (relaxing service levels of non-critical workloads trades reliability for fewer resources)
• Pillars overlap and trade off against each other; answer 'which pillar?' questions by finding the stated goal, not the service or practice named

• The AWS CAF has six perspectives: Business, People, Governance (business capabilities) and Platform, Security, Operations (technical capabilities). Program, risk, cloud financial and application portfolio management are Governance; strategy and product portfolio are Business.
• The four CAF benefit categories are reduced business risk, improved ESG performance, increased revenue, and increased operational efficiency (lower cost, higher productivity, better employee and customer experience) — outcomes, not perspectives.
• If an option starts with reduced/improved/increased, it's a CAF benefit; Technology, Process, Organization and Product are transformation domains; the six functional nouns are perspectives.
• The 7 Rs: rehost (as-is onto EC2), replatform (managed service or runtime such as RDS or Elastic Beanstalk), refactor (re-architect), repurchase (SaaS), relocate (cloud version of the same platform, e.g. VMware Cloud on AWS), retain (stay put), retire (shut down). Hyper-V VMs moved unchanged are rehost.
• AWS DMS migrates live databases with minimal downtime using full load plus ongoing replication (CDC); heterogeneous migrations convert the schema first (DMS Schema Conversion or AWS SCT), homogeneous ones need no conversion.
• Rule of thumb: 100 Mbps moves about 1 TB a day. When that misses the deadline, use a physical path — AWS Snowball only for existing Snow customers (closed to new customers since 7 November 2025), otherwise AWS Data Transfer Terminal or Partner services; S3 Transfer Acceleration cannot beat your own bandwidth.
• DataSync copies files and objects; DMS replicates databases; AWS Transform MGN (formerly Application Migration Service) rehosts servers on EC2; Storage Gateway is ongoing hybrid access, not a migration copy.
• Migration Evaluator builds the business case from measured on-premises usage; Prescriptive Guidance documents strategies; AWS Partners supply expertise; Migration Hub is closed to new customers (AWS Transform is the successor).
• Retire and retain are the only two Rs where nothing moves to AWS — a common distractor pair.

• Moving to AWS trades upfront capital expense (CapEx) for pay-as-you-go operational expense (OpEx) — fixed costs become variable costs
• A cost is variable if it rises and falls with usage; hardware purchases, data center rent, and facilities are fixed costs
• Savings Plans and Reserved Instances are deliberately fixed cloud spending: the commitment is billed regardless of usage, and it lowers the rate without changing instance size
• On-premises TCO includes hardware, power, cooling, physical space, network, software licenses, AND staff labor — but not general business costs, and application development drops out because it is the same in both environments
• BYOL reuses licenses you already own (compliance stays with you; License Manager only helps track it; Dedicated Hosts meet dedicated-hardware terms); license-included bundles the license into the EC2 or RDS price
• Rightsizing means continuously matching instance type and size to actual workload needs — down when idle, up when saturated; a 1:1 lift-and-shift of peak-sized servers recreates overprovisioning
• Only rightsizing changes the instance; commitments and Spot change the price, and schedules change the hours
• Automation with AWS CloudFormation cuts cost by replacing manual provisioning labor with repeatable templates and making idle environments safe to delete
• Managed services (RDS, ECS, EKS, DynamoDB) reduce TCO by shifting patching, backups, scaling, and failure recovery to AWS; AWS Fargate removes container node management too
• A managed service can cost more per hour than self-managed EC2 yet have lower total cost of ownership once staff time and operations are counted

Security and Compliance

• AWS is responsible for security OF the cloud (facilities, hardware, network, hypervisor); the customer is responsible for security IN the cloud (data, access, configuration).
• Customer data, IAM permissions (including execution roles), database user accounts, and encryption choices are ALWAYS the customer's responsibility, on every service.
• Physical data centers, the hardware lifecycle (including replacing a failed Dedicated Host), the global infrastructure, and the hypervisor are ALWAYS AWS's responsibility, on every tenancy option.
• The line shifts by service: on EC2 you patch the guest OS; on RDS, AWS patches the OS and database engine in the maintenance window you set; on Lambda, AWS manages the OS, scaling and managed runtimes — but a runtime or container image you package and the libraries you bundle stay yours.
• Secure defaults and AWS tools don't move responsibility: S3 default encryption, AWS AMIs and Patch Manager help, but the keys, baselines and schedules are still your choice.
• Security groups, network ACLs and other firewall settings are the customer's to configure, even though AWS provides the feature.
• Encryption at rest (S3, EBS) and encryption in transit (TLS) are separate customer decisions; one does not cover the other.
• AWS's durability protects data from failed hardware; protecting it from your own accidental deletion (versioning, backups, least privilege) is yours.
• The three shared controls: patch management, configuration management, and awareness and training.
• Controls classify as inherited (evidenced by AWS's audit reports), shared, or customer-specific; AWS's reports never evidence your own controls.
• Your content stays in the Region you choose (replicated across AZs inside it); any cross-Region copy is your configuration, and the snapshots and backups you create are yours to delete — AWS only disposes of its retired physical media.

• AWS Artifact = AWS's own compliance reports (SOC, PCI, ISO) and agreements such as the BAA; an organization agreement is accepted once from the management account and covers every account.
• Compliance varies by geography (you choose the Region and AWS keeps content there unless you agree; GovCloud (US) for ITAR/FedRAMP High), industry (HIPAA, PCI DSS), and service (services-in-scope lists).
• In scope means AWS's controls for a service were assessed; the customer must still meet and evidence its own controls.
• Encryption at rest = KMS (CloudHSM for dedicated single-tenant HSMs); in transit = TLS with ACM certificates. SSE-S3, SSE-KMS and SSE-C all encrypt after AWS receives the data; only client-side encryption keeps plaintext from AWS.
• CloudTrail event history is a 90-day console view; long-term API records need a trail delivering to S3 (GuardDuty findings are detections, kept 90 days, not an API record). Flow Logs go to CloudWatch Logs or S3; S3 server access logs and ALB access logs go to S3.
• GuardDuty = threats (including malware in S3 uploads); Inspector = vulnerabilities (EC2, ECR, Lambda); Macie = sensitive data in S3; Security Hub brings findings together and Security Hub CSPM checks standards; Shield Standard is the only free, always-on DDoS protection.
• CloudTrail = who did what; CloudWatch = performance, dashboards and alarms; Config = configuration state and rules, with remediation actions to fix. Audit Manager collects your audit evidence but is closed to new accounts since 30 April 2026.
• IAM credential report = root and IAM users' passwords, keys and MFA (no roles, regenerated at most every four hours); last accessed information = which services users, groups, roles and policies actually use.

• IAM is a free, global service: authentication proves who you are; policies authorize what you can do — explicit deny beats allow, and anything not allowed is implicitly denied.
• Users hold long-term credentials, groups organize IAM users (never instances or other accounts' users), roles are assumed temporarily, policies are JSON permission documents.
• Protect the root user: MFA, strong password, no access keys, an administrative user (AWS recommends IAM Identity Center) for daily work. IAM policies cannot restrict root.
• Root-only tasks include changing the root email/password, closing or reopening a standalone account, restoring a locked-out admin, enabling S3 MFA delete, and unlocking a deny-all bucket or queue policy. Changing the Support plan or account name is not root-only.
• Least privilege narrows both actions and resources; a custom policy is only least privilege if it is narrow. Permissions boundaries and SCPs cap permissions but grant nothing.
• Workloads use roles: an EC2 instance role or Lambda execution role, never stored access keys. Cross-account roles live in the resource-owning account and trust the requesting account.
• Access keys never expire on their own and ignore the password policy; find unused ones with the IAM credential report and deactivate leaked ones immediately.
• IAM Identity Center = workforce single sign-on across many accounts (permission sets become roles); Cognito = customer sign-in for your apps; Secrets Manager rotates secrets, Parameter Store stores config and SecureString values.

• Security groups are stateful instance-level firewalls with allow rules only; all rules are evaluated together.
• Network ACLs are stateless subnet-level filters with allow AND deny rules, evaluated in number order, first match wins.
• Because NACLs are stateless, responses go to the client's ephemeral port, so the return-direction rule must allow the ephemeral port range, not the service port.
• A NACL deny only takes effect if it is numbered lower than any allow rule that also matches.
• Starting states: default NACL allows all; custom NACL denies all; new security group denies inbound and allows outbound.
• AWS WAF blocks SQL injection and XSS at layer 7 on CloudFront, ALB or API Gateway; AWS Shield stops DDoS (Standard automatic at no extra cost, Advanced paid with the Shield Response Team and cost protection).
• AWS Firewall Manager applies WAF, Shield Advanced, security group, NACL, Network Firewall and DNS Firewall policies across an organization, including new accounts; AWS Network Firewall is a managed stateful VPC firewall with intrusion prevention and domain filtering.
• Third-party security products come from AWS Marketplace, billed through your AWS bill. Quick answers → Knowledge Center; whitepapers and bulletins → Security Center; announcements → Security Blog. Trusted Advisor flags open security groups, public S3 buckets and snapshots, and missing root MFA; Basic Support gets selected security checks, the full set needs Business Support+, Enterprise Support or Unified Operations.

Cloud Technology and Services

• Every access method — Console, CLI, SDKs, IaC — ultimately makes calls to the same AWS APIs over HTTPS.
• Management Console = human, visual, one-time or infrequent tasks; sign in with password + MFA.
• AWS CLI = terminal commands and scripts for repeatable admin automation; SDKs = AWS calls from application code.
• AWS CloudFormation templates provision entire environments repeatably, consistently, and under version control — the IaC answer on CLF-C02.
• An AMI copies one EC2 instance's software image; a CloudFormation template recreates the whole environment (network, database, permissions, instances).
• CloudFormation drift detection reports manual changes but does not revert them; scaling needs Auto Scaling; a stack exists only in its Region (use StackSets or redeploy for more).
• One-time task → console is fine; anything repeated → script it (CLI) or template it (CloudFormation) for consistency and fewer errors.
• Hybrid deployment = cloud connected to on-premises (including AWS Outposts on site with its parent Region); multi-cloud = more than one cloud provider.
• Site-to-Site VPN = encrypted tunnel over the internet — fast to set up, cheaper, variable performance.
• Client VPN connects individual users' devices to AWS; Site-to-Site VPN connects whole networks.
• Direct Connect = dedicated private physical link — consistent bandwidth/latency, avoids the public internet, takes weeks to provision, and is not encrypted by default (run a VPN over it).

• A Region is a geographic area containing multiple isolated Availability Zones; an AZ is one or more discrete data centers with independent power, cooling, and networking.
• Availability Zones do not share single points of failure but are linked by low-latency connections — deploy across multiple AZs for high availability within a Region.
• Spreading servers across AZs does not replicate data by itself, and each tier (web, app, database) needs copies in more than one AZ — splitting tiers across zones just creates two single points of failure.
• All AZs in a Region lie within about 100 km of each other, so multi-AZ cannot absorb a disaster across the Region's whole area.
• Use multiple Regions for exactly four exam reasons: disaster recovery, business continuity, low latency for distant users, and data sovereignty.
• Backups in a second Region recover data; keeping customers served through a Region outage needs the workload running in the second Region.
• Data stays in the Region you put it in unless you move it — that is why Region choice answers data-residency questions.
• Backups and DR copies are customer data: in a single-Region country with an in-country residency rule, resilience comes from multiple AZs in that Region.
• Edge locations number in the hundreds — far more than Regions — and serve users nearby rather than hosting your core workloads.
• CloudFront caches content at edge locations (CDN); Global Accelerator uses edge locations as static entry points onto the AWS global network for any TCP/UDP application.
• Local Zones extend a Region into a metro area for single-digit-millisecond latency; Wavelength Zones embed AWS inside telecom 5G networks; Outposts puts AWS hardware on your premises.
• Trap check: availability during component failure = multiple AZs; regional disaster, global users, or legal residency = multiple Regions.

• EC2 = virtual servers with full OS control; you patch, size, and scale them, and they suit long-running workloads.
• Instance families by trigger: compute optimized = CPU-heavy (batch, gaming); memory optimized = in-memory datasets; storage optimized = high local disk I/O; accelerated = GPUs/ML; HPC optimized = tightly coupled CPU simulations (no GPUs); general purpose = balanced.
• Lambda runs event-driven functions, each invocation capped at 15 minutes, with pay-per-use billing on its default compute; choose EC2 for long-running or full-control workloads.
• Fargate is serverless compute for ECS or EKS containers with no instances at all, and it can keep a container service running all day — Lambda runs short functions, even when packaged as a container image.
• ECS is AWS-native container orchestration; EKS is managed Kubernetes — pick EKS whenever the question says Kubernetes or portability.
• Auto scaling adjusts capacity to demand — that is elasticity; a load balancer distributes traffic across existing targets for availability and fault tolerance.
• ELB types: ALB = HTTP/HTTPS (layer 7) with path- and host-based routing; NLB = TCP/UDP (layer 4) at extreme scale; Gateway LB = third-party network appliances; Classic = previous generation.
• One-liners: Elastic Beanstalk = upload code or a container, AWS provisions EC2 instances you can still adjust; Lightsail = simple VPS at a predictable monthly price; AWS Batch = queued batch jobs with compute that scales down when idle.

• Database on EC2 = full control (any engine/version, OS access) but the customer patches, backs up and fails it over; managed services shift that work to AWS — but never the schema, queries or data decisions.
• Amazon RDS = managed relational service for MySQL, PostgreSQL, MariaDB, SQL Server, Oracle and IBM Db2 — relational engines only.
• RDS Multi-AZ = synchronous standby in another AZ, serves no traffic, automatic failover; read replicas = asynchronous read-only copies that scale reads, promoted manually.
• Amazon Aurora = MySQL/PostgreSQL-compatible engine with higher performance and six copies of data across three AZs (two per AZ), even with one DB instance; Aurora Serverless scales capacity automatically.
• Amazon DynamoDB = serverless NoSQL key-value/document database with a flexible schema and single-digit millisecond latency at any scale; joins and multi-table transactions point to relational instead.
• Amazon ElastiCache (Valkey, Redis OSS, Memcached) caches results in memory in front of a database; read replicas re-run queries and CloudFront caches content for end users. MemoryDB = durable in-memory primary database; Neptune = graph database.
• AWS DMS moves the data with the source live (full load + CDC); AWS SCT or DMS Schema Conversion converts schema and code between different engines.
• Same-engine migration = DMS alone; cross-engine = schema conversion, then DMS. Application Migration Service rehosts whole servers to EC2 and DataSync moves files — neither migrates a database into RDS or Aurora.

• Amazon VPC is your logically isolated virtual network in one Region; you define the IP range and split it into subnets, each in exactly one Availability Zone.
• Public subnet = route to an internet gateway; private subnet = no direct internet route. Every route table keeps a local route, so all subnets can still reach each other.
• Routing decides whether a path exists; security groups and network ACLs only filter traffic on paths that exist — an allow rule never makes a private subnet reachable.
• Internet gateway = two-way internet access (one per VPC, already redundant); NAT gateway = outbound-only access for private subnets (zonal in a public subnet, or regional for the whole VPC); virtual private gateway = the VPC's VPN endpoint.
• Security groups filter at the resource level with allow rules only; network ACLs filter at the subnet level and support deny rules. AWS WAF filters web requests at CloudFront, ALB and API Gateway, not in the VPC.
• VPC peering joins two VPCs and is not transitive; Transit Gateway is the hub for many VPCs and on-premises links; PrivateLink exposes one service through interface endpoints.
• Route 53 is DNS: it translates names to IP addresses, registers domains and routes with health checks — failover keeps a standby idle, multivalue answer returns several healthy records (up to eight) per query.
• CloudFront caches content at edge locations; Global Accelerator brings TCP/UDP traffic onto the AWS network at the nearest edge with static anycast IPs — unlike a Regional NLB or S3 Transfer Acceleration.
• Site-to-Site VPN = encrypted tunnels over the internet; Direct Connect = dedicated private physical link; Client VPN = individual remote users.

• Match the storage shape first: S3 = objects via API, EBS = block disk for one EC2 instance, EFS/FSx = shared file systems.
• S3 is designed for 11 nines (99.999999999%) durability, virtually unlimited capacity, and shines for backups, static websites, data lakes, and media.
• Pick S3 classes by access pattern: Standard (frequent), Standard-IA (infrequent + instant), One Zone-IA (re-creatable), Intelligent-Tiering (unknown pattern).
• Pick Glacier tiers by retrieval time: Instant Retrieval (milliseconds, about-quarterly reads, cheaper storage than Standard-IA), Flexible Retrieval (minutes–hours), Deep Archive (hours, cheapest, compliance retention).
• Lifecycle policies automatically transition aging objects to cheaper classes and expire them; they do not replicate, version, back up or encrypt data.
• EBS persists through stop/start and lives in one AZ (Multi-Attach is io1/io2, same AZ only); to reach another AZ, restore a snapshot as a new volume. Instance store is ephemeral — lost on stop or termination.
• EFS is elastic shared NFS for Linux with nothing to provision and data across AZs; FSx is sized at creation — FSx for Windows File Server = SMB/Active Directory, FSx for Lustre = HPC in a single AZ.
• Storage Gateway = on-premises access to cloud storage with a local cache (S3 File, Volume = iSCSI disks, Tape = iSCSI virtual tape library); DataSync transfers data and Direct Connect is a network link.
• AWS Backup = centralized policy-based backup with cross-Region/account copies across EC2, EBS, RDS, DynamoDB, EFS and more; Data Lifecycle Manager covers only EBS snapshots/AMIs, and Elastic Disaster Recovery is continuous replication for failover.

• SageMaker (now SageMaker AI) is the platform to build, train, and deploy YOUR OWN ML models; every other AI service is a pre-trained API you can call out of the box, with no ML expertise needed.
• Transcribe = speech to text; Polly = text to speech; Translate = between languages; Comprehend = sentiment and meaning from text.
• Rekognition analyzes photos and videos; Textract extracts text and form data from scanned documents; Lex builds chatbots; Kendra is natural-language enterprise search.
• Athena runs serverless, ad hoc SQL on data in S3, by default billed per data scanned; Redshift (clusters or Serverless) is the data warehouse for recurring, high-concurrency reporting on structured data.
• "Real time" or "streaming" means Kinesis; Kinesis Data Streams retains records so several consumers can read and replay them, while Data Firehose just delivers to destinations. "Apache Kafka" means MSK; "Spark or Hadoop" means EMR.
• AWS Glue is serverless ETL plus the Glue Data Catalog that Athena uses and EMR can use; QuickSight (now Amazon Quick Sight) is the BI dashboard and visualization service.
• OpenSearch Service is full-text search and log analytics developers build into applications; Kendra is ML-powered question-answering search over company documents with ready-made connectors.
• AWS Data Exchange is where you find and subscribe to third-party data sets; the data and its updates arrive in your own AWS account.
• Match multi-service pipelines stage by stage: Transcribe → Translate for foreign-language audio, Transcribe → Comprehend for call sentiment, Textract → QuickSight for scanned paperwork to dashboards.

• SQS is a pull-based message queue (one consumer per message, buffers and decouples); SNS is push-based pub/sub (one message fanned out to many subscribers).
• Fan-out pattern: publish once to an SNS topic, deliver copies to multiple SQS queues for independent processing.
• EventBridge routes events between AWS services, SaaS apps, and custom apps using rules; Step Functions orchestrates multi-step workflows visually.
• Contact center = Amazon Connect; application-sent transactional or marketing email to any recipient = Amazon SES; one notification to every topic subscriber (email, SMS and more) = Amazon SNS.
• AWS Support is the in-scope customer-enablement service: AWS engineers advise under a support plan (a TAM comes with Enterprise Support or Unified Operations). Contrast it with AMS (AWS operates your infrastructure), Activate (startup credits) and hired project help (AWS Professional Services, or partners via AWS Marketplace; AWS IQ is discontinued).
• CI/CD by stage: CodeCommit (Git, generally available again) → CodeBuild (build/test) → CodeDeploy (deploy) → CodePipeline (orchestrate); CodeArtifact stores packages; X-Ray traces requests (CloudTrail logs API calls, Config tracks resource configuration); AppConfig manages feature flags.
• Full virtual desktop = WorkSpaces; stream a single application = AppStream 2.0 (now WorkSpaces Applications); secure browser access to internal web apps = WorkSpaces Secure Browser.
• GraphQL = AppSync; build/host full-stack apps fast = Amplify; connect devices and route their messages with rules = IoT Core; compute on devices, even offline = IoT Greengrass — edge designs use both.

Billing, Pricing, and Support

• Steady, predictable workloads running a year or more → Reserved Instances or Savings Plans, up to 72% off On-Demand.
• Fault-tolerant, interruptible workloads (batch, CI, analytics) → Spot Instances, up to 90% off, reclaimable with a two-minute warning.
• Unpredictable, short-term, or first-time workloads → On-Demand: no commitment, most flexible, most expensive long-run.
• Standard RI = bigger discount, less flexible; Convertible RI = exchangeable (family/OS/tenancy) for a smaller discount; more money upfront = bigger discount.
• Regional RIs discount matching usage in any AZ (and across sizes in the family for Linux/Unix default-tenancy RIs) but reserve no capacity; zonal RIs reserve capacity but pin the discount to one AZ and one size. Scope can be modified either way during the term.
• Compute Savings Plans are the most flexible commitment — any EC2 family, size, or Region, plus Fargate and Lambda; EC2 Instance Savings Plans trade flexibility for a deeper discount.
• Dedicated Host = whole physical server with socket/core visibility for BYOL licensing; Dedicated Instance = isolated hardware without host visibility; Capacity Reservation = guaranteed AZ capacity at the On-Demand rate with no discount and no 1- or 3-year term (future-dated ones carry a minimum commitment).
• Under AWS Organizations consolidated billing, unused RI and Savings Plans discounts are shared across all accounts by default, and aggregated usage reaches volume-discount tiers sooner.
• Data transfer: inbound from the internet is free; outbound to the internet, cross-Region, and cross-AZ transfers are charged; same-AZ private-IP traffic is typically free.
• Storage: the lower the per-GB-month rate, the higher the cost to read — Standard-IA adds a per-GB retrieval fee and 30-day minimum; Glacier Instant, Flexible Retrieval and Deep Archive get cheaper in that order, with Deep Archive retrievals taking up to 12 hours (standard).

• Match by tense: estimate BEFORE = Pricing Calculator; alert DURING = AWS Budgets; analyze AFTER = Cost Explorer; deepest data = CUR.
• AWS Pricing Calculator is a free public web tool — no AWS account needed — for estimating a planned architecture's cost.
• AWS Budgets alerts via email or SNS on actual OR forecasted thresholds; budget actions apply an IAM policy or SCP (blocks new activity) or stop chosen EC2/RDS instances.
• AWS Cost Explorer visualizes historical spend, filters/groups by service, account, and tag, and forecasts future costs from history.
• The Cost and Usage Report is the most detailed billing data AWS provides — per-resource, per-hour line items delivered to an S3 bucket.
• Consolidated billing gives one bill for all Organizations accounts, combines usage toward volume tiers (including data transfer), and shares RI/Savings Plans discounts, which apply to the usage they were bought for and never to data transfer.
• AWS Billing Conductor produces pro-forma billing data at custom rates for resellers and chargeback; it never changes the real AWS bill.
• Cost allocation tags must be ACTIVATED by the management account (or a standalone account); a backfill can apply them to up to 12 months of earlier cost data.
• Account and billing support cases are free on every support plan, including Basic; the Price List API returns list prices, the Cost Explorer API your own spend.

• Current AWS Support plans: Basic (free), Business Support+, Enterprise Support and Unified Operations; Developer and Business Support have a 1 January 2027 end-of-support date, and Enterprise On-Ramp customers are upgraded to Enterprise Support.
• Business Support+ is the lowest-cost plan with technical support and AWS's minimum recommendation for production; it unlocks the full Trusted Advisor checks and the AWS Health API.
• A designated TAM and Trusted Advisor Priority start at Enterprise Support; Unified Operations adds domain specialist and incident management engineers for mission-critical workloads.
• Learn plans by role, not by response-time numbers or prices, which AWS changes.
• The AWS Support Center is where cases are opened; Basic Support can still open account-and-billing and service quota increase cases, only technical cases need a paid plan.
• AWS Health Dashboard shows AWS events and maintenance affecting your resources (all accounts); the Health API needs Business Support+ or higher.
• Prescriptive Guidance = proven strategies and patterns; Knowledge Center = answers to the most frequent support questions; re:Post = free community Q&A.
• Report abuse from AWS resources to AWS Trust & Safety; if you receive an abuse notice, you investigate, stop the activity and reply.
• APN: ISVs build software (often sold on AWS Marketplace), system integrators deliver projects; partner benefits include training and certification, events and volume discounts.
• AWS Marketplace covers procurement, cost management, governance (Private Marketplace for approved third-party products) and entitlement; Service Catalog curates your own internal products.

Yes — the whole CLF-C02 deck is free and needs no account, as is every CLF-C02 revision lesson. Create a free account to save progress and drill practice questions; full-length mock exams are a one-time unlock per certification.