💻 Compute
ALB vs NLB vs GLB
| ALB | NLB | GLB | |
|---|---|---|---|
| OSI Layer | 7 (HTTP/HTTPS) | 4 (TCP/UDP/TLS) | 3 (IP) |
| Routing | Path, host, header, query | Flow hash (fast) | To virtual appliances |
| Static IP | No (DNS name) | Yes (per AZ / EIP) | No |
| Best for | Web apps, microservices | Low latency, gaming, IoT | Firewalls, IDS/IPS inline |
ECS vs EKS vs Fargate
| ECS | EKS | Fargate | |
|---|---|---|---|
| What | AWS-native container orchestrator | Managed Kubernetes | Serverless compute for containers |
| Control plane | Managed by AWS (free) | Managed K8s (hourly fee) | N/A - launch type |
| Use when | Simple, AWS-only | K8s portability/ecosystem | No servers to manage (works with ECS/EKS) |
Lambda vs Fargate vs EC2
| Lambda | Fargate | EC2 | |
|---|---|---|---|
| Unit | Function (event) | Container (task) | Virtual machine |
| Max run time | 15 min | No hard limit | No limit |
| Scaling | Automatic, to zero | Task-based | Auto Scaling groups |
| Use when | Event-driven, spiky | Long-running containers, no server mgmt | Full control / legacy |
💾 Storage
EBS vs EFS vs FSx vs S3
| EBS | EFS | FSx | S3 | |
|---|---|---|---|---|
| Type | Block | File (NFS) | File (Windows/Lustre) | Object |
| Attach | One instance (or multi-attach io2) | Many instances, multi-AZ | Many instances | Over HTTP API |
| Scope | Single AZ | Regional (multi-AZ) | Varies | Regional, 11 9s durability |
| Use for | Boot volumes, databases | Shared Linux file storage | Windows shares, HPC | Static assets, data lake, backup |
S3 Standard-IA vs One Zone-IA vs Glacier
| Standard-IA | One Zone-IA | Glacier Flexible | |
|---|---|---|---|
| Retrieval | Milliseconds | Milliseconds | Minutes to hours |
| AZs | Multi-AZ | Single AZ | Multi-AZ |
| Use for | Infrequent, needs durability | Infrequent, reproducible data | Archive |
💡 Instance store vs EBS
Instance store is ephemeral (data lost on stop/terminate); EBS persists independently of the instance lifecycle.
📊 Databases
RDS vs Aurora vs DynamoDB vs Redshift
| RDS | Aurora | DynamoDB | Redshift | |
|---|---|---|---|---|
| Model | Relational | Relational (MySQL/PG compatible) | NoSQL key-value/document | Columnar data warehouse |
| Scale | Vertical + read replicas | Auto-scaling storage, 15 replicas | Horizontal, virtually unlimited | MPP cluster / serverless |
| Use for | Traditional apps | High-performance relational | Massive scale, low latency | OLAP / analytics |
RDS Multi-AZ vs Read Replicas
Multi-AZ
- Purpose: high availability / failover
- Synchronous standby, not readable
- Automatic failover on outage
Read Replicas
- Purpose: scale read traffic
- Asynchronous, readable
- Can be promoted to standalone
ElastiCache Redis vs Memcached
| Redis | Memcached | |
|---|---|---|
| Data structures | Rich (lists, sets, sorted sets) | Simple key-value |
| Persistence / replication | Yes (backups, replicas, Multi-AZ) | No |
| Use for | Leaderboards, pub/sub, HA cache | Simple, multi-threaded caching |
🌐 Networking
Security Group vs Network ACL
| Security Group | Network ACL | |
|---|---|---|
| Level | Instance / ENI | Subnet |
| State | Stateful (return auto-allowed) | Stateless (allow both directions) |
| Rules | Allow only | Allow and Deny |
| Evaluation | All rules | In order, lowest number first |
⚠ Ephemeral ports
Because NACLs are stateless, you must allow the ephemeral port range (1024-65535) for return traffic. Security Groups handle this automatically.
VPC Peering vs Transit Gateway vs PrivateLink
| VPC Peering | Transit Gateway | PrivateLink | |
|---|---|---|---|
| Topology | 1:1 | Hub-and-spoke (many) | Expose a single service |
| Transitive | No | Yes | N/A |
| Overlapping CIDRs | Not allowed | Not allowed | Works despite overlap |
NAT Gateway vs Internet Gateway vs Egress-Only IGW
| NAT Gateway | Internet Gateway | Egress-Only IGW | |
|---|---|---|---|
| Direction | Outbound only (IPv4) | Inbound + outbound | Outbound only (IPv6) |
| Subnet | Private -> internet | Public subnet | Private IPv6 -> internet |
📩 Messaging & Integration
SQS vs SNS vs EventBridge vs Kinesis
| SQS | SNS | EventBridge | Kinesis | |
|---|---|---|---|---|
| Pattern | Queue (pull) | Pub/sub (push) | Event bus + routing rules | Streaming |
| Consumers | One (per message) | Many subscribers | Many targets, filtered | Many, can replay |
| Ordering | FIFO option | FIFO option | No | Per-shard order + replay |
| Use for | Decouple, buffer work | Fan-out notifications | SaaS/AWS event routing | Real-time analytics, big streams |
Step Functions: Standard vs Express
| Standard | Express | |
|---|---|---|
| Duration | Up to 1 year | Up to 5 minutes |
| Rate | Lower throughput | Very high throughput |
| Use for | Long-running, auditable workflows | High-volume, short event processing |
🔒 Security & Identity
SCP vs IAM Policy vs Permission Boundary
| SCP | IAM Policy | Permission Boundary | |
|---|---|---|---|
| Scope | Whole account/OU (Org) | User/role/group | Max perms for a principal |
| Grants access? | No - only limits | Yes | No - only caps |
| Use for | Org-wide guardrails | Day-to-day permissions | Delegated admin limits |
Cognito User Pool vs Identity Pool
User Pool
- User directory & sign-in
- Issues JWT tokens
- Answers "who is this user?"
Identity Pool
- Exchanges identity for temporary AWS credentials
- Maps to IAM roles
- Answers "what AWS resources can they use?"
Secrets Manager vs Parameter Store
| Secrets Manager | Parameter Store | |
|---|---|---|
| Rotation | Built-in automatic | Manual (Lambda + EventBridge) |
| Cost | Per secret/month | Standard tier free |
| Use for | DB creds, rotating secrets | Config values, non-rotating secrets |
KMS vs CloudHSM
| KMS | CloudHSM | |
|---|---|---|
| Tenancy | Multi-tenant managed | Single-tenant dedicated HSM |
| Control | AWS-managed FIPS 140-2 | You fully control keys |
| Use for | Most encryption needs | Strict compliance, custom key store |
🚀 Deployment & DR
Deployment strategies
| Strategy | Behavior | Downtime / rollback |
|---|---|---|
| All-at-once | Replace everything at once | Downtime; fast but risky |
| Rolling | Replace in batches | Reduced capacity during deploy |
| Blue/Green | New env beside old, then switch | Zero downtime, instant rollback |
| Canary | Small % first, then rest | Limited blast radius |
DR strategies (RTO/RPO vs cost)
| Strategy | RTO/RPO | Cost |
|---|---|---|
| Backup & Restore | Hours | Lowest |
| Pilot Light | Tens of minutes | Low |
| Warm Standby | Minutes | Medium |
| Multi-Region Active-Active | Near zero | Highest |
📈 Analytics & AI
Athena vs Redshift vs EMR
| Athena | Redshift | EMR | |
|---|---|---|---|
| What | Serverless SQL on S3 | Managed data warehouse | Managed Hadoop/Spark clusters |
| Pay for | Data scanned per query | Cluster / serverless capacity | Cluster runtime |
| Use for | Ad-hoc queries, occasional | Frequent BI on structured data | Big data processing, custom frameworks |
Kinesis Data Streams vs Data Firehose
| Data Streams | Data Firehose | |
|---|---|---|
| Management | You manage shards/consumers | Fully managed delivery |
| Latency | Real-time (sub-second) | Near real-time (buffered) |
| Use for | Custom real-time processing, replay | Load to S3/Redshift/OpenSearch |
Fine-tuning vs RAG vs Prompt Engineering
| Prompt Engineering | RAG | Fine-tuning | |
|---|---|---|---|
| Changes model? | No | No (adds context) | Yes (weights) |
| Uses private data | In the prompt | Retrieved at query time | Baked into the model |
| Effort / cost | Lowest | Medium | Highest |
📝 Contribute
Spot a missing pair? Add it to the cheat sheet source in build.py and open a pull request.
🍉 Decision Trees
Fast "which service?" flowcharts for the most common exam decision points.
Which compute service?
flowchart TD
A{Need to run code?} --> B{Event-driven &
short-lived under 15 min?}
B -->|Yes| L[AWS Lambda]
B -->|No| C{Containers?}
C -->|Yes| D{Want to manage servers?}
D -->|No| F[Fargate]
D -->|Yes, Kubernetes| K[EKS]
D -->|Yes, AWS-native| E[ECS on EC2]
C -->|No| G{Full OS control /
legacy app?}
G -->|Yes| H[EC2]
G -->|No| I[Elastic Beanstalk /
App Runner]Which database?
flowchart TD
A{Data model?} --> B{Relational?}
B -->|Yes| C{Need MySQL/PostgreSQL
high performance?}
C -->|Yes| AU[Aurora]
C -->|Standard engine| RDS[RDS]
C -->|Data warehouse / OLAP| RS[Redshift]
B -->|No| D{Access pattern?}
D -->|Key-value, massive scale| DDB[DynamoDB]
D -->|In-memory cache| EC[ElastiCache]
D -->|Document| DOC[DocumentDB]
D -->|Graph| NEP[Neptune]
D -->|Time series| TS[Timestream]Which S3 storage class?
flowchart TD
A{Access frequency?} --> B{Frequently accessed?}
B -->|Yes| STD[S3 Standard]
B -->|Unknown / changing| INT[S3 Intelligent-Tiering]
B -->|Infrequent| C{Need multi-AZ
durability?}
C -->|Yes| IA[S3 Standard-IA]
C -->|Reproducible data| OZ[S3 One Zone-IA]
A --> D{Archive?}
D -->|Minutes retrieval| GIR[Glacier Instant Retrieval]
D -->|Hours retrieval| GFR[Glacier Flexible Retrieval]
D -->|12+ hours, lowest cost| GDA[Glacier Deep Archive]