Cloud Computing Study Guide: Lessons 5–8

How to use this guide

This guide combines the Lessons 5–8 chapter material. It is organized by lesson so you can connect securing an account to the tools that manage it, the compute services that run applications, and the storage services that hold their data.

Study in this order:

Learn the vocabulary and comparisons in the lesson summaries.
Explain the key comparisons and decision rules in your own words.
Revisit the high-yield distinctions and connect them across the lessons.

Some AWS details (service names, device options, and defaults) have changed over time. Where your course material uses the older model, this guide lists both the older and current versions so you can recognize either one.

This guide always gives the exam’s answer. A note labeled Exam answer check marks a place where that answer is incorrect, imprecise, or out of date compared with AWS today. Learn the answer in the guide for the exam, and use the note for real-world work.

The ideas that connect all four lessons

Lessons 1–4 explained what the cloud is and where it runs. These four lessons cover how you actually use it:

Lesson 5 — who can do what: the root user, IAM identities, credentials, encryption, and compliance documents.
Lesson 6 — how you work and watch: the console, CLI, and SDKs, plus CloudWatch, CloudTrail, and Cost Explorer.
Lesson 7 — where code runs: EC2, managed deployments, containers, and Lambda.
Lesson 8 — where data lives: S3, Glacier, Storage Gateway, and the Snow Family.

Two rules appear in every lesson. First, match the tool to the need: the right credential for the access method, the right pricing model for the workload, and the right storage class for the access pattern. Second, know what a tool does not do: an alarm does not watch for events, a Reserved Instance does not launch a server, and integrity validation does not prevent deletion.

Lesson 5 — Securing Your AWS Resources

Protecting the root user

The root user is created with the account and can do anything, which is why it should not be used for daily work. To secure it:

create a strong password,
enable MFA, and
avoid root access keys.

Do not use root for day-to-day administration, and do not try to put it in an IAM group. Instead, create an admin IAM user with the AdministratorAccess policy. AmazonS3FullAccess and AmazonEC2FullAccess open up only one service each, so they are too narrow for an admin. “AdminAccess” is not the policy name.

Credentials and how each one is used

Access method	What you need
AWS Management Console as an IAM user	Username and password, on the account’s sign-in page (such as `https://<account-id>.signin.aws.amazon.com/console`)
Programmatic access (CLI, SDK, API)	Access key ID and secret access key, as a pair. An ID alone is worthless. No password or MFA is required to make calls
SSH to an EC2 Linux instance	A key pair, with the private key stored on your client machine

To connect to an Amazon Linux instance, name the local key with -i and log in as the default user, ec2-user:

ssh -i mykey.pem ec2-user@54.7.35.103

Multifactor authentication (MFA) requires at least two methods: normally a password (something you know) plus a token from a physical or virtual MFA device (something you have). The device is added to the password, not used instead of it, and only one device is needed.

Exam answer check: Username and password are enough only when you are already on the account-specific sign-in page. On the general sign-in page, an IAM user also enters the account ID or alias, and an MFA code if MFA is enabled.

An IAM password policy can require at least one uppercase letter, one number, and one non-alphanumeric character. It cannot require a space or null character.

Users, groups, and roles

User: one person or application with long-term credentials.
Group: a collection of users that share permissions. Assigning users with similar needs to IAM groups is the most efficient way to manage permissions for many users.
Role: a set of permissions granted to a trusted entity (such as an AWS service or a federated identity) over specified AWS resources. Roles issue temporary credentials when assumed, but a role is the set of permissions, not the credentials. It is also not a security group.

The principle of least privilege means giving each identity only the permissions its job requires.

Federated identities

Federation lets people sign in with an identity that already exists elsewhere. The third-party federated identity standards to know are SAML 2.0 and Active Directory (AD). SSH is an encrypted remote connection protocol, and SSO (single sign-on) is an interface feature, so neither is a federated identity standard. Today, IAM Identity Center is the AWS-recommended way to give workforce users access.

Exam answer check: Active Directory is a directory service, not really a federation standard. SAML 2.0 is the actual standard.

Federated identities fit into AWS workflows in ways such as:

giving users authenticated through a third-party identity provider access to the backend resources of a mobile app, and
giving admins authenticated through AWS Microsoft AD access to a Microsoft SharePoint farm running on AWS.

Identities do not guide infrastructure design or import outside data such as Gmail records.

The credential report

The IAM credential report shows the current state of security of your IAM users’ access credentials: passwords, access keys, and MFA status. It is saved in CSV format. It is not a record of API requests (that is CloudTrail) or of failed login attempts.

Encryption and KMS

AWS Key Management Service (KMS) uses a customer master key (CMK) to encrypt objects on your account. AWS now calls these KMS keys, and the two terms mean the same thing. KMS can encrypt RDS databases, S3 buckets, and DynamoDB databases.

EBS volumes can be encrypted only at creation. An existing unencrypted volume cannot be encrypted with KMS later.

Approach	Where it protects data	Keys
SSE-S3	Within S3 buckets	Managed by S3
SSE-KMS	Within S3 buckets	KMS-managed server-side keys
Client-side	Before data reaches AWS, including in transit between your office and S3	Client-side master key

To protect data in transit to S3 this way, encrypt it before upload with a client-side master key. SSE-S3 and SSE-KMS only encrypt data once it is inside the bucket. DynamoDB is a NoSQL database, not an encryption tool. Since January 2023, S3 also encrypts all new objects with SSE-S3 by default.

Compliance and AWS Artifact

AWS Artifact provides AWS compliance documents. They help you confirm that your deployment infrastructure is compliant with regulatory standards during application planning. They do not describe AWS’s design policies or how to optimize your workflows.

Document	What it covers
PCI DSS	Credit card transaction processing; helps find vulnerabilities in resources that handle cardholder data
SOC reports	Attest to AWS infrastructure compliance with data accountability standards such as Sarbanes–Oxley
FedRAMP	U.S. government cloud security authorization
APRA	Australian Prudential Regulation Authority requirements

SOC reports do not guarantee your own application is compliant. AWS proves its side, and the customer still has to configure its own workloads correctly.

Other security services

Service	Job
Inspector	Scans workloads for software vulnerabilities
GuardDuty	Detects threats from account activity
Detective	Investigates the origin and impact of security findings
Secrets Manager	Stores and rotates secrets such as database passwords
Audit Manager	Collects evidence and produces audit reports
CloudHSM	Dedicated hardware for your own cryptographic keys
Resource Access Manager	Shares resources with other accounts
Security Hub	One dashboard for findings across security services

Lesson 5 terms to know

root user, IAM, AdministratorAccess, MFA, access key ID, secret access key, key pair, ec2-user, password policy, IAM user, IAM group, IAM role, trusted entity, least privilege, federation, SAML 2.0, Active Directory, SSO, IAM Identity Center, credential report, KMS, CMK, SSE-S3, SSE-KMS, client-side master key, AWS Artifact, PCI DSS, SOC, FedRAMP, APRA, Inspector, GuardDuty, Detective, Secrets Manager, Audit Manager, CloudHSM, Resource Access Manager, and Security Hub.

Lesson 6 — Working with Your AWS Resources

The AWS Management Console

You sign in to the console as the root user or as an IAM user. For IAM users, the account ID or account alias identifies the account, but those are not credentials. You cannot log in to the console with an access key ID.

Exam answer check: An IAM user is an identity rather than a credential. The actual credentials are the username and password.

A console session stays active for 12 hours, then expires to protect the account.
If resources seem to be missing, check the Region selector first. The root user can view everything, you don’t need an access key to use the console, and you cannot choose an AZ in the navigation bar.

Resource tags

A resource tag must have a key. The value is optional. Tags do not have to be unique within an account, and they are case-sensitive. Tag Editor finds and tags resources in bulk, and resource groups gather resources by tag or CloudFormation stack. Tagging strategies are commonly technical, automation, business, or security focused.

The AWS CLI

The AWS CLI lets you interact with AWS services from a terminal on Linux, macOS, or Windows.

Installing on Windows: use the MSI installer or Python and pip. An SDK does not include the CLI, and Yum and Aptitude are Linux-only package managers.
After installing: run aws configure to set your access key ID, secret access key, default Region, and output format. aws --version only displays the version and isn’t required. Never create root access keys for this.
Output formats: JSON, text, and table. CSV and TSV are not options.

Exam answer check: Python and pip apply to AWS CLI version 1. Version 2, the one to install today, uses the MSI installer on Windows and also supports YAML output.

aws --version
aws configure

Software development kits

An AWS SDK lets you use a popular programming language to write applications that interact with AWS services. Do not swap these: the CLI is for the terminal, and the SDK is for writing applications.

SDK type	Available for	Not available for
Language SDKs	JavaScript, Java, PHP, Python, Ruby, Go, .NET, C++	Fortran; JSON (a data format, not a language)
Mobile SDKs for both Android and iOS	Unity and .NET and Xamarin	Go is a language SDK, not a cross-platform mobile SDK
IoT device SDKs	C++, Python, Java, JavaScript, Embedded C	Swift, Ruby

Today, AWS Amplify is the main AWS framework for web and mobile apps.

CloudWatch

Feature	What it does
Metrics	Store performance data from AWS services
Logs	Store text-based logs from applications and AWS services
Metric filters	Extract metric information from logs
Alarms	Monitor metrics and trigger when one crosses a threshold
Events (now EventBridge)	Respond to actions against resources, or run on a schedule

Alarms versus events is the distinction to master:

A CloudWatch alarm triggers on a metric that exceeds a threshold, such as CPU utilization above 90 percent. It cannot trigger on an event such as an instance terminating.
CloudWatch Events responds to something specific happening, such as an IAM user logging in to the console, or a schedule, such as shutting down an instance at a specific time. It cannot watch a metric threshold or a line in a log file.
To react to a specific IP address in a web server log, create a metric filter that increments a custom metric, then set an alarm on that metric.

Simple Notification Service (SNS) sends the notifications. Its supported protocols include SMS and SQS, as well as email, HTTP/HTTPS, Lambda, and mobile push (not “pull”).

CloudTrail

CloudTrail records API activity: who did what, when, and from where.

What counts as an API action: viewing or listing a resource, in either the console or the CLI, such as viewing an S3 bucket or listing IAM users. Logging in to the console and configuring the CLI are not API actions.

Option	What it gives you
Event history	The last 90 days of management events per Region, on by default. No data events. The most cost-effective way to view and search recent management events, such as the last 60 days
Trail	Keeps logs in an S3 bucket indefinitely and can log data events such as S3 object downloads
Streaming to CloudWatch Logs	Makes a trail’s logs easy to view and search; requires a trail

To log every object downloaded from a bucket, keep the logs indefinitely, and search them easily, create a trail that logs S3 data events and stream it to CloudWatch Logs. Global service event logging does not include S3 data events.

Log file integrity validation uses cryptographic hashing so you can assert that no log files have been deleted from S3. It does not prevent tampering or deletion, cannot tell you how a file was changed, and has nothing to do with CloudWatch or network monitoring.

Cost Explorer

Report	What it shows
Costs and usage	Monthly spending by service, including the monthly cost of reserved EC2 instances
RI utilization	How much of your reservations you use and the money you have saved with RIs
RI coverage	How many running hours reservations cover, your on-demand spending, and what RIs could have saved
Daily costs	Spending over recent months with a forecast for the current month
Monthly EC2 running hours	Graphs of costs and running hours for EC2 instances

Reserved instances are available for services that use instances, such as EC2 and Amazon RDS. Lambda, S3, and Fargate don’t use instances, so they cannot be reserved.

Governance tools

AWS Config: records how resources are configured over time. Config shows what a resource looked like; CloudTrail shows who changed it.
Control Tower: sets up and governs a multi-account environment (a landing zone).
License Manager: tracks software licenses and license compliance.
Billing Conductor: produces custom bills for companies that resell AWS services.

Lesson 6 terms to know

AWS Management Console, account alias, account ID, 12-hour session, Region selector, resource tag, Tag Editor, resource group, AWS CLI, aws configure, MSI installer, pip, SDK, Mobile SDK, IoT device SDK, AWS Amplify, CloudWatch, metric, metric filter, alarm, CloudWatch Events, EventBridge, SNS, CloudTrail, management event, data event, event history, trail, log file integrity validation, Cost Explorer, RI utilization, RI coverage, AWS Config, Control Tower, License Manager, and Billing Conductor.

Lesson 7 — The Core Compute Services

Amazon Machine Images

The function of an AMI is to serve as a source image from which an instance’s primary storage volume is built. An AMI can include an operating system and a software application stack. It does not include a networking configuration or an instance type, and it doesn’t define the instance’s hardware.

AMI source	What you find there
Quick Start	A few dozen of the most popular AMIs
AWS Marketplace	A wide range of verified AMIs from AWS and third-party vendors
Community	Thousands of publicly available AMIs; you are responsible for trusting them
My AMIs	Only AMIs created from your own account

Instance types and families

An instance type sets the hardware profile. A family groups types by purpose.

Families: general purpose, compute optimized, memory optimized, accelerated computing, storage optimized, and HPC optimized.
Types: names such as t2.micro and c5d.18xlarge are instance types, not families.
vCPU: a metric that roughly measures an instance type’s compute power compared to the number of processors on a physical machine.

A dedicated instance runs on a physical host reserved for the exclusive use of a single AWS account. A dedicated host gives you an entire physical server with control over instance placement.

EBS versus instance store

	EBS volume	Instance store volume
What it is	Virtualized partition of a physical drive that can be encrypted	Virtualized partition on a drive directly connected to the instance
Performance	Fast	Faster reads and writes
After shutdown	Data persists	Data is lost
Good for	Anything you must keep	Temporary data

Choose instance store for its speed and direct connection, not because it is more secure or lasting. EBS encryption is optional, so don’t describe a volume as always encrypted.

EC2 pricing models

Model	Use it for	Avoid it for
On-Demand	Limited-time work that can’t be interrupted, such as extra instances during demand spikes	Instances running 24/7 for years
Reserved	Base instances that run constantly	Short or occasional use
Spot	Big data processing and continuous integration environments	E-commerce sites and long-term, highly available websites, because Spot instances can be shut down unexpectedly

A Spot fleet is also unreliable for constantly running base instances. A Savings Plan is the newer, more flexible commitment option.

When you purchase an EC2 Reserved Instance, the reservation covers charges for any instances you run that match the RI type. It does not launch an instance, and it is not automatically billed in full, because you choose All Upfront, Partial Upfront, or No Upfront.

Simplified deployments

Both Elastic Beanstalk and Lightsail simplify bringing web applications to deployment, and both use primarily EC2 resources. EBS is storage, and RDS is largely built on its own infrastructure.

	Lightsail	Elastic Beanstalk
You provide	A blueprint and a plan	Application code
Billing	Flat rate, regardless of how it’s consumed	Actual usage

Lightsail blueprints include application stacks such as GitLab and LAMP, as well as plain operating systems such as Ubuntu and Debian. An operating system alone is not a stack. EC2, Beanstalk, and RDS all bill by actual usage.

Containers and serverless

Docker and Kubernetes directly use container technologies. Lambda and Lightsail are not inherently container technologies, even if they use containers internally.

AWS services designed to deploy Docker containers are Elastic Container Service (ECS) and Elastic Beanstalk. Elastic Kubernetes Service (EKS) runs Kubernetes, and Fargate runs containers without servers to manage. EBS and S3 are storage services.

AWS Lambda runs functions when triggered:

The maximum run time is 15 minutes (it was once 5).
Python can be set as a function’s runtime environment. It is not the code driving the Lambda service or a required language for API calls.

Lesson 7 terms to know

EC2, AMI, Quick Start, AWS Marketplace, Community AMIs, My AMIs, instance type, instance family, vCPU, compute optimized, accelerated computing, dedicated instance, dedicated host, EBS, instance store, On-Demand, Reserved Instance, Spot, Spot fleet, Savings Plans, Lightsail, blueprint, LAMP, Elastic Beanstalk, Docker, Kubernetes, ECS, EKS, Fargate, Lambda, and runtime.

Lesson 8 — The Core Storage Services

S3 fundamentals

S3 stores objects, and EBS stores volumes. S3 is object storage, and EBS is block storage. EBS snapshots are themselves stored in S3.

A single S3 object can be up to 5 TB.
Bucket names must be globally unique across AWS, regardless of Region, and 3 to 63 characters long. If a name such as documents is taken, choose a globally unique one. Changing the Region or length won’t help.
Storage classes are set per object, so they have no effect on bucket naming.

For a static website on S3:

you are responsible for S3 charges, but there is no compute charge,
no one can modify your content unless you give them permission, and
the STANDARD class keeps objects in multiple AZs, so one AZ outage won’t bring down the site.

Storage classes

Class	Best for	Availability	AZs
STANDARD	Frequent access	99.99%	At least 3
INTELLIGENT_TIERING	Unknown or changing access	99.9%	At least 3
STANDARD_IA	Infrequent access to data that can’t be easily replaced	99.9%	At least 3
ONEZONE_IA	Infrequent access to data you can re-create	99.5%	1
GLACIER	Rarely accessed archives	99.99% after restore	At least 3

For infrequently accessed data that can’t be easily replaced, choose STANDARD_IA or GLACIER. ONEZONE_IA keeps objects in only one AZ, so losing that zone could lose everything. STANDARD and INTELLIGENT_TIERING are less cost-effective for this use. Current AWS names also include Glacier Instant Retrieval, Glacier Flexible Retrieval, and Glacier Deep Archive.

Exam answer check: The answer is still STANDARD_IA and GLACIER, but the exam’s explanation is wrong to give GLACIER 99.5 percent availability. That figure belongs to ONEZONE_IA.

Durability asks whether the data will still exist. Availability asks whether you can reach it right now.

S3 access and life cycles

Method	Grants access to	Anonymous access?
Bucket policies	Principals, other accounts, or anyone	Yes
Access control lists (ACLs)	Other accounts or anyone	Yes
User policies	IAM principals	No

Security groups control access to resources in a VPC, not to S3 objects. Today, Block Public Access is on by default for new buckets, and AWS recommends policies over ACLs.

Object life-cycle configurations can automatically move objects to Glacier and delete old object versions. They cannot delete buckets or move objects to an EBS volume.

S3 Glacier

An archive can be as small as 1 byte and as large as 40 TB.
From the Glacier service console, you can create or delete vaults. You cannot create, retrieve, or delete archives there.
S3 and Glacier offer the same durability, but Glacier is the more cost-effective choice for long-term storage. A 5 TB database file kept off-site for five years and needed within 8 hours fits S3 Glacier, because it meets the requirement at the lowest cost.

Retrieval option	Time
Expedited	1 to 5 minutes
Standard	3 to 5 hours
Bulk	5 to 12 hours

Today, most people use Glacier through S3 storage classes and life-cycle rules rather than vaults.

AWS Storage Gateway

All Storage Gateway types primarily store data in S3 buckets. From there, data can move to Glacier or to EBS snapshots, which can become EBS volumes. Storage Gateway lets you transfer files from on-premises servers to S3 using standard protocols, without installing third-party software. It runs as a virtual machine, not a hardware device.

Gateway type	Protocol	Key facts
File	NFS, SMB	Files stored as S3 objects
Volume, stored	iSCSI	All data local; asynchronously backed up to S3 as EBS snapshots; up to 16 TB
Volume, cached	iSCSI	Only a frequently used subset stored locally; does not asynchronously back up to S3 as EBS snapshots; up to 32 TB
Tape	iSCSI	Virtual tapes for existing backup software

Remember these distinctions:

The types that connect servers to block storage over iSCSI are tape and volume. “Cached” is a volume configuration, not a gateway type.
To move files without third-party software, use a file gateway with SMB, or a volume gateway with iSCSI. Snowball and the AWS CLI both require installing software.

Exam answer check: Cached volumes can in fact take snapshots. AWS documents point-in-time backups of cached volumes stored in S3 as EBS snapshots. The exam’s point is the difference in design: stored volumes keep data locally and back it up asynchronously, while cached volumes keep their primary data in S3.

The Snow Family

Device	Key facts
50 TB Snowball	42 TB usable; up to 10 Gbps
80 TB Snowball	72 TB usable; up to 10 Gbps
Snowball Edge, Storage Optimized	QSFP+ port supporting up to 40 Gbps
Snowball Edge, Compute Optimized	QSFP+ port supporting up to 100 Gbps
Snowball Edge, Compute Optimized with GPU	Best for machine learning and high-performance computing

Snowball Edge devices can run EC2 instances and can be clustered together for storage. Copying files using NFSv1 and adding a QSFP+ interface that supports up to 40 Gbps are not true statements about Snowball Edge devices.

Exam answer check: The exam contradicts itself here. It rejects the 40 Gbps QSFP+ statement for Snowball Edge in general, but also says the Storage Optimized configuration has a QSFP+ port supporting up to 40 Gbps. Learn both answers as worded.

Security features: Snowball enforces encryption at rest and in transit, and it uses a TPM chip to detect unauthorized changes to hardware or software.

Damaged or tampered devices: AWS won’t replace the TPM chip or copy your data to S3 or Glacier. It will securely erase the data from the device.

Transferring data from Windows without writing code: use the Snowball Client. The S3 SDK Adapter for Snowball requires code. NFS, SMB, and iSCSI are not the Snowball tools for this.

AWS has since discontinued Snowcone and Snowmobile, and Snow device availability continues to change.

Other storage services

AWS Transfer Family: managed SFTP, FTPS, and FTP into S3 and EFS.
Amazon FSx: managed file systems, including Windows File Server and Lustre.
AWS Elastic Disaster Recovery: replicates servers to AWS for failover, drills, and failback.
AWS DataSync: moves data online between on-premises storage and AWS.

Lesson 8 terms to know

S3, object, bucket, globally unique, block storage, object storage, durability, availability, STANDARD, INTELLIGENT_TIERING, STANDARD_IA, ONEZONE_IA, GLACIER, bucket policy, ACL, user policy, Block Public Access, life-cycle configuration, archive, vault, Expedited, Standard, Bulk, Storage Gateway, file gateway, volume gateway, stored volume, cached volume, tape gateway, iSCSI, NFS, SMB, Snowball, Snowball Edge, QSFP+, TPM, Snowball Client, Transfer Family, FSx, Elastic Disaster Recovery, and DataSync.