AWS Developer Associate 练习

Lambda is a serverless compute service that runs code in response to events. EC2 and RDS require server management, and CodeCommit is a git repository service.

S3 is object storage for files, images, backups, and static content. EBS is block storage for EC2, RDS is relational, and ElastiCache is in-memory caching.

DynamoDB is a managed NoSQL database with single-digit millisecond performance. RDS, Aurora, and Redshift are relational or warehouse services.

RDS manages relational databases such as MySQL, PostgreSQL, and SQL Server. S3 is object storage, DynamoDB is NoSQL, and SQS is a queue.

An EC2 instance is a virtual machine with configurable CPU, memory, and storage. Lambda is serverless, DynamoDB is a database, and SQS is a queue.

API Gateway creates REST and HTTP APIs, often fronting Lambda. S3 stores objects, CodeBuild builds code, and Route 53 provides DNS.

SQS is a message queue for decoupling components. SNS is pub/sub, CloudFront is a CDN, and Step Functions orchestrates workflows.

SNS publishes messages to subscribers, supporting fan-out. SQS is a queue, DynamoDB is a database, and Lambda is compute.

CloudFront caches content at edge locations. Route 53 is DNS, S3 is storage, and WAF is a web firewall.

Lambda layers package libraries and dependencies that can be shared across functions. Triggers invoke functions, reserved concurrency controls capacity, and alarms monitor metrics.

Provisioned concurrency pre-initializes environments so invocations avoid cold starts. Timeouts and memory do not directly prevent cold starts, and triggers cause them.

API Gateway creates HTTP endpoints that integrate with Lambda functions. It does not store logs, compile code, or replace Lambda.

HTTP APIs are simpler and cheaper than REST APIs for most use cases. REST APIs offer more features, WebSocket APIs handle persistent connections, and private APIs are VPC-only.

TTL deletes expired items automatically, which is useful for sessions and logs. It is not encryption, backup, or indexing.

Event source mappings poll sources such as DynamoDB Streams, Kinesis, or SQS and invoke Lambda with records. They are not dashboards, VPC settings, or deployment policies.

Step Functions coordinates steps in a workflow with state machines. SQS queues messages, SNS publishes, and API Gateway exposes APIs.

Provisioned concurrency initializes environments ahead of time to reduce latency. It is not an invocation limit, timeout, or log level.

CodeCommit hosts private git repositories. CodeBuild builds, CodeDeploy deploys, and CodePipeline orchestrates CI/CD.

CodeBuild builds and tests source code. CodeCommit stores source, CodePipeline automates release steps, and ECR stores container images.

CodeDeploy automates application deployments. CodeBuild builds, CodeCommit stores code, and CloudFront is a CDN.

CodePipeline orchestrates build, test, and deploy stages. CodeCommit and CodeBuild are individual services, and X-Ray traces requests.

A buildspec defines phases such as install, pre_build, build, and post_build for CodeBuild. Deployment configs and templates are different artifacts.

An appspec defines how CodeDeploy handles deployment, hooks, and file locations. It is not a repository, layer, or log.

Blue/green runs two environments and shifts traffic, enabling quick rollback. Rolling replaces instances gradually, and all-at-once replaces everything at once.

Rolling deployment updates instances in batches to reduce risk. Blue/green switches environments, and canary routes a small percentage to the new version.

A canary releases a small percentage of traffic to the new version and increases it over time. All-at-once replaces everything, and blue/green switches environments.

Elastic Beanstalk deploys and manages web apps without managing infrastructure. EC2 is IaaS, Lambda is serverless, and S3 is storage.

CloudFormation provisions infrastructure from templates. CodePipeline automates releases, CloudWatch monitors, and X-Ray traces.

IAM is Identity and Access Management, controlling users, roles, and permissions. The other expansions are not official.

An IAM role grants permissions through temporary credentials, often used by services and applications. It is not a password, key, or security group.

An IAM policy is a JSON document that allows or denies actions. It is not a table, layer, or build file.

Least privilege grants the minimum permissions required. It reduces security risk compared with broad access.

KMS creates and manages encryption keys. WAF filters web traffic, Cognito handles identity, and Shield provides DDoS protection.

Secrets Manager securely stores and rotates secrets. S3 is object storage, CodeCommit is git, and DynamoDB is a database.

Cognito provides authentication for app users. IAM is for AWS identities, KMS is keys, and CloudFront is a CDN.

WAF filters web traffic for attacks such as SQL injection. KMS manages keys, SQS queues messages, and CodeBuild builds code.

A presigned URL grants time-limited access to S3 objects or other resources. It is not permanent, DNS, or firewall.

Encryption at rest protects stored data. Encryption in transit protects data during transfer, which is a separate control.

Resource-based policies such as S3 bucket policies grant access to a resource. They are not passwords, security rules, or alarms.

Lifecycle policies move objects between tiers or delete them over time. Encryption, versioning, and replication are separate features.

Versioning preserves previous versions of objects, protecting against overwrites and deletes. Replication, encryption, and caching are separate.

Secondary indexes provide alternate query patterns. Backups, streams, and partitions are different features.

DynamoDB Streams captures item-level changes and can trigger Lambda. It is not a backup, index, or global table.

ElastiCache provides Redis or Memcached caching. S3 is object storage, RDS is relational, and DynamoDB is NoSQL.

Read replicas offload read traffic from the primary database. Backups restore data, Multi-AZ provides failover, and migrations move data.

Aurora is a relational database compatible with MySQL and PostgreSQL. DynamoDB is NoSQL, S3 is object storage, and Redshift is a warehouse.

Presigned URLs provide temporary access. Lifecycle policies manage tiers, versioning keeps versions, and transfer acceleration speeds uploads.

Glacier is for low-cost archival storage. Standard is hot storage, Intelligent-Tiering moves data automatically, and One Zone-IA is infrequent single-zone storage.

EFS is a shared NFS file system. EBS is block storage attached to one instance, S3 is object storage, and Glacier is archive.

An SNS topic is a pub/sub channel. SQS is a queue, Lambda is compute, and CloudWatch alarms trigger notifications.

CloudWatch collects metrics, logs, and alarms. X-Ray traces requests, CloudTrail records API activity, and Config tracks configuration.

CloudWatch Logs stores and queries log data. SQS queues, DynamoDB stores NoSQL data, and CodeBuild builds code.

CloudWatch alarms monitor metrics and trigger notifications or actions. They do not compile code, store git, or route DNS.

X-Ray analyzes and traces requests across services. CloudWatch monitors metrics, CloudTrail audits API calls, and Trusted Advisor gives best-practice checks.

CloudTrail records API calls for auditing. X-Ray traces, CloudWatch monitors, and WAF filters traffic.

Trusted Advisor reviews accounts and recommends improvements for cost, security, and reliability. CloudTrail audits, CloudWatch monitors, and CodePipeline deploys.

Lambda, API Gateway, DynamoDB, and S3 are all serverless services because they do not require server management.

Blue/green, rolling, canary, and all-at-once are deployment strategies. Each balances risk and speed differently.

Lambda runs outside a VPC by default. You can configure VPC access when functions need private resources, but it is not required.

SQS queues messages, SNS publishes notifications, CloudWatch monitors metrics and logs, and X-Ray traces requests.