Domain 3 is 34% of the scored content and the widest. Most of it is recall: which service does this job, and what distinguishes it from the one next to it. AWS publishes an in-scope service list for CLF-C02, and this sheet follows it. Read it as a catalogue, and drill the pairs that get confused.
Ways to reach AWS
- AWS Management Console. Browser interface. Exploring, one-off tasks, learning a service.
- AWS CLI. The command line over the same APIs. Scripting, and anything repeatable in a shell.
- AWS SDKs. Language libraries for Python, Java, JavaScript, Go, .NET and more, called from application code.
- Infrastructure as code. CloudFormation takes declarative JSON or YAML templates. The AWS CDK defines infrastructure in a programming language and synthesises CloudFormation. Both give repeatable, version-controlled, reviewable environments.
- AWS Elastic Beanstalk. Upload code and AWS provisions and manages the environment, for a standard web application.
- AWS Systems Manager. Operating a fleet after it exists: Session Manager, Patch Manager, Parameter Store, Run Command, Automation.
One-off or repeatable is the discriminator when both the console and IaC would do. A task done once is a console task. A task done per environment, per Region or per release should be code.
The global infrastructure
- Region. A geographic area containing multiple Availability Zones. Resources are Regional unless the service is a global one.
- Availability Zone. One or more discrete data centres with independent power, cooling and physical security. AZs in a Region sit on low-latency links to each other and share no single points of failure.
- Edge location. A point of presence for CloudFront and Route 53, far more numerous than Regions, used for caching and DNS.
- Regional edge cache. A larger cache between the edge locations and the origin, so content that is not popular enough to stay at an edge location remains close to viewers.
- Local Zone. An extension of a Region placing compute and storage nearer a large population centre.
- AWS Outposts. AWS-managed racks installed in your own data centre, running AWS services locally.
How to choose a Region: latency to users, compliance and data residency requirements, which services are available there, and price, which differs per Region.
When to use more than one Region: disaster recovery and business continuity, low latency for users in another part of the world, and sovereignty rules that require data to stay in a country.
High availability comes from deploying across multiple Availability Zones in one Region. Multiple Regions covers a Region-level failure, a sovereignty requirement, or a distant user base, and it is a larger undertaking than multi-AZ.
Some services are global rather than Regional: IAM, Route 53, CloudFront, AWS Organizations, AWS WAF for CloudFront distributions, and S3 bucket names, which are globally unique even though the data is Regional.
Compute
- Amazon EC2. Virtual machines you control. Reach for it when you need OS access, specific licensing, a legacy application, or a long-running server.
- AWS Lambda. Code run in response to an event, charged per request and duration, and capped at 15 minutes per invocation. Event-driven work, short tasks, spiky or unpredictable traffic.
- Amazon ECS. AWS container orchestration, for containers without running Kubernetes.
- Amazon EKS. Managed Kubernetes, for an existing Kubernetes investment or an ecosystem requirement.
- AWS Fargate. Serverless compute for containers, used by both ECS and EKS. No instances to patch or scale.
- Amazon ECR. Container image registry, with image scanning.
- AWS Elastic Beanstalk. Managed platform for web applications: deploy code, AWS runs the stack.
- AWS Batch. Managed batch computing, for queued jobs across many instances.
- AWS Outposts. AWS hardware on-premises, for low latency to local systems or data that has to stay in the building.
- Amazon Lightsail. Simple virtual private servers at a flat monthly price. Small predictable workloads, a simple website, a learning environment.
EC2 instance families, by what they are optimised for:
| Family | Optimised for | Typical workload |
|---|---|---|
| General purpose (M, T) | Balance of compute, memory and network | Web servers, small databases, development environments |
| Compute optimised (C) | High-performance processors | Batch processing, media transcoding, gaming servers |
| Memory optimised (R, X, U, Z) | Large memory relative to vCPU | In-memory databases, large caches, real-time analytics |
| Storage optimised (I, D) | High sequential read and write to local storage | Data warehouses, distributed file systems, very high IOPS databases |
| Accelerated computing (P, G, Inf, Trn) | GPUs and purpose-built accelerators | Machine learning training and inference, graphics rendering |
| High performance computing (Hpc) | Tightly coupled cluster workloads | Simulation, modelling |
Elasticity in compute: an Auto Scaling group adds and removes instances against a metric or a schedule, which is what makes capacity elastic rather than merely scalable. An Elastic Load Balancer spreads incoming traffic across targets and health-checks them, so an unhealthy target stops receiving requests.
| Load balancer | Layer | Use it for |
|---|---|---|
| Application Load Balancer | HTTP and HTTPS (layer 7) | Path and host routing, containers, web applications |
| Network Load Balancer | TCP, UDP, TLS (layer 4) | Extreme performance, static IP addresses, non-HTTP protocols |
| Gateway Load Balancer | Layer 3 gateway plus layer 4 | Inserting third-party virtual appliances into the traffic path |
The Classic Load Balancer is the previous generation, and AWS recommends migrating off it.
Storage
- Amazon S3. Object storage, for anything retrieved as a whole file: backups, media, data lakes, static websites.
- Amazon EBS. Block storage. A volume attached to one EC2 instance, like a disk, persisting independently of the instance.
- EC2 instance store. Block storage on the host itself, lost when the instance stops or terminates. Scratch space, caches, temporary data.
- Amazon EFS. A shared NFS file system that many Linux instances mount at once, across AZs.
- Amazon FSx. Managed versions of file systems you already run: Windows File Server, Lustre, NetApp ONTAP, OpenZFS.
- AWS Storage Gateway. On-premises systems reaching AWS storage through a local cache, as S3 File Gateway, FSx File Gateway, Volume Gateway or Tape Gateway.
- AWS Backup. One policy-driven place to back up EBS, RDS, DynamoDB, EFS, FSx and more, with retention and compliance reporting.
- AWS Elastic Disaster Recovery. Continuous replication of servers into AWS, ready to launch after an outage.
S3 storage classes, from hottest to coldest:
| Class | For | Retrieval |
|---|---|---|
| S3 Standard | Frequently accessed data | Milliseconds |
| S3 Express One Zone | The most latency-sensitive data | Single-digit milliseconds; one AZ only |
| S3 Intelligent-Tiering | Unknown or changing access patterns | Milliseconds; moves objects between tiers automatically for a per-object monitoring charge |
| S3 Standard-IA | Infrequently accessed, needed quickly | Milliseconds; lower storage price, retrieval charge, 30-day minimum |
| S3 One Zone-IA | Infrequent, reproducible data | Milliseconds; one AZ only, so cheaper and less resilient |
| S3 Glacier Instant Retrieval | Archive accessed about once a quarter | Milliseconds; 90-day minimum |
| S3 Glacier Flexible Retrieval | Archive accessed about once a year | Minutes to hours; restore first |
| S3 Glacier Deep Archive | Long-term retention, rarely read | Hours; the lowest storage price, 180-day minimum |
Lifecycle policies move objects between classes on an age rule and expire them at the end, which turns a retention requirement into configuration rather than a job. Versioning keeps every version of an object, and Object Lock makes versions immutable for a retention period. Each of these classes is designed for eleven nines of durability, and S3 encrypts new objects with SSE-S3 by default.
Databases
- Amazon RDS. Managed relational, running Db2, MariaDB, Microsoft SQL Server, MySQL, Oracle or PostgreSQL without you running the server.
- Amazon Aurora. AWS-built relational, MySQL- and PostgreSQL-compatible, on a cluster volume that spans Availability Zones with a copy in each.
- Amazon DynamoDB. Serverless NoSQL key-value, single-digit millisecond reads at any scale, no instance to size.
- Amazon ElastiCache. In-memory caching for a database or a session store, on Valkey, Redis OSS or Memcached.
- Amazon Neptune. Graph, for when relationships are the query: fraud rings, recommendations, social graphs.
- Amazon DocumentDB. MongoDB-compatible document workloads.
- Amazon Redshift. Columnar data warehouse for analytical queries over large volumes, not transactional work.
- AWS DMS. Moves a database while the source stays online.
- AWS SCT. Converts schema and code between different engines.
RDS resilience: a Multi-AZ deployment keeps a synchronous standby in another Availability Zone for automatic failover, which is availability rather than performance. A read replica is an asynchronous copy that serves read traffic, which is performance rather than availability, and it can be promoted.
EC2-hosted or managed is a recurring decision. Run it on EC2 when the engine, version or operating system access is not available on RDS. Use the managed service when patching, backups and failover are work the team would rather not own.
Networking and content delivery
- Amazon VPC. A logically isolated network in AWS, with your own address range.
- Subnet. A range within the VPC, in one Availability Zone. It is public if it routes to an internet gateway.
- Internet gateway. Allows traffic between the VPC and the internet.
- NAT gateway. Lets instances in private subnets reach the internet without being reachable from it.
- Route table. Where traffic for a destination is sent.
- Security group. Instance-level firewall. Stateful, allow rules only.
- Network ACL. Subnet-level firewall. Stateless, allow and deny rules, evaluated in number order.
- VPC endpoint. Private access to AWS services without traversing the internet. Gateway endpoints serve S3 and DynamoDB; interface endpoints, built on AWS PrivateLink, serve the rest.
- VPC peering. A private connection between two VPCs, and it is not transitive.
- AWS Transit Gateway. A hub connecting many VPCs and on-premises networks.
- AWS Site-to-Site VPN. An encrypted tunnel over the internet to on-premises. Quick to stand up, and subject to internet variability.
- AWS Client VPN. An encrypted tunnel from an individual user’s device into the VPC.
- AWS Direct Connect. A dedicated private circuit to AWS. Consistent latency, higher bandwidth, weeks to provision.
- Amazon Route 53. DNS, domain registration and health checks, with eight routing policies: simple, weighted, latency, failover, geolocation, geoproximity, IP-based and multivalue answer.
- Amazon CloudFront. Content delivery network caching at edge locations, and a front door for dynamic content.
- AWS Global Accelerator. Static anycast IP addresses routing users over the AWS global network to the nearest healthy endpoint.
- Amazon API Gateway. Creates, publishes and secures REST, HTTP and WebSocket APIs.
Security groups against network ACLs is the pair most often confused. Security groups attach to an instance’s network interface, are stateful, so a reply to an allowed request is allowed automatically, and support allow rules only. Network ACLs attach to a subnet, are stateless, so return traffic needs its own rule, support deny as well as allow, and are evaluated in rule-number order.
AI, machine learning and analytics
- Amazon SageMaker AI. Build, train and deploy machine learning models.
- Amazon Bedrock. Foundation models through an API, and the building blocks for generative AI applications.
- Amazon Q. Generative AI assistant. Amazon Q Developer helps you build and operate on AWS.
- Amazon Rekognition. Images and video: objects, faces, moderation.
- Amazon Transcribe. Speech to text.
- Amazon Polly. Text to speech.
- Amazon Translate. Language translation.
- Amazon Comprehend. Natural language processing: sentiment, entities, key phrases.
- Amazon Textract. Text and structure out of scanned documents and forms.
- Amazon Lex. Conversational interfaces: chatbots and voice bots.
- Amazon Athena. SQL straight against data in S3, serverless, charged on the data each query scans.
- AWS Glue. Serverless ETL and a data catalogue.
- Amazon Kinesis. Streaming data. Kinesis Data Streams ingests records, Kinesis Video Streams handles video, Amazon Data Firehose loads streams into S3, Redshift, OpenSearch and others, and Amazon Managed Service for Apache Flink processes them.
- Amazon EMR. Managed Hadoop, Spark, Hive and Presto clusters.
- Amazon Quick Sight. Business intelligence dashboards.
- Amazon OpenSearch Service. Search and log analytics.
Application integration, and the rest of the catalogue
- Amazon SNS. Publish and subscribe messaging: one message to many subscribers, and alerts by email, SMS or HTTP.
- Amazon SQS. A message queue decoupling a producer from a consumer, as standard or FIFO queues.
- Amazon EventBridge. An event bus routing events by rule between AWS services, your applications and SaaS partners, plus scheduled events.
- AWS Step Functions. Orchestrates multiple steps into a workflow with state, retries and branching.
- Amazon Connect. Cloud contact centre.
- Amazon SES. Bulk and transactional email.
- Amazon WorkSpaces. Managed virtual desktops.
- Amazon WorkSpaces Secure Browser. A managed browser delivering internal web applications without a full desktop.
- Amazon AppStream 2.0. Streams a single application rather than a whole desktop.
- AWS Amplify. Builds and hosts frontend web and mobile applications.
- AWS IoT Core. Connects and manages IoT devices at scale.
- AWS CodeBuild. Compiles source and runs tests.
- AWS CodePipeline. Continuous delivery pipeline orchestrating the stages.
- AWS X-Ray. Distributed tracing: which call in a request chain was slow or failed.
SNS, SQS and EventBridge are the trio to hold apart. SNS pushes one message to many subscribers. SQS holds messages until a consumer pulls them, which decouples components and absorbs bursts. EventBridge routes events by rule to many possible targets, and connects SaaS applications as well as AWS services.
Renamed, and closed to new customers
Names move, and a sheet written a year ago will use a few that AWS has retired.
- Amazon QuickSight is now Amazon Quick Sight, a feature of Amazon Quick. Existing APIs and integrations are unchanged, and the in-scope service list uses the new name.
- Amazon Q Business is closed to new customers, with Amazon Quick named as the replacement. Amazon Q Developer is unaffected.
- AWS Cloud9 is closed to new customers. AWS CloudShell and the IDE toolkits cover the ground.
- AWS Snowball Edge has been limited to existing customers since 7 November 2025, and AWS Snowcone was discontinued in November 2024. AWS directs new customers to AWS DataSync for online transfers, or AWS Data Transfer Terminal for physical ones.
- Kinesis Data Firehose is now Amazon Data Firehose, and Kinesis Data Analytics is now Amazon Managed Service for Apache Flink.
- Amazon Timestream for LiveAnalytics is closed to new customers, leaving Amazon Timestream for InfluxDB as the available one.
- Amazon SageMaker is now Amazon SageMaker AI, for the build, train and deploy service.
AWS also publishes an out-of-scope list. It names AWS Wavelength, Amazon Fraud Detector, Amazon Personalize, Amazon Keyspaces, Amazon MemoryDB, Amazon MSK, AWS CodeDeploy and AWS CodeArtifact, none of which are worth drilling.
Traps
- An Availability Zone is not a data centre, it is one or more, and AZs in a Region are designed to share no single points of failure.
- Multi-AZ is for availability, read replicas are for performance. The RDS pair gets confused more than any other.
- Instance store is ephemeral. Stopping or terminating the instance loses it. EBS persists.
- EFS is Linux, FSx for Windows File Server is Windows. EBS attaches to one instance; EFS mounts on many.
- S3 One Zone-IA is in one AZ. Cheaper, and the wrong choice whenever the data cannot be reproduced.
- Glacier Deep Archive retrieval takes hours. Archival data needed in milliseconds is Glacier Instant Retrieval.
- Security groups are stateful, network ACLs are stateless. Only the ACL needs a rule for return traffic, and only the ACL can deny.
- VPC peering is not transitive. Three VPCs need three peerings, or a transit gateway.
- Direct Connect is not encrypted by itself. It is private, not encrypted, so run a VPN over it where encryption is required.
- CloudFront is a CDN, Global Accelerator is not. Accelerator gives static anycast IPs and routes over the AWS global network, and it does not cache.
- Lambda is event-driven and time-limited. A process longer than 15 minutes is EC2, Fargate or Batch.
- Fargate removes the instance, not the container image. The image is still yours to build and patch.
- Athena queries S3 in place. Nothing is loaded, and the charge is on data scanned, so file format and partitioning change the bill.
- SQS pulls, SNS pushes. A consumer polls a queue; a subscriber receives a notification.