Title: Cloud Computing AWS — LearnCoachAssist

Q: What is cloud computing?
A: Cloud computing is the on-demand delivery of IT resources over the internet with pay-as-you-go pricing. Instead of owning physical data centers, you rent compute power, storage, and databases from a cloud provider like AWS, Azure, or Google Cloud.

Q: What are the three main cloud service models?
A: - IaaS (Infrastructure as a Service) — You manage OS, apps, and data; provider manages hardware (e.g., EC2)
- PaaS (Platform as a Service) — Provider manages OS and runtime; you manage code and data (e.g., Elastic Beanstalk)
- SaaS (Software as a Service) — Provider manages everything; you just use the app (e.g., Gmail, Salesforce)

Q: What is the AWS Shared Responsibility Model?
A: AWS and the customer share security duties:
AWS is responsible for security of the cloud — hardware, networking, facilities, and managed services.
The customer is responsible for security in the cloud — data encryption, IAM policies, OS patching, firewall rules, and application code.

Q: What are AWS Regions and Availability Zones?
A: An AWS Region is a geographic area (e.g., us-east-1) containing multiple isolated data centers. An Availability Zone (AZ) is one or more discrete data centers within a Region, each with independent power, networking, and connectivity. Deploying across multiple AZs provides high availability and fault tolerance.

Q: What is Amazon EC2?
A: Amazon Elastic Compute Cloud (EC2) provides resizable virtual servers (instances) in the cloud. You choose the instance type, operating system (AMI), storage, and networking configuration. EC2 gives you full control over compute resources with per-second or per-hour billing.

Q: What are the main EC2 instance type families?
A: - General Purpose (T, M) — Balanced CPU, memory, and networking
- Compute Optimized (C) — High-performance processors for batch processing, ML inference
- Memory Optimized (R, X) — Fast performance for large in-memory datasets
- Storage Optimized (I, D, H) — High sequential read/write to large local datasets
- Accelerated Computing (P, G) — GPU instances for machine learning and graphics

Q: What is an Amazon Machine Image (AMI)?
A: An AMI is a template that contains a software configuration (OS, application server, applications) used to launch EC2 instances. AMIs can be:
- AWS-provided (Amazon Linux, Ubuntu, Windows)
- Marketplace (third-party pre-configured)
- Custom (your own golden images)
AMIs are region-specific but can be copied across regions.

Q: What is an EC2 Security Group?
A: A Security Group acts as a virtual firewall for EC2 instances controlling inbound and outbound traffic. Key features:
- Rules are stateful — return traffic is automatically allowed
- You can only specify allow rules (no deny rules)
- Evaluated as a group — all rules are checked before deciding
- Applied at the instance (ENI) level

Q: What are EC2 Key Pairs used for?
A: Key Pairs consist of a public key (stored by AWS) and a private key (downloaded by you) used for secure SSH access to Linux instances. AWS uses the public key to encrypt a credential, and only your private key can decrypt it. Never share your private key — if lost, you cannot recover it.

Q: What is an EBS Volume?
A: Amazon Elastic Block Store (EBS) provides persistent block-level storage volumes for EC2 instances. Key types:
- gp3/gp2 — General Purpose SSD (most workloads)
- io2/io1 — Provisioned IOPS SSD (databases)
- st1 — Throughput Optimized HDD (big data)
- sc1 — Cold HDD (infrequent access)
EBS volumes are AZ-specific and can be snapshotted for backups.

Q: What are EC2 Placement Groups?
A: Placement Groups control how instances are placed on hardware:
- Cluster — Packs instances close together in one AZ for low-latency, high-throughput (e.g., HPC)
- Spread — Places instances on distinct hardware to reduce correlated failures (max 7 per AZ)
- Partition — Spreads instances across logical partitions so groups don't share hardware (e.g., Hadoop, Kafka)

Q: What is Amazon S3?
A: Amazon Simple Storage Service (S3) is an object storage service offering virtually unlimited storage. Data is stored as objects inside buckets. Each object can be up to 5 TB in size. S3 provides 99.999999999% (11 nines) durability and is accessed via HTTP/HTTPS APIs.

Q: What is an S3 bucket and what are its naming rules?
A: An S3 bucket is a container for objects. Rules:
- Bucket names must be globally unique across all AWS accounts
- Names must be 3–63 characters, lowercase, no underscores
- Buckets are created in a specific Region
- You can have up to 100 buckets per account (soft limit)
Objects are identified by a key (the full path within the bucket).

Q: What are the S3 storage classes?
A: - S3 Standard — Frequently accessed data, low latency
- S3 Intelligent-Tiering — Auto-moves data between tiers based on access
- S3 Standard-IA — Infrequent access, lower cost, retrieval fee
- S3 One Zone-IA — Infrequent access, single AZ (cheaper)
- S3 Glacier Instant Retrieval — Archive with millisecond access
- S3 Glacier Deep Archive — Lowest cost, 12-hour retrieval

Q: What is S3 Versioning?
A: S3 Versioning keeps multiple variants of an object in the same bucket. When enabled:
- Every overwrite or delete creates a new version
- Deleted objects get a delete marker (recoverable)
- Protects against accidental deletion and overwrites
- Once enabled, versioning can be suspended but not disabled
Versioning is a prerequisite for Cross-Region Replication.

Q: What are S3 Lifecycle Policies?
A: Lifecycle policies automate transitioning objects between storage classes or deleting them. You define rules based on:
- Transition actions — Move objects to cheaper classes after N days (e.g., Standard → Glacier after 90 days)
- Expiration actions — Delete objects after N days
Policies can target objects by prefix or tags and apply to current or previous versions.

Q: How do you host a static website on S3?
A: Steps to host a static site on S3:
- Create a bucket with your domain name
- Enable Static Website Hosting in bucket properties
- Set the index document (e.g., index.html) and error document
- Make objects publicly readable via a bucket policy
- Optionally, use CloudFront as a CDN and Route 53 for DNS
The endpoint format is: http://bucket-name.s3-website-region.amazonaws.com

Q: What is AWS Lambda?
A: AWS Lambda is a serverless compute service that runs your code in response to events without provisioning servers. Key features:
- Supports Node.js, Python, Java, Go, .NET, Ruby
- Pay only for compute time consumed (per ms)
- Scales automatically from zero to thousands of concurrent executions
- Max execution time: 15 minutes
- Max memory: 10 GB

Q: What are Lambda triggers and common event sources?
A: A trigger is an AWS service or event that invokes a Lambda function. Common sources:
- API Gateway — HTTP requests
- S3 — Object upload/delete events
- DynamoDB Streams — Table changes
- SQS — Queue messages
- CloudWatch Events/EventBridge — Scheduled or event-driven
- SNS — Notification messages

Q: What is a Lambda Cold Start?
A: A cold start occurs when Lambda must initialize a new execution environment for a function, including downloading code and starting the runtime. This adds latency (100ms to several seconds). Mitigation strategies:
- Use Provisioned Concurrency to keep instances warm
- Choose lighter runtimes (Python, Node.js over Java)
- Minimize deployment package size
- Keep functions warm with scheduled pings

Q: What are Lambda Layers?
A: Lambda Layers are ZIP archives containing libraries, custom runtimes, or other dependencies that can be shared across multiple functions. Benefits:
- Reduce deployment package size
- Promote code reuse across functions
- Separate dependencies from business logic
- A function can use up to 5 layers
Total unzipped size (function + layers) must be under 250 MB.

Q: What is AWS IAM?
A: AWS Identity and Access Management (IAM) controls who can access what in your AWS account. Core components:
- Users — Individual people or applications
- Groups — Collections of users with shared permissions
- Roles — Assumed by services, users, or external identities
- Policies — JSON documents defining allow/deny permissions
IAM is global (not region-specific) and free.

Q: What is an IAM Policy and what does it look like?
A: An IAM Policy is a JSON document that defines permissions. Structure:
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::my-bucket/*"
  }]
}
Policies can be identity-based (attached to users/groups/roles) or resource-based (attached to resources like S3 buckets).

Q: What is the Principle of Least Privilege in IAM?
A: The Principle of Least Privilege means granting only the minimum permissions required to perform a task. Best practices:
- Start with no permissions and add as needed
- Use IAM Access Analyzer to identify unused permissions
- Prefer managed policies over inline policies
- Enable MFA (Multi-Factor Authentication) for all human users
- Regularly review and rotate credentials

Q: What is an IAM Role and when would you use one?
A: An IAM Role is an identity with permissions that can be assumed by trusted entities — no permanent credentials. Use cases:
- EC2 instance roles — Let instances access AWS services securely
- Cross-account access — Allow users from another account
- Lambda execution roles — Grant Lambda permissions
- Federation — Allow external identity providers (SAML, OIDC)
Roles use temporary security credentials via STS.

Q: What is an Amazon VPC?
A: Amazon Virtual Private Cloud (VPC) is a logically isolated virtual network you define in AWS. You control:
- IP address range (CIDR block, e.g., 10.0.0.0/16)
- Subnets (public and private)
- Route tables for traffic direction
- Gateways for internet or VPN access
Each AWS account gets a default VPC in every Region. VPCs are Region-specific.

Q: What is the difference between a public and private subnet?
A: - Public subnet — Has a route to an Internet Gateway (IGW), allowing resources with public IPs to communicate directly with the internet
- Private subnet — No direct route to the internet; resources use a NAT Gateway in a public subnet for outbound-only internet access
Typically, web servers go in public subnets and databases in private subnets.

Q: What is the difference between a Security Group and a NACL?
A: Security Groups:
- Operate at the instance (ENI) level
- Stateful — return traffic auto-allowed
- Only allow rules
Network ACLs (NACLs):
- Operate at the subnet level
- Stateless — must explicitly allow return traffic
- Support both allow and deny rules
- Rules evaluated in number order
Use both for defense in depth.

Q: What is VPC Peering?
A: VPC Peering creates a networking connection between two VPCs enabling private IP communication as if they were on the same network. Key points:
- Can peer VPCs across different accounts or regions
- Not transitive — if VPC-A peers with VPC-B and VPC-B peers with VPC-C, A cannot reach C through B
- CIDR blocks must not overlap
- Route tables must be updated in both VPCs

Q: What is Amazon RDS?
A: Amazon Relational Database Service (RDS) is a managed service for relational databases. Supported engines:
- MySQL, PostgreSQL, MariaDB
- Oracle, SQL Server
- Amazon Aurora (MySQL/PostgreSQL compatible, up to 5x faster)
RDS handles provisioning, patching, backups, and replication, letting you focus on your application.

Q: What is RDS Multi-AZ deployment?
A: Multi-AZ deploys a synchronous standby replica in a different Availability Zone. Benefits:
- Automatic failover — if the primary fails, DNS flips to standby (60–120 seconds)
- High availability, not performance improvement
- Standby is not readable (unlike read replicas)
For read scaling, use Read Replicas instead, which use asynchronous replication and can be in different regions.

Q: What is AWS CloudFormation?
A: AWS CloudFormation is an Infrastructure as Code (IaC) service that lets you define AWS resources in JSON or YAML templates. Key concepts:
- Template — Describes the desired resources
- Stack — A running collection of resources from a template
- Change Set — Preview changes before applying
- Drift Detection — Identifies manual changes made outside CloudFormation

Q: What is Amazon DynamoDB?
A: Amazon DynamoDB is a fully managed NoSQL key-value and document database. Features:
- Single-digit millisecond performance at any scale
- Serverless — no servers to manage
- Supports on-demand and provisioned capacity modes
- Built-in encryption, backup, and global tables
Tables require a partition key (and optional sort key) for the primary key.

Q: What are DynamoDB Global and Local Secondary Indexes?
A: - Global Secondary Index (GSI) — An index with a different partition key and sort key from the base table. Can be created anytime. Has its own provisioned throughput.
- Local Secondary Index (LSI) — Same partition key as the base table but a different sort key. Must be created at table creation time. Shares throughput with the base table.
Both enable efficient queries on non-primary-key attributes.

Q: What is Amazon SQS?
A: Amazon Simple Queue Service (SQS) is a fully managed message queuing service for decoupling application components. Two queue types:
- Standard — Nearly unlimited throughput, at-least-once delivery, best-effort ordering
- FIFO — Exactly-once processing, strict ordering, up to 3,000 msg/sec with batching
Messages are retained for up to 14 days (default 4 days).

Q: What is a Dead Letter Queue (DLQ)?
A: A Dead Letter Queue is a special SQS queue that receives messages that failed processing after a configured number of attempts (maxReceiveCount). Benefits:
- Isolates problematic messages for debugging
- Prevents poison messages from blocking the main queue
- Allows analysis and reprocessing of failed messages
DLQs should match the source queue type (Standard with Standard, FIFO with FIFO).

Q: What is Amazon SNS?
A: Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service. Key concepts:
- Topic — A communication channel for messages
- Publisher — Sends messages to a topic
- Subscriber — Receives messages (email, SMS, HTTP, SQS, Lambda)
One message published to a topic is delivered to all subscribers (fan-out pattern). Supports message filtering to route specific messages to specific subscribers.

Q: What is Amazon CloudWatch?
A: Amazon CloudWatch is a monitoring and observability service. Core features:
- Metrics — Collect and track resource metrics (CPU, network, custom)
- Alarms — Trigger actions (SNS, Auto Scaling) when thresholds are breached
- Logs — Centralize and query log data from EC2, Lambda, etc.
- Dashboards — Visualize metrics in real-time graphs
CloudWatch enables proactive monitoring and automated incident response.

Q: What is Amazon Route 53?
A: Amazon Route 53 is a highly available DNS (Domain Name System) web service. It provides:
- Domain registration
- DNS routing — Translates domain names to IP addresses
- Health checks — Monitors endpoint availability
Named after port 53, the standard DNS port. Supports both public and private hosted zones.

Q: What are Route 53 routing policies?
A: - Simple — Maps a domain to a single resource
- Weighted — Distributes traffic by percentage across resources
- Latency-based — Routes to the lowest-latency region
- Failover — Routes to a standby if the primary is unhealthy
- Geolocation — Routes based on the user's geographic location
- Geoproximity — Routes based on resource location with bias
- Multivalue Answer — Returns multiple IPs with health checks

Q: What is Elastic Load Balancing (ELB)?
A: ELB automatically distributes incoming traffic across multiple targets. Three types:
- Application Load Balancer (ALB) — Layer 7 (HTTP/HTTPS), path/host-based routing, WebSocket support
- Network Load Balancer (NLB) — Layer 4 (TCP/UDP), ultra-low latency, millions of requests/sec
- Classic Load Balancer (CLB) — Legacy, Layer 4 and 7 (not recommended for new apps)

Q: What are ELB Target Groups?
A: A Target Group routes requests to registered targets using a specified protocol and port. Targets can be:
- EC2 instances
- IP addresses
- Lambda functions (ALB only)
- Other ALBs
Target groups perform health checks on targets and only route traffic to healthy ones. Each ALB listener rule forwards to a target group.

Q: What is EC2 Auto Scaling?
A: EC2 Auto Scaling automatically adjusts the number of EC2 instances to match demand. Components:
- Launch Template — Defines instance configuration (AMI, type, key pair, security groups)
- Auto Scaling Group (ASG) — Manages min, max, and desired capacity
- Scaling Policies — Rules that trigger scaling (target tracking, step, simple)
Ensures availability and cost optimization.

Q: What are Auto Scaling cooldown periods?
A: A cooldown period is a configurable time (default 300 seconds) after a scaling activity completes during which Auto Scaling does not launch or terminate additional instances. Purpose:
- Prevents rapid fluctuations (thrashing)
- Allows metrics to stabilize before the next scaling decision
- Can be set per scaling policy or as a default cooldown
Use shorter cooldowns for fast-changing workloads.

Q: What is AWS Elastic Beanstalk?
A: AWS Elastic Beanstalk is a PaaS that deploys and manages applications automatically. You upload your code and Beanstalk handles:
- Capacity provisioning (EC2, Auto Scaling)
- Load balancing (ELB)
- Health monitoring (CloudWatch)
- Patching and updates
Supports Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker. You retain full control over underlying resources.

Q: What is Amazon CloudFront?
A: Amazon CloudFront is a Content Delivery Network (CDN) that caches content at edge locations worldwide for low-latency delivery. Features:
- Caches static and dynamic content
- Integrates with S3, EC2, ALB, and custom origins
- HTTPS support with free SSL/TLS certificates (ACM)
- DDoS protection via AWS Shield
- Lambda@Edge for request/response customization

Q: What is Amazon ElastiCache?
A: Amazon ElastiCache is a managed in-memory caching service that improves application performance. Two engines:
- Redis — Rich data structures, persistence, replication, pub/sub, Lua scripting
- Memcached — Simple key-value caching, multi-threaded, no persistence
Common uses: session stores, database query caching, leaderboards, and real-time analytics. Reduces database load significantly.

Q: What is an Internet Gateway vs a NAT Gateway?
A: - Internet Gateway (IGW) — Attached to a VPC; allows resources in public subnets to communicate with the internet (both inbound and outbound). Horizontally scaled and highly available.
- NAT Gateway — Placed in a public subnet; allows resources in private subnets to initiate outbound-only internet connections (e.g., for software updates). Does not allow inbound connections from the internet.

Q: How do RDS automated backups differ from manual snapshots?
A: - Automated Backups — Enabled by default, retention 1–35 days, support point-in-time recovery (every 5 minutes), deleted when RDS instance is deleted
- Manual Snapshots — User-initiated, retained indefinitely until explicitly deleted, can be shared across accounts and copied across regions
Both create full snapshots of the DB instance stored in S3.

Q: What are DynamoDB capacity modes?
A: DynamoDB offers two capacity modes:
- On-Demand — Pay per request; automatically scales to handle any traffic level; ideal for unpredictable workloads
- Provisioned — You specify Read Capacity Units (RCU) and Write Capacity Units (WCU); more cost-effective for predictable workloads; supports Auto Scaling
You can switch between modes once every 24 hours.

Q: What is the AWS Well-Architected Framework?
A: AWS Well-Architected Framework describes key principles and questions to build secure, high-performing, resilient, and efficient cloud infrastructure. The six pillars are:
- Operational Excellence
- Security
- Reliability
- Performance Efficiency
- Cost Optimization
- Sustainability
AWS publishes the AWS Well-Architected Tool to review workloads against these pillars.

Q: What is the AWS Well-Architected Tool?
A: The AWS Well-Architected Tool is a free self-service console that helps you review workloads against the Well-Architected Framework. You answer questions for each pillar, mark risks (high/medium), and track improvements over time. Lenses (e.g., serverless, SaaS, financial services) extend the framework to specific domains.

Q: What is AWS Trusted Advisor?
A: AWS Trusted Advisor analyzes your AWS environment and provides real-time recommendations across five categories: Cost Optimization, Security, Fault Tolerance, Performance, and Service Limits. The full checks require Business or Enterprise support; Basic and Developer plans see only a subset of checks focused on security and service limits.

Q: What is AWS Organizations?
A: AWS Organizations lets you centrally manage multiple AWS accounts in a hierarchy of Organizational Units (OUs) rooted in a master account. Features include:
- Consolidated billing across all accounts
- Service Control Policies (SCPs) to set permission guardrails
- Group accounts by team, environment, or workload
It is the foundation for multi-account architectures.

Q: What are Service Control Policies (SCPs)?
A: SCPs are JSON policies in AWS Organizations that define the maximum permissions for accounts in an OU or the entire org. They are permission boundaries, not grants — an SCP denies actions by default if not allowed. SCPs do not affect service-linked roles and do not grant permissions; they only restrict what IAM entities can do.

Q: What is AWS Control Tower?
A: AWS Control Tower automates the setup of a secure, multi-account AWS environment based on best practices. It uses Account Factory to provision new accounts and applies guardrails (preventive and detective) for compliance. Built on AWS Organizations, IAM Identity Center, and CloudFormation StackSets.

Q: What is AWS IAM Identity Center (formerly AWS SSO)?
A: IAM Identity Center is the recommended way to manage human access to AWS accounts. It provides:
- Single sign-on to multiple accounts and applications
- Integration with identity sources (Active Directory, Okta, Google Workspace)
- Permission sets (collections of IAM policies) assignable to users/groups
It replaces per-account IAM users for everyday access.

Q: What is the difference between horizontal and vertical scaling?
A: - Horizontal scaling (scaling out/in) — Add or remove more instances (e.g., more EC2s, more Lambda concurrency). Common for stateless web tiers.
- Vertical scaling (scaling up/down) — Increase the size of a single instance (more CPU/RAM). Limited by hardware; usually requires downtime.
AWS prefers horizontal scaling because it is elastic and fault-tolerant.

Q: What is AWS WAF?
A: AWS WAF (Web Application Firewall) protects web applications from common exploits via rules you define. It can be attached to CloudFront, ALB, API Gateway, Cognito User Pools, and AppSync. Features:
- SQL injection and XSS protection via managed rule groups
- IP allow/block lists and rate-based rules
- Bots and bot control via Bot Control managed rules
Charged per request and per rule.

Q: What is AWS Shield?
A: AWS Shield is a managed DDoS protection service.
- Shield Standard — Free for all AWS customers; protects against common network and transport-layer DDoS attacks on CloudFront and Route 53.
- Shield Advanced — Paid ($3,000/month) tier with enhanced protection, real-time visibility, 24/7 DRT (DDoS Response Team) access, and cost protection for scaling charges during attacks.

Q: What is AWS KMS?
A: AWS Key Management Service (KMS) is a managed service to create and control encryption keys used to encrypt data. Features:
- Integrated with S3, EBS, RDS, DynamoDB, Lambda, SQS, and many more
- AWS-managed keys (free, automatic rotation) and customer-managed keys (CMKs) (full control)
- Auditable via CloudTrail
- FIPS 140-2 validated HSMs
KMS enforces envelope encryption at scale.

Q: What is envelope encryption?
A: Envelope encryption encrypts data with a data key, and then encrypts the data key with a KMS key (a key encryption key). The data key is stored alongside the encrypted data for performance; only the encrypted copy is protected by KMS. This pattern allows you to encrypt large payloads without hitting KMS API limits.

Q: What is AWS Secrets Manager?
A: AWS Secrets Manager stores, rotates, and retrieves secrets (DB credentials, API keys, OAuth tokens) at runtime. Features:
- Automatic rotation via Lambda for RDS, Redshift, DocumentDB
- Fine-grained IAM access and CloudTrail auditing
- Cross-region replication of secrets
Compared to SSM Parameter Store SecureString, Secrets Manager is purpose-built for secrets rotation and has higher cost per secret.

Q: What is AWS Systems Manager Parameter Store?
A: Parameter Store provides secure, hierarchical storage for configuration data and secrets. Two parameter tiers:
- Standard — Free, up to 10,000 parameters
- Advanced — $0.05/parameter/month, larger size, higher throughput
Use SecureString type with KMS to encrypt sensitive values. Integrated with ECS, Lambda, EC2 via aws ssm get-parameter.

Q: What is AWS CloudTrail?
A: AWS CloudTrail records API calls made in your AWS account as events. It is the foundation for governance, compliance, and operational auditing. Features:
- Captures who made the call, when, from where, and what was requested
- Events delivered to an S3 bucket and optionally a CloudWatch Logs group
- Enable multi-region trails and insights to detect unusual activity

Q: What is AWS Config?
A: AWS Config provides a detailed inventory of AWS resources and tracks configuration changes over time. It answers "What did my resource look like at time T?" Features:
- Records configuration history of resources
- Evaluates resources against Config Rules (desired state)
- Integrates with Security Hub and EventBridge
Useful for compliance auditing and change management.

Q: What is AWS Security Hub?
A: AWS Security Hub provides a single pane of glass for security alerts and compliance posture across AWS accounts. It aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, and third-party tools. It runs continuous, automated security checks against standards like CIS AWS Foundations Benchmark and PCI DSS.

Q: What is Amazon GuardDuty?
A: Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It analyzes CloudTrail, VPC Flow Logs, and DNS logs using machine learning and threat intelligence feeds. Findings are categorized as low/medium/high severity and integrated with Security Hub, EventBridge, and Lambda for automated response.

Q: What is Amazon Macie?
A: Amazon Macie is a data security and privacy service that uses machine learning to automatically discover, classify, and protect sensitive data in S3. It identifies PII, credentials, and financial data, surfaces findings in Security Hub, and produces dashboards of data privacy risks.

Q: What is AWS IAM Access Analyzer?
A: IAM Access Analyzer analyzes resource-based policies (S3, KMS, IAM, SQS, SNS, Lambda, etc.) to identify unintended public or cross-account access. It also generates least-privilege IAM policies from access activity in CloudTrail, and validates policies against JSON grammar and best practices.

Q: What is AWS Cost Explorer?
A: AWS Cost Explorer is a free tool to visualize, understand, and manage AWS costs and usage over time. Features:
- Filter by service, region, account, tag
- Forecast future spending with at least 12 months of history
- Pick hourly or daily granularity
- Build saved reports and RI/SP recommendations

Q: What are AWS Savings Plans?
A: Savings Plans are flexible pricing models offering up to 72% discount in exchange for a 1- or 3-year commitment to a consistent amount of compute usage (measured in $/hour). Three types:
- Compute Savings Plans — Apply to EC2, Fargate, Lambda regardless of region/family/tenancy
- EC2 Instance Savings Plans — Apply to a specific instance family in a region
- SageMaker Savings Plans — For SageMaker training and inference

Q: What are Reserved Instances?
A: Reserved Instances (RIs) provide a capacity reservation and up to 75% discount for EC2 and RDS in exchange for a 1- or 3-year term. Options:
- Standard RIs — Cheapest, but cannot be resold after exchange
- Convertible RIs — Can change instance family, OS, tenancy
- Regional vs Zonal — Zonal reserves capacity in a specific AZ
Savings Plans are generally more flexible for equivalent savings.

Q: What are Spot Instances?
A: Spot Instances let you use spare EC2 capacity at up to 90% off the On-Demand price. Risk: AWS can reclaim the instance with 2 minutes of notice. Best for:
- Fault-tolerant workloads (batch, image rendering, ML training)
- Workloads that can checkpoint
Use Spot Fleet to mix instance types and strategies, and EC2 Auto Scaling to substitute on-demand capacity when interrupted.

Q: What is the AWS Free Tier?
A: The AWS Free Tier lets new users explore services for free within limits for 12 months after account creation. It has three categories:
- Always Free — Lambda, DynamoDB, etc. up to monthly limits
- 12 Months Free — EC2 750 hrs/month, S3 5 GB, RDS 750 hrs, etc.
- Trials — Short-term free trials (e.g., Amazon SageMaker, Amazon Redshift)
You still need a credit card; overages are charged.

Q: What is AWS Support?
A: AWS Support plans:
- Basic — Free, account/billing only
- Developer — Business hours email for one primary contact
- Business — 24/7 phone/chat, full Trusted Advisor checks, < 1 hour response for production systems
- Enterprise — Adds 15-minute response, IEM, designated TAM, concierge support, infrastructure event management
There is no SLA on Developer plan; only Business and Enterprise.

Q: What is Amazon CloudWatch Logs?
A: CloudWatch Logs is the central log aggregation service in AWS. Features:
- Ingests logs from EC2, Lambda, ECS, Route 53, VPC Flow Logs, and on-prem
- Logs Insights to query and visualize log data
- Metric filters turn log patterns into CloudWatch metrics
- Subscription filters stream to Kinesis, Lambda, or OpenSearch
Logs are stored indefinitely unless you set a retention policy.

Q: What is Amazon CloudWatch Alarms?
A: A CloudWatch Alarm watches a single metric over a time period and performs one or more actions based on the value relative to a threshold. Three states: OK, ALARM, INSUFFICIENT_DATA. Actions can target SNS, Auto Scaling, EC2, Lambda, and many more. Composite alarms combine multiple alarms using AND/OR logic.

Q: What is CloudWatch Anomaly Detection?
A: Anomaly Detection applies machine learning models to a metric's past behavior to surface unusual activity. You create a band around expected values, and CloudWatch fires alarms when the metric crosses it. Reduces false positives from static thresholds for spiky or seasonal workloads.

Q: What is CloudWatch Logs Insights?
A: Logs Insights is an interactive query language for CloudWatch Logs. You write queries to search, filter, and aggregate log events (e.g., count errors, top IP addresses, average latency). Queries support functions, stats, parse, fields, sort, limit, and you can visualize results in a time-series chart.

Q: What are CloudWatch Metrics?
A: CloudWatch Metrics are time-ordered data points published to AWS. Sources include:
- AWS service metrics (free, 15-month retention)
- Custom metrics (PutMetricData API, charged per metric)
- Application metrics via the CloudWatch Agent or SDK
Standard resolution is 1-minute; detailed monitoring is 1-second for some services.

Q: What is Amazon EventBridge?
A: Amazon EventBridge is a serverless event bus that connects applications using events. Features:
- Built-in buses for AWS services, SaaS apps (Datadog, Zendesk), and custom apps
- Schema registry for event contracts
- Rules with content-based filtering, routing to Lambda, SQS, SNS, Step Functions, Kinesis
- Replaces and supersedes CloudWatch Events

Q: What is AWS Step Functions?
A: AWS Step Functions is a serverless workflow orchestrator for coordinating distributed components using state machines defined in Amazon States Language (ASL) JSON. Two workflow types:
- Standard — Long-running (up to 1 year), exactly-once execution, full history
- Express — Short-lived (up to 5 min), at-least-once, high throughput, lower cost
Useful for retries, parallelism, and human approvals.

Q: What is Amazon SQS vs SNS?
A: - SQS — Message queue; one consumer processes each message; pull-based; supports delayed messages and DLQs
- SNS — Pub/sub topic; fan-out to many subscribers; push-based; no message persistence
Combine them (SNS → SQS) for fan-out with persistence and per-consumer scaling.

Q: What is SQS Visibility Timeout?
A: The visibility timeout is the period during which SQS prevents other consumers from receiving a message that is currently being processed. Default: 30 seconds, max 12 hours. If the consumer fails to DeleteMessage within that window, SQS makes the message visible again. Set it to longer than the worst-case processing time to avoid duplicate processing.

Q: What is SQS Long Polling?
A: Long polling lets ReceiveMessage wait up to 20 seconds for messages to arrive instead of returning immediately. Benefits:
- Reduces empty responses and API cost
- Reduces latency of message delivery (messages appear as soon as they arrive)
Enable via WaitTimeSeconds at the queue level or per request.

Q: What is SQS Message Timer (DelaySeconds)?
A: DelaySeconds hides a message from consumers for up to 900 seconds (15 minutes) after it's added to the queue. Use cases: deferred tasks, scheduled retries, batch processing. For longer delays, use EventBridge Scheduler or place messages on a per-second basis in a FIFO queue with MessageGroupId.

Q: What is Amazon Kinesis Data Streams?
A: Kinesis Data Streams is a real-time, durable, ordered data streaming service. Producers write records to shards; consumers (Lambda, KCL apps) process them with sub-second latency. Features:
- Replay data up to 365 days with extended retention (default 24h)
- On-demand mode for variable throughput
- Provisioned mode: pay per shard
Common for analytics, log ingestion, clickstreams, IoT.

Q: What is Amazon Kinesis Data Firehose?
A: Kinesis Data Firehose is the easiest way to load streaming data into S3, Redshift, OpenSearch, or custom HTTP endpoints. It is fully managed (no shards, no consumers) and supports near real-time delivery (lowest ~60 seconds) with optional Lambda transformations. No replay capability — for that use Kinesis Data Streams.

Q: What is AWS Glue?
A: AWS Glue is a serverless data integration (ETL) service. Components include:
- Glue Data Catalog — Central metadata repository (Hive-compatible)
- Glue Crawlers — Auto-detect schemas from S3, RDS, DynamoDB
- Glue Jobs — Apache Spark (Python/Scala) ETL that scales automatically
- Glue Studio — Visual job builder
Common for analytics pipelines, data lakes, and discovery.

Q: What is Amazon Athena?
A: Amazon Athena is a serverless interactive query service that lets you run standard SQL directly against data in S3 (CSV, JSON, Parquet, ORC, Avro). It uses the Glue Data Catalog for table metadata. Pricing is $5 per TB scanned; partition data, use columnar formats (Parquet/ORC), and compress to cut cost.

Q: What is Amazon EMR?
A: Amazon EMR (Elastic MapReduce) is a managed big data platform that runs Apache Spark, Hadoop, Hive, Presto, Flink, and HBase on EC2 or EKS. It handles provisioning, configuration, and scaling of clusters. Use cases: large-scale ETL, machine learning, log analytics, genomics. EMR Serverless runs these frameworks without managing clusters.

Q: What is Amazon Redshift?
A: Amazon Redshift is a fast, fully managed cloud data warehouse using columnar storage and massively parallel processing (MPP). Features:
- RA3 nodes with managed storage and AQUA query accelerator
- Redshift Serverless — No cluster management; per-second billing
- Spectrum queries S3 without loading data
- Concurrency Scaling and Elastic Resize
Pricing: per-node (DC2/RA3) or RPU-second (Serverless).

Q: What is Amazon Kinesis Data Analytics?
A: Kinesis Data Analytics (now Managed Service for Apache Flink) runs real-time stream processing on Apache Flink without managing servers. You author SQL or Flink code that reads from Kinesis Data Streams or Firehose, transforms data, and writes to S3, OpenSearch, or another Kinesis stream. Useful for anomaly detection, dashboards, and stateful aggregations.

Q: What is AWS Lake Formation?
A: AWS Lake Formation is a service to build, secure, and manage a data lake in days. It centralizes data lake permissions (table- and column-level), discovers data with crawlers, and moves/transforms data into S3. Underlying storage is S3; metadata lives in the Glue Data Catalog.

Q: What is AWS Data Pipeline?
A: AWS Data Pipeline is a managed orchestration service for data-driven workflows. It schedules and runs ETL jobs and data movements between AWS services (S3, RDS, DynamoDB, EMR) and on-prem. Now legacy for new use cases — AWS Glue workflows or Step Functions are the modern replacements.

Q: What is Amazon QuickSight?
A: Amazon QuickSight is a serverless business intelligence (BI) service with pay-per-session pricing ($0.30/session after the free trial). Features:
- Build dashboards and interactive analyses with ML Insights (forecasting, anomaly detection, natural language Q&A)
- Connects to RDS, Aurora, Redshift, Athena, S3, and on-prem/JDBC
- Embed dashboards in applications
Targets SPICE in-memory engine for fast queries.

Q: What is Amazon OpenSearch Service?
A: Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) is a managed deployment of OpenSearch (and older Elasticsearch OSS). Use cases: full-text search, log analytics (ELK), and real-time application monitoring. It supports multi-AZ domains, fine-grained access control, and integrations with Kinesis Firehose, CloudWatch Logs, and IAM.

Q: What is Amazon CloudFront and how does it work?
A: CloudFront is a global CDN with 600+ Points of Presence (PoPs). Behavior:
- User requests are routed to the nearest edge via DNS and Anycast IPs
- Edges cache responses based on TTL and cache key (path, query string, headers, cookies)
- Cache misses forward to origin (S3, ALB, EC2, MediaStore, custom) and store the result
- Supports origin failover via origin groups

Q: What are CloudFront Cache Behaviors?
A: A cache behavior in a CloudFront distribution defines how a URL pattern is processed: which origin to use, which viewer protocol policy (HTTP/HTTPS), cache policy (TTL, key), origin request policy, and response headers policy. The default behavior applies to all requests not matched by another path pattern.

Q: What are CloudFront Signed URLs and Signed Cookies?
A: Signed URLs and signed cookies restrict access to private content:
- Signed URL — Single object/time-bound access URL using a trusted key group or AWS account
- Signed Cookies — Multiple objects, useful for HLS/DASH streaming
Use them to gate premium content, internal apps, or live streams. Signed URLs cannot be used with Lambda@Edge or CloudFront Functions.

Q: What is CloudFront Lambda@Edge?
A: Lambda@Edge lets you run Lambda functions at CloudFront edge locations in response to CloudFront events: viewer request, viewer response, origin request, and origin response. Use cases: A/B testing, header rewrites, cookie stripping, simple auth. Functions run in Node.js or Python with limited Lambda features.

Q: What are CloudFront Functions?
A: CloudFront Functions are lightweight, sub-millisecond JavaScript functions at the edge for viewer request/response events. They are cheaper and faster than Lambda@Edge but limited to JS only, no network calls, no third-party libraries. Best for URL rewrites, header manipulation, and cache key normalization.

Q: What is Origin Access Control (OAC) for S3?
A: Origin Access Control (OAC) is the modern way to lock down an S3 origin behind CloudFront. The bucket stays private, and the CloudFront service principal is granted read access via a bucket policy. OAC supports SSE-KMS, dynamic requests, and all regions — superseding the older OAI.

Q: What is Amazon Route 53 Health Checks?
A: Route 53 health checks monitor the health of endpoints (HTTP/HTTPS/TCP) from multiple global probes. You can attach them to records in failover or multivalue answer routing policies to remove unhealthy endpoints from DNS responses. CloudWatch alarms can be linked to health checks for application-level health.

Q: What is Amazon API Gateway?
A: Amazon API Gateway is a fully managed service to create, publish, maintain, monitor, and secure REST, HTTP, and WebSocket APIs. Two main flavors:
- REST API — Feature-rich (request validation, usage plans, API keys)
- HTTP API — Cheaper, lower latency, built on Lambda for serverless backends
Integrates with Lambda, ECS, EKS, ALB, and VPC links.

Q: What is API Gateway throttling?
A: Throttling protects backend systems from request floods. Default limits:
- Steady-state 10,000 RPS per account, per region
- Burst 5,000 RPS per account
- You can configure per-method rate and burst limits
Throttled requests return HTTP 429. For usage plans and API-key-based quotas, use REST API.

Q: What is AWS AppSync?
A: AWS AppSync is a managed GraphQL service that simplifies application development by providing a single endpoint to securely query/mutate data from multiple sources (DynamoDB, Aurora, Lambda, OpenSearch, HTTP). It supports real-time subscriptions via WebSockets, offline data sync, and caching with ElastiCache.

Q: What is Amazon Cognito?
A: Amazon Cognito provides authentication, authorization, and user management for web/mobile apps. Components:
- User Pools — User directories with sign-in, MFA, federation (SAML/OIDC)
- Identity Pools — Exchange user pool/IdP tokens for AWS credentials to access AWS services
Tokens are JWT (ID, access, refresh). Cognito can act as an OIDC IdP for API Gateway and ALB.

Q: What is AWS Amplify?
A: AWS Amplify is a set of tools and services to build full-stack web and mobile apps on AWS. Features:
- Amplify Studio — Visual UI builder for frontends and data models
- Amplify CLI — Configure backend resources (Auth, Storage, Functions, GraphQL)
- Amplify Hosting — Git-based CI/CD with CloudFront, branch previews, custom domains
Targets React, Vue, Angular, iOS, Android, Flutter.

Q: What is Amazon ECS?
A: Amazon Elastic Container Service (ECS) is a fully managed, highly scalable container orchestration service. Components:
- Task Definition — Blueprint for containers (image, CPU/memory, env)
- Service — Maintains N running tasks; integrates with ALB
- Cluster — Logical grouping of tasks/services
- Launch type — EC2 instances you manage, or Fargate (serverless)

Q: What is Amazon EKS?
A: Amazon Elastic Kubernetes Service (EKS) is a managed Kubernetes service. AWS runs the control plane across multiple AZs and you manage worker nodes (EC2, Fargate, or on-prem via Outposts). Features: EKS Add-ons, EKS Anywhere for on-prem, EKS Connector for hybrid visibility. Compatible with standard Kubernetes tooling.

Q: What is AWS Fargate?
A: AWS Fargate is a serverless compute engine for containers that works with ECS and EKS. You define task/pod CPU and memory; Fargate provisions and scales the infrastructure. No EC2 instances to manage, no patching, no over-provisioning. Charged per vCPU/GB-hour consumed.

Q: What is Amazon ECR?
A: Amazon Elastic Container Registry (ECR) is a fully managed Docker container registry. It hosts OCI images, integrates with IAM for access control, supports image scanning for CVEs (Basic on push, Enhanced continuous), and uses KMS to encrypt images at rest. Repositories can be private or public (Amazon ECR Public Gallery).

Q: What is AWS Cloud Development Kit (CDK)?
A: AWS CDK is an open-source framework to define cloud resources using familiar programming languages (TypeScript, Python, Java, Go, .NET). CDK synthesizes your code into CloudFormation templates and deploys via cdk deploy. You author constructs (reusable cloud components) and share them as libraries.

Q: What is AWS SAM?
A: AWS Serverless Application Model (SAM) is an open-source framework for building serverless applications. It extends CloudFormation with simplified syntax for Lambda functions, API Gateway, DynamoDB, SQS, and Step Functions. The sam local command runs Lambda/APIs locally in Docker for testing. SAM CLI also powers sam build, sam deploy, and sam pipeline.

Q: What is AWS CodeCommit?
A: AWS CodeCommit is a managed, private Git repository service. It supports standard Git workflows, integrates with IAM for auth, CodePipeline, and pull requests. Note: AWS announced that CodeCommit is being closed to new customers — most teams now use GitHub, GitLab, or CodeCatalyst instead.

Q: What is AWS CodeBuild?
A: AWS CodeBuild is a fully managed continuous integration service that compiles, tests, and packages code. You define a buildspec.yml with commands and phases, and CodeBuild runs them in ephemeral Docker containers. Pay per build minute; supports local caching and batch builds.

Q: What is AWS CodeDeploy?
A: AWS CodeDeploy automates application deployments to EC2, ECS, Lambda, and on-prem servers. Strategies:
- In-place — Replace on the same instance (EC2/on-prem)
- Blue/Green — New instances; traffic is shifted via ALB/Route 53; fast rollback
Integrates with Auto Scaling for Lambda hooks via traffic shifting (Canary/Linear/All-at-once).

Q: What is AWS CodePipeline?
A: AWS CodePipeline is a fully managed continuous delivery service that orchestrates the steps to release software: source → build → test → deploy. It uses stages and actions, supports manual approvals, parallel execution, and triggers from CodeCommit, S3, ECR, GitHub, or Bitbucket.

Q: What is Amazon CloudWatch Synthetics?
A: CloudWatch Synthetics runs canaries — configurable scripts that follow user paths in your application to monitor endpoints, APIs, and links 24/7. They check availability and latency, capture screenshots, and store logs in CloudWatch Logs. Common use: detect broken pages before users do.

Q: What is AWS X-Ray?
A: AWS X-Ray provides distributed tracing across your application. It captures requests as they travel through services (Lambda, ECS, EC2, API Gateway, DynamoDB), shows a service map of dependencies, and surfaces latency/segmentation. Use the X-Ray SDK or AWS Distro for OpenTelemetry to instrument apps.

Q: What is AWS Distro for OpenTelemetry?
A: AWS Distro for OpenTelemetry (ADOT) is a secure, AWS-supported distribution of the OpenTelemetry project. It provides auto-instrumentation agents for Java, Python, .NET, and Go that collect traces/metrics/logs and export to CloudWatch, X-Ray, or any OTLP backend.

Q: What is Amazon Managed Service for Prometheus?
A: Amazon Managed Service for Prometheus (AMP) is a serverless, Prometheus-compatible metrics monitoring service. It is integrated with ADOT, EKS, ECS, and EC2 for scraping Prometheus exporters, and dashboards via Amazon Managed Grafana. Removes the operational burden of running a Prometheus server.

Q: What is Amazon Managed Grafana?
A: Amazon Managed Grafana is a fully managed, secure Grafana service for visualizing metrics, logs, and traces from CloudWatch, Prometheus, X-Ray, and many data sources. Built-in SSO via IAM Identity Center, Okta, or Auth0; fine-grained access controls; supports alerting and dashboards.

Q: What is AWS Service Catalog?
A: AWS Service Catalog lets organizations centrally manage and govern approved IT services as products (CloudFormation templates). End users (often in separate accounts) can self-service launch the products into their accounts within guardrails set by launch constraints (IAM roles).

Q: What is AWS Proton?
A: AWS Proton is a managed deployment service for platform engineers. Teams define environment and service templates (CloudFormation or Terraform) for container and serverless apps; developers self-serve versioned, templated infrastructure. Reduces the time developers spend on infrastructure choices.

Q: What is AWS App Runner?
A: AWS App Runner is a fully managed service to deploy containerized web apps and APIs from a container image or source code, with automatic scaling, load balancing, and TLS certificates. No infrastructure to manage. Best for simple web services, APIs, and backends without complex networking.

Q: What is Amazon Lightsail?
A: Amazon Lightsail is a beginner-friendly, low-cost VPS-style service with predictable monthly pricing. It bundles compute, storage, networking, and a static IP (often under $5/month). Best for small sites, dev/test, and learning. You can peer Lightsail with your VPC for advanced networking.

Q: What is AWS Outposts?
A: AWS Outposts is a fully managed hybrid solution that brings native AWS hardware and services to your on-premises data center. Outposts racks run EC2, EBS, S3, RDS, ECS, EKS using the same APIs and tools as in-region. Use cases: low-latency to on-prem systems, data residency, regulated industries.

Q: What is AWS Local Zones?
A: AWS Local Zones place AWS compute, storage, and database services closer to large population centers where there is no AWS Region. They extend the VPC from a parent region and run EC2, EBS, FSx, ALB, and more. Useful for sub-10 ms latency workloads (gaming, media, ML inference).

Q: What are AWS Wavelength?
A: AWS Wavelength embeds AWS compute and storage at 5G telecom provider edge locations to deliver single-digit millisecond latency to mobile devices. Targets 5G applications like AR/VR, IoT, real-time gaming, and smart factories. Wavelength Zones are tied to a parent Region.

Q: What is AWS Batch?
A: AWS Batch dynamically provisions compute resources (EC2, Spot, Fargate) to run batch computing workloads in Docker containers. You submit jobs with priority and resource requirements; Batch queues them and schedules across an optimal mix of instance types. No manual cluster management.

Q: What is Amazon SageMaker?
A: Amazon SageMaker is a fully managed machine learning platform covering the entire ML lifecycle: labeling, data prep, training (built-in algorithms, BYO framework, JumpStart), tuning, deployment, and monitoring. Studio is the integrated IDE. Inference can run real-time, async, batch, or serverless.

Q: What is Amazon Rekognition?
A: Amazon Rekognition is a managed image and video analysis service. Capabilities include: object/scene/text detection, face analysis and comparison, face liveness, celebrity recognition, unsafe content moderation, and PPE detection. Charges per image or per minute of video analyzed.

Q: What is Amazon Comprehend?
A: Amazon Comprehend is a natural language processing (NLP) service that uses ML to find insights in text. Features: sentiment, entities, key phrases, language, syntax, topic modeling, custom entity recognition, and Comprehend Medical for clinical text. Returns structured data via API.

Q: What is Amazon Translate?
A: Amazon Translate is a neural machine translation service that delivers real-time language translation. Supports dozens of languages, custom terminology, formality, and profanity masking. Useful for localization, customer support, content moderation. Charged per character translated.

Q: What is Amazon Polly?
A: Amazon Polly is a text-to-speech (TTS) service that turns text into lifelike speech. Supports many languages and voices, Neural TTS for higher quality, Speech Synthesis Markup Language (SSML), and lexicons for custom pronunciation. Output formats include MP3, OGG, PCM.

Q: What is Amazon Lex?
A: Amazon Lex is a service for building conversational interfaces (chatbots and voice bots) using the same technology as Alexa. Supports automatic speech recognition (ASR) and natural language understanding (NLU). Integrates with Lambda for fulfillment, Cognito for auth, and many messaging channels via Connect.

Q: What is Amazon Transcribe?
A: Amazon Transcribe is an automatic speech recognition (ASR) service that converts audio to text. Supports real-time and batch transcription, speaker identification, custom vocabulary, language identification, and Transcribe Medical for clinical conversations. Returns timestamped JSON output.

Q: What is Amazon Textract?
A: Amazon Textract extracts printed text, handwriting, and structured data (tables, form fields) from documents and images. Goes beyond OCR by returning key-value pairs and tables with spatial context. Expense and ID document analysis is available as pre-trained APIs.

Q: What is AWS IoT Core?
A: AWS IoT Core is a managed cloud service to connect, manage, and interact with billions of IoT devices. Features: Device Gateway (MQTT/HTTPS), Message Broker, Device Shadow (virtual state), Rules Engine (route to Lambda/Kinesis/SNS), and Device Defender for security monitoring.

Q: What is AWS Greengrass?
A: AWS IoT Greengrass extends AWS to edge devices. It runs Lambda functions, Docker containers, and messaging on local hardware with offline operation. Devices sync with the cloud via Greengrass Core, supporting ML inference at the edge using models deployed from the cloud.

Q: What is AWS Batch vs Lambda?
A: - Lambda — Event-driven, short-lived (≤15 min), pay per ms, scales to thousands. Best for stateless, spiky work.
- Batch — Long-running, containerized batch jobs with queueing and priority. Best for scheduled, large-scale, multi-step workloads that need more than 15 min or specific hardware (e.g., GPU).
Use Step Functions to orchestrate both.

Q: What are AWS SDKs?
A: The AWS SDKs provide language-specific APIs (Node.js, Python/boto3, Java, Go, .NET, Ruby, PHP, C++) to interact with AWS services. They handle request signing, retries, pagination, and credential providers (IAM role, env, profile). The AWS CLI wraps the same APIs for shell scripting.

Q: What is AWS CDK vs CloudFormation?
A: - CloudFormation — Declarative JSON/YAML templates. Direct mapping to AWS resources. Verbose but standard.
- CDK — Imperative code in TypeScript/Python/Go that synthesizes to CloudFormation. Reusable constructs, type safety, loops/conditionals.
Both have the same capabilities; CDK is preferred for complex apps with logic. Terraform is the popular third-party alternative.

Q: What is Lambda's maximum deployment package size?
A: Lambda deployment package limits:
- Direct upload (.zip) — 50 MB compressed, 250 MB uncompressed (function + layers)
- S3 upload (.zip) — 250 MB compressed, 250 MB uncompressed
- Container image — 10 GB max image size
Layers count toward the unzipped size; total function size includes all layers and custom runtimes.

Q: What is Lambda's default and maximum execution timeout?
A: - Default timeout — 3 seconds
- Maximum timeout — 900 seconds (15 minutes)
- Minimum timeout — 1 second
For longer workflows use Step Functions, ECS, or Batch.

Q: What is Lambda's concurrency limit?
A: Each AWS Region has a default 1,000 concurrent executions account-level limit for Lambda. You can:
- Request a quota increase from AWS
- Configure Reserved Concurrency to cap a function's concurrency (throttles at the limit)
- Use Provisioned Concurrency to pre-warm environments for low latency
Throttled invocations receive an async retry with backoff or, for sync sources, a 429 error.

Q: What is Lambda's /tmp storage limit?
A: Lambda functions get 512 MB of ephemeral disk space at /tmp. The space is not shared with other invocations on the same environment but persists across invocations while the execution environment is warm. Useful for caching, scratch work, or large data extraction. Mounted with full POSIX file semantics.

Q: What is the difference between Lambda env vars and parameters?
A: - Environment variables — Key-value pairs defined on the function configuration; encrypted at rest with KMS; mutable via UpdateFunctionConfiguration; size limit 4 KB total.
- SSM Parameter Store / Secrets Manager — Centralized, audited, rotatable; retrieved at cold start; SecureString parameters encrypted with KMS.
Prefer Secrets Manager or Parameter Store for secrets and rotation; env vars for non-sensitive config.

Q: What is the VPC Cold Start penalty in Lambda?
A: When a Lambda function is connected to a VPC, AWS automatically attaches an ENI (Elastic Network Interface) to access VPC resources. This is called VPC cold start and adds several seconds of latency. Mitigation:
- Use shared ENIs (Hyperplane) — automatically enabled for many services
- Pre-warm with Provisioned Concurrency
- Avoid VPC for services reachable over public endpoints

Q: What is Lambda's IAM execution role?
A: Every Lambda function has an execution role — an IAM role that grants the function permissions to access AWS services and resources. The basic trust policy allows the Lambda service to sts:AssumeRole. Common permissions: CloudWatch Logs (always), X-Ray, and service-specific (e.g., S3 read, DynamoDB write).

Q: What is S3 Object Lock?
A: Object Lock prevents an object from being deleted or overwritten for a fixed period or indefinitely. Two retention modes:
- Governance mode — Protected, but users with special IAM permissions can overwrite/delete
- Compliance mode — Cannot be deleted or overwritten by anyone, including root, until the retention period expires
Requires versioning; enables WORM (write once, read many) for regulatory archives.

Q: What is S3 Replication?
A: S3 Replication automatically copies objects across buckets, often across regions (CRR) or within the same region (SRR). Use cases: disaster recovery, low-latency access, compliance, and data sovereignty. Requires versioning on both buckets. Replicates new objects by default; S3 Batch Replication backfills existing objects.

Q: What is S3 Transfer Acceleration?
A: S3 Transfer Acceleration uses CloudFront edge locations to speed up long-distance uploads to S3. Clients upload to a nearby edge over the public internet, and AWS uses the AWS backbone to deliver the data to the destination bucket. Helpful for global users uploading large files. Charged per GB accelerated.

Q: What is S3 Multipart Upload?
A: Multipart Upload lets you upload a single object as a set of parts (each between 5 MB and 5 GB, last part can be smaller; up to 10,000 parts). Benefits:
- Parallelize uploads for speed
- Resume from failed parts without restarting
- Recommended for objects larger than 100 MB
Initiate with CreateMultipartUpload, upload parts, then CompleteMultipartUpload.

Q: What is an S3 Pre-signed URL?
A: A pre-signed URL is a signed S3 URL that grants temporary, time-limited access (default 15 min, max 7 days) to a private object. Generated with the AWS SDK using your IAM credentials. Use cases: share private files, allow direct browser upload, distribute content without making the bucket public. You can scope to GET, PUT, or any verb.

Q: What are S3 Event Notifications?
A: S3 Event Notifications fire when a bucket event occurs (object created, deleted, restored, reduced redundancy, etc.). Destinations include SQS, SNS, and Lambda. Events are delivered at least once — consumers must be idempotent. Combine with EventBridge for advanced filtering and multi-account delivery.

Q: What is S3 Storage Lens?
A: S3 Storage Lens provides organization-wide visibility into object-storage usage and activity trends. It delivers 30+ metrics (e.g., storage bytes, request count, encryption status) via an interactive dashboard, with daily exports to S3. Free default metrics; advanced metrics and recommendations are paid.

Q: What is S3 Select and S3 Glacier Select?
A: S3 Select lets you run simple SQL expressions to filter and retrieve a subset of data from an S3 object (CSV, JSON, Parquet) without downloading the whole object. S3 Glacier Select does the same against objects stored in Glacier. Reduces data transfer and processing cost.

Q: What is AWS Direct Connect?
A: AWS Direct Connect (DX) is a dedicated private network connection from your on-premises data center to AWS. Benefits: consistent network performance, reduced bandwidth costs, and lower latency than internet. Speeds from 1 Gbps to 100 Gbps. Used with Direct Connect Gateway to reach any region.

Q: What is a Site-to-Site VPN?
A: AWS Site-to-Site VPN creates an encrypted IPsec tunnels over the public internet between your on-prem network and your AWS VPC. Two tunnels per connection for redundancy. Often paired with Direct Connect as a backup. Transit Gateway simplifies multi-VPC and multi-account VPN topologies.

Q: What is AWS Transit Gateway?
A: Transit Gateway (TGW) is a central hub that connects VPCs, VPNs, and Direct Connect through a single gateway, replacing complex VPC peering meshes. It supports transit routing, peering between Transit Gateways (inter-region), and shared services VPCs. Scales to 5,000 attachments per TGW.

Q: What is AWS PrivateLink?
A: AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-prem networks over the AWS backbone — no internet traversal. You create an Interface VPC endpoint with ENIs in your subnets and consume the service privately. Used for SaaS, marketplace services, and cross-account access.

Q: What is AWS Client VPN?
A: AWS Client VPN is a managed client-based VPN that lets remote users securely access AWS and on-prem resources using OpenVPN-based clients. It scales automatically and integrates with mutual TLS or SAML-based SSO. Useful for remote workforces needing private access to internal apps.

Q: What is a VPC Endpoint?
A: A VPC Endpoint connects your VPC privately to supported AWS services without going through the public internet. Two types:
- Gateway endpoint — S3 and DynamoDB only; route-table entry; free
- Interface endpoint — Most services; PrivateLink ENI; per-hour + per-GB pricing
Endpoints improve security (private IPs) and can reduce NAT costs.

Q: What is Amazon EFS?
A: Amazon Elastic File System (EFS) is a managed, shared, elastic NFS file system for Linux. Features:
- Scales to petabytes; you pay only for what you use
- Mount from thousands of EC2, ECS, Lambda, and on-prem via Direct Connect
- Standard and Infrequent Access (IA) storage classes with lifecycle management
- Multi-AZ regional or One Zone option

Q: What is Amazon FSx?
A: Amazon FSx offers fully managed third-party file systems:
- FSx for Windows File Server — SMB, NTFS, AD-integrated
- FSx for Lustre — High-performance HPC, integrates with S3
- FSx for NetApp ONTAP — Enterprise NFS/SMB with ONTAP features
- FSx for OpenZFS — NFS with snapshots and cloning
Choose EFS for Linux-native, FSx for specific protocols or performance.

Q: What is AWS Storage Gateway?
A: AWS Storage Gateway is a hybrid storage service that connects on-prem software appliances to AWS cloud storage. Three types:
- File Gateway — NFS/SMB files backed by S3
- Volume Gateway — iSCSI block storage with EBS snapshots
- Tape Gateway — Virtual tape library for backups, backed by S3 Glacier
Use cases: backup, archive, and tiered storage for on-prem workloads.