overview aws topics

index2.md

Here’s your AWS Developer Associate Study Guide (Markdown format) — written like a clean, shareable internal doc or Notion page, with exam-focused callouts.

---

📘 AWS Developer Associate Study Guide

---

🔐 1. IAM & Long-Term Credentials

🧠 Core Concepts

IAM User Access Keys (Programmatic Access)

• Used by applications to call AWS APIs via:

  • AWS SDKs
  • CLI

• Consists of:

  • Access Key ID
  • Secret Access Key

IAM Roles

• Provide temporary credentials (via STS)
• No long-term secrets stored
• Automatically rotated by AWS

---

⚙️ App-Based Access (Your Use Case)

Typical Setup (Less Ideal)

App → IAM User → Access Keys → AWS Services

• Often combined with:

  • IAM Groups (shared permissions)

• Keys stored in:

  • .env
  • config files
  • CI/CD secrets

---

Recommended Setup (Best Practice)

App → IAM Role → Temporary Credentials → AWS Services

Examples:

• EC2 Instance Role
• ECS Task Role
• Lambda Execution Role

---

🔄 Key Rotation

Manual Rotation

• Human-driven (rotate every 90 days)

• Risk:

  • Forgotten keys
  • Downtime during rotation

Automated Rotation

• Via:

  • Secrets Manager
  • IAM Access Analyzer + scripts

---

⚠️ EXAM WATCH OUT

• Access Keys = long-term credentials → NOT recommended

• Roles = preferred (temporary, auto-rotated)

• If question mentions:

  • “application running on AWS” → USE IAM ROLE
  • “external system” → access keys may still be used

---

🔐 Least Privilege Principle

• Grant only required permissions

• Avoid:

  "Action": "*",
  "Resource": "*"

Example (Good)

{
  "Effect": "Allow",
  "Action": ["s3:GetObject"],
  "Resource": "arn:aws:s3:::my-bucket/*"
}

---

⚠️ EXAM WATCH OUT

• Overly broad permissions = common wrong answer
• Always pick: 👉 “minimum permissions required”

---

🪣 2. Amazon S3 Fundamentals

---

📌 Consistency Model

• Strong Read-After-Write (NEW objects)
• Eventual consistency (overwrites & deletes)

---

⚠️ EXAM WATCH OUT

• New object → immediately readable ✅
• Update/delete → may take time ❗

---

🔐 Bucket Policy vs ACL

Feature	Bucket Policy	ACL
Scope	Bucket/Object	Object
Language	JSON (IAM style)	Simple
Flexibility	High	Low
Recommended	✅ Yes	❌ Legacy

---

⚠️ EXAM WATCH OUT

• AWS prefers: 👉 Bucket Policies over ACLs
• ACLs = legacy / limited control

---

📦 Multipart Upload

• Required for: 👉 Files > 5GB

Benefits:

• Parallel uploads
• Resume failed uploads
• Improved performance

---

⚠️ EXAM WATCH OUT

• File > 5GB → MUST use multipart
• Can use for smaller files too (optimization)

---

🚀 S3 Transfer Acceleration

• Uses CloudFront edge locations
• Speeds up uploads over long distances

---

⚠️ EXAM WATCH OUT

• Best for: 👉 global users uploading to a single bucket

• Uses:

  bucket.s3-accelerate.amazonaws.com
  

---

🐳 3. Amazon ECS (Docker on AWS)

---

🧱 Core Components

1. Task Definition

• Blueprint for containers

• Includes:

  • Docker image
  • CPU/memory
  • IAM roles

---

2. Task

• Running instance of a Task Definition

---

3. Service

• Keeps tasks running

• Handles:

  • Scaling
  • Load balancing
  • Auto-recovery

---

4. Cluster

• Logical group of compute resources

---

🚀 Launch Types

Fargate

• Serverless containers
• No EC2 management

EC2

• You manage instances
• More control

---

📊 Fargate vs EC2

Feature	Fargate	EC2
Server management	❌ None	✅ Required
Scaling	Automatic	Manual/ASG
Cost	Higher	Lower (optimized)
Control	Low	High
Use case	Simple, fast deploy	Custom infra

---

⚠️ EXAM WATCH OUT

• “No server management” → FARGATE
• “Need full control / custom AMI” → EC2

---

🔐 Task Role vs Task Execution Role

Task Role

• Used by application inside container
• Access AWS services (S3, DynamoDB)

“What my app can do” (Medium)

---

Task Execution Role

• Used by ECS service/agent

• Handles:

  • Pulling images (ECR)
  • Writing logs (CloudWatch)

“What ECS needs to run the container” (AWS Documentation)

---

⚠️ EXAM WATCH OUT

• App accessing S3 → Task Role
• Pulling Docker image → Execution Role
• NEVER put app permissions in execution role

---

🧠 Final Mental Model

---

IAM

• Prefer roles over access keys
• Use least privilege

---

S3

• Strong consistency (new objects)
• Multipart for large files
• Bucket policy > ACL

---

ECS

• Task = container permissions
• Execution role = infrastructure permissions
• Fargate = serverless

---

🚀 Quick Exam Strategy

• If question says:

  • “secure” → roles + least privilege
  • “scalable uploads globally” → transfer acceleration
  • “container needs AWS access” → task role
  • “no server management” → Fargate