Trigger Words
90% soalan SAA-C03 berlegar pada satu trigger word. Nampak keyword → tembak service → buang perangkap. Disusun ikut domain exam (D1–D4) — tap mana-mana row untuk Deep Notes.
48 triggers · 4 domain · 2 decision tree · 13 corak · 29 perangkap
D1 · Secure
10monitor OU hierarchy changes · alert account governance drift · SCP removed notification · account moved out of OU
Control Tower auto-detect drift dari landing-zone baseline → publish ke SNS. BUKAN StackSets drift (itu drift template infra) dan BUKAN raw Config.
cert validation pending · auto-renew SSL · ACM stuck · certificate renewal
DNS validation = ACM auto-renew selamanya (selagi CNAME wujud). Email validation = manual, senang tersangkut.
cross-account send to SQS/S3 · cross-account KMS decrypt · other accounts access · set IAM + bucket/queue/key policy
Cross-account = DUA kunci: IAM policy belah source (bagi user/app keluar) AND resource-based policy belah destination (bucket/queue/key policy sebut Principal). Set satu belah je → Access Denied. Member account → IAM + SCP.
consolidated billing · centralized management many accounts · one bill for all accounts · volume discount across accounts
Satu payer (Management acct) untuk semua → consolidated billing + volume discount + central guardrail. Kelola banyak account dari satu tempat.
restrict org-wide · block region/service for all accounts · prevent even root/admin · guardrail across accounts
SCP = siling maksimum (SEKAT, bukan BAGI) atas OU/account. Apply kat Management acct utk had semua member — even root member tak boleh lepas. TAK apply ke management acct sendiri.
automated landing zone · set up multi-account baseline / governance at scale · provision many accounts self-service · pre-built guardrails + drift detection
Automated landing zone + Account Factory + pre-built guardrails + drift detection DI ATAS Organizations. Organizations = building block manual; Control Tower = setup laju & konsisten.
ensure resources stay compliant · config drift / configuration history · enforce encryption/tagging + auto-fix violations · what changed on this resource & when
Rekod config STATE resource over time + Config Rules semak compliant/non-compliant + auto-remediation (SSM). "WHO call API" tu CloudTrail; Config = "WHAT state + comply ke tak".
transparent inspection semua trafik · 3rd-party firewall / IDS / IPS inline · centralized inspection untuk banyak VPC · GENEVE port 6081 · salur trafik ke virtual appliance · bump-in-the-wire
GWLB = Layer 3, dengar SEMUA IP packet, salur ke fleet virtual appliance (firewall/IDS/IPS) secara transparent guna GENEVE port 6081. Pasangan GWLBe (next hop dalam route table) sambung spoke VPC ↔ security VPC via PrivateLink. Flow stickiness (5/3/2-tuple) pastikan stateful firewall nampak dua hala. BUKAN NLB (L4 connection je) atau appliance per-VPC (tak scale). Keyword "transparent + 3rd-party firewall + GENEVE 6081 + centralized" → GWLB.
retain indefinitely, no expiration · no user can delete forever · immutable compliance policy Glacier · block delete without time limit · compliance hold on archive
"indefinitely" (tiada tempoh tamat) → Legal Hold (apply serta-merta, halang delete selamanya). "fixed duration" → retention period (BUKAN indefinite). Compliance ketat → Vault LOCK policy (immutable lepas lock), BUKAN Vault ACCESS policy (mutable, boleh ubah).
RDS instance not encrypted · encrypt existing unencrypted RDS · add encryption to running DB · security audit RDS unencrypted · encrypt Read Replica · KMS key for RDS
RDS encryption-at-rest cuma boleh set masa CREATE instance — butang "turn on encryption" pada existing RDS TAK WUJUD. Encrypt existing unencrypted: (1) snapshot, (2) COPY snapshot + tick Enable Encryption (pilih KMS key: aws/rds managed atau CMK), (3) restore NEW encrypted instance, (4) update app endpoint, (5) buang lama. Read Replica WARISI source — primary unencrypted → replica unencrypted (same-region), jadi buang RR lama, create RR baru dari encrypted primary (auto encrypted). Konsep sama macam encrypt EBS volume.
D2 · Resilient
14Lambda throttling 429 · downstream overwhelmed · spiky traffic decouple · smooth out burst to Lambda · acknowledge when accepted · API Gateway Aurora persist · split Lambda SQS
SQS depan Lambda serap burst + retry; Lambda poll ikut kadar sendiri. SNS push terus → tak buffer, masih throttle.
EKS route by URL path · L7 HTTP routing for pods · Kubernetes Ingress least effort · expose EKS service to internet
Ingress → ALB (L7 path/host routing) auto-provisioned. NLB = L4 je; NGINX Ingress = self-managed (lagi banyak kerja).
too many connections · connection pooling · Lambda spam RDS · idle connections
Pool & reuse DB connections so a burst of Lambdas tak banjirkan RDS sampai "too many connections".
simpan file jangan hilang · async upload · burst traffic · durable file store
S3 = simpan FILE sebenar (11 nines, murah). SQS depan = serap burst & decouple supaya upload tak hilang.
fault-tolerant + lowest cost · handle 500% spike cheaply · survive interruption
On-Demand baseline (jamin minimum) + Spot (murah untuk lebihan). Bukan Spot 100% — semua boleh kena reclaim serentak.
mesej gagal berulang blok queue · corrupted / poison message · isolate & debug messages
Lepas gagal N kali (maxReceiveCount), SQS auto-pindah ke DLQ → queue utama jalan, developer bedah asingan.
order must be preserved · no duplicate processing · exactly-once
FIFO = strict order (per MessageGroupId) + exactly-once dedup. Standard = best-effort order + at-least-once.
intermittent / spiky workload · unpredictable traffic · dev / test database · don't pay when idle · auto-scale capacity · new app unknown load · MySQL-compatible on-prem replace · memory 2-16 GiB · ACU min max · Site-to-Site VPN database migrate
Beban naik-turun / tak boleh teka / dev-test / nak jimat masa idle → Aurora Serverless auto-scale capacity (ACU) ikut load, bayar ikut guna. BUKAN Aurora provisioned (kena set instance size tetap = bazir bila idle).
managed relational database · MySQL / PostgreSQL / MariaDB managed · Oracle / SQL Server on AWS · lift-and-shift commercial DB · bring your own license (BYOL) · which RDS engine
RDS support 6 engine: MySQL, PostgreSQL, MariaDB (open-source) · Oracle, SQL Server (commercial, kena license/BYOL) · Aurora (AWS-native, paling laju & HA). Soalan sebut Oracle/SQL Server → RDS (Aurora TAK support dua tu).
5xx / 502 error masa scale-in · dropped connection bila Spot ditutup · graceful shutdown behind ALB · finish in-flight requests before terminate · connection draining
Bila target di-deregister (scale-in / Spot rampas / deploy), ALB stop trafik BARU tapi biar request sedia ada habis dulu (default 300s) → elak error 5xx. "Connection Draining" = nama lama pada CLB. Combo: ALB + ASG Mixed Instances (On-Demand + Spot) + deregistration delay. BUKAN tukar semua ke On-Demand.
jangan hantar trafik ke EC2 crash · auto-detect unhealthy instance · stop routing to failed server · how does ELB avoid dead backend · remove unhealthy target from rotation
ELB ketuk setiap target ikut interval; pulang 200 OK = Healthy (hantar trafik), gagal threshold (cth 500/timeout) = Unhealthy → ELB STOP hantar trafik ke situ sampai sihat balik. Ini asas HA — auto-buang server rosak dari rotation. ASG patut guna ELB health check (bukan EC2 je) supaya app-level hang pun dikira unhealthy.
AWS primary + on-prem secondary failover · DR active-passive via Route 53 · failover alias record · Evaluate Target Health for ALB · health check for on-prem endpoint
Active-passive failover perlu DUA record berasingan. AWS resource (ALB) → Evaluate Target Health = Yes (auto-check). On-prem BUKAN AWS resource → kena custom Route 53 health check. Tak boleh combine dua endpoint dalam satu record.
same application state on recovery · avoid long initialization · memory-intensive app fast recovery · preserve RAM across stop · in-memory state persistence · resume exactly where it stopped
Hibernation simpan RAM (in-memory state: OS, processes, cache) ke EBS root volume. Resume sambung tepat di mana berhenti — cepat, tak reinitialize. Stop/Start = RAM HILANG (macam reboot). AMI = disk je, bukan RAM.
Aurora DB invoke Lambda synchronously/asynchronously · trigger Lambda from Aurora DB cluster · mysql.lambda_async / lambda_sync · Aurora call Lambda function from stored procedure · database event-driven to Lambda
SIAPA mulakan aksi (actor) = dia yang pakai kuasa. Aurora DB yang nak panggil Lambda → IAM Role dengan lambda:InvokeFunction ATTACH dekat AURORA cluster (BUKAN dekat Lambda). Network: Security Group menjaga dari mana arah request BERMULA. Bila Lambda dalam VPC: SG Aurora OUTBOUND allow ke Lambda, SG Lambda INBOUND allow dari SG Aurora (port 443, AWS API endpoint). Jangan terbalik arah SG, dan jangan attach IAM ke Lambda (Lambda penerima, bukan pemanggil).
D3 · High-Perf
19AMI ID beza ikut region · hardcode value per region · same template, many regions
Mappings = lookup table dalam template (region → AMI). Satu template jalan di semua region tanpa edit.
orchestrate Lambda · visual workflow · track each step · state machine · avoid custom failure logic
Orchestrate multi-step workflow secara visual + auto retry/catch per step — tak payah tulis state/failure logic sendiri.
root / apex domain ke ALB · zone apex · no CNAME at root · naked domain
Apex MESTI Alias (CNAME haram kat root). Alias point ke ALB tanpa IP tetap + query FREE.
store all/any data types, any scale · structured + unstructured + raw · central repository semua data
Data Lake = humban SEMUA jenis data mentah (struct/unstruct/semi) di satu tempat murah & scale tanpa had → Amazon S3.
fine-grained access data lake · row/column/cell-level security · simplify/accelerate secure data lake
Kawalan akses halus (row/column/cell) ATAS data lake + bina secure lake laju. Glue Catalog metadata je, IAM S3 object-level je.
complex SQL + BI on structured data · data warehouse · analyze structured data, recurring reports
Data Warehouse OLAP — structured data dah kemas, complex SQL + BI berulang atas berbilion baris. BUKAN Data Lake (mentah) / Athena (ad-hoc jarang).
highest IOPS · mission-critical database · sub-millisecond latency · I/O-intensive · provisioned IOPS · SAP HANA / Oracle / SQL Server on EBS
Bila soalan tekan IOPS paling tinggi + latency rendah konsisten untuk DB kritikal → io2/io1. io2 Block Express = sampai 256,000 IOPS, 99.999% durability. BUKAN gp3 (gp3 cuma sampai 16,000 IOPS).
default SSD · cost-effective general purpose · boot volume · balanced price/performance · baseline 3000 IOPS
Default & paling worth untuk majoriti workload — gp3 bagi 3,000 IOPS + 125 MB/s baseline TANPA bayar ikut saiz (gp2 IOPS terikat saiz). Boot disk, web/app server. Naik IOPS/throughput asing-asing.
sequential access · big data · log processing · data warehouse on EBS · high throughput cheap · streaming workload
Akses SEQUENTIAL besar-besar + throughput tinggi murah (MB/s, bukan IOPS) → st1. Big data, log/ETL, streaming. Kalau jarang sentuh & nak paling murah → sc1 (Cold HDD). HDD = TAK boleh jadi boot volume.
session store · cache + persistence · pub/sub · leaderboard / sorted set · replication & Multi-AZ failover · multi-threaded simple cache · Redis vs Memcached
Perlu persistence, replication, Multi-AZ failover, pub/sub, struktur kompleks (sorted set/leaderboard), backup → Redis. Cuma nak cache key-value ringkas, multi-threaded, scale-out mendatar, boleh buang bila-bila → Memcached.
live video · CCTV / camera feed · drone / dashcam / video doorbell · facial recognition on video · two-way / interactive video (WebRTC) · ingest & playback media
Perkataan VIDEO / camera / CCTV / media → KVS (BUKAN Kinesis Data Streams, itu untuk text/log/telemetry). Real-time face/object detection atas video → KVS + Rekognition Video. Dua-hala / interactive / talk-back (video doorbell, baby monitor, telehealth) → KVS with WebRTC.
raw / landing zone · cleanse / processed zone · curated / analytics zone · data lake unmanageable / unsearchable · data swamp · organize data lake by zone
Data lake matang = 3 zon: Raw/Landing (mentah as-is) → Cleanse/Processed (Glue ETL, Parquet) → Curated/Analytics (sedia BI/ML). Humban tanpa Glue Catalog + Lake Formation = DATA SWAMP (ada data tapi tak boleh cari/percaya). "lake jadi tak terurus" → fix dengan catalog + governance.
shopping cart / session store · schemaless / key-value · graph / mutual friends / fraud ring · data warehouse / OLAP / BI · time-series / IoT metrics · cache in-memory · serverless DB scale-to-zero
RDS = 6 enjin RELATIONAL je (MySQL/PostgreSQL/MariaDB/Oracle/SQL Server/Aurora). Apa-apa NoSQL/cache/warehouse/graph/time-series = BUKAN RDS: cart/session/key-value → DynamoDB; graph/fraud → Neptune; OLAP/BI → Redshift; IoT/time-series → Timestream; cache → ElastiCache. "Aurora" ≠ serverless melainkan ada perkataan "Serverless".
Redshift performance issues · network bandwidth + CPU processing limits · accelerate Redshift query, minimize overhead/cost · reduce data movement in cluster
Push compute dekat storage → kurang data lalu NETWORK + kurang beban CPU compute node. Auto-managed (RA3, no extra charge) = minimum operational overhead. BUKAN Spectrum (Spectrum extend ke S3, boleh TAMBAH trafik), BUKAN ElastiCache (itu cache OLTP, bukan analytics columnar).
VPC in different regions, private · access EFS across regions without internet · eu-west-2 to us-east-1 private link · minimize latency cross-region · Direct Connect + cross-region access
VPC beza REGION → inter-region VPC peering (private, elak internet, low-latency). PrivateLink TAK support EFS (ia untuk service-based, bukan file system). On-prem via Direct Connect ke satu VPC → route through peering ke VPS lain. BUKAN Managed VPN (mahal+latency), BUKAN same-region peering.
track ALB request count / latency / HTTP codes · alarm when threshold crossed on load balancer · monitor ALB without installing agent · ALB metrics to CloudWatch
ALB AUTOMATIK hantar metrics (request count, latency, HTTP response codes) ke CloudWatch. Buat alarm terus dari CW — tak perlu install apa-apa. CloudWatch Agent kumpul OS-level metrics DALAM EC2 (CPU/memory), BUKAN metrics ALB. X-Ray = trace dalam app, ALB tak native integrate.
real-time recommendation engine · low-latency read/write at scale · high-velocity user interactions · sub-millisecond key-value · in-memory personalized suggestions
"real-time" + "low-latency" + "high-velocity" + key-value at scale → ElastiCache Redis (sub-millisecond, in-memory). Redshift = analytics/BATCH (OLAP, lawan real-time). Aurora = relational, tak sepantas Redis. Neptune = graph DB, latency lebih tinggi, untuk hubungan kompleks bukan real-time KV.
identify specific animal species in images · camera trap species monitoring · automate image recognition without building from scratch · custom object recognition managed training · recognize custom/specific objects not generic labels
Kenal SPESIES/objek KHSUSUS → Custom Labels (label imej, Rekognition urus training & hosting — managed, bukan from-scratch). DetectLabels (Object/Scene Detection) = label GENERIK je ("animal", "outdoor"), tak kenal spesies. "from scratch" exclude SageMaker (D), BUKAN Custom Labels (A, managed). Facial Analysis = muka MANUSIA, bukan haiwan.
scale ECS/EC2 based on SQS queue · scale consumer on queue backlog · ApproximateNumberOfMessagesVisible · backlog per task custom metric · auto-scale on message count not CPU · queue-based scaling · which metric to scale SQS consumer
Consumer yang sedut kerja dari SQS mesti scale ikut QUEUE BACKLOG, bukan CPU/Memory. CPU/Memory BUTA pada queue depth — container proses mesej satu-satu jadi CPU kekal rendah walau 10,000 mesej sangkut → auto-scaling ingat server rilek, tak scale. Guna custom metric ApproximateNumberOfMessagesVisible (queue depth) atau backlog per task (queue depth ÷ target capacity) → Target Tracking scale out. Keyword "scale based on SQS queue / number of messages" → custom metric backlog, BUKAN CPU/Memory/S3 objects/container count.
D4 · Cost
5unusual spending patterns · anomalous spend · detect unusual AWS costs · alert departments cost spike · ML cost anomaly · cost monitor Billing console
ML auto-detect spike pelik + alert email/SNS + root-cause. BUKAN Budgets (threshold tetap), BUKAN CloudWatch EstimateCharges (tak bezakan unusual vs growth), BUKAN Cost Explorer (visualize je).
RTO RPO 20 minutes · backup infrastructure cost not high · budget concerns DR · tens of minutes recovery · financial institute disaster · resilient low budget DR
RTO/RPO "10s of minutes" cukup untuk ~20 min, data replicate aktif, app OFF → $$ (lebih murah dari Warm Standby $$$ yang bayar full stack idle). Backup&Restore = jam. Multi-Site = $$$$.
office hours only · stop EC2 nights & weekends · start stop schedule · dev/test idle after hours · cut cost non-prod · weekday working hours · EC2 RDS office hours · minimal operational overhead · Instance Scheduler CloudFormation
AWS Solution (CFN template): EventBridge → Lambda → start/stop EC2 + RDS ikut jadual tag. Least ops. BUKAN RI/SP (commit 24/7) atau CloudWatch CPU+Lambda (more ops, RDS trap).
Java cold start · reduce cold start cheapest · most cost-effective cold start · .NET / Python startup latency
Snapshot execution environment (Firecracker) → restore cepat, NO extra charge. "strict zero cold start / any runtime / predictable spike" → Provisioned Concurrency (bayar per jam).
rarely accessed shared files · low-cost EFS · single AZ + can be regenerated · re-creatable / not critical data · cheapest EFS class · redundant backup file storage
2 soalan je: (1) jarang akses → IA. (2) 1 AZ cukup sebab data boleh dijana semula → One Zone. Gabung "rarely accessed + single AZ + re-creatable + low-cost" = One Zone-IA (paling murah). "frequently accessed + multi-AZ HA" = Standard; "infrequent tapi masih multi-AZ" = Standard-IA.
★ Pilih Database
pokok keputusanNampak bentuk data → pilih keluarga → tembak service ikut keyword. Mula dari soalan ni:
Relational / SQL (transaksi OLTP)
perlu HA hebat · auto-scale storage · Global DB · MySQL/PostgreSQL je
standard, atau perlu Oracle / SQL Server / MariaDB
NoSQL — ikut shape data
key-value · serverless · single-digit ms · spiky traffic
document · "MongoDB-compatible"
graph · hubungan · fraud ring · recommendation
wide-column · "Cassandra / CQL"
cache laju · DAX khusus depan DynamoDB
in-memory tapi DURABLE (boleh jadi primary DB)
Analytics / time-series
OLAP warehouse · BI · agregat berjuta baris · report berulang
time-series · sensor IoT · metrik ikut masa
Discriminator:“relational + transaksi” → RDS/Aurora · “key-value + serverless + ms” → DynamoDB · “graph / hubungan” → Neptune · “warehouse / BI” → Redshift · “cache” → ElastiCache (BUKAN DAX melainkan sebut DynamoDB).
★ Pilih Storage
pokok keputusanTanya cara akses dulu — attach jadi disk (block) · mount share ramai (file) · HTTP API (object). Lepas tu pilih service:
Block — attach jadi disk (1 EC2)
volume persistent satu EC2 (RWO) · boot/DB disk · Multi-Attach HANYA io1/io2 = shared BLOCK (max 16 EC2, same AZ); gp/st1/sc1 TAK boleh
disk fizikal ephemeral · hilang bila stop/terminate · paling laju · buffer/cache/scratch
File — mount share (ramai serentak)
NFS · Linux · ReadWriteMany (RWX) · ribuan EC2/pod merentas AZ · auto-grow · "shared file" · "multiple pods different nodes" → EFS
SMB · Windows file share · Active Directory · NTFS
HPC / ML / analytics · throughput gila · boleh link ke S3
Object — HTTP API (flat, unlimited)
object · 11 nines · unlimited · web asset / data lake / backup · akses via API
arkib murah · retrieval lambat (ms→jam ikut tier) · compliance/long-term
hybrid · on-prem sentuh AWS storage (File/Volume/Tape Gateway)
Perangkap utama: “shared across many EC2/pod” → EFS (file, RWX), BUKAN EBS. Tapi kalau soalan tanya shared BLOCK device → io1/io2 Multi-Attach(max 16 EC2, same AZ). “ephemeral / paling laju / boleh hilang” → Instance Store. “Windows / SMB / AD” → FSx for Windows · “HPC / ML throughput” → FSx for Lustre.
★ Peta Besar
13 corak terasPasangan keliru yang exam ulang — diagram dengan discriminator pada setiap edge. (garis putus-putus = vs, pilih satu · anak panah pejal = aliran / mengandungi · garis tebal = dua-dua perlu)
Master Index — 4 Domain × Category (overview kt atas)
MNEMONIC: IAM=siapa buat apa, Directory=senarai pekerja, Cognito=login app, Organizations=payung akaun, RAM=kongsi resource. SG Satu Gate stateful suka-allow; NACL kena List nombor boleh Lock (deny). GIM Detect (GuardDuty/Inspector/Macie), WAS Protect (WAF/Shield). KMS=Kongsi (managed), HSM=Hardware Sendiri (single-tenant). Direct Connect=dedicated, Client VPN=remote-user, Site-to-Site=network-ke-network. Peer-server, End-service, NAT-net.
MNEMONIC: Region=bandar, AZ=lokasi berasingan dalam bandar. Multi-AZ=SELAMAT (failover), Read Replica=LAJU (agih baca). DR 4 pattern makin mahal makin laju: Backup&Restore → Pilot Light → Warm Standby → Multi-Site Active/Active. RTO=berapa cepat pulih (downtime), RPO=berapa banyak data boleh hilang. Server→MGN, DB→DMS(+SCT), file→DataSync, offline besar→Snow.
MNEMONIC: Lambda=serverless event, ECS/EKS=container (Fargate=serverless container), EC2=full control. EBS=SSD laptop (1 mesin), EFS=folder kongsi (ramai), S3=Google Drive (object). ALB=App L7 path-routing, NLB=Network L4 laju static IP, GLB=Gate firewall pihak3. SQS=Queue 1 consumer, SNS=Pub-sub ramai, Kinesis=Stream. RDS/Aurora=SQL, DynamoDB=NoSQL, Redshift=warehouse OLAP, ElastiCache=cache, Athena=query S3 serverless. Rekognition=imej, Comprehend=teks, SageMaker=bina model sendiri.
MNEMONIC: On-Demand=teksi (bayar guna, mahal), RI=sewa kontrak (komit instance type), SP=komit DUIT per jam (flexible), Spot=tiket standby (murah s/h 90%, boleh ditarik 2 min). RI=komit instance type (kurang flexible), SP=komit $/jam — Compute SP merangkumi EC2+Fargate+Lambda (paling flexible). Cost Explorer=visualize+forecast 12bln, Budgets=alert+Budget Actions, CUR=detail line-item ke S3+Athena, Cost Anomaly Detection=ML spike, Compute Optimizer=rightsize ML, Trusted Advisor=broad checks.
Security & multi-account
Organizations = satu payer · consolidated billing + volume discount.
SCP = siling maksimum (SEKAT, bukan BAGI) — even root member tak lepas.
Cross-account = DUA kunci; set satu belah je → Access Denied.
Org luar read S3/SQS → resource policy (kemas). Permission kompleks / temp creds / banyak service → Role + STS.
Group = bakul kumpul user (tak boleh login/assume). Role = identiti sementara di-assume (EC2/Lambda/cross-account).
Secrets Manager = auto-rotate built-in (Lambda), bayar/secret — DB password/API key. Parameter Store = config biasa, Standard FREE, no native rotation.
AWS-managed = AWS urus penuh, takde kawalan rotation/policy. CMK = kau cipta & kawal: "control over keys / rotate own key / audit who used key / custom key policy" → CMK.
KMS = multi-tenant managed (FIPS 140-2 L2), AWS urus. CloudHSM = single-tenant dedicated HW (FIPS L3), AWS tak boleh access — bank/regulasi ketat.
At rest = data DUDUK disimpan (S3/EBS/RDS/snapshot): "stored data / on disk / encrypt at rest" → KMS (SSE-KMS). In transit = data JALAN atas network: "in flight / over the network / man-in-the-middle / secure communication" → TLS/SSL (ACM cert) atau IPSec VPN.
Monitoring & audit
CloudWatch = metrics/logs/alarms (APA jadi); CloudTrail = SIAPA call API (audit).
CloudTrail = siapa buat action; Config = STATE resource + comply ke tak.
Networking
VPC = rangkaian sendiri; subnet pecah ikut AZ.
SG = stateful, instance-level, allow je; NACL = stateless, subnet-level, allow + deny.
CloudFront = CDN, cache content (statik/dynamic) di edge. GA = NO cache, 2 static anycast IP, route TCP/UDP via AWS backbone + failover cross-region <30s.
Load Balancer
ALB = HTTP path/host routing; NLB = TCP/UDP, juta conn, static IP, latency rendah.
GWLB = depan appliance pihak ketiga (firewall / IDS / IPS).
Database
Multi-AZ = survive AZ outage (HA); Read Replica = offload READ (scaling).
Proxy pool connection; elak "too many connections". Pilih DB? Tengok pokok keputusan atas ↑
Compute & scaling
UP = instance lagi besar (ada had); OUT = tambah instance (ASG) = elastik.
Spot = sampai 90% murah, 2-min notice; Mixed = On-Demand baseline + Spot.
EBS = block, 1 instance; EFS = file, share ramai; S3 = object; Instance Store = ephemeral.
Beanstalk = PaaS, deploy APP cepat (opinionated: auto EC2+ALB+ASG). CloudFormation = IaC general untuk SEMUA jenis resource.
Geografi — Region / AZ
Region = geografi; AZ = data center berasingan dalam region.
1 subnet = 1 AZ; deploy Multi-AZ = tahan 1 AZ tumbang.
Aliran data
Streams = real-time custom (shard); Firehose = auto-deliver ke S3/Redshift (serverless).
SQS = queue, pull, 1 consumer; SNS = pub/sub, push, fan-out ramai.
Threat detection & protection
GuardDuty = threat dari LOGS (CloudTrail/VPC Flow/DNS, ML, no agent). Inspector = scan CVE/vulnerability (EC2/ECR/Lambda). "unusual activity / crypto-mining / compromised" → GuardDuty; "CVE / patch / vulnerability" → Inspector.
Inspector = CVE/vuln dalam SOFTWARE (EC2/ECR/Lambda). Macie = PII/sensitive data dalam S3. "vulnerability scan" → Inspector; "PII / credit card / sensitive data in S3" → Macie.
GuardDuty = DETECT (real-time, cari ancaman). Detective = INVESTIGATE (post-incident, behavior graph, root cause). "investigate finding / root cause / scope / visualize attack" → Detective.
Security Hub = AGGREGATOR (kumpul semua finding + compliance score CIS/PCI, satu dashboard) — TAK detect sendiri. "single pane of glass / aggregate findings / compliance across accounts" → Security Hub.
WAF = L7 web exploit (SQLi/XSS/bad bot/rate limit). Shield = DDoS (L3/4 volumetric flood). "SQL injection / XSS" → WAF; "DDoS flood" → Shield.
Standard = FREE, auto, L3/4 — takyah buat apa. Advanced = $3k/bln: DRT 24/7 + cost protection + WAF free + L7. "free DDoS" → Standard; "DRT / cost protection / maximum DDoS" → Advanced.
WAF = HTTP request je (L7, pasang CloudFront/ALB/API GW). Network Firewall = SEMUA traffic VPC (L3-7, Suricata, domain/egress filter). "domain filtering / egress / IDS-IPS VPC-wide" → Network Firewall.
WAF = tulis rule untuk SATU resource. Firewall Manager = sebar policy (WAF/Shield/SG/Network Firewall) merentas SEMUA account Organization + auto-cover account baru. "centrally enforce across all accounts incl. new ones" → Firewall Manager.
Migration & Transfer
Apa yang dipindah? MGN = whole SERVER (OS+apps+data) → EC2, lift-and-shift. DMS = DATABASE je (minimal downtime). DataSync = FILE/object → S3/EFS/FSx. "entire server to EC2" → MGN; "migrate database" → DMS; "transfer NAS/NFS files" → DataSync.
Engine SAMA (MySQL→RDS MySQL) = homogeneous = DMS sorang cukup. Engine BEZA (Oracle→Aurora PostgreSQL) = heterogeneous = wajib SCT convert schema dulu, baru DMS. CDC = keep source↔target sync sampai cutover. Multi-AZ replication instance = HA masa migrate.
DataSync = migration ONLINE (one-time/scheduled, NFS/SMB/HDFS → S3/EFS/FSx, +EFS cross-region private network). Storage Gateway = akses hybrid BERTERUSAN. Snow = OFFLINE peti fizikal bila PB-scale / bandwidth lambat. "no public internet EFS cross-region" → DataSync.
Ikut saiz: Snowcone = 8TB HDD / 14TB SSD (paling kecik, edge). Snowball Edge Storage Optimized = 210TB (bulk migration). Snowball Edge Compute Optimized = 28TB · 104 vCPU · 416GB RAM (edge ML/video). "smallest/portable" → Snowcone; "petabyte bulk" → Snowball Edge Storage.
Managed SFTP/FTPS/FTP/AS2 endpoint, backend S3/EFS — untuk partner/customer hantar fail guna protokol lama tanpa tukar code mereka. "partner uploads via SFTP into S3" → Transfer Family (BUKAN DataSync, BUKAN Storage Gateway).
ADS = DISCOVER + inventory + dependency on-prem (fasa planning; agentless via VMware vCenter, agent-based untuk network dependency). Migration Hub = TRACK progress merentas MGN/DMS/DataSync (home region, Strategy Recommendations, Orchestrator) — TAK migrate apa-apa. "track migrations one dashboard" → Migration Hub.
Terma: Ingress = Inbound · Egress = Outbound
Maksud SAMA: trafik MASUK dari luar → dalam sistem. "Inbound" = nama mesra UI (AWS Console Security Group/NACL). "Ingress" = nama saintifik bila tulis code (Terraform/CloudFormation/Kubernetes). Nampak `ingress {}` dalam Terraform → otak tukar: "ooo ini Inbound rules".
Maksud SAMA: trafik KELUAR dari sistem → internet luar. "Outbound" = UI Console; "Egress" = code. Terraform: blok `ingress{}` = inbound rules, blok `egress{}` = outbound rules.
Konsep sama (jaga pintu masuk) tapi beza LAPISAN. SG/NACL Inbound = L4 perimeter infra — tengok port/IP je ("Port 443 bukak? Lepas masuk"), tak kisah app apa. K8s Ingress = L7 aplikasi — boleh baca URL path ("request ke /api/v1/users → hantar ke Pod backend-user").
Pasang K8s Ingress dalam EKS → AWS Load Balancer Controller AUTO-create sebiji ALB di belakang tabir untuk agih trafik HTTP ikut path/host. Ingress Controller = "polis trafik / pengagih URL" = kerja sama macam ALB. Mereka berkawan baik.
NetSec — mnemonics + master decision
MNEMONIC SNAP: SG = Satu Gate (instance), Stateful, Suka (allow je, tak boleh deny). NACL = Net Access Control List, kena List nombor (lowest dulu), boleh Lock (DENY). Block specific IP at subnet → NACL; stateful instance-level allow → SG. Stateful = "saya ingat awak" (response auto keluar); Stateless = "saya lupa" (define in & out dua arah). Table penuh ada kat card NACL / SG vs NACL.
Internet → Route 53 (DNS) → Shield+WAF → CloudFront (CDN) → VPC (IGW/NAT) → NACL (subnet) → Security Group (instance) → IAM → Resource. MNEMONIC: "Dulu Shield, CDN Veto, Net Security, Identity".
GIM = GuardDuty (ancaman/malicious), Inspector (vulnerability/CVE), Macie (data sensitif PII dalam S3). WAS = WAF (L7 SQLi/XSS), Advanced Shield (DDoS+ mitigation), Shield Standard (DDoS asas, FREE auto). Ingat: GuardDuty jaga Gate, Inspector cari Illness, Macie cari Maklumat sulit.
MNEMONIC: KMS = Kongsi (multi-tenant, AWS urus, FIPS 140-2 L2). CloudHSM = Hardware Sendiri Milik (single-tenant dedicated, kau urus, FIPS L3, compliance ketat bank/regulasi).
Gateway Endpoint = S3 & DynamoDB SAHAJA, PERCUMA (route table entry). Interface Endpoint = semua servis lain (SQS/SNS/KMS/dll), BERBAYAR (ENI dalam subnet). MNEMONIC: "S3 dan Dynamo = FREE Gate".
Perangkap
29Jawapan yang nampak betul tapi tak kena root cause — exam ulang perangkap yang sama.
DynamoDB simpan METADATA je (max 400 KB/item) — bukan file sebenar. Simpan FILE → S3, metadata → DynamoDB.
RDS = relational data, bukan blob store. Mahal + tak durable untuk file. File besar → S3.
DNS spec larang CNAME kat zone apex. Untuk root domain → Route 53 Alias; subdomain (www) → CNAME/Alias.
ALB takde static IP (IP berubah). Jangan hardcode IP — guna Alias yang auto-track ALB.
Cross-account = DUA kunci. IAM (source) bagi user keluar, TAPI resource-based policy (bucket/queue/key) di destination mesti sebut Principal source acct juga. Satu belah je → Access Denied.
Resource policy izin source masuk, tapi user/app di source masih perlu IAM policy bagi dia buat action keluar. Dua-dua pintu kena buka.
SourceVpc = SELURUH VPC (luas). Untuk least privilege "satu endpoint tertentu" → aws:SourceVpce (ada "e" hujung = VPC Endpoint ID, lebih spesifik).
Baca metadata + INSTALL masa launch → cfn-init (init = setup). cfn-signal = bagi tahu CFN dah siap; cfn-hup = pantau metadata berubah; cfn-get-metadata = ambil info je.
Kalau semua Spot, AWS boleh reclaim serentak → app down. Guna Mixed: On-Demand baseline + Spot.
Timeout cuma tangguh; poison pill tetap pusing & crash. Selesai → DLQ + maxReceiveCount.
Read Replica = offload READ, bukan urus connection. Connection exhaustion → RDS Proxy (pooling).
Email validation = manual & senang tersangkut. Untuk auto-renew selamanya → DNS validation (CNAME).
DMS = DATABASE je. "minimal downtime" mengumpan, tapi whole server (OS+apps) → AWS MGN (lift-and-shift). Files → DataSync.
Nama "Migration Hub" mengumpan — ia TRACK je, tak migrate. Server → MGN, DB → DMS, file → DataSync. Hub cuma dashboard progress.
Engine BEZA (heterogeneous) → wajib SCT convert schema/stored procedure dulu, baru DMS pindah data. DMS sorang cukup hanya kalau engine SAMA.
Evaluate Target Health cuma untuk AWS resource (ALB, ELB, API Gateway…). On-prem BUKAN AWS resource → kena create custom Route 53 health check. DR failover juga perlu DUA record berasingan (primary+secondary), bukan satu record gabungan.
Stop/Start = RAM HILANG, macam reboot, kena reinitialize. Nak simpan in-memory state (OS, processes, cache) + resume cepat → EC2 Hibernation (RAM → EBS root). AMI simpan disk je, bukan RAM.
Retention period = tempoh TETAP (fixed duration), bukan indefinite. "indefinitely / no expiration" → Legal Hold (tiada tempoh tamat). Dan compliance ketat → Vault LOCK policy (immutable), bukan Vault ACCESS policy (mutable, boleh ubah).
PrivateLink TAK support EFS (ia untuk service-based connection, bukan file system). VPC beza region nak akses EFS private → inter-region VPC peering (+ Direct Connect untuk on-prem).
VPC peering biasa = same region. VPC di REGION berbeza → inter-region VPC peering (kalau tak, trafik tak mengalir private). VPN = mahal + latency, bukan optimum.
ALB AUTOMATIK hantar metrics (request, latency, HTTP codes) ke CloudWatch — tak perlu agent. CW Agent kumpul metrics OS-level DALAM EC2 (CPU/memory/disk), bukan metrics load balancer.
Redshift = data warehouse OLAP untuk analytics/BATCH, bukan real-time (lambat). Real-time + sub-millisecond + key-value at scale → ElastiCache for Redis. Aurora = relational, Neptune = graph — dua-dua tak sepantas Redis utk real-time KV.
DetectLabels bagi label GENERIK ("animal", "outdoor") — tak kenal spesies tertentu (harimau Malaya vs Benggala). Spesies/objek khusus → Rekognition Custom Labels (label imej, Rekognition urus training — managed). Jangan anggap "train" = "from scratch"; SageMaker je yang from-scratch.
Facial Analysis direka untuk MUKA MANUSIA (emosi, umur, jantina, landmark). Bukan untuk haiwan langsung. Kenal objek/haiwan → Object/Scene Detection (generik) atau Custom Labels (spesifik).
TERBALIK. Aurora DB yang MEMULAKAN panggilan = actor, jadi IAM Role (lambda:InvokeFunction) attach dekat AURORA cluster, BUKAN Lambda. Lambda cuma penerima. Prinsip: siapa mula aksi, dia pakai pasport kuasa.
TERBALIK arah SG. Security Group jaga dari mana request BERMULA. Aurora MULAKAN outbound → SG Aurora perlu OUTBOUND allow ke Lambda; SG Lambda perlu INBOUND allow dari SG Aurora (port 443). Kalau Lambda dalam VPC sahaja (VPC-enabled). Lambda non-VPC (default) takde SG inbound — invoke guna AWS API endpoint, cukup IAM Role pada Aurora je.
Butang "turn on encryption" pada existing unencrypted RDS TAK WUJUD — encryption cuma set masa CREATE. Cara betul: snapshot → COPY snapshot (enable encryption + KMS key) → restore NEW encrypted instance → update app endpoint → buang lama. Konsep sama macam encrypt EBS volume.
Read Replica WARISI encryption source. RR dari primary unencrypted (same-region) WAJIB unencrypted — tak boleh encrypt terus. Buang RR lama, create RR BARU dari encrypted primary → auto encrypted. primary encrypted → replica encrypted (KMS key sama).
CPU/Memory BUTA terhadap queue depth. Container yang proses SQS satu-satu maintain CPU rendah walau 10,000 mesej beratur → auto-scaling ingat server rilek, tak scale. Consumer tarik kerja dari queue → scale ikut custom metric: ApproximateNumberOfMessagesVisible atau backlog per task (queue depth ÷ target capacity). Salah juga: scale ikut "number of objects in S3" (bucket makin penuh hari hari → scale selamanya) atau "number of containers" (itu RESULT scaling, bukan METRIK).
Setiap row link ke penjelasan penuh di Deep Notes. Test diri di Practice.