AWS Developer Flashcards & Memory Notes

Synchronous invocation waits for the response. Asynchronous invocation accepts the event, retries on failure, and can send the outcome to a destination.

Orchestration uses a central workflow such as Step Functions. Choreography lets services react to events, often through EventBridge, without one owner of the whole flow.

Choose SQS when one consumer should pull work later. Choose SNS when one publish must reach many subscribers.

It spreads items across partitions so one key does not take all the traffic. A low-cardinality key, such as a status flag, creates a hot partition.

A query reads items that match the key condition. A scan reads widely and filters afterward.

Choose DAX when the cache sits in front of DynamoDB. Choose ElastiCache when the application manages a Redis or Memcached cache itself.

A layer shares libraries across functions so each deployment package stays smaller. It is not a second copy of the function's business logic.

Attach the function to subnets and a security group. It then needs a NAT gateway or a VPC endpoint to reach services outside that VPC.

Rules that match event patterns and send them to targets, including a schedule. A queue stores work for a consumer to pull.

Amazon Q Developer. It can draft and review code. You still own the API contract, the validation, and the status codes.

A user pool authenticates users and issues tokens. An identity pool exchanges a token for temporary AWS credentials.

A role gives temporary credentials through STS. A long-term key in code can be copied and does not expire on its own.

The key policy must allow the other account, and that account's IAM policy must allow the decrypt. An allow on only one side leaves the call denied.

Client-side encryption happens before the data reaches AWS. Server-side encryption happens after AWS receives the data.

From AWS Secrets Manager at runtime. Do not commit the password or bake it into the image.

A KMS key keeps that configuration from sitting in plaintext. A secret that must rotate belongs in Secrets Manager.

The response or the log hides part of a sensitive value while the stored record can remain. It is not a bucket policy.

The role can call the APIs that function needs and nothing broader. A policy that grants every action on every resource fails that test.

Temporary security credentials. A long-term access key in source code does not expire on its own.

Mask or remove it. Version 2.1 includes sanitizing sensitive data in application code.

A version is an immutable snapshot. An alias is a pointer you can move, including a weighted split for a canary.

It keeps the old version running and shifts traffic to the new version, so a rollback shifts traffic back.

It sends a small share of traffic to the new version first, then shifts the rest if that share stays healthy.

The source action in CodePipeline, or the repository webhook it uses. The commit is not itself a deployment strategy.

When configuration or a feature flag must change without a new application deployment. A rotating password still belongs in Secrets Manager.

Container images. ECS, EKS, Fargate, or Lambda then runs an image you push there.

When the container should run without you managing the EC2 instances under the task. EKS is the managed Kubernetes choice.

A named deployment of the API, such as test or prod, with its own settings and stage variables.

The same serverless stack in another environment, such as a staging deploy of the functions and API. It is not a manual edit of the live function.

It can generate tests and help automate repetitive test work. It does not replace the pipeline or approve production by itself.

Logs record events. Metrics are numbers over time. Tracing follows one request across services.

A structured log line that CloudWatch extracts into a custom metric, so the application does not call PutMetricData for every point.

An indexed field you can filter on, such as an error flag. Metadata is recorded and is not indexed the same way.

That the task can receive traffic. A failed check keeps traffic away. A log line that says the process started is not that check.

Memory and CPU are allocated together. More memory can shorten a CPU-heavy function even when the function does not use the extra RAM.

A ceiling on how many copies of that function can run. It also reserves that amount from the account pool. Zero stops the function.

Initialized execution environments so the first requests avoid a cold start. It is not a higher memory setting.

The subscriber receives only messages that match the filter, so it does not process every publish.

The trace for that request, then duration, throttles, and the downstream call. A bigger instance is a guess until the trace names the slow hop.

The service output for that deployment, such as CodeBuild, CodeDeploy, or CloudFormation events, before you change application code.