AWS Certified Solutions Architect - Professional 2026 [NEW]

Explore the shift from legacy single-account setups to a multi-account architecture that isolates development, staging, and production, and learn logging, access, and cross-account configuration using AWS Organizations and Identity Center.

Explore identity account architecture that centralizes users and enables cross-account login to multiple AWS accounts via roles.

Configure cross-account access by creating an identity account user, defining a cross-account role in the destination account with proper trust, and enabling role switching for S3 access.

Discover the core AWS IAM policy types—identity-based, resource-based, permission boundaries, service control policies, and ACLs—with practical demos showing how these govern access in production environments.

Understand how AWS organizations enable centralized management of many accounts via a management account, member accounts, and consolidated billing, and how service control policies and tag policies enforce governance.

Enable AWS Organizations, create the management account, and add member accounts by creating new ones or inviting existing ones, then leverage consolidated billing and policies.

Enable service control policies in AWS organizations, create a deny policy for S3 actions, and attach it to a sandbox account to observe permission restrictions.

Learn to create and test AWS tag policies in an organization, restrict tag values (team name: security or devops), and propagate the policy to all accounts.

Explore the two policy categories in AWS organizations—authorization policies that deny actions and management policies that govern resources and tag enforcement across accounts, including service control policies.

Learn how organizational units group AWS accounts by environment and apply service control policies at the OU level, including nested structures and root-level options.

Explore practical AWS organization management by creating and nesting organizational units, moving member accounts between OUs, and safely deleting empty structures from root to production.

Explore service control policies for AWS organizations, comparing deny list and allow list strategies, including full access policy basics, explicit denies, and implicit denies to control service access.

Switch from a denial list to an allow list using service control policies, attaching a custom allow list policy at sandbox and root, then remove the default full access policy.

Understand how IAM permission boundaries cap the maximum permissions from an identity-based policy, and how the boundary, policy, and SCP determine effective AWS access.

Explore how IAM permission boundaries constrain privileged access; attaching administrator policy and setting a boundary like S3 full access prevents EC2 permissions, while S3 remains accessible.

Learn how IAM policy evaluation works in AWS, including implicit and explicit deny, explicit allow, default deny, and the final outcome when identity, resource, and SCP policies conflict.

Explore how the AWS security token service enables assume role to grant temporary credentials (access key, secret key, and session token) bounded by role policies and trust relationships.

Explore how service roles let AWS services act on your behalf, and how pass role controls who can assign those roles to resources such as CloudFormation stacks.

Learn how attribute-based access control (abac) uses tags to grant access based on user and resource attributes, reducing policies and enabling scalable, environment-specific permissions in AWS.

Explore how external ID strengthens cross-account access in IAM by requiring a unique external ID with the role ARN, preventing the confused deputy in third-party integrations.

Set up a cross-account IAM role with external ID between a security corp and client account, verify the trust policy, and assume the role via the CLI.

Discover centralized logging architectures that aggregate logs from many aws accounts into a single logging account, enabling efficient security monitoring with CloudTrail, GuardDuty, and config data.

Learn how to enable cross-account CloudTrail logging by sending logs from multiple accounts to a centralized S3 bucket in a logging account. Configure bucket policy and trails to centralize monitoring.

Craft a tightly scoped S3 bucket policy for cross-account CloudTrail, using conditional keys to specify region, account, and trail name and prevent unauthorized access.

Explore how the AWS License Manager tracks and enforces licenses across AWS and on premise, blocking overprovisioning with vcpu, sockets, and instance-based policies.

Experience a practical workflow with AWS License Manager: create an AMI from EC2, configure a self-managed vcpu license, associate it, and test license enforcement.

Explore how AWS service catalog standardizes and secures resource provisioning by offering approved cloud products, driven by CloudFormation templates, and enables cost control through shared portfolios.

Explore how AWS service catalog uses product blueprints linked to CloudFormation or Terraform within portfolios to control end-user access, launch constraints, and automated provisioning of development or production environments.

Explore the end-to-end workflow of AWS service catalog, configuring products with CloudFormation templates, setting up portfolios and permissions, and letting end users launch and manage provisioned infrastructure.

Explore how S3 bucket policies control access beyond identity policies, allowing public internet access, IP address and VPC restrictions, and https only.

Learn how deny policies and IP address restrictions can lock you out of an S3 bucket, and how to regain access by removing the bucket policy as the root user.

Implement cross-account S3 access to centralize logs from production accounts into a central S3 bucket. Limit actions to get object, put object, and put object acl.

Explore cross-account S3 access with canned ACLs, showing how bucket owner full control grants both object and bucket owners full control, enabling centralized log storage.

Demonstrates cross-account S3 replication between two buckets in separate accounts, detailing IAM role creation, trust with S3, and destination bucket policy, and shows end-to-end setup and verification.

Set up cross-account S3 replication by creating two buckets in separate accounts, enabling versioning, and configuring a replication rule with an IAM role and destination bucket policy.

Learn how CloudFormation stack sets enable centralized deployment across multiple accounts and regions with a single operation, including creating, updating, and deleting stacks.

Practical guide to CloudFormation stacksets, creating administration and execution IAM roles and permissions, deploying an SNS topic across multiple regions, verifying stack instances, and deleting the stackset.

Explore how Active Directory provides central authentication, using a domain controller to authenticate and authorize users across applications, enabling single login and centralized user management.

Learn how AWS Directory Service offers a managed cloud alternative to on-prem Active Directory with Microsoft AD, Simple AD, and AD Connector, handling high availability, backups, and cloud authentication.

Federation centralizes user identities in a single directory such as Active Directory, enabling secure login to multiple services via trusted identity and service providers and an identity broker.

Saml enables identity sharing across organizations and secure single sign-on via the security assertion markup language. It uses an identity provider and a service provider with a Saml assertion.

Explore how IAM identity center enables centralized access to multiple accounts and applications via a single sign-on, from the access portal to pre-integrated apps and identity sources.

Learn how to deploy IAM Identity Center, integrate with Active Directory, and define permission sets to grant read-only or administrator access across accounts via assigned IAM roles.

Enable the IAM Identity Center, create a user, assign a permission set to accounts, and test access via the access portal, including identity source integration.

Learn how Amazon Cognito provides authentication, authorization, and user management for web and mobile apps. It covers sign-up with credentials or social logins, verification codes, multi-factor authentication, and identity pools.

Learn how the Resource Access Manager securely shares resources across accounts, such as a private subnet and a prefix list, using resource shares and invitations.

Explore how AWS VPC sharing lets multiple accounts place resources like EC2 instances and AWS Lambda into a centrally managed VPC using the Resource Access Manager.

Explore aws vpc traffic mirroring, which copies traffic from an elastic network interface to a centralized monitoring tool. See a demo capturing client to server traffic for analysis.

Explore VPC traffic mirroring by configuring a target, filters, and sessions to copy specified traffic to a monitoring instance, including HTTP and DNS rules and CIDR-based filtering.

Discover the basics of VPC endpoints, enabling private network communication between private subnets and AWS services without internet, using gateway, interface, and gateway load balancer endpoints.

Explain the gateway VPC endpoints architecture: how it routes traffic from private subnets to S3 and DynamoDB via route tables and prefix lists, while AWS manages the CIDR ranges.

Implement a gateway VPC endpoint to enable private EC2 access to S3 bucket from a private subnet, using an IAM role and updated route table.

Configure gateway VPC endpoint policies to govern EC2 access to S3 buckets, using region-specific allow and deny rules and the endpoint policy evaluation logic.

Explore the architecture of interface endpoints, where an elastic network interface with private IPs in a subnet serves as the entry point to supported AWS services via a VPC endpoint.

Implement interface endpoints in a VPC by creating an EC2 endpoint, configuring subnets and a security group, and validating traffic uses the interface endpoint instead of a public IP.

Connects consumer VPCs to provider VPCs via VPC endpoint services, enabling transfer of metrics and logs to monitoring providers such as Datadog and New Relic on the AWS private network.

Implement end-to-end VPC endpoint services in AWS, linking a service consumer to a provider via interface endpoints and a network load balancer, with EC2 instances and proper security groups.

Learn how to terminate endpoint services after configuring service provider and consumer by deleting the interface endpoint, then deleting the endpoint service, and terminating the load balancer and instances.

Understand elastic load balancing in AWS, covering application, network, gateway, and classic load balancers. Learn how these services ensure high availability, security, and performance.

Analyze the OSI model with load balancers, illustrating application load balancer at layer seven routing by HTTP headers like user agent, while network load balancer stays at layer four.

Explore classic load balancers as the original elastic load balancer, contrast with application, network, and gateway types, and walk through a practical classic load balancer setup.

Learn how application load balancers operate at the application layer, reading http headers like host and user agent to route requests and support path- and host-based routing.

Explore how listeners check requests on configured protocols and ports. See how rules trigger actions and how target groups route to EC2 instances or Lambda functions.

Configure an EC2 instance with nginx, create an application load balancer and target group, and test http traffic while opening port 80 in security groups; then delete the resources.

Understand how network load balancers operate at the transport layer to support non-http protocols like tcp, udp, tls, and ssh, unlike http-focused application load balancers.

Set up a network load balancer to handle SSH traffic by creating a TCP target group on port 22 and testing end-to-end with the NLB DNS name.

Associate a load balancer with the correct availability zones and enable zones to route traffic to EC2 instances. Use target groups and health status to troubleshoot and ensure healthy traffic.

Explore cross zone load balancing in ELB, comparing disabled and enabled setups, and learn traffic distribution across availability zones for application, network, and gateway load balancers.

Learn how ELB access logs capture requests, enable and store them in an S3 bucket in the same region, and analyze with Splunk or ELK.

Enable elastic load balancer access logs by creating a region-matched s3 bucket, applying the bucket policy, configuring the alb to push logs, and verifying delivery in s3.

Explore the three load balancer ip address types—ipv4, dual stack, and dual stack without public ipv4—and understand dns behavior, ipv6 availability, and the draining period when migrating.

Explore how sticky sessions bind a user’s session to a specific target in application and classic load balancers, using cookies to maintain session state and improve responsiveness.

Understand that a network load balancer provides a static IP per availability zone and elastic IPs. Prevent subnet or EIP modifications after creation; ALB behind NLB delivers a static IP.

Learn how to preserve the original client IP behind elastic load balancers using x forwarded for header and proxy protocol, across application and network load balancers.

Explain how https listeners on the elastic load balancer terminate tls with a certificate (acm/iam/import) to encrypt client traffic, and when to use nlb or clb tcp 443.

Learn how read replicas offload read and analytics traffic from a primary database through replication, directing reads to replicas and writes to the primary, including cross-region setups.

Practically configure an RDS read replica by creating a primary database, launching a replica in another region, adjusting the instance class, and monitoring replication, then clean up to avoid costs.

Explore how Amazon RDS multi-AZ deployments use a primary and standby in different availability zones with replication and automated failover, keeping the same endpoint during outages.

Compare RDS multi-az deployment types, including multi-az instance deployment and multi-az cluster deployment, and learn their failover speeds, read/write endpoints, and cost implications.

Learn how AWS RDS event notification delivers alerts via SNS when events occur, covering availability, configuration change, failure, low storage, maintenance, and setting up event subscriptions for DB instances.

Explore the basics of the RDS proxy, its failover to standby databases, and how it uses connection pooling, IAM authentication, and TLS to improve resiliency.

Explore how Amazon Aurora delivers MySQL and PostgreSQL compatibility with enterprise performance, automatic storage growth, and cluster, reader, instance, and custom endpoints.

See how Aurora Serverless automatically scales capacity and pauses when idle, using a warm pool and proxy fleet to reduce costs while handling variable workloads.

Explore how Aurora Global Database spans multiple regions with asynchronous replication, delivering fast local reads and disaster recovery by promoting a read replica to master when needed.

Learn how aws rds storage auto scaling expands storage with zero downtime as workloads grow; grasp triggers, 5 gb or 10% increments, six-hour cadence, and older-generation instances under 60 gb.

Learn how Aurora scales storage, instances, and reads with cluster volume expansion, other supported DB instance classes, up to 15 replicas, and auto scaling policies with minimum and maximum.

ElastiCache provides a fully managed in-memory cache to deploy and scale Memcached or Redis, with point-and-click configuration, automated backups, and multi-AZ auto-failover to reduce database load.

Explore the core components of Dynamo DB: tables, items, and attributes, and learn how a primary key uniquely identifies items in a schema-less table.

Explore how DynamoDB replicates data across availability zones for high availability and durability, and compare eventual versus strong reads, including setting consistency for get item, query, and scan.

Learn how read and write capacity units in dynamo db control throughput to balance cost and performance, prevent throttling, and use the capacity calculator.

Discover DynamoDB capacity modes, including provision mode with auto scaling and on-demand mode, and learn how read and write capacity units, throttling, and pricing shape your traffic strategy.

Explore how DynamoDB streams capture time-ordered item changes, log new and old images, and enable real-time Lambda processing for auditing, reconstructing tables, and CloudWatch logging.

Discover DynamoDB global tables, a fully managed multi-region, multi-active database that propagates writes to replicas across regions for fast local reads and eventual consistency.

discover how DynamoDB accelerator (DAX) provides a fully managed in‑memory cache delivering up to 10x faster reads for eventually consistent data, with microsecond latency via a DAX cluster.

Understand RTO and RPO to design highly available architectures. Balance cost and availability with multi-region backups and migration planning for data resilience.

Discover IAM database authentication using rotating tokens instead of passwords to securely connect MySQL and PostgreSQL databases, with policy-based access, TLS encryption, and production considerations.

Learn how Amazon SQS enables a decoupled image processing workflow by using a reliable queue between a publisher and a consumer, improving high availability and scalability.

Learn how Amazon SQS uses dead letter queues to move messages that fail processing after a max receives, preserving timestamps for troubleshooting and enforcing retention best practices.

Compare standard queue and the other queue type in SQS, highlighting throughput, delivery (with duplicates vs once), and ordering.

Explore creating a fifo queue, enable content-based deduplication, compare with a standard queue, and observe that duplicate messages sent are not received, demonstrating fifo deduplication behavior.

Learn to design auto scaling on Amazon EC2 instances driven by SQS queue messages, using CloudWatch metrics and the approximate number of messages to launch or terminate instances.

Using a message queue to decouple database transactions handles load spikes during alternate month promotions, avoiding downtime and cost, while ECS workers process queued updates with a small delay.

Amazon MQ provides a fully managed broker for Apache ActiveMQ or RabbitMQ, easing cloud migration with options for single or active standby deployment for high availability, not infinitely scalable.

Learn how the Simple Notification Service routes messages from publishers to subscribers via topics, with endpoints such as SMS, email, HTTP, HTTPS, and lambda.

Explore the SAS fan out pattern, where a publisher sends a message to a SAS topic that fans out to multiple endpoints, including logistic and notification queues.

Connect SNS with SQS to implement a fan-out pattern by creating a topic and a queue, subscribing the queue to the topic, publishing a message, and pulling it for processing.

Explore sns topic filtering and filter policies that route messages to specific queues based on message attributes, such as customer type, enabling priority and normal queues to receive different messages.

Explore how Amazon EventBridge acts as a bridge between event sources and targets, routing real-time events with rules to AWS services like Lambda, SNS, and CloudWatch for event driven workflows.

Explore AWS EventBridge concepts and workflows, including events, event buses and pipes, event patterns, and targets like Lambda and CloudWatch log groups.

Explore how to configure EventBridge rules with event patterns to capture EC2 instance state changes and route them to a CloudWatch log group, as shown by a prod server stopped example.

Discover how AWS Step Functions coordinate serverless services through a visual workflow, using Lambda, SNS, and DynamoDB, and design conditional flows with choices, parallel steps, and retries.

Configure a step function workflow to coordinate two lambda functions, Terraform and AWS, using a code-based state machine named course selector and test with AWS input.

Explore security incident response using AWS Step Functions to auto-trigger a policy-approval workflow when administrator access is granted, routing approvals via email and detaching the policy on rejection.

Explore Amazon SES as a scalable email service to send and receive messages using verified identities or domains, with formats like formatted and raw, dashboards, templates, and IP options.

Learn how to set up simple email service (ses), create and verify identities (domain or email), understand sandbox limits, request production access, and send test emails from a verified identity.

Identify the three Amazon SES credential types—SES API, SES SMTP interface, and SES console—and how each uses distinct authentication methods for sending emails using SMTP credentials with software like WordPress.

Connect to the SES SMTP endpoint using TLS encryption, choosing between start TLS and TLS wrapper, and select the correct port (25, 587, or 465) based on the method.

Explains AWS SES templates, including creating an email template with subject, text, and HTML parts, using variables like name and favorite animal, and sending templated emails with template data.

Learn to create an SES template via the CLI and send personalized emails using template data like name and favorite animal, with a config set and verified identities.

Explore bring your own IP addresses and their impact on IP reputation, customer whitelisting, and compliance during cloud migrations from on-premises, and use with elastic IP addresses.

Explore elastic network interface fundamentals in aws, including eni attributes like private and elastic ip addresses, mac addresses, security groups, and eni portability across ec2 instances.

Explore enhanced networking in aws ec2, using sr-iov to bypass virtualization for bandwidth. Learn how ena and intel vf with usb evf enable up to 100 gb and 10 gb.

Explore placement groups in AWS to co-locate EC2 instances for low latency and high network throughput. Learn cluster, partition, and spread strategies, including availability zones, rack awareness, and fault tolerance.

Discover how prefix lists centralize IP address blocks for security groups and route tables, enabling easy updates, regional scope, and efficient management of IPv4 or IPv6 entries with entry quotas.

Explore the basics of virtual private networks, how a middle proxy server routes client requests to destinations, encrypts traffic, and enables geo-restriction bypass and internal network access for corporate environments.

Explore how AWS client VPN provides secure, pay-as-you-go access to internal servers, and compare EC2 based OpenVPN deployments with client VPN endpoints, highlighting high availability, patching, and upgrades.

Compare AWS client VPN authentication options: Active Directory, mutual certificate authentication, and SAML SSO. Implement mutual authentication using client and server certificates, certificate manager, and OpenVPN or AWS VPN client.

Learn how to implement AWS Client VPN with mutual authentication, from certificate generation (CA, server, client) to provisioning the client VPN endpoint, ACM integration, and OpenVPN client setup.

Terminate the AWS client VPN endpoint after dissociating its target networks to avoid costs, then delete the certificates and terminate the EC2 instance to prevent unexpected costs.

explore multiple client vpn architectures for aws, including vpc-subnet restricted access, vpc peering, on-premise side-to-side vpn, internet gateway access, and client-to-client connectivity, with security groups controlling access.

Securely connect two networks over the internet with site-to-site vpn tunnels. Use a virtual private gateway with two endpoint IP addresses and two tunnels for high availability.

Understand the benefits of AWS Direct Connect for private, dedicated connectivity between your data center and a VPC, delivering consistent network performance and reduced bandwidth cost.

Discover how to establish AWS direct connect and create public, private, and transit virtual interfaces, including the letter of authorization, router configuration downloads, and gateway choices for multi-VPC access.

Explore how Direct Connect Gateway connects direct or private connections to multiple VPCs across regions, offering a capable alternative to virtual private gateways, with multi-account support and transit gateway association.

Explore high availability for AWS direct connect, including backup VPN connectivity and dual-location architectures to prevent downtime from hardware or network failures.

Learn how transit gateways centralize VPC and on-prem connectivity, simplifying large networks beyond peering. See attachments, direct connect, and site-to-site vpn routing in action across VPCs.

Explore base transit gateway concepts, including multiple attachments (VPC, Direct Connect, site-to-site VPN), enabling internal VPC communication and routing via transit gateway route tables and static routes.

Deploy a transit gateway, attach two VPCs, configure routes, launch EC2 instances, and verify connectivity via ping.

Explore how transit gateway routes propagate automatically from VPC attachments, manage static routes and black holes, and learn the route evaluation order and priority.

Implement attachment-level routing on a transit gateway by using custom attachment route tables to control inter-VPC communication, replacing defaults and blocking traffic between specific VPCs.

Attach ipsec vpn connections to the transit gateway with encrypted traffic up to 1.25 gbps per tunnel, using multiple icmp tunnels and enabling dynamic routing with a customer gateway.

Explore how transit gateways connect to direct connect gateways, enabling multi-region, multi-account connectivity with connect attachments and optional ipsec vpn for encryption.

Learn how transit gateway sharing enables VPCs across multiple accounts to interconnect via a region-specific central transit gateway, using RAM shares and attachments to establish end-to-end connectivity.

Understand gateway load balancers for scalable, highly available traffic inspection using virtual network appliances, with Geneve encapsulation and architecture detailing route tables and endpoints.

Analyze NAT gateway performance and how to scale bandwidth by distributing instances across multiple subnets with dedicated NAT gateways, preventing bottlenecks and improving throughput in architectural designs.

Explore egress-only internet gateways for IPv6-enabled VPCs to let EC2 instances reach the internet while preventing inbound connections like a NAT gateway.

Explore denial of service concepts, including DoS and DDoS, and see practical labs showing how high traffic overwhelms servers and how AWS Shield mitigates these attacks.

Protect workloads from distributed denial-of-service attacks with AWS Shield, offering standard and advanced tiers. Advanced provides real-time visibility and 24/7 DDoS response with credits for Route 53, CloudFront, and ELB.

Explore how web application firewalls inspect HTTP requests and payloads to block malicious content beyond standard network firewalls, with ModSecurity and managed AWS WAF offerings.

Learn how the AWS WAF guards against common web exploits like cross-site scripting and SQL injection through customizable and managed rules, with seamless integration to ALB, API gateway, and CloudFront.

Learn the three core AWS WAF components: rules, rule groups, and web ACL, and how they work with rule actions, geolocation checks, and resource associations to secure applications.

Configure AWS WAF with a web ACL and geo location rule to block traffic from India, using a regional resource and app load balancer. Test shows 403 responses and cleanup.

Explore how a stateful network firewall protects your VPC with intrusion detection and prevention, using domain filtering and IP-based rules (stateless) plus deep packet inspection.

Deploy a network firewall in a VPC with a dedicated firewall subnet and routing via the VPC endpoint and internet gateway, using firewall policies and rule groups to block domains.

Explore hardware security modules and cloud HSM to securely store and manage encryption keys, with tamper-resistance and FIPS 142 level three compliance.

Learn how Cloud HSM operates inside your VPC with security boxes, enabling separation of duties between the database administrator and you, and providing load-balanced, high-availability key management across availability zones.

Discover how AWS Key Management Service encrypts and decrypts data using keys, with command-line interface operations and base64 encoding. See its integration with S3 and EBS for protecting large-scale files.

Learn how to create a customer managed key (CMK) in AWS KMS, assign admin and user permissions, and perform encryption and decryption using the AWS CLI.

Discover how envelope encryption with a customer master key and data keys in KMS secures data by producing plaintext and ciphertext keys, encrypting data, and decrypting via the decrypt interface.

Learn how scheduled deletion safeguards prevent irreversible loss of production data by delaying key deletion, enabling disablement, and blocking cryptographic operations during a seven to 30 day waiting period.

Block a malicious IP across a VPC by using a network ACL at the subnet level, with inbound and outbound deny rules, complementing security groups.

Explore how network NACL rule ordering works, including lowest-number evaluation, automatic subnet application, inbound and outbound rules, ephemeral ports, and why proper allow and deny sequences matter for VPC traffic.

Explore how Amazon Macie uses machine learning to discover and protect sensitive data in S3 backups, flagging plaintext credentials and PII. Inventory buckets, monitor access, and support custom identifiers.

Test the amazon macie setup by creating an s3 bucket in north virginia, uploading sensitive files, and running a scan with recommended data identifiers, then review findings and job status.

Explore GuardDuty, AWS’s managed threat detection service that analyzes logs to identify malicious activity, breaches, and malware across EC2, IAM, and more, with automatic findings.

Enable Amazon GuardDuty and explore its findings dashboard, including sample findings, severity levels, and EC2 details, while noting the 30-day trial, required permissions, and export options.

Centralize all GuardDuty findings across multiple accounts into a single administrator account, inviting member accounts and viewing consolidated results from a single dashboard.

Learn how to set up centralized GuardDuty findings by inviting a member account, enabling GuardDuty, and sharing findings with the administrator, with filtering by account ID.

Explore Amazon Inspector, an automated vulnerability management service that scans EC2, Lambda, and ECR workloads for software vulnerabilities, reveals criticality, provides remediation steps and CVE details to streamline patch management.

Discover how to use Amazon Inspector to automatically scan EC2 resources and ECR Docker images for vulnerabilities, ensure SSM agent is installed, and assess severities and remediations.

Leverage AWS Security Hub to centralize findings from Inspector, GuardDuty, AWS Config, and more, then analyze, identify, and prioritize issues with CSPM across CIS, PCI DSS, and NIST.

Understand how HTTPS secures web communication by using certificates, public and private keys, and a TLS handshake to establish a temporary symmetric key, preventing eavesdropping and tampering.

Explore how AWS Certificate Manager issues trusted certificates for your domain and integrates with load balancers. Learn why private keys are not exposed and how expiry reminders keep traffic secure.

Learn to issue a public certificate with the AWS certificate management service using DNS validation and apply the issued certificate to Cloud Front ILB and EPA Gateway.

Discover how AWS Control Tower automates governance of a multi-account environment, enabling single sign-on, centralized logging, security guardrails, and automated account creation with account factory.

Learn how AWS Firewall Manager centralizes and standardizes firewall rules across multiple accounts and applications, enabling centralized protection for VPC resources with Network Firewall, Route 53, and DNS Firewall.

Explore how secrets management replaces hardcoded credentials by securely storing and rotating credentials with AWS Secrets Manager and Hashicorp Vault. Learn about encryption, access control, and lifecycle auditing.

Explore the basics of AWS Secrets Manager, store your first secret with encryption options, use API keys or tokens, and enable rotation with lambda while learning retrieval with permissions.

Learn how to rotate secrets with secrets manager using a lambda function on a schedule to update both the secret and the database, with templates for common use cases.

Replicate secrets across regions to support high availability and disaster recovery, enabling Secrets Manager replication, rotation propagation, and promoting replicas to standalone when needed.

Identify resources shared with external entities across accounts using the IAM access analyzer. Validate IAM policies against grammar and best practices, and generate policies from CloudTrail activity.

Create and configure the IAM access analyzer to generate findings on cross-account access, including shared EBS snapshots and bucket policies. Review and archive findings, then re-scan to verify resolution.

Explore how Amazon CodeGuru uses machine learning to boost code security, quality, and performance through CodeGuru Security, CodeGuru Profiler, and CodeGuru Reviewer. Detect vulnerabilities and hard-coded secrets, and provide recommendations.

Learn how aws audit manager automates evidence collection and continuous compliance across frameworks like pci dss, using data sources such as aws config and cloudtrail to move beyond point-in-time checks.

Explore how AWS CodeBuild, a fully managed build service, compiles code, runs tests, and stores artifacts in S3, enabling automated deployment to production.

Discover how AWS CodeDeploy automates deploying application binaries from S3 to production servers, with validations and flexible deployment configurations, including all at once, half, or one-at-a-time deployments.

Learn how AWS CodePipeline automates the release pipeline by orchestrating CodeBuild and CodeDeploy to build, test, and deploy GitHub code to staging and production, with optional manual approval.

Learn how launch templates store EC2 launch parameters, including AMI, instance type, security groups, and advanced settings, enabling consistent, versioned deployment for organizations.

Create and manage launch templates to deploy EC2 instances, modify versions, and launch from the template with AMI, instance type, key pair, and security settings.

Learn how EC2 auto scaling automatically adjusts the number of instances based on load, driven by CPU utilization and CloudWatch metrics, using dynamic, manual, scheduled, and predictive scaling.

Explore the base concepts of EC2 auto scaling, including auto scaling groups, capacity settings (minimum, desired, maximum), launch templates, health checks, and scaling policies like dynamic, predictive, and scheduled actions.

Explore how EC2 auto scaling groups use launch templates to deploy instances with a chosen ami, instance type, and security group. Understand manual scaling, health checks, and capacity settings.

Explore the simple scaling policy, a basic auto scaling mechanism that adjusts EC2 instances in an auto scaling group with CloudWatch alarms, scaling out or in after cooldown.

Explore configuring a practical simple scaling policy with a CloudWatch alarm tied to an auto scaling group, demonstrating scale-out on CPU utilization and steps toward scale-in.

Use the schedule scaling policy to automatically adjust an auto scaling group's desired capacity at set times, increasing or decreasing EC2 instances for predictable traffic and cost savings through recurrence.

Understand how step scaling policy in auto scaling groups maps CPU utilization ranges to progressive capacity adjustments, using CloudWatch alarms to add EC2 instances as thresholds are crossed.

Explore how EC2 auto scaling lifecycle hooks enable custom actions before an instance is terminated or launched, including pending and terminating waits, deregistering from antivirus, and log backups to S3.

Learn to configure a terminating lifecycle hook on an auto scaling group, run actions such as backing up logs to S3, and complete the lifecycle action to terminate the instance.

Explore how AWS Config records configuration changes and provides a timeline for resources, enabling audit and compliance through conformance packs and managed rules.

Explore how to set up AWS Config with one-click setup, apply AWS managed rules such as approved AMI by ID, and view resource inventory, timelines, and compliance.

Discover how AWS config rules evaluate resource compliance using detective and proactive modes. Learn how proactive checks prevent misconfigurations before creation and how CloudFormation gates deployments.

Explore AWS config aggregator to centralize config and compliance data across multiple accounts and regions, including organization-wide data access, queries, and essential authorization steps.

Learn to set up an AWS config aggregator across multiple accounts, authorize the aggregator, and verify resource inventories from different regions in a practical walkthrough.

Upload your code to elastic beanstalk and choose a preset platform to auto-provision resources, load balancing, autoscaling, and monitoring with logs via the central console.

Explore a practical Elastic Beanstalk workflow: create an application, launch a Docker-based web server environment, upload a version, apply presets, and monitor with CloudWatch.

Explore how AWS Elastic Beanstalk deployment policies manage version updates across EC2 instances for production environments, including all at once, rolling, immutable, and blue-green strategies.

Discover rolling deployments with AWS Elastic Beanstalk, deploying newer app versions batch by batch across two EC2 instances and draining the first before switching traffic.

Elastic Beanstalk rolling with additional batch deployment. Launches a new EC2 batch, registers it with the load balancer, then deploys the newer version to existing instances with zero downtime.

Explain blue/green deployment in Elastic Beanstalk with blue and green environments, traffic swapped via CNAMEs, and quick rollback; explore DNS routing and environment swaps as methods.

Learn how to implement blue/green deployment in AWS Elastic Beanstalk by creating blue and green environments, swapping CNAMEs, and validating traffic routing.

Automate the creation of hardened golden AMIs with the EC2 image builder, from base images through hardening and testing. Integrate with CIS benchmarks and inspector for secure, compliant images.

Build a golden image pipeline with EC2 image builder by creating an IAM role and a base Amazon Linux image, then add CloudWatch and Go components and run boot test.

Explore Amazon Kinesis for real-time streaming data: understand producers, streams, and consumers, and how the service handles storage and processing to deliver timely insights.

Explore Amazon Kinesis capabilities, including data streams, firehose, analytics, and video streams, for capturing and processing streaming data. See how data can move to S3 or Splunk and enable analytics.

Ingest, search, and visualize data with Amazon OpenSearch, using dashboards to explore operating system usage; OpenSearch is a fork of Elasticsearch with quick setup in 15–20 minutes.

Explore OpenSearch storage tiers, including hot data nodes with EBS, ultra warm caching of S3 data, and cold storage, plus master and data node roles and cost implications.

Explore how Amazon Athena analyzes large log data in S3 with standard SQL queries to quickly derive insights from CloudTrail, CloudFront, and other logs.

VPC flow logs act as a visitor register for your AWS environment, capturing IP traffic to and from network interfaces and helping you monitor security events in CloudWatch.

Explore how AWS service quotas prevent overprovisioning and abuse by enforcing per service limits, with adjustable quotas and a hands-on demo of EC2 Elastic IP and quota increase processes.