AWS Certified DevOps Engineer - Professional 2026 [NEW]

Learn how CI/CD pipelines automate building, testing, approving, and deploying code from git to staging and production, with continuous integration, delivery, and deployment in real-world DevOps workflows.

Learn how to automate software builds with AWS CodeBuild, a fully managed build service that fetches code, compiles it, runs tests, and stores ready-to-deploy binaries as artifacts in S3.

Designs a practical AWS CodeBuild workflow that fetches code from GitHub, compiles it with gcc, and stores the hello world binary in an S3 bucket via a buildspec.

Explore how AWS CodeDeploy fetches the binary from S3, deploys to production, starts and validates the app, and supports staged, blue-green, and in-place deployments.

Master the three core CodeDeploy components: application, deployment group, and deployment. Learn how appspec files, deployment groups, load balancer settings, and the code deploy agent coordinate deployments to EC2 instances.

Learn to configure AWS CodeDeploy to fetch a binary from S3 and deploy it to EC2 instances, using IAM roles, CodeDeploy agent, appspec, and deployment groups.

Discover how AWS CodePipeline automates the release pipeline from source to build and deploy, integrating CodeBuild and CodeDeploy with GitHub, S3, and EC2 for staging and production deployments.

Connect AWS CodeBuild and CodePipeline to private repositories such as GitHub and Bitbucket by configuring credentials and connections, enabling builds, triggers, and GitHub actions.

Build and automate a complete AWS CodePipeline with CodeBuild and CodeDeploy using GitHub as source, AppSpec YAML, and deploying to EC2, including automatic change detection.

Explain how CodePipeline creates and passes artifacts through source, build, and deploy stages, storing input and output artifacts in the S3 bucket and managing their locations.

Learn how CodePipeline links source, build, and deploy stages with pausing and resuming transitions and a 30-day rule, including manual approval between build and deploy.

Troubleshoot CodePipeline stage failures by verifying source access to GitHub, correct buildspec.yml and artifacts in S3, and valid appspec YAML with a healthy EC2 CodeDeploy agent, logging to CloudWatch.

Compare the old vertical and new horizontal CodePipeline console experiences and learn how to switch between them, with both options available across regions.

Explore AWS CodeDeploy app spec hooks and the deployment lifecycle, including application stop, download bundle, before install, install, start, and validate service, plus ELB traffic hooks.

Deploy a hello world app to production with Elastic Beanstalk by uploading your code and letting it auto provision infrastructure, including load balancing, autoscaling, and platform-specific packages.

execute a practical elastic beanstalk workflow by creating an application, setting up a docker web environment, uploading a version, configuring presets and roles, and managing updates, logs, and deletion.

Explore AWS Elastic Beanstalk deployment policies, including all at once and blue-green strategies, using a two-instance environment to compare version one and version two deployments and uptime.

Set up a highly available AWS Elastic Beanstalk environment with load balancing, auto scaling, and deployment policies like rolling and rolling with additional batch traffic splitting.

Demonstrates applying the all at once deployment policy in a high availability Elastic Beanstalk environment, and reverts to a stable version using base EB apps after deploying a faulty app.

Elastic Beanstalk uses rolling deployment to update a two-instance environment one batch at a time, removing the first instance from the load balancer and deploying the new version.

this practical rolling deployment video shows configuring batch size, deregistering ec2 instances from the load balancer, handling a faulty deployment, and restoring with a base version.

Elastic Beanstalk uses rolling with additional batch to deploy a newer version by launching a new EC2 batch, adding it to the load balancer, then updating existing instances.

Learn how the immutable deployment policy creates a new auto scaling group with fresh EC2 instances, deploys the new version, and shifts traffic by terminating old instances after health checks.

Learn blue/green deployment in Elastic Beanstalk by swapping traffic from blue to green and back, with options like DNS Route 53, or swapping the launch configuration.

Create a blue and green deployment in Elastic Beanstalk by spinning up two single-instance environments, configuring a Docker-based green build, and swapping CNAMEs to route traffic.

Learn to use the EB CLI to deploy a PHP application to Elastic Beanstalk from an EC2 Ubuntu instance, covering init, create, health checks, logs, and termination.

Explore elastic beanstalk extensions (ebextensions) to customize production environments with yaml scripts, installing packages, creating users and groups, managing files and commands without ssh.

Compare commands and container commands in Elastic Beanstalk, explain when each runs during deployment, and highlight the leader_only_true directive for DB migrations and single database setup.

Explore canary deployments, gradually routing a portion of traffic to a new environment with Route 53 weighted routing policies and load balancers.

Leverage lambda at the edge to customize cloudfront content by running at viewer request, origin request, origin response, and viewer response, enabling authentication, dynamic origin selection, and header handling.

See how lambda at the edge integrates with cloudfront to rewrite origin request uris and serve control or treatment pixel images based on an experiment and cookie check.

Explore how A/B testing splits traffic between two web page variations to compare conversions, monitor metrics, and use Route 53 weighted records to gradually roll out a newer interface.

Understand the git branching model and why developers create feature branches from master. Keep the master branch stable to protect the CI/CD pipeline while teams work on isolated features.

Automate pull request validation by running code build tests defined in buildspec.yml, detecting CloudFormation template issues, and reporting results back to the PR via comments.

Set up a PR validation pipeline with CloudFormation templates, CodeCommit, CodeBuild, Lambda functions, and CloudWatch events to automatically validate pull requests and post status updates.

Explore automated tests within a ci/cd pipeline, including unit, integration, regression, end-to-end, and UI tests, plus test-driven development and artifact and environment validation.

Explore CodeDeploy deployment configuration to control rollout across EC2, Lambda, and ECS; EC2 options all at once, half, one at a time; Lambda/ECS canary, linear, and all at once.

Explore CodeDeploy deployment types, in place for EC2 on-prem, and blue-green with replacement environments, and traffic shifting for Lambda and ECS via canary, linear, or all-at-once.

Master CodeDeploy troubleshooting across EC2 on-premises, Lambda, and related targets by diagnosing lifecycle script errors, health-check misconfigurations in ELBs, and autoscaling issues to ensure reliable deployments.

Explore CodeDeploy deployment settings for blue-green environments, including traffic routing timing, options to terminate or keep original instances, and the ability to reroute traffic if the newer environment has issues.

Explain the CodePipeline service role, how to attach a rule with required permissions for CodeCommit and CodeDeploy, and how to tailor IAM policies and JSON policies for secure pipelines.

Explore artifact encryption in CodePipeline, choosing AWS managed or customer managed keys, configuring S3 encryption with KMS, and applying bucket policies to ensure server-side encryption in production.

Explore AWS CodePipeline stage actions, enabling serial action groups or parallel actions within stages, and master run order concepts and manual approvals for pipeline workflows.

Deploy resources with CloudFormation through CodePipeline, integrated with CodeCommit, to create or update resources in the deploy stage while using proper CodePipeline and CloudFormation permissions.

discover how to deploy a CloudFormation stack through CodePipeline using a CodeCommit-stored template, with a simple iam-user.yaml that creates an IAM user.

Explore cross-account codepipeline architecture across dev, tools, test, and prod accounts, enabling secure CodeCommit fetch, CodeBuild, and CloudFormation deployments via IAM roles, CMK, and S3 bucket policies.

Explains change detection options in code pipeline, comparing CloudWatch events and code pipeline polling, and shows EventBridge triggers pipelines on code changes; CloudWatch events are recommended for most sources.

Explore AWS CodeArtifact, a secure central artifact repository for binaries and public packages, enabling fast deployment to EC2 and CI/CD with public upstream repositories and access controls.

set up an aws codeartifact repository by creating a domain and a demo repo, connect an ec2 instance with an iam role, and install packages via pip to understand pricing.

Explore how AWS Systems Manager acts as a command center, coordinating run command, parameter store, patch manager, inventory, and sessions to manage and monitor EC2 instances from a single console.

Configure and manage EC2 via Systems Manager by installing and running the SSM agent, attaching an IAM role with the Amazon SSM managed instance policy, and verifying connectivity.

Explore Session Manager in AWS Systems Manager, enabling browser-based or CLI access to EC2 instances without open ports or SSH keys, with RBAC and audit logging to CloudWatch or S3.

Connect to an EC2 instance using Session Manager, then configure CloudWatch logs and IAM permissions to audit commands, set idle timeout, and review log groups for command history.

Run command in AWS Systems Manager executes scripts on managed instances without SSH, enabling antivirus installs across many servers. Use tags or manual selection and command documents like shell scripts.

Discover how parameter store centralizes configuration settings and secrets. Learn the three parameter types—string, string list, and secure string—and how KMS encryption and app queries protect values.

Create parameters in the AWS parameter store using string or secure string, and decrypt secure values with a KMS key while your IAM role can read them.

Compare standard and advanced parameter store tiers in AWS, covering limits, policies, sharing, and pricing; learn to reference parameters with SSM syntax and organize them hierarchically.

Automate operational tasks across AWS resources with AWS Systems Manager automation, using codified runbooks to perform scalable EC2 actions, from creating images to quarantining compromised instances.

Explore how to execute a Systems Manager automation runbook to stop an EC2 instance, understand the workflow, and review status and results.

Automate AWS operations with SSM runbooks—AWS managed or custom—that define steps, run commands, and scripts for memory dumps and quarantining EC2 instances across accounts and regions.

Learn how AWS Systems Manager Patch Manager automates scanning for missing patches, applies updates, and enforces baselines and maintenance windows to protect systems from vulnerabilities.

Discover how AWS Systems Manager compliance scans patch and configuration across managed instances, flags non-compliant resources, and integrates with Security Hub and Chef Inspec for audits.

Explore AWS systems manager inventory, which collects metadata from managed nodes, including packages, services, Windows registry, network, and CPU details, and stores data in S3 for Athena queries across nodes.

Hybrid activation lets AWS Systems Manager manage on-premise and multi-cloud servers using activation ID and code, with instance limits and expiration to control registration of mi- prefixed nodes.

Explore hybrid activation by comparing standard and advanced instance tiers, highlighting session manager availability, per-region limits, and suitability for small to medium versus large environments.

Automate infrastructure with infrastructure as code to deploy repeatable setups across development, staging, and production. Use tools like CloudFormation, Terraform, and Ansible to speed delivery and reduce errors.

Deploy a minimal VPC via CloudFormation using a yaml template to provision an AWS EC2 VPC with CIDR block 1070 700 16 and tags for name and environment.

Explore how CloudFormation uses references to enforce stack dependencies, ensuring a subnet is created after its VPC, and how to deploy and update templates to manage ordering.

Explore how the depends on attribute in CloudFormation ensures correct resource creation order, making the RDS database deploy before EC2 instance and handling stack deletion so EC2 is terminated first.

Explore CloudFormation validation and semantic post API call errors with examples like a typo in resources and an S3 bucket failure, then learn rollback works and how to disable it.

Explore CloudFormation change sets to preview delta changes before updating a stack, perform a dry run, and safely replace resources like subnets in a production environment.

Explore how CloudFormation parameters enable dynamic values in templates, letting developers choose instance types during stack deployment. Set defaults and allowed values, like t2.micro or m1.small, to avoid hardcoding.

Learn how the CloudFormation deletion policy attribute preserves or snapshots resources when you delete a stack, using retain and snapshot options on resources like S3, RDS, and EBS.

Explore how CloudFormation stack sets enable centralized creation, update, and deletion of stacks across multiple accounts and regions, with a single operation.

Deploy resources across multiple regions and accounts with AWS CloudFormation stack sets, using administration and execution roles to enable cross-account access and manage stack instances.

Explore CloudFormation nested stacks to centralize reusable components like EC2 instances and S3 buckets, using template URLs and outputs to reference across parent and nested stacks.

Explore CloudFormation creation policy attributes, differentiating resource creation from readiness. See how EC2 and application configuration use success signals to complete a stack, with timeout, count, and wait condition.

Learn how weight condition and weight condition handle pause CloudFormation stack creation until a pre signed URL receives a success or failure signal, with timeout and rollback behavior.

Explore iam service roles and pass roles, enabling CloudFormation to perform tasks assuming a role with policies. Understand how pass role permissions enforce least-privilege control who can use these roles.

Explore AWS SAM, the serverless application model that extends CloudFormation using JSON or YAML templates. Learn to package, test, and deploy with the SAM CLI to S3 and CloudFormation stacks.

Explore AWS step functions as a visual workflow service that coordinates AWS Lambda, SNS, and DynamoDB, using a choice logic to run tasks in parallel or sequentially.

Configure a step function to coordinate Lambda functions for Terraform and AWS, using a code-based state machine with if/else choices and ARN-configured endpoints.

Leverage AWS Step Functions for security incident response by automating admin access policy approvals with EventBridge, Lambda, and API Gateway notifications, detaching policy on rejection.

Learn how aws license manager enforces software licenses across aws and on premise, using vcpu, cores, sockets, or instances to prevent overprovisioning and support automated discovery, cross-account management, and auditing.

Launch an EC2 from a commercial AMI, create a self-managed license in License Manager, associate it with the AMI, and enforce vCPU-based limits to prevent overprovisioning.

Discover how the AWS Service Catalog securely provisions development environments using CloudFormation templates or Terraform, reduces overprovisioning, and enables cross-account portfolio sharing for governed IT resources.

Explore AWS service catalog fundamentals, including products as infrastructure blueprints, portfolios that control access, and launch constraints using IAM roles to provision resources via CloudFormation or Terraform.

Learn to configure AWS service catalog end-to-end, from creating a CloudFormation-based product and portfolio to granting user access and launching a dev environment that provisions an EC2 instance.

Explore how RDS read replicas offload read traffic from the primary database, enable multi-region replication, and support scalable analytics while keeping writes on the primary.

Create a primary database, provision an RDS read replica with configurable instance class and destination region, and verify replication while outlining cost-saving deletion steps.

Explore how rds multi-az deployments provide automatic failover from a primary to a standby database across zones, driven by replication, with a single endpoint.

Explain multi-az deployment types in RDS, detailing the older multi-az instance with one standby and the newer multi-az cluster with writer and two readers across separate availability zones.

Explain how RDS event notification uses SNS to deliver alerts for categories like availability and low storage, and demonstrate configuring an event subscription for DB instance restarts.

Explore Amazon Aurora, a MySQL and PostgreSQL compatible relational database built for the cloud, delivering enterprise performance with open source efficiency and scalable storage with cluster, reader, and instance endpoints.

Discover how the Aurora Global Database spans multiple regions with asynchronous replication, enabling fast local reads and disaster recovery, and how to promote a secondary region to master during failover.

Learn Aurora scaling, including storage auto scaling, instance class tuning, up to 15 read replicas, and Aurora auto scaling driven by CPU or connections.

Learn how Aurora Serverless automatically scales a database workload, pauses when idle, and resumes on demand to cut costs. Explore architecture, including proxy fleet, a warm instance pool, and monitoring.

Explore the core DynamoDB components—tables, items, attributes, and the primary (partition) key—within a schema-less design, and see how attributes carry types like string, number, and boolean.

Explore the DynamoDB consistency model, detailing eventual and strong reads, their timing and throughputs, and how replication across availability zones ensures availability and durability.

Explore how read and write capacity units control DynamoDB throughput, balancing cost and performance by configuring strong and eventual consistency, item size, and auto scaling.

Explore capacity modes in DynamoDB, including provision mode and on-demand mode, and learn how auto scaling adjusts read and write capacity units to prevent throttling.

DynamoDB streams capture the time-ordered item-level changes, log them for 24 hours, and expose old and new images via CloudWatch for auditing and reconstruction.

Explore DynamoDB global tables, a fully managed multi-region, multi-active database that replicates data across regions to reduce latency and provide eventual consistency through last writer wins.

Learn how the DynamoDB accelerator (DAX) provides a managed in-memory cache that delivers up to ten times faster reads by serving frequently accessed data from a DAX cluster.

Discover how the AWS database migration service moves data from on-premises to the cloud, or cloud to cloud, across relational, NoSQL, and data warehouse stores.

Centralize backup planning with AWS backup, automating daily and monthly backups across services. Configure retention and life-cycle policies, including cross-region, cross-account, and on-premises support.

Create an AWS backup plan, configure retention and schedules, enable on-demand backups, and assign resources (Aurora, DynamoDB, EBS, S3) using a template or custom plan.

Master disaster recovery models in AWS, from backup and restore to multi-site, detailing RPO and cost with pilot light and warm standby using S3, Glacier, Direct Connect, and Route 53.

Explore designing highly available architectures by balancing recovery time objective (RTO) and recovery point objective (RPO), using regional failover, backups, and multi-region strategies to optimize cost and availability.

Explore advanced Route 53 capabilities, including public and private hosted zones, routing policies such as weighted, latency, and geolocation, health checks, DNS firewall, and traffic flow.

Explore how Route 53 health checks monitor endpoint health and performance by sending requests, classify endpoints as healthy or unhealthy, trigger alarms, and rely on global health checkers.

Implement Route 53 health checks from scratch by configuring an http endpoint, launching an EC2 instance with Nginx, and validating health using health checker regions and 200 responses.

Explore the three Route 53 health check types—http/https, tcp, and http/https with string matching—and learn their health criteria, the 5120-byte string matching limit, and practical configuration tips.

Explore Route 53 routing policies, including simple, failover, weighted, latency-based, geolocation, and multi value routing, and how to apply them in a hosted zone.

Understand how Route 53 failover routing redirects traffic to a healthy primary EC2 and, if unhealthy, to a secondary maintenance page hosted on S3, guided by health checks.

Implement a failover routing setup with Route 53 by configuring a primary EC2 service and a secondary S3 maintenance page, linked to health checks and a private hosted zone.

Explore how Route 53's weighted routing policy distributes traffic by weight across record sets, enabling gradual rollout, testing, and traffic control using zero-weight to stop routing.

Explore latency-based routing in Route 53, directing user requests to the region with the lowest latency and illustrating with a practical demo and multi-region setup.

Explains elastic load balancing in aws, covering application, network, gateway, and classic types, routing decisions, and key integrations such as auto scaling, web application firewall, certificate manager, and global accelerator.

Explain how the OSI model shapes load balancers, contrasting layer seven application load balancers with layer four network load balancers, and show routing based on HTTP headers like user agent.

Discover how application load balancers operate at the application layer by inspecting http headers. Learn to use host header and user agent header for path-based and host-based routing effectively together.

Explore how listeners and target groups work with a load balancer, configuring http and https protocols, defining listener rules, and forwarding requests to target groups.

Set up a nginx-backed EC2 instance and an application load balancer with an http listener, create a target group, test traffic, and ensure port 80 is open.

Learn how network load balancers operate at the transport layer to support non-http protocols like TCP, UDP, SSH, DNS, and FTP, while handling millions of requests per second.

Set up an ec2 instance, a tcp target group on port 22, a network load balancer with a tcp listener, and test ssh via the nlb dns, then clean up.

Ensure your load balancer associates with the correct availability zones to route traffic to EC2 instances. Enable availability zones to avoid targets remaining unused and achieve healthy traffic flow.

Compare cross zone load balancing when disabled and enabled, noting that application load balancers always have it enabled by default, while network and gateway balancers require enabling.

Enable and analyze elb access logs, which capture timestamp, ip address, headers, uri, and user agent, then deliver logs to an s3 bucket for dashboards and alerts.

Enable elastic load balancer access logs by creating an S3 bucket in the same region with a bucket policy, and configure the alb to push logs.

Explore the dual stack ip address type for elastic load balancers, enabling ipv4 and ipv6 connectivity on internet-facing albs and the ipv6 cidr block prerequisites for enabling this.

Learn how launch templates store EC2 launch parameters, including AMI, instance type, security groups, storage, and advanced settings, so teams launch pre-configured instances consistently via versioned templates.

Learn to create and customize a launch template, configure AMI, instance type, key pair, subnet and security group, and launch an EC2 instance from a template, including versioning for flexibility.

Explore how EC2 Auto Scaling automatically adjusts the number of instances based on load and CPU utilization, using dynamic, scheduled, manual, and predictive policies with CloudWatch metrics.

Explore the base concepts of EC2 auto scaling, including auto scaling groups, capacity settings (minimum, desired, maximum), launch templates, health checks, and dynamic, predictive, and scheduled scaling policies.

Explore how an EC2 auto scaling group uses a launch template, security groups, and health checks to automatically launch or terminate instances, including manual scaling and scaling policies.

Explore the simple scaling policy in AWS auto scaling, driven by CloudWatch alarms and CPU utilization thresholds to scale out or in, with a cooldown to stabilize the system.

Configure a simple scaling policy in an auto scaling group by creating a CloudWatch alarm on CPU utilization to trigger a scale-out action that adds one EC2 instance.

Schedule scaling policy automatically adjusts an auto scaling group's desired capacity at times to handle traffic spikes and save costs, increasing before 9 a.m. daily and decreasing after 6 p.m.

Learn how step scaling policies in auto scaling groups use CloudWatch alarms and range-based CPU thresholds to automatically add capacity, with incremental adjustments for each metric band.

Learn how EC2 auto scaling lifecycle hooks pause instances during scale-out and scale-in, enabling custom actions like deregistering from antivirus server and backing up logs to S3 before termination.

Add a terminating lifecycle hook to an auto scaling group to back up logs to S3, then run AWS auto scaling complete lifecycle action with continue.

Discover how EC2 auto scaling group processes—launch, terminate, health check—and suspending them affects scaling, with a demo showing desired capacity drop to zero and termination pauses.

Explore how EC2 auto scaling uses EC2 status checks, ELB health checks, and custom health checks to replace unhealthy instances.

Learn how auto scaling group tags propagate to ec2 instances, enable propagation, and use launch templates to tag volumes, noting ebs volumes aren't propagated by default.

Learn the basics of application programming interfaces and how an api acts as a secure intermediary to access backend data, with a weather data use case.

Explore how API gateway serves as the front door to backend services, enabling high availability, security, authentication, throttling, and caching for scalable APIs.

Compare REST and HTTP APIs in API Gateway; REST APIs offer more features for production, while HTTP APIs stay cheaper and simpler.

Create a simple http API using API gateway that invokes a Lambda function, returning hello from Lambda, with a node.js runtime setup.

Create a rest api via api gateway that invokes a backend lambda function, test the get method, and deploy to a dev stage to obtain the invoke url.

Explore api keys to control access through api gateway using the x api key header. Learn how usage plans pair with keys to set throttling and quotas.

Master API gateway logging by examining execution and access logs, tracing request flow from client to Lambda, and using CloudWatch metrics for errors, latency, and geolocation insights.

Implement canary deployment at the API gateway level by shifting traffic between base and canary stages. Configure stage distribution options like 50/50 or 90/10 and monitor logs and latencies.

Understand lambda concurrency and how in-flight requests initialize separate execution environments. Learn how environments are reused and how automatic scaling and limits affect latency.

Compare reserved concurrency and provisioned concurrency in AWS lambda, learn how reserved guarantees capacity for key functions and provisioned pre-initialized environments to reduce cold starts.

Learn how elastic container registry acts as a fully managed central repository for Docker images, supporting private and public repositories and seamless AWS integration with EC2.

Explore practical steps to create a private ACR or ECR repository on EC2, install Docker, and push the Engine X image to the registry.

Compare ECS and EKS for container orchestration on AWS, outlining open source status, complexity, and community support; choose ECS for simple AWS integration or Kubernetes for multi-platform deployment.

Explore the basics of elastic container service (ecs) as a container orchestrator that runs docker containers on ec2 instances using images from ecr and manages deployments via the ecs console.

Explore the three core ECS components—task definition, task, and service—describing containers, images, ports, and storage, then deploy nginx or apache tasks and rely on service for auto-recovery.

Explore how to create an ECS cluster, define tasks, and deploy an nginx service on EC2 with port mappings, security groups, and revision updates.

Discover how elastic Kubernetes service offers a managed cluster on AWS, delivering high availability, security, and tight integration with services like ECR, IAM, and load balancing.

Explore the essential steps to create an ECS cluster using the AWS console, including configuring the cluster service role, Kubernetes version, and node group with IAM and ECR permissions.

Deploy and configure a Kubernetes cluster on AWS by creating an ECS cluster, setting up IAM roles, VPC, subnets, security groups, a node group, and kubectl, then deploy nginx.

Learn how AWS Fargate replaces EC2 management with a serverless, pay-as-you-go compute engine, letting your container orchestrator deploy containers directly while you focus on building applications.

Explore how FSx provides a simple, fully managed, secure file system platform with Lustre, Openzfs, Windows file server, and NetApp ONTAP, integrating with S3 and KMS.

Explore how Amazon FSx for Lustre integrates with Amazon S3 to load data for processing on EC2, with scratch versus persistent deployments and lazy loading for ML and HPC workloads.

Explore how transit gateways centralize vpc connectivity, replacing complex vpc peering. Attach multiple vpcs and on-prem networks such as Direct Connect and site-to-site vpn to enable cross-vpc communication.

Understand how VPC endpoints enable private, internet-free communication from isolated subnets to AWS services such as S3, using gateway, interface, or gateway load balancer endpoints.

Explore the architecture of Gateway VPC endpoints, how route tables and prefix lists divert private subnet traffic to S3 or DynamoDB, and how AWS manages the service CIDR ranges.

Understand how interface endpoints create an elastic network interface with private IPs in a subnet, acting as the entry point for traffic to supported AWS services via the VPC endpoint.

Implement interface endpoints in a VPC by creating the endpoint, selecting the VPC, subnets, and a security group, and verify traffic uses the interface endpoint IP.

Explore how AWS VPC endpoint services enable private connectivity from a consumer VPC to a service provider VPC via interface endpoints, avoiding internet traffic and VPC peering CIDR issues.

Implement VPC endpoint services to connect a service consumer to a provider over the AWS private network using an interface endpoint and a network load balancer.

Learn to safely terminate endpoint services resources by detaching the interface endpoint, deleting the endpoint service, and then terminating the load balancer, instances, and target group to avoid AWS costs.

Explore the basics of EC2 pricing including on-demand, reserved instances, savings plans, spot instances, and dedicated hosts, and learn cost optimization strategies with the pricing calculator.

Reserve EC2 capacity in a specific availability zone with on-demand capacity reservations, without long-term commitments.

Learn how EC2 fleet combines spot and on‑demand instances across types and availability zones, using target capacity and weighted capacity to meet your 16 vcpu needs cost‑effectively.

Configure an EC2 fleet with a launch template, set weighted and target capacity, and manage spot and on-demand instances via the AWS CLI, including creating and deleting fleets.

Explore allocation strategies for spot instances and how spot instance pools affect availability. Compare lowest price, diversified, and capacity optimized approaches to balance cost and interruptions for your fleet.

Explore how AWS Elastic File System scales automatically from gigabytes to petabytes and can be attached to EC2 instances, Lambda, and ECS for shared storage via the NFS protocol.

Deploy and test an elastic file system by creating an elastic file system in a vpc, launching ec2 instances, mounting via nfs, sharing storage across servers, and cleaning up resources.

Discover how EFS file system policies, as resource-based controls, enable granular access management for EC2 mounting, including enforcing read-only by default, preventing anonymous access, and IAM role–based read/write rights.

Explore how AWS EFS access points create application-specific entry points to isolate folders, allowing apps to mount dedicated access points and view only their designated app folders.

Demonstrate a practical aws efs access points setup by creating two folders, app one and app two, mounting them via access point ids with tls to ensure isolation and permissions.

Explore cross-account architecture for mounting an EFS file system to resources in another AWS account, including VPC connectivity and assume role based access via cross-account IAM roles.

Explore how AWS Health delivers service event notifications, distinguishes account-specific from public events, and enables automations with Eventbridge, Lambda, and Slack notifications to respond to issues.

Connect on premise applications to cloud storage with the storage gateway and enable S3 access through a file gateway using NFS or SMB without changing the application code.

Set up and test an S3 file gateway on EC2, create a file share for NFS or SMB, and mount it on Linux to access the S3 bucket.

Compare cached and stored volume gateways, noting local cache vs on premise full data with asynchronous S3 backups, and summarize tape gateway with VTL and archive to S3 Glacier.

Learn how the AWS Compute Optimizer uses machine learning to detect overprovisioning and under provisioning, and recommend EC2 instance types, auto scaling groups, EBS volumes, ECS Fargate, and Lambda resources.

Explore Amazon OpenSearch at a high level: ingest, search, and visualize data from logs and other sources, with dashboards, heatmaps, and a note on its Elasticsearch fork and quick setup.

Explore OpenSearch storage tiers, including hot data nodes with EBS or instance store for fast indexing and searching, and ultrawarm and cold storage backed by S3 for cost-effective queries.

Discover how the unified CloudWatch agent enhances EC2 monitoring by collecting memory and disk usage metrics, netstat, and logs, and routes them to a central CloudWatch dashboard with alarms.

Configure the unified Cloudwatch agent on ec2 to send metrics and logs to Cloudwatch, by creating an iam role, installing, running the configuration wizard, and starting the agent.

Learn how CloudWatch uses namespaces, metrics, and dimensions to organize time-series data, and how to create custom metrics with put metric data and view data points over time.

Explore how CloudWatch Logs Insights lets you search across up to 50 log groups with a purpose-built query language, create visualizations, and identify causes of operational issues efficiently.

Explore how CloudWatch metric filters turn log data into actionable metrics, using filter patterns to search logs, test patterns, and trigger alarms when errors appear.

Learn how CloudWatch Logs subscription filters forward selected log group events to destinations like Kinesis data stream, Lambda, OpenSearch, and Firehose, with customizable patterns.

Discover the basics of VPC flow logs as a visitor register for IP traffic to and from your VPC resources, stored in CloudWatch and used for security dashboards.

Explore CloudTrail log file integrity validation through digest files and SHA-256/RSA signatures that detect tampering, and learn CLI commands to validate logs, view trails, and manage public keys.

Learn how CloudTrail log file validation monitors integrity and how hourly digest delivery affects detection of tampering in real-world scenarios.

learn how AWS X-Ray enables debugging and monitoring of microservice apps through request tracing, showing root causes, performance insights, and visualization of traces.

Implement an Elastic Beanstalk sample with X-Ray enabled, configure the X-Ray daemon and the SDK, and explore the service map, traces, and performance insights from generated traffic.

Discover how Amazon Kinesis enables real-time streaming data by connecting producers, streams, and consumers, and manage storage and processing layers with strong consistency, record ordering, and replayable reads.

Explore Amazon Kinesis capabilities, including data stream, data firehose, data analytics, and video stream, to capture, deliver, transform, and analyze streaming data in real time.

Discover how the AWS personal health dashboard provides personalized alerts, open issues, and event logs for your resources. Configure CloudWatch notifications with SNS or Lambda to automate responses.

Discover how Amazon Athena lets you analyze large log files from S3 and other data sources with standard SQL queries, producing quick insights on OS and browser usage.

Learn how AWS Trusted Advisor analyzes your environment and delivers category-based recommendations across cost optimization, performance, security, fault tolerance, service quotas, and operational excellence.

Learn how AWS config records configuration changes and builds a timeline of resource modifications. Explore its audit and compliance features, conformance packs, and integration with CloudTrail and EventBridge.

Learn to set up AWS Config with one-click setup, configure AWS managed rules such as approved ami by id, and use resource inventory and timelines to identify non-compliant EC2 instances.

Configure the AWS config aggregator across two accounts by enabling config, creating the aggregator, and authorizing the sandbox account in the Singapore region to collect cross-account resource inventories.

integrate AWS config rules with SSM automation to remediate non-compliant resources, such as encrypting S3 buckets and closing open port 22 on security groups, with change manager approval.

Explore Amazon CodeGuru to automatically scan code for security, quality, and performance issues using machine learning, profiling, reviewer analysis, and security detectors across Java, Python, and JavaScript.

Learn how Amazon SQS enables reliable, scalable decoupling of image gatherer and image enhancer via a queue, and why loosely coupled architectures improve availability.

Learn how Amazon SQS uses a dead letter queue to handle unprocessed messages. Configure max receives and monitor receive counts to move messages to the dead letter queue.

Compare standard and FIFO SQS queue types, highlighting ordering, throughput, and duplicates in delivery, and explain when to choose each for production workloads.

Create a fifo queue in AWS SQS and enable content based deduplication. Test sending hello world messages and observe that duplicates are not received when polling.

Configure auto-scaling to launch or terminate EC2 instances based on the SQS queue's approximate number of messages, using CloudWatch metrics to balance cost and speed.

Explore how a message queue using SQS with EC2 workers decouples writes from an AWS database, handling load spikes without downtime and reducing costs, with a small delay in writes.

Explore how AWS Simple Notification Service enables publish-subscribe messaging via topics. Configure endpoints such as email, SMS, HTTP/HTTPS, Lambda, and push notifications, and integrate with CloudWatch for alerts.

Learn how the SNS fanout pattern publishes messages to multiple destinations, including SQS, Lambda, and HTTP endpoints, and how to replicate production data to development environments.

Connect an SNS topic to an SQS queue to enable fan-out, create a topic and a queue, subscribe the queue to the topic, then publish and read messages.

Explore sns topic filtering with filter policies to route messages to selective queues. Learn how message attributes like customer type determine delivery to the priority or normal queues.

Learn how Amazon EventBridge acts as a serverless bridge between event sources and targets, routing real-time events via rules to Lambda, SNS, or CloudWatch logs, enabling event-driven, scheduling capabilities.

Explore concepts of AWS EventBridge, including events, event buses and pipes, rules and event patterns, targets like CloudWatch log group and Lambda, and scheduler and cross-bus routing.

Demonstrates how EventBridge connects an event source, the middleman, and a target by using an event pattern to trigger a CloudWatch log group when an EC2 instance stops.

Configure a system status check alarm to auto recover the EC2 instance by stopping and starting it. Instance auto recovery does not apply to instance status checks.

Configure S3 event notifications to trigger on put and other object events, sending alerts to Lambda, SQS, or SNS, then test by uploading a file.

Learn how AWS Secrets Manager centralizes credentials, enables rotation, and enforces access control, with database and service integrations and audit via CloudTrail and CloudWatch.

Learn to create your first secret in AWS Secrets Manager, choose secret types and encryption keys, configure optional rotation with Lambda, and retrieve secrets with proper permissions.

Rotate secrets with a secrets manager using a lambda function to update credentials and the database on a defined schedule, with templates and cron options.

Replicate secrets across AWS regions to support high availability and disaster recovery. Learn how Secrets Manager replicas, promotion to standalone, and rotation ensure credential continuity for cross-regional apps.

Block a specific IP across a VPC by using network ACLs at the subnet level to deny traffic, while understanding inbound and outbound rules and default ACL behavior.

Explore how stateful and stateless firewalls manage inbound and outbound tcp/ip traffic, with network acls illustrating stateless behavior and security groups enforcing remembered connection states.

Discover AWS network firewall, a stateful managed firewall with intrusion detection for your VPC, using domain and IP filtering, Suricata rules, and TCP flag options.

Deploy a network firewall and configure the firewall subnet. Configure routes, firewall policy, and rule groups with domain and IP filters to control traffic via VPC endpoint and internet gateway.

Explore how denial of service attacks overwhelm servers with malicious traffic, distinguishing dos from ddos, and see a practical lab using kali linux to simulate the attack.

Scale for traffic surges with auto scaling and ELB, decouple app and database with SQS and Elastic Beanstalk, and use CloudWatch, SNS, Shield, CloudFront to distinguish normal from abnormal traffic.

Protect your workloads from DDoS with AWS shield, comparing shield standard and shield advanced, including near real-time visibility and 24/7 DART support during attacks.

Explore Amazon Inspector, an automated vulnerability management service that scans EC2, Lambda, and ECR workloads for vulnerabilities and severity, with CVE IDs and remediation guidance.

Explore how AWS Inspector automatically discovers resources and scans for vulnerabilities, requiring SSM agent on EC2, and assess ECR container images for critical issues.

Explore how AWS Security Hub aggregates findings from GuardDuty, Inspector, AWS Config, and tools into a dashboard, enabling CSPM checks against CIS, PCI DSS, and NIST standards to prioritize issues.

Discover how web application firewalls inspect HTTP requests and bodies to block malicious content, compare ModSecurity with managed AWS and Cloudflare WAFs, and use rule builders and managed rules.

Explore how AWS WAF protects web applications by blocking exploits with geolocation and custom or managed rules, including third-party rule groups, integrated with application load balancers, API gateway, and CloudFront.

Explore identity account architecture to centralize IAM users in an identity account and enable cross-account login via cross-account roles, with its advantages, disadvantages, and alternatives like Identity Center.

Design and test cross-account IAM roles by creating a user in the identity account, a trusted role in the destination account, and enabling role switching.

Explore how AWS Organizations centralizes management of hundreds of AWS accounts through a dedicated management account, enabling consolidated billing and policy enforcement with service control policies and tag policies.

Enable AWS organizations and create a new organization from the console. Add member accounts by creating new ones or inviting existing accounts, then apply policies and leverage consolidated billing.

Design and apply service control policies in AWS organizations, including creating a deny S3 policy, attaching it to an account, and validating permissions by attempting bucket creation.

Group AWS accounts into organizational units within AWS Organization and apply service control policies at the OU level to manage development and production environments, including nested structures.

Learn how to create and manage organizational units in AWS organization, build nested OUs like development and production, move member accounts between OUs, and delete empty units responsibly.

Compare deny list and allow list strategies for service control policies, starting from default full access to explicit denies. Understand benefits, limitations, and practical demos at root and account levels.

Switch from a deny list to an allow list scp strategy by creating and attaching an allow list policy, then remove full access at sandbox and root and verify access.

Explore IAM permission boundaries, which set the maximum actions an identity-based policy can grant, and see how effective permissions result from identity policies, boundaries, SCPs, and session policies.

Learn how AWS secure token service (STS) issues temporary credentials for IAM users and federated identities, enabling role assumption, cross-account access, and short-lived access keys and session tokens.

Explore attribute based access control (abac) as a scalable alternative to rbac, using tags and attributes to grant permissions with a single policy across red and green environments.

Learn how federation links a central identity store, like Active Directory or IPA, with service providers via an identity broker to enable secure single sign-on.

Understand how SAML enables secure single sign-on by moving identities to the identity provider and issuing a SAML assertion to service providers.

Discover how IAM Identity Center enables single sign-on and centralized access to multiple AWS accounts and applications via a unified access portal, with identity sources and pre-integrated apps.

Explore IAM Identity Center concepts, including organization prerequisites, identity source options, and permission sets that grant read-only or administrator access across linked AWS accounts.

Enable IAM Identity Center, create a test user, assign a permission set, and access accounts via the AWS access portal to test login.

Explore how Amazon Cognito handles authentication, authorization, and user management for web and mobile apps, including sign up, social sign-in, email verification, and multifactor authentication, and account recovery.

Explore how AWS Control Tower simplifies managing a multi-account environment with single sign-on, centralized logging, and automated security guardrails using CloudFormation StackSets and account factory.

Firewall manager centrally configures rules across AWS accounts, enabling consistent security for applications with WAF, VPC security groups, and Route 53 DNS firewall.

Learn how Amazon GuardDuty delivers one click threat detection by monitoring cloud logs (CloudTrail, VPC flow, DNS) to generate findings that reveal compromised servers and malware activity.

Enable GuardDuty in your AWS account and explore the findings dashboard, including severity levels and EC2 details, with generated sample findings during a 30-day trial.

Centralize GuardDuty findings by routing member account findings to a single administrator account, where invitations enable filtering by account ID for unified monitoring and investigation.

Learning to centralize GuardDuty findings by linking admin and member accounts, enabling GuardDuty on both, sending and accepting invitations, and viewing shared findings by account ID.

Discover how Amazon Macie uses machine learning and pattern matching to detect sensitive data in S3 backups, identify PII and credentials, and generate actionable findings for remediation.

Practice setting up and enabling Amazon Macie to scan an S3 bucket in the North Virginia region, run a one-time job, review high-severity findings, and note potential trial charges.

Explore how AWS Inspector functions as a vulnerability scanner for EC2 instances and ECR repositories, using the SSM agent to detect package vulnerabilities and display findings with CVSS scores.

Configure AWS Inspector vulnerability scans to assess EC2 and Docker images, using SSM agent, IAM policies, and Inspector console, with a hands-on walkthrough of two instances.

Discover how AWS key management service enables encryption and decryption with keys, via a practical plaintext to ciphertext workflow, base64 decoding, and integration with S3 and EBS.

Create a CMK and define an administrator and a key user to enable encryption and decryption, then use IAM and CLI workflows to manage keys.

Schedule key deletion introduces a seven to thirty-day waiting period to prevent irreversible data loss, while disabling a key blocks encryption and decryption until it is re-enabled, safeguarding production data.

Explore IAM access analyzer to identify resources shared with external entities, validate policies against policy grammar and best practices, and generate IAM policies from CloudTrail activity.

Learn to use AWS IAM access analyzer to verify findings, create analyzers, identify cross-account access via bucket policies and roles, and manage findings by archiving and re-scanning.

Centralize logs in a central bucket in account A. Enable account B to push data with a cross-account bucket policy and an IAM policy.

Understand how S3 encryption protects data with server-side encryption options (SSE-S3, SSE-KMS, SSE-C) and client-side encryption.

Learn how canned ACL enables cross-account S3 access by applying bucket owner full control to objects, ensuring both accounts can read and manage logs in a central S3 bucket.

Learn the basics of S3 server access logging, which records bucket requests with fields like timestamp and IP address, and enables security audits, usage insights, and cost analysis.

Set up server access logging for an S3 bucket with a separate target bucket, enabling automatic policy updates and later query the logs with Athena for insights.

Master cross-account replication in S3 by configuring a source IAM role and a destination bucket policy, then enabling the replication rule between two accounts.

Implement cross-account S3 replication by configuring two buckets with versioning and a destination bucket policy, plus an IAM role, then validate replication by uploading a file to the source.

Explore how the resource access manager securely shares AWS resources across accounts, enabling cross-account subnet and prefix list sharing, invitations, and permissions management.

Explore how AWS certificate manager simplifies issuing and renewing trusted certificates for domains, integrates with load balancers for https, and secures private keys to prevent leakage.

Learn how to issue a public certificate with AWS certificate manager, validate ownership via DNS records, and apply the issued certificate to CloudFront and API Gateway.

Explore how virtual private networks create a middle proxy to route client traffic, enabling encryption, anonymity, and geo bypass, with both personal and corporate use cases.

Explore AWS client VPN, a fully managed remote access VPN, enabling access to internal servers in private subnets via OpenVPN protocol with pay-as-you-go, elastic scaling.

Explore AWS Client VPN authentication options, including Active Directory, mutual certificate, and SAML-based single sign-on, and understand certificate-based mutual authentication with client and server certificates.

Learn how the EC2 image builder automates creating golden or hardened AMIs by applying CIS benchmark hardening, build and test components, and distributing secure images across regions.

Learn to create a golden image pipeline with EC2 image builder by defining an IAM role, a recipe, an Amazon Linux image, build components, and boot tests to produce AMIs.

Explore EC2 image builder deployment options, integrating with CodePipeline, CloudFormation, and SSM parameter store to automate AMI creation, manage latest AMIs for auto scaling, and enable rolling updates.