AWS

A Cognito user pool sign-in returns an ID token, an access token and a refresh token. Your API should accept the access token, which carries scopes and group claims; the ID token describes the user to the client, and the refresh token only obtains new tokens.

IAM Identity Center centralises workforce sign-in: each engineer exists once in one identity source, is assigned permission sets per account, and receives short-lived credentials at login instead of access keys that live on a laptop forever.

In AWS Organizations one management account creates the organization, pays every bill and cannot be restricted by service control policies; the rest are member accounts holding workloads. OUs group accounts so one attached policy applies to all beneath.

Effective permissions are the intersection of the two, so the role can call only S3 and CloudWatch actions. A permissions boundary never grants anything, so with the boundary alone and no identity policy the role could do nothing.

Every AWS request starts denied. An implicit deny is simply the absence of any matching Allow, and adding an Allow fixes it. An explicit Deny is a statement with Effect Deny, and no Allow anywhere can override it.

The function returned a shape API Gateway cannot map to an HTTP response. A Lambda proxy handler must return an object with a numeric statusCode, an optional headers map, and a body that is already a string — returning a raw object or a bare value produces 502.

An origin is a backend CloudFront fetches from: an S3 bucket, a load balancer, any HTTP server. A cache behavior maps a URL path pattern to one origin. CloudFront tests behaviors in their configured order and falls back to the default behavior.

An ALB listener rule matches on host header, URL path, HTTP header, HTTP method, query string, or source IP. Rules are evaluated in priority order, lowest number first; the first match wins, and unmatched requests fall through to the listener's default action.

A target group is the named set of backends an Elastic Load Balancing listener forwards to, plus the health check run against each member. A target that fails enough consecutive checks is marked unhealthy and stops receiving new requests.

Security groups attach to network interfaces, are allow-only and stateful, so return traffic is automatically permitted. Network ACLs attach to subnets, allow or deny in numbered order, and are stateless, so every direction needs an explicit rule.

User data is a text blob you attach to an EC2 instance that cloud-init fetches from the instance metadata service at first boot. A script starting with a shebang runs as root, once per instance — not on every reboot.

Desired capacity is the instance count the group tries to run right now; minimum and maximum are the floor and ceiling that scaling can never cross. Manually terminating an instance leaves the group below desired, so it launches a replacement.

m7g.2xlarge splits into four parts: family m (general purpose, roughly 4 GiB of memory per vCPU), generation 7, processor letter g (AWS Graviton, arm64), and size 2xlarge — 8 vCPUs and 32 GiB of memory.

Spot Instances run on EC2 capacity AWS currently has idle, at a steep discount off On-Demand, but AWS can reclaim them at any moment with a two-minute warning. Spot prices move gradually with supply and demand; there is no bidding auction.

An ECS task definition is the immutable blueprint: image, CPU and memory, IAM roles, logging. A task is one running copy of it. A service keeps a desired count of tasks alive and replaces failures; RunTask launches one-off jobs.

Amazon EFS is the AWS shared file system: an NFS file share that many EC2 instances, containers and Lambda functions mount read-write at the same time, across Availability Zones, with capacity that grows and shrinks automatically.

EC2 instance store data survives a reboot but is lost on stop, hibernate, or terminate, because it lives on disks physically inside the host. EBS volumes are network-attached and persist independently of the instance lifecycle.

The Aurora cluster endpoint always resolves to the current writer and follows failover; the reader endpoint round-robins DNS across available readers; an instance endpoint names one fixed instance. Sending everything to the cluster endpoint puts all reads on the writer while paid-for readers sit idle.

Eventually consistent reads, the DynamoDB default, may return a slightly stale copy of an item and cost half a read unit per 4 KB. Strongly consistent reads always reflect the latest acknowledged write and cost a full read unit per 4 KB.

Valkey and Redis OSS on ElastiCache add replicas, automatic failover, snapshots and authentication; Memcached has none of those but is multi-threaded and simple. Choose Memcached only for a plain, disposable, horizontally sharded key-value cache.

A shard is Kinesis Data Streams' unit of capacity and ordering: roughly 1 MB/s or 1,000 records per second in, 2 MB/s of shared reads out. Records are placed by partition-key hash and are ordered only within one shard.

The SES sandbox is the default restricted state of every new SES account, per Region. In it you may only send to identities you have verified (plus the SES mailbox simulator), at a low daily cap and send rate. You leave it by requesting production access for that Region.

ReceiveMessage hides a message for the visibility timeout instead of removing it, giving one consumer a temporary exclusive lease. Only DeleteMessage removes it; if the lease expires first, the message becomes visible again and is delivered to another consumer.

Standard SQS queues give near-unlimited throughput with best-effort ordering and possible duplicate deliveries. FIFO queues preserve order within each MessageGroupId and deduplicate messages, but cap throughput. Choose FIFO only when ordering or deduplication is genuinely required.

Every account and region has one default bus, which is where AWS services emit their own events. Custom buses are ones you create for your application's events. Partner buses receive events from a SaaS provider you have associated. Application events belong on a custom bus.

CloudTrail Event history is free, always on, and covers only the last 90 days of management events in the current region. A trail is the delivery configuration that writes events to an S3 bucket you own, giving you retention you control and the option to log data events.

A CloudWatch dashboard is a JSON document of widgets — metric graphs, log tables, alarm-status tiles, text — and each widget carries its own region, statistic and period. Dashboards only draw data; notification comes from CloudWatch alarms, never from a dashboard.

Three paths: the CloudWatch agent tailing files on a host, AWS services delivering logs natively (Lambda, the ECS awslogs driver, VPC Flow Logs), or your code calling the PutLogEvents API. All three need IAM permission to create streams and put events.

A Logs Insights query is a pipeline of commands joined by the pipe character: fields or display picks columns, filter narrows rows, sort orders them, limit caps the output. Every event exposes @timestamp, @message, @logStream and @ingestionTime.

Set AWS Cost Explorer to Daily granularity to find the day spend jumped, Group by Service to name the culprit, then filter to that service and regroup by Usage Type, Region or Linked Account until the charge line is identified.