Current AWS facts (changed vs older material)
Living table of AWS values and behaviours that differ from the course slides or older practice material. Teach the Current (verified) column; mention the older value only as "older practice material may say …". /ingest re-checks a module's existing rows in both tables, edits a row in place when its value changed or you corrected it, and adds newly confirmed rows to Changed values right after that module's rows (same columns, grouped by module, no duplicates) — only after you confirm. The EC2 rows were verified on 2026-10-12 while writing the EC2 notes (context: notes/ec2-mastery-guide.md#changed-vs-older-material). The other modules' rows were verified on 2026-10-12 by a separate fact-check sweep ahead of their ingest, so /explain, /drill numbers and new questions use current values; they count as pre-verified, not confirmed, until that module's /ingest re-checks them with you.
Changed values
| Module | Fact | Older material may say | Current (verified) | Source | Verified on |
|---|---|---|---|---|---|
| iam | Centralized root access management for AWS Organizations member accounts | Every member account has its own root credentials that must be individually secured with MFA | Since Nov 15, 2024 IAM can centrally manage root access for Organizations member accounts: remove member root credentials (password, MFA) and run scoped privileged root tasks with temporary credentials. | What's New | 2026-10-12 |
| iam | IAM root user MFA enforcement | MFA on the root user is a recommended best practice but optional | Mandatory for the root user of every account type (standalone, management, member); a root user without MFA must register one within 35 days of its first console sign-in attempt. | AWS docs | 2026-10-12 |
| iam | MFA devices per IAM/root user and passkey support | Only one MFA device per IAM user or root user | Up to 8 MFA devices per root and IAM user (since Nov 16, 2022); FIDO2 passkeys (synced or security keys) supported as MFA (since Jun 11, 2024) and recommended. | What's New | 2026-10-12 |
| iam | Tasks that require root user credentials | Only the root user can change the account name or the AWS Support plan | Standalone accounts need root only for the account email, root password and root access keys, and to close or reopen the account; name, contacts, payment currency and Regions don't need root. | AWS docs | 2026-10-12 |
| iam | Identities for human users | One IAM user per person (one physical user = one AWS user) | People federate (IAM Identity Center or an external IdP) with temporary credentials; IAM users only for emergency access, workloads that can't use roles, third-party clients, CodeCommit, Keyspaces. | AWS docs | 2026-10-12 |
| iam | Access key rotation guidance | Rotate all access keys often, on a fixed schedule | Prefer temporary credentials; where long-term keys are required, update them when needed (for example when an employee leaves), guided by access key last-used information. | AWS docs | 2026-10-12 |
| iam | IAM Access Advisor name, scope and action-level coverage | IAM Access Advisor tab (user-level): services granted to a user and when they were last accessed | Last accessed information (Last Accessed tab) for users, groups, roles, policies; services >= 400 days; action level: S3 since 2020-04-12, EC2/IAM/Lambda since 2021-04-07, others since 2023-05-23. | AWS docs | 2026-10-12 |
| iam | MFA device types and hardware vendors | U2F security key, Gemalto hardware key fob, SurePassID key fob for AWS GovCloud (US) | Passkeys and FIDO security keys (recommended), virtual authenticator apps, hardware TOTP tokens from Thales (OTP token or display card); AWS GovCloud (US): Hypersecu tokens. | AWS docs | 2026-10-12 |
| iam | SMS text-message MFA | SMS text messages are an MFA option for IAM users | AWS ended support for enabling SMS MFA; move remaining SMS users to passkeys or security keys, virtual or hardware MFA. | AWS docs | 2026-10-12 |
| iam | Managed policies per IAM role (default / maximum) | 10 by default, adjustable to 20 | 20 by default, adjustable up to 25 (users: 10, adjustable to 20; groups: 10, not adjustable) | AWS docs | 2026-10-12 |
| iam | Adjustable IAM quota maximums (roles, customer managed policies, instance profiles, role trust policy length) | Roles, customer managed policies and instance profiles up to 5,000; role trust policy up to 4,096 characters | Auto-approved maximums 10,000 roles, 10,000 customer managed policies, 10,000 instance profiles, 8,192-character trust policy (defaults unchanged: 1,000 / 1,500 / 1,000 / 2,048). | AWS docs | 2026-10-12 |
| iam | AWS SSO service name | AWS Single Sign-On (AWS SSO) | Renamed AWS IAM Identity Center on July 26, 2022; aws configure sso and the sso, sso-admin, sso-oidc and identitystore namespaces kept their names. | AWS docs | 2026-10-12 |
| cli-sdk-policies | Default AWS Region when none is configured (CLI and SDKs) | us-east-1 is used when no Region is specified or configured | No default Region: set it in code, AWS_REGION (boto3 and CLI v1 read only AWS_DEFAULT_REGION, not AWS_REGION) or the profile; otherwise the CLI fails with 'You must specify a region' and boto3 raises NoRegionError | AWS docs | 2026-10-12 |
| cli-sdk-policies | AWS CLI version 1 support status | AWS CLI v1 (installed with pip) is the current CLI | Maintenance mode since 2026-07-15 (critical bug and security fixes only; no new services, APIs or Regions); end of support 2027-07-15; use AWS CLI v2 | AWS blog | 2026-10-12 |
| cli-sdk-policies | Official AWS SDK languages and major versions | Eight SDKs: Java, .NET, Node.js, PHP, Python (boto3), Go, Ruby, C++ | Also Kotlin, Rust, Swift, SAP ABAP and Tools for PowerShell; build on Java 2.x, JavaScript v3, Go v2 and .NET 4.x (Java 1.x, JavaScript v2, Go v1 and .NET 3.x are end of support) | AWS docs | 2026-10-12 |
| cli-sdk-policies | EC2 DescribeInstances API request rate | 100 calls per second | Token bucket per account and Region: without filters or pagination 50 burst / 10 per second; filtered or paginated 100 / 20 per second (non-mutating bucket); throttled calls get RequestLimitExceeded | AWS docs | 2026-10-12 |
| cli-sdk-policies | Running On-Demand Standard (A, C, D, H, I, M, R, T, Z) instances quota | 1,152 vCPUs | AWS default 5 vCPUs (L-1216C47A, adjustable); applied values vary by account and EC2 raises them automatically with usage; exceeding the quota returns VcpuLimitExceeded | AWS docs | 2026-10-12 |
| cli-sdk-policies | Which errors to retry with exponential backoff | Retry only 5xx server errors and throttling; never retry a 4xx client error | Retry transient and throttling errors even with a 4xx status (ThrottlingException is HTTP 400, many throttles 429, HTTP 400 RequestTimeout is transient); don't retry AccessDeniedException or ValidationException | AWS docs | 2026-10-12 |
| cli-sdk-policies | AWS SDK default retry behaviour (volatile, November 2026) | Per-SDK defaults; boto3 and AWS CLI v1 use legacy mode with 5 attempts (CLI v1 DynamoDB 10) | Opt-in now with AWS_NEW_RETRIES_2026=true, default from November 2026: standard mode in every SDK, 3 attempts (DynamoDB 4), base delay 50 ms transient / 1,000 ms throttling, 20 s cap, 500-token retry quota | AWS docs | 2026-10-12 |
| lambda | Asynchronous invocation max payload | 256 KB | 1 MB (quota 'Asynchronous payload' 1,024 KB, not adjustable), up from 256 KB since 2025-10-24 in all commercial and GovCloud (US) Regions. Billing: 1 request for the first 256 KB, +1 per extra 64 KB chunk. | What's New | 2026-10-12 |
| lambda | Code storage for .zip functions and layers (per Region) | 75 GB per Region (soft limit) | 300 GB of Lambda-managed storage per Region per account (was 75 GB) since 2026-07-15; self-managed S3 code storage (S3ObjectStorageMode=REFERENCE) doesn't count. Dev Guide: not increasable; Gen. Reference: adjustable. | What's New | 2026-10-12 |
| lambda | Concurrency scaling rate | Account-level initial burst of 500-3,000 concurrent executions (varies by Region) in the first minute, then +500 per minute | Since 2023-11-26, each function scales independently by up to 1,000 execution environments every 10 s (10,000 RPS per 10 s) until the account concurrency limit. Not adjustable; unused rate doesn't accrue. | AWS docs | 2026-10-12 |
| lambda | Function URL invoke permissions | Only lambda:InvokeFunctionUrl needed (resource-based policy with the lambda:FunctionUrlAuthType condition) | Since Oct 2025 new function URLs need lambda:InvokeFunctionUrl plus lambda:InvokeFunction (scope via lambda:InvokedViaFunctionUrl), else 403 even with NONE. Console/SAM add both for NONE; CLI/CFN/API: add them yourself. | AWS docs | 2026-10-12 |
| lambda | Function resource-based policies (extra item) | Built one statement at a time with AddPermission (one principal per statement), with limited condition support; 20 KB maximum policy size | Since 2026-08-25: full JSON policies via PutResourcePolicy (overwrites the whole policy) with multiple principals/actions, explicit Deny and the full range of IAM condition keys; 20 KB max. AddPermission still works. | What's New | 2026-10-12 |
| lambda | Response streaming max response size and bandwidth | 20 MB (soft limit) per streamed response; Node.js managed runtime or custom runtime; via function URLs (RESPONSE_STREAM) or InvokeWithResponseStream only | 200 MB default max per streamed response (was 20 MB) since 2025-07-31; first 6 MB uncapped, then 2 MBps. Node.js managed/custom runtimes; via function URLs (RESPONSE_STREAM), InvokeWithResponseStream, API Gateway REST. | What's New | 2026-10-12 |
| lambda | SnapStart supported runtimes | Java only (Java 11/17 Corretto managed runtimes); .zip only, no container images | Java 11+, Python 3.12+, .NET 8+ (Python/.NET since 2024-11-18, billed for cache/restore); .zip and container images. Published versions/aliases only; not with PC, EFS, S3 Files, /tmp >512 MB | AWS docs | 2026-10-12 |
| lambda | Memory for one full vCPU | 1,792 MB = one full vCPU | 1,769 MB = one vCPU; up to 6 vCPUs at the 10,240 MB maximum; CPU scales with memory (there is no separate CPU setting) | AWS docs | 2026-10-12 |
| lambda | SQS event source mapping batch size | 1-10 messages per batch | Standard queues up to 10,000 (MaximumBatchingWindowInSeconds >= 1 s when above 10), FIFO queues up to 10, default 10; batches also stop at 6 MB | AWS docs | 2026-10-12 |
| lambda | SQS event source mapping scaling (standard queues, default mode) | +60 instances per minute, up to 1,000 batches at once | Starts at 5 concurrent invokes, adds up to 300 per minute (since 2023-11-06), max 1,250 per mapping; MaximumConcurrency 2-1,000; provisioned mode adds up to 1,000 concurrency/min | AWS docs | 2026-10-12 |
| lambda | Asynchronous invocation destinations | SQS, SNS, Lambda or EventBridge bus | On failure: SQS standard queue, SNS standard topic, S3 bucket, Lambda or EventBridge bus; on success the same list without S3; FIFO queues and topics unsupported | AWS docs | 2026-10-12 |
| lambda | Event source mapping destinations for discarded batches | SQS or SNS | Kinesis, DynamoDB and Kafka mappings: SQS or SNS (metadata only) or S3 (whole batch); Kafka mappings also a Kafka topic; SQS mappings none (use the queue's DLQ) | AWS docs | 2026-10-12 |
| lambda | Event source mapping sources | Kinesis Data Streams, SQS (standard and FIFO), DynamoDB Streams | SQS, Kinesis, DynamoDB Streams, Amazon MSK, self-managed Apache Kafka, Amazon MQ and Amazon DocumentDB (7 sources) | AWS docs | 2026-10-12 |
| lambda | Throttle error for synchronous calls and how to raise concurrency | "ThrottleError 429"; open a support ticket for more concurrency | TooManyRequestsException (429), reason ConcurrentInvocationLimitExceeded or ReservedFunctionConcurrentInvocationLimitExceeded; raise concurrency in Service Quotas (L-B99A9384) | AWS docs | 2026-10-12 |
| lambda | Init phase billing | Init is free for on-demand .zip functions on managed runtimes | Init phase billed for every function configuration since 2025-08-01; Init time is included in Billed Duration | AWS blog | 2026-10-12 |
| lambda | AWS SDK included in the runtime | The AWS SDK comes with every Lambda function | Only the Node.js, Python and Ruby runtimes include an AWS SDK; Java, .NET and OS-only runtimes don't; AWS recommends packaging the SDK version you use | AWS docs | 2026-10-12 |
| lambda | Go and Rust runtime | Community-supported custom runtimes (Custom Runtime API); a Go base image | OS-only runtime provided.al2023 (go1.x deprecated 2024-01-08); container images use the OS-only base image | AWS docs | 2026-10-12 |
| lambda | Lambda container base images | amazon/aws-lambda-nodejs:12-style images built on Amazon Linux 2 | public.ecr.aws/lambda/<runtime>:<tag>; Node.js 20+, Python 3.12+, Java 21+, .NET 8+ and Ruby 3.3+ base images on Amazon Linux 2023; nodejs12.x deprecated 2023-03-31 | AWS docs | 2026-10-12 |
| lambda | Where to keep secrets for a function | KMS-encrypted environment variables are the place for secrets | AWS recommends Secrets Manager instead of environment variables for credentials and API keys; read them cached via the Parameters and Secrets extension (port 2773, 300 s TTL) | AWS docs | 2026-10-12 |
| lambda | Duration price (x86, US East (N. Virginia), first tier) | $1.00 per 600,000 GB-seconds | $0.0000166667 per GB-second (x86, us-east-1, first tier), about $1 per 60,000 GB-s; $0.20 per million requests; free tier 1M requests + 400,000 GB-s per month | AWS docs | 2026-10-12 |
| lambda | PassThrough tracing behaviour | Lambda sends traces automatically when an upstream service sampled the request | PassThrough (default) only forwards the trace header and sends no Lambda segments, even for sampled requests; enable Active tracing | AWS docs | 2026-10-12 |
| lambda | Encryption of /tmp content | To encrypt /tmp content you must generate KMS data keys in your code | All /tmp data is encrypted at rest with an AWS managed key, with no setup; use KMS data keys in code only for your own key or application-level encryption | AWS docs | 2026-10-12 |
| api-gateway | API Gateway REST API integration timeout | 50 ms - 29 s, hard limit that cannot be increased | REST default 50 ms-29 s. Since 2024-06-04 Regional/private REST APIs can exceed 29 s via Service Quotas (L-E5AE38E3); may lower account throttle (10,000 rps). Edge-optimized: 29 s max; HTTP API: 30 s, fixed. | AWS docs | 2026-10-12 |
| api-gateway | API Gateway REST API response streaming (new) | Not available: API Gateway always buffered the full integration response, so the 29 s and 10 MB response caps always applied | Since 2025-11-19, REST APIs (all endpoint types): responseTransferMode=STREAM (default BUFFERED) on HTTP_PROXY/AWS_PROXY; up to 15 min, >10 MB, idle timeout 5 min (edge 30 s); no caching/VTL/content encoding. | AWS docs | 2026-10-12 |
| api-gateway | Account-level throttle quota per Region | 10,000 rps across all APIs (soft limit that can be increased) | 10,000 rps with a 5,000 burst per account per Region across REST, HTTP, WebSocket APIs and WebSocket callbacks; 2,500 rps / 1,250 burst by default in 13 Regions; rate adjustable (L-8A5B8E43), burst set by AWS | AWS docs | 2026-10-12 |
| api-gateway | REST API execution log levels | ERROR, DEBUG, INFO | OFF, ERROR (errors only), INFO (errors and info), plus a separate data-tracing option that logs full request/response data | AWS docs | 2026-10-12 |
| api-gateway | Where a Lambda function receives API Gateway stage variables | Passed to the Lambda 'context' object | In the request event: event['stageVariables'] with Lambda proxy; passed through the mapping template ($stageVariables) with a custom integration | AWS docs | 2026-10-12 |
| api-gateway | WebSocket @connections callback URL | wss://{api-id}.execute-api.{region}.amazonaws.com/{stage}/@connections/{connectionId} | https://{api-id}.execute-api.{region}.amazonaws.com/{stage}/@connections/{connection_id}, SigV4-signed (API Gateway Management API), needs execute-api:ManageConnections | AWS docs | 2026-10-12 |
| api-gateway | HTTP API data mapping | HTTP APIs offer no data mapping | Parameter mapping: append/overwrite/remove request headers and query strings, overwrite the path, change response headers and status code; no body transformation (VTL) and no request validation | AWS docs | 2026-10-12 |
| api-gateway | Where the CORS Access-Control-Allow-* headers go | The OPTIONS preflight request must contain Access-Control-Allow-Methods, -Headers and -Origin | They are response headers returned by the OPTIONS method (its 200 method response); the browser's preflight request carries Origin and Access-Control-Request-Method | AWS docs | 2026-10-12 |
| api-gateway | REST API private integration targets | REST private integrations reach only a Network Load Balancer through a VPC link | VPC link V2 to an Application Load Balancer or a Network Load Balancer (HTTP_PROXY, connectionType VPC_LINK); existing VPC link V1 integrations can be switched to V2; HTTP APIs: ALB, NLB or Cloud Map | AWS docs | 2026-10-12 |
| api-gateway | Lambda authorizer response format | The Lambda authorizer must return an IAM policy | REST: principalId + IAM policy (optional context, usageIdentifierKey); HTTP API payload format 2.0 with simple responses: {"isAuthorized": true/false} | AWS docs | 2026-10-12 |
| dynamodb | DynamoDB capacity mode switching frequency | Can switch between provisioned and on-demand only once every 24 hours | Provisioned -> on-demand up to 4 times per rolling 24 hours (since Aug 13, 2025); on-demand -> provisioned at any time. | AWS docs | 2026-10-12 |
| dynamodb | DynamoDB on-demand throughput pricing | On-demand costs more per request than provisioned (e.g., $1.25/M writes, $0.25/M reads before the cut); recommended only for spiky/unpredictable or new workloads | On-demand price cut 50% effective Nov 1, 2024 (announced Nov 14, 2024); global-table replicated writes up to 67% lower. On-demand now default/recommended. us-east-1 Standard: $0.625/M writes, $0.125/M reads. | What's New | 2026-10-12 |
| dynamodb | DynamoDB warm throughput / pre-warming | No visibility into instantly available capacity; to pre-warm, temporarily set high provisioned capacity and then switch to on-demand | Since Nov 13, 2024: warm throughput value visible for all tables/GSIs (free); pre-warm via WarmThroughput on CreateTable/UpdateTable (charged), cannot be decreased; works for on-demand and provisioned. | AWS docs | 2026-10-12 |
| dynamodb | Partitions: count formula and capacity split | Partitions = ceil(max(RCU/3,000 + WCU/1,000, size/10 GB)); RCU/WCU spread evenly across partitions | No published formula; adaptive capacity (always on, free, instant) shifts throughput to hot partitions and isolates hot items; per partition 3,000 RCU / 1,000 WCU, 10 GB | AWS docs | 2026-10-12 |
| dynamodb | On-demand capacity mode throttling | On-demand has unlimited WCU/RCU and never throttles | Throttles at the per-table quota (40,000 RRU/WRU default, adjustable), at an optional OnDemandThroughput cap (ThrottlingException), beyond 2x previous peak within 30 min, and on hot partitions | AWS docs | 2026-10-12 |
| dynamodb | Throttling exceptions and diagnostics | Only ProvisionedThroughputExceededException, no detail on the cause | Since Aug 2025 exceptions carry ThrottlingReasons (Table/Index + Read/Write + limit type, plus resource ARN); 16 cause-specific CloudWatch metrics; Contributor Insights THROTTLED_KEYS mode | AWS docs | 2026-10-12 |
| dynamodb | AWS CLI --page-size default | --page-size defaults to 1,000 items for every command | Default page size is set per service (S3 1,000); each DynamoDB Query/Scan call returns at most 1 MB; --page-size changes only the number of API calls | AWS docs | 2026-10-12 |
| dynamodb | GSI key schema (multi-attribute keys) | A GSI key is one partition-key attribute plus at most one sort-key attribute (concatenate values into synthetic keys) | Multi-attribute GSI keys: up to 4 partition-key attributes and up to 4 sort-key attributes | AWS docs | 2026-10-12 |
| dynamodb | GSI throughput settings | Every GSI must be provisioned with its own RCU and WCU | GSIs inherit the table's capacity mode: own RCU/WCU only on provisioned tables; none on on-demand tables (optional OnDemandThroughput cap) | AWS docs | 2026-10-12 |
| dynamodb | Maximum items per transaction | 25 items per transaction | Up to 100 actions on 100 distinct items, 4 MB aggregate, one account and Region | AWS docs | 2026-10-12 |
| dynamodb | On-failure destinations for DynamoDB stream event source mappings | SQS queue or SNS topic only | SQS queue, SNS topic or S3 bucket (S3 also receives the full invocation record; SQS/SNS get metadata only) | AWS docs | 2026-10-12 |
| dynamodb | KCL consumers of DynamoDB Streams | Streams Kinesis Adapter with KCL 1.x and SDK for Java 1.x | Kinesis Adapter with KCL 3.5.x+ and SDK for Java 2.x; KCL 1.x end of support 2026-01-30 | AWS docs | 2026-10-12 |
| dynamodb | TTL deletion delay | Expired items are deleted within 48 hours | Typically within a few days after expiry; expired items stay readable until deleted | AWS docs | 2026-10-12 |
| dynamodb | TTL delete cost on global tables | TTL deletes never consume capacity or cost anything | Free in the Region where the item expires; replicated TTL deletes consume replicated write units in each other replica Region; MRSC tables don't support TTL | AWS docs | 2026-10-12 |
| dynamodb | Cross-account access to tables (resource-based policies) | Cross-account access always requires assuming a role in the table's account | Resource-based policies on tables, indexes and streams (Mar 2024, max 20 KB, Block Public Access) grant cross-account access without role assumption; caller also needs an identity-based allow | AWS docs | 2026-10-12 |
| dynamodb | Private connectivity to DynamoDB (VPC endpoints) | Gateway endpoints only; on-premises clients need a proxy in the VPC | Gateway endpoints (free) or interface endpoints via PrivateLink (Mar 2024; Streams Mar 2025), reachable from on-premises; endpoint-specific DNS names, no private DNS | AWS docs | 2026-10-12 |
| dynamodb | Full-access AWS managed policy | Attach AmazonDynamoDBFullAccess | AmazonDynamoDBFullAccess deprecated 2025-04-25; use the narrower AmazonDynamoDBFullAccess_v2 | AWS docs | 2026-10-12 |
| dynamodb | PITR recovery period | PITR always covers 35 days | Configurable 1-35 days (RecoveryPeriodInDays, Jan 2025); same price whatever the period; restores always create a new table | AWS docs | 2026-10-12 |
| dynamodb | Global tables consistency modes | Global tables are always eventually consistent between Regions (last writer wins) | MREC (default, async, last writer wins) or MRSC (Jun 2025): exactly 3 Regions (or 2 + witness), RPO 0, strongly consistent reads anywhere; no TTL, LSIs or transactions | AWS docs | 2026-10-12 |
| dynamodb | Protecting a table from accidental deletion | Only an IAM deny on dynamodb:DeleteTable prevents an accidental delete | Deletion protection (DeletionProtectionEnabled, Mar 2023) blocks DeleteTable for everyone until disabled | What's New | 2026-10-12 |
| dynamodb | Copying a DynamoDB table | Copy with AWS Backup, AWS Glue or a Scan + PutItem/BatchWriteItem script | Also export to S3 (needs PITR, no RCU, full/incremental/filtered, cross-account bucket) + import from S3 into a new table (no WCU) | AWS docs | 2026-10-12 |
| security-encryption | KMS AWS managed key rotation frequency | AWS managed keys rotated automatically every 3 years (~1,095 days) | AWS managed keys rotate every year (~365 days) since May 2022; customers cannot enable/disable or rotate them on demand. | AWS docs | 2026-10-12 |
| security-encryption | KMS automatic key rotation period (customer managed keys) | Fixed: automatic rotation once a year (every 365 days); period not configurable | Configurable RotationPeriodInDays 90-2560 days (~7 yrs); default 365 if omitted. Launched Apr 12, 2024. Symmetric keys with AWS_KMS-origin material only; AWS managed keys still rotate yearly. | AWS docs | 2026-10-12 |
| security-encryption | KMS key rotation pricing | Each rotation adds $1/month for retained key material (cost keeps growing with every rotation) | Since Apr 2024 only the 1st and 2nd rotations each add $1/month (prorated hourly); later rotations are not billed (keys with 3+ rotations cut to $3/month from first week of May 2024). | What's New | 2026-10-12 |
| security-encryption | KMS on-demand key rotation availability and limit | Not available; immediate rotation required manual rotation (create new KMS key and repoint alias/apps) | Yes since Apr 12, 2024 (RotateKeyOnDemand), independent of auto schedule; max 25 per key (not adjustable); symmetric incl. imported material (Jun 2025; multi-Region Nov 26, 2025). Not asymmetric/HMAC/custom key store. | AWS docs | 2026-10-12 |
| security-encryption | Secrets Manager minimum rotation frequency | Rotation schedule in days only (AutomaticallyAfterDays); minimum once per day | As often as every 4 hours (since Nov 21, 2022) using rate()/cron() ScheduleExpression; rotation window min 1 hour; rate() max 999 days; schedules in UTC. AutomaticallyAfterDays still 1-1000. | AWS docs | 2026-10-12 |
| security-encryption | KMS symmetric cryptographic request quota (shared, per account and Region) | 5,500/s default; 10,000/s in six large Regions; 30,000/s in us-east-1, us-west-2, eu-west-1 | 10,000/s default; 20,000/s in us-east-2, ap-southeast-1/-2, ap-northeast-1, eu-central-1, eu-west-2, eu-south-2; 100,000/s in us-east-1, us-west-2, eu-west-1 (Jul 8, 2024); HMAC ops share it | AWS docs | 2026-10-12 |
| security-encryption | KMS RSA key request quota (shared) | 500/s | 1,000/s shared for RSA KMS keys (Encrypt, Decrypt, ReEncrypt, Sign, Verify) | AWS docs | 2026-10-12 |
| security-encryption | KMS ECC key request quota (shared) | 300/s | 1,000/s shared for ECC and SM2 KMS keys (Sign, Verify, DeriveSharedSecret); ML-DSA keys have their own 1,000/s quota | AWS docs | 2026-10-12 |
| security-encryption | KMS key types | Symmetric AES-256 or asymmetric RSA/ECC key pairs only | Also HMAC (Apr 2022), ECC KEY_AGREEMENT usage (Jun 2024), ML-DSA post-quantum signing (Jun 2025) and Ed25519 ECC_NIST_EDWARDS25519 sign/verify (Nov 2025) keys | AWS docs | 2026-10-12 |
| security-encryption | AWS KMS HSM FIPS validation | FIPS 140-2 Level 3 | FIPS 140-3 Level 3 | AWS docs | 2026-10-12 |
| security-encryption | AWS CloudHSM FIPS validation | FIPS 140-2 Level 3 | hsm2m.medium FIPS 140-3 Level 3 (hsm1.medium FIPS 140-2 Level 3); cluster FIPS or non-FIPS mode (non-FIPS only on hsm2m.medium), fixed at creation | AWS docs | 2026-10-12 |
| security-encryption | Using a KMS key outside its Region | A KMS key can't be used outside the Region where it was created | Keys stay Regional, but multi-Region keys (Jun 2021) share key ID and material, so ciphertext encrypted in one Region decrypts with the related key in another; existing keys can't be converted | AWS docs | 2026-10-12 |
| security-encryption | AWS managed key charges and status | AWS managed keys (aws/service-name) are free | No monthly fee, but requests are billed (some services pay); legacy type: not created for new services since 2021, which use AWS owned keys | AWS docs | 2026-10-12 |
| security-encryption | AWS Encryption SDK language implementations | Java, Python, C, JavaScript (plus a CLI) | C, C#/.NET, Java, JavaScript, Python, Rust, Go, plus the AWS Encryption CLI; all interoperate | AWS docs | 2026-10-12 |
| security-encryption | Secrets Manager rotation mechanism | Rotation always runs a Lambda function | Managed rotation (no Lambda) for RDS, Aurora, Redshift, DocumentDB master credentials, ECS Service Connect TLS certificates and managed external secrets; Lambda rotation for other secrets | AWS docs | 2026-10-12 |
| security-encryption | Version segment in ssm / ssm-secure CloudFormation dynamic references | The version is a required part of the syntax | Optional: latest version used at each create/update; mandatory only for ssm references in the Parameters section; labels and shared parameters unsupported | AWS docs | 2026-10-12 |
| advanced-identity | Cognito advanced security features (ASF) mapping to feature plans | Advanced security features add-on (adaptive authentication, compromised-credentials detection, risk event logs) priced separately | Former advanced security features now live in Essentials or Plus; threat protection (adaptive auth, compromised-credential checks, activity log export) is Plus-only; AUDIT/ENFORCED mode requires tier PLUS. | AWS docs | 2026-10-12 |
| advanced-identity | Cognito hosted UI vs managed login | Built-in Hosted UI sign-in pages with limited customization (logo + CSS file) | Managed login (Nov 22, 2024): hosted pages with no-code branding editor, passkeys, localization; Essentials/Plus only. Classic hosted UI remains (all plans; only option in Lite). One branding version per domain. | AWS docs | 2026-10-12 |
| advanced-identity | Cognito user pool feature plans (Lite/Essentials/Plus) and default plan | Single MAU-based user pool pricing plus optional 'advanced security features' add-on; no named tiers | Since Nov 22, 2024: Lite (basic auth, classic hosted UI), Essentials (default for new pools: managed login, passkeys/passwordless, email MFA, access-token customization), Plus (Essentials + threat protection). | AWS docs | 2026-10-12 |
| advanced-identity | Role session lifetime (AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity) | Temporary credentials last 15 minutes to 1 hour | 900 s up to the role's MaxSessionDuration (settable 1-12 h), default 3,600 s; asking for more fails; role chaining at most 1 h whatever the maximum (a chained request for more also fails) | AWS docs | 2026-10-18 |
| advanced-identity | GetSessionToken and GetFederationToken credential lifetime | STS temporary credentials last up to 1 hour | IAM user: 900-129,600 s (36 h), default 43,200 s (12 h); root user: 900-3,600 s (1 h) | AWS docs | 2026-10-12 |
| advanced-identity | Pre token generation Lambda trigger: tokens it can customize | Adds, changes or suppresses claims in the ID token only | V1_0 (default) ID token + group overrides; V2_0 also access-token claims and scopes; V3_0 adds M2M access tokens; V2/V3 need Essentials or Plus | AWS docs | 2026-10-12 |
| advanced-identity | STS API behind Cognito identity pools | AssumeRoleForWebIdentity | sts:AssumeRoleWithWebIdentity; Cognito makes the call itself in the enhanced flow (GetCredentialsForIdentity); the basic flow's app calls it with the GetOpenIdToken token | AWS docs | 2026-10-12 |
| advanced-identity | AWS guidance on calling AssumeRoleWithWebIdentity directly | AWS recommends against calling it; use Cognito identity pools instead | Cognito recommended for mobile apps; calling it directly with a JWT from an IdP configured in the account (e.g. CI/CD) is a listed IAM best practice for workloads | AWS docs | 2026-10-12 |
| advanced-identity | STS API set | Seven operations: AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity, GetSessionToken, GetFederationToken, GetCallerIdentity, DecodeAuthorizationMessage | Also AssumeRoot (privileged root task on an Organizations member account, max 900 s, Regional endpoint only) and GetAccessKeyInfo | AWS docs | 2026-10-12 |
| advanced-identity | STS global endpoint (sts.amazonaws.com) routing | Every global-endpoint request is served by US East (N. Virginia) | Served in the originating Region for Regions enabled by default (Amazon DNS resolver); opt-in Regions and other resolvers still go to us-east-1; Regional endpoints recommended | AWS docs | 2026-10-12 |
| advanced-identity | Policy types in IAM policy evaluation | Explicit deny, then any allow, else deny over identity and resource policies (plus SCPs, boundaries, session policies) | Adds resource control policies (13 Nov 2024; now dozens of services): explicit deny -> RCPs -> SCPs -> resource-based -> identity-based -> boundary -> session policy | AWS docs | 2026-10-12 |
| advanced-identity | IAM managed-policy attachment and role trust policy quotas | 10 managed policies per role (max 20); trust policy max 4,096 characters | Managed policies per role 20 (adjustable to 25), per user 10 (to 20), per group 10 (fixed); role trust policy 2,048 characters default, adjustable to 8,192 | AWS docs | 2026-10-12 |
| advanced-identity | ECS task IAM roles: ECS_ENABLE_TASK_IAM_ROLE | Always set ECS_ENABLE_TASK_IAM_ROLE=true for task roles | Current ECS-optimized AMIs support task roles out of the box; the variable (and ..._NETWORK_HOST for host mode) is only for non-optimized AMIs and external instances; Fargate always uses task roles | AWS docs | 2026-10-12 |
| advanced-identity | Where long-term IAM access keys are acceptable (overlaps the ec2 row on CLI/SDK credentials outside AWS) | Acceptable on a personal computer or an on-premises server | Humans federate with temporary credentials (IAM Identity Center); workloads outside AWS use IAM Roles Anywhere, OIDC/SAML federation, ECS Anywhere or SSM hybrid activations; keys only where roles can't be used | AWS docs | 2026-10-12 |
| advanced-identity | Where a Cognito custom domain is configured | In the console's App integration section | Console: Domain menu under Branding; API: CreateUserPoolDomain with CustomDomainConfig and ManagedLoginVersion; ACM certificate still in us-east-1 | AWS docs | 2026-10-12 |
| advanced-identity | Amazon Cognito Sync availability | Use Cognito Sync to synchronize user data across devices | No longer open to new customers (existing customers keep it, no new features); use AWS AppSync for real-time sync or DynamoDB for per-user data | AWS docs | 2026-10-12 |
| advanced-identity | Cognito refresh token rotation | Refresh tokens are never rotated; refresh with REFRESH_TOKEN_AUTH | Optional per app client (RefreshTokenRotation, grace up to 60 s); new refresh token on each refresh within the original window; needs GetTokensFromRefreshToken or the token endpoint | AWS docs | 2026-10-12 |
| advanced-identity | ALB JWT verification (jwt-validation action) | The ALB only authenticates browser users; bearer JWTs are validated in code or API Gateway | jwt-validation rule action since 12 Nov 2025 on HTTPS listeners: RS256, iss + exp required, up to 10 extra claims; JWKS max 150 KB and 10 keys | AWS docs | 2026-10-12 |
| advanced-identity | ALB user-claims headers that targets can trust | x-amzn-oidc-accesstoken, x-amzn-oidc-identity and x-amzn-oidc-data are equally usable | Only x-amzn-oidc-data is signed (ES256; check signer = ALB ARN); x-amzn-oidc-accesstoken and x-amzn-oidc-identity are legacy unsigned headers | AWS docs | 2026-10-12 |
| advanced-identity | AWS Directory Service directory types | AWS Managed Microsoft AD, AD Connector and Simple AD only | Also AWS Managed Microsoft AD (Hybrid Edition, 30 Jul 2025): extends a self-managed AD to AWS without synchronizing identities | AWS docs | 2026-10-12 |
| advanced-identity | Simple AD availability | Simple AD is the low-cost AD-compatible directory for any account | Closed to new customers since 30 Jul 2026; existing customers keep full functionality and can still create directories; newcomers use AWS Managed Microsoft AD or AD Connector | AWS docs | 2026-10-12 |
| cicd | AWS Cloud9 availability to new customers | Presented as AWS's current, generally available browser-based IDE that any account can use. | Closed to new customers since Jul 25, 2024 (AWS Lifecycle: Maintenance), not reversed. Existing customers use it as normal; security, availability, performance work only, no new features. Use IDE Toolkits or CloudShell. | AWS docs | 2026-10-12 |
| cicd | AWS CodeCommit availability to new customers | Course: fully managed private Git repos (IAM, SSH/HTTPS, KMS), no closure notice. 2024-25 updates said it was closed to new customers from Jul 25, 2024. | GA and open to new customers again since Nov 24, 2025 (the Jul 25, 2024 closure was reversed), so the course content holds. Announced Git LFS and eu-south-2/ca-west-1 Regions are not in the docs as of Oct 2026. | AWS blog | 2026-10-12 |
| cicd | AWS CodeStar Connections name | AWS CodeStar Connections (codestar-connections) is the service that connects CodePipeline/CodeBuild/CodeDeploy to GitHub, Bitbucket and GitLab. | Renamed AWS CodeConnections (2024-03-29), codeconnections API/CLI/IAM prefix; old codestar-connections resources and ARNs still supported; the console has created codeconnections ARNs since 2024-07-01 | AWS docs | 2026-10-12 |
| cicd | AWS CodeStar status | Presented as a current service for creating CI/CD projects from templates (CodeCommit/CodeBuild/CodeDeploy/CodePipeline), with a project dashboard and team management. | Discontinued: AWS Lifecycle 'Full Shutdown', end of support Jul 25, 2024 (2024 notice said Jul 31). Console and projects gone; repos, pipelines and builds it created still work. Connections now AWS CodeConnections. | AWS docs | 2026-10-12 |
| cicd | Amazon CodeCatalyst availability (the recommended CodeStar successor) | Pointed to by the 2024 CodeStar discontinuation notice as the place to build, test and deploy apps; open to new customers. | Maintenance: closed to new customers since Nov 7, 2025. Existing customers keep their spaces but can't create new ones; security and availability work only, no new features. AWS suggests GitLab Duo with Amazon Q. | AWS docs | 2026-10-12 |
| cicd | Amazon CodeGuru Reviewer status | Generally available ML-based automated code review: associate CodeCommit/GitHub/Bitbucket/S3 repositories and get recommendations on pull requests and full scans. | Maintenance (announced Oct 2025): since Nov 7, 2025 no one can create new repository associations; existing ones keep working. AWS lists Amazon Q Developer code reviews and Amazon Inspector code security instead. | AWS docs | 2026-10-12 |
| cicd | CodePipeline connections source action: provider name and IAM permissions | Source action provider 'CodeStarSourceConnection'; the service role needs codestar-connections:UseConnection. | Provider unchanged: CodeStarSourceConnection (Source, AWS, v1; ConnectionArn, FullRepositoryId, BranchName). The service role now needs both codeconnections:UseConnection and codestar-connections:UseConnection. | AWS docs | 2026-10-12 |
| cicd | CodeDeploy predefined deployment configurations for Amazon ECS | ECSLinear10PercentEvery3Minutes, ECSLinear10PercentEvery10Minutes, ECSCanary10Percent5Minutes, ECSCanary10Percent30Minutes, AllAtOnce | CodeDeployDefault.ECSLinear10PercentEvery1Minutes, ECSLinear10PercentEvery3Minutes, ECSCanary10Percent5Minutes, ECSCanary10Percent15Minutes, ECSAllAtOnce; the other two only as custom configs | AWS docs | 2026-10-12 |
| cicd | Load balancer for CodeDeploy blue/green deployments to Amazon ECS | An Application Load Balancer is required | Application Load Balancer or Network Load Balancer (ALB recommended); with an NLB only CodeDeployDefault.ECSAllAtOnce is supported | AWS docs | 2026-10-12 |
| cicd | Blue/green, linear and canary deployments on Amazon ECS | Only through CodeDeploy (CODE_DEPLOY deployment controller, task sets) | ECS built-in blue/green since 2025-07-17 and linear/canary since 2025-10-30 (deploymentController ECS, strategy BLUE_GREEN/LINEAR/CANARY, bake time); CodeDeploy for ECS still works | What's New | 2026-10-12 |
| cicd | CodeBuild build queue | Continuous scaling with no build queue | Builds wait in QUEUED at the account's per-compute-type concurrent-build quota (small defaults, 1 for most types; raise in Service Quotas); queuedTimeoutInMinutes 5-480; project concurrentBuildLimit | AWS docs | 2026-10-12 |
| cicd | CodeBuild billing granularity | Charged per minute for compute | On-demand EC2 per build minute, rounded up; Lambda compute per second; reserved capacity per instance-minute with a 60-minute minimum; free tier 100 build minutes/month (general1.small, arm1.small) | AWS docs | 2026-10-12 |
| cicd | CodeBuild maximum build timeout | 8 hours (480 minutes) | 5 to 2,160 minutes (36 hours), default 60 minutes; maximum raised on 2024-05-01 | AWS docs | 2026-10-12 |
| cicd | CodeBuild source providers | CodeCommit, S3, Bitbucket, GitHub | CODECOMMIT, CODEPIPELINE, GITHUB, GITHUB_ENTERPRISE, GITLAB, GITLAB_SELF_MANAGED, BITBUCKET, S3, NO_SOURCE; up to 12 secondary sources | AWS docs | 2026-10-12 |
| cicd | CodePipeline action providers | Sources CodeCommit, ECR, S3, Bitbucket, GitHub; deploy CodeDeploy, Beanstalk, CloudFormation, ECS, S3; invoke Lambda, Step Functions | Connection sources (Bitbucket Cloud, GitHub, GHES, GitLab.com, GitLab self-managed); GitHub OAuth action not recommended; plus EC2, EKS, Lambda (V2) deploy, ECRBuildAndPublish, InspectorScan, Commands | AWS docs | 2026-10-12 |
| cicd | CodeCommit HTTPS access for federated users and temporary credentials | HTTPS with Git credentials or the AWS CLI credential helper | git-remote-codecommit (codecommit:: URLs with a CLI profile) recommended for federated, SSO and role access; credential helper is the alternative; Git credentials and SSH keys are for IAM users | AWS docs | 2026-10-12 |
| cicd | CodeArtifact package formats and login tools | Maven, Gradle, npm, yarn, twine, pip, NuGet | Formats Cargo, generic, Maven, npm, NuGet, PyPI, Ruby, Swift; aws codeartifact login supports dotnet, npm, nuget, pip, swift, twine | AWS docs | 2026-10-12 |
| cicd | CodePipeline manual approval timeout | Fixed at 7 days | Account default 7 days; per-action timeoutInMinutes (manual approval actions only) from 5 to 86,400 minutes (60 days) | AWS docs | 2026-10-12 |
| cicd | CodePipeline pricing | $1 per active pipeline per month | V1 $1.00 per active pipeline/month (one free); V2 $0.002 per action execution minute, rounded up, 100 free minutes/month; manual approval and custom actions not charged | AWS docs | 2026-10-12 |
| cicd | CodePipeline source change detection | Pipelines poll CodeCommit, S3 or GitHub for changes | Event-based (EventBridge for CodeCommit/S3/ECR, connections for Git providers); polling off after 30 days without executions; max 300 polling pipelines per Region (fixed); omitted PollForSourceChanges = polling | AWS docs | 2026-10-12 |
| cicd | CodeDeploy agent runtime | The agent is a Ruby application and needs Ruby | Agent 2.x (2.0.0 on 2026-07-15) is a Rust binary without Ruby; opt-in via AWSCodeDeployAgentV2 or the latestv2 install script; no automatic upgrade from 1.8.x; minimum supported 1.8.x | AWS docs | 2026-10-12 |
| cicd | Notification rule chat targets | AWS Chatbot clients for Slack or Microsoft Teams | Amazon Q Developer in chat applications (AWS Chatbot renamed on 2025-02-19); APIs, IAM permissions, service principals and console URLs unchanged | AWS docs | 2026-10-12 |
| beanstalk | Elastic Beanstalk compute modes | One model: Beanstalk always runs your code on EC2 instances in an Auto Scaling group it manages | Two modes since 2026-09-17: Standard (EC2, dedicated Auto Scaling group) and Cluster (containers on a service-operated, shared Amazon EKS cluster with EKS Auto Mode) | AWS docs | 2026-10-12 |
| beanstalk | Default EC2 instance profile | The console creates aws-elasticbeanstalk-ec2-role automatically for the first environment | No longer auto-created: create a role trusted by ec2.amazonaws.com with AWSElasticBeanstalkWebTier / WorkerTier / MulticontainerDocker; existing default profiles keep working | AWS docs | 2026-10-12 |
| beanstalk | Managed user and service policies | AWSElasticBeanstalkFullAccess, AWSElasticBeanstalkReadOnlyAccess; service policy AWSElasticBeanstalkService | AdministratorAccess-AWSElasticBeanstalk and AWSElasticBeanstalkReadOnly (old ones being retired); AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy replaces AWSElasticBeanstalkService | AWS docs | 2026-10-12 |
| beanstalk | Default load balancer type | Classic Load Balancer is the default or a console choice | Console and EB CLI default to an ALB; CLB disabled in the console create wizard (EB CLI, AWS CLI or a clone still can); API default LoadBalancerType still classic; type fixed at creation | AWS docs | 2026-10-12 |
| beanstalk | Environment instances: launch templates | Beanstalk launches instances from Auto Scaling launch configurations | Accounts created on/after 2024-10-01 use launch templates; EnableSpot, DisableIMDSv1=true or a gp3 root volume migrate older environments (no way back) | AWS docs | 2026-10-12 |
| beanstalk | IMDSv1 default on environment instances | Instances allow both IMDSv1 and IMDSv2 | AL2023 and Windows Server 2022+ platforms: DisableIMDSv1 defaults to true (IMDSv2 only); Windows Server 2019, AL2 and earlier: false | AWS docs | 2026-10-12 |
| beanstalk | Worker environment scaling | The worker tier scales on the number of SQS messages by itself | Built-in triggers use instance/load balancer metrics (default NetworkOut, no SQS metric; docs describe CPU-based scaling); queue-depth scaling needs your own CloudWatch alarm and scaling policy | AWS docs | 2026-10-12 |
| beanstalk | Supported language platforms | Go, Java SE, Java with Tomcat, .NET Core on Linux, .NET on Windows Server, Node.js, PHP, Python, Ruby (no OS or versions) | AL2023-only Linux branches: Docker, ECS, Go 1, Corretto 8-25, Tomcat 9/10/11, .NET 8-10, Node.js 22/24, PHP 8.2-8.5, Python 3.11-3.14, Ruby 3.3-4.0; .NET on Windows Server 2019/2022/2025 (volatile) | AWS docs | 2026-10-12 |
| beanstalk | Packer Builder / custom platforms | Packer Builder is a supported platform | Custom platforms (Packer) retired 2022-07-18 with all Amazon Linux AMI branches; use a custom AMI on a managed platform or a Docker image | AWS docs | 2026-10-12 |
| beanstalk | Amazon Linux 2 platform branches | Amazon Linux 2 platforms are current | All remaining AL2 branches retired 2026-08-06; only AL2023 and Windows Server branches remain (Windows Server 2016 retired 2026-10-08) | AWS docs | 2026-10-12 |
| beanstalk | Multi-container Docker platform | Multicontainer Docker is the platform for several containers per instance | Multicontainer Docker (Amazon Linux AMI) retired 2022-07-18; ECS running on AL2023 runs the same Dockerrun.aws.json v2 with no source changes | AWS docs | 2026-10-12 |
| beanstalk | Single Container and Preconfigured Docker | Single Container Docker runs exactly one container per instance; Preconfigured Docker platforms exist | Both retired 2022-07-18; Docker running on AL2023 runs one or more containers per instance (Docker Compose, Dockerrun.aws.json v1/v3) and supersedes Preconfigured Docker | AWS docs | 2026-10-12 |
| beanstalk | Decoupling an RDS database | Snapshot, deletion protection, new environment without RDS, URL swap, terminate the old one, delete the DELETE_FAILED stack | Decouple in place since 2021-10-06 (console or HasCoupledDatabase=false) with DBDeletionPolicy Retain/Snapshot/Delete (default Delete), applied first in a separate update | AWS docs | 2026-10-12 |
| beanstalk | Application version quota | At most 1,000 application versions (fixed ceiling) | 1,000 per account per Region by default, shared by all applications, adjustable in Service Quotas (L-D64F1F14) | AWS docs | 2026-10-12 |
| beanstalk | Lifecycle policy rules | Rules based on time or on space | MaxCountRule or MaxAgeRule + service role; runs after each new version (not counted), <= 100 deletions per run; keeps in-use versions and those used < 10 weeks ago; bundles kept in S3 by default | AWS docs | 2026-10-12 |
| beanstalk | What a clone copies | A clone keeps every resource and setting of the original | Only Beanstalk-managed settings and fresh resource copies: no RDS data, no unmanaged changes, no ingress security groups (open to the internet until fixed); same platform branch only | AWS docs | 2026-10-12 |
| beanstalk | Secrets as environment variables | Keep secrets in plaintext environment properties or fetch them with the SDK in code | aws:elasticbeanstalk:application:environmentsecrets maps variables to Secrets Manager/Parameter Store ARNs (platforms from 2025-03-26; JSON keys from 2026-01-13); fetched at bootstrap | AWS docs | 2026-10-12 |
| beanstalk | Recommended instance customization | .ebextensions files and commands for every customization | AL2 and later (AL2023 today): prefer Buildfile, Procfile and platform hooks (.platform/hooks, .platform/confighooks); .ebextensions keeps option_settings and Resources | AWS docs | 2026-10-12 |
| cloudformation | Where templates must be stored (inline body vs S3) | Templates must be uploaded in S3 and then referenced in CloudFormation | Inline TemplateBody up to 51,200 bytes; larger templates up to 1 MB must be passed as an S3 TemplateURL (the console uploads local files to a CloudFormation-managed bucket) | AWS docs | 2026-10-12 |
| cloudformation | Per-template quotas (resources, parameters, outputs, mappings, S3 template size) | 200 resources, 60 parameters, 60 outputs, 100 mappings, 450 KB S3 template | 500 resources, 200 parameters, 200 outputs, 200 mappings (200 attributes each), 1 MB S3 template (since 2020-10-22) | What's New | 2026-10-12 |
| cloudformation | Visual template editor in the CloudFormation console | Editing templates in Infrastructure Composer | Template studio in the CloudFormation console; the standalone AWS Infrastructure Composer console ends support on 2026-12-07 (full experience stays in the AWS Toolkit for VS Code) | AWS docs | 2026-10-12 |
| cloudformation | Express mode for stack operations | every stack operation waits for each resource to stabilize | --deployment-config '{"mode": "EXPRESS"}' on create, update, delete, change sets and rollback-stack completes once configuration is applied; rollback off by default; not for StackSets; custom resources still wait | AWS docs | 2026-10-12 |
| cloudformation | Fn::FindInMap DefaultValue | DefaultValue requires the AWS::LanguageExtensions transform | DefaultValue works in any template | AWS docs | 2026-10-12 |
| cloudformation | Name of the reference intrinsic function | The Fn::Ref function can be leveraged to reference parameters (slides title it 'Fn::Ref') | The function is Ref (JSON {"Ref": "logicalName"}, YAML Ref: / !Ref); there is no Fn:: prefix | AWS docs | 2026-10-12 |
| cloudformation | Sharing stack outputs across accounts and Regions | Cross-stack sharing only through exported outputs and Fn::ImportValue (Fn::GetStackOutput absent from the slide's function list) | Fn::GetStackOutput reads outputs from other Regions and accounts (RoleArn) without an export, as a weak reference; ImportValue stays same account and Region | AWS docs | 2026-10-12 |
| cloudformation | When CAPABILITY_AUTO_EXPAND is required | Necessary when your CloudFormation template includes Macros or Nested Stacks | Required for a direct create or update (without reviewing a change set) of a template with macros or transforms, including macros combined with nested stacks; nested stacks alone don't need it; no effect on change sets | AWS docs | 2026-10-12 |
| cloudformation | Pre-deployment validation of stack operations and change sets | change sets only diff templates and catch nothing before execution | Runs on create-stack, update-stack and create-change-set: property syntax and name conflicts fail early; change sets also warn on quotas, non-empty buckets, Config recorders, ECR; skip with --disable-validation | AWS docs | 2026-10-12 |
| cloudformation | Change sets and drift | change sets compare only the new template with the previous template | Drift-aware change sets (--deployment-mode REVERT_DRIFT) compare actual, previous and desired state and revert drift | AWS docs | 2026-10-12 |
| cloudformation | Stack failure options on create and update | Stack creation fails: everything rolls back by default, with an option to disable rollback | Also Preserve successfully provisioned resources (--disable-rollback, then Retry, Update or rollback-stack) and --retain-except-on-create, which deletes newly created resources on rollback even with DeletionPolicy Retain | AWS docs | 2026-10-12 |
| cloudformation | Recovering from UPDATE_ROLLBACK_FAILED | Fix resources manually then issue ContinueUpdateRollback | Fix and continue, skip specific resources with --resources-to-skip, or --force-rollback to skip every resource that failed to roll back (nested stacks included) | AWS docs | 2026-10-12 |
| cloudformation | Recovering from DELETE_FAILED | delete-stack --retain-resources is the only way out | Also --deletion-mode FORCE_DELETE_STACK (since 2024-05-22) | AWS docs | 2026-10-12 |
| cloudformation | Default DeletionPolicy | Default DeletionPolicy=Delete | Delete, except Snapshot for AWS::RDS::DBCluster and for AWS::RDS::DBInstance without DBClusterIdentifier | AWS docs | 2026-10-12 |
| cloudformation | DeletionPolicy options | Delete, Retain, Snapshot | Delete, Retain, RetainExceptOnCreate, Snapshot | AWS docs | 2026-10-12 |
| cloudformation | Custom resource response wait time | a stuck custom resource always blocks the stack for 1 hour | ServiceTimeout property 1–3,600 seconds, default 3,600 | AWS docs | 2026-10-12 |
| cloudformation | Inline Lambda code size (ZipFile) for custom resources | inline ZipFile code limited to 4,096 characters | CloudFormation zips inline code into a package of up to 4 MB | AWS docs | 2026-10-12 |
| cloudformation | StackSets concurrency vs failure tolerance | maximum concurrent accounts can never exceed failure tolerance + 1 | ConcurrencyMode STRICT_FAILURE_TOLERANCE (default, caps concurrency at tolerance + 1) or SOFT_FAILURE_TOLERANCE (keeps the configured concurrency; since 2023-11-09) | AWS docs | 2026-10-12 |
| sam | SAM template format | All SAM configuration is YAML | SAM templates can be YAML or JSON (the AWS::Serverless transform reference shows both syntaxes) | AWS docs | 2026-10-12 |
| sam | SAM resource types (AWS::Serverless::*) | Only Function, Api and SimpleTable (or the original seven types) | 13 types (2026-10-12): Api, Application, CapacityProvider, Connector, Function, GraphQLApi, HttpApi, LayerVersion, MicrovmImage, NetworkConnector, SimpleTable, StateMachine, WebSocketApi | AWS docs | 2026-10-12 |
| sam | Scheduled function event type | Use the Schedule event (EventBridge / CloudWatch Events rule) | AWS recommends ScheduleV2 (EventBridge Scheduler, AWS::Scheduler::Schedule); Schedule still works and creates an AWS::Events::Rule | AWS docs | 2026-10-12 |
| sam | Globals resource types | Function, Api, HttpApi and SimpleTable only | 8 types (Globals reference, 2026-10-12): Function, Api, HttpApi, SimpleTable, StateMachine, CapacityProvider, MicrovmImage, NetworkConnector; the template-anatomy page lists six | AWS docs | 2026-10-12 |
| sam | sam package before sam deploy | sam package must run before sam deploy | sam deploy packages implicitly; sam package is optional (useful when the packaged template is a pipeline artifact) | AWS docs | 2026-10-12 |
| sam | Services the SAM CLI emulates locally | SAM runs Lambda, API Gateway and DynamoDB locally | The SAM CLI emulates Lambda and API Gateway; DynamoDB needs DynamoDB local (JAR, Docker image or Maven dependency) or a real development table | AWS docs | 2026-10-12 |
| sam | sam local start-api code reload | Changes to functions are always reloaded automatically | Automatic only for interpreted runtimes without an .aws-sam build; after sam build, run sam build again to pick up edits; template changes need a restart | AWS docs | 2026-10-12 |
| cdk | Command that installs the CDK CLI | npm install -g aws-cdk-lib installs the CLI and libraries | npm install -g aws-cdk installs the CLI (Node.js needed for every app language); aws-cdk-lib and constructs are per-project dependencies that cdk init adds | AWS docs | 2026-10-12 |
| cdk | CDK supported programming languages | JavaScript/TypeScript, Python, Java and .NET | TypeScript, JavaScript, Python, Java, C#/.NET and Go, all rated stable | AWS docs | 2026-10-12 |
| cdk | CDK CLI vs construct library versioning | The CDK CLI and aws-cdk-lib share one version number | CLI (aws-cdk-cli) released separately on a 2.1xxx line; each aws-cdk-lib release works with the CLI current at its release and any newer CLI; an older CLI fails with 'Cloud assembly schema version mismatch' | AWS docs | 2026-10-12 |
| cdk | Adding L2-style features to L1 constructs | L1 constructs must be configured property by property, with no way to borrow L2 features | Mixins (.with() or Mixins.of(scope).apply()) add features such as versioning or auto-delete to L1 and L2 constructs; Facades (Grants classes such as BucketGrants) add permission helpers to L1s | AWS docs | 2026-10-12 |
| cdk | S3 Bucket L2 lifecycle helper method name | bucket.addLifeCycleRule() | bucket.addLifecycleRule() (lower-case c) | AWS docs | 2026-10-12 |
| cdk | ALB + Fargate L3 pattern class name | aws-ecs-patterns.ApplicationLoadBalancerFargateService | ecs_patterns.ApplicationLoadBalancedFargateService ('Balanced'); the 'Balancer' class name does not exist | AWS docs | 2026-10-12 |
| cdk | Cross-stack references between CDK stacks | Always a CloudFormation export + Fn::ImportValue; cross-Region references need crossRegionReferences: true (custom resources) | Strong (default: export + Fn::ImportValue) or weak (Fn::GetStackOutput: no export lock, cross-account/Region) via @aws-cdk/core:defaultCrossStackReferences or CrossStackReferences.of(); BOTH to migrate | AWS docs | 2026-10-12 |
| cdk | Keeping resources when constructs are renamed or moved | A changed logical ID always means replacement unless you restore the old ID | cdk refactor --unstable=refactor (preview) maps old to new logical IDs via CloudFormation stack refactoring; the Default construct ID and overrideLogicalId() also preserve IDs | AWS docs | 2026-10-12 |
| cdk | Granting a principal access to an L2 resource | bucket.grantRead(fn), table.grantReadWriteData(fn) | bucket.grants.read(fn), table.grants.readWriteData(fn), BucketGrants.fromBucket(cfnBucket) for L1s; grantRead()-style methods still work but are discouraged; fn.grantInvoke() unchanged | AWS docs | 2026-10-12 |
| cdk | Resources in the CDKToolkit bootstrap stack | An S3 bucket (to store files) and IAM roles (for deployments) | S3 staging bucket, ECR repository, 5 IAM roles (CloudFormation execution, deployment, file publishing, image publishing, lookup) and SSM parameter /cdk-bootstrap/hnb659fds/version; no KMS key by default | AWS docs | 2026-10-12 |
| cdk | Error when deploying to an environment that was not bootstrapped | Policy contains a statement with one or more invalid principal | 'SSM parameter /cdk-bootstrap/hnb659fds/version not found. Has the environment been bootstrapped?'; the invalid-principals message comes from CDK Pipelines deploying into an unbootstrapped account | AWS docs | 2026-10-12 |
| cdk | How cdk diff computes differences | Compares template text only (--no-change-set) | --method auto (default) creates a read-only change set for accurate replacement info and falls back to a template diff; --method template for a text diff; --change-set is deprecated | AWS docs | 2026-10-12 |
| cdk | cdk deploy --hotswap fallback behaviour and coverage | --hotswap falls back to a CloudFormation deployment by itself; covers Lambda, Step Functions and ECS only | Non-hotswappable changes are skipped unless --hotswap-fallback; coverage also includes API Gateway, AppSync, CodeBuild, S3 BucketDeployment, EventBridge, DynamoDB, SQS, CloudWatch, Bedrock (volatile) | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | Amazon Data Firehose name (formerly Kinesis Data Firehose) | Amazon Kinesis Data Firehose ("delivery stream") | Renamed Amazon Data Firehose on 2024-02-09, name only: same endpoints, APIs (e.g. CreateDeliveryStream), CLI 'firehose', IAM and metrics. Docs now say 'Firehose stream'. Record max still 1,000 KiB. | What's New | 2026-10-12 |
| sqs-sns-kinesis | Amazon Managed Service for Apache Flink name (formerly Kinesis Data Analytics for Apache Flink) | Amazon Kinesis Data Analytics (Kinesis Data Analytics for Apache Flink; Kinesis Data Analytics Studio) | Renamed Amazon Managed Service for Apache Flink on 2023-08-30 (Studio became Managed Service for Apache Flink Studio). Existing apps run unchanged; API/CLI namespace is still kinesisanalyticsv2. | AWS blog | 2026-10-12 |
| sqs-sns-kinesis | Kinesis Data Analytics for SQL applications status | Active service: standard SQL over Kinesis Data Streams / Firehose sources | Discontinued: no bug fixes from 2025-09-01; no new apps and running apps stopped (READY, restartable) 2025-10-15; apps deleted from 2026-01-27, support ended. Re-create in Managed Service for Apache Flink or its Studio. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | Kinesis Data Streams PutRecords maximum request size | 5 MB per PutRecords request (up to 500 records, each up to 1 MB) | 10 MiB per PutRecords request incl. partition keys (was 5 MiB) since 2025-10-28; still max 500 records, each up to the stream's max record size (default 1 MiB, configurable to 10 MiB). | What's New | 2026-10-12 |
| sqs-sns-kinesis | Kinesis Data Streams maximum record size | 1 MB (1 MiB) per record data blob (before base64-encoding) | Up to 10 MiB per record (partition key + data blob, pre-base64) since 2025-10-28, opt-in per stream (default still 1 MiB) via UpdateMaxRecordSize or MaxRecordSizeInKiB; shard limits unchanged (1 MB/s in, 2 MB/s out). | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | SNS maximum message size | 256 KB (262,144 bytes), fixed; larger payloads need the SNS Extended Client Library (S3, up to 2 GB) | Default still 256 KiB. Since 2026-09-18 a topic's MaximumMessageSize (1,024 B-1 MiB; Standard+FIFO) can go to 1 MiB; topics above 256 KiB allow only SQS/Lambda/Firehose subs, max 100. Bigger: Extended Client (2 GB). | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | SQS maximum message size | 256 KiB (262,144 bytes); anything larger needs the SQS Extended Client Library (payload in S3, up to 2 GB) | 1 MiB (1,048,576 B) max, 1 B min, since 2025-08-04 (was 256 KiB). MaximumMessageSize 1 KiB-1 MiB, default 1 MiB; batch total 1 MiB; billed per 64 KB chunk (1 MiB = 16 requests). >1 MiB: Extended Client + S3 (2 GB). | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | SQS FIFO in-flight message limit | 20,000 in-flight messages per FIFO queue | 120,000 in-flight messages per FIFO queue (since 2024-11-21); no error at the limit. Standard queues: about 120,000 (short polling then returns OverLimit). | What's New | 2026-10-12 |
| sqs-sns-kinesis | SQS FIFO queue throughput | Capped at 300 msg/s per API action, 3,000 msg/s with batches of 10 | Normal mode as before (per partition). High throughput mode (DeduplicationScope=messageGroup + FifoThroughputLimit=perMessageGroupId): up to 70,000 TPS in us-east-1/us-west-2/eu-west-1, 2,400 default elsewhere. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | SQS default encryption at rest | Queues are unencrypted unless SSE is enabled with a KMS key | SSE-SQS (SQS-owned keys, AES-256, no extra cost) is the default for new queues created without encryption attributes (since 2022-10-04); not for queues created via the HTTP endpoint. | What's New | 2026-10-12 |
| sqs-sns-kinesis | SQS Extended Client Library languages | Java library only | Extended Client Libraries for Java and Python; payload stored in S3, up to 2 GB; synchronous clients only. SNS has its own Java and Python extended clients. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | SQS dead-letter queue redrive scope | Console-only redrive for standard queues | Console or API (StartMessageMoveTask, ListMessageMoveTasks, CancelMessageMoveTask; 2023-06-07); FIFO supported, same-type destination; default = source queue; up to 500 msg/s; 36 h per task; SQS-sourced DLQs only. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | CloudWatch metric for SQS backlog | Scale or alarm on the CloudWatch metric ApproximateNumberOfMessages | The CloudWatch metric is ApproximateNumberOfMessagesVisible (AWS/SQS, dimension QueueName); ApproximateNumberOfMessages is the GetQueueAttributes attribute name. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | MessageGroupId on SQS standard queues (fair queues) | MessageGroupId exists only on FIFO queues | Standard queues accept MessageGroupId as a tenant ID for fair queues (since 2025-07-21): no ordering, no consumer change, no throughput limit. SNS standard topics forward it only to SQS standard subscriptions. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | SNS FIFO topic throughput | Same as SQS FIFO: 300 msg/s, or 3,000 msg/s with batching | 300 msg/s per message group. FifoThroughputScope=Topic (default): 3,000 msg/s or 20 MB/s per topic. MessageGroup (2025-01-21, irreversible): per-group dedup, up to the Regional publish quota. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | SNS FIFO topic subscriber types | Only SQS FIFO queues can subscribe to an SNS FIFO topic | SQS FIFO and SQS standard queues (standard since 2023-09-14, without order or dedup guarantees); no Lambda, HTTP/S, email, SMS or mobile push subscriptions. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | SNS message persistence (archive and replay) | SNS never stores messages; undelivered messages are lost | Standard topics still store nothing (retries, then DLQ or drop). FIFO topics: ArchivePolicy keeps messages 1-365 days; a subscription ReplayPolicy replays a time window (since 2023-10-26). | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | SNS filter policy scope and operators | Filters match message attributes only; exact, prefix, anything-but, numeric and exists | FilterPolicyScope MessageAttributes (default) or MessageBody (2022-11-22); suffix, equals-ignore-case and $or (2023-11-16), plus cidr and wildcard; 5 keys, 150 combinations; up to 15 min to apply. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | SNS mobile push for Android | Google Cloud Messaging (GCM) | Firebase Cloud Messaging with FCM HTTP v1 credentials (supported since 2024-01-18); SNS still uses GCM as the platform name and payload key. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | SNS message data protection availability | Data protection policies on topics are available to every account | SNS message data protection is no longer available to new customers (since 2026-04-30). | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | Kinesis Data Streams capacity modes | Provisioned or on-demand; on-demand starts at 4 MB/s write or 4,000 records/s | On-demand Standard (starts 4 MB/s write, 8 MB/s read; 2x previous 30-day peak), On-demand Advantage (account-level, no stream fee, data >=60% cheaper, 25 MiB/s commitment, warm throughput) and Provisioned. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | Kinesis enhanced fan-out consumers per stream | Up to 20 registered consumers per stream | 20 per stream with On-demand Standard and Provisioned; 50 with On-demand Advantage (listed Regions); each consumer gets 2 MB/s per shard; at most 5 consumers CREATING at a time. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | Kinesis Client Library and Producer Library versions | KCL 1.x with a single DynamoDB lease table is the current library | KCL 3.x (GA 2024-11-06; CPU-based lease balancing, extra metadata tables) and KPL 1.x (GA 2024-12-15) current; KCL 1.x and KPL 0.x in maintenance since 2025-04-17, end-of-support date 2026-01-30. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | Kinesis record distribution strategy | The partition key always decides the shard | On-demand streams can switch to AUTO with UpdateStreamRecordDistributionStrategy: partition keys and ExplicitHashKey are ignored, no per-key order. USER_PARTITION_KEY stays the default. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | Kinesis Data Streams direct delivery to S3 | A stream needs Firehose or consumer code to land data in S3 | On-demand streams can deliver to S3 general purpose buckets or Iceberg streaming tables (S3 Tables) via CreateChannel: no consumer code, 300-900 s freshness, at most 2 deliveries per stream. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | Firehose buffering interval minimum | Firehose always buffers for at least 60 seconds | IntervalInSeconds 0-900 (default 300), SizeInMBs 1-128 (default 5); zero buffering since 2023-12-26, most streams without processing deliver within about 5 s. | AWS docs | 2026-10-12 |
| sqs-sns-kinesis | Firehose sources and destinations | Destinations S3, Redshift, OpenSearch, Splunk, a few partners and HTTP endpoints | Sources: Direct PUT, Kinesis Data Streams or Amazon MSK. Destinations also include OpenSearch Serverless, Apache Iceberg Tables, Snowflake and partners such as Coralogix, Dynatrace, Elastic and Sumo Logic. | AWS docs | 2026-10-12 |
| other-services | Step Functions execution start and state transition rates | Standard: over 2,000 executions per second; Express: over 100,000 per second | Soft quotas: Standard StartExecution bucket 1,300/refill 300 per s (us-east-1, us-west-2, eu-west-1; 800/150 elsewhere), 5,000 (800) transitions/s; Express 6,000/6,000 per s, transitions unlimited | AWS docs | 2026-10-12 |
| other-services | Step Functions Map state iteration fields | Iterator and Parameters define the Map iteration | ItemProcessor and ItemSelector replace Iterator and Parameters (old fields deprecated but still accepted) | AWS docs | 2026-10-12 |
| other-services | Step Functions data transformation (JSONata and variables) | JSONPath only: InputPath, Parameters, ResultSelector, ResultPath, OutputPath | Since 2024-11-22: JSONata (QueryLanguage, Arguments, Output, {% %}, $states) and variables (Assign; 256 KiB each, 10 MiB per execution); JSONPath stays the default | AWS docs | 2026-10-12 |
| other-services | Step Functions redrive of failed executions | A failed execution can only be started again from the beginning | RedriveExecution resumes failed, aborted or timed-out Standard executions from the failed step within 14 days (started on or after 2023-11-15); same ARN and input; retry counts reset; not Express | AWS docs | 2026-10-12 |
| other-services | Step Functions local testing | Test state machines locally with Step Functions Local | Step Functions Local is unsupported (no feature parity); use the TestState API, which since November 2025 mocks service results/errors and tests Map, Parallel, activity, .sync and callback states | AWS docs | 2026-10-12 |
| other-services | AppSync authorization types | Four: API_KEY, AWS_IAM, OPENID_CONNECT, AMAZON_COGNITO_USER_POOLS | Five: API_KEY, AWS_LAMBDA, AWS_IAM, OPENID_CONNECT, AMAZON_COGNITO_USER_POOLS | AWS docs | 2026-10-12 |
| other-services | AppSync real-time subscription protocol | Pure WebSockets or MQTT over WebSockets | Pure WebSockets only since 2022-01-01 (MQTT over WebSockets removed); subscription payloads up to 240 KB | AWS docs | 2026-10-12 |
| other-services | AppSync custom domain names | Put your own CloudFront distribution in front of AppSync for a custom domain and HTTPS | Native custom domains: public or imported ACM certificate in us-east-1, AppSync-managed CloudFront (SNI), https://<domain>/graphql and wss://<domain>/graphql/realtime, TLS 1.2/1.3 | AWS docs | 2026-10-12 |
| other-services | Amplify backend tooling (Gen 2) | Build backends with the Amplify CLI wizard (amplify push), Amplify Studio and DataStore | Gen 2 (GA 2024-05-06) for new apps: TypeScript code-first backend (defineAuth, defineData), npx ampx sandbox, npx ampx pipeline-deploy; no Studio data modeling or DataStore in Gen 2 | AWS docs | 2026-10-12 |
| other-services | AppConfig configuration sources | Parameter Store, SSM documents and S3 | Six: hosted configuration store (recommended; 2,048 KB per version by default, up to 4,000 KB), S3, Parameter Store, SSM documents, Secrets Manager, CodePipeline | AWS docs | 2026-10-12 |
| other-services | AppConfig configuration retrieval API | Call GetConfiguration with a client ID | GetConfiguration is deprecated (priced per configuration received); use StartConfigurationSession + GetLatestConfiguration (single-use tokens, 24 h) or the AppConfig Agent (recommended) | AWS docs | 2026-10-12 |
| other-services | OpenSearch SQL support | OpenSearch doesn't support SQL natively; a plugin must be enabled | SQL and PPL through the built-in SQL plugin on OpenSearch or Elasticsearch 6.5+ domains (POST _plugins/_sql); the native query language is still the JSON DSL | AWS docs | 2026-10-12 |
| other-services | Athena query engine | Athena is built on Presto | Athena engine version 3 tracks both the Trino and Presto open-source projects | AWS docs | 2026-10-12 |
| other-services | Athena federated query connectors | Every data source connector runs as a Lambda function in your account | Lambda connectors remain, but since 2026-04-21 certain new AWS Glue Data Catalog federated connectors register automatically without a Lambda function in your account | AWS docs | 2026-10-12 |
| other-services | Athena query result storage | Query results must be written to an S3 bucket you provide | S3 output location, or Athena managed query results per workgroup: no bucket, kept 24 hours at no cost, AWS owned or customer managed key | AWS docs | 2026-10-12 |
| other-services | QuickSight service name | Amazon QuickSight | Amazon Quick Sight, a capability of Amazon Quick; existing QuickSight APIs, SDKs and integrations keep working | AWS docs | 2026-10-12 |
| other-services | MSK cluster metadata management | MSK always creates and manages ZooKeeper nodes for each cluster | KRaft from Kafka 3.7.x (controllers included, no extra cost); 3.9 is the last version with both modes; migrate ZooKeeper clusters with UpdateClusterKafkaVersion; 60 brokers per KRaft cluster | AWS docs | 2026-10-12 |
| other-services | MSK broker storage | Data always sits on EBS volumes you size | Standard brokers: EBS 1-16,384 GiB per broker, optional tiered storage; Express brokers: pay-as-you-go storage with no sizing, up to 3x throughput, 20x faster scaling, 3 AZs only | AWS docs | 2026-10-12 |
| monitoring | A/B testing after Evidently: AWS AppConfig experimentation | AppConfig does feature flags and configuration only; A/B experiments are done with CloudWatch Evidently. | AWS AppConfig experimentation (A/B and multivariate tests on feature variations, traffic splits, audience targeting) GA since Jul 1, 2026 in all Regions incl. GovCloud (US). Analyze in CloudWatch or your own tools. | What's New | 2026-10-12 |
| monitoring | AWS X-Ray SDKs and X-Ray daemon support status | Instrument with the AWS X-Ray SDK and run the X-Ray daemon (UDP 2000) to batch and upload segments; presented as the standard, fully supported approach. | Maintenance mode since Feb 25, 2026: security-fix releases only, no new features; no end-of-support date set (N/A). The X-Ray service continues: traces remain in CloudWatch Traces/Trace Map and the X-Ray APIs. | AWS docs | 2026-10-12 |
| monitoring | Amazon CloudWatch Evidently status | CloudWatch Evidently is the service for feature flags, launches and A/B experiments. | Discontinued Oct 17, 2025 (announced Oct 17, 2024); the service and all its capabilities ended. AWS Lifecycle 'Full Shutdown'. Docs removed: the CloudWatch guide page redirects and the API reference returns 404. | AWS docs | 2026-10-12 |
| monitoring | CloudWatch Evidently replacement | Use Evidently for feature flags and launches; AppConfig is only for deploying application configuration. | Flags/launches: AWS AppConfig feature flags (Evidently client-side evaluation users already onboarded). A/B: 2024 notice said segments/splits + your data warehouse/lake; now AppConfig experimentation (GA Jul 1, 2026). | AWS blog | 2026-10-12 |
| monitoring | EventBridge maximum event size (PutEvents) | 256 KB per PutEvents request (sum of all entries, max 10 entries) | 1 MB (1,048,576 B) per PutEvents request to default/Classic buses (sum of up to 10 entries; one may use all 1 MB), up from 256 KB on 2026-01-29; at launch not in NZ, Thailand, Malaysia, Taipei, Mexico. Bigger: S3 + URL. | AWS docs | 2026-10-12 |
| monitoring | Recommended replacement for X-Ray SDK/daemon | AWS Distro for OpenTelemetry (ADOT) presented as an optional alternative; the X-Ray SDK plus daemon is the default way to send traces. | OpenTelemetry (OTel SDKs or ADOT); swap the daemon for CloudWatch agent 1.300025.0+ or OTel Collector + awsxray exporter. Lambda: AWS Lambda Layer for OpenTelemetry. Attributes -> metadata unless in aws.xray.annotations. | AWS docs | 2026-10-12 |
| monitoring | CloudWatch Logs maximum log event size (EMF included) | 256 KB per log event | 1 MB (1,024 KB) per log event since 2025-04-02, for PutLogEvents and the OTLP endpoint; EMF documents follow the same limit | AWS docs | 2026-10-12 |
| monitoring | PutLogEvents sequence token and request rate | Each call needs the previous nextSequenceToken (InvalidSequenceTokenException otherwise); 5 requests/s per log stream | Sequence token ignored; parallel PutLogEvents calls to one stream allowed; throttled per account and Region (5,000 requests/s default, adjustable) | AWS docs | 2026-10-12 |
| monitoring | CloudWatch Logs subscription filters per log group | 2 subscription filters per log group | Up to 5 per log group (not adjustable), plus one account-level subscription filter per Region (since 2024-01-11) | AWS docs | 2026-10-12 |
| monitoring | CloudWatch Logs Insights query languages | One purpose-built query language | Logs Insights QL, OpenSearch PPL and OpenSearch SQL (StartQuery queryLanguage CWLI / PPL / SQL); all billed per GB of uncompressed data scanned | AWS docs | 2026-10-12 |
| monitoring | CloudWatch Logs Insights concurrency and result size | 30 concurrent queries; 10,000 results per query | 100 concurrent Logs Insights QL queries incl. dashboards (15 PPL/SQL) since 2026-03-09 (most Regions); up to 100,000 QL results since 2026-05-15, 10,000 per GetQueryResults page | AWS docs | 2026-10-12 |
| monitoring | CloudWatch alarm action targets | EC2 stop/terminate/reboot/recover, Auto Scaling actions and SNS notifications only | Also Lambda invoke (since 2023-12-22; resource policy for lambda.alarms.cloudwatch.amazonaws.com), SSM OpsItem or Incident Manager incident, CloudWatch investigation (ALARM only); max 5 actions per state | AWS docs | 2026-10-12 |
| monitoring | CloudWatch composite alarm rules and actions | AND and OR conditions only; SNS notifications only | AND, OR, NOT, TRUE/FALSE and AT_LEAST (since 2025-11-11); SNS, Lambda, OpsItems/incidents, investigations; no EC2 or Auto Scaling actions; max 100 child alarms; not cross-account | AWS docs | 2026-10-12 |
| monitoring | CloudWatch Synthetics canary languages and browsers | Node.js or Python scripts with a headless Google Chrome browser | Node.js (Puppeteer or Playwright), Python (Selenium) or Java (since 2025-05-28, no browser); Chrome and Firefox (Selenium: Chrome only) | AWS docs | 2026-10-12 |
| monitoring | CloudWatch Synthetics canary blueprints | Six blueprints: heartbeat, API canary, broken link checker, visual monitoring, canary recorder, GUI workflow builder | Adds Multi checks (since 2025-10-22): up to 10 HTTP, DNS, SSL and TCP checks from a JSON configuration, with Secrets Manager authentication | AWS docs | 2026-10-12 |
| monitoring | EventBridge scheduled rules | EventBridge rules with cron or rate schedules are the way to run scheduled jobs | Scheduled rules are legacy (default bus only, UTC only, 1-minute precision); AWS recommends EventBridge Scheduler (time zones, one-time at() schedules, flexible windows, universal targets) | AWS docs | 2026-10-12 |
| monitoring | EventBridge permissions for Lambda, SNS and SQS targets | These targets always need a resource-based policy | Resource-based policy or an IAM execution role on the target (execution roles for Lambda, SNS and SQS targets since 2025-03-11); CloudWatch Logs targets use a resource policy only (no RoleArn) | AWS docs | 2026-10-12 |
| monitoring | EventBridge custom event bus types | One kind of custom event bus (rules and up to 5 targets, resource-based policies) | Since 2026-09-24: new Custom Event Bus (subscribers, 1-365-day retention, EventGroupId ordering, RAM sharing, aws eventsv2) beside Custom Event Bus - Classic (existing buses, APIs unchanged) | AWS docs | 2026-10-12 |
| monitoring | EventBridge cross-account delivery | Cross-account events always go through an event bus in the other account (resource-based policy) | New cross-account bus targets need an IAM role (since 2023-03-02); since 2025-01-21 rules can also deliver directly to SQS, SNS, Lambda, Kinesis or API Gateway targets in another account of the same Region (execution role in the bus account + a target resource policy that allows the bus account) | AWS docs · direct targets | 2026-10-18 |
| monitoring | Read-only CloudTrail management events in EventBridge | EventBridge never receives read-only (Get/List/Describe) API calls | Matched only by rules in state ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS (since 2023-11-17; CLI or CloudFormation only; both rules when forwarding); a trail with logging is required | AWS docs | 2026-10-12 |
| monitoring | CloudTrail single-Region trails | A trail can be applied to all Regions (default) or to a single Region in the console | Console trails are always multi-Region; single-Region trails only via CLI/API, where single-Region is the default and logging starts only after start-logging | AWS docs | 2026-10-12 |
| monitoring | CloudTrail data event resource types | S3 object-level activity and Lambda Invoke only | Many resource types via advanced event selectors (S3, Lambda, DynamoDB, SNS, SQS, Kinesis, CloudWatch metrics...); basic selectors: S3 objects, Lambda functions, DynamoDB tables only | AWS docs | 2026-10-12 |
| monitoring | CloudTrail Insights scope | Baseline of management events; continuous analysis of write events only | API call rate (write management) and API error rate (read/write management) Insights; since 2025-11-20 the same two types for data events (trails only) | AWS docs | 2026-10-12 |
| monitoring | CloudTrail Lake availability | CloudTrail Lake is the recommended way to run SQL over CloudTrail events | Closed to new customers since 2026-05-31; existing customers continue (critical bug fixes and security updates only); AWS points to CloudWatch for similar capabilities | AWS docs | 2026-10-12 |
| containers | ECS capacity types (launch types) | ECS has two launch types: EC2 and Fargate | Three capacity types: ECS Managed Instances (since 2025-09-30), Fargate and self-managed EC2, plus external instances (ECS Anywhere); Managed Instances only through a capacity provider strategy | AWS docs | 2026-10-12 |
| containers | AWS Copilot CLI support status (module scope item) | AWS Copilot is the supported, recommended CLI for building and deploying ECS applications | End of support 2026-06-12 (announced 2026-03-06): no updates, patches or support; deployed stacks keep running; use ECS Express Mode (2025-11-21) or the AWS CDK | AWS docs | 2026-10-12 |
| containers | AWS Copilot in the DVA-C02 in-scope services | AWS Copilot is an in-scope DVA-C02 service (exam guide v1.x, Containers category) | Exam guide v2.1 (2024-12-12) removed AWS Copilot; Containers = Amazon ECR, Amazon ECS, Amazon EKS | AWS docs | 2026-10-12 |
| containers | Fargate maximum task size | 16 vCPU and 120 GB is the Fargate maximum | 32 vCPU with 60, 120 or 244 GB (Linux, platform version 1.4.0+); 16 vCPU allows 32-120 GB | AWS docs | 2026-10-12 |
| containers | Default ECS log driver delivery mode | ECS container log delivery is blocking by default | non-blocking by default since 2025-06-25 (max-buffer-size 10m, overflow dropped); keep blocking with mode: blocking or the defaultLogDriverMode account setting | AWS docs | 2026-10-12 |
| containers | EBS volumes for ECS tasks | ECS tasks can't use EBS; EFS is the only persistent storage on Fargate | One new EBS volume per task, configured at launch, on Fargate 1.4.0+, EC2 (Nitro) and Managed Instances; needs the infrastructure role; deleted when a service task ends | AWS docs | 2026-10-12 |
| containers | Role that fetches task-definition secrets, pulls ECR images and sends awslogs logs | The EC2 instance profile fetches Secrets Manager/Parameter Store values, pulls the image and sends logs | Task execution role: secrets, registry auth and S3 env files on Fargate and EC2; ECR pulls and awslogs on Fargate, Managed Instances and external instances | AWS docs | 2026-10-12 |
| containers | Load balancer types for ECS services | ECS services integrate with ALB, NLB and Classic Load Balancer | ALB (recommended), NLB and GWLB with ip targets on Fargate and Managed Instances; Classic is legacy (EC2 only, 1 per service) | AWS docs | 2026-10-12 |
| containers | ECS service auto scaling policy types | ECS services scale with target tracking, step and scheduled policies on 1-minute metrics | Also predictive scaling; target tracking can use 20-second high-resolution CPU and memory metrics (ECSServiceAverage...HighResolution) | AWS docs | 2026-10-12 |
| containers | ECS-native deployment strategies | ECS natively supports only rolling updates; blue/green requires the CodeDeploy controller | ECS controller strategies ROLLING, BLUE_GREEN (2025-07-17), LINEAR and CANARY (2025-10-30) with lifecycle hooks, bake time and rollback; CODE_DEPLOY still supported | AWS docs | 2026-10-12 |
| containers | Deployment circuit breaker failure threshold and scope | Circuit breaker threshold is always 50 % of desired count (min 3, max 200) | Default unchanged but configurable: thresholdConfiguration COUNT, BOUNDED_PERCENT or UNBOUNDED_PERCENT plus resetOnHealthyTask; works for rolling and ECS-native blue/green | AWS docs | 2026-10-12 |
| containers | Where task placement strategies and constraints apply | Placement strategies and constraints exist only for the EC2 launch type | Strategies: EC2 only. Constraints: EC2 and ECS Managed Instances (ecs.subnet-id, ecs.availability-zone, ecs.instance-type, ecs.cpu-architecture). Fargate: neither | AWS docs | 2026-10-12 |
| containers | ECR login command | Log in with $(aws ecr get-login --no-include-email) | aws ecr get-login-password / docker login --username AWS --password-stdin <registry>; get-login is removed in AWS CLI v2; token valid 12 hours | AWS docs | 2026-10-12 |
| containers | ECR lifecycle policy actions and criteria | Lifecycle policies only expire images, by image count or age since push | Also transition to the archive storage class and the sinceImagePulled / sinceImageTransitioned criteria; archived images restore typically within 20 minutes | AWS docs | 2026-10-12 |
| containers | ECR tag immutability granularity | Tag immutability always applies to every tag in the repository | Wildcard exclusion filters (IMMUTABLE_WITH_EXCLUSION, MUTABLE_WITH_EXCLUSION) let selected tags such as latest behave differently | AWS docs | 2026-10-12 |
| containers | ECR basic scanning engine | ECR basic scanning uses the open-source Clair scanner | Basic scanning uses AWS native technology with the CVE database (OS packages; results via DescribeImageScanFindings); enhanced scanning uses Amazon Inspector | AWS docs | 2026-10-12 |
| containers | Pushing to an ECR repository that doesn't exist | A repository must always be created before the first push | A matching repository creation template with appliedFor CREATE_ON_PUSH creates it on push; without one ECR creates nothing | AWS docs | 2026-10-12 |
| containers | EKS compute (node) options | EKS offers only managed node groups, self-managed nodes and Fargate | Also EKS Auto Mode (launched 2024-12-01) and EKS Hybrid Nodes | AWS docs | 2026-10-12 |
| containers | Granting AWS permissions to EKS pods | Use IRSA (or the node role) to give pods AWS permissions | EKS Pod Identity recommended (pods.eks.amazonaws.com, EKS API association, Linux EC2 nodes only); IRSA for Fargate pods and non-EKS Kubernetes | AWS docs | 2026-10-12 |
| containers | Granting IAM principals access to the Kubernetes API | Grant IAM principals access by editing the aws-auth ConfigMap | EKS access entries (access policies or Kubernetes groups via the EKS API) are recommended; aws-auth ConfigMap is legacy | AWS docs | 2026-10-12 |
| containers | EKS storage options (CSI drivers) | EKS storage is limited to EBS, EFS, FSx for Lustre and FSx for NetApp ONTAP | Also FSx for OpenZFS, File Cache, Mountpoint for Amazon S3, S3 Files (through the EFS CSI driver) and instance store | AWS docs | 2026-10-12 |
| s3 | S3 Block Public Access default for new buckets | BPA on by default only for console-created buckets; buckets created via API/CLI/SDK/CloudFormation had BPA off | BPA enabled by default on every new bucket regardless of creation method (API/CLI/SDK/CloudFormation, not just console); rollout began Apr 5, 2023, all Regions by Apr 27-28, 2023; existing buckets unchanged. | What's New | 2026-10-12 |
| s3 | S3 Object Ownership / ACL default for new buckets | ACLs enabled with 'Object writer' ownership for buckets created via API/CLI/CloudFormation (console defaulted to ACLs disabled since 2021) | Bucket owner enforced (ACLs disabled) is the default for all new buckets since April 2023; bucket owner owns every object; PUTs with ACLs other than bucket-owner-full-control fail (400 AccessControlListNotSupported). | AWS docs | 2026-10-12 |
| s3 | S3 SSE-C default for new buckets | SSE-C usable on any bucket by supplying customer key headers over HTTPS | Since Apr 2026 SSE-C blocked by default for new general purpose buckets (except Bahrain/UAE) and existing buckets in accounts without SSE-C objects; enable via PutBucketEncryption BlockedEncryptionTypes=NONE, else 403. | AWS docs | 2026-10-12 |
| s3 | S3 conditional deletes | Not supported; DeleteObject is unconditional | Since Sep 16, 2025 general purpose buckets support conditional DeleteObject/DeleteObjects with If-Match ETag, enforceable via s3:if-match in bucket policies (Express One Zone had it from Nov 25, 2024). | What's New | 2026-10-12 |
| s3 | S3 conditional writes (If-None-Match / If-Match) | Not supported; last writer wins, so concurrent writers must coordinate client-side (e.g., DynamoDB lock table) | If-None-Match: * (Aug 20, 2024) and If-Match: <ETag> (Nov 25, 2024) on PutObject/CompleteMultipartUpload; CopyObject since Oct 29, 2025. Failure = 412 Precondition Failed. Enforce with s3:if-none-match/s3:if-match. | AWS docs | 2026-10-12 |
| s3 | S3 default encryption for new objects (SSE-S3) | Objects stored unencrypted unless bucket default encryption is enabled or SSE headers are sent | Since Jan 5, 2023 SSE-S3 (AES-256) is applied to all new object uploads in every bucket at no cost; default encryption can be changed (e.g., SSE-KMS) but not removed. Existing objects not re-encrypted. | AWS docs | 2026-10-12 |
| s3 | S3 maximum object size | 5 TB (5,000 GB) | 50 TB (48.8 TiB) in all Regions and storage classes since 2025-12-02; single PUT still 5 GB, console upload 160 GB; Transfer Manager with the CRT recommended above 5 TB | AWS docs | 2026-10-12 |
| s3 | KMS request quota hit by SSE-KMS uploads and downloads | 5,500, 10,000 or 30,000 requests per second depending on the Region | Shared symmetric quota: 10,000/s default; 20,000/s in us-east-2, ap-southeast-1/2, ap-northeast-1, eu-central-1, eu-west-2, eu-south-2; 100,000/s in us-east-1, us-west-2, eu-west-1; adjustable | AWS docs | 2026-10-12 |
| s3 | Number of S3 object encryption methods | Four: SSE-S3, SSE-KMS, SSE-C, client-side | Five: DSSE-KMS (aws:kms:dsse, two independent AES-256 layers, no S3 Bucket Keys) added 2023-06-13 | AWS docs | 2026-10-12 |
| s3 | S3 Object Lambda availability | Generally available way to transform objects on read with Lambda | Since 2025-11-07 only existing customers and selected APN partners, no new capabilities; alternatives: Lambda via function URL, API Gateway or CloudFront, or client-side processing | AWS docs | 2026-10-12 |
| s3 | S3 Intelligent-Tiering optional archive tier thresholds | Archive Access 90 to 700+ days; Deep Archive Access 180 to 700+ days | Archive Access from 90 days, Deep Archive Access from 180 days, each configurable up to a maximum of 730 days | AWS docs | 2026-10-12 |
| s3 | Minimum billable object size, Glacier Flexible Retrieval and Deep Archive | 40 KB | No minimum billable size; each archived object adds 40 KB of metadata (32 KB billed at the archive rate, 8 KB at S3 Standard) | AWS docs | 2026-10-12 |
| s3 | S3 storage classes | Seven classes | Eight current classes: plus S3 Express One Zone (2023-11-28; directory buckets, one AZ, single-digit ms, 99.95 % availability); Reduced Redundancy still exists but isn't recommended | AWS docs | 2026-10-12 |
| s3 | S3 server access log destinations | Another S3 bucket in the same Region | S3 bucket in the same Region and account (SSE-S3 only, no Object Lock, no Requester Pays) or CloudWatch Logs (structured, cross-account/Region, KMS) | AWS docs | 2026-10-12 |
| s3 | Searching S3 object metadata and tags | Not possible in S3; index metadata in an external database such as DynamoDB | S3 Metadata (GA 2025-01-27): read-only Apache Iceberg metadata tables (system, tags, user metadata) in a table bucket, queried with Athena; an own index stays valid | AWS docs | 2026-10-12 |
| s3 | General purpose bucket naming rules | Reserved: prefix xn-- and suffix -s3alias only | Also begin and end with a letter or digit, no adjacent periods; reserved prefixes sthree-, amzn-s3-demo-; suffixes --ol-s3, .mrap, --x-s3, --table-s3; -an only for the account regional namespace | AWS docs | 2026-10-12 |
| s3 | General purpose buckets per account | 100 (soft limit) | 10,000 by default since 2024-11-14, raisable to 1,000,000 via Service Quotas; accounts above 10,000 must use paginated ListBuckets | AWS docs | 2026-10-12 |
| s3 | Block Public Access configuration levels | Bucket and account level | Organization (AWS Organizations S3 policy, all four settings together), account, bucket and access point (fixed at creation); the most restrictive combination applies | AWS docs | 2026-10-12 |
| s3 | Lifecycle transitions of objects smaller than 128 KB | Skipped only for IA transitions; still archived to Glacier Flexible Retrieval or Deep Archive | Since Sep 2024 not transitioned to any class by default (older configurations keep the old behaviour until edited); override with size filters or varies_by_storage_class | AWS docs | 2026-10-12 |
| s3 | Minimum age before a lifecycle transition to Standard-IA or One Zone-IA | Objects must stay 30 days in S3 Standard first | No minimum since 2026-07-16: Transition Days can be 0 or any positive integer, and with Days 0 objects become eligible at the first midnight UTC after creation; the 30-day minimum storage charge in the IA classes still applies | What's New · AWS docs | 2026-10-18 |
| s3 | Amazon S3 Select availability | Filter CSV/JSON rows server-side with SQL | No longer available to new customers since 2024-07-25 (existing customers continue); use byte-range GETs, Amazon Athena or application-side filtering | AWS docs | 2026-10-12 |
| s3 | Enabling S3 Object Lock on existing buckets | Only when the bucket is created | Can be enabled on existing versioned buckets since 2023-11-20 (console or PutObjectLockConfiguration); afterwards it can't be disabled and versioning can't be suspended | AWS docs | 2026-10-12 |
| s3 | Replication of SSE-C encrypted objects | SSE-C objects are not replicated | Replicated like unencrypted and SSE-S3 objects since 2022-10-24, no extra permissions; SSE-KMS/DSSE-KMS still need the SseKmsEncryptedObjects opt-in | AWS docs | 2026-10-12 |
| s3 | Re-encrypting existing S3 objects | Always rewrite them with CopyObject in place or a Batch Operations Copy job | UpdateObjectEncryption switches SSE-S3/SSE-KMS objects to SSE-KMS (other key or Bucket Key) in place, keeping ETag and Last-Modified; unencrypted, SSE-C, DSSE-KMS still need a copy | AWS docs | 2026-10-12 |
| s3 | S3 Replication Time Control SLA | 99.99 % of objects within 15 minutes (SLA) | SLA covers 99.9 % of objects within 15 minutes per Region pair per month (credits below 99.9 %); the replication overview still cites 99.99 % as the design figure | AWS docs | 2026-10-12 |
| ec2 | Credentials for CLI/SDK use outside AWS | Use environment variables or named profiles with IAM user access keys | Prefer temporary credentials: aws login with console credentials (AWS CLI 2.32.0+, refreshed every 15 min, session up to 12 h), IAM Identity Center (aws configure sso) or IAM Roles Anywhere for servers; long-term keys only where roles are impossible |
AWS docs | 2026-10-12 |
| ec2 | AWS CLI v2 credential precedence | 6 sources: command-line options, environment, credentials file, config file, container, instance profile | 10 sources: options → environment → assume role → web identity → IAM Identity Center → credentials file → credential_process → config file → container (ECS task role) → EC2 instance profile |
AWS docs | 2026-10-12 |
| ec2 | AWS SDK for Java default credential chain | Java 1.x: system properties aws.accessKeyId / aws.secretKey, 5-step chain |
Java 2.x DefaultCredentialsProvider: aws.accessKeyId / aws.secretAccessKey / aws.sessionToken → environment variables → web identity token → shared credentials/config files → ECS container → instance profile (Java 1.x end of support 2025-12-31) |
AWS docs | 2026-10-12 |
| ec2 | IMDS default metadata version (HttpTokens) |
IMDSv1 is the default and both versions are always available | IMDSv2-only by default for AL2023 AMIs (ImdsSupport v2.0: required, hop limit 2) and console Quick Start launches ("V2 only"). Accounts can opt in to a per-Region default of required (March 2024) and enforce it (February 2026). With nothing set at launch, account (default "No preference") or AMI level, HttpTokens is optional |
AWS docs | 2026-10-12 |
| ec2 | IMDSv2 default for newly released instance types | AWS's November 2023 roadmap: newly released instance types use IMDSv2 only by default from mid-2024 | Current EC2 docs define no instance-type default; precedence is launch parameters → account default → AMI, and "not set" everywhere resolves to V1 or V2 (optional); check the instance's MetadataOptions |
AWS docs | 2026-10-12 |
| ec2 | Blocking launches that allow IMDSv1 (account-level enforcement) | Only IAM or SCP condition keys (ec2:MetadataHttpTokens) can block launches that allow IMDSv1 |
Since 2026-02-24, modify-instance-metadata-defaults --http-tokens-enforced enabled (or a declarative policy) fails any launch whose HttpTokens does not resolve to required; setting optional on an existing instance fails with UnsupportedOperation; instances that already allow IMDSv1 are untouched |
AWS docs | 2026-10-12 |
| ec2 | AL2023 instance metadata defaults (ImdsSupport v2.0) |
Instances default to IMDSv1 allowed (HttpTokens optional) with a PUT response hop limit of 1 |
AL2023 AMIs carry ImdsSupport v2.0: instances default to HttpTokens required with hop limit 2 (an account-level hop limit overrides the AMI value) |
AWS docs | 2026-10-12 |
| ec2 | AL2023 cloud-init behaviour and package manager | Amazon Linux 2: cloud-init installs security updates at launch, unreachable remote includes are ignored, package manager yum |
AL2023: no launch-time security updates by default, unavailable remote resources fail cloud-init ("fail closed"), package manager DNF | AWS docs | 2026-10-12 |
| ec2 | AL2023 deterministic upgrades and boot-time version drift | Every boot-time yum install pulls the newest packages, so instances drift between launches |
Versioned repositories are on by default: dnf installs from the Amazon Linux repositories lock to the AMI's release; drift comes from a changing AMI (latest-AMI SSM parameter), --releasever=latest upgrades, or unpinned pip/npm/third-party sources |
AWS docs | 2026-10-12 |
| ec2 | Security group scope (VPC associations and sharing) | A security group is locked to the single VPC it was created in | Still Region-scoped, but it can be associated with other VPCs in the same Region (Security Group VPC Associations) and shared with accounts in the same AWS Organization (AWS RAM, same Region) | AWS docs | 2026-10-12 |
| ec2 | Public IPv4 and Elastic IP charge | An Elastic IP is free while attached to a running instance | Since 1 Feb 2024 every public IPv4 address, in use or idle, including an Elastic IP on a running instance, is billed $0.005 per IP-hour | AWS docs | 2026-10-12 |
| ec2 | EC2 Instance Connect IP address support | EC2 Instance Connect needs a public IPv4 address | Since 23 Sep 2024 it also connects to a public IPv6 address; the instance needs a public IPv4 or IPv6 address in a subnet with a route to the internet. Browser-client prefix lists: com.amazonaws.<region>.ec2-instance-connect (IPv4) and com.amazonaws.<region>.ipv6.ec2-instance-connect (IPv6). Inbound TCP 22 is still required. |
AWS docs | 2026-10-12 |
| ec2 | EC2 Instance Connect preinstalled AMIs | EC2 Instance Connect works out of the box only on Amazon Linux 2 | Preinstalled on the AL2023 standard AMI, Amazon Linux 2 2.0.20190618 or later, Ubuntu 20.04 or later, and macOS Sonoma 14.2.1+, Ventura 13.6.3+ and Monterey 12.7.2+ | AWS docs | 2026-10-12 |
| ec2 | EC2 Instance Connect Endpoint | EC2 Instance Connect always needs a public IP; private instances need a bastion | Since June 2023 an EIC Endpoint reaches instances by private IPv4 address (IPv6 and dual-stack endpoints since October 2025) with no public IP, internet gateway or bastion. The instance SG must still allow 22 or 3389 from the endpoint SG; IAM action ec2-instance-connect:OpenTunnel. Limits: 1 hour per connection, 20 concurrent connections, 1 endpoint per VPC and per subnet, 5 per account per Region. No extra charge. |
AWS docs · quotas | 2026-10-12 |
| ec2 | On-Demand per-second billing by operating system | Only Linux and Windows are billed per second; every other OS is billed hourly | Per second with a 60 s minimum for Linux, Windows (including SQL Server editions), RHEL and Ubuntu Pro; only SLES is billed per full hour | AWS pricing | 2026-10-12 |
| ec2 | Savings Plans returns | A Savings Plan can never be cancelled or returned | Since 20 Mar 2024 a Savings Plan with an hourly commitment of $100 or less can be returned within 7 days of purchase and in the same calendar month; up to 10 returns per calendar year per management account; upfront payments are refunded in full (ReturnSavingsPlan API). Otherwise the commitment can't be changed or cancelled. |
AWS docs | 2026-10-12 |
| ec2 | Savings Plans types | Only Compute, EC2 Instance and SageMaker Savings Plans exist | Four types: Compute (up to 66%), EC2 Instance (up to 72%, one family in one Region), SageMaker AI (up to 64%) and Database Savings Plans (up to 35% across Aurora, RDS, DynamoDB, ElastiCache and other database services) | AWS docs | 2026-10-12 |
| ec2 | Spot pricing model and interruptions | Spot is an auction: you lose the instance when outbid or when the price passes your bid, so bid high to keep it | There is no bidding. EC2 interrupts mainly to reclaim capacity. The max price defaults to the On-Demand price, setting one only increases interruptions, and you always pay the current Spot price. | AWS docs | 2026-10-12 |
| ec2 | Spot request APIs | Spot Fleet, RequestSpotInstances and Spot blocks are the main Spot tools |
Spot Fleet (RequestSpotFleet) and RequestSpotInstances are legacy APIs with no planned investment, and AWS strongly discourages both. Use Auto Scaling groups, EC2 Fleet (instant type when no scaling is needed) or RunInstances with Spot market options. Defined-duration Spot blocks are deprecated. |
AWS docs · Spot requests | 2026-10-12 |
| ec2 | Spot allocation strategy recommendation | lowest-price (or capacity-optimized) is the strategy to choose |
price-capacity-optimized is recommended. lowest-price is marked "not recommended" (highest risk of interruption) but is still the API default for SpotAllocationStrategy, and in ASGs it is available only through the AWS CLI/API. |
AWS docs | 2026-10-12 |
| ec2 | Future-dated Capacity Reservations | Capacity Reservations never involve a commitment and can always be cancelled freely | Since 21 Nov 2024 future-dated reservations (requested 5–120 days ahead) need a commitment duration (minimum 14 days, or 12 weeks for U and X instances) and at least 32 vCPUs, and a cancellation charge may apply. Immediate-use reservations are still commitment-free. | AWS docs | 2026-10-12 |
| ec2 | gp3 maximum size, IOPS and throughput | 16 TiB, 16,000 IOPS, 1,000 MiB/s | 64 TiB, 80,000 IOPS (500 IOPS per GiB), 2,000 MiB/s (0.25 MiB/s per IOPS), since 2025-09-26 | AWS docs | 2026-10-12 |
| ec2 | io2 vs io2 Block Express | io2 is limited to 64,000 IOPS and 16 TiB unless it is Block Express | All io2 volumes are io2 Block Express since 2025-04-30: 4 GiB–64 TiB, 256,000 IOPS (1,000 per GiB), 4,000 MiB/s, 99.999% durability | AWS docs | 2026-10-12 |
| ec2 | IOPS threshold for Provisioned IOPS volumes | Any requirement above 16,000 IOPS needs io1/io2 | gp3 covers up to 80,000 IOPS and 2,000 MiB/s; io2 Block Express is for more than that, sub-millisecond latency, 99.999% durability or Multi-Attach | AWS docs | 2026-10-12 |
| ec2 | Elastic Volumes modification frequency | Wait at least 6 hours between modifications of the same volume | A new modification can start when the previous one completes, up to 4 per volume per rolling 24 hours (since 2026-01-15) | AWS docs | 2026-10-12 |
| ec2 | EBS encryption instance support | Only some instance types support EBS encryption | Available on all current and previous generation instance types | AWS docs | 2026-10-12 |
| ec2 | Recycle Bin coverage | Snapshots and AMIs only | Also deleted EBS volumes (retention 1–7 days), since 2025-11-20 | AWS docs | 2026-10-12 |
| ec2 | Volume initialization from snapshots | Fast Snapshot Restore and manual pre-warming are the only options | Provisioned Rate for Volume Initialization of 100–300 MiB/s per volume (since 2025-05-06) | AWS docs | 2026-10-12 |
| ec2 | Duplicating an EBS volume (copy-volumes) |
A snapshot is the only way to duplicate a volume | copy-volumes makes an instant, crash-consistent same-AZ copy that can encrypt or re-key it (since 2025-10-14). VolumeType defaults to gp2. Background initialization runs at the lowest of 3,000 IOPS / 125 MiB/s and both volumes' provisioned levels. 1 copy per source at a time, at most 5 in progress per Region. |
AWS docs | 2026-10-12 |
| ec2 | Giving another account a volume's data | Only by sharing a snapshot | Volumes can be shared through AWS RAM (AWSRAMPermissionEBSVolumeCopyAccess); the other account can only view and copy them in the same AZ, never attach them. Unencrypted or customer managed key only; aws/ebs volumes cannot be shared. |
AWS docs | 2026-10-12 |
| ec2 | Deregistering an AMI and its snapshots | Snapshots always have to be deleted separately | Snapshots are still kept by default, but deregister-image --delete-associated-snapshots deletes them in the same call (since 2025-05-28) |
AWS docs | 2026-10-12 |
| ec2 | Amazon Linux 2 AMI parameter | /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2 |
AL2 reached end of support on 2026-06-30; use the AL2023 SSM parameters (al2023-ami-kernel-default-x86_64 / -arm64) |
AWS FAQ | 2026-10-12 |
| ec2 | Root volume replacement sources | Only the launch state, a snapshot of the root, or an AMI | create-replace-root-volume-task --volume-id swaps in an existing available, detached same-AZ volume (since 2026-07-09). DeleteOnTermination does not carry over; encrypted → unencrypted is rejected. |
AWS docs | 2026-10-12 |
| ec2 | EFS file system type naming | EFS Standard (multi-AZ) and One Zone / One Zone-IA as availability options | File system types are Regional (≥ 3 AZs) and One Zone; "EFS Standard" now names the SSD storage class | AWS docs | 2026-10-12 |
| ec2 | EFS storage classes and small files | Only Standard and IA classes; files smaller than 128 KiB never leave Standard | Standard, Infrequent Access and Archive; files under 128 KiB are tiered (billed as 128 KiB) for lifecycle policies set since 2023-11-26 | AWS docs | 2026-10-12 |
| ec2 | EFS Max I/O performance mode | Choose Max I/O for highly parallel big-data or media workloads | Max I/O is previous generation, not supported with Elastic throughput or One Zone; AWS recommends General Purpose for all file systems | AWS docs | 2026-10-12 |
| ec2 | EFS Elastic throughput limits | Up to 3 GiB/s read and 1 GiB/s write | 20–60 GiB/s read and 1–5 GiB/s write per file system (Region-dependent); 1,500 MiB/s per client with amazon-efs-utils 2.0+ (500 MiB/s otherwise) | AWS docs | 2026-10-12 |
| ec2 | EFS default throughput mode and encryption | Bursting is the default everywhere | The console defaults to Elastic, General Purpose and encryption at rest; the CreateFileSystem API/CLI still defaults to bursting and no encryption unless requested |
AWS docs | 2026-10-12 |
| ec2 | Mounting S3 as a file system (S3 Files) | S3 cannot be mounted as a POSIX file system with locking | Amazon S3 Files (built on EFS) mounts a bucket over NFS 4.1/4.2 with POSIX permissions and file locking from EC2, Lambda, ECS and EKS | AWS docs | 2026-10-12 |
| ec2 | NLB security groups | NLBs have no security groups | Supported since 10 Aug 2023, but only if at least one is attached at creation (cannot be added later); QUIC/TCP_QUIC listeners require an NLB with no security groups | AWS docs | 2026-10-12 |
| ec2 | NLB listener protocols | TCP, TLS and UDP only | TCP, TLS, UDP, TCP_UDP, QUIC and TCP_QUIC (QUIC since 13 Nov 2025; QUIC needs an ipv4 NLB without SGs, fixed 300 s deregistration delay, no Proxy Protocol v2) |
AWS docs | 2026-10-12 |
| ec2 | NLB TCP idle timeout | Fixed at 350 s | Default 350 s, configurable 60–6000 s per TCP listener (tcp.idle_timeout.seconds); TLS listeners stay at a fixed 350 s |
AWS docs | 2026-10-12 |
| ec2 | ALB rule condition matching | Only * and ? wildcards |
host-header, path-pattern and http-header conditions also accept regular expressions (RegexValues) |
AWS docs | 2026-10-12 |
| ec2 | ALB public IPv4 addresses | ALB public IPs are always AWS-chosen; only an NLB gives allow-listable addresses | An internet-facing IPv4 ALB can draw public IPv4 addresses from an Amazon VPC IPAM pool (e.g. BYOIP) via modify-ip-pools; not for internal ALBs; falls back to AWS-managed IPs when the pool is exhausted; an NLB is still needed for fixed per-AZ IPs |
AWS docs | 2026-10-12 |
| ec2 | CLB cross-zone default | CLB: cross-zone load balancing disabled by default | Disabled by default via API/CLI, enabled by default in the console; no inter-AZ charge | AWS docs | 2026-10-12 |
| ec2 | ALB access-log bucket policy | Grant s3:PutObject to a Region-specific ELB account ID; S3 is the only destination |
Grant the service principal logdelivery.elasticloadbalancing.amazonaws.com (supported in all Regions since 10 Sep 2025; the legacy policy still works); ALB logs can also go out as CloudWatch vended logs |
AWS docs | 2026-10-12 |
| ec2 | ACM public certificate validity and renewal | 13 months (395 days), renewal from 60 days before expiry | 198 days, managed renewal 45 days before expiry (since February 2026); the CA/B Forum maximum falls to 100 days from 15 Mar 2027 and 47 days from 15 Mar 2029 (ACM's future values not yet documented) | What's New | 2026-10-12 |
| ec2 | ACM exportable public certificates | ACM public certificates and their private keys can never leave ACM | Exportable public certificates since 17 Jun 2025 (certificate, key and chain); $7 per FQDN / $79 per wildcard at issuance and each renewal since February 2026 (launched at $15/$149); standard certificates are still not exportable | AWS pricing | 2026-10-12 |
| ec2 | Default ELB TLS security policy | ELBSecurityPolicy-2016-08 (or ELBSecurityPolicy-TLS13-1-2-2021-06) is the default everywhere |
Console: ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09; CLI, CloudFormation and CDK: ELBSecurityPolicy-2016-08 (allows TLS 1.0/1.1), so set SslPolicy explicitly |
AWS docs | 2026-10-12 |
| ec2 | Launch configurations | Legacy but still available | No new instance types since 1 Jan 2023; no console creation for accounts created on or after 1 Jun 2023; no creation by any method for accounts created on or after 1 Oct 2024 | AWS docs | 2026-10-12 |
| ec2 | Auto Scaling health check types | Only EC2 and ELB health checks | EC2 (default, always on), ELB, VPC Lattice and EBS health checks, plus custom health (set-instance-health) |
AWS docs | 2026-10-12 |
| ec2 | Detecting application failures in an ASG | Only ELB health checks detect application failures | EC2 application status checks (HTTP/HTTPS every 60 s, thresholds 2/2, 6 s timeout, matcher 200, 300 s initialization grace; associated by tag aws:autoscaling:groupName) make Auto Scaling replace impaired instances even with health check type EC2; no redirects followed; $0.01 per managed ENI-hour per AZ |
AWS docs | 2026-10-12 |
| ec2 | SQS backlog-per-instance scaling | Publish backlog per instance yourself with PutMetricData |
Target tracking computes it with metric math (ApproximateNumberOfMessagesVisible / GroupInServiceInstances); group metrics must be enabled |
AWS docs | 2026-10-12 |
| ec2 | Scaling cooldown scope | During the cooldown the ASG launches or terminates nothing | The default 300 s cooldown gates simple scaling; target tracking and step scaling scale out without it; scheduled actions and unhealthy-instance replacement ignore it; scale-in can still be delayed | AWS docs | 2026-10-12 |
| ec2 | Instance refresh capacity behaviour | An instance refresh always terminates first, dropping capacity to the minimum healthy percentage | MinHealthyPercentage 100% launches replacements before terminating; MaxHealthyPercentage 100–200% (max − min ≤ 100) replaces more at once |
AWS docs | 2026-10-12 |
| ec2 | Termination lifecycle hook outcome | A termination hook can never stop the termination (with ABANDON or CONTINUE, the instance terminates) | An instance lifecycle policy (since 20 Nov 2025) can retain the instance on TerminateHookAbandon in Terminating:Retained (still billed, outside desired capacity; terminate it with terminate-instance-in-auto-scaling-group) |
AWS docs | 2026-10-12 |
| ec2 | Lifecycle hook notification targets | EventBridge, SNS or SQS only | EventBridge (console default), SNS or SQS (role ARN; no FIFO queues), or Lambda directly (since 28 Jul 2025; resource-based policy for AWSServiceRoleForAutoScaling), set via the CLI, CloudFormation or an SDK |
AWS docs | 2026-10-12 |
| ec2 | CloudWatch Logs agent (awslogs) |
The CloudWatch Logs agent is a valid choice for shipping EC2 logs | Deprecated; it does not work on instances that require IMDSv2. Use the unified CloudWatch agent, which AWS strongly recommends in all cases. | AWS docs | 2026-10-12 |
| ec2 | PutMetricData request limits |
20 metrics and 40 KB per PutMetricData call |
Up to 1,000 metrics and 1 MB per request (gzip allowed), 150 values per Values array, 30 dimensions per metric; timestamps from 2 weeks in the past to 2 hours in the future |
AWS docs | 2026-10-12 |
| ec2 | High-resolution alarm periods | Sub-minute alarm periods are 10 and 30 seconds only | Valid periods are 10, 20 or 30 s, or any multiple of 60 s. Sub-minute periods are only useful on StorageResolution 1 metrics: on standard data the alarm often lapses into INSUFFICIENT_DATA and is still billed as a high-resolution alarm. |
AWS docs | 2026-10-12 |
| ec2 | Simplified automatic recovery | Automatic instance recovery always requires a CloudWatch alarm with the recover action | Enabled by default on supported instances; it acts on system status check failures only, never when only the instance check fails. Bare-metal instances, instances with instance store volumes, Dedicated Hosts, EFA instances and Auto Scaling group members are excluded. Alarm-based recover still works, with StatusCheckFailed_System. |
AWS docs | 2026-10-12 |
| ec2 | EC2 status check types | EC2 has only system and instance status checks | Four types: system, instance, attached EBS (StatusCheckFailed_AttachedEBS, Nitro only) and opt-in application status checks (HTTP/HTTPS probe of an application path, metric StatusCheckFailed_Application) |
AWS docs | 2026-10-12 |
| rds | ElastiCache support for Valkey | ElastiCache engines: Redis and Memcached only | Valkey support since 2024-10-08 (Serverless 33% / node-based 20% cheaper; zero-downtime upgrade from Redis OSS); engines Valkey, Memcached, Redis OSS; Valkey 9.1 is the newest engine (release date undocumented). | What's New | 2026-10-12 |
| rds | RDS storage autoscaling trigger | Free space < 10% for 5 min and at least 6 hours since the last storage modification | Free space <= 10% for >= 5 min, previous storage optimization finished and fewer than 4 storage modifications in 24 h; step = max(10 GiB, 10%, 7-hour forecast); ceiling >= 10% above allocated. | AWS docs | 2026-10-12 |
| rds | Multi-AZ and read scaling | Multi-AZ standbys never serve reads; Multi-AZ is not for scaling | True for a Multi-AZ DB instance (failover 60-120 s); a Multi-AZ DB cluster (RDS for MySQL/PostgreSQL) has 2 readable standbys in 3 AZs, a reader endpoint and failover typically < 35 s. | AWS docs | 2026-10-12 |
| rds | Aurora maximum cluster volume | Up to 128 TB, grows in 10 GB increments | 256 TiB on Aurora MySQL 3.10+ and Aurora PostgreSQL 15.13+/16.9+/17.5+ (128 TiB on earlier versions); grows automatically and shrinks when data is removed; no fixed increment. | AWS docs | 2026-10-12 |
| rds | Aurora Replica lag | Under 10 ms | Usually much less than 100 ms (AuroraReplicaLag, milliseconds). | AWS docs | 2026-10-12 |
| rds | Aurora failover time | Instantaneous, or always under 30 seconds | With at least one replica typically < 60 s, often < 30 s; with no replica the writer is recreated in the same AZ, typically in < 10 minutes. | AWS docs | 2026-10-12 |
| rds | Aurora Global Database secondary Regions | Up to 5 secondary Regions | Up to 10 read-only secondary Regions, replication typically < 1 s, up to 16 read-only instances per secondary cluster. | AWS docs | 2026-10-12 |
| rds | Aurora encryption at rest default | Unencrypted unless encryption is chosen at launch | Clusters created on or after 2026-02-18 are encrypted by default (AWS owned key); copies, clones and replicas of older unencrypted clusters stay unencrypted. RDS instances still default to unencrypted. | AWS docs | 2026-10-12 |
| rds | Encrypting an existing unencrypted database | Only via snapshot, encrypted snapshot copy and restore | That path, or a blue/green deployment whose green environment uses a target KMS key (TargetKmsKeyId); Aurora can also restore an unencrypted snapshot into an encrypted cluster. | AWS docs | 2026-10-12 |
| rds | RDS Proxy authentication to the database | Database credentials must be stored in Secrets Manager | Since 2025-09-12 also end-to-end IAM (DefaultAuthScheme IAM_AUTH, no secrets; MySQL, MariaDB and PostgreSQL engine families, not SQL Server). | What's New | 2026-10-12 |
| rds | ElastiCache Redis OSS persistence | Durability through AOF persistence | AOF (appendonly, appendfsync) not supported; use Multi-AZ replicas and snapshots, Valkey 9.0+ durability (sync = zero loss, async = up to 10 s at risk) or MemoryDB. | AWS docs | 2026-10-12 |
| rds | ElastiCache network access | Reachable only from inside its VPC | Serverless Valkey 9.0+ caches can use a public endpoint with IAM authentication and TLS 1.3 for every connection (documented 2026-09-29); node-based clusters stay VPC-only. | AWS docs | 2026-10-12 |
| rds | MemoryDB name and engines | Amazon MemoryDB for Redis (Redis-compatible) | Amazon MemoryDB, compatible with Valkey (since 2024-10-08, priced 30% lower than MemoryDB for Redis OSS) and Redis OSS. | AWS docs | 2026-10-12 |
| rds | IAM DB authentication connection rate | Use IAM DB auth only below 200 new connections per second | No rate ceiling documented; needs 300-1,000 MiB extra DB memory; use RDS Proxy for high connection rates; token valid 15 min, TLS required. | AWS docs | 2026-10-12 |
| rds | Database load monitoring (Performance Insights) | Use the Performance Insights dashboard | CloudWatch Database Insights; the Performance Insights console experience reached end of life on 2025-11-30 (the Performance Insights API remains). | AWS docs | 2026-10-12 |
| rds | Aurora Serverless v2 capacity | 0.5-128 ACUs; only Aurora Serverless v1 can pause | 0-256 ACUs on current engine versions (256 since 2024-10-03; auto-pause at 0 ACUs since 2024-11-20; SecondsUntilAutoPause 300-86,400 s, default 300). | AWS docs | 2026-10-12 |
| rds | Aurora Serverless v1 | Recommended for intermittent workloads because it pauses | End of life 2025-03-31; no new v1 clusters after 2025-01-08; use Aurora Serverless v2 with a 0 ACU minimum. | AWS docs | 2026-10-12 |
| rds | RDS Data API scope | Works only with Aurora Serverless v1 | Aurora PostgreSQL and Aurora MySQL clusters with provisioned or Serverless v2 instances (Aurora MySQL since 2024-09-26); 45 s per call, 1 MiB response, 4 MiB request. | AWS docs | 2026-10-12 |
| rds | Default RDS TLS certificate authority | rds-ca-2019 | rds-ca-rsa2048-g1 (also rds-ca-rsa4096-g1, rds-ca-ecc384-g1); RDS rotates server certificates automatically; trust only the root bundle. | AWS docs | 2026-10-12 |
| rds | RDS for PostgreSQL TLS enforcement | rds.force_ssl is off by default | rds.force_ssl defaults to 1 (TLS required) on RDS for PostgreSQL 15 and later, 0 on 14 and earlier. | AWS docs | 2026-10-12 |
| rds | TTL with write-through caching | No TTL needed when you use write-through | Put a TTL on every write, write-through included, to limit cache churn and staleness. | AWS docs | 2026-10-12 |
| cloudfront | CloudFront cache behaviors per distribution | 25 cache behaviors per distribution | 75 per distribution by default (adjustable) | AWS docs | 2026-10-12 |
| cloudfront | CloudFront origins per distribution | 25 origins per distribution | 100 per distribution by default (adjustable); up to 10 origin groups per distribution | AWS docs | 2026-10-12 |
| cloudfront | CloudFront origin response (read) timeout | 1-60 s, default 30 s | 1-120 s, default 30 s, higher through a quota request; optional response completion timeout (2025-07-30) caps the whole wait | AWS docs | 2026-10-12 |
| cloudfront | CloudFront largest cacheable object | 30 GB (earlier 20 GB) | 50 GB per GET response (only GET responses are cached) | AWS docs | 2026-10-12 |
| cloudfront | CloudFront origin failover status codes | 400, 403, 404, 416, 500, 502, 503, 504 | 400, 403, 404, 416, 429, 500, 502, 503, 504; failover only for GET, HEAD and OPTIONS requests | AWS docs | 2026-10-12 |
| cloudfront | CloudFront pricing model | Pay-as-you-go only, with price classes All, 200 and 100 | Price classes unchanged (PriceClass_All default); flat-rate plans Free, Pro, Business, Premium (AWS WAF bundled, no overage charges) since 2025-11-18 | AWS docs | 2026-10-12 |
| cloudfront | CloudFront cache policy option naming | Headers None/Whitelist; cookies and query strings None/Whitelist/All-Except/All | Console: None, Include specified, Include all except, All; API values none, whitelist, allExcept, all (headers: none, whitelist) | AWS docs | 2026-10-12 |
| cloudfront | CloudFront origin request policy options | Headers None/Whitelist/All viewer headers; cookies and query strings None/Whitelist/All | Block lists added 2023-02-22: All viewer headers except, All cookies except, All query strings except | AWS docs | 2026-10-12 |
| cloudfront | CloudFront TTL range | 0 seconds to 1 year | MinTTL required (0 allowed); DefaultTTL defaults to 86,400 s, MaxTTL to 31,536,000 s; longer values allowed (max-age up to 100 years) | AWS docs | 2026-10-12 |
| cloudfront | CloudFront invalidation path for all files | * | /* in the API and CLI (paths must start with /; only the console accepts a path without it); * only as the last character | AWS docs | 2026-10-12 |
| cloudfront | CloudFront invalidation methods | By path or wildcard only | Also cache tags: CacheTagConfig.HeaderName on the distribution, origin returns up to 50 tags per object, CreateInvalidation with #tag items (one tag = one billed path) | AWS docs | 2026-10-12 |
| cloudfront | Restricting an ALB or EC2 origin to CloudFront | Allow the published CloudFront edge IP ranges in the security group | AWS-managed prefix list com.amazonaws.global.cloudfront.origin-facing (2022-02-07) plus a secret origin header, or VPC origins (2024-11-20) | AWS docs | 2026-10-12 |
| cloudfront | CloudFront S3 origin access | Origin access identity (OAI) | Origin access control (OAC) recommended: all Regions, SSE-KMS, PUT/DELETE; OAI legacy; OAC also for Lambda function URLs and MediaPackage v2 (2024-04-11) | AWS docs | 2026-10-12 |
| cloudfront | CloudFront field-level encryption status | Current feature, up to 10 fields | Still up to 10 fields (body 1 MB, field 16 KB) but listed among legacy features that flat-rate plans don't support | AWS docs | 2026-10-12 |
| cloudfront | CloudFront viewer client-certificate authentication | Not available: CloudFront cannot authenticate viewers with client certificates | Viewer mutual TLS since 2025-11-24: client certificates validated against a trust store; required (default), optional or passthrough mode | AWS docs | 2026-10-12 |
| cloudfront | CloudFront signed URL and cookie signers | Account-wide CloudFront key pair that only the root user can manage | Trusted key groups (API and IAM, recommended; 5 keys per group, 4 groups per behavior); root-user key pairs are legacy, at most 2 active per account | AWS docs | 2026-10-12 |
| cloudfront | CloudFront signed URL key types and hash algorithm | RSA 2048 key pair with SHA-1 | RSA 2048 or ECDSA 256 (PEM); optional SHA-256 via Hash-Algorithm=SHA256 (cookie CloudFront-Hash-Algorithm); SHA-1 remains the default | AWS docs | 2026-10-12 |
| cloudfront | Lambda@Edge package size on viewer events | 1 MB on viewer events (50 MB on origin events) | 50 MB compressed on viewer and origin events | AWS docs | 2026-10-12 |
| cloudfront | CloudFront Functions runtime and data store | ECMAScript 5.1 only, no data store | cloudfront-js-2.0 (2023-11-21): const/let, async/await, Buffer, selected ES6-ES12 features; KeyValueStore (5 MB per store, runtime 2.0 only) | AWS docs | 2026-10-12 |
| cloudfront | Changing the origin per request at the edge | Only a Lambda@Edge origin request function | Also CloudFront Functions (runtime 2.0, viewer request): cf.updateRequestOrigin() since 2024-11-21, cf.selectRequestOriginById() since 2025-04-02 | AWS docs | 2026-10-12 |
| cloudfront | CloudFront standard (access) log destinations | An S3 bucket only | Standard logging v2 (2024-11-20): CloudWatch Logs, Amazon Data Firehose or S3 (JSON, plain, W3C, raw, Parquet); legacy S3 logging still available | AWS docs | 2026-10-12 |
| route53 | Route 53 supported DNS record types | 13 types: A, AAAA, CAA, CNAME, DS, MX, NAPTR, NS, PTR, SOA, SPF, SRV, TXT | 17 types: HTTPS, SVCB, SSHFP and TLSA added 2024-10-30 (SSHFP and TLSA in public hosted zones only); the SPF type is no longer recommended, publish SPF policies in TXT | What's New | 2026-10-12 |
| route53 | Route 53 API request rate limits | 5 requests per second per AWS account; at most 1,000 CreateHealthCheck requests per 24 h | Token buckets: 50 requests burst, 10/s sustained (account level and per action; CreateHealthCheck 1 every 2 s) plus 1,500 record changes burst, 100/s (UPSERT = 2); HTTP 400 Throttling | AWS docs | 2026-10-12 |
| route53 | Route 53 alias record targets | ELB, CloudFront, API Gateway, Elastic Beanstalk, S3 website, VPC interface endpoint, Global Accelerator, record in the same hosted zone | Also App Runner (2022-08-30), OpenSearch custom domains (2025-01-14), AppSync domain names, VPC Lattice service custom domains (2025-06-25), CloudFront distribution tenants (2025-04-28) | AWS docs | 2026-10-12 |
| route53 | Geoproximity routing availability | Requires Route 53 Traffic Flow (traffic policies) | Standard routing policy for records in public and private hosted zones since 2024-01-10 (console, API, SDK, CLI); Traffic Flow only for the map view and traffic policies | What's New | 2026-10-12 |
| route53 | Routing policies supported in private hosted zones | Simple, failover, multivalue answer and weighted only | Simple, failover, multivalue answer, weighted, latency and geolocation (since 2022-03-16), geoproximity (since 2024-01-10); IP-based is not supported | AWS docs | 2026-10-12 |
| route53 | Recommended JVM DNS cache TTL for AWS SDK for Java clients | No more than 60 seconds | 5 seconds via the networkaddress.cache.ttl security property (java.security file or Security.setProperty; -D doesn't set it); the RDS User Guide's Multi-AZ failover page still says no more than 60 seconds, which 5 s also meets | AWS docs · RDS Multi-AZ failover | 2026-10-18 |
| vpc | NAT gateway availability mode (regional NAT gateway) | A NAT gateway always lives in one AZ inside a public subnet; high availability means one NAT gateway per AZ with per-AZ routes | Zonal stays the default; since 2025-11-19 a regional NAT gateway (--availability-mode regional) needs no public subnet, auto-expands to AZs with ENIs (up to 60 min), one ID in all routes, 32 IPs per AZ, no private mode | AWS docs | 2026-10-12 |
| vpc | NAT gateway bandwidth and packet rate | Up to 45 Gbps and 4 million packets per second | 5 Gbps scaling automatically to 100 Gbps; 1 million scaling to 10 million packets per second, beyond which packets are dropped (since 2022-06-15) | AWS docs | 2026-10-12 |
| vpc | NAT instances and the AWS NAT AMI | Launch a NAT instance from the AWS-provided NAT AMI as a ready-made alternative to a NAT gateway | The AWS NAT AMI (Amazon Linux AMI 2018.03) is out of maintenance support since 2023-12-31; AWS recommends NAT gateways, or a NAT AMI you build from AL2023 or Amazon Linux 2 | AWS docs | 2026-10-12 |
| vpc | VPC Block Public Access | An IGW route plus a public IP always gives internet access | Since 2024-11-19 VPC BPA can block IGW and egress-only IGW traffic per account and Region (bidirectional or ingress-only), with VPC or subnet exclusions; blocked flows show reject-reason BPA in flow logs | AWS docs | 2026-10-12 |
| vpc | VPC Flow Logs destinations | S3, CloudWatch Logs and Kinesis Data Firehose | CloudWatch Logs, S3 or Amazon Data Firehose (renamed 2024-02-09); the create-flow-logs --log-destination-type value is still kinesis-data-firehose | AWS docs | 2026-10-12 |
| vpc | VPC Flow Logs resource types | Flow logs for VPCs, subnets and network interfaces only | --resource-type VPC, Subnet, NetworkInterface, TransitGateway, TransitGatewayAttachment or RegionalNatGateway | AWS docs | 2026-10-12 |
| vpc | DynamoDB VPC endpoint types | DynamoDB supports only gateway endpoints | Gateway (free) or interface endpoints via AWS PrivateLink (since 2024-03-19); the interface endpoint has no private DNS, so SDK and CLI clients use the vpce endpoint URL | What's New | 2026-10-12 |
| vpc | S3 interface endpoint private DNS | S3 interface endpoints always need endpoint-specific DNS names | Private DNS supported; 'private DNS only for inbound endpoint' (default when enabled; CLI PrivateDnsOnlyForInboundResolverEndpoint=true) keeps in-VPC traffic on the S3 gateway endpoint, which must exist | AWS docs | 2026-10-12 |
| vpc | Cross-Region interface endpoints to AWS services | VPC endpoints reach services in their own Region only | Interface endpoints reach some AWS services in another Region (e.g. S3, IAM, ECR, KMS, ECS, Lambda, Firehose) via --service-region; needs vpce:AllowMultiRegion; gateway endpoints stay same-Region | AWS docs | 2026-10-12 |
| vpc | Site-to-Site VPN tunnel bandwidth | 1.25 Gbps per tunnel maximum | Standard tunnel up to 1.25 Gbps and 140,000 packets/s; Large Bandwidth Tunnel up to 5 Gbps and 400,000 packets/s for VPNs attached to a transit gateway or Cloud WAN | AWS docs | 2026-10-12 |
| vpc | Direct Connect encryption in transit | A Direct Connect link is private and secure, so no extra encryption is needed | Not encrypted in transit by default; use MACsec on 10/100/400 Gbps dedicated connections at supported locations, an IPsec Site-to-Site VPN over DX, or TLS | AWS docs | 2026-10-12 |
Verified unchanged (values people often doubt)
Still current as of 2026-10-12, despite rumours or newer adjacent features.
| Module | Fact | Current (verified, unchanged) | Source | Verified on |
|---|---|---|---|---|
| lambda | /tmp ephemeral storage default and max | Unchanged: default 512 MB, configurable 512-10,240 MB in 1-MB increments (10 GB max since 2022-03-24). SnapStart cannot be used with more than 512 MB. | AWS docs | 2026-10-12 |
| lambda | Container image code package size | Unchanged: 10 GB maximum uncompressed image size, including all layers. Images are stored in Amazon ECR (ECR quotas apply), and container image functions cannot use Lambda layers. | AWS docs | 2026-10-12 |
| lambda | Default regional concurrency quota | Unchanged: 1,000 concurrent executions per Region by default, raisable to tens of thousands; you can reserve all but 100. Sync RPS limit = 10x concurrency. New accounts start lower; AWS raises them with usage. | AWS docs | 2026-10-12 |
| lambda | Deployment package (.zip) size limits | Unchanged: 50 MB zipped for direct upload (API/SDK or console), larger .zip files via Amazon S3; 250 MB unzipped including layers and custom runtimes; 3 MB in the console code editor. Not adjustable. | AWS docs | 2026-10-12 |
| lambda | Environment variables size | Unchanged: 4 KB total for all of a function's environment variables combined; not adjustable (quota 'Environment variable size'). | AWS docs | 2026-10-12 |
| lambda | Function URL auth types | Unchanged: AuthType AWS_IAM (IAM-authenticated and authorized callers only) or NONE (public, but the resource-based policy must still allow it). InvokeMode: BUFFERED (default, 6 MB) or RESPONSE_STREAM (200 MB). | AWS docs | 2026-10-12 |
| lambda | Layers per function | Unchanged: up to 5 layers per function (not adjustable); layers work only with .zip-archive functions, and the function plus its layers must fit in 250 MB unzipped. | AWS docs | 2026-10-12 |
| lambda | Maximum function timeout | Standard functions: 900 s (15 min), not adjustable. Lambda Managed Instances: up to 5,400 s (90 min) for async and ESM invocations (not Amazon MQ/DocumentDB); sync stays 15 min | AWS docs | 2026-10-12 |
| lambda | Memory range and CPU scaling | Unchanged: 128 MB (default, minimum) to 10,240 MB in 1-MB steps; 1 vCPU at 1,769 MB, ~6 vCPUs at max. Lambda Managed Instances: MemorySize up to 32,768 MB, 2-8 GiB per vCPU | AWS docs | 2026-10-12 |
| lambda | Synchronous invocation payload (request/response) | Unchanged: 6 MB request and 6 MB response for synchronous invocations (quota 'Synchronous payload', not adjustable), plus a 1 MB cap on the combined request line and header values. | AWS docs | 2026-10-12 |
| api-gateway | API Gateway maximum payload size | Unchanged: 10 MB, not increasable, for REST and HTTP APIs. Exception: REST response streaming (since 2025-11-19) can return >10 MB, throttled to 2 MB/s past 10 MB; requests stay capped at 10 MB. | AWS docs | 2026-10-12 |
| dynamodb | DynamoDB on-demand initial throughput and 2x-previous-peak scaling | Unchanged: new on-demand tables sustain up to 4,000 writes/s and 12,000 reads/s; instantly handle up to 2x previous peak; >2x within 30 min may throttle (pre-warm or ramp over 30 min). | AWS docs | 2026-10-12 |
| cicd | Amazon CodeGuru Profiler status | No change found: still active (JVM languages and Python 3.6+), with no notice in its guide, and not on the AWS Lifecycle maintenance, sunset or shutdown lists (Oct 2026). aws.amazon.com/codeguru/ redirects to Profiler. | AWS docs | 2026-10-12 |
| cdk | AWS CDK v1 end of support | CDK v1: maintenance Jun 1, 2022, end of support Jun 1, 2023. v2, as the course teaches: stable constructs in aws-cdk-lib, Construct from constructs v10, experimental modules as -alpha packages, modern bootstrap required. | AWS docs | 2026-10-12 |
| other-services | Step Functions maximum state/task/execution payload size | Unchanged: 256 KiB (UTF-8) max input/output per task, state or execution (Standard and Express), hard quota since 2020-09-03. Over it: States.DataLimitExceeded (States.ALL won't catch it); use S3 ARNs. | AWS docs | 2026-10-12 |