AWS Infrastructure, Scripting & Terraform

Explain how AWS Regions, Availability Zones, and edge locations affect availability and latency.

Apply the AWS shared responsibility model to common infrastructure scenarios.

Secure an AWS root user and establish daily administrative access through IAM Identity Center.

Construct an IAM policy that grants least-privilege access to specified AWS resources.

Configure an IAM role and trust policy for temporary cross-service or cross-account access.

Install AWS CLI v2 in WSL and configure a secure named profile.

Use AWS CLI commands and built-in help to inspect account resources and caller identity.

Configure AWS Budgets, cost anomaly alerts, and mandatory cost-allocation tags for a lab account.

Calculate valid subnet ranges from an IPv4 CIDR block.

Design a VPC with public and private subnets distributed across multiple Availability Zones.

Configure route tables and an internet gateway for controlled public connectivity.

Select between NAT gateways and VPC endpoints for private-subnet access to external services.

Apply security groups and network ACLs to satisfy a stated traffic-flow requirement.

Resolve application names using Route 53 public and private hosted zones.

Select VPC peering, Transit Gateway, Site-to-Site VPN, or Direct Connect for a connectivity scenario.

Diagnose a blocked VPC traffic path using VPC Flow Logs and Reachability Analyzer.

Select an EC2 instance family and size from workload CPU, memory, storage, and networking requirements.

Launch an EC2 instance with an appropriate AMI, security group, IAM role, and EBS root volume.

Bootstrap an EC2 workload reproducibly with user data.

Administer an EC2 instance without inbound SSH by using Systems Manager Session Manager.

Configure an Application Load Balancer listener, target group, and health check.

Configure an Auto Scaling group that replaces unhealthy instances and responds to demand.

Select an EC2 purchasing option from availability, interruption tolerance, and cost requirements.

Choose between EC2, Lambda, ECS on Fargate, and EKS for a stated compute workload.

Select an EBS volume type and snapshot strategy for a specified block-storage workload.

Choose among EBS, EFS, and FSx based on access pattern, protocol, and scaling requirements.

Secure an S3 bucket using Block Public Access, encryption, and a least-privilege bucket policy.

Configure S3 storage classes and lifecycle rules from access-frequency and retention requirements.

Configure S3 versioning and replication to meet a stated recovery requirement.

Deliver private S3 content through CloudFront using Origin Access Control.

Select and configure a Route 53 routing policy and health check for an availability requirement.

Create an AWS Backup plan with an appropriate schedule, retention period, and protected vault.

Choose between RDS, Aurora, and DynamoDB from a workload's consistency, query, and scaling needs.

Deploy an RDS database in private subnets with encrypted storage and restricted network access.

Distinguish RDS Multi-AZ deployments from read replicas and select the appropriate pattern.

Restore an RDS database to a specified point in time from automated backups.

Select an Aurora configuration from availability, read-scaling, and geographic requirements.

Design a DynamoDB partition key and secondary index for stated access patterns.

Configure DynamoDB capacity and consistency options for predictable performance and cost.

Select an ElastiCache for Redis or Memcached pattern for a stated performance problem.

Configure a Lambda function with least-privilege permissions, environment settings, and operational limits.

Expose a Lambda-backed service through API Gateway with request validation and authorization.

Configure an SQS queue with visibility timeout, dead-letter handling, and encryption.

Use SNS subscriptions and filter policies to fan out notifications to multiple consumers.

Route application events to targets using EventBridge rules.

Model a retry-aware application workflow with Step Functions.

Select a Kinesis service for a stated real-time streaming requirement.

Design an idempotent asynchronous workflow that tolerates duplicate delivery and partial failure.

Configure CloudWatch metrics, alarms, and dashboards for an application service-level indicator.

Centralize application logs and investigate a fault with CloudWatch Logs Insights.

Use CloudTrail event history to identify who changed an AWS resource.

Create an AWS Config rule and remediation path for a compliance requirement.

Select and configure a KMS key policy for an encryption scenario.

Choose between Secrets Manager and Systems Manager Parameter Store for application configuration.

Apply AWS Organizations organizational units and service control policies to a multi-account scenario.

Select appropriate uses of GuardDuty, Inspector, Security Hub, Macie, WAF, and Shield for stated threats.

Evaluate an AWS design against the six pillars of the Well-Architected Framework.

Design a multi-AZ application architecture with no avoidable single point of failure.

Derive recovery time and recovery point objectives and select an AWS disaster-recovery strategy.

Select an application migration strategy and an appropriate service such as Application Migration Service or Database Migration Service.

Choose among DataSync, Storage Gateway, and AWS Snow Family for a data-transfer scenario.

Estimate and optimize an architecture's cost using Pricing Calculator and Cost Explorer evidence.

Query AWS CLI JSON output with JMESPath and transform the result in a Bash pipeline.

Build a resilient Bash automation script using strict mode, traps, retries, and meaningful exit codes.

Explain how Terraform's declarative model and state support infrastructure lifecycle management.

Write Terraform configuration containing required providers, resources, and data sources.

Parameterize a Terraform configuration with typed variables, locals, validation rules, and outputs.

Express resource dependencies using references and explicit dependency declarations.

Generate repeated resources using for_each or count from structured input data.

Execute init, plan, apply, and destroy while reviewing proposed infrastructure changes safely.

Import an existing AWS resource into Terraform management and identify configuration drift.

Format, validate, and troubleshoot Terraform configuration using Terraform CLI diagnostics.

Configure a versioned, encrypted remote Terraform state backend with state locking.

Protect Terraform state and prevent sensitive values from being exposed in code or command output.

Create and consume a reusable Terraform module with a clear variable and output interface.

Separate development and production infrastructure using independent configuration and state.

Provision a multi-AZ VPC from a reusable Terraform module.

Provision an Application Load Balancer and Auto Scaling group with Terraform.

Test and scan Terraform configuration for correctness and common security misconfigurations.

Build a CI workflow that runs Terraform formatting, validation, tests, plan, and an approval-gated apply.

Translate a business scenario into explicit availability, security, performance, cost, and recovery requirements.

Create an AWS architecture diagram and concise decision record for the portfolio scenario.

Compose reusable Terraform modules to deploy the portfolio project's network and IAM baseline.

Deploy a load-balanced, automatically scaled application tier with an appropriate data service.

Add monitoring, alerting, backup, and cost controls to the portfolio environment.

Execute and document a security, failure-recovery, and cost-validation checklist for the deployed system.

Apply a structured elimination method to timed questions aligned with the current Solutions Architect Associate exam guide.

Present the portfolio project in a clear README and answer architecture trade-off questions using evidence from the project.