Storage, Database & Networking

Amazon S3 (Simple Storage Service) is object storage that stores data as objects inside buckets, not as files in folders or blocks on a disk. Each object holds the data, metadata, and a unique key. S3 delivers 99.999999999% (eleven nines) durability and scales to virtually unlimited capacity, making it foundational for backups, static website hosting, and data lakes. The key CLF-C02 distinction is S3 (object storage) versus Amazon EBS (block storage attached to EC2). Storage classes — Standard, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, and Glacier Deep Archive — trade retrieval speed for lower cost across infrequent-access and archival use cases.

Amazon Elastic Block Store provides persistent block-level storage volumes that attach to EC2 instances over the network, behaving like a raw hard drive. Unlike instance store volumes, which are physically attached to the host and lost when an instance stops or terminates, EBS volumes survive instance stops and can be detached and reattached to another instance in the same Availability Zone.

A key exam nuance is that an EBS volume can only be attached to one EC2 instance at a time in standard configurations (Multi-Attach is an advanced io1/io2 Provisioned IOPS feature not emphasized at the practitioner level). Snapshots back up EBS data to S3 incrementally and can be used to restore or copy volumes across Availability Zones.

Amazon Relational Database Service (RDS) is a managed service that runs popular relational database engines — MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Amazon Aurora — on AWS infrastructure. Because RDS handles OS patching, automated backups, Multi-AZ failover, and read replica provisioning, teams can focus on schema and query design rather than server maintenance.

The key CLF-C02 distinction is SQL versus NoSQL: RDS is the go-to when structured data and ACID transactions are required, while DynamoDB serves schema-less, high-throughput workloads. Aurora is often presented as a separate choice, but it is an engine offered through RDS, not a standalone database category.

Amazon DynamoDB is a fully managed, serverless NoSQL database that stores data as key-value pairs or JSON-like documents. AWS handles provisioning, patching, and replication, so there is no database server to manage. DynamoDB automatically replicates data across multiple Availability Zones, providing built-in high availability and durability with single-digit millisecond latency. The key exam distinction: DynamoDB is NoSQL and schema-flexible, while Amazon RDS manages traditional relational databases that require a fixed schema and run on provisioned instances. DynamoDB Global Tables extend replication across AWS Regions for multi-region active-active workloads, a separate concept from standard multi-AZ replication within a single region.

Amazon VPC (Virtual Private Cloud) provisions a logically isolated virtual network within the AWS Cloud where resources such as EC2 instances and RDS databases can be launched. You define the IP address range using CIDR notation, divide it into public and private subnets across Availability Zones, and control traffic with route tables, security groups, and network ACLs.

The key exam distinction is that security groups are stateful (return traffic is automatically allowed), while network ACLs are stateless (both inbound and outbound rules must be explicitly set). Every AWS account comes with a default VPC in each Region, so services can launch immediately without custom configuration.

Amazon CloudFront is a globally distributed content delivery network (CDN) that caches content at AWS edge locations worldwide, serving each request from the point of presence closest to the user. This reduces latency for websites, APIs, video streams, and downloads without changing the origin, which can be an S3 bucket, an EC2 instance, an Elastic Load Balancer, or any custom HTTP origin. A common exam point: edge locations are the physical infrastructure, while CloudFront is the service using them. CloudFront integrates with AWS Shield Standard for DDoS protection and AWS WAF for application-layer filtering, adding security alongside performance.

Amazon Route 53 is AWS’s authoritative DNS service that resolves domain names to IP addresses, but it goes well beyond basic resolution. It supports several routing policies — including latency-based, geolocation, geoproximity, weighted, failover, and multivalue answer — letting architects direct traffic based on network conditions, user location, or application health. Route 53 also performs health checks against endpoints and can automatically reroute traffic when a target becomes unhealthy. A common exam trap is confusing Route 53 with CloudFront: Route 53 handles DNS resolution and global traffic steering, while CloudFront caches and delivers content at edge locations. Route 53 also functions as a domain registrar, so a single service can register a domain, host its DNS zone, and enforce routing logic.

Amazon CloudWatch is AWS’s native monitoring and observability service, collecting metrics, logs, and events from resources like EC2, Lambda, and RDS, plus custom applications. It offers dashboards to visualize utilization and CloudWatch Alarms that evaluate metric thresholds to trigger automated responses, such as SNS notifications or Auto Scaling policies. The key CLF-C02 distinction is between CloudWatch and CloudTrail: CloudWatch answers “how is my infrastructure performing?” (CPU, requests), while CloudTrail answers “who did what and when?” (API call history for auditing). Confusing the two is a common exam distractor.

Amazon Simple Queue Service (SQS) is a fully managed message queuing service that decouples the components of a distributed application so they can scale independently and fail without affecting each other. A producer writes a message to the queue, and a consumer polls the queue to retrieve and process it — SQS holds the message until the consumer deletes it after successful processing. The key exam distinction is the delivery model: SQS is pull-based and delivers each message to a single consumer, whereas SNS is push-based and fans a single message out to multiple subscribers simultaneously. SQS also offers two queue types — Standard (at-least-once delivery, best-effort ordering) and FIFO (exactly-once, strict order).

Amazon Simple Notification Service is a fully managed pub/sub messaging service that delivers messages from a publisher to multiple subscribers simultaneously through a topic. Subscribers can receive messages via HTTP/HTTPS endpoints, email, SMS, mobile push notifications, or other AWS services such as Lambda and SQS.

The key exam distinction is the delivery model: SNS fans out a single message to all subscribed endpoints at once (push-based, one-to-many), while SQS holds messages in a queue until a single consumer polls and retrieves them (pull-based, one-to-one). A common architecture combines both — SNS fans out to multiple SQS queues so different consumers each get their own copy to process independently.