Domain 3: Resilient Cloud Solutions on Album69

AWS Auto Scaling

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is Auto Scaling?

Automatically adjusts compute capacity based on demand
Maintains application availability and performance
Optimizes costs by scaling resources up and down
Multiple scaling services across different AWS resources

Auto Scaling Services

EC2 Auto Scaling - EC2 instances
Application Auto Scaling - ECS, Lambda, DynamoDB, etc.
AWS Auto Scaling - Unified scaling across services
Predictive Scaling - ML-based capacity planning

2. EC2 Auto Scaling

Auto Scaling Groups (ASG)

# Create launch template
aws ec2 create-launch-template \
 --launch-template-name "web-server-template" \
 --launch-template-data '{
 "ImageId": "ami-0abcdef1234567890",
 "InstanceType": "t3.micro",
 "SecurityGroupIds": ["sg-12345678"],
 "UserData": "IyEvYmluL2Jhc2gKeXVtIHVwZGF0ZSAteQp5dW0gaW5zdGFsbCAteSBodHRwZApzZXJ2aWNlIGh0dHBkIHN0YXJ0"
 }'

# Create Auto Scaling group
aws autoscaling create-auto-scaling-group \
 --auto-scaling-group-name "web-servers-asg" \
 --launch-template LaunchTemplateName=web-server-template,Version='$Latest' \
 --min-size 2 \
 --max-size 10 \
 --desired-capacity 3 \
 --vpc-zone-identifier "subnet-12345678,subnet-87654321" \
 --target-group-arns "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-servers/1234567890123456"

Scaling Policies

# Target tracking scaling policy
aws autoscaling put-scaling-policy \
 --auto-scaling-group-name "web-servers-asg" \
 --policy-name "cpu-target-tracking" \
 --policy-type "TargetTrackingScaling" \
 --target-tracking-configuration '{
 "TargetValue": 70.0,
 "PredefinedMetricSpecification": {
 "PredefinedMetricType": "ASGAverageCPUUtilization"
 },
 "ScaleOutCooldown": 300,
 "ScaleInCooldown": 300
 }'

# Step scaling policy
aws autoscaling put-scaling-policy \
 --auto-scaling-group-name "web-servers-asg" \
 --policy-name "scale-out-policy" \
 --policy-type "StepScaling" \
 --adjustment-type "ChangeInCapacity" \
 --step-adjustments '[
 {
 "MetricIntervalLowerBound": 0,
 "MetricIntervalUpperBound": 50,
 "ScalingAdjustment": 1
 },
 {
 "MetricIntervalLowerBound": 50,
 "ScalingAdjustment": 2
 }
 ]'

3. Application Auto Scaling

ECS Service Scaling

import boto3

def setup_ecs_auto_scaling():
 """Configure Auto Scaling for ECS service"""
 
 autoscaling = boto3.client('application-autoscaling')
 
 # Register scalable target
 autoscaling.register_scalable_target(
 ServiceNamespace='ecs',
 ResourceId='service/my-cluster/my-service',
 ScalableDimension='ecs:service:DesiredCount',
 MinCapacity=2,
 MaxCapacity=20
 )
 
 # Create scaling policy
 autoscaling.put_scaling_policy(
 PolicyName='cpu-scaling-policy',
 ServiceNamespace='ecs',
 ResourceId='service/my-cluster/my-service',
 ScalableDimension='ecs:service:DesiredCount',
 PolicyType='TargetTrackingScaling',
 TargetTrackingScalingPolicyConfiguration={
 'TargetValue': 70.0,
 'PredefinedMetricSpecification': {
 'PredefinedMetricType': 'ECSServiceAverageCPUUtilization'
 },
 'ScaleOutCooldown': 300,
 'ScaleInCooldown': 300
 }
 )

DynamoDB Auto Scaling

# Register DynamoDB table for scaling
aws application-autoscaling register-scalable-target \
 --service-namespace dynamodb \
 --resource-id "table/MyTable" \
 --scalable-dimension "dynamodb:table:ReadCapacityUnits" \
 --min-capacity 5 \
 --max-capacity 100

# Create scaling policy for DynamoDB
aws application-autoscaling put-scaling-policy \
 --policy-name "MyTableReadScalingPolicy" \
 --service-namespace dynamodb \
 --resource-id "table/MyTable" \
 --scalable-dimension "dynamodb:table:ReadCapacityUnits" \
 --policy-type "TargetTrackingScaling" \
 --target-tracking-scaling-policy-configuration '{
 "TargetValue": 70.0,
 "PredefinedMetricSpecification": {
 "PredefinedMetricType": "DynamoDBReadCapacityUtilization"
 }
 }'

4. Predictive Scaling

ML-Based Capacity Planning

def enable_predictive_scaling():
 """Enable predictive scaling for ASG"""
 
 autoscaling = boto3.client('autoscaling')
 
 # Create predictive scaling policy
 response = autoscaling.put_scaling_policy(
 AutoScalingGroupName='web-servers-asg',
 PolicyName='predictive-scaling-policy',
 PolicyType='PredictiveScaling',
 PredictiveScalingConfiguration={
 'MetricSpecifications': [
 {
 'TargetValue': 70.0,
 'PredefinedMetricPairSpecification': {
 'PredefinedMetricType': 'ASGCPUUtilization'
 }
 }
 ],
 'Mode': 'ForecastAndScale',
 'SchedulingBufferTime': 300,
 'MaxCapacityBreachBehavior': 'HonorMaxCapacity',
 'MaxCapacityBuffer': 10
 }
 )
 
 return response

5. Multi-AZ and Cross-Region Resilience

Multi-AZ Deployment

# Create ASG across multiple AZs
aws autoscaling create-auto-scaling-group \
 --auto-scaling-group-name "resilient-web-asg" \
 --launch-template LaunchTemplateName=web-template,Version='$Latest' \
 --min-size 3 \
 --max-size 15 \
 --desired-capacity 6 \
 --vpc-zone-identifier "subnet-1a,subnet-1b,subnet-1c" \
 --availability-zones "us-east-1a,us-east-1b,us-east-1c" \
 --health-check-type "ELB" \
 --health-check-grace-period 300

Cross-Region Auto Scaling

def setup_cross_region_scaling():
 """Set up Auto Scaling across multiple regions"""
 
 regions = ['us-east-1', 'us-west-2', 'eu-west-1']
 
 for region in regions:
 autoscaling = boto3.client('autoscaling', region_name=region)
 
 # Create ASG in each region
 autoscaling.create_auto_scaling_group(
 AutoScalingGroupName=f'web-asg-{region}',
 LaunchTemplate={
 'LaunchTemplateName': f'web-template-{region}',
 'Version': '$Latest'
 },
 MinSize=2,
 MaxSize=10,
 DesiredCapacity=3,
 VPCZoneIdentifier=get_subnets_for_region(region),
 HealthCheckType='ELB',
 HealthCheckGracePeriod=300
 )

6. Health Checks and Instance Replacement

Health Check Configuration

def configure_health_checks():
 """Configure comprehensive health checks"""
 
 autoscaling = boto3.client('autoscaling')
 
 # Update ASG with ELB health checks
 autoscaling.update_auto_scaling_group(
 AutoScalingGroupName='web-servers-asg',
 HealthCheckType='ELB',
 HealthCheckGracePeriod=300
 )
 
 # Create custom health check Lambda
 lambda_code = '''
import boto3
import json

def lambda_handler(event, context):
 """Custom health check for application"""
 
 instance_id = event['instance_id']
 
 # Perform application-specific health checks
 if check_application_health(instance_id):
 return {'healthy': True}
 else:
 # Mark instance unhealthy
 autoscaling = boto3.client('autoscaling')
 autoscaling.set_instance_health(
 InstanceId=instance_id,
 HealthStatus='Unhealthy'
 )
 return {'healthy': False}

def check_application_health(instance_id):
 """Check application-specific health metrics"""
 # Implementation for custom health checks
 return True
'''

7. Lifecycle Hooks

Instance Lifecycle Management

# Create lifecycle hook for launch
aws autoscaling put-lifecycle-hook \
 --lifecycle-hook-name "launch-hook" \
 --auto-scaling-group-name "web-servers-asg" \
 --lifecycle-transition "autoscaling:EC2_INSTANCE_LAUNCHING" \
 --heartbeat-timeout 300 \
 --notification-target-arn "arn:aws:sns:us-east-1:123456789012:asg-notifications" \
 --role-arn "arn:aws:iam::123456789012:role/AutoScalingNotificationRole"

# Create lifecycle hook for termination
aws autoscaling put-lifecycle-hook \
 --lifecycle-hook-name "terminate-hook" \
 --auto-scaling-group-name "web-servers-asg" \
 --lifecycle-transition "autoscaling:EC2_INSTANCE_TERMINATING" \
 --heartbeat-timeout 300 \
 --default-result "ABANDON"

Lifecycle Hook Processing

def process_lifecycle_hook(event, context):
 """Process Auto Scaling lifecycle hooks"""
 
 message = json.loads(event['Records'][0]['Sns']['Message'])
 
 lifecycle_transition = message['LifecycleTransition']
 instance_id = message['EC2InstanceId']
 lifecycle_action_token = message['LifecycleActionToken']
 auto_scaling_group_name = message['AutoScalingGroupName']
 lifecycle_hook_name = message['LifecycleHookName']
 
 autoscaling = boto3.client('autoscaling')
 
 try:
 if lifecycle_transition == 'autoscaling:EC2_INSTANCE_LAUNCHING':
 # Perform launch initialization
 initialize_instance(instance_id)
 result = 'CONTINUE'
 
 elif lifecycle_transition == 'autoscaling:EC2_INSTANCE_TERMINATING':
 # Perform graceful shutdown
 graceful_shutdown(instance_id)
 result = 'CONTINUE'
 
 # Complete lifecycle action
 autoscaling.complete_lifecycle_action(
 LifecycleHookName=lifecycle_hook_name,
 AutoScalingGroupName=auto_scaling_group_name,
 InstanceId=instance_id,
 LifecycleActionToken=lifecycle_action_token,
 LifecycleActionResult=result
 )
 
 except Exception as e:
 # Abandon on error
 autoscaling.complete_lifecycle_action(
 LifecycleHookName=lifecycle_hook_name,
 AutoScalingGroupName=auto_scaling_group_name,
 InstanceId=instance_id,
 LifecycleActionToken=lifecycle_action_token,
 LifecycleActionResult='ABANDON'
 )

8. Monitoring and Metrics

CloudWatch Integration

def monitor_auto_scaling_metrics():
 """Monitor Auto Scaling group metrics"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Create custom metrics
 cloudwatch.put_metric_data(
 Namespace='AutoScaling/Custom',
 MetricData=[
 {
 'MetricName': 'HealthyInstanceCount',
 'Value': get_healthy_instance_count(),
 'Unit': 'Count',
 'Dimensions': [
 {
 'Name': 'AutoScalingGroupName',
 'Value': 'web-servers-asg'
 }
 ]
 }
 ]
 )
 
 # Create alarms for scaling events
 cloudwatch.put_metric_alarm(
 AlarmName='ASGScalingActivity',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=1,
 MetricName='GroupTotalInstances',
 Namespace='AWS/AutoScaling',
 Period=300,
 Statistic='Average',
 Threshold=8.0,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:scaling-alerts'
 ],
 Dimensions=[
 {
 'Name': 'AutoScalingGroupName',
 'Value': 'web-servers-asg'
 }
 ]
 )

9. Cost Optimization

Spot Instance Integration

# Create mixed instances policy with Spot
aws autoscaling create-auto-scaling-group \
 --auto-scaling-group-name "cost-optimized-asg" \
 --mixed-instances-policy '{
 "LaunchTemplate": {
 "LaunchTemplateSpecification": {
 "LaunchTemplateName": "web-template",
 "Version": "$Latest"
 },
 "Overrides": [
 {
 "InstanceType": "t3.micro",
 "WeightedCapacity": "1"
 },
 {
 "InstanceType": "t3.small",
 "WeightedCapacity": "2"
 }
 ]
 },
 "InstancesDistribution": {
 "OnDemandBaseCapacity": 2,
 "OnDemandPercentageAboveBaseCapacity": 25,
 "SpotAllocationStrategy": "diversified",
 "SpotInstancePools": 4,
 "SpotMaxPrice": "0.05"
 }
 }' \
 --min-size 2 \
 --max-size 20 \
 --desired-capacity 4

Scheduled Scaling

# Create scheduled action for predictable load
aws autoscaling put-scheduled-update-group-action \
 --auto-scaling-group-name "web-servers-asg" \
 --scheduled-action-name "morning-scale-up" \
 --recurrence "0 8 * * MON-FRI" \
 --desired-capacity 10 \
 --min-size 5 \
 --max-size 15

# Scale down for off-hours
aws autoscaling put-scheduled-update-group-action \
 --auto-scaling-group-name "web-servers-asg" \
 --scheduled-action-name "evening-scale-down" \
 --recurrence "0 18 * * MON-FRI" \
 --desired-capacity 3 \
 --min-size 2 \
 --max-size 10

10. Common Exam Scenarios

Scenario 1: High availability web application

Solution:

AWS Backup

Sun, 04 Oct 2026 00:00:00 +0000

What it is: Centralized, policy-based backup orchestration across AWS services — one place to define what gets backed up, how often, how long it’s kept, and where copies go, replacing per-service snapshot scripts.

Exam-testable facts:

Backup plan: one or more rules; each rule sets a schedule (cron/rate), a backup window, a lifecycle (transition to cold storage after N days, expire after M days), copy actions, and the target vault.
Backup vault: the encrypted container holding recovery points (KMS-encrypted; each vault has its own key).
Vault Lock: makes recovery points immutable (WORM). Compliance mode cannot be undone — not even by the root user — which is the ransomware-protection answer. Governance mode is reversible.
Resource assignment: pick protected resources by tag, resource type, or ARN — policy decoupled from individual resources.
Cross-Region and cross-account copy: built into the plan for DR and blast-radius isolation; Organizations integration pushes data-protection policies org-wide.
Coverage: EBS, EC2, RDS/Aurora, DynamoDB, EFS, FSx, S3, DocumentDB, Neptune, Redshift, Storage Gateway, and more.
Backup Audit Manager: frameworks that prove resources are backed up per policy. Restore testing automatically validates that backups are actually recoverable.
Continuous backup enables point-in-time recovery (PITR) for supported services.

Common traps:

AWS EKS (Elastic Kubernetes Service)

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is EKS?

Managed Kubernetes service for running containerized applications
Provides highly available and secure Kubernetes control plane
Integrates with AWS services for networking, security, and monitoring
Supports both EC2 and Fargate compute options

Key Benefits

Managed Control Plane - AWS manages Kubernetes masters
High Availability - Multi-AZ control plane deployment
Security - Integration with IAM and VPC
Scalability - Auto scaling for nodes and pods
AWS Integration - Native integration with AWS services

2. Cluster Architecture

Control Plane

Managed by AWS across multiple AZs
Includes API server, etcd, scheduler, and controller manager
Automatic updates and patching
99.95% SLA for control plane availability

Worker Nodes

# Create managed node group
aws eks create-nodegroup \
 --cluster-name "my-cluster" \
 --nodegroup-name "worker-nodes" \
 --subnets "subnet-12345678" "subnet-87654321" \
 --instance-types "t3.medium" \
 --ami-type "AL2_x86_64" \
 --node-role "arn:aws:iam::123456789012:role/NodeInstanceRole" \
 --scaling-config minSize=1,maxSize=10,desiredSize=3

Fargate Integration

# Fargate profiles are created via the AWS CLI/API - NOT via kubectl manifests.
# (There is no "Fargate profile" Kubernetes object; a ConfigMap cannot define one.)
aws eks create-fargate-profile \
 --cluster-name my-cluster \
 --fargate-profile-name default \
 --pod-execution-role-arn arn:aws:iam::123456789012:role/eks-fargate-pod-execution-role \
 --selectors namespace=default,labels={compute-type=fargate} \
 --subnets subnet-12345678 subnet-87654321

3. IAM Roles for Service Accounts (IRSA)

OIDC Identity Provider Setup

# Create OIDC identity provider
eksctl utils associate-iam-oidc-provider \
 --cluster my-cluster \
 --approve

Service Account with IAM Role

apiVersion: v1
kind: ServiceAccount
metadata:
 name: s3-access-sa
 namespace: default
 annotations:
 eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/S3AccessRole

IAM Role Trust Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "Federated": "arn:aws:iam::123456789012:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E"
 },
 "Action": "sts:AssumeRoleWithWebIdentity",
 "Condition": {
 "StringEquals": {
 "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:sub": "system:serviceaccount:default:s3-access-sa",
 "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:aud": "sts.amazonaws.com"
 }
 }
 }
 ]
}

4. Node Groups and Scaling

Managed Node Groups

def create_managed_node_group():
 """Create EKS managed node group with auto scaling"""
 
 eks = boto3.client('eks')
 
 response = eks.create_nodegroup(
 clusterName='my-cluster',
 nodegroupName='production-nodes',
 scalingConfig={
 'minSize': 2,
 'maxSize': 20,
 'desiredSize': 5
 },
 instanceTypes=['t3.medium', 't3.large'],
 amiType='AL2_x86_64',
 nodeRole='arn:aws:iam::123456789012:role/NodeInstanceRole',
 subnets=[
 'subnet-12345678',
 'subnet-87654321',
 'subnet-13579246'
 ],
 tags={
 'Environment': 'Production',
 'Team': 'DevOps'
 },
 launchTemplate={
 'name': 'eks-node-template',
 'version': '$Latest'
 }
 )
 
 return response

Cluster Autoscaler

apiVersion: apps/v1
kind: Deployment
metadata:
 name: cluster-autoscaler
 namespace: kube-system
spec:
 replicas: 1
 selector:
 matchLabels:
 app: cluster-autoscaler
 template:
 metadata:
 labels:
 app: cluster-autoscaler
 spec:
 serviceAccountName: cluster-autoscaler
 containers:
 - image: registry.k8s.io/autoscaling/cluster-autoscaler:v1.21.0  # k8s.gcr.io is deprecated; use registry.k8s.io
 name: cluster-autoscaler
 resources:
 limits:
 cpu: 100m
 memory: 300Mi
 command:
 - ./cluster-autoscaler
 - --v=4
 - --stderrthreshold=info
 - --cloud-provider=aws
 - --skip-nodes-with-local-storage=false
 - --expander=least-waste
 - --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,k8s.io/cluster-autoscaler/my-cluster

5. Networking and Security

VPC Configuration

def setup_eks_networking():
 """Set up EKS networking with proper security"""
 
 ec2 = boto3.client('ec2')
 
 # Create security group for EKS cluster
 cluster_sg = ec2.create_security_group(
 GroupName='eks-cluster-sg',
 Description='Security group for EKS cluster',
 VpcId='vpc-12345678'
 )
 
 # Allow HTTPS traffic from worker nodes
 ec2.authorize_security_group_ingress(
 GroupId=cluster_sg['GroupId'],
 IpPermissions=[
 {
 'IpProtocol': 'tcp',
 'FromPort': 443,
 'ToPort': 443,
 'UserIdGroupPairs': [
 {
 'GroupId': 'sg-worker-nodes',
 'Description': 'HTTPS from worker nodes'
 }
 ]
 }
 ]
 )
 
 return cluster_sg['GroupId']

Network Policies

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: deny-all-ingress
 namespace: production
spec:
 podSelector: {}
 policyTypes:
 - Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: allow-frontend-to-backend
 namespace: production
spec:
 podSelector:
 matchLabels:
 app: backend
 policyTypes:
 - Ingress
 ingress:
 - from:
 - podSelector:
 matchLabels:
 app: frontend
 ports:
 - protocol: TCP
 port: 8080

6. Monitoring and Logging

Container Insights

# Deploy CloudWatch Container Insights
curl https://raw.githubusercontent.com/aws-samples/amazon-cloudwatch-container-insights/latest/k8s-deployment-manifest-templates/deployment-mode/daemonset/container-insights-monitoring/quickstart/cwagent-fluentd-quickstart.yaml | sed "s/{{cluster_name}}/my-cluster/;s/{{region_name}}/us-east-1/" | kubectl apply -f -

Prometheus and Grafana

# Prometheus configuration
apiVersion: v1
kind: ConfigMap
metadata:
 name: prometheus-config
 namespace: monitoring
data:
 prometheus.yml: |
 global:
 scrape_interval: 15s
 scrape_configs:
 - job_name: 'kubernetes-pods'
 kubernetes_sd_configs:
 - role: pod
 relabel_configs:
 - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
 action: keep
 regex: true

7. Application Deployment Patterns

Blue/Green Deployment

# Blue deployment
apiVersion: apps/v1
kind: Deployment
metadata:
 name: app-blue
 labels:
 version: blue
spec:
 replicas: 3
 selector:
 matchLabels:
 app: myapp
 version: blue
 template:
 metadata:
 labels:
 app: myapp
 version: blue
 spec:
 containers:
 - name: app
 image: myapp:v1.0
 ports:
 - containerPort: 8080
---
# Service pointing to blue
apiVersion: v1
kind: Service
metadata:
 name: app-service
spec:
 selector:
 app: myapp
 version: blue
 ports:
 - port: 80
 targetPort: 8080

Canary Deployment with Istio

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
 name: app-canary
spec:
 http:
 - match:
 - headers:
 canary:
 exact: "true"
 route:
 - destination:
 host: app-service
 subset: v2
 - route:
 - destination:
 host: app-service
 subset: v1
 weight: 90
 - destination:
 host: app-service
 subset: v2
 weight: 10

8. Disaster Recovery and Backup

Velero Backup

# Install Velero
velero install \
 --provider aws \
 --plugins velero/velero-plugin-for-aws:v1.2.0 \
 --bucket my-backup-bucket \
 --backup-location-config region=us-east-1 \
 --snapshot-location-config region=us-east-1

# Create backup
velero backup create my-backup --include-namespaces production

Cross-Region Cluster Setup

def setup_cross_region_eks():
 """Set up EKS clusters across regions for DR"""
 
 regions = ['us-east-1', 'us-west-2']
 
 for region in regions:
 eks = boto3.client('eks', region_name=region)
 
 # Create cluster in each region
 cluster_config = {
 'name': f'production-cluster-{region}',
 'version': '1.21',
 'roleArn': f'arn:aws:iam::123456789012:role/EKSServiceRole',
 'resourcesVpcConfig': {
 'subnetIds': get_subnets_for_region(region),
 'securityGroupIds': [get_security_group_for_region(region)]
 },
 'logging': {
 'enable': [
 {
 'types': ['api', 'audit', 'authenticator', 'controllerManager', 'scheduler']
 }
 ]
 }
 }
 
 eks.create_cluster(**cluster_config)

9. Common Exam Scenarios

Scenario 1: Secure microservices communication

Solution:

AWS Elastic Load Balancing (ELB)

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is ELB?

Distributes incoming traffic across multiple targets
Provides high availability and fault tolerance
Automatically scales to handle traffic demands
Integrates with Auto Scaling and health checks

Load Balancer Types

Application Load Balancer (ALB) - Layer 7 (HTTP/HTTPS)
Network Load Balancer (NLB) - Layer 4 (TCP/UDP/TLS)
Gateway Load Balancer (GWLB) - Layer 3 (IP packets)
Classic Load Balancer (CLB) - Legacy (Layer 4 & 7)

2. Application Load Balancer (ALB)

Core Features

HTTP/HTTPS traffic routing
Content-based routing
WebSocket and HTTP/2 support
Integration with AWS services

Target Groups and Health Checks

# Create target group
aws elbv2 create-target-group \
 --name "web-servers-tg" \
 --protocol HTTP \
 --port 80 \
 --vpc-id vpc-12345678 \
 --health-check-protocol HTTP \
 --health-check-path "/health" \
 --health-check-interval-seconds 30 \
 --health-check-timeout-seconds 5 \
 --healthy-threshold-count 2 \
 --unhealthy-threshold-count 3

# Register targets
aws elbv2 register-targets \
 --target-group-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-servers-tg/1234567890123456" \
 --targets Id=i-1234567890abcdef0,Port=80 Id=i-0987654321fedcba0,Port=80

Advanced Routing

# Create ALB
aws elbv2 create-load-balancer \
 --name "web-application-alb" \
 --subnets subnet-12345678 subnet-87654321 \
 --security-groups sg-12345678 \
 --scheme internet-facing \
 --type application \
 --ip-address-type ipv4

# Create listener with rules
aws elbv2 create-listener \
 --load-balancer-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/web-application-alb/1234567890123456" \
 --protocol HTTPS \
 --port 443 \
 --certificates CertificateArn="arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012" \
 --default-actions Type=forward,TargetGroupArn="arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-servers-tg/1234567890123456"

# Create routing rule
aws elbv2 create-rule \
 --listener-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/web-application-alb/1234567890123456/1234567890123456" \
 --priority 100 \
 --conditions Field=path-pattern,Values="/api/*" \
 --actions Type=forward,TargetGroupArn="arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/api-servers-tg/1234567890123456"

Sticky Sessions

def configure_sticky_sessions():
 """Configure session stickiness for ALB"""
 
 elbv2 = boto3.client('elbv2')
 
 # Enable stickiness on target group
 response = elbv2.modify_target_group_attributes(
 TargetGroupArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-servers-tg/1234567890123456',
 Attributes=[
 {
 'Key': 'stickiness.enabled',
 'Value': 'true'
 },
 {
 'Key': 'stickiness.type',
 'Value': 'lb_cookie'
 },
 {
 'Key': 'stickiness.lb_cookie.duration_seconds',
 'Value': '86400' # 24 hours
 }
 ]
 )
 
 return response

3. Network Load Balancer (NLB)

High Performance Layer 4 Routing

# Create NLB
aws elbv2 create-load-balancer \
 --name "high-performance-nlb" \
 --subnets subnet-12345678 subnet-87654321 \
 --scheme internet-facing \
 --type network \
 --ip-address-type ipv4

# Create target group for NLB
aws elbv2 create-target-group \
 --name "tcp-servers-tg" \
 --protocol TCP \
 --port 80 \
 --vpc-id vpc-12345678 \
 --health-check-protocol TCP \
 --health-check-port 80 \
 --health-check-interval-seconds 30 \
 --healthy-threshold-count 3 \
 --unhealthy-threshold-count 3

Static IP and Cross-Zone Load Balancing

def configure_nlb_features():
 """Configure NLB advanced features"""
 
 elbv2 = boto3.client('elbv2')
 
 # Enable cross-zone load balancing
 elbv2.modify_load_balancer_attributes(
 LoadBalancerArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/net/high-performance-nlb/1234567890123456',
 Attributes=[
 {
 'Key': 'load_balancing.cross_zone.enabled',
 'Value': 'true'
 },
 {
 'Key': 'deletion_protection.enabled',
 'Value': 'true'
 }
 ]
 )
 
 # Configure target group attributes
 elbv2.modify_target_group_attributes(
 TargetGroupArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/tcp-servers-tg/1234567890123456',
 Attributes=[
 {
 'Key': 'preserve_client_ip.enabled',
 'Value': 'true'
 },
 {
 'Key': 'proxy_protocol_v2.enabled',
 'Value': 'false'
 }
 ]
 )

4. Gateway Load Balancer (GWLB)

Third-Party Appliance Integration

# Create GWLB for security appliances
aws elbv2 create-load-balancer \
 --name "security-appliance-gwlb" \
 --subnets subnet-12345678 subnet-87654321 \
 --type gateway

# Create target group for GWLB
aws elbv2 create-target-group \
 --name "security-appliances-tg" \
 --protocol GENEVE \
 --port 6081 \
 --vpc-id vpc-12345678 \
 --health-check-protocol HTTP \
 --health-check-path "/health" \
 --health-check-port 80

5. Multi-AZ and Cross-Region Resilience

Multi-AZ Deployment

def create_resilient_alb():
 """Create highly available ALB across multiple AZs"""
 
 elbv2 = boto3.client('elbv2')
 ec2 = boto3.client('ec2')
 
 # Get subnets across multiple AZs
 subnets = ec2.describe_subnets(
 Filters=[
 {'Name': 'vpc-id', 'Values': ['vpc-12345678']},
 {'Name': 'availability-zone', 'Values': ['us-east-1a', 'us-east-1b', 'us-east-1c']}
 ]
 )
 
 subnet_ids = [subnet['SubnetId'] for subnet in subnets['Subnets']]
 
 # Create ALB with multi-AZ subnets
 response = elbv2.create_load_balancer(
 Name='resilient-web-alb',
 Subnets=subnet_ids,
 SecurityGroups=['sg-12345678'],
 Scheme='internet-facing',
 Type='application',
 IpAddressType='ipv4'
 )
 
 return response

Cross-Region Load Balancing with Route 53

def setup_cross_region_load_balancing():
 """Set up cross-region load balancing with Route 53"""
 
 route53 = boto3.client('route53')
 
 # Create health checks for each region
 health_checks = []
 regions = ['us-east-1', 'us-west-2', 'eu-west-1']
 
 for region in regions:
 health_check = route53.create_health_check(
 Type='HTTPS',
 ResourcePath='/health',
 FullyQualifiedDomainName=f'alb-{region}.example.com',
 Port=443,
 RequestInterval=30,
 FailureThreshold=3
 )
 health_checks.append(health_check['HealthCheck']['Id'])
 
 # Create weighted routing records
 for i, region in enumerate(regions):
 route53.change_resource_record_sets(
 HostedZoneId='Z123456789',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'app.example.com',
 'Type': 'CNAME',
 'SetIdentifier': f'region-{region}',
 'Weight': 100,
 'TTL': 60,
 'ResourceRecords': [{'Value': f'alb-{region}.example.com'}],
 'HealthCheckId': health_checks[i]
 }
 }]
 }
 )

6. SSL/TLS Termination and Security

SSL Certificate Management

# Create HTTPS listener with SSL termination
aws elbv2 create-listener \
 --load-balancer-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/web-alb/1234567890123456" \
 --protocol HTTPS \
 --port 443 \
 --certificates CertificateArn="arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012" \
 --ssl-policy "ELBSecurityPolicy-TLS-1-2-2017-01" \
 --default-actions Type=forward,TargetGroupArn="arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-tg/1234567890123456"

# Redirect HTTP to HTTPS
aws elbv2 create-listener \
 --load-balancer-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/web-alb/1234567890123456" \
 --protocol HTTP \
 --port 80 \
 --default-actions Type=redirect,RedirectConfig='{Protocol=HTTPS,Port=443,StatusCode=HTTP_301}'

WAF Integration

def integrate_waf_with_alb():
 """Integrate AWS WAF with Application Load Balancer"""
 
 wafv2 = boto3.client('wafv2')
 
 # Associate WAF with ALB
 response = wafv2.associate_web_acl(
 WebACLArn='arn:aws:wafv2:us-east-1:123456789012:regional/webacl/MyWebACL/12345678-1234-1234-1234-123456789012',
 ResourceArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/web-alb/1234567890123456'
 )
 
 return response

7. Health Checks and Monitoring

Advanced Health Check Configuration

def configure_advanced_health_checks():
 """Configure comprehensive health checks"""
 
 elbv2 = boto3.client('elbv2')
 
 # Configure detailed health check
 response = elbv2.modify_target_group(
 TargetGroupArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-tg/1234567890123456',
 HealthCheckProtocol='HTTP',
 HealthCheckPath='/health/detailed',
 HealthCheckIntervalSeconds=15,
 HealthCheckTimeoutSeconds=10,
 HealthyThresholdCount=2,
 UnhealthyThresholdCount=5,
 Matcher={'HttpCode': '200,202'}
 )
 
 return response

CloudWatch Metrics and Alarms

def setup_elb_monitoring():
 """Set up comprehensive ELB monitoring"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Create alarm for high latency
 cloudwatch.put_metric_alarm(
 AlarmName='ALB-HighLatency',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=2,
 MetricName='TargetResponseTime',
 Namespace='AWS/ApplicationELB',
 Period=300,
 Statistic='Average',
 Threshold=2.0,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:alb-alerts'
 ],
 Dimensions=[
 {
 'Name': 'LoadBalancer',
 'Value': 'app/web-alb/1234567890123456'
 }
 ]
 )
 
 # Create alarm for high error rate
 cloudwatch.put_metric_alarm(
 AlarmName='ALB-HighErrorRate',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=2,
 MetricName='HTTPCode_ELB_5XX_Count',
 Namespace='AWS/ApplicationELB',
 Period=300,
 Statistic='Sum',
 Threshold=10,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:error-alerts'
 ]
 )

8. Auto Scaling Integration

Target Group Auto Scaling

def integrate_with_auto_scaling():
 """Integrate ELB with Auto Scaling groups"""
 
 autoscaling = boto3.client('autoscaling')
 
 # Create Auto Scaling group with target group
 autoscaling.create_auto_scaling_group(
 AutoScalingGroupName='web-servers-asg',
 LaunchTemplate={
 'LaunchTemplateName': 'web-server-template',
 'Version': '$Latest'
 },
 MinSize=2,
 MaxSize=10,
 DesiredCapacity=3,
 TargetGroupARNs=[
 'arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-tg/1234567890123456'
 ],
 HealthCheckType='ELB',
 HealthCheckGracePeriod=300,
 VPCZoneIdentifier='subnet-12345678,subnet-87654321'
 )
 
 # Create scaling policy based on ALB metrics
 autoscaling.put_scaling_policy(
 AutoScalingGroupName='web-servers-asg',
 PolicyName='alb-request-count-scaling',
 PolicyType='TargetTrackingScaling',
 TargetTrackingConfiguration={
 'TargetValue': 1000.0,
 'PredefinedMetricSpecification': {
 'PredefinedMetricType': 'ALBRequestCountPerTarget',
 'ResourceLabel': 'app/web-alb/1234567890123456/targetgroup/web-tg/1234567890123456'
 }
 }
 )

9. Connection Draining and Blue/Green Deployments

Connection Draining

def configure_connection_draining():
 """Configure connection draining for graceful shutdowns"""
 
 elbv2 = boto3.client('elbv2')
 
 # Configure deregistration delay
 elbv2.modify_target_group_attributes(
 TargetGroupArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-tg/1234567890123456',
 Attributes=[
 {
 'Key': 'deregistration_delay.timeout_seconds',
 'Value': '300' # 5 minutes
 }
 ]
 )

Blue/Green Deployment Support

def blue_green_deployment():
 """Implement blue/green deployment with ELB"""
 
 elbv2 = boto3.client('elbv2')
 
 # Create green target group
 green_tg = elbv2.create_target_group(
 Name='web-servers-green-tg',
 Protocol='HTTP',
 Port=80,
 VpcId='vpc-12345678',
 HealthCheckPath='/health'
 )
 
 green_tg_arn = green_tg['TargetGroups'][0]['TargetGroupArn']
 
 # Register new instances to green target group
 elbv2.register_targets(
 TargetGroupArn=green_tg_arn,
 Targets=[
 {'Id': 'i-newinstance1', 'Port': 80},
 {'Id': 'i-newinstance2', 'Port': 80}
 ]
 )
 
 # Wait for health checks to pass
 wait_for_healthy_targets(green_tg_arn)
 
 # Switch traffic to green target group
 elbv2.modify_listener(
 ListenerArn='arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/web-alb/1234567890123456/1234567890123456',
 DefaultActions=[
 {
 'Type': 'forward',
 'TargetGroupArn': green_tg_arn
 }
 ]
 )

10. Common Exam Scenarios

Scenario 1: High availability web application

Solution:

AWS Global Accelerator

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What it is: A global networking service that routes user traffic through the AWS global network backbone to your application endpoints, improving availability and performance for global users.

What problem it solves: Public internet routing is unpredictable — packets take suboptimal paths, experience congestion, and suffer variable latency. Global Accelerator puts users onto the AWS backbone at the nearest edge location and keeps them there all the way to your endpoint, bypassing the public internet for most of the journey.

AWS RDS Multi-AZ and High Availability

Sun, 04 Oct 2026 00:00:00 +0000

Related: For zero-downtime engine upgrades and schema changes, see RDS-BlueGreen-General.md.

1. Overview

What is RDS Multi-AZ?

Synchronous replication to standby instance in different AZ
Automatic failover for high availability
Zero data loss during planned maintenance or failures
Enhanced durability and availability for production databases

Key Benefits

High Availability - Automatic failover within 60-120 seconds
Data Durability - Synchronous replication prevents data loss
Maintenance - Zero-downtime maintenance operations
Backup - Backups taken from standby to reduce I/O impact

2. Multi-AZ Deployment Types

Multi-AZ DB Instance

# Create Multi-AZ RDS instance
aws rds create-db-instance \
 --db-instance-identifier "prod-database" \
 --db-instance-class "db.r5.xlarge" \
 --engine "mysql" \
 --engine-version "8.0.35" \
 --master-username "admin" \
 --master-user-password "SecurePassword123!" \
 --allocated-storage 100 \
 --storage-type "gp3" \
 --storage-encrypted \
 --multi-az \
 --vpc-security-group-ids "sg-12345678" \
 --db-subnet-group-name "prod-subnet-group" \
 --backup-retention-period 7 \
 --preferred-backup-window "03:00-04:00" \
 --preferred-maintenance-window "sun:04:00-sun:05:00"

Multi-AZ DB Cluster

# Create Multi-AZ Aurora cluster
aws rds create-db-cluster \
 --db-cluster-identifier "prod-aurora-cluster" \
 --engine "aurora-mysql" \
 --engine-version "8.0.mysql_aurora.3.02.0" \
 --master-username "admin" \
 --master-user-password "SecurePassword123!" \
 --vpc-security-group-ids "sg-12345678" \
 --db-subnet-group-name "aurora-subnet-group" \
 --backup-retention-period 7 \
 --storage-encrypted \
 --enable-cloudwatch-logs-exports "error,general,slowquery"

# Add cluster instances
aws rds create-db-instance \
 --db-instance-identifier "prod-aurora-writer" \
 --db-instance-class "db.r5.large" \
 --engine "aurora-mysql" \
 --db-cluster-identifier "prod-aurora-cluster"

aws rds create-db-instance \
 --db-instance-identifier "prod-aurora-reader" \
 --db-instance-class "db.r5.large" \
 --engine "aurora-mysql" \
 --db-cluster-identifier "prod-aurora-cluster"

3. Failover Mechanisms

Automatic Failover Scenarios

Primary DB instance failure
Availability Zone outage
Network connectivity loss
Storage failure

Failover Process

def monitor_rds_failover():
 """Monitor RDS failover events"""
 
 rds = boto3.client('rds')
 
 # Describe DB instances to check status
 response = rds.describe_db_instances(
 DBInstanceIdentifier='prod-database'
 )
 
 db_instance = response['DBInstances'][0]
 
 # Check Multi-AZ status
 multi_az_status = db_instance['MultiAZ']
 db_status = db_instance['DBInstanceStatus']
 
 if db_status == 'failed-over':
 # Handle post-failover actions
 handle_post_failover_actions(db_instance)
 
 return {
 'multi_az': multi_az_status,
 'status': db_status,
 'endpoint': db_instance['Endpoint']['Address']
 }

def handle_post_failover_actions(db_instance):
 """Handle actions after RDS failover"""
 
 # Update application configuration if needed
 update_connection_strings(db_instance['Endpoint']['Address'])
 
 # Send notifications
 send_failover_notification(db_instance)
 
 # Verify application connectivity
 verify_database_connectivity(db_instance)

Manual Failover Testing

# Force failover for testing
aws rds reboot-db-instance \
 --db-instance-identifier "prod-database" \
 --force-failover

4. Read Replicas for Scalability

Cross-AZ Read Replicas

# Create read replica in different AZ
aws rds create-db-instance-read-replica \
 --db-instance-identifier "prod-database-replica-1" \
 --source-db-instance-identifier "prod-database" \
 --db-instance-class "db.r5.large" \
 --availability-zone "us-east-1b" \
 --publicly-accessible false

# Create cross-region read replica
aws rds create-db-instance-read-replica \
 --db-instance-identifier "prod-database-replica-west" \
 --source-db-instance-identifier "arn:aws:rds:us-east-1:123456789012:db:prod-database" \
 --db-instance-class "db.r5.large" \
 --region us-west-2

Read Replica Monitoring

def monitor_read_replica_lag():
 """Monitor read replica lag"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Get replica lag metrics
 response = cloudwatch.get_metric_statistics(
 Namespace='AWS/RDS',
 MetricName='ReplicaLag',
 Dimensions=[
 {
 'Name': 'DBInstanceIdentifier',
 'Value': 'prod-database-replica-1'
 }
 ],
 StartTime=datetime.utcnow() - timedelta(hours=1),
 EndTime=datetime.utcnow(),
 Period=300,
 Statistics=['Average', 'Maximum']
 )
 
 # Check if lag is acceptable
 max_lag = max([point['Maximum'] for point in response['Datapoints']])
 
 if max_lag > 30: # 30 seconds threshold
 send_lag_alert(max_lag)
 
 return max_lag

5. Backup and Recovery Strategies

Automated Backups

def configure_backup_strategy():
 """Configure comprehensive backup strategy"""
 
 rds = boto3.client('rds')
 
 # Modify backup settings
 rds.modify_db_instance(
 DBInstanceIdentifier='prod-database',
 BackupRetentionPeriod=30, # 30 days retention
 PreferredBackupWindow='03:00-04:00', # Low traffic window
 PreferredMaintenanceWindow='sun:04:00-sun:05:00',
 ApplyImmediately=False # Apply during maintenance window
 )
 
 # Enable automated backups for read replicas
 rds.modify_db_instance(
 DBInstanceIdentifier='prod-database-replica-1',
 BackupRetentionPeriod=7,
 ApplyImmediately=False
 )

Manual Snapshots

# Create manual snapshot
aws rds create-db-snapshot \
 --db-instance-identifier "prod-database" \
 --db-snapshot-identifier "prod-database-snapshot-$(date +%Y%m%d%H%M%S)"

# Copy snapshot to another region
aws rds copy-db-snapshot \
 --source-db-snapshot-identifier "prod-database-snapshot-20240115120000" \
 --target-db-snapshot-identifier "prod-database-snapshot-20240115120000-copy" \
 --source-region us-east-1 \
 --region us-west-2

Point-in-Time Recovery

def perform_point_in_time_recovery():
 """Perform point-in-time recovery"""
 
 rds = boto3.client('rds')
 
 # Restore to specific point in time
 response = rds.restore_db_instance_to_point_in_time(
 SourceDBInstanceIdentifier='prod-database',
 TargetDBInstanceIdentifier='prod-database-restored',
 RestoreTime=datetime(2024, 1, 15, 10, 30, 0), # UTC time
 DBInstanceClass='db.r5.xlarge',
 MultiAZ=True,
 PubliclyAccessible=False,
 VpcSecurityGroupIds=['sg-12345678'],
 DBSubnetGroupName='prod-subnet-group'
 )
 
 return response

6. Performance Monitoring and Optimization

Performance Insights

# Enable Performance Insights
aws rds modify-db-instance \
 --db-instance-identifier "prod-database" \
 --enable-performance-insights \
 --performance-insights-retention-period 7 \
 --apply-immediately

CloudWatch Metrics

def setup_rds_monitoring():
 """Set up comprehensive RDS monitoring"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # CPU utilization alarm
 cloudwatch.put_metric_alarm(
 AlarmName='RDS-HighCPU',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=2,
 MetricName='CPUUtilization',
 Namespace='AWS/RDS',
 Period=300,
 Statistic='Average',
 Threshold=80.0,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:rds-alerts'
 ],
 Dimensions=[
 {
 'Name': 'DBInstanceIdentifier',
 'Value': 'prod-database'
 }
 ]
 )
 
 # Database connections alarm
 cloudwatch.put_metric_alarm(
 AlarmName='RDS-HighConnections',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=2,
 MetricName='DatabaseConnections',
 Namespace='AWS/RDS',
 Period=300,
 Statistic='Average',
 Threshold=80,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:rds-alerts'
 ]
 )
 
 # Read replica lag alarm
 cloudwatch.put_metric_alarm(
 AlarmName='RDS-ReplicaLag',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=1,
 MetricName='ReplicaLag',
 Namespace='AWS/RDS',
 Period=300,
 Statistic='Average',
 Threshold=30,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:rds-alerts'
 ],
 Dimensions=[
 {
 'Name': 'DBInstanceIdentifier',
 'Value': 'prod-database-replica-1'
 }
 ]
 )

7. Security and Encryption

Encryption at Rest

# Create encrypted RDS instance
aws rds create-db-instance \
 --db-instance-identifier "secure-database" \
 --db-instance-class "db.r5.large" \
 --engine "postgres" \
 --master-username "admin" \
 --master-user-password "SecurePassword123!" \
 --allocated-storage 100 \
 --storage-encrypted \
 --kms-key-id "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012" \
 --multi-az

Network Security

def configure_rds_security():
 """Configure RDS security settings"""
 
 ec2 = boto3.client('ec2')
 
 # Create security group for RDS
 sg_response = ec2.create_security_group(
 GroupName='rds-security-group',
 Description='Security group for RDS instances',
 VpcId='vpc-12345678'
 )
 
 security_group_id = sg_response['GroupId']
 
 # Allow access from application servers only
 ec2.authorize_security_group_ingress(
 GroupId=security_group_id,
 IpPermissions=[
 {
 'IpProtocol': 'tcp',
 'FromPort': 3306,
 'ToPort': 3306,
 'UserIdGroupPairs': [
 {
 'GroupId': 'sg-app-servers',
 'Description': 'MySQL access from app servers'
 }
 ]
 }
 ]
 )
 
 return security_group_id

8. Disaster Recovery Strategies

Cross-Region Disaster Recovery

def setup_cross_region_dr():
 """Set up cross-region disaster recovery"""
 
 # Primary region setup
 primary_rds = boto3.client('rds', region_name='us-east-1')
 
 # Create cross-region read replica
 dr_replica = primary_rds.create_db_instance_read_replica(
 DBInstanceIdentifier='prod-database-dr',
 SourceDBInstanceIdentifier='arn:aws:rds:us-east-1:123456789012:db:prod-database',
 DBInstanceClass='db.r5.xlarge',
 PubliclyAccessible=False,
 MultiAZ=True,
 StorageEncrypted=True
 )
 
 # Set up automated snapshots in DR region
 dr_rds = boto3.client('rds', region_name='us-west-2')
 
 # Configure backup retention for DR replica
 dr_rds.modify_db_instance(
 DBInstanceIdentifier='prod-database-dr',
 BackupRetentionPeriod=30,
 PreferredBackupWindow='06:00-07:00', # Different window than primary
 ApplyImmediately=False
 )

def promote_read_replica_for_dr():
 """Promote read replica during disaster recovery"""
 
 dr_rds = boto3.client('rds', region_name='us-west-2')
 
 # Promote read replica to standalone instance
 response = dr_rds.promote_read_replica(
 DBInstanceIdentifier='prod-database-dr'
 )
 
 # Wait for promotion to complete
 waiter = dr_rds.get_waiter('db_instance_available')
 waiter.wait(DBInstanceIdentifier='prod-database-dr')
 
 # Update application configuration to use new endpoint
 update_application_config_for_dr()
 
 return response

9. Cost Optimization

Reserved Instances

def optimize_rds_costs():
 """Implement RDS cost optimization strategies"""
 
 rds = boto3.client('rds')
 
 # Get current instance information
 instances = rds.describe_db_instances()
 
 recommendations = []
 
 for instance in instances['DBInstances']:
 db_id = instance['DBInstanceIdentifier']
 instance_class = instance['DBInstanceClass']
 engine = instance['Engine']
 
 # Check utilization metrics
 utilization = get_instance_utilization(db_id)
 
 if utilization['cpu_avg'] < 20:
 recommendations.append({
 'instance': db_id,
 'recommendation': 'Consider downsizing',
 'current_class': instance_class,
 'suggested_class': get_smaller_instance_class(instance_class)
 })
 
 # Check for Reserved Instance opportunities
 if utilization['consistent_usage']:
 recommendations.append({
 'instance': db_id,
 'recommendation': 'Consider Reserved Instance',
 'potential_savings': calculate_ri_savings(instance_class, engine)
 })
 
 return recommendations

Storage Optimization

# Convert to gp3 for better performance and cost
aws rds modify-db-instance \
 --db-instance-identifier "prod-database" \
 --storage-type "gp3" \
 --iops 3000 \
 --storage-throughput 125 \
 --apply-immediately false

10. Common Exam Scenarios

Scenario 1: High availability database for critical application

Solution:

AWS Resilience Hub

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What it is: A service that assesses, validates, and tracks the resilience of your AWS applications against defined RTO and RPO targets — giving you a resilience score and actionable recommendations.

What problem it solves: You might think your application is resilient because it uses Multi-AZ RDS and Auto Scaling, but you don’t know if those configurations actually meet your RTO/RPO targets until you test them. Resilience Hub analyses your infrastructure and tells you before an outage.

AWS Route 53

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is Route 53?

Highly available and scalable DNS web service
Domain registration and DNS routing service
Health checking and failover capabilities
Global service with 100% availability SLA

Key Features

DNS Resolution - Authoritative DNS service
Domain Registration - Register and manage domains
Health Checks - Monitor endpoint health
Traffic Routing - Intelligent routing policies
DNS Failover - Automatic failover capabilities

2. DNS Fundamentals

DNS Record Types

# A Record - IPv4 address
aws route53 change-resource-record-sets \
 --hosted-zone-id Z123456789 \
 --change-batch '{
 "Changes": [{
 "Action": "CREATE",
 "ResourceRecordSet": {
 "Name": "www.example.com",
 "Type": "A",
 "TTL": 300,
 "ResourceRecords": [{"Value": "192.0.2.1"}]
 }
 }]
 }'

# CNAME Record - Canonical name
aws route53 change-resource-record-sets \
 --hosted-zone-id Z123456789 \
 --change-batch '{
 "Changes": [{
 "Action": "CREATE",
 "ResourceRecordSet": {
 "Name": "api.example.com",
 "Type": "CNAME",
 "TTL": 300,
 "ResourceRecords": [{"Value": "alb-123456789.us-east-1.elb.amazonaws.com"}]
 }
 }]
 }'

# MX Record - Mail exchange
aws route53 change-resource-record-sets \
 --hosted-zone-id Z123456789 \
 --change-batch '{
 "Changes": [{
 "Action": "CREATE",
 "ResourceRecordSet": {
 "Name": "example.com",
 "Type": "MX",
 "TTL": 300,
 "ResourceRecords": [
 {"Value": "10 mail1.example.com"},
 {"Value": "20 mail2.example.com"}
 ]
 }
 }]
 }'

Alias Records

def create_alias_record():
 """Create alias record for AWS resources"""
 
 route53 = boto3.client('route53')
 
 # Alias record for ALB
 response = route53.change_resource_record_sets(
 HostedZoneId='Z123456789',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'app.example.com',
 'Type': 'A',
 'AliasTarget': {
 'DNSName': 'alb-123456789.us-east-1.elb.amazonaws.com',
 'EvaluateTargetHealth': True,
 'HostedZoneId': 'Z35SXDOTRQ7X7K' # ALB hosted zone ID
 }
 }
 }]
 }
 )
 
 return response

3. Routing Policies

Simple Routing

def create_simple_routing():
 """Create simple routing policy"""
 
 route53 = boto3.client('route53')
 
 response = route53.change_resource_record_sets(
 HostedZoneId='Z123456789',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'simple.example.com',
 'Type': 'A',
 'TTL': 300,
 'ResourceRecords': [
 {'Value': '192.0.2.1'},
 {'Value': '192.0.2.2'}
 ]
 }
 }]
 }
 )
 
 return response

Weighted Routing

def create_weighted_routing():
 """Create weighted routing for traffic distribution"""
 
 route53 = boto3.client('route53')
 
 # 70% traffic to primary
 route53.change_resource_record_sets(
 HostedZoneId='Z123456789',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'app.example.com',
 'Type': 'A',
 'SetIdentifier': 'Primary-70',
 'Weight': 70,
 'TTL': 60,
 'ResourceRecords': [{'Value': '192.0.2.1'}]
 }
 }]
 }
 )
 
 # 30% traffic to secondary
 route53.change_resource_record_sets(
 HostedZoneId='Z123456789',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'app.example.com',
 'Type': 'A',
 'SetIdentifier': 'Secondary-30',
 'Weight': 30,
 'TTL': 60,
 'ResourceRecords': [{'Value': '192.0.2.2'}]
 }
 }]
 }
 )

Latency-Based Routing

def create_latency_routing():
 """Create latency-based routing for global applications"""
 
 route53 = boto3.client('route53')
 
 regions = [
 {'region': 'us-east-1', 'ip': '192.0.2.1'},
 {'region': 'eu-west-1', 'ip': '192.0.2.2'},
 {'region': 'ap-southeast-1', 'ip': '192.0.2.3'}
 ]
 
 for region_config in regions:
 route53.change_resource_record_sets(
 HostedZoneId='Z123456789',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'global.example.com',
 'Type': 'A',
 'SetIdentifier': f"Latency-{region_config['region']}",
 'Region': region_config['region'],
 'TTL': 60,
 'ResourceRecords': [{'Value': region_config['ip']}]
 }
 }]
 }
 )

Geolocation Routing

def create_geolocation_routing():
 """Create geolocation-based routing"""
 
 route53 = boto3.client('route53')
 
 # US traffic
 route53.change_resource_record_sets(
 HostedZoneId='Z123456789',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'geo.example.com',
 'Type': 'A',
 'SetIdentifier': 'US-Traffic',
 'GeoLocation': {'CountryCode': 'US'},
 'TTL': 60,
 'ResourceRecords': [{'Value': '192.0.2.1'}]
 }
 }]
 }
 )
 
 # European traffic
 route53.change_resource_record_sets(
 HostedZoneId='Z123456789',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'geo.example.com',
 'Type': 'A',
 'SetIdentifier': 'EU-Traffic',
 'GeoLocation': {'ContinentCode': 'EU'},
 'TTL': 60,
 'ResourceRecords': [{'Value': '192.0.2.2'}]
 }
 }]
 }
 )
 
 # Default for all other locations
 route53.change_resource_record_sets(
 HostedZoneId='Z123456',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'geo.example.com',
 'Type': 'A',
 'SetIdentifier': 'Default-Traffic',
 'GeoLocation': {'CountryCode': '*'},
 'TTL': 60,
 'ResourceRecords': [{'Value': '192.0.2.3'}]
 }
 }]
 }
 )

4. Health Checks and Failover

HTTP Health Checks

def create_health_checks():
 """Create comprehensive health checks"""
 
 route53 = boto3.client('route53')
 
 # HTTP health check
 http_health_check = route53.create_health_check(
 Type='HTTP',
 ResourcePath='/health',
 FullyQualifiedDomainName='app1.example.com',
 Port=80,
 RequestInterval=30,
 FailureThreshold=3,
 Tags=[
 {
 'Key': 'Name',
 'Value': 'App1-HealthCheck'
 }
 ]
 )
 
 # HTTPS health check with string matching
 https_health_check = route53.create_health_check(
 Type='HTTPS_STR_MATCH',
 ResourcePath='/api/status',
 FullyQualifiedDomainName='api.example.com',
 Port=443,
 RequestInterval=30,
 FailureThreshold=3,
 SearchString='{"status":"healthy"}',
 Tags=[
 {
 'Key': 'Name',
 'Value': 'API-HealthCheck'
 }
 ]
 )
 
 return {
 'http_health_check_id': http_health_check['HealthCheck']['Id'],
 'https_health_check_id': https_health_check['HealthCheck']['Id']
 }

Failover Routing

def create_failover_routing():
 """Create active-passive failover configuration"""
 
 route53 = boto3.client('route53')
 
 # Create health checks first
 health_checks = create_health_checks()
 
 # Primary record (active)
 route53.change_resource_record_sets(
 HostedZoneId='Z123456789',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'app.example.com',
 'Type': 'A',
 'SetIdentifier': 'Primary',
 'Failover': 'PRIMARY',
 'TTL': 60,
 'ResourceRecords': [{'Value': '192.0.2.1'}],
 'HealthCheckId': health_checks['http_health_check_id']
 }
 }]
 }
 )
 
 # Secondary record (passive)
 route53.change_resource_record_sets(
 HostedZoneId='Z123456',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'app.example.com',
 'Type': 'A',
 'SetIdentifier': 'Secondary',
 'Failover': 'SECONDARY',
 'TTL': 60,
 'ResourceRecords': [{'Value': '192.0.2.2'}]
 }
 }]
 }
 )

Calculated Health Checks

def create_calculated_health_check():
 """Create calculated health check based on multiple checks"""
 
 route53 = boto3.client('route53')
 
 # Create individual health checks
 web_health_check = route53.create_health_check(
 Type='HTTP',
 ResourcePath='/health',
 FullyQualifiedDomainName='web.example.com',
 Port=80
 )
 
 api_health_check = route53.create_health_check(
 Type='HTTPS',
 ResourcePath='/api/health',
 FullyQualifiedDomainName='api.example.com',
 Port=443
 )
 
 db_health_check = route53.create_health_check(
 Type='TCP',
 FullyQualifiedDomainName='db.example.com',
 Port=3306
 )
 
 # Create calculated health check
 calculated_check = route53.create_health_check(
 Type='CALCULATED',
 ChildHealthChecks=[
 web_health_check['HealthCheck']['Id'],
 api_health_check['HealthCheck']['Id'],
 db_health_check['HealthCheck']['Id']
 ],
 HealthThreshold=2, # At least 2 out of 3 must be healthy
 Tags=[
 {
 'Key': 'Name',
 'Value': 'Application-Overall-Health'
 }
 ]
 )
 
 return calculated_check['HealthCheck']['Id']

5. Multi-Region Resilience

Global Load Balancing

def setup_global_load_balancing():
 """Set up global load balancing across regions"""
 
 route53 = boto3.client('route53')
 
 # Create health checks for each region
 regions = [
 {'name': 'us-east-1', 'endpoint': 'us-east-alb.example.com', 'weight': 50},
 {'name': 'eu-west-1', 'endpoint': 'eu-west-alb.example.com', 'weight': 30},
 {'name': 'ap-southeast-1', 'endpoint': 'ap-southeast-alb.example.com', 'weight': 20}
 ]
 
 health_check_ids = {}
 
 for region in regions:
 health_check = route53.create_health_check(
 Type='HTTPS',
 ResourcePath='/health',
 FullyQualifiedDomainName=region['endpoint'],
 Port=443,
 RequestInterval=30,
 FailureThreshold=3
 )
 health_check_ids[region['name']] = health_check['HealthCheck']['Id']
 
 # Create weighted routing with health checks
 for region in regions:
 route53.change_resource_record_sets(
 HostedZoneId='Z123456789',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'global.example.com',
 'Type': 'CNAME',
 'SetIdentifier': f"Region-{region['name']}",
 'Weight': region['weight'],
 'TTL': 60,
 'ResourceRecords': [{'Value': region['endpoint']}],
 'HealthCheckId': health_check_ids[region['name']]
 }
 }]
 }
 )

Disaster Recovery DNS

def setup_disaster_recovery_dns():
 """Set up DNS for disaster recovery scenarios"""
 
 route53 = boto3.client('route53')
 
 # Primary site health check
 primary_health_check = route53.create_health_check(
 Type='HTTPS',
 ResourcePath='/health',
 FullyQualifiedDomainName='primary.example.com',
 Port=443,
 RequestInterval=30,
 FailureThreshold=2 # Faster failover
 )
 
 # DR site health check
 dr_health_check = route53.create_health_check(
 Type='HTTPS',
 ResourcePath='/health',
 FullyQualifiedDomainName='dr.example.com',
 Port=443,
 RequestInterval=30,
 FailureThreshold=3
 )
 
 # Primary site record
 route53.change_resource_record_sets(
 HostedZoneId='Z123456789',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'app.example.com',
 'Type': 'CNAME',
 'SetIdentifier': 'Primary-Site',
 'Failover': 'PRIMARY',
 'TTL': 30, # Low TTL for faster failover
 'ResourceRecords': [{'Value': 'primary.example.com'}],
 'HealthCheckId': primary_health_check['HealthCheck']['Id']
 }
 }]
 }
 )
 
 # DR site record
 route53.change_resource_record_sets(
 HostedZoneId='Z123456',
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'app.example.com',
 'Type': 'CNAME',
 'SetIdentifier': 'DR-Site',
 'Failover': 'SECONDARY',
 'TTL': 30,
 'ResourceRecords': [{'Value': 'dr.example.com'}],
 'HealthCheckId': dr_health_check['HealthCheck']['Id']
 }
 }]
 }
 )

6. Private DNS and Resolver

Private Hosted Zones

def create_private_hosted_zone():
 """Create private hosted zone for VPC"""
 
 route53 = boto3.client('route53')
 
 # Create private hosted zone
 response = route53.create_hosted_zone(
 Name='internal.example.com',
 VPC={
 'VPCRegion': 'us-east-1',
 'VPCId': 'vpc-12345678'
 },
 CallerReference=str(uuid.uuid4()),
 HostedZoneConfig={
 'PrivateZone': True,
 'Comment': 'Private zone for internal services'
 }
 )
 
 hosted_zone_id = response['HostedZone']['Id']
 
 # Add internal service records
 route53.change_resource_record_sets(
 HostedZoneId=hosted_zone_id,
 ChangeBatch={
 'Changes': [{
 'Action': 'CREATE',
 'ResourceRecordSet': {
 'Name': 'database.internal.example.com',
 'Type': 'A',
 'TTL': 300,
 'ResourceRecords': [{'Value': '10.0.1.100'}]
 }
 }]
 }
 )
 
 return hosted_zone_id

Route 53 Resolver

# Create resolver endpoint for hybrid DNS
aws route53resolver create-resolver-endpoint \
 --creator-request-id "$(uuidgen)" \
 --security-group-ids "sg-12345678" \
 --direction "OUTBOUND" \
 --ip-addresses SubnetId=subnet-12345678,Ip=10.0.1.10 SubnetId=subnet-87654321,Ip=10.0.2.10 \
 --tags Key=Name,Value=OutboundResolver

# Create resolver rule for on-premises domain
aws route53resolver create-resolver-rule \
 --creator-request-id "$(uuidgen)" \
 --domain-name "onprem.example.com" \
 --rule-type "FORWARD" \
 --resolver-endpoint-id "rslvr-out-12345678" \
 --target-ips Ip=192.168.1.10,Port=53 Ip=192.168.1.11,Port=53 \
 --tags Key=Name,Value=OnPremRule

7. Monitoring and Logging

CloudWatch Integration

def setup_route53_monitoring():
 """Set up Route 53 monitoring and alerting"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Health check status alarm
 cloudwatch.put_metric_alarm(
 AlarmName='Route53-HealthCheck-Failed',
 ComparisonOperator='LessThanThreshold',
 EvaluationPeriods=1,
 MetricName='HealthCheckStatus',
 Namespace='AWS/Route53',
 Period=60,
 Statistic='Minimum',
 Threshold=1.0,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:route53-alerts'
 ],
 Dimensions=[
 {
 'Name': 'HealthCheckId',
 'Value': 'health-check-id-12345'
 }
 ]
 )
 
 # Health check percentage alarm
 cloudwatch.put_metric_alarm(
 AlarmName='Route53-HealthCheck-LowPercentage',
 ComparisonOperator='LessThanThreshold',
 EvaluationPeriods=2,
 MetricName='HealthCheckPercentHealthy',
 Namespace='AWS/Route53',
 Period=300,
 Statistic='Average',
 Threshold=80.0,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:route53-alerts'
 ]
 )

Query Logging

# Enable query logging for hosted zone
aws route53 create-query-logging-config \
 --hosted-zone-id "Z123456789" \
 --cloud-watch-logs-log-group-arn "arn:aws:logs:us-east-1:123456789012:log-group:/aws/route53/queries"

8. Common Exam Scenarios

Scenario 1: Global application with automatic failover

Solution:

AWS S3 Cross-Region Replication

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is S3 Cross-Region Replication (CRR)?

Automatic, asynchronous replication of objects across AWS regions
Provides disaster recovery and compliance capabilities
Reduces latency for global applications
Maintains object metadata and access control lists

Key Benefits

Disaster Recovery - Geographic separation of data
Compliance - Meet regulatory requirements for data locality
Latency Reduction - Serve content from nearest region
Operational Efficiency - Centralized data management

2. Replication Configuration

Basic CRR Setup

# Create replication configuration
aws s3api put-bucket-replication \
 --bucket "source-bucket-us-east-1" \
 --replication-configuration '{
 "Role": "arn:aws:iam::123456789012:role/S3ReplicationRole",
 "Rules": [
 {
 "ID": "ReplicateToWest",
 "Status": "Enabled",
 "Priority": 1,
 "Filter": {
 "Prefix": "documents/"
 },
 "Destination": {
 "Bucket": "arn:aws:s3:::destination-bucket-us-west-2",
 "StorageClass": "STANDARD_IA"
 }
 }
 ]
 }'

Advanced Replication Rules

def create_advanced_replication_config():
 """Create advanced S3 replication configuration"""
 
 s3 = boto3.client('s3')
 
 replication_config = {
 'Role': 'arn:aws:iam::123456789012:role/S3ReplicationRole',
 'Rules': [
 {
 'ID': 'ReplicateDocuments',
 'Status': 'Enabled',
 'Priority': 1,
 'Filter': {
 'And': {
 'Prefix': 'documents/',
 'Tags': [
 {
 'Key': 'Replicate',
 'Value': 'true'
 }
 ]
 }
 },
 'Destination': {
 'Bucket': 'arn:aws:s3:::backup-bucket-eu-west-1',
 'StorageClass': 'GLACIER',
 'EncryptionConfiguration': {
 'ReplicaKmsKeyID': 'arn:aws:kms:eu-west-1:123456789012:key/12345678-1234-1234-1234-123456789012'
 },
 'ReplicationTime': {
 'Status': 'Enabled',
 'Time': {
 'Minutes': 15
 }
 },
 'Metrics': {
 'Status': 'Enabled',
 'EventThreshold': {
 'Minutes': 15
 }
 }
 }
 },
 {
 'ID': 'ReplicateImages',
 'Status': 'Enabled',
 'Priority': 2,
 'Filter': {
 'Prefix': 'images/'
 },
 'Destination': {
 'Bucket': 'arn:aws:s3:::cdn-bucket-ap-southeast-1',
 'StorageClass': 'STANDARD',
 'AccessControlTranslation': {
 'Owner': 'Destination'
 }
 }
 }
 ]
 }
 
 response = s3.put_bucket_replication(
 Bucket='source-bucket-us-east-1',
 ReplicationConfiguration=replication_config
 )
 
 return response

3. IAM Role and Permissions

Replication Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "Service": "s3.amazonaws.com"
 },
 "Action": "sts:AssumeRole"
 }
 ]
}

Replication Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObjectVersionForReplication",
 "s3:GetObjectVersionAcl",
 "s3:GetObjectVersionTagging"
 ],
 "Resource": "arn:aws:s3:::source-bucket-us-east-1/*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "s3:ListBucket"
 ],
 "Resource": "arn:aws:s3:::source-bucket-us-east-1"
 },
 {
 "Effect": "Allow",
 "Action": [
 "s3:ReplicateObject",
 "s3:ReplicateDelete",
 "s3:ReplicateTags"
 ],
 "Resource": "arn:aws:s3:::destination-bucket-us-west-2/*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "kms:Decrypt"
 ],
 "Resource": "arn:aws:kms:us-east-1:123456789012:key/source-key-id",
 "Condition": {
 "StringEquals": {
 "kms:ViaService": "s3.us-east-1.amazonaws.com"
 }
 }
 },
 {
 "Effect": "Allow",
 "Action": [
 "kms:GenerateDataKey"
 ],
 "Resource": "arn:aws:kms:us-west-2:123456789012:key/destination-key-id",
 "Condition": {
 "StringEquals": {
 "kms:ViaService": "s3.us-west-2.amazonaws.com"
 }
 }
 }
 ]
}

4. Same-Region Replication (SRR)

SRR Configuration

def setup_same_region_replication():
 """Set up Same-Region Replication for compliance"""
 
 s3 = boto3.client('s3')
 
 srr_config = {
 'Role': 'arn:aws:iam::123456789012:role/S3ReplicationRole',
 'Rules': [
 {
 'ID': 'ComplianceReplication',
 'Status': 'Enabled',
 'Priority': 1,
 'Filter': {
 'Tag': {
 'Key': 'Compliance',
 'Value': 'Required'
 }
 },
 'Destination': {
 'Bucket': 'arn:aws:s3:::compliance-backup-bucket',
 'StorageClass': 'STANDARD_IA',
 'EncryptionConfiguration': {
 'ReplicaKmsKeyID': 'arn:aws:kms:us-east-1:123456789012:key/compliance-key-id'
 }
 }
 }
 ]
 }
 
 response = s3.put_bucket_replication(
 Bucket='production-data-bucket',
 ReplicationConfiguration=srr_config
 )
 
 return response

5. Replication Time Control (RTC)

RTC Configuration

def enable_replication_time_control():
 """Enable Replication Time Control for predictable replication"""
 
 s3 = boto3.client('s3')
 
 rtc_config = {
 'Role': 'arn:aws:iam::123456789012:role/S3ReplicationRole',
 'Rules': [
 {
 'ID': 'RTCReplication',
 'Status': 'Enabled',
 'Priority': 1,
 'Filter': {
 'Prefix': 'critical-data/'
 },
 'Destination': {
 'Bucket': 'arn:aws:s3:::dr-bucket-us-west-2',
 'StorageClass': 'STANDARD',
 'ReplicationTime': {
 'Status': 'Enabled',
 'Time': {
 'Minutes': 15
 }
 },
 'Metrics': {
 'Status': 'Enabled',
 'EventThreshold': {
 'Minutes': 15
 }
 }
 }
 }
 ]
 }
 
 response = s3.put_bucket_replication(
 Bucket='critical-data-bucket',
 ReplicationConfiguration=rtc_config
 )
 
 return response

6. Monitoring Replication

CloudWatch Metrics

def monitor_replication_metrics():
 """Monitor S3 replication metrics"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Create alarm for replication failures
 cloudwatch.put_metric_alarm(
 AlarmName='S3-ReplicationFailures',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=1,
 MetricName='ReplicationLatency',
 Namespace='AWS/S3',
 Period=300,
 Statistic='Maximum',
 Threshold=900, # 15 minutes
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:s3-replication-alerts'
 ],
 Dimensions=[
 {
 'Name': 'SourceBucket',
 'Value': 'source-bucket-us-east-1'
 },
 {
 'Name': 'DestinationBucket',
 'Value': 'destination-bucket-us-west-2'
 }
 ]
 )
 
 # Create alarm for replication rule status
 cloudwatch.put_metric_alarm(
 AlarmName='S3-ReplicationRuleFailures',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=2,
 MetricName='ReplicationRuleFailures',
 Namespace='AWS/S3',
 Period=300,
 Statistic='Sum',
 Threshold=0,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:s3-replication-alerts'
 ]
 )

Replication Status Tracking

def check_replication_status():
 """Check replication status for objects"""
 
 s3 = boto3.client('s3')
 
 # List objects and check replication status
 response = s3.list_objects_v2(
 Bucket='source-bucket-us-east-1',
 Prefix='documents/'
 )
 
 replication_status = {}
 
 for obj in response.get('Contents', []):
 key = obj['Key']
 
 # Get object replication status
 obj_response = s3.head_object(
 Bucket='source-bucket-us-east-1',
 Key=key
 )
 
 replication_status[key] = {
 'replication_status': obj_response.get('ReplicationStatus', 'PENDING'),
 'last_modified': obj['LastModified'],
 'size': obj['Size']
 }
 
 return replication_status

7. Bi-Directional Replication

Two-Way Replication Setup

def setup_bidirectional_replication():
 """Set up bi-directional replication between regions"""
 
 s3_us_east = boto3.client('s3', region_name='us-east-1')
 s3_us_west = boto3.client('s3', region_name='us-west-2')
 
 # Replication from US East to US West
 east_to_west_config = {
 'Role': 'arn:aws:iam::123456789012:role/S3ReplicationRole',
 'Rules': [
 {
 'ID': 'EastToWest',
 'Status': 'Enabled',
 'Priority': 1,
 'Filter': {
 'Prefix': 'shared-data/'
 },
 'Destination': {
 'Bucket': 'arn:aws:s3:::shared-bucket-us-west-2',
 'StorageClass': 'STANDARD'
 }
 }
 ]
 }
 
 # Replication from US West to US East
 west_to_east_config = {
 'Role': 'arn:aws:iam::123456789012:role/S3ReplicationRole',
 'Rules': [
 {
 'ID': 'WestToEast',
 'Status': 'Enabled',
 'Priority': 1,
 'Filter': {
 'Prefix': 'shared-data/'
 },
 'Destination': {
 'Bucket': 'arn:aws:s3:::shared-bucket-us-east-1',
 'StorageClass': 'STANDARD'
 }
 }
 ]
 }
 
 # Apply configurations
 s3_us_east.put_bucket_replication(
 Bucket='shared-bucket-us-east-1',
 ReplicationConfiguration=east_to_west_config
 )
 
 s3_us_west.put_bucket_replication(
 Bucket='shared-bucket-us-west-2',
 ReplicationConfiguration=west_to_east_config
 )

8. Disaster Recovery Patterns

Multi-Region Backup Strategy

def implement_multi_region_backup():
 """Implement comprehensive multi-region backup strategy"""
 
 regions = ['us-east-1', 'us-west-2', 'eu-west-1']
 primary_region = 'us-east-1'
 
 for backup_region in [r for r in regions if r != primary_region]:
 s3_primary = boto3.client('s3', region_name=primary_region)
 
 # Create replication configuration for each backup region
 replication_config = {
 'Role': 'arn:aws:iam::123456789012:role/S3ReplicationRole',
 'Rules': [
 {
 'ID': f'BackupTo{backup_region.replace("-", "")}',
 'Status': 'Enabled',
 'Priority': 1,
 'Filter': {}, # Replicate all objects
 'Destination': {
 'Bucket': f'arn:aws:s3:::backup-bucket-{backup_region}',
 'StorageClass': 'GLACIER',
 'ReplicationTime': {
 'Status': 'Enabled',
 'Time': {'Minutes': 15}
 }
 }
 }
 ]
 }
 
 s3_primary.put_bucket_replication(
 Bucket='production-data-bucket',
 ReplicationConfiguration=replication_config
 )

Failover Automation

def automate_s3_failover():
 """Automate S3 failover for disaster recovery"""
 
 def lambda_handler(event, context):
 """Lambda function for S3 failover automation"""
 
 # Parse CloudWatch alarm or manual trigger
 primary_region = 'us-east-1'
 failover_region = 'us-west-2'
 
 route53 = boto3.client('route53')
 
 # Update Route 53 records to point to failover region
 response = route53.change_resource_record_sets(
 HostedZoneId='Z123456789',
 ChangeBatch={
 'Changes': [{
 'Action': 'UPSERT',
 'ResourceRecordSet': {
 'Name': 'data.example.com',
 'Type': 'CNAME',
 'TTL': 60,
 'ResourceRecords': [
 {'Value': f's3-{failover_region}.amazonaws.com'}
 ]
 }
 }]
 }
 )
 
 # Send notification
 sns = boto3.client('sns')
 sns.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:disaster-recovery',
 Message=f'S3 failover completed to {failover_region}',
 Subject='S3 Disaster Recovery Activated'
 )
 
 return {'statusCode': 200, 'body': 'Failover completed'}

9. Cost Optimization

Storage Class Optimization

def optimize_replication_costs():
 """Optimize replication costs with appropriate storage classes"""
 
 s3 = boto3.client('s3')
 
 # Different storage classes for different data types
 cost_optimized_config = {
 'Role': 'arn:aws:iam::123456789012:role/S3ReplicationRole',
 'Rules': [
 {
 'ID': 'FrequentAccessData',
 'Status': 'Enabled',
 'Priority': 1,
 'Filter': {
 'Tag': {
 'Key': 'AccessPattern',
 'Value': 'Frequent'
 }
 },
 'Destination': {
 'Bucket': 'arn:aws:s3:::backup-bucket-us-west-2',
 'StorageClass': 'STANDARD'
 }
 },
 {
 'ID': 'InfrequentAccessData',
 'Status': 'Enabled',
 'Priority': 2,
 'Filter': {
 'Tag': {
 'Key': 'AccessPattern',
 'Value': 'Infrequent'
 }
 },
 'Destination': {
 'Bucket': 'arn:aws:s3:::backup-bucket-us-west-2',
 'StorageClass': 'STANDARD_IA'
 }
 },
 {
 'ID': 'ArchiveData',
 'Status': 'Enabled',
 'Priority': 3,
 'Filter': {
 'Tag': {
 'Key': 'AccessPattern',
 'Value': 'Archive'
 }
 },
 'Destination': {
 'Bucket': 'arn:aws:s3:::backup-bucket-us-west-2',
 'StorageClass': 'GLACIER'
 }
 }
 ]
 }
 
 response = s3.put_bucket_replication(
 Bucket='source-bucket-us-east-1',
 ReplicationConfiguration=cost_optimized_config
 )
 
 return response

10. Common Exam Scenarios

Scenario 1: Disaster recovery for critical data

Solution:

ECS Deployments

Sun, 04 Oct 2026 00:00:00 +0000

What it is: How new container revisions reach production on ECS — the resilient-deployment core for container workloads.

Exam-testable facts:

Deployment controllers: ECS (default), CODE_DEPLOY (blue/green powered by CodeDeploy), EXTERNAL (bring your own controller, e.g., a third-party progressive-delivery tool).
ECS-controller strategies: ROLLING (default; governed by minimumHealthyPercent/maximumPercent), BLUE_GREEN, LINEAR (equal-percentage traffic steps), CANARY (small slice first, then the rest at once).
Deployment circuit breaker: watches a rolling deployment and automatically rolls back on repeated task-launch failures — the “self-healing deploy” answer. Can also roll back on CloudWatch alarms.
CODE_DEPLOY blue/green: CodeDeploy stands up a replacement task set, validates it against a test listener, then shifts production traffic (all-at-once, canary, or linear); AppSpec file plus Lambda lifecycle hooks (BeforeAllowTraffic, AfterAllowTraffic).
Scaling knobs are different things: Service Auto Scaling changes the task count (target tracking on CPU/memory/ALB request count); for the EC2 launch type, capacity providers with managed scaling change the instance count.
Fargate note: with CODE_DEPLOY or EXTERNAL controllers on Fargate, minimumHealthyPercent is ignored.

Common traps:

ElastiCache Resilience

Sun, 04 Oct 2026 00:00:00 +0000

What it is: In-memory data store (Redis/Valkey, Memcached). The resilience story is two features people constantly confuse.

Exam-testable facts:

Redis replication group: 1 primary + up to 5 read replicas. With automatic failover, the replica with the least replication lag is promoted to primary on failure; the primary/reader DNS endpoints follow automatically.
Multi-AZ, failover, and replicas move together: Multi-AZ needs automatic failover, which needs a replica.
Multi-AZ ≠ cross-Region. Multi-AZ survives node/AZ failure within one Region. Cross-Region DR is Global Datastore: async replication (typically sub-second lag), secondaries serve local reads — but regional failover is manual (promote the secondary yourself).
Cluster mode disabled (single shard): full Redis command support, vertical scaling only. Cluster mode enabled (up to 500 shards): horizontal write scaling; multi-key commands need all keys in one hash slot (use {hash tags}).
Exam trap: “automatic cross-Region failover for ElastiCache” does not exist.

Sources: https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/redis-ug.pdf

RDS Blue/Green Deployments

Sun, 04 Oct 2026 00:00:00 +0000

Launched: November 2022 for RDS MySQL, MariaDB, and Aurora MySQL. PostgreSQL support added later. This is a tested resilience and deployment pattern — know it alongside Multi-AZ and read replicas.

1. Overview

What it is: A managed deployment mechanism that creates a staging environment (green) that mirrors your production database (blue), lets you make and validate changes on green, then switches traffic from blue to green with minimal downtime — typically under 1 minute.