Your FREE AWS Cloud Practitioner Flashcards 2026 – 300+ Cards

On-demand delivery of IT resources (compute, storage, databases) over the internet with pay-as-you-go pricing

Trade fixed for variable expense, benefit from economies of scale, stop guessing capacity, increase speed and agility, stop spending on data centers, and go global in minutes

Paying only for the resources you actually use, with no large upfront investment

Capital expenditure is upfront spending on owned assets; operational expenditure is ongoing pay-as-you-go spending — the cloud shifts CapEx to OpEx

The ability to automatically add or remove resources to match demand in real time

The ability to increase capacity to handle growth, by scaling up (bigger) or scaling out (more)

Scalability is the capacity to grow; elasticity is automatically scaling in and out with fluctuating demand

The ability to quickly develop, test, and launch applications because resources are available on demand

Because AWS aggregates usage from many customers, it achieves lower costs and passes savings to customers

You can deploy applications to multiple Regions worldwide quickly, reaching users with low latency

Designing systems to remain operational with minimal downtime, often by using multiple Availability Zones

The ability of a system to keep running even when a component fails

A set of best practices and design principles for building secure, reliable, efficient, and cost-effective workloads, organized into six pillars

Six: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability

Running and monitoring systems to deliver business value and continually improving processes and procedures

Protecting data, systems, and assets through risk assessment and mitigation strategies

Ensuring a workload performs its function correctly and recovers quickly from failures

Using computing resources efficiently and maintaining efficiency as demand and technology change

Running systems to deliver business value at the lowest price point

Minimizing the environmental impact of running cloud workloads

Guidance that helps organizations plan and accelerate cloud adoption across six perspectives

Business, People, Governance, Platform, Security, and Operations

Rehost, Replatform, Repurchase, Refactor, Retire, Retain, and Relocate

Moving an application to the cloud with little or no change

Making a few cloud optimizations to gain benefits without changing the core architecture

Redesigning an application to take full advantage of cloud-native features

Moving from a licensed product to a different one, often a SaaS offering

Decommissioning applications that are no longer needed

Keeping certain applications on-premises for now (revisit later)

Moving infrastructure to the cloud without purchasing new hardware or changing operations, e.g., VMware Cloud on AWS

The full cost of owning a solution, including hardware, software, operations, and staffing, used to compare on-premises vs cloud

Matching instance types and sizes to actual workload requirements to optimize cost and performance

Infrastructure as a Service — basic building blocks (compute, storage, networking) with maximum control, e.g., EC2

Platform as a Service — a managed platform to develop and deploy apps without managing infrastructure, e.g., Elastic Beanstalk

Software as a Service — completed applications delivered over the internet, e.g., email or a web app

IaaS gives the most control over infrastructure; PaaS manages the platform; SaaS delivers ready-to-use software

Cloud (all-in), Hybrid (cloud plus on-premises), and On-premises (private cloud)

Connecting cloud resources with existing on-premises infrastructure

Understanding and optimizing the cost benefits of the cloud, such as variable cost and reduced TCO

Routine tasks (racking servers, patching) that add no unique value, which the cloud offloads to AWS

Designing components so they operate independently, reducing the impact of one failing

It reduces manual effort and errors, improves consistency, and lowers operational cost

An AWS service where AWS handles the operational tasks (patching, scaling, backups), reducing customer burden

Running code without provisioning or managing servers; AWS handles scaling and you pay per use, e.g., Lambda

With elastic cloud resources you no longer need to over- or under-provision hardware for peak demand

Resources are available in minutes, so teams experiment and deliver faster

Choosing a Region lets you keep data in a specific geography to meet legal and regulatory requirements

Using AWS to back up and recover workloads quickly across Regions/AZs to minimize downtime and data loss

Deploying close to end users worldwide reduces latency and improves experience

Vertical scaling adds power to one resource (scale up); horizontal scaling adds more resources (scale out)

It eliminates large upfront capital costs in favor of variable operating costs

It helps you measure architectures against best practices and identify areas for improvement

On-demand, scalable IT resources with pay-as-you-go pricing and no upfront infrastructure investment

On-premises means you own and run the data center; cloud means AWS owns the infrastructure and you consume it as a service

The ability to run workloads across environments, supported by containers and standard tooling

Breaking apps into small, independent services improves agility, scalability, and resilience

Scaling out adds resources to meet demand; scaling in removes them when demand drops, saving cost

Paying only for resources while in use, and releasing them when idle, lowers total spend

Assume components will fail and architect so the system continues operating despite failures

It increases availability and fault tolerance by isolating workloads from a single AZ failure

Low-cost, fast experimentation because you can spin resources up and tear them down on demand

An action plan (cloud transformation roadmap) for a successful cloud migration

Public cloud resources are shared and delivered over the internet (AWS); private cloud is dedicated to one organization

AWS invests heavily in security and compliance at a scale most organizations cannot match on their own

You avoid paying for idle capacity during low-demand periods

It shortens time to market by removing procurement and provisioning delays

Reduced operational overhead, better utilization, and economies of scale

It reduces energy use and carbon footprint by optimizing resource usage

AWS is responsible for security OF the cloud; the customer is responsible for security IN the cloud

Security OF the cloud: hardware, the global infrastructure, Regions, AZs, edge locations, and the managed-service software

Security IN the cloud: their data, identity and access management, OS/app patching for what they run, encryption, and network/firewall configuration

EC2 is closer to IaaS, so the customer manages the guest OS, patching, applications, and security configuration

AWS handles more (the OS and platform); the customer mainly manages data, access permissions, and encryption settings

The customer — managing their own data and controlling access is always the customer's responsibility

Identity and Access Management — controls who is authenticated and authorized to use AWS resources

An identity representing a person or application with long-term credentials for accessing AWS

A collection of IAM users that share the same permissions, making access easier to manage

An identity with temporary permissions that can be assumed by users, applications, or AWS services — no long-term credentials

A JSON document that defines permissions — what actions are allowed or denied on which resources

Granting only the minimum permissions required to perform a task, and nothing more

The identity created when you open an AWS account, with full access; it should be locked down and used only for a few tasks

Enable MFA, do not use it for daily tasks, never create access keys for it, and create IAM identities for everyday use

An extra layer of sign-in security requiring a second factor (such as a code from a device) in addition to a password

Formerly AWS SSO — centrally manages single sign-on access to multiple AWS accounts and applications

Short-lived access keys provided when assuming a role, more secure than long-term credentials

A service to centrally manage and govern multiple AWS accounts, with consolidated billing and policies

An Organizations policy that sets the maximum permissions for accounts in an organizational unit

A group of AWS accounts within AWS Organizations that can be managed as a single unit

A service that sets up and governs a secure, multi-account AWS environment based on best practices

A managed service that protects applications against Distributed Denial of Service (DDoS) attacks

Shield Standard is free automatic DDoS protection; Shield Advanced adds enhanced protection, reporting, and DDoS cost protection

Web Application Firewall — filters and blocks malicious web traffic such as SQL injection and cross-site scripting

A threat-detection service that continuously monitors for malicious activity and unauthorized behavior

An automated vulnerability-management service that scans workloads for software vulnerabilities and exposure

A service that uses machine learning to discover and protect sensitive data such as PII stored in Amazon S3

A service that gives a centralized view of security alerts and compliance status across AWS accounts

Key Management Service — creates and manages encryption keys to encrypt your data across AWS services

A hardware security module (HSM) service that provides dedicated hardware to manage your encryption keys

A service to store, manage, and automatically rotate secrets such as database credentials and API keys

A service to provision, manage, and deploy SSL/TLS certificates for AWS resources

A service that adds user sign-up, sign-in, and access control to web and mobile apps

A self-service portal providing on-demand access to AWS compliance reports and agreements

Protecting stored data by encrypting it on disk, so it is unreadable without the key

Protecting data as it moves across networks, typically using TLS/SSL

Third-party attestations and certifications (e.g., SOC, PCI DSS, HIPAA, ISO, FedRAMP) that AWS meets

To provide evidence that AWS infrastructure meets regulatory and compliance requirements

A service that analyzes and visualizes security data to investigate the root cause of security findings

Centrally configures and manages firewall rules (WAF, Shield, security groups) across accounts

A managed network firewall service for VPCs that filters traffic at the perimeter

Identifies resources shared with external entities and helps validate least-privilege policies

Automates evidence collection to help audit AWS usage against compliance frameworks

Authentication verifies who you are (sign-in); authorization determines what you are allowed to do (permissions)

An encryption key that the customer creates, owns, and manages within AWS KMS

It checks for security gaps such as open ports, exposed access keys, and missing MFA on the root user

AWS protecting the infrastructure that runs all AWS services — compute, storage, networking, and facilities

The customer protecting their content, applications, identity management, and configurations

The customer is responsible for guest OS patching on EC2

AWS handles patching of the managed RDS database engine; the customer manages data and access

It greatly reduces the risk of account compromise even if a password is stolen

JSON with Effect (Allow/Deny), Action, Resource, and optional Condition elements

Allowing users authenticated by an external identity provider to access AWS without separate IAM users

A service to securely share AWS resources across accounts

Roles provide temporary, automatically rotated credentials, avoiding hard-coded long-term keys

The requirement that data be stored within a specific country or Region; you control the Region in AWS

It defines the terms of service, including the shared responsibility for security and compliance

Reduces the attack surface and limits damage if credentials are compromised

AWS provides channels to report suspected abuse of AWS resources, such as spam or malicious activity

A hardened instance in a public subnet used to securely access instances in private subnets

It protects web applications from common exploits by filtering HTTP/HTTPS requests with rules

Customers may run pen tests on permitted services without prior approval, subject to AWS policy

Issues temporary, limited-privilege credentials for IAM users or federated users

Amazon GuardDuty (threat detection) and Trusted Advisor flag suspicious or exposed credentials

It provides an auditable record of API activity across the account for security investigations

A public and private key used to securely connect (SSH/RDP) to an EC2 instance

WAF can be attached to CloudFront, Application Load Balancer, or API Gateway to filter traffic

The root user has unrestricted access, so MFA is essential to prevent full account takeover

An advanced feature that sets the maximum permissions an IAM entity can have

All inbound traffic is denied by default until you add allow rules

The default NACL allows all inbound and outbound traffic; custom NACLs deny all by default

AWS provides encryption tools (KMS); the customer is responsible for enabling and configuring encryption

It continuously evaluates resource configurations against desired rules and flags non-compliance

Sensitive data such as personally identifiable information (PII) stored in Amazon S3

Inspector scans for software vulnerabilities; GuardDuty detects active threats and malicious behavior

It is automatically included at no extra cost for all AWS customers, protecting against common DDoS attacks

Configuring bucket policies, access control, Block Public Access, and encryption to protect data

An S3 setting that prevents buckets and objects from being made publicly accessible

Embedding long-term access keys in code; the secure way is to attach an IAM role

On-demand reports such as SOC reports, PCI DSS attestations, and ISO certifications

To aggregate, organize, and prioritize security findings from multiple AWS security services

Periodically replacing encryption keys to limit exposure; KMS can rotate keys automatically

A managed policy is reusable and attachable to many identities; an inline policy is embedded in a single identity

It enables centralized governance, SCP guardrails, and consistent policies across all accounts

It analyzes CloudTrail logs, VPC Flow Logs, and DNS logs to detect threats

Applying multiple layers of security controls (network, identity, encryption, monitoring) so no single failure is catastrophic

Common web exploits like SQL injection, cross-site scripting, and bad bots

The customer, through IAM policies, bucket policies, ACLs, and Block Public Access settings

Assume-role grants short-lived credentials, avoiding shared long-term keys between accounts

Elastic Compute Cloud — resizable virtual servers (instances) in the cloud; the core IaaS compute service

Simple Storage Service — highly durable, scalable object storage for files of any type, stored in buckets

A serverless compute service that runs your code in response to events; you pay only for compute time used, no servers to manage

Virtual Private Cloud — a logically isolated virtual network in AWS where you launch resources with full control over IP ranges, subnets, and routing

A separate geographic area containing multiple, isolated Availability Zones

One or more discrete data centers with redundant power and networking within a Region, isolated from failures in other AZs

A site used by Amazon CloudFront and Route 53 to cache content and serve it closer to users for low latency

Region = geographic area; AZ = isolated data center(s) within a Region; edge location = caching site for content delivery

Deploy resources across multiple Availability Zones so the failure of one AZ does not take down the application

A content delivery network (CDN) that caches content at edge locations to deliver it with low latency

Extensions of a Region that place compute and storage closer to large population centers for single-digit-millisecond latency

AWS infrastructure and services delivered as physical racks installed in your own on-premises data center for hybrid workloads

Embeds AWS compute and storage within 5G networks to deliver ultra-low-latency applications to mobile devices

Categories of instance types optimized for different workloads: general purpose, compute optimized, memory optimized, storage optimized, and accelerated computing

A template containing the operating system, configuration, and software used to launch EC2 instances

Automatically adds or removes EC2 instances based on demand to maintain performance and minimize cost

Automatically distributes incoming traffic across multiple targets such as EC2 instances across Availability Zones

A Layer 7 load balancer that routes HTTP/HTTPS traffic based on content such as URL path or host

A Layer 4 load balancer that handles TCP/UDP traffic at very high performance and ultra-low latency

Distributes traffic to virtual appliances such as firewalls and intrusion-detection systems

Elastic Container Service — a fully managed service to run and orchestrate Docker containers on AWS

Elastic Kubernetes Service — a managed Kubernetes service for running containerized applications

A serverless compute engine for containers that runs ECS or EKS tasks without managing the underlying servers

A PaaS that automatically handles deployment, capacity, load balancing, and scaling for web applications you upload

An easy-to-use service offering pre-configured virtual servers, databases, and networking at a low, predictable price

A service that runs large numbers of batch computing jobs, dynamically provisioning the optimal compute resources

The default S3 storage class for frequently accessed data, offering high durability and availability across multiple AZs

A lower-cost S3 class for data accessed less often but needed quickly, with a per-GB retrieval fee

An infrequent-access S3 class storing data in a single Availability Zone at lower cost, for re-creatable data

An archive S3 class for rarely accessed data that still needs millisecond retrieval

A low-cost archive class with retrieval times from minutes to hours, for data accessed once or twice a year

The lowest-cost S3 storage class for long-term archival, with retrieval times of about 12 hours

An S3 class that automatically moves objects between access tiers based on usage to optimize cost

Elastic Block Store — durable block storage volumes you attach to EC2 instances, like a virtual hard drive

Elastic File System — a scalable, fully managed shared file system that multiple Linux EC2 instances can mount at once

Fully managed third-party file systems such as FSx for Windows File Server and FSx for Lustre

EBS = block storage for one instance; EFS = shared file storage for many Linux instances; S3 = object storage accessed over the internet

A hybrid service that connects on-premises applications to AWS cloud storage

Physical devices (Snowcone, Snowball Edge) for migrating large amounts of data into and out of AWS, including in disconnected environments

A centralized service to automate and manage backups across AWS services

Relational Database Service — managed relational databases (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server) that handle patching, backups, and failover

A high-performance, MySQL- and PostgreSQL-compatible relational database built for the cloud, part of RDS

A fully managed, serverless NoSQL key-value and document database with single-digit-millisecond performance at any scale

A fully managed, petabyte-scale cloud data warehouse for analytics and business intelligence

A managed in-memory caching service supporting Redis and Memcached to speed up applications

A managed document database service compatible with MongoDB

A fully managed graph database service for highly connected data sets

A managed, serverless database compatible with Apache Cassandra

A service that migrates databases to AWS with minimal downtime, including between different database engines

A range of IP addresses within a VPC, placed in a single Availability Zone, that can be public or private

A public subnet has a route to an internet gateway; a private subnet does not have direct inbound internet access

A VPC component that allows communication between resources in the VPC and the internet

Allows instances in a private subnet to initiate outbound internet connections while blocking inbound connections from the internet

A stateful virtual firewall at the instance level that controls inbound and outbound traffic; allow rules only

A stateless firewall at the subnet level that supports both allow and deny rules

Security group = stateful, instance level, allow rules only; NACL = stateless, subnet level, allow and deny rules

A scalable Domain Name System (DNS) web service for domain registration, routing, and health checks

A dedicated private network connection from your premises to AWS, bypassing the public internet

An encrypted connection over the internet between your on-premises network and your AWS VPC

A fully managed service to create, publish, and secure REST, HTTP, and WebSocket APIs at scale

A network hub that connects VPCs and on-premises networks through a central gateway

A networking connection between two VPCs that lets resources route traffic privately between them

Provides private connectivity between VPCs and AWS services without exposing traffic to the public internet

A web-based graphical interface for accessing and managing AWS services

The AWS Command Line Interface — a tool to control AWS services from the command line using commands and scripts

Software Development Kits that let you interact with AWS services programmatically from languages such as Python, Java, and JavaScript

An infrastructure-as-code service that provisions and manages AWS resources using templates

Defining and provisioning infrastructure through machine-readable templates or code rather than manual processes

A service to view and control your AWS and on-premises infrastructure, including patching, automation, and Parameter Store

A monitoring service that collects metrics, logs, and alarms to observe AWS resources and applications

A service that records API calls and account activity for governance, compliance, and auditing

CloudWatch monitors performance (metrics and logs); CloudTrail audits who did what (API call history)

A service that tracks AWS resource configurations over time and evaluates them against rules for compliance

It lets developers deploy applications quickly without managing the underlying infrastructure

Simple Notification Service — a pub/sub messaging service that sends notifications to subscribers and other services

Simple Queue Service — a fully managed message queue that decouples and scales application components

SNS pushes messages to many subscribers (pub/sub); SQS holds messages in a queue to be pulled by consumers

A serverless event bus that connects application data from your apps, AWS services, and SaaS sources

A serverless service that coordinates multiple AWS services into visual workflows

A fully managed service to build, train, and deploy machine learning models at scale

An AI service that analyzes images and video for objects, faces, text, and content moderation

A natural-language-processing service that finds insights and relationships in text

A service that turns text into lifelike speech (text-to-speech)

A service for building conversational chatbots using voice and text

An automatic speech-recognition service that converts audio to text

A neural machine-translation service that translates text between languages

A service that automatically extracts text and data from scanned documents

A generative-AI-powered assistant for work and software development on AWS

A serverless, interactive query service that analyzes data directly in Amazon S3 using SQL

A platform to collect, process, and analyze real-time streaming data

A serverless data-integration and ETL (extract, transform, load) service to prepare data for analytics

A cloud-based business-intelligence service for building dashboards and visualizations

Elastic MapReduce — a managed big-data platform for processing data using frameworks like Apache Spark and Hadoop

A cloud-based contact-center service for customer support

A set of tools to build and deploy full-stack web and mobile applications quickly

A free tool in the console that reviews your workloads against the Well-Architected Framework best practices

AWS Management Console (GUI), AWS CLI (command line), and AWS SDKs (programmatic) — all call the same APIs

Regions, Availability Zones within each Region, and a global network of edge locations

Based on data residency/compliance, proximity to users (latency), service availability, and cost

Delivering static and dynamic content with low latency by caching at edge locations worldwide

Free service — you pay only for the underlying resources it provisions (EC2, S3, etc.)

A reusable configuration that specifies instance settings (AMI, type, key pair) used to launch instances

On-Demand, Reserved Instances, Savings Plans, Spot Instances, and Dedicated Hosts

Pay for compute by the second or hour with no commitment — best for short-term, unpredictable workloads

A 1- or 3-year commitment to a specific instance configuration in exchange for a large discount over On-Demand

A flexible pricing model offering lower prices for a committed amount of compute usage (per hour) over 1 or 3 years

Unused EC2 capacity at up to 90% off On-Demand; AWS can reclaim them with short notice — ideal for fault-tolerant workloads

Physical EC2 servers dedicated to you, often used for licensing or compliance requirements

Spot Instances, which offer the deepest discount but can be interrupted

Reserved Instances or Savings Plans, which discount in exchange for a 1- or 3-year commitment

A way to try AWS services free, in three forms: always free, 12-months free, and short-term trials

Always Free, 12 Months Free (for new accounts), and Free Trials (short-term)

Compute, storage, and data transfer out of AWS (inbound transfer is generally free)

Inbound data transfer is generally free; you are charged for data transferred out

An AWS Organizations feature that combines billing for multiple accounts into one bill and can earn volume discounts

One bill across accounts plus aggregated usage that can qualify for volume pricing tiers

A tool to visualize, understand, and forecast your AWS costs and usage over time

A tool to set custom cost and usage budgets and receive alerts when you exceed or are forecast to exceed them

The most detailed report of your AWS costs and usage, delivered to an S3 bucket

A web tool to estimate the cost of AWS services before you deploy them

A service to customize billing and show back/charge back costs across accounts

Labels on resources used to categorize and track AWS costs in billing reports

Cost Explorer analyzes and forecasts past/current spend; Budgets sets thresholds and alerts you proactively

Basic, Developer, Business, Enterprise On-Ramp, and Enterprise

Free for all customers: documentation, whitepapers, AWS re:Post, and access to a limited set of Trusted Advisor checks

Business-hours email access to Cloud Support associates, for early development and testing

24/7 phone, email, and chat support, full Trusted Advisor checks, and faster response times — for production workloads

A pool of Technical Account Managers and faster critical response, between Business and Enterprise

A designated Technical Account Manager (TAM), 24/7 support, fastest response (15 minutes for business-critical), and concierge support

Enterprise Support includes a designated TAM; Enterprise On-Ramp provides a pool of TAMs

Business, Enterprise On-Ramp, and Enterprise (Basic and Developer get a limited set)

A tool that inspects your environment and recommends improvements across five categories

Cost Optimization, Performance, Security, Fault Tolerance, and Service Limits (quotas)

Shows the health and status of AWS services and any events affecting your specific resources

A community-driven, AWS-managed question-and-answer service that replaced AWS Forums

A collection of answers to the most frequent technical questions about AWS

A curated digital catalog to find, buy, and deploy third-party software that runs on AWS

A designated AWS advocate who provides proactive guidance and architectural support to Enterprise customers

Business Support — 24/7 access, full Trusted Advisor, and quick response times

The more you use of certain services (like S3), the lower the per-unit price through tiered pricing

Savings Plans commit to a dollar-per-hour spend with flexibility across instance families; RIs commit to specific instance configurations

They identify idle or underused resources and security gaps, helping reduce cost and risk

$100 USD

You do not need to pass each domain separately; only the overall scaled score of 700 matters