AWS Certified Developer - Associate Flashcards

Concurrency is the number of in-flight executions a function has at any moment. Reserved concurrency sets both a guaranteed minimum and a hard maximum for a specific function, preventing it from consuming the account's shared pool or from scaling beyond that cap.

Use FIFO when message order must be preserved and duplicates cannot be tolerated, such as processing financial transactions in sequence. Standard queues offer higher throughput but only best-effort ordering and at-least-once delivery.

It captures messages that fail processing after a configured number of receive attempts (maxReceiveCount), isolating problem messages so they don't block the main queue and allowing them to be inspected or reprocessed later.

It is the IAM role that grants a Lambda function permission to interact with other AWS services (e.g., writing to S3 or DynamoDB); it is separate from any role used to invoke the function.

Eventually consistent reads may return stale data shortly after a write but consume half the read capacity and have lower latency; strongly consistent reads always return the most recent write but cost more read capacity and are unavailable for global secondary indexes.

A GSI lets you query a table using an alternate partition key (and optional sort key) different from the table's primary key, enabling additional query patterns without duplicating the table.

An item-level modification (insert, update, or delete) in a DynamoDB table, which can then be consumed by Lambda or the Kinesis Client Library to react to data changes in near real time.

Data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a KMS customer master/managed key (CMK); this avoids sending large payloads to KMS and lets KMS manage only key wrapping.

An IAM user represents a persistent identity with long-term credentials; an IAM role is an identity with temporary credentials that can be assumed by users, services, or applications, and is the recommended way to grant permissions to compute resources.

Temporary security credentials (access key, secret key, and session token) that expire after a set duration, allowing cross-account or cross-service access without long-lived credentials.

It grants time-limited access to a specific S3 object using the permissions of the URL's creator, allowing a client to upload or download the object directly without needing AWS credentials of their own.

S3 Standard-Infrequent Access (S3 Standard-IA), which offers lower storage cost than S3 Standard with millisecond retrieval, but charges a retrieval fee and has a minimum storage duration.

It splits a large object into parts uploaded independently (and in parallel), improving throughput and allowing resumption of a failed upload without restarting the entire transfer.

It defines deployment configuration for EC2/on-premises or Lambda deployments, including source file locations, lifecycle event hooks, and (for Lambda) the function version and alias to shift traffic to.

In-place deployment stops the application on existing instances and installs the new version on them; blue/green provisions a new set of instances (or resources) with the new version and shifts traffic over, allowing quick rollback by reverting traffic.

An alias is a named pointer to a specific Lambda function version; assigning weighted routing across two aliases enables canary or linear deployments that gradually shift invocation traffic to a new version.

They let you throttle and meter API consumption per client, enforcing rate limits, burst limits, and quotas for individual API keys tied to specific customers or applications.

It traces requests as they travel through multiple services, producing a service map and timing data that helps developers identify latency bottlenecks and pinpoint errors across microservices.

Annotations are indexed key-value pairs that can be used to filter and search traces; metadata is not indexed and is used only to record additional contextual detail on a trace segment.

CloudWatch Logs stores raw log event data emitted by applications and services; CloudWatch Metrics stores numeric time-series data (like CPU utilization) that can trigger alarms and be graphed on dashboards.

It scans incoming log data for a specified pattern and converts matches into a custom CloudWatch metric, enabling alarms to be built on values that only appear inside log text.

Parameter Store holds configuration values and can optionally encrypt them with KMS, at little or no cost; Secrets Manager is purpose-built for secrets like database credentials, offering automatic rotation and tighter secret-lifecycle features at a higher cost.

Idempotency means repeating the same request produces the same result without unintended side effects. A DynamoDB conditional write (e.g., attribute_not_exists) can reject duplicate writes for the same idempotency key, preventing duplicate processing of a retried request.

Synchronous invocation waits for the function to complete and returns the response directly to the caller (e.g., API Gateway); asynchronous invocation queues the event and returns immediately, with Lambda handling retries and optional destinations for success/failure.

A destination is a target (SQS, SNS, Lambda, or EventBridge) that receives a record about an asynchronous invocation's outcome, and can be configured separately for success and failure; a DLQ only captures failed events and provides less detail than a destination.

A cold start occurs when Lambda must initialize a new execution environment (download code, start the runtime, run init code) before handling a request, adding latency. Provisioned concurrency pre-initializes a specified number of environments so they are ready to respond immediately.

Subscribers attach a filter policy to their subscription; SNS evaluates the policy against message attributes and only delivers messages that match, allowing a single topic to fan out selectively to different subscribers.

A change set previews the proposed additions, modifications, and deletions a template update would make without executing them; a stack update applies those changes directly, which can be riskier since there's no preview step.

The API must respond to preflight OPTIONS requests with appropriate Access-Control-Allow-* headers, and the actual method responses must also include the allowed origin header, or browsers will block the client-side request.

AWS SDKs automatically retry throttled or transient failures using exponential backoff with jitter, progressively increasing the wait time between retries to avoid overwhelming a service that is already struggling under load.