AWS Cert Notes

My AWS cert notes.

This project is maintained by jangroth

↖↑↓ Solutions Architect Associate

9/2018 - 2/2019

↖↑↓ 10000 Feet Overview

Area Covered Other
Compute EKS
. Lightsail
. Batch
. . ECR
. . Elastic Beanstalk
Storage FSx
. AWS Backup
. .
. .
Database Neptune
. Amazon DocumentDB
. .
. .
Migration AWS Migration Hub
. . Application Discovery Service
. . Database Migration Service
. . Server /Migration Service
. . AWS Transfer for SFTP
. . DataSync
Networking & Content Delivery Global Accelerator
. AWS Cloud Map
. .
. .
. .
Tools . CodeStar
. . CodeCommit
. . CodeBuild
. . CodeDeploy
. . CodePipeline
. . Cloud9
. . X-Ray
Robotics . AWS RoboMaker
Blockchain . Amazon Managed Blockchain
Satellite . Ground Station
Management Tools AWS Auto Scaling
. CloudFormation Service Catalog
. CloudTrail Systems Manager
. Config Managed Services
. Control Tower
. Trusted Advisor AWS License Manager
. . AWS Well-Architected Tool
. . Personal Health Dashboard
Media Services Kinesis Video Streams
. . MediaConvert
. . MediaLive
. . MediaPackage
. . MediaStore
. . MediaTailor
Machine Learning . Amazon SageMaker
. . Amazon Comprehend
. . AWS DeepLens
. . Amazon Lex
. . Machine Learning
. . Amazon Polly
. . Rekognition
. . Amazon Transcribe
. . Amazon Translate
. . Amazon Personalize
. . Amazon Forecast
. . Amazon Textract
Analytics MKS
. CloudSearch
. Data Pipeline Elasticsearch Service
. QuickSight
. . AWS Glue
Security, Identity & Compliance Cognito
. Inspector Secrets Manager
. Certificate Manager GuardDuty
. Directory Service Amazon Macie
. Security Hub
. AWS Single Sign-On
. . CloudHSM
. . WAF & Shield
. . Artifact
. . Resource Access Manager
. . AWS Organizations
AWS Cost Management . AWS Cost Explorer
. . AWS Budgets
. . AWS Marketplace Subscriptions
Mobile . Mobile Hub
. . AWS AppSync
. . Device Farm
. . AWS Amplify
AR & VR . Amazon Sumerian
Application Integration Step Functions
. Amazon MQ
. .
Customer Engagement Simple Email Service Amazon Connect
. . Pinpoint
Business Applications . Alexa for Business
. . Amazon Chime
. . WorkMail
End User Computing . WorkSpaces
. . AppStream 2.0
. . WorkDocs
. . WorkLink
Internet of Things . IoT Core
. . IoT 1-Click
. . IoT Device Management
. . IoT Analytics
. . Greengrass
. . Amazon FreeRTOS
. . IoT Device Defender
. . IoT Events
. . IoT SiteWise
. . IoT Things Graph
Game Development . Amazon GameLift

↖↑↓ IAM

↖↑↓ Overview

IAM is a global service that helps to securely control access to AWS resources.

↖↑↓ Policies

	{
		"Version": "2012-10-17",
		"Statement": [
			{
				"Effect": "Allow",
				"Action": "s3:ListAllMyBuckets",
				"Resource": "arn:aws:s3:::*"
			},
			{
				"Effect": "Allow",
				"Action": [
						"s3:ListBucket",
						"s3:GetBucketLocation"
				],
				"Resource": "arn:aws:s3:::productionapp"
			},
			{
				"Effect": "Allow",
				"Action": [
					"s3:GetObject",
					"s3:PutObject",
					"s3:DeleteObject"
				],
				"Resource": "arn:aws:s3:::productionapp/*"
			}
		]
	}

IAM Policies

↖↑↓ Limits

. .
Groups per account 100
Instance profiles 100
Roles 500
Server certificates 20
Users 5000

↖↑↓ STS

↖↑↓ Overview

The AWS Security Token Service (STS) is a global web service that enables you to request temporary, limited-privilege credentials for AWS Identity and Access Management (IAM) users or for users that you authenticate (federated users).

↖↑↓ Scenarios

↖↑↓ KMS

↖↑↓ Overview

AWS Key Management Service (KMS) makes it easy for you to create and manage keys and control the use of encryption across a wide range of AWS services and in your applications. AWS KMS is a secure and resilient service that uses FIPS 140-2 validated hardware security modules to protect your keys. AWS KMS is integrated with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs.

↖↑↓ Benfits

↖↑↓ S3

↖↑↓ Overview

Amazon Simple Storage Service (S3) is object storage with a simple web service interface to store and retrieve any amount of data from anywhere on the web. It is designed to deliver 11x9 durability and scale past trillions of objects worldwide.

↖↑↓ Getting Data In And Out

Perfomance & Consistency

Versioning

Logging

Transfer Acceleration

Amazon S3 Transfer Acceleration enables fast, easy, and secure transfers of files over long distances between your client and an S3 bucket. Transfer Acceleration takes advantage of Amazon CloudFront’s globally distributed edge locations. As the data arrives at an edge location, data is routed to Amazon S3 over an optimized network path.

Cross-Region Replication

Hosting Static Websites

<bucket-name>.s3-website-<AWS-Region>.amazonaws.com

Storage classes

. Durability Availability AZs Costs per GB Retrieval Fee .
S3 Standard 11x9 4x9 >=3 $0.023 No .
S3 Intelligent Tiering 11x9 3x9 >=3 $0.023 No Automatically moves objects between two access tiers based on changing access patterns
S3 IA (infrequent access) 11x9 3x9 >=3 $0.0125 Yes For data that is accessed less frequently, but requires rapid access when needed
S3 One Zone IA (infrequent access) 11x9 99.5 1 $0.01 Yes For data that is accessed less frequently, but requires rapid access when needed
Glacier 11x9 . >=3 . Yes For archival only, comes as expedited, standard or bulk
Glacier Deep Archive 11x9 . >=3 . Yes Longer time span to retrieve
S3 RRS (reduced redundancy storage) 4x9 4x9 >=3 $0.024 . Deprecated

↖↑↓ Access Control

Defaults

IAM

Bucket policies

ACLs

How to specify resources in a policy:

. .
arn:partition:service:region:namespace:relative-id arn:aws:s3:::mybucket
arn:aws:s3:::* All buckets and objects in account
arn:aws:s3:::mybucket mybucket
arn:aws:s3:::mybucket/* All objects in mybucket
arn:aws:s3:::mybucket/mykey mykey in mybucket
arn:aws:s3:::mybucket/developers/($aws:username)/ folder matching the accessing user's name

Pre-signed URLs

All objects are private by default. Only the object owner has permission to access these objects. However, the object owner can optionally share objects with others by creating a pre-signed URL, using their own security credentials, to grant time-limited permission to download the objects.

↖↑↓ Encryption

Protecting data in transit

Protecting data at rest

↖↑↓ Etc

Pricing

Charged by

Limits

. .
Buckets per account 100
Bucket policy max size 20KB
Object size 0B to 5TB
Object size in a single PUT 5GB

↖↑↓ Glacier

↖↑↓ Overview

Amazon S3 Glacier is a secure, durable, and extremely low-cost cloud storage service for data archiving and long-term backup. It is designed to deliver 99.999999999% durability, and provides comprehensive security and compliance capabilities that can help meet even the most stringent regulatory requirements. Amazon S3 Glacier provides query-in-place functionality, allowing you to run powerful analytics directly on your archive data at rest. Customers can store data for as little as $0.004 per gigabyte per month, a significant savings compared to on-premises solutions. To keep costs low yet suitable for varying retrieval needs, Amazon S3 Glacier provides three options for access to archives, from a few minutes to several hours.

↖↑↓ CloudFront

↖↑↓ Overview

↖↑↓ Storage Gateway

↖↑↓ Overview

AWS Storage Gateway is a hybrid cloud storage service that connects your existing on-premises environments with the AWS Cloud. Its features make it easy for you to run hybrid cloud workloads at any stage of your cloud adoption, whether it's getting started with cloud backups, running cloud processing workflows for data generated by on-premises machines, or performing a one-time migration of block volume data or databases.

The gateway connects to AWS storage services, such as Amazon S3, Amazon Glacier, Amazon EBS, and AWS Backup, providing storage for files, volumes, snapshots, and virtual tapes in AWS.

↖↑↓ Gateway types

File gateway (NFS, SMB)

The File Gateway presents a file interface that enables you to store files as objects in Amazon S3 using the industry-standard NFS and SMB file protocols, and access those files via NFS and SMB from your datacenter or Amazon EC2, or access those files as objects with the S3 API.

Volume gateway (iSCSI)

The Volume Gateway presents your applications storage volumes using the iSCSI block protocol. Data written to these volumes can be asynchronously backed up as point-in-time snapshots of your volumes, and stored in the cloud as Amazon EBS snapshots. You can set the schedule for when snapshots occur or create them via the AWS Management Console or service API. Snapshots are incremental backups that capture only changed blocks. All snapshot storage is also compressed to minimize your storage charges.

Tape gateway (VTL)

The Tape Gateway presents itself to your existing backup application as an industry-standard iSCSI-based virtual tape library (VTL), consisting of a virtual media changer and virtual tape drives. You can continue to use your existing backup applications and workflows while writing to a nearly limitless collection of virtual tapes. Each virtual tape is stored in Amazon S3. When you no longer require immediate or frequent access to data contained on a virtual tape, you can have your backup application move it from the Storage Gateway Virtual Tape Library into an archive tier that sits on top of Amazon Glacier cloud storage, further reducing storage costs.

↖↑↓ Snowball

Snowball is a petabyte-scale data transport solution that uses devices designed to be secure to transfer large amounts of data into and out of the AWS Cloud. Using Snowball addresses common challenges with large-scale data transfers including high network costs, long transfer times, and security concerns. Customers today use Snowball to migrate analytics data, genomics data, video libraries, image repositories, backups, and to archive part of data center shutdowns, tape replacement or application migration projects. Transferring data with Snowball is simple, fast, more secure, and can be as little as one-fifth the cost of transferring data via high-speed Internet.

This replaces Import Export which was a manual service to ship drives to AWS.

↖↑↓ Elastic Compute Cloud (EC2)

↖↑↓ Overview

↖↑↓ Storage Options

S3 vs EFS vs EBS Comparison

Amazon S3 Amazon EBS Amazon EFS
Can be publicly accessible Accessible only via the given EC2 Machine Accessible via several EC2 machines and AWS services
Web interface File system interface Web and file system interface
Object Storage Block storage Object storage
Scalable Hardly scalable Scalable
Slowest Fastest Faster than S3, slower than EBS
Good for storing backups Is meant to be EC2 drive Good for shareable applications and workloads
Elastic, only pay for used storage Fixed, pay for provisioned storage Elastic, only pay for used storage

↖↑↓ Payment model

Pricing by

Instance Types

Family Mnemomic Description
F FPGA Can be reprogrammed on the fly and be tuned for specific applications, making them faster than traditional CPU/GPU combinations
I IOPS (NVMe) SSD-backed instance storage optimized for low latency
G Graphics GPU optimized
H High disk throughput HDD-based local storage
T Cheap general purpose Balance of computer, memory and networking
D Density Lowest price per disk throughput performance
R RAM Lowest prize for memory performance
M Main choice for general purpose apps Balance of computer, memory and networking
C Compute Lowest prize for compute performance
P Graphics (pics) GPU optimized
X eXtreme memory Lowest prize for memory performance

↖↑↓ Instance metadata & userdata

↖↑↓ AMIs

Choose by

↖↑↓ Autoscaling

Auto Scaling distributes load across multiple instances

↖↑↓ Placement Groups

↖↑↓ Load Balancers

. ALB NLB ELB
. Active Load Balancer Network Load Balancer Classic Load Balancer
Layer 7 (application layer) 4 (transport layer) EC2-classic network (deprecated)
Protocoll HTTP, HTTPS TCP TCP, SSL, HTTP, HTTPS

↖↑↓ Limits:

. .
Elastic IP addresses for EC2-Classic 5

↖↑↓ Elastic Block Storage (EBS)

↖↑↓ Volume options

. . .
General purpose SSD GP2 <= 10,000 IOPS
Provisioned IOPS I01 > 10,000 IOPS
Magnetic volumes, throughput optimized ST1, HS1 * Frequently accessed workload
* Cannot be boot volume
Magnetic volumes, cold SC1 * Less frequently accessed workload
* Cannot be boot volume
Magnetic volumes, standard . Can be boot volume

Snaphosts

Moving Instances/Volumes To A Different AZ/Region

Encrypting root volumes

↖↑↓ Elastic File System (EFS)

↖↑↓ Overview

↖↑↓ CloudWatch

Monitoring service that plugs into many other services

↖↑↓ Key metrics for EC2

Metric Effect
CPUUtilization The total CPU resources utilized within an instance at a given time.
DiskReadOps,DiskWriteOps The number of read (write) operations performed on all instance store volumes. This metric is applicable for instance store-backed AMI instances.
DiskReadBytes,DiskWriteBytes The number of bytes read (written) on all instance store volumes. This metric is applicable for instance store-backed AMI instances.
NetworkIn,NetworkOut The number of bytes received (sent) on all network interfaces by the instance
NetworkPacketsIn,NetworkPacketsOut The number of packets received (sent) on all network interfaces by the instance
StatusCheckFailed,StatusCheckFailed_Instance,StatusCheckFailed_System Reports whether the instance has passed both/instance/system status check in the last minute.

↖↑↓ Lambda

↖↑↓ Overview

AWS Lambda lets you run code without provisioning or managing servers. You pay only for the compute time you consume - there is no charge when your code is not running. With Lambda, you can run code for virtually any type of application or backend service - all with zero administration. Just upload your code and Lambda takes care of everything required to run and scale your code with high availability. You can set up your code to automatically trigger from other AWS services or call it directly from any web or mobile app.

↖↑↓ Route53

↖↑↓ DNS Overview

Domain Name System (DNS) is a system for naming computers and network services that is organized into a hierarchy of domains. DNS naming is used in TCP/IP networks, such as the Internet, to locate computers and services with user-friendly names. When a user enters a DNS name in an application, DNS services can resolve the name to other information that is associated with the name, such as an IP address.

Terminology

Basic Flow

Root Server -> TLD Server -> Domain-Level Name Server -> Zone File

Zone File & Records

Zone file stores records. Various records exists:

Type Definition Example
SOA State of Authority - Mandatory first entry, defines various things,
eg name servers & admin contact		 ns1.dnsimple.com admin.dnsimple.com 2013022001 86400 7200 604800 300
A Map host name to ip4 address px01.vc.example.com. 198.51.100.40
AAAA Map host name to ip6 address px01.vc.example.com. 2a00:1450:4014:80c:0:0:0:2004
CNAME Defines alias for host name
(maps one domain name to another)		 www.dnsimple.com. dnsimple.com.
MX Defines mail exchange example.com. 1800 MX mail1.example.com. 10
PTR Maps ip4 address to host name (inverse to A record) 10.27/1.168.192.in-addr.arpa. 1800 PTR mail.example.com.
SVR Points one domain to another domain name using a specific destination port _sip._tcp.example.com. 86400 IN SRV 0 5 5060 sipserver.example.com.

Route53 specifics

Route53 Routing Policies

↖↑↓ Relational Database Service (RDS)

↖↑↓ RDS Backup

↖↑↓ Multi-AZ deployments

Amazon RDS Multi-AZ deployments provide enhanced availability for database instances within a single AWS Region.

↖↑↓ Replicating RDS

↖↑↓ Etc

↖↑↓ Dynamo DB

↖↑↓ Overview

↖↑↓ Keys and indexes

Partion key (PK)

PK & Sort key

↖↑↓ Secondary indexes

Projected attributes

Local secondary index

Global secondary index

↖↑↓ Capacity provisioning

. .
. 300 strongly consistent reads of 11KB per minute
Calculate read / writes per second 300r/60s = 5r/s
Multiply with payload factor 5r/s * (11KB/4KB) = 15cu
If eventual consistent, devide by 2 15cu / 2 = 8cu

↖↑↓ Pricing

↖↑↓ Amazon Redshift

↖↑↓ Overview

Amazon Redshift is a fully managed, petabyte-scale data warehouse service in the cloud. You can start with just a few hundred gigabytes of data and scale to a petabyte or more.

Data is stored in colums, not in rows. This is better for data-analytics (OLAP) as a row-based approach (which would be better for transaction-processing (OLTP)):

Redshift is a good answer if your database is feeling stress because it's running OLAP transactions.

↖↑↓ Pricing

↖↑↓ ElastiCache

↖↑↓ Overview

Amazon ElastiCache offers fully managed Redis and Memcached. Seamlessly deploy, run, and scale popular open source compatible in-memory data stores.

ElastiCache is a good choice if database is read-heavy and not prone to frequent changing.

↖↑↓ Aurora

↖↑↓ Overview

Amazon Aurora is a MySQL and PostgreSQL-compatible relational database built for the cloud, that combines the performance and availability of traditional enterprise databases with the simplicity and cost-effectiveness of open source databases.

Amazon Aurora is up to five times faster than standard MySQL databases and three times faster than standard PostgreSQL databases. It provides the security, availability, and reliability of commercial databases at 1/10th the cost. Amazon Aurora is fully managed by Amazon Relational Database Service (RDS), which automates time-consuming administration tasks like hardware provisioning, database setup, patching, and backups.

Amazon Aurora features a distributed, fault-tolerant, self-healing storage system that auto-scales up to 64TB per database instance. It delivers high performance and availability with up to 15 low latency read replicas, point-in-time recovery, continuous backup to Amazon S3, and replication across three Availability Zones (AZs).

↖↑↓ Scaling

↖↑↓ Replicas

↖↑↓ Athena

↖↑↓ Overview

Amazon Athena is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL. Athena is serverless, so there is no infrastructure to manage, and you pay only for the queries that you run.

Athena is easy to use. Simply point to your data in Amazon S3, define the schema, and start querying using standard SQL. Most results are delivered within seconds. With Athena, there’s no need for complex ETL jobs to prepare your data for analysis. This makes it easy for anyone with SQL skills to quickly analyze large-scale datasets.

Supports different formats

↖↑↓ Virtual Private Cloud (VPC)

↖↑↓ Overview

Default VPC (Amazon specific)

Non-default VPC (regular VPC)

VPC Peering

VPC Scenarios

↖↑↓ Components

↖↑↓ Structure & Package Flow

Package flow through VPC components

VPC Flow Logs

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to Amazon CloudWatch Logs and Amazon S3. After you've created a flow log, you can retrieve and view its data in the chosen destination.

Can be created at 3 levels:

↖↑↓ VPC Endpoints

Allows instances with a VPC to connect to services without going via public internet.

Supported by: Amazon API Gateway, AWS CloudFormation, Amazon CloudWatch, Amazon CloudWatch Events, Amazon CloudWatch Logs, AWS CodeBuild, AWS Config, Amazon EC2 API, Elastic Load Balancing API, Amazon Elastic Container Registry, Amazon Elastic Container Service, AWS Key Management Service, Amazon Kinesis Data Streams, Amazon SageMaker and Amazon SageMaker Runtime, Amazon SageMaker Notebook Instance, AWS Secrets Manager, AWS Security Token Service, AWS Service Catalog, Amazon SNS, Amazon SQS, AWS Systems Manager, Endpoint services hosted by other AWS accounts, Supported AWS Marketplace partner services

↖↑↓ Limits:

. .
VPCs per region 5
Subnets per VPC 200
Customer gateways per region 50
Gateway per region 5 Internet
Elastic IPs per account per region 5
VPN connections per region 50
Route tables per region 200
Security groups per region 500

TODO: Build own VPC from memory

↖↑↓ Simple Queue Service (SQS)

↖↑↓ Overview

↖↑↓ Core features

↖↑↓ Limits:

. .
Max message size 256KB
Max inflight messages 120,000

↖↑↓ Simple Workflow Service (SWF)

↖↑↓ Overview

↖↑↓ Core components

↖↑↓ Limits:

. .
Maximum registered domains 100

↖↑↓ Simple Notification Service (SNS)

↖↑↓ Overview

↖↑↓ Components

↖↑↓ Limits

. .
Subscibers per topic 10 mio

↖↑↓ Elastic Transcoder

↖↑↓ Overview

Amazon Elastic Transcoder is media transcoding in the cloud. It is designed to be a highly scalable, easy to use and a cost effective way for developers and businesses to convert (or “transcode”) media files from their source format into versions that will playback on devices like smartphones, tablets and PCs.

↖↑↓ API Gateway

↖↑↓ Overview

Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale. With a few clicks in the AWS Management Console, you can create REST and WebSocket APIs that act as a “front door” for applications to access data, business logic, or functionality from your backend services, such as workloads running on Amazon Elastic Compute Cloud (Amazon EC2), code running on AWS Lambda, any web application, or real-time communication applications.

↖↑↓ Kinesis

↖↑↓ Overview

Amazon Kinesis makes it easy to collect, process, and analyze real-time, streaming data so you can get timely insights and react quickly to new information. Amazon Kinesis offers key capabilities to cost-effectively process streaming data at any scale, along with the flexibility to choose the tools that best suit the requirements of your application. With Amazon Kinesis, you can ingest rea -time data such as video, audio, application logs, website clickstreams, and IoT telemetry data for machine learning, analytics, and other applications. Amazon Kinesis enables you to process and analyze data as it arrives and respond instantly instead of having to wait until all your data is collected before the processing can begin.

Streaming Data is data that is generated continuuously by thousands of data sources, which typically send in the data records simulataneously, and in small sizes

↖↑↓ Elastic Map Reduce

↖↑↓ Overview

Amazon EMR provides a managed Hadoop framework that makes it easy, fast, and cost-effective to process vast amounts of data across dynamically scalable Amazon EC2 instances. You can also run other popular distributed frameworks such as Apache Spark, HBase, Presto, and Flink in EMR, and interact with data in other AWS data stores such as Amazon S3 and Amazon DynamoDB. EMR Notebooks, based on the popular Jupyter Notebook, provide a development and collaboration environment for ad hoc querying and exploratory analysis.

EMR securely and reliably handles a broad set of big data use cases, including log analysis, web indexing, data transformations (ETL), machine learning, financial analysis, scientific simulation, and bioinformatics.

↖↑↓ Direct Connect

↖↑↓ Overview

AWS Direct Connect is a cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS. Using AWS Direct Connect, you can establish private connectivity between AWS and your datacenter, office, or colocation environment, which in many cases can reduce your network costs, increase bandwidth throughput, and provide a more consistent network experience than Internet-based connections.

↖↑↓ ECS

↖↑↓ Overview

Amazon Elastic Container Service (Amazon ECS) is a highly scalable, fast, container management service that makes it easy to run, stop, and manage Docker containers on a cluster. You can host your cluster on a serverless infrastructure that is managed by Amazon ECS by launching your services or tasks using the Fargate launch type. For more control you can host your tasks on a cluster of Amazon Elastic Compute Cloud (Amazon EC2) instances that you manage by using the EC2 launch type.

↖↑↓ Components

↖↑↓ Workspaces

↖↑↓ Overview

Amazon WorkSpaces is a managed, secure cloud desktop service. You can use Amazon WorkSpaces to provision either Windows or Linux desktops in just a few minutes and quickly scale to provide thousands of desktops to workers across the globe. You can pay either monthly or hourly, just for the WorkSpaces you launch, which helps you save money when compared to traditional desktops and on premises VDI solutions. Amazon WorkSpaces helps you eliminate the complexity in managing hardware inventory, OS versions and patches, and Virtual Desktop Infrastructure (VDI), which helps simplify your desktop delivery strategy. With Amazon WorkSpaces, your users get a fast, responsive desktop of their choice that they can access anywhere, anytime, from any supported device.

↖↑↓ OpsWorks

↖↑↓ Overview

↖↑↓ AWS Organizations

↖↑↓ Overview

AWS Organizations offers policy-based management for multiple AWS accounts. With Organizations, you can create groups of accounts, automate account creation, apply and manage policies for those groups. Organizations enables you to centrally manage policies across multiple accounts, without requiring custom scripts and manual processes.

Using AWS Organizations, you can create Service Control Policies (SCPs) that centrally control AWS service use across multiple AWS accounts. You can also use Organizations to help automate the creation of new accounts through APIs. Organizations helps simplify the billing for multiple accounts by enabling you to setup a single payment method for all the accounts in your organization through consolidated billing. AWS Organizations is available to all AWS customers at no additional charge.

↖↑↓ Limits:

. .
Maximum linked accounts 20

TODO: Look at AWS Organization in root account

↖↑↓ Resource Groups

↖↑↓ Overview

↖↑↓ The Well Architected Framework

↖↑↓ Overview

↖↑↓ Security

↖↑↓ Reliability

↖↑↓ Performance Efficiency

↖↑↓ Cost efficiency

↖↑↓ Operational excellence