More Solutions Architectures

1. Lambda with SNS and SQS

Lambda, SNS and SQS combine into a handful of shapes that the exam returns to again and again. The thing to hold on to is that each combination has its own retry behavior and its own place for a DLQ (Dead Letter Queue), and that SQS FIFO adds one extra property the other two do not have.

• SQS + Lambda — Lambda polls the queue. Messages that keep failing after the retries are sent to a DLQ attached to the queue.
• SQS FIFO + Lambda — same polling model, but ordering is guaranteed, so a message that will not process blocks the messages behind it in its group. The DLQ sits on the queue as before, and here it is what unblocks the pipeline.
• SNS + Lambda — SNS invokes Lambda asynchronously. The retries happen on the SNS side, and the DLQ catches whatever still fails.

Exam tip

Poll versus asynchronous invoke is the discriminator. If the question says the consumer pulls work at its own pace, that is SQS. If it says the producer pushes and does not wait, that is SNS. And if a question mentions one bad message stalling everything behind it, the answer involves SQS FIFO plus a DLQ.

2. The Fan Out pattern

Suppose one event has to land in several SQS queues. The naive option is for the application to call PUT once per queue with the SDK: PUT #1, PUT #2, PUT #3. That is three calls that can partially fail, and every new consumer means another code change.

The Fan Out option is a single PUT into an SNS topic that every SQS queue subscribes to. One publish, many deliveries, and adding a fourth consumer is a subscription rather than a deployment.

Real-world example

An order service publishes one order-created message to an SNS topic. The billing queue, the fulfillment queue and the analytics queue all subscribe. When the fraud team later wants its own copy, they create a queue and subscribe it; the order service never changes.

3. S3 Event Notifications

Amazon S3 can emit events and deliver them to Lambda, SQS or SNS. The event types include S3:ObjectCreated, S3:ObjectRemoved, S3:ObjectRestore and S3:Replication, among others.

Details worth remembering:

• Object name filtering is possible, for example only *.jpg.
• A classic use case is generating thumbnails of images uploaded to S3.
• You can create as many S3 events as you want.
• Delivery is typically within seconds, but can sometimes take a minute or longer — so the design must not assume instant notification.

S3 Event Notifications with Amazon EventBridge

S3 can instead send all events to Amazon EventBridge, which then applies rules and routes them to over 18 AWS services as destinations. You reach for EventBridge when you need:

• Advanced filtering with JSON rules — on metadata, object size, name and so on.
• Multiple destinations, for example Step Functions or Kinesis Data Streams / Firehose.
• EventBridge capabilities: Archive, Replay Events and reliable delivery.

Exam tip

Plain S3 Event Notifications reach three targets (Lambda, SQS, SNS) with name-based filtering. The moment a question asks for filtering on object size or metadata, for a destination that is not one of those three, or for replaying past events, the answer is EventBridge.

4. EventBridge intercepting API calls

CloudTrail records any API call. Wire CloudTrail into Amazon EventBridge and you can turn a specific call into an action. The canonical example on the slide: a user issues a DeleteTable API call against DynamoDB, CloudTrail logs it, EventBridge matches it and publishes to SNS, and an alert goes out.

Real-world example

You cannot always prevent a privileged operator from deleting a production table, but you can make sure the whole team knows within seconds. CloudTrail plus EventBridge plus SNS is the cheapest possible audit alarm.

More on CloudTrail itself is in Monitoring & Audit.

5. API Gateway integrating directly with AWS services

API Gateway does not have to sit in front of Lambda. It can integrate directly with AWS services, which removes a whole tier of code you would otherwise write and operate.

The example in the deck is a streaming ingest path: client requests arrive at API Gateway, which sends records into Kinesis Data Streams, which feeds Kinesis Data Firehose, which stores .json files in Amazon S3.

Exam tip

When an answer option offers “API Gateway with a direct service integration” against another option that adds a Lambda function whose only job is to forward the payload, the direct integration is usually the intended answer: less code, less latency, less cost.

6. Caching strategies across the layers

Caching is not one decision, it is a decision at every hop between the client and the database. The deck lays the layers out in order:

Layer	Cache used
Client to edge	CloudFront (edge)
API tier	API Gateway caching
Application logic (EC2 / Lambda) to database	Redis, Memcached, DAX
Static content in S3	CloudFront

Each layer is a trade-off across the same six dimensions the slide names: caching, TTL, network, computation, cost and latency. Caching closer to the client cuts latency and network cost the most, but it is also the hardest to invalidate; caching next to the database is the easiest to keep correct but saves the least network.

7. Blocking an IP address — where does the rule belong?

This is a favorite exam scenario because the correct layer changes with the architecture. The constant is that Security Groups only support allow rules, so a Security Group can never be the thing that blocks an IP.

EC2 with a public IP, no load balancer

The client reaches the instance in the public subnet directly. Blocking happens at the NACL, which supports deny rules as well as allow rules. The Security Group stays allow-only, and optionally the instance itself runs firewall software.

Behind an Application Load Balancer

The ALB sits in the public subnet and the slide labels it with connection termination; the EC2 instance moves to a private subnet with only a private IP. Blocking is done at the NACL on the public subnet the ALB lives in, with the ALB Security Group and the EC2 Security Group still allow-only.

Behind a Network Load Balancer

Swap the ALB for an NLB and the layers the slide draws are the same three: an NLB Security Group in the public subnet, an EC2 Security Group on the private-IP instance, and the NACL. The NACL is still where a block belongs, because both Security Groups remain allow-only.

ALB plus AWS WAF

Attach AWS WAF to the Application Load Balancer and do IP address filtering there. The NACL is still present in the diagram, but the filtering decision has moved up to WAF.

ALB plus CloudFront plus WAF

Put CloudFront in front and the picture changes again. Traffic now arrives at the ALB from CloudFront public IPs, which means the NACL is no longer helpful — it would be blocking CloudFront, not the attacker. The filtering moves to AWS WAF at CloudFront for IP address filtering, with CloudFront Geo Restriction available on top.

Exam tip

Read the topology before picking the layer. No load balancer means NACL. ALB or NLB means NACL or, better, WAF on the ALB. CloudFront in front means WAF at CloudFront, and any answer that says “add a deny rule to the NACL” is wrong because the source addresses are CloudFront’s.

8. High Performance Computing (HPC)

The deck’s claim is that the cloud is the ideal place to do HPC, and it gives three reasons: resources can be stood up in enormous numbers almost instantly, results arrive sooner simply by throwing more of them at the problem, and the bill covers only the systems that actually ran. The workloads it names are genomics, computational chemistry, financial risk modeling, weather prediction, machine learning, deep learning and autonomous driving.

The services that make it work fall into four groups.

Data management and transfer

• AWS Direct Connect — move GB/s of data to the cloud over a private, secure network.
• Snowball & Snowmobile — move PB of data to the cloud.
• AWS DataSync — move large amounts of data between on-premises and S3, EFS or FSx for Windows.

Compute and networking

• EC2 instances — CPU optimized and GPU optimized families, with Spot Instances / Spot Fleets plus Auto Scaling for cost savings.
• EC2 Placement Groups — the Cluster strategy packs instances into the same rack in the same AZ for a low latency, 10 Gbps network.
• EC2 Enhanced Networking (SR-IOV) — higher bandwidth, higher PPS (packets per second) and lower latency. Two options: Elastic Network Adapter (ENA) up to 100 Gbps, or the legacy Intel 82599 VF up to 10 Gbps.
• Elastic Fabric Adapter (EFA) — the HPC-tuned version of the ENA, and it runs on Linux and nothing else. Its target is chatter between nodes in tightly coupled workloads; it speaks the Message Passing Interface (MPI) standard, and it gets its low latency and reliable transport by going around the underlying Linux OS rather than through it.

Storage

Category	Option	What the deck says
Instance-attached	EBS	Scales up to 256,000 IOPS with io2 Block Express
Instance-attached	Instance Store	Scales to millions of IOPS, tied to the EC2 instance, low latency
Network	Amazon S3	Large blobs, not a file system
Network	Amazon EFS	IOPS scale with total size, or use provisioned IOPS
Network	Amazon FSx for Lustre	HPC-optimized distributed file system, millions of IOPS, backed by S3

Automation and orchestration

• AWS Batch — supports multi-node parallel jobs, so a single job can span multiple EC2 instances; it schedules jobs and launches the instances accordingly.
• AWS ParallelCluster — open-source cluster management whose purpose is standing HPC up on AWS. You describe the cluster in text files and it builds the pieces for you: the VPC, the subnets, the cluster type and the instance types. It can also switch EFA on across the cluster, which is where the network performance gain comes from.

Exam tip

EFA versus ENA is the HPC networking question. ENA is the general high-throughput adapter, up to 100 Gbps, on any OS. EFA is the one that shows up whenever the question mentions MPI or tightly coupled nodes, and it is Linux only.

9. Building a highly available single EC2 instance

Some workloads genuinely run on one instance — a scheduler, a license server, a legacy daemon pinned to an Elastic IP. The deck builds the same solution three times, each version better than the last.

Version 1 — CloudWatch Event or Alarm

A public EC2 instance holds an Elastic IP address. A CloudWatch Event, or an alarm based on a metric, monitors it. When it fails, the automation starts the standby EC2 instance and attaches the Elastic IP to it.

Version 2 — with an Auto Scaling Group

Replace the standby with an Auto Scaling group whose settings are 1 min, 1 max, 1 desired, spread across at least 2 AZs. When the instance dies, the ASG launches a replacement EC2 instance in either Availability Zone. The replacement runs EC2 User Data that attaches the Elastic IP, selecting it based on a tag, and the instance carries an EC2 instance role allowing the API calls needed to attach the Elastic IP.

Version 3 — ASG plus EBS to keep the data

Version 2 restores the address but not the disk. Add EBS and two ASG lifecycle hooks:

• On the ASG Terminate lifecycle hook — take an EBS Snapshot, tagged.
• On the ASG Launch lifecycle hook — create an EBS volume from the snapshot and attach it to the new instance.

The replacement instance now comes up with the same Elastic IP and the same data.

Real-world example

A single-node job scheduler must keep both its address and its state directory. The ASG of size one gives you automatic replacement across two AZs, user data reattaches the Elastic IP, and the lifecycle hooks carry the state volume forward through the snapshot.

Quick recap

Topic	What to remember for the exam
SQS + Lambda	Lambda polls; failures land in the queue’s DLQ
SNS + Lambda	Asynchronous invoke, retries on the SNS side, DLQ for the rest
SQS FIFO + Lambda	Ordering means a bad message blocks the ones behind it; the DLQ unblocks it
Fan Out	One PUT to an SNS topic, many SQS queues subscribed, instead of N PUTs from the app
S3 Event Notifications	To Lambda / SQS / SNS, filter by object name, usually seconds but can exceed a minute
S3 + EventBridge	Needed for JSON-rule filtering (metadata, size), 18+ destinations, Archive and Replay
CloudTrail + EventBridge + SNS	The pattern for alerting on any API call, e.g. DeleteTable
API Gateway service integration	Direct to Kinesis Data Streams, on to Firehose, on to S3 — no Lambda needed
Caching layers	CloudFront (edge), API Gateway, Redis / Memcached / DAX, CloudFront over S3
Blocking an IP	Security Groups cannot deny. Bare EC2 or ELB means NACL; with an ALB prefer WAF; with CloudFront use WAF at CloudFront and Geo Restriction, and the NACL is no longer helpful
HPC networking	Placement Group Cluster, Enhanced Networking (ENA to 100 Gbps, Intel 82599 VF to 10 Gbps legacy), EFA (Linux, MPI, bypasses the OS)
HPC storage	EBS io2 Block Express 256,000 IOPS, Instance Store millions of IOPS, FSx for Lustre backed by S3
HPC orchestration	AWS Batch for multi-node parallel jobs, AWS ParallelCluster for the whole cluster from text files
HPC data transfer	Direct Connect for GB/s, Snowball / Snowmobile for PB, DataSync to S3 / EFS / FSx for Windows
Highly available single EC2	ASG 1/1/1 across ≥ 2 AZs, user data attaches the Elastic IP by tag, instance role for the API call, lifecycle hooks to snapshot and restore the EBS volume