Certificate

# AWS certificate - outline

## Part 1 - exam (90 min)

Topics:
- IAM: principals, policies, roles, conditions, ABAC
- VPC: subnets, security groups, NAT, endpoints
- S3: encryption, lifecycle, ownership, signed URLs
- Compute: EC2 + SSM, Lambda, Fargate
- Databases: RDS, DynamoDB single-table, secrets handling
- Observability: CloudWatch, X-Ray, OpenTelemetry
- Cost + security: SCPs, Budgets, GuardDuty, Config

Passing mark: 70 percent.

## Part 2 - capstone (take-home, ~12 hours)

Ship a small multi-account workload:

- AWS Organizations with at least: management + workloads + log archive
- SCP that denies cross-region usage outside your home region
- One workload account hosting:
  - A Lambda or Fargate service behind API Gateway
  - DynamoDB or RDS Postgres
  - CI via GitHub Actions + OIDC (no long-lived keys)
- CloudTrail org trail delivering to the log archive account
- GuardDuty + AWS Config enabled across all accounts

Submit IaC (CDK or Terraform) + an architecture diagram + a one-page Well-Architected review.

## Grading

- Multi-account org + SCPs (25 percent)
- Workload correctness (30 percent)
- Security + logging (25 percent)
- IaC quality + docs (20 percent)

## Tips

- OIDC federation from CI is non-negotiable
- Tag everything (Environment, Owner, CostCentre, Project)
- The Well-Architected review is how you show you understand the tradeoffs

# /certificate/aws