- Learn AWS
- Comparisons
AWS service comparisons
Most of what an exam tests is not whether you know a service but whether you can tell it from the one next to it. These are the comparisons the library answers, and where each one is answered — every link lands on the table itself rather than at the top of the page.
Side by side
REST or HTTP, and which endpoint
REST APIs and HTTP APIs feature by feature, then the three endpoint types of a REST API.
On the AWS API Gateway page · 10 rows
Storage classes, and the ways to replicate
Every S3 storage class side by side, then the four kinds of replication and when each fits.
On the AWS S3 page · 10 rows
Where each kind of secret belongs
Secrets Manager beside Parameter Store and KMS, Parameter Store's two tiers, and where AWS says each kind of credential should live.
On the AWS Secrets Manager page · 10 rows
Standard, Advanced, and the neighbours
The two tiers of Shield side by side, then Shield beside WAF and Firewall Manager.
On the AWS Shield page · 9 rows
Where events live, and which are recorded
Event history, trails and Lake side by side, the kinds of event, and CloudTrail beside CloudWatch.
On the AWS CloudTrail page · 8 rows
Behaviour against audit, and how long data lasts
CloudWatch beside CloudTrail, basic against detailed monitoring, and how long each resolution of metric is kept.
On the AWS CloudWatch page · 8 rows
Line or tunnel, interface, resiliency
Direct Connect beside Site-to-Site VPN, the three kinds of virtual interface, and the three resiliency models.
On the AWS Direct Connect page · 8 rows
Eight routing policies, and alias against CNAME
All eight routing policies side by side, and the five ways an alias record differs from a CNAME.
On the AWS Route 53 page · 8 policies
Which protection, which rule
WAF beside the two tiers of Shield, then the kinds of rule and what each one is for.
On the AWS WAF page · 8 rows
Edge options, edge code, private content
CloudFront beside Global Accelerator and an S3 website endpoint, Functions beside Lambda@Edge, and signed URLs beside signed cookies.
On the AWS CloudFront page · 7 rows
Which database, which index, which cache
DynamoDB beside RDS and ElastiCache, the two kinds of index, and DAX against ElastiCache.
On the AWS DynamoDB page · 7 rows
Where shared files belong
EFS beside EBS, S3 and instance store, then the three throughput modes and when each one fits.
On the AWS EFS page · 7 rows
Which engine, which strategy, which cache
The engines side by side, the two ways to fill a cache and what each costs, and ElastiCache against DAX.
On the AWS ElastiCache page · 7 rows
Three ways in, four ways to control concurrency
Synchronous, asynchronous and event source mappings side by side, and the four concurrency settings with what each costs.
On the AWS Lambda page · 7 rows
Standbys, replicas, and other databases
Four kinds of second copy side by side, then RDS beside DynamoDB and ElastiCache.
On the AWS RDS and Aurora page · 7 rows
Tunnel or line, and which gateway
Site-to-Site VPN beside Direct Connect, the two gateways on AWS's side, and which route wins a tie.
On the AWS Site-to-Site VPN page · 7 rows
Push or pull, standard or FIFO
SNS beside SQS, standard topics beside FIFO topics, and how long each kind of endpoint is retried.
On the AWS SNS page · 7 rows
Six ways to set the size
Target tracking, step, simple, scheduled, predictive and manual: what moves the size, and when to use each.
On the AWS Auto Scaling page · 6 methods
Six volume types, and three kinds of instance storage
Every current volume type with its limits and when to choose it, then EBS against instance store and EFS.
On the AWS EBS page · 6 volume types
Three kinds of key, and three services
Customer managed, AWS managed and AWS owned keys side by side, then KMS beside Secrets Manager and ACM.
On the AWS KMS page · 6 rows
NAT gateway against a NAT instance
NAT gateway against a NAT instance, row by row: availability, bandwidth, upkeep, and what only an instance can do.
On the AWS NAT Gateway page · 6 rows
Where rarely read data belongs
The three Glacier classes beside Standard-IA and Intelligent-Tiering, and the three retrieval tiers side by side.
On the AWS S3 Glacier page · 5 classes
The services a question will offer you instead
SQS, SNS, EventBridge, Kinesis Data Streams and Amazon MQ: who gets each message, how long it is kept, and the line in a question that picks each one.
On the AWS SQS page · 5 services
Four kinds of certificate
DNS-validated, email-validated, imported and private: who trusts each, and whether ACM renews it.
On the AWS ACM page · 4 kinds
Four load balancers
Application, Network, Gateway and Classic: the layer, the traffic, when to choose each, and their cross-zone defaults.
On the AWS ELB page · 4 types
Four ways out of a VPC
Internet gateway, egress-only internet gateway, NAT gateway and gateway endpoint: which side can start a connection, and what each costs.
On the AWS Internet Gateway page · 4 options
Six ways to pay for the same instance
Six ways to pay for the same instance
On the AWS EC2 page
The identities a question will offer you
The identities a question will offer you
On the AWS IAM page
Four kinds of subnet, told apart by their routes
Four kinds of subnet, told apart by their routes
On the AWS VPC page
Easily mistaken for each other
Pairs where picking the wrong one is a whole question. The line under each is what separates them; both names link to the page that explains that side.
ACMvsKMS
ACM issues and renews TLS certificates for HTTPS. KMS holds the keys that encrypt data at rest.
DAXvsElastiCache Redis
DAX only ever fronts DynamoDB. With no DynamoDB in the design it does nothing.
DynamoDBvsRDS
DynamoDB is built for lookups by key. The moment you need to join across tables, it is the wrong shape.
EBSvsEFS
One volume attached to one instance. EFS is the one many machines can mount at the same time.
EC2vsLambda
An instance is a machine you size, patch and keep alive. Any scenario that says "nothing to manage" has ruled it out.
EC2 Auto ScalingvsLambda
An Auto Scaling group reacts in minutes and is still servers you patch.
Internet GatewayvsNAT Gateway
An internet gateway carries traffic both ways for anything with a public address, and is what makes a subnet public. A NAT gateway lets private instances reach out without letting anyone reach in.
KMSvsSecrets Manager
KMS holds the keys that encrypt data. Secrets Manager holds the credentials your app logs in with, and rotates them.
Lambda@EdgevsLambda
Lambda@Edge runs at CloudFront locations on each request, before the origin is reached. An ordinary Lambda function runs in one Region.
Route 53vsCloudFront
Route 53 decides which endpoint a name resolves to. CloudFront caches the content once you get there — routing versus delivery.
S3vsEFS
S3 holds objects fetched by URL. EFS is a file system you mount — only useful if compute needs a shared disk.
S3 GlaciervsS3
Glacier classes are for data kept for years and rarely read: far cheaper per gigabyte, with retrieval in milliseconds to hours by tier. S3 Standard is for data in use.
Site-to-Site VPNvsDirect Connect
A Site-to-Site VPN runs encrypted IPsec tunnels over the internet link you already have, up to 1.25 Gbps a standard tunnel. Direct Connect is a private line through a Direct Connect location: steadier, but not encrypted by default.
SNSvsSQS
SNS fans one message out to many subscribers. SQS holds work for one consumer to take.
WAFvsShield
WAF inspects HTTP requests and blocks them by rule: injection, bots, too many requests from one address. Shield absorbs floods below HTTP.
Knowing the difference is not the same as choosing
A table tells you what separates two services. A brief makes you pick one, under constraints, with nothing naming either. That is what the scenarios are for.