AWS Solutions Architect Professional Course Notes

Multi-account architecture is about separating workloads, teams, and risk while still applying consistent governance. Architects must balance isolation, delegated administration, shared services, auditability, and billing visibility across an organization.

• **AWS Organizations vs. IAM:** IAM grants and controls access within account and resource boundaries; AWS Organizations manages account relationships, billing, and organization-level policies across accounts.

• Identify the governance scope first: single account, OU, entire organization, or selected services. The correct control usually follows that boundary.

Resilience design separates steady-state high availability from disaster recovery. Architects map failure domains to RTO and RPO targets, then choose replication, failover, queueing, backup, and immutability patterns that fit the workload.

• **Aurora Global Database vs. DynamoDB Global Tables:** Aurora uses one writer Region with secondary read Regions and planned or unplanned promotion paths; DynamoDB global tables support multi-Region active-active access with asynchronous replication.

• Tie every resilience answer to the stated RTO, RPO, failure domain, and tolerance for data loss or manual action.

Security architecture combines identity, network, data-protection, logging, and workload controls so one missed control does not expose the whole environment. The design must match the threat, trust boundary, and operational model.

• **Security Groups vs. Network ACLs:** Security groups are stateful resource-level controls with allow rules only. NACLs are stateless subnet-level controls with ordered allow and deny rules.

• Start with the threat model: web exploit, credential exposure, data access, network path, or cross-account trust. Then choose controls at the matching layer.

Network integration connects VPCs, accounts, Regions, and on-premises environments while preserving routing control, availability, security boundaries, and operational visibility.

• **Transit Gateway vs. VPC Peering:** Transit Gateway supports hub-and-spoke and transitive routing at scale. VPC peering is point-to-point, non-transitive, and can be simpler or cheaper for a small number of connections.

• Choose Transit Gateway when central routing, segmentation, or many connections are explicit requirements; do not choose it solely because more VPCs are mentioned.

Migration and modernization design begins with business drivers, dependencies, downtime tolerance, data gravity, security constraints, and target-state operations. The migration strategy should fit the workload, not the other way around.

• **DMS vs. DataSync:** DMS migrates and replicates database data. DataSync transfers file and object data between storage locations.

• Start with the migration strategy: rehost, replatform, refactor, relocate, repurchase, retain, or retire. The service choice should support that strategy.

Cost architecture optimizes spend while preserving required performance, reliability, security, and operations. The design starts with workload patterns and then applies purchasing, storage, scaling, scheduling, and visibility controls.

• **Savings Plans vs. Reserved Instances:** Savings Plans discount eligible compute usage based on hourly spend commitments. Reserved Instances are more service and configuration specific, with flexibility depending on RI type and scope.

• Classify the spend driver before choosing a tool: compute commitment, storage retention, idle resources, unknown access, or lack of visibility.