Learning path
AWS learning path: everything to study, topic by topic
Comprehensive AWS Cloud assessment covering cloud foundations, IAM, compute, networking, storage, databases, serverless architecture, security, monitoring, and cost optimization.
Short answer
To learn AWS, work through 7 modules and 42 topics in the order they build on each other. It starts with Cloud Foundations & IAM, then moves on to Compute & Networking and Storage & Databases. Use the map as a checklist, or measure your level and study only what is missing.
What you will study
Topics are grouped by module. Open one to see its objectives and key concepts.
1 · Cloud Foundations & IAM6 topics
Cloud Fundamentals
Core cloud computing concepts, shared responsibility model, and AWS global infrastructure
Objectives
- Explain cloud value proposition
- Describe the shared responsibility model
Key concepts
- cloud benefits
- shared responsibility
- regions
- AZs
- edge locations
- pay-as-you-go
IAM Users & Groups
Creating and managing IAM users, groups, and basic permission management
Objectives
- Configure IAM users and groups
- Enforce MFA and password policies
Key concepts
- IAM users
- groups
- console access
- programmatic access
- MFA
- password policies
IAM Roles & Policies
IAM roles, managed and inline policies, policy evaluation logic, and least-privilege access
Objectives
- Design least-privilege IAM policies
- Understand policy evaluation logic
Key concepts
- IAM roles
- managed policies
- inline policies
- policy evaluation
- least privilege
- trust policies
AWS Organizations
Multi-account strategies, SCPs, consolidated billing, and organizational units
Objectives
- Design multi-account strategies
- Apply SCPs for governance
Key concepts
- AWS Organizations
- SCPs
- OUs
- consolidated billing
- cross-account access
- control tower
CloudFormation
Infrastructure as code with CloudFormation templates, stacks, and change sets
Objectives
- Write CloudFormation templates
- Manage infrastructure as code
Key concepts
- template anatomy
- resources section
- parameters and mappings
- outputs and exports
- intrinsic functions
- stack updates and rollbacks
- nested stacks
- change sets
Shared Responsibility Model
AWS vs customer responsibility boundaries across infrastructure, container, and abstracted services
Objectives
- Distinguish AWS and customer responsibilities
- Explain how the model shifts across service types
Key concepts
- AWS vs customer responsibility
- shared controls
- infrastructure services
- container services
- abstracted services
2 · Compute & Networking9 topics
EC2 Instances
Instance types, AMIs, security groups, key pairs, placement groups, and instance metadata
Objectives
- Launch and configure EC2 instances
- Select appropriate instance types
Key concepts
- instance types
- AMI
- security groups
- key pairs
- EBS volumes
- instance metadata
VPC & Subnets
Virtual private clouds, subnets, route tables, NACLs, NAT gateways, and VPC peering
Objectives
- Design VPC architectures
- Configure public and private subnets
Key concepts
- VPC
- subnets
- route tables
- NACLs
- NAT gateway
- VPC peering
- VPC endpoints
Load Balancing & Auto Scaling
ELB types (ALB, NLB, CLB), target groups, auto scaling groups, and scaling policies
Objectives
- Configure load balancers for high availability
- Design auto scaling strategies
Key concepts
- ALB
- NLB
- target groups
- auto scaling groups
- scaling policies
- health checks
Route 53
DNS management, routing policies, health checks, and domain registration
Objectives
- Configure DNS routing policies
- Implement failover strategies with Route 53
Key concepts
- hosted zones
- routing policies
- health checks
- alias records
- failover routing
CloudFront
CDN distribution, origins, cache behaviors, signed URLs, and Lambda@Edge
Objectives
- Configure CloudFront distributions
- Secure content delivery with signed URLs
Key concepts
- distributions
- origins
- cache behaviors
- signed URLs
- Lambda@Edge
- OAI
ECS & Fargate
Container orchestration with ECS, Fargate serverless compute, task definitions, services, and clusters
Objectives
- Deploy containerized applications on ECS
- Choose between Fargate and EC2 launch types
Key concepts
- task definitions
- services
- clusters
- Fargate vs EC2 launch type
- task networking
- service discovery
ECR
Elastic Container Registry for Docker image management, lifecycle policies, scanning, and cross-account access
Objectives
- Manage container images with ECR
- Configure lifecycle policies and image scanning
Key concepts
- image repositories
- lifecycle policies
- image scanning
- cross-account access
- immutable tags
EKS Basics
Managed Kubernetes with EKS, node groups, Fargate profiles, IRSA, and cluster management
Objectives
- Deploy and manage EKS clusters
- Configure IRSA for pod-level AWS access
Key concepts
- managed control plane
- node groups
- Fargate profiles
- IRSA
- kubectl
- Helm
Auto Scaling Deep-Dive
Advanced auto scaling with launch templates, scaling policies, predictive scaling, and warm pools
Objectives
- Design advanced auto scaling strategies
- Configure predictive scaling and warm pools
Key concepts
- launch templates
- scaling policies
- target tracking
- step scaling
- scheduled scaling
- AMIs
- predictive scaling
- warm pools
3 · Storage & Databases5 topics
S3
Buckets, objects, storage classes, lifecycle policies, versioning, and access control
Objectives
- Design S3 storage strategies
- Configure lifecycle and access policies
Key concepts
- buckets
- storage classes
- lifecycle policies
- versioning
- pre-signed URLs
- bucket policies
EBS & EFS
Block and file storage, volume types, snapshots, encryption, and performance tuning
Objectives
- Select appropriate storage types for workloads
- Manage snapshots and encryption
Key concepts
- EBS volume types
- IOPS
- snapshots
- EFS
- mount targets
- encryption at rest
RDS & Aurora
Managed relational databases, Multi-AZ, read replicas, Aurora serverless, and backups
Objectives
- Design highly available RDS deployments
- Choose between RDS and Aurora
Key concepts
- Multi-AZ
- read replicas
- Aurora serverless
- automated backups
- parameter groups
- encryption
DynamoDB
NoSQL data modeling, partition keys, sort keys, GSIs, LSIs, and capacity modes
Objectives
- Design DynamoDB table schemas
- Choose appropriate capacity modes
Key concepts
- partition keys
- sort keys
- GSI
- LSI
- on-demand vs provisioned
- DynamoDB Streams
ElastiCache
Managed Redis and Memcached, caching strategies, replication, and cluster mode
Objectives
- Design caching layers with ElastiCache
- Choose between Redis and Memcached
Key concepts
- Redis vs Memcached
- caching strategies
- replication groups
- cluster mode
- eviction policies
4 · Serverless, Integration & CI/CD7 topics
Lambda
Serverless functions, triggers, layers, concurrency, cold starts, and best practices
Objectives
- Design serverless applications with Lambda
- Optimize cold start performance
Key concepts
- handler
- triggers
- layers
- concurrency
- cold starts
- environment variables
API Gateway
REST and HTTP APIs, stages, authorizers, throttling, and usage plans
Objectives
- Design APIs with API Gateway
- Configure authorization and throttling
Key concepts
- REST vs HTTP API
- stages
- authorizers
- throttling
- usage plans
- CORS
Step Functions
Workflow orchestration, state machines, error handling, and Express vs Standard workflows
Objectives
- Design workflow orchestrations
- Handle errors in distributed workflows
Key concepts
- state machines
- task states
- error handling
- retries
- Express vs Standard
- parallel execution
SQS, SNS & EventBridge
Message queues, pub/sub, event buses, dead-letter queues, and event-driven patterns
Objectives
- Design event-driven architectures
- Choose between SQS, SNS, and EventBridge
Key concepts
- SQS standard vs FIFO
- SNS topics
- EventBridge rules
- DLQ
- fan-out
- event patterns
Simple Email Service (SES)
Transactional and marketing email with SES, domain verification, authentication protocols, and bounce handling
Objectives
- Configure SES for transactional email
- Implement email authentication and bounce handling
Key concepts
- SES sandbox mode
- domain verification
- DKIM/SPF/DMARC
- sending quotas
- bounce handling
- complaint notifications
- email templates
- sender reputation
CI/CD Services
AWS developer tools for continuous integration and delivery: CodePipeline, CodeBuild, CodeDeploy, and CodeCommit
Objectives
- Design CI/CD pipelines with CodePipeline
- Configure CodeBuild and CodeDeploy for automated delivery
Key concepts
- CodePipeline stages
- CodeBuild buildspec
- CodeDeploy strategies
- artifact management
- pipeline triggers
- approval actions
- cross-account deployments
- CodeCommit basics
Kinesis & Streaming
Real-time data streaming with Kinesis Data Streams, Firehose, Analytics, and stream processing patterns
Objectives
- Design real-time streaming architectures with Kinesis
- Choose between Kinesis Data Streams and Firehose
Key concepts
- Kinesis Data Streams
- shards and partitions
- Kinesis Firehose
- consumer types (KCL)
- retention periods
- enhanced fan-out
- Kinesis Analytics
- stream processing patterns
5 · Security & Monitoring4 topics
KMS & Secrets Manager
Encryption key management, envelope encryption, secret rotation, and parameter store
Objectives
- Design encryption strategies with KMS
- Implement secret rotation
Key concepts
- CMKs
- envelope encryption
- key rotation
- Secrets Manager
- Parameter Store
- encryption context
CloudWatch
Metrics, alarms, logs, dashboards, custom metrics, and CloudWatch Insights
Objectives
- Build monitoring strategies with CloudWatch
- Create custom metrics and alarms
Key concepts
- metrics
- alarms
- log groups
- custom metrics
- Insights queries
- dashboards
WAF & Shield
Web application firewall rules, DDoS protection, rate-based rules, and managed rule groups
Objectives
- Configure WAF rules for web protection
- Design DDoS mitigation strategies
Key concepts
- WAF rules
- managed rule groups
- rate-based rules
- Shield Standard vs Advanced
- IP sets
GuardDuty & Inspector
Threat detection, vulnerability scanning, security findings, and automated remediation
Objectives
- Implement threat detection with GuardDuty
- Automate vulnerability scanning
Key concepts
- GuardDuty findings
- Inspector assessments
- Security Hub
- automated remediation
- threat intelligence
6 · Architecture, Data & Analytics5 topics
Well-Architected Framework
Six pillars of the Well-Architected Framework and architectural review process
Objectives
- Apply Well-Architected pillars to designs
- Conduct architectural reviews
Key concepts
- six pillars
- operational excellence
- security
- reliability
- performance
- cost optimization
- sustainability
Cost Optimization
Reserved instances, savings plans, spot instances, rightsizing, and cost allocation
Objectives
- Design cost-optimized architectures
- Implement cost governance strategies
Key concepts
- reserved instances
- savings plans
- spot instances
- rightsizing
- cost allocation tags
- Cost Explorer
Migration Patterns
The 7 Rs of migration, migration strategies, AWS Migration Hub, and database migration
Objectives
- Plan cloud migration strategies
- Select appropriate migration patterns
Key concepts
- 7 Rs
- rehost
- replatform
- refactor
- Migration Hub
- DMS
- SCT
Analytics Services
Data analytics with Athena, Glue, QuickSight, Redshift, and Lake Formation for serverless data lakes
Objectives
- Query data in S3 with Athena and Glue
- Design serverless data lake architectures
Key concepts
- Athena SQL queries
- Glue crawlers
- Glue ETL jobs
- data catalog
- QuickSight dashboards
- Redshift basics
- Lake Formation
- partition projection
SageMaker
Machine learning lifecycle with SageMaker notebooks, training jobs, model endpoints, pipelines, and monitoring
Objectives
- Build and deploy ML models with SageMaker
- Design ML pipelines with SageMaker Pipelines
Key concepts
- SageMaker notebooks
- training jobs
- built-in algorithms
- model endpoints
- SageMaker Pipelines
- feature store
- model monitoring
- hyperparameter tuning
7 · Expert & Emerging6 topics
AWS Control Tower & Landing Zones
Deploying and operating AWS Control Tower to standardize multi-account environments with guardrails and landing zones
Objectives
- Design and deploy a Control Tower landing zone for enterprise environments
- Configure preventive and detective guardrails with appropriate SCP policies
Key concepts
- Landing Zone
- Account Factory
- guardrails
- SCPs
- log archive account
- audit account
- VPC baseline
- account vending
Multi-Account Strategy & SCPs
Designing AWS multi-account strategies using AWS Organizations, OU hierarchies, and Service Control Policies
Objectives
- Design OU hierarchies that align to security and compliance boundaries
- Write SCPs that enforce least-privilege guardrails at the organization level
Key concepts
- AWS Organizations
- OUs
- SCPs
- account segmentation
- delegated administration
- billing consolidation
- security boundaries
Amazon Bedrock & AI Services
Building AI-powered applications with Amazon Bedrock: model selection, Knowledge Bases, Agents, and responsible AI guardrails
Objectives
- Select and integrate Bedrock foundation models for production AI workloads
- Design RAG architectures with Knowledge Bases and implement responsible AI guardrails
Key concepts
- Bedrock foundation models
- Knowledge Bases
- Bedrock Agents
- RAG patterns
- guardrails
- model invocation logging
- cross-region inference
AWS FinOps
Managing and optimizing AWS costs using Cost Explorer, Savings Plans, Compute Optimizer, and rightsizing strategies
Objectives
- Select and implement the correct commitment discount strategy for a given workload
- Build a FinOps practice with unit economics, anomaly detection, and chargeback reporting
Key concepts
- Savings Plans
- Reserved Instances
- Spot Instances
- Compute Optimizer
- Cost Anomaly Detection
- unit economics
- showback/chargeback
AWS Resilience Hub & Fault Injection
Using AWS Resilience Hub and AWS FIS to measure, test, and improve application resilience against failure scenarios
Objectives
- Use AWS Resilience Hub to assess and track application resiliency scores against RTO/RPO policies
- Design and run AWS FIS experiments to validate failure assumptions
Key concepts
- Resilience Hub
- RTO/RPO policies
- AWS FIS
- fault injection experiments
- resiliency scores
- multi-AZ design
- DR runbooks
AWS Security Hub & GuardDuty at Depth
Operating a comprehensive AWS security posture using Security Hub findings, GuardDuty detectors, and automated remediation
Objectives
- Aggregate and prioritize Security Hub findings across a multi-account organization
- Design automated remediation pipelines triggered by GuardDuty and Security Hub events
Key concepts
- Security Hub findings
- CSPM
- GuardDuty detectors
- threat intelligence
- automated remediation
- Security Hub integrations
- ASFF format
Levels: Junior, Mid, Senior, and Expert
Explain it in your own words
Graded by AI · no account · 1 questionNo options to guess from: you write, the AI grades against the topic's rubric and tells you what level your answer reads at.
Already studying AWS?
The assessment measures topic by topic, and your plan skips what you already know.
Open to read. An account is only needed to be measured.
Frequently asked questions
Where should I start studying AWS?
Start with Cloud Foundations & IAM: Cloud Fundamentals, IAM Users & Groups, and IAM Roles & Policies. The map orders topics by what they depend on, so each one prepares the next.
How long does a full AWS assessment take?
A full assessment of this path takes about 55 minutes. Study time depends on where you start; a diagnostic shows which topics you can skip.
Do I need an account to use this page?
No. The map, objectives and key concepts are open. You only need an account to be measured, get your gap by topic and receive a plan.