Control who can access what AWS resources

Generate temporary security credentials

Managed Microsoft Active Directory, AD Connector, or Simple AD for AWS workloads

Centralized SSO untuk multiple AWS accounts

Security assessments on your own AWS infrastructure

User sign-up/sign-in, federated identity (Google/Facebook), mobile app auth

Share subnets, Transit Gateway, Route 53 resolver rules cross-account

Manage multiple AWS accounts centrally with guardrails

Instance-level firewall — control inbound/outbound per EC2/ENI

Subnet-level firewall, stateless, boleh block IP

Protect against SQL injection, XSS, rate limiting

DDoS protection Layer 3/4 (Standard) and Layer 7 (Advanced)

VPC-level stateful deep packet inspection, domain filtering

Automated threat detection: crypto-mining, unusual API calls, compromised instances

Investigate and analyze security findings from GuardDuty, Security Hub, Macie

Find OS vulnerabilities, CVEs in EC2 instances and ECR images

Discover and protect sensitive data in S3: PII, credentials, financial data, compliance

Understand AWS policy on security testing and acceptable use

Encrypt data at rest, manage encryption keys

Store dan auto-rotate credentials, API keys, DB passwords

WORM compliance, prevent deletion/modification

WORM compliance for Glacier archives — enforce retention policies that cannot be changed

Encrypt data warehouse at rest (KMS) and in transit (SSL); share data cross-account via DataShare

Audit who did what and when — compliance, forensics, account activity

Provision free SSL/TLS certificates for ALB, CloudFront, API Gateway

FIPS 140-2 Level 3 compliance, customer-exclusive HSM hardware

Private dedicated connection from on-premises to AWS

Encrypted IPSec tunnel from on-premises to VPC over internet

Allow individual users to authenticate and connect to a VPC from their devices

Isolated private network — the foundation for all AWS resources

Plan IP address ranges — VPC perlu CIDR sebelum boleh buat subnets

Connect VPC to internet (bidirectional) — kena ada untuk public subnet

Private subnet instances download patches/call APIs without being exposed to internet

Control traffic direction: public subnet → IGW, private subnet → NAT GW

Two-layer defence: SG guards each EC2, NACL guards each subnet

Connect 2 VPCs privately — same account, cross-account, atau cross-region

Connect 3+ VPCs dan on-premises networks melalui satu hub yang transitive

Access S3/DynamoDB (free) atau AWS services lain (paid) dari private subnet secara private

Automatically scale EC2 instances based on load

High availability for RDS — automatic failover

Scale read traffic, reporting queries, multi-region read access

Connection pooling for RDS — handle too many connections from Lambda/Auto Scaling

Route global users to nearest healthy endpoint via AWS backbone

High-performance relational DB, MySQL/PostgreSQL compatible, enterprise HA

Unpredictable/intermittent workloads — auto-scale DB capacity, pay per second

Serverless key-value/document store, single-digit ms latency at any scale

Non-critical systems, lowest cost DR strategy

Core DB running in DR region, app servers off until needed

Scaled-down full stack running in DR, quick scale up

Mission-critical — full capacity in both regions simultaneously

Centralized backup across EC2, RDS, EFS, DynamoDB, S3

Protect against accidental deletion, cross-region DR for S3

Point-in-time backup of EBS volumes, cross-region DR

Managed file systems: Windows SMB, HPC Lustre, NetApp ONTAP, OpenZFS

Hybrid cloud storage — on-premises apps guna AWS storage secara seamless

One-time or recurring data migration from on-premises to S3, EFS, or FSx; also EFS cross-region replication

Migrate databases to AWS — homogeneous (MySQL→RDS MySQL) or heterogeneous (Oracle→Aurora)

Petabyte-scale data transfer bila internet terlalu lambat/mahal, atau edge computing

Legacy FTP/SFTP/FTPS/AS2 file transfers stored directly into S3 or EFS — no code changes needed

Migrate servers (physical/virtual/cloud) to AWS EC2 with minimal downtime

Run AWS services on-premises for compliance, low latency, or data residency requirements

Run any workload, full control

Serverless, event-driven

Deploy app tanpa urus server

Run containers

Container orchestration guna K8s

Run container workloads on-premises with varying levels of AWS integration

Auto-configure EC2 instance on first boot

Preserve in-memory state across stop/start — fast resume for memory-intensive apps

Get info about the running instance from within the instance

Recover accidentally deleted AMIs and EBS snapshots within a defined retention period

Run batch computing jobs at scale without managing EC2 infrastructure

Run containers without managing any EC2 server infrastructure

Store, version, and deploy Docker container images privately in AWS

Block storage, attach ke 1 EC2

Choose right EBS type for workload: random I/O vs sequential, IOPS vs throughput, cost vs performance

Shared file storage for multiple EC2 instances simultaneously

Object storage, images, backups

Archiving, jarang access

Deliver content laju via edge locations

HTTP/HTTPS path-based routing, microservices, containers

TCP/UDP, low latency, static IP, cross-VPC with IP targets

DNS management, domain routing

Control how DNS traffic is routed to resources

Decouple services, async queue

Push notification ke many subscribers

Real-time data streaming & analytics

Manage & expose REST/WebSocket APIs

Serverless event bus: decouple services, schedule tasks, react to AWS service changes

Coordinate multi-step processes with error handling, retry, and branching

Migrate existing ActiveMQ/RabbitMQ message brokers to AWS without code changes

Capture and load streaming data to S3, Redshift, OpenSearch, Splunk automatically

Automated no-code data transfer between SaaS apps (Salesforce, ServiceNow, Slack) and AWS services

Automate infrastructure deployment, consistent environment

Manage, patch, and run commands on EC2 instances at scale

Track configuration changes and compliance of AWS resources

Private Git repository dalam AWS ecosystem

Automate build, test, and deploy pipeline end-to-end

Monitor metrics, collect logs, set alarms, create dashboards for AWS resources

Distributed tracing — debug latency and errors across microservices and serverless

JSON document store, MongoDB-compatible workloads migrate to AWS

Social networks, fraud detection, knowledge graphs, recommendation engines

Migrate Apache Cassandra workloads, IoT telemetry, time-series data

Business intelligence dashboards, data visualization, ML-powered analytics

Ad-hoc SQL analysis of data in S3 without loading to a database

ETL jobs, data catalog for data lake, prepare and transform data for analytics

Fine-grained access control on data lake: row-level, column-level, cell-level security

Process petabyte-scale data with Spark, Hadoop, Hive, Presto — full control

Full-text search, real-time log/event analytics, dashboard visualisation

Real-time event streaming dengan Kafka API — migrate or build Kafka workloads

Intelligent enterprise search across diverse document repositories

Subscribe to and access third-party datasets for analytics

AI/ML services untuk audio, video, text, image analysis without training models

Build, train, and deploy custom ML models with full control

Workload tak menentu, short-term, testing

Workload steady, predictable usage, 1-3 tahun

Batch jobs, fault-tolerant workloads, flexible timing

Commit spend per hour, flexible instance type

Rightsizing recommendations for EC2, Lambda, EBS, ECS on Fargate, Auto Scaling Groups

Identify idle resources, cost optimization recommendations

Set cost/usage thresholds and get alerted before overspending

Visualise and analyse AWS costs — understand patterns, get RI/SP recommendations

Kurangkan kos storage ikut frequency of access

Data dengan access pattern tak menentu

Reduce data transfer cost, cache content dekat user

EC2 → S3/DynamoDB tanpa kena NAT Gateway fees

Cache frequent queries, reduce RDS cost

Unpredictable traffic, serverless apps

Run and monitor systems to deliver business value and continually improve processes

Protect information, systems, and assets via risk assessments and mitigation strategies

Ensure workload performs correctly and consistently, including recovery from failures

Use computing resources efficiently to meet requirements and maintain efficiency as demand changes

Run systems to deliver business value at the lowest price point

Minimize environmental impacts of running cloud workloads

Continuously replicate a SQLite database to S3 (or GCS / Azure Blob) for near-zero-cost backup and restore