Browse Hands-on AWS Labs

Real AWS sandboxes for every major service. Zero setup, no AWS bill.

Free AWS certification roadmap · AWS sandbox pricing

All hands-on AWS labs

IAM Users, Groups and Permissions : Beginner, ~75 min, IAM, EC2, VPC
IAM Roles: Beginner, ~75 min, IAM, EC2
VPC with Public and Private Subnets (free): Beginner, ~75 min, VPC
Security Group vs NACL (free): Beginner, ~75 min, EC2, VPC
Getting Started with EC2: Beginner, ~75 min, EC2
Build a Scalable Web Application Using ALB and Auto Scaling Group: Intermediate, ~75 min, EC2, ALB
Getting Started with S3: Beginner, ~75 min, S3
Automatic Object Replication with S3: Beginner, ~75 min, S3, IAM
Getting Started with AWS RDS MySQL: Beginner, ~75 min, RDS
Getting Started with Amazon DynamoDB (free): Beginner, ~75 min, DynamoDB
Deploying a Containerized Application on ECS with an Application Load Balancer: Beginner, ~75 min, ECS, ALB
Serving Static and Dynamic Content with CloudFront: Beginner, ~75 min, CloudFront, S3, API Gateway
CloudWatch Alarm to Automatically Stop Unused EC2 and Notify via SNS: Beginner, ~75 min, CloudWatch, SNS, EC2
Automating EC2 Stop Using EventBridge and Systems Manager: Beginner, ~75 min, Eventbridge, EC2, SSM
Secure 3-Tier App: ALB → Private Apache → Multi-AZ RDS: Intermediate, ~75 min, VPC, EC2, ALB, RDS, SSM
IAM Instance Role: Least-Privilege S3 Access from EC2: Intermediate, ~75 min, IAM, S3, EC2
TLS Web App with ACM, ALB HTTPS, and Secrets Manager: Intermediate, ~75 min, ACM, ALB, EC2, Secrets Manager, RDS
Public API Hardening with AWS WAF, ALB, and Rate-Based Rules: Intermediate, ~75 min, WAF, ALB, EC2, CloudWatch
KMS-Encrypted App Stack: EBS + S3 with Key Policies: Intermediate, ~75 min, KMS, EBS, S3, EC2
Path-Based Microservices Behind One ALB (Two Target Groups): Intermediate, ~75 min, ALB, EC2, ASG, VPC
Order Processing Pipeline: API → SQS → Workers → SNS Alerts: Intermediate, ~75 min, SQS, SNS, EC2, IAM, CloudWatch
Async Image Pipeline: S3 → EventBridge → Lambda → Output Bucket: Intermediate, ~75 min, S3, EventBridge, Lambda, IAM
Route 53 Failover DR: Primary + Warm Standby Across AZs: Intermediate, ~75 min, Route 53, ALB, EC2
VPC Peering in One Region: Two VPCs, Routes, and Private Connectivity: Intermediate, ~75 min, VPC, EC2
Serverless Checkout API: API Gateway + Lambda + DynamoDB Streams: Intermediate, ~75 min, API Gateway, Lambda, DynamoDB, IAM
Host-Based Routing for Two ECS Services on One ALB: Intermediate, ~75 min, ECS, Fargate, ECR, ALB
Real-Time Clickstream Lake: Kinesis → Firehose → S3 → Athena: Intermediate, ~75 min, Kinesis, Firehose, S3, Athena, IAM
S3 Data Lifecycle Project: Hot → IA → Glacier (free): Beginner, ~75 min, S3, IAM
Mixed Instances ASG: Spot + On-Demand for Cost-Aware Scale: Intermediate, ~75 min, EC2, ASG, ALB, CloudWatch
Right-Size & Schedule Non-Prod: ASG Scheduled Actions + Budgets: Intermediate, ~75 min, ASG, EC2, Budgets, SNS, CloudWatch
Cut Data-Transfer Cost: VPC Endpoints + Shared NAT Design: Intermediate, ~75 min, VPC, Endpoints, S3, EC2, NAT Gateway
Shared POSIX Storage with Amazon EFS Across Two AZs: Intermediate, ~75 min, EFS, EC2, VPC
Serverless CRUD API: API Gateway REST + Lambda + DynamoDB: Intermediate, ~75 min, API Gateway, Lambda, DynamoDB, IAM
DynamoDB Data Access: Partition Keys, GSIs, Query vs Scan: Beginner, ~75 min, DynamoDB
Lambda Tuning: Memory, Timeout, Reserved Concurrency, and SQS DLQ: Intermediate, ~75 min, Lambda, SQS, IAM
SQS and SNS: Queue Worker, Topic Fan-Out, and a Dead-Letter Queue: Intermediate, ~75 min, SNS, SQS, Lambda, IAM
EventBridge: Custom Bus, Rule, and Lambda Target: Beginner, ~75 min, EventBridge, Lambda
Step Functions: Sequence Two Lambdas with Retry and Catch: Intermediate, ~75 min, Step Functions, Lambda, IAM
Cognito User Pool: Test User and API Gateway Authorizer: Intermediate, ~75 min, Cognito, API Gateway, Lambda
Resource Policies: S3 Bucket Policy vs Lambda Execution Role: Intermediate, ~75 min, S3, IAM, Lambda
KMS Encryption: Customer Managed Key, S3 SSE-KMS, and Key Rotation: Intermediate, ~75 min, KMS, S3, IAM
Secrets in Code: Secrets Manager, Parameter Store, and Lambda Env Vars: Beginner, ~75 min, Secrets Manager, Systems Manager, Lambda
CloudFormation: Deploy a SAM Template and Update the Stack: Intermediate, ~75 min, CloudFormation, SAM, Lambda
Lambda Versions and Aliases: Weighted Traffic and Rollback: Beginner, ~75 min, Lambda
API Gateway Stages: Mock Integrations, Stage Variables, and Deploys: Intermediate, ~75 min, API Gateway, Lambda
API Keys and Usage Plans: Throttle and Quota a Stage: Beginner, ~75 min, API Gateway, Lambda
DynamoDB Streams: Event Source Mapping to Lambda: Intermediate, ~75 min, DynamoDB, Lambda
CloudWatch Logs Insights: JSON Logs and a Saved Query: Beginner, ~75 min, CloudWatch, Lambda
AWS X-Ray: Active Tracing and the Service Map: Intermediate, ~75 min, X-Ray, Lambda, API Gateway, DynamoDB
CloudWatch Alarms: Lambda Errors to an SNS Topic: Beginner, ~75 min, CloudWatch, SNS, SQS, Lambda
Host your first website on Amazon S3 (free): Beginner, ~75 min, S3
Incident: Checkout Returns 504 Gateway Timeout: Intermediate, ~75 min, ALB, EC2, VPC
Incident: Finance Reports Fail With KMS AccessDenied: Advanced, ~75 min, KMS, S3, Lambda, IAM
Incident: Reports Bucket Returns Access Denied: Beginner, ~75 min, S3, IAM
Incident: Bakery Website Returns 403 Forbidden: Beginner, ~75 min, S3
Incident: Private App Servers Lost Internet Access: Intermediate, ~75 min, VPC, EC2
Incident: Private Data Lake Reader Can't Reach S3: Advanced, ~75 min, VPC, S3, Lambda
Incident: API Target Unhealthy After Health Check Change: Intermediate, ~75 min, ALB, EC2
Incident: Bakery Web Server Unreachable: Beginner, ~75 min, EC2, VPC
Incident: Event Recorder Hangs Writing to DynamoDB: Advanced, ~75 min, VPC, DynamoDB, Lambda
Incident: One Bad Payment Blocks the Settlement Queue: Advanced, ~75 min, SQS, Lambda
Incident: Store Down, Auto Scaling Fleet at Zero: Intermediate, ~75 min, EC2, ALB
Incident: Website Down After Overnight Maintenance: Beginner, ~75 min, EC2
Incident: Orders Lambda Keeps Timing Out: Intermediate, ~75 min, Lambda, CloudWatch
Incident: Payments Return 502 Bad Gateway After Deploy: Advanced, ~75 min, ALB, EC2, VPC
Incident: Public Subnet With No Way Out: Beginner, ~75 min, VPC, EC2
Incident: Order Kiosk Has No Public Address: Beginner, ~75 min, EC2, VPC
Incident: Order Writer Gets AccessDenied From DynamoDB: Intermediate, ~75 min, Lambda, DynamoDB, IAM
Incident: Private Workers Have No Internet Despite a NAT Route: Advanced, ~75 min, VPC, EC2
Incident: Menu Site Blocked by a Network ACL: Beginner, ~75 min, VPC, EC2
Incident: Order Audit Events Silently Disappear: Advanced, ~75 min, EventBridge, Lambda
Incident: Order Queue Backlog Keeps Growing: Intermediate, ~75 min, SQS, Lambda
Incident: Orders API Returns 500 Internal Server Error: Intermediate, ~75 min, API Gateway, Lambda
Incident: Sensor Ingest Throttled to Zero: Advanced, ~75 min, Lambda, DynamoDB
Incident: The Alarm Fired but Nobody Was Paged: Beginner, ~75 min, CloudWatch, SNS
Incident: App Can't Reach the Database Over VPC Peering: Intermediate, ~75 min, VPC
Incident: Status Page Times Out After the NACL Hardening: Advanced, ~75 min, VPC, EC2
Incident: Website Logo Missing After Deploy: Beginner, ~75 min, S3
Incident: Checkout Workflow Fails at the Charge Step: Advanced, ~75 min, Step Functions, Lambda, IAM
Incident: Ledger Bucket Fails the Security Audit: Beginner, ~75 min, S3, KMS
Incident: Report Server Can't Read From S3: Intermediate, ~75 min, EC2, IAM, S3
Centralized Egress Inspection with AWS Network Firewall: Advanced, ~75 min, Network Firewall, VPC, NAT Gateway, CloudWatch Logs, EC2
Centralized Internet Egress Through a Transit Gateway: Advanced, ~75 min, Transit Gateway, VPC, NAT Gateway, Systems Manager
Chaos Engineering with AWS FIS: Prove the Web Tier Survives Instance Loss: Advanced, ~75 min, Fault Injection Service, Auto Scaling, ELB, CloudWatch
CloudWatch Agent: Memory, Disk and Log Collection from Parameter Store: Intermediate, ~75 min, CloudWatch, Systems Manager, EC2
CodeDeploy In-Place Deployments to EC2 with AppSpec Lifecycle Hooks: Advanced, ~75 min, CodeDeploy, EC2, S3
Container Supply Chain: ECR Scan on Push and Lifecycle Policies: Advanced, ~75 min, ECR, CodeBuild
Continuous Integration with CodePipeline and CodeBuild: Tests and Reports: Advanced, ~75 min, CodePipeline, CodeBuild, S3
ECS Fargate Microservices: Service Connect Discovery and Service Auto Scaling: Advanced, ~75 min, ECS, Cloud Map, Application Auto Scaling, CloudWatch Logs
GuardDuty: Findings, Automated Alerting and Suppression Rules: Advanced, ~75 min, GuardDuty, EventBridge, SNS
Kinesis Data Streams: Lambda Consumer, Batching and Enhanced Fan-Out: Intermediate, ~75 min, Kinesis, Lambda, DynamoDB
Mask Sensitive Data in CloudWatch Logs: Managed and Custom Data Identifiers: Advanced, ~75 min, CloudWatch Logs, CloudShell
Resilient Serverless Order API: Idempotency Keys, Queues and Dead-Letter Queues: Advanced, ~75 min, API Gateway, Lambda, DynamoDB, SQS
Right-Size Permissions: Generate a Least-Privilege Policy from CloudTrail Activity: Advanced, ~75 min, IAM Access Analyzer, IAM, CloudTrail, Lambda
Safe Lambda Releases: SAM Canary Deployments with Alarm-Based Rollback: Advanced, ~75 min, Lambda, CodeDeploy, CloudFormation, CloudWatch
Secrets Manager: Customer Managed Key, Rotation and Resource Policy: Advanced, ~75 min, Secrets Manager, KMS, Lambda
Security Hub and AWS Config: Standards, Findings and Triage: Advanced, ~75 min, Security Hub, Config, EC2, S3
Self-Healing Web Tier: ELB Health Checks, Lifecycle Hooks and Event-Driven Validation: Advanced, ~75 min, Auto Scaling, ELB, EventBridge, Lambda
Site-to-Site VPN with Static Routing to an On-Premises Network: Advanced, ~75 min, VPC, Site-to-Site VPN, EC2, Systems Manager
Stream Logs in Real Time: CloudWatch Logs Subscription to Kinesis and Lambda: Advanced, ~75 min, CloudWatch Logs, Kinesis, Lambda, DynamoDB
Tag Governance: Required-Tags Rule, Bulk Tagging and Resource Groups: Advanced, ~75 min, Config, Resource Groups, Tag Editor
Temporary Credentials: External IDs, Presigned URLs and Session Revocation: Advanced, ~75 min, STS, IAM, S3
Transit Gateway Hub-and-Spoke: Connect Three VPCs: Advanced, ~75 min, VPC, Transit Gateway, EC2, Reachability Analyzer
Amazon Data Firehose to S3: Parquet Conversion and Dynamic Partitioning: Intermediate, ~75 min, Firehose, S3, Glue
Centralized VPC Interface Endpoints Shared Through Private Hosted Zones: Advanced, ~75 min, PrivateLink, Route 53, Transit Gateway, Systems Manager
CodeBuild: Secrets from Parameter Store and Secrets Manager, and Build Caching: Advanced, ~75 min, CodeBuild, Systems Manager, Secrets Manager, S3
CodeDeploy Blue/Green for an Auto Scaling Group Behind a Load Balancer: Advanced, ~75 min, CodeDeploy, Auto Scaling, ELB
Composite Alarms and EventBridge Routing to Cut Alert Noise: Intermediate, ~75 min, CloudWatch, EventBridge, SNS, EC2
Dynamic VPN with BGP on a Transit Gateway: Advanced, ~75 min, Transit Gateway, Site-to-Site VPN, VPC, EC2, Systems Manager
Enforce S3 Encryption: SSE-KMS by Default, Bucket Keys and Deny Policies: Advanced, ~75 min, S3, KMS
Log-Derived Metrics, Anomaly Detection and Composite Alarms: Advanced, ~75 min, CloudWatch, CloudWatch Logs, SNS
Transit Gateway Segmentation: Isolate Dev and Prod, Share Services: Advanced, ~75 min, VPC, Transit Gateway, EC2, Reachability Analyzer
AWS Config Rule with Automatic SSM Remediation: Advanced, ~75 min, Config, Systems Manager, EC2
CloudWatch Dashboards: One Operational View for EC2, ALB and DynamoDB: Intermediate, ~75 min, CloudWatch, ELB, EC2, DynamoDB
CodeArtifact: A Private Package Proxy for Builds: Advanced, ~75 min, CodeArtifact, CodeBuild
Glue Crawler and Data Catalog: Query Partitioned Data with Athena: Intermediate, ~75 min, Glue, Athena, S3
Protect a Partner API: REST API Keys, Usage Plans and Throttling: Advanced, ~75 min, API Gateway
CloudTrail Audit Trail: SSE-KMS, Log File Validation and Athena: Advanced, ~75 min, CloudTrail, KMS, S3, Athena
ECS Blue/Green Deployments with CodeDeploy, a Test Listener and Canary Traffic: Advanced, ~75 min, ECS, CodeDeploy, ELB
Glue ETL: Convert CSV to Partitioned Parquet with Job Bookmarks: Intermediate, ~75 min, Glue, S3, Athena
Systems Manager Automation: Write a Runbook and Trigger It from an Alarm: Intermediate, ~75 min, Systems Manager, EventBridge, CloudWatch, EC2
Blue/Green Releases with ALB Weighted Target Groups: Advanced, ~75 min, ELB, EC2, CloudWatch
CIS Monitoring Controls: CloudTrail Metric Filters and Alarms: Advanced, ~75 min, CloudTrail, CloudWatch Logs, CloudWatch, SNS
Glue DataBrew: Profile and Clean a Messy Dataset Without Code: Intermediate, ~75 min, Glue DataBrew, S3
Hybrid DNS with Route 53 Resolver Inbound and Outbound Endpoints: Advanced, ~75 min, Route 53 Resolver, Route 53, VPC, EC2, CloudWatch Logs
Patch Manager: Custom Baseline, Patch Group and Maintenance Window: Intermediate, ~75 min, Systems Manager, EC2
Athena Performance and Cost Control: Workgroups, Partition Projection and CTAS: Intermediate, ~75 min, Athena, Glue, S3
Fleet Operations: Run Command Rate Control, State Manager and Inventory: Intermediate, ~75 min, Systems Manager, EC2, S3
IAM Access Analyzer: External Access Findings, Archive Rules and Policy Checks: Advanced, ~75 min, IAM Access Analyzer, IAM, S3
Private Hosted Zones Across VPCs and Overlapping Namespaces: Advanced, ~75 min, Route 53, VPC, EC2
Strangler Fig Migration: Route One Path of a Monolith to Lambda: Advanced, ~75 min, ELB, Lambda, EC2
Attribute-Based Access Control with Session Tags: Advanced, ~75 min, IAM, STS, EC2
EBS Operations: gp2 to gp3 Online, Resize and Automated Snapshots: Intermediate, ~75 min, EBS, EC2, Data Lifecycle Manager
Lake Formation: Column-Level Permissions on a Data Lake Table: Intermediate, ~75 min, Lake Formation, Glue, Athena, IAM
Route 53 Resolver DNS Firewall with Query Logging: Advanced, ~75 min, Route 53 Resolver, VPC, CloudWatch Logs, EC2
AWS Backup: Centralized Plan, On-Demand Backup and Restore Test: Intermediate, ~75 min, AWS Backup, DynamoDB
AWS PrivateLink: Publish a Service Behind a Network Load Balancer: Advanced, ~75 min, PrivateLink, ELB, VPC, EC2
Orchestrate an ETL Pipeline with Step Functions and EventBridge Scheduler: Intermediate, ~75 min, Step Functions, Glue, SNS, EventBridge Scheduler
Permissions Boundaries and Session Policies: Safe Delegation: Advanced, ~75 min, IAM, STS, S3
CloudFormation at Scale: Nested Stacks and a Lambda-Backed Custom Resource: Advanced, ~75 min, CloudFormation, Lambda, Systems Manager
Connect Overlapping VPCs with a Private NAT Gateway: Advanced, ~75 min, VPC, NAT Gateway, Transit Gateway, ELB, Reachability Analyzer
DynamoDB Accelerator (DAX): Microsecond Reads for a Read-Heavy Table: Advanced, ~75 min, DynamoDB, DAX, EC2
DynamoDB Operations: Fix Throttling, Enable Point-in-Time Recovery and Expire Data with TTL: Intermediate, ~75 min, DynamoDB, CloudWatch
Event-Driven Ingestion: S3 Events to EventBridge, Lambda Validation and Scheduled Jobs: Intermediate, ~75 min, S3, EventBridge, Lambda, EventBridge Scheduler
KMS Bring Your Own Key: Import, Expire and Re-import Key Material: Advanced, ~75 min, KMS, CloudShell
AMI Lifecycle: Build a Golden Image, Launch It from a Template and Deprecate It: Intermediate, ~75 min, EC2, AMI, EBS
AWS SAM: One Template, Multiple Environments with Parameter Overrides: Advanced, ~75 min, SAM, Lambda, API Gateway, CloudFormation
Central Security Log Archive: CloudTrail and Config into a Locked-Down KMS Bucket: Advanced, ~75 min, CloudTrail, Config, S3, KMS
DynamoDB Export to S3: Analyze Operational Data with Athena, Zero Impact: Intermediate, ~75 min, DynamoDB, S3, Athena, Glue
Private-Only VPC: Interface and Gateway Endpoints with Endpoint Policies: Advanced, ~75 min, VPC, PrivateLink, S3, Systems Manager, EC2
CloudFormation Operations: Drift Detection, Change Sets and Stack Policies: Intermediate, ~75 min, CloudFormation, EC2, S3, Systems Manager
Configuration Drift Control: Custom SSM Documents, State Manager and Compliance: Advanced, ~75 min, Systems Manager, EC2
Glue Workflows: Orchestrate a Crawler and an ETL Job with Triggers: Intermediate, ~75 min, Glue, S3
Resource-Based Policies for Partner Access: S3 Bucket Policy and KMS Key Policy: Advanced, ~75 min, S3, KMS, IAM, STS
Custom AWS Config Rule in Lambda with Automatic Remediation: Advanced, ~75 min, Config, Lambda, Systems Manager, S3
DynamoDB Data Modeling: Composite Keys, GSIs and Sparse Indexes for Access Patterns: Intermediate, ~75 min, DynamoDB
KMS in Depth: Encryption Context, Grants and Automatic Key Rotation: Advanced, ~75 min, KMS, IAM, Systems Manager
Troubleshoot a Failed CloudFormation Deployment: cfn-init and cfn-signal: Intermediate, ~75 min, CloudFormation, EC2, Systems Manager
VPC Traffic Mirroring to a Packet-Capture Instance: Advanced, ~75 min, VPC, Traffic Mirroring, EC2, Systems Manager
Auto Scaling Operations: Target Tracking, Lifecycle Hooks and Instance Refresh: Intermediate, ~75 min, Auto Scaling, EC2, ELB
Harden EC2: Enforce IMDSv2, Encrypt EBS by Default and Close SSH: Advanced, ~75 min, EC2, EBS, Systems Manager, VPC
Kinesis Data Streams Operations: Hot Shards, Resharding, Retention and Replay: Intermediate, ~75 min, Kinesis, CloudWatch, CloudShell
VPC Flow Logs with a Custom Format: Find Rejected Traffic: Advanced, ~75 min, VPC, CloudWatch Logs, S3, Athena, Glue
ALB Access Logs: Find the Source of 5xx Errors with Athena: Intermediate, ~75 min, ELB, S3, Athena, CloudWatch
AWS WAF on an Application Load Balancer: Managed, Rate-Based and Geo Rules: Advanced, ~75 min, WAF, ELB, CloudWatch Logs
Glue Data Quality: DQDL Rules, Scores and Alerts on Failures: Intermediate, ~75 min, Glue, EventBridge, SNS
Reachability Analyzer and Network Access Analyzer: Diagnose and Prove Paths: Advanced, ~75 min, Reachability Analyzer, Network Access Analyzer, VPC, EC2
Replatform a Cron Server: EventBridge Schedules, Lambda and Failure Destinations: Advanced, ~75 min, Lambda, EventBridge, S3, SQS, EC2
CloudWatch Synthetics: Canary Monitoring and Alarms for a Web Endpoint: Advanced, ~75 min, CloudWatch Synthetics, CloudWatch, S3, EC2
Data Lake Storage Lifecycle: Versioning, Intelligent-Tiering, Expiration and Inventory: Intermediate, ~75 min, S3
Global Accelerator in Front of Load Balancers: Weights and Failover: Advanced, ~75 min, Global Accelerator, ELB, EC2
Incident Response Automation: Isolate and Snapshot a Compromised Instance: Advanced, ~75 min, Step Functions, EC2, EventBridge, SNS, GuardDuty
Rehost and Cut Over: Move Traffic to a Migrated Server with Weighted DNS: Advanced, ~75 min, Route 53, EC2, VPC
S3 at Scale: Multipart Uploads, Transfer Acceleration and Lifecycle Hygiene: Intermediate, ~75 min, S3
Amazon EFS: Shared Storage with Access Points and Lifecycle Tiers: Intermediate, ~75 min, EFS, EC2, VPC
Apache Iceberg in Athena: ACID Upserts, Deletes and Time Travel: Intermediate, ~75 min, Athena, Glue, S3
AWS Transfer Family: Managed SFTP into S3 for Partners: Advanced, ~75 min, Transfer Family, S3, CloudWatch Logs
CloudFront in Front of an ALB: Origin Cloaking and WAF at the Edge: Advanced, ~75 min, CloudFront, ELB, WAF, VPC
Event-Driven Auto-Remediation: Restart Critical Instances with EventBridge and SSM: Advanced, ~75 min, EventBridge, Systems Manager, EC2
Session Manager Only: No SSH, Encrypted Sessions and Full Audit Logs: Advanced, ~75 min, Systems Manager, KMS, CloudWatch Logs, S3, EC2
Distributed Transactions with the Saga Pattern: Step Functions Compensation: Advanced, ~75 min, Step Functions, Lambda, EventBridge, CloudWatch Logs
Monitor and Audit Data Pipelines: Job Failure Alerts and S3 Data Events: Intermediate, ~75 min, Glue, EventBridge, CloudWatch, CloudTrail, SNS
Network Load Balancer Deep Dive: TLS, Client IP and Cross-Zone: Advanced, ~75 min, ELB, ACM, EC2, VPC
Rotate Pipeline Credentials Automatically: Secrets Manager with CodeBuild Consumers: Advanced, ~75 min, Secrets Manager, Lambda, CodeBuild
Troubleshoot VPC Connectivity: Flow Logs, Reachability Analyzer and NACLs: Intermediate, ~75 min, VPC, Reachability Analyzer, CloudWatch Logs, NAT Gateway, Systems Manager
CloudFront Caching: Origin Access Control, Cache Policies and Invalidations: Intermediate, ~75 min, CloudFront, S3
Detect and Redact PII in a Glue ETL Job: Intermediate, ~75 min, Glue, S3, Athena
Dual-Stack VPC: IPv6, Egress-Only Internet Gateway and a Secondary CIDR: Advanced, ~75 min, VPC, EC2
S3 Access Points: Delegated, VPC-Restricted Access to a Shared Data Lake Bucket: Advanced, ~75 min, S3, S3 Access Points, VPC