What's changed: Service coverage: added catalog sections (s4 compute/DB/storage/network, s5 analytics/ML/IoT/media/integration)
2.3Choosing Data Stores and Encryption
Understand the right data store and protection—choosing RDS/Aurora/DynamoDB/S3 storage classes, encryption with KMS, Secrets Manager, and encryption at rest/in transit. Select secure stores that fit requirements.
Choose data stores by access pattern: relational = RDS/Aurora, key-value/large low-latency = DynamoDB, objects = S3. All can be encrypted with KMS.
2.3.1Data stores and encryption
- RDS/Aurora: relational/transactional; Multi-AZ for HA, read replicas for read scaling.
- DynamoDB: key-value, large-scale low-latency; serverless, global tables for multi-region.
- S3 storage classes: optimize cost with Standard/Intelligent-Tiering/Glacier by access frequency.
- KMS / Secrets Manager: KMS for at-rest (envelope) encryption; Secrets Manager to store and auto-rotate credentials.
Common on SAP-C02: relational = RDS/Aurora, key-value/ultra-low-latency/serverless = DynamoDB, objects + tiered cost optimization = S3 storage classes (Intelligent-Tiering/Glacier), key management/at-rest encryption = KMS, DB password auto-rotation = Secrets Manager. Derive the store from the access pattern.
For unpredictable access, S3 Intelligent-Tiering auto-tiers to optimize cost; for rarely accessed long-term archives, the Glacier classes are cheapest.
Derive the data store from the access pattern. Relational/transactional = RDS/Aurora (Aurora’s distributed storage, up to 15 read replicas, Global Database cross-region, Serverless v2); key-value/ultra-low-latency/serverless = DynamoDB (partition key design, on-demand/provisioned, microseconds via DAX, global tables); analytics/DWH = Redshift; full-text search = OpenSearch; caching = ElastiCache; objects = S3 (classes Standard/Intelligent-Tiering/Standard-IA/One Zone-IA/Glacier Instant·Flexible·Deep Archive; auto-transition via lifecycle policies). Protect with KMS (envelope encryption, CMKs, automatic key rotation, SSE for S3/EBS/RDS) and TLS in transit; manage credentials in Secrets Manager (auto-rotation; config in SSM Parameter Store). Control access with IAM / resource policies / VPC endpoint policies; address data sovereignty via region choice. Pick by requirement: “unpredictable access = Intelligent-Tiering,” “archive = Glacier,” “microsecond reads = DAX,” “password auto-rotation = Secrets Manager.”
| Access pattern | Store | Key point |
|---|---|---|
| Relational/transactional | RDS / Aurora | Multi-AZ, read replicas, Global DB |
| Key-value, ultra-low-latency | DynamoDB (+ DAX) | Serverless, global tables |
| Objects/large | S3 (storage classes) | Intelligent-Tiering/Glacier |
| Analytics/DWH | Redshift | Columnar, large aggregation |
Scenario: read/write global game player data at single-digit ms (microseconds for hot data) with low latency from multiple regions. → Choose DynamoDB (global tables for multi-region active-active) and front it with DAX for ultra-fast reads. Encrypt with KMS (at rest) + TLS (in transit) and auto-rotate app DB credentials with Secrets Manager.
FAQ: Q. KMS vs Secrets Manager? → A. KMS manages keys/encryption; Secrets Manager stores and auto-rotates credentials (passwords/connection strings). Q. S3 data with unpredictable access? → A. Intelligent-Tiering auto-tiers; with known rules, transition to Glacier classes via lifecycle policies.
Trap: “use KMS to store and auto-rotate credentials” is wrong—KMS manages keys/encryption; credential storage and auto-rotation is Secrets Manager. Also “choose RDS for ultra-low-latency key-value” is wrong—key-value at single-digit ms is DynamoDB, microseconds is DAX.
2.3.2Section summary
- Choose = RDS/Aurora (relational) / DynamoDB (key-value) / S3 (objects)
- Protect = KMS (encryption) + Secrets Manager (credential rotation)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want a single-digit-millisecond, virtually unlimited key-value store with no server management. What?
Q2. You want to auto-optimize storage cost for objects with unpredictable access, without operational effort. Which S3 option?
Q3. You want DB credentials kept out of code, securely managed, and auto-rotated. What do you use?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.