Blog
The cloud's hard topics, explained, then played
Each article takes one exam topic you cannot try in a free-tier account, explains it from the documentation, shows it in a short video, and ends at the stage that proves it. 8 of the 12 articles end at a stage you can play free, without an account.
SAA-C03 · Networking
How a private subnet reaches the internet: the NAT gateway, hop by hop
A NAT gateway lets private instances start connections out while nothing on the internet starts one in. Follow every hop, and see the address the far end sees.
Ends at Private but Connected Free at release6 min read · video coming
SAA-C03 · Networking
Security group or network ACL: which one dropped the packet?
Security groups are stateful and only allow. Network ACLs are stateless, numbered and can deny. Follow one HTTPS request to see which layer drops what.
Ends at Guard Rails Paid5 min read · video coming
SAA-C03 · Networking
What actually makes a subnet public
Not its name, not a public IP, not the gateway alone. The subnet's route table decides, and the main route table decides for every subnet you forgot.
Ends at Open for BusinessFree5 min read · video coming
SAA-C03 · Networking
Why can't my private subnet reach S3? Gateway and interface endpoints
With no internet gateway or NAT, a private subnet can still reach AWS services. A gateway endpoint adds a route; an interface endpoint adds an address.
Ends at Shortcut to S3 Paid5 min read · video coming
SOA-C03 · Core architecture
gp3, io2, st1 or sc1: choosing an EBS volume by the numbers
gp3 includes 3,000 IOPS at any size, io2 is the sub-millisecond volume, st1 sells throughput by the TiB, and the instance sets the last ceiling.
Ends at Volumes That FitFree5 min read · video coming
SOA-C03 · Operations and delivery
Why CloudWatch shows no memory for your EC2 instance
EC2 publishes CPU, network, disk operations and status checks. Memory and disk space live inside the guest, where the CloudWatch agent reads them.
Ends at Measure ItFree5 min read · video coming
SCS-C03 · Security
How AWS decides a request: why an explicit deny always wins
Every request starts denied. An Allow lets it through, and one Deny in any policy ends it. The order AWS reads policies in, and how to find the Deny.
Ends at Deny WinsFree5 min read · video coming
SCS-C03 · Security
Identity policy or bucket policy: which one has to allow?
In one account, either side can allow. Across accounts, both must. An account principal only delegates, and Block Public Access overrides a public policy.
Ends at Deny WinsFree6 min read · video coming