Management and Governance
Provision, monitor, audit, and govern AWS at scale. The three “observability” services below are the most-confused trio on the exam.
The observability trio
| Service | Answers | Example question |
|---|---|---|
| Amazon CloudWatch | Is it working / how fast? | ”Why is CPU at 100%?” |
| AWS CloudTrail | Who did what, when? | ”Who deleted the bucket?” |
| AWS Config | What state is it in / did it drift? | ”Is this volume still encrypted?” |
Provisioning & operations
| Service | Job | Key distinction |
|---|---|---|
| AWS CloudFormation | Infra as code | Declarative; you specify the stack |
| AWS Systems Manager | Ops hub | Session Manager, Patch, Parameter Store |
| AWS Auto Scaling | Match capacity to demand | Delivers Elasticity |
| AWS Service Catalog | Approved self-service products | Your curated templates |
| AWS Launch Wizard | Guided enterprise deploys | SAP, SQL Server, AD |
| AWS Control Tower | Governed multi-account landing zone | Opinionated layer over AWS Organizations |
| AWS Organizations | Multi-account management | Consolidated billing + SCP guardrails |
Recommendations & health
| Service | Job | Key distinction |
|---|---|---|
| AWS Trusted Advisor | Best-practice checks | Fixed AWS-authored list, 5 categories |
| AWS Compute Optimizer | ML right-sizing | Names a specific better instance type |
| AWS Health Dashboard | AWS-side events affecting you | Maintenance, deprecations, outages |
| AWS License Manager | Track license usage | Enforces Bring Your Own License limits |
| AWS Management Console | Web GUI | One of 3 access methods (vs CLI, IaC) |
| AWS Resource Groups and Tag Editor | Group & tag resources | Drives cost allocation and automation |
- CloudWatch (performance) vs CloudTrail (API audit) vs Config (resource state) — memorize by the verb in the question.
- Trusted Advisor (fixed checks) vs Compute Optimizer (ML right-sizing) vs Config (your custom rules).