AWS Services Study Summary - AI Practitioner

Amazon Bedrock

Amazon Bedrock is a fully managed service for building generative AI applications. It gives you access to powerful foundation models from Amazon and other model providers, via an Application Programming Interface, or API, so you can focus on building your application instead of managing servers or infrastructure.

Foundation Model — a large, pre‑trained AI model that can generate text, images, audio, or other content. You access these models through an API, meaning you don't have to train them yourself.

With Bedrock, you can quickly add generative AI to your applications: create chatbots, generate text, compare different models to find the best one for your needs, and even apply safety filters to control what content is produced. All of this without provisioning or maintaining any servers.

One key feature is Bedrock Knowledge Bases. This implements a managed RAG workflow — Retrieval‑Augmented Generation — which lets your application pull in relevant information from your own documents or data sources, then include that context in the model's response, grounding the answer in your specific data.

Another feature is Agents for Amazon Bedrock. An agent can plan and execute multi‑step tasks: it understands your request, decides what actions to take, calls APIs or AWS Lambda functions, retrieves information, and returns a final answer. Think of it as giving the model the ability to do real work on your behalf.

Bedrock Guardrails help with content moderation. You can configure them to block harmful content, filter out sensitive information like personal data, or prevent the model from producing off‑topic or unsupported responses.

You can also evaluate foundation models using Bedrock model evaluation. It measures things like accuracy, relevance, and safety, helping you pick the right model. And with prompt management, you can store, version, and reuse your prompts across different environments.

If you need a model tailored to your domain, Bedrock supports customization, including fine‑tuning and continued pre‑training on your own data. And for running inference, you have flexible options: on‑demand for occasional use, provisioned throughput for consistent traffic, or batch processing for large jobs.

How Amazon Bedrock differs from Amazon SageMaker: Bedrock is for using foundation models without managing infrastructure — it's the go‑to for quickly integrating generative AI into apps. SageMaker is a broader platform for building, training, and deploying your own custom machine learning models, giving you full control over the model lifecycle.

Amazon Titan

Amazon Titan — the family of foundation models built by AWS. These models handle text, images, video, speech, and more, and you access them through Amazon Bedrock.

How Titan differs from Bedrock: think of Titan as the cars and Bedrock as the dealership. Titan models are the AI engines AWS builds; Bedrock is the managed platform where you pick one, take it for a spin, and integrate it into your application.

Titan models can summarize long documents, generate fluent text, reason over complex problems, and understand images or video. They also handle multimodal tasks—combining text and visuals—and can create images, video, and even speech. Embeddings models turn words or content into number vectors for search and recommendations.

Amazon Bedrock AgentCore

Amazon Bedrock AgentCore is a managed environment for deploying, securing, operating, and monitoring AI agents. Think of it as the control center that takes an agent from a prototype to a production-ready system, handling all the infrastructure and governance for you.

AgentCore works with agents built using different frameworks and model providers. It is not tied to one specific tool set, so you can bring agents created with various development kits and still manage them through a single, consistent platform.

agentcore-runtime — a runtime environment designed for multi-turn agents. It keeps the agent running across back-and-forth conversations, managing the state and flow of each interaction without you having to build that plumbing yourself.

AgentCore-Gateway — the component that connects agents to tools, APIs, Lambda functions, and other services. It also lets you expose existing systems or other agents so they can be called by the agent, acting like a universal connector.

agentcore-identity — provides authentication and permission management for agents. It ensures an agent can securely access AWS resources, third-party applications, and other systems, using a consistent identity instead of hardcoded credentials.

Policy in AgentCore — a set of controls that govern which actions an agent is allowed to perform. For example, you can limit an agent so it can only read data from an external system but never place an order or delete a record.

agentcore-memory — allows agents to remember previous interactions. It supports short-term conversational context, like what was just said, and long-term information, like user preferences, so the agent can give more personalized responses over time.

agentcore-observability — the component that tracks metrics such as agent interactions, tool calls, action failures, and latency. It gives you a dashboard to monitor and analyze how your agent is performing in the real world.

agentcore-datastream — provides an authenticated, low-latency environment for agents that need to interact with websites. This is useful when an agent must browse or retrieve information from the web in real time.

AgentCore-Code Interpreter — a controlled environment where agents can execute code safely. It lets the agent run small scripts or calculations without giving it unrestricted access to your underlying systems.

How Bedrock Agents differs from AgentCore. Amazon Bedrock generates text, images, and code using foundation models. Bedrock AgentCore, on the other hand, creates and manages agents that plan multi-step tasks and call tools. In short, Bedrock is about generating content; AgentCore is about orchestrating and operating the agents that take action.

Amazon SageMaker AI

Amazon SageMaker AI is a managed platform that covers the entire machine learning lifecycle. You use it to build, train, tune, deploy, and monitor your own custom machine learning models.

SageMaker is for custom machine learning models and gives you full control over the lifecycle. Amazon Bedrock, on the other hand, is for building generative AI applications using pre-built foundation models through APIs, without managing the underlying infrastructure.

SageMaker Studio is a web-based integrated development environment where you can write code in Jupyter notebooks, prepare data, run experiments, and manage your entire machine learning workflow in one place.

SageMaker Canvas is a no-code visual tool. It lets business analysts or users without coding experience import data, build models, and generate predictions just by pointing and clicking.

SageMaker Data Wrangler helps you import and prepare data for machine learning. You can clean data, transform columns, and engineer features without writing complex code.

SageMaker Ground Truth helps you create high-quality labeled datasets. You can use human labelers, automated labeling, or a combination of both to annotate images, text, or other data before training.

Ground Truth is for labeling training data before you build a model. Augmented AI, or A two I, is for human review of a model's predictions after the model is deployed, typically when confidence is low or a human check is required.

SageMaker JumpStart gives you access to pre-trained models and ready-made machine learning solutions. You can quickly deploy a model without training one from scratch, which saves time and effort.

SageMaker Autopilot is an AutoML capability. It automatically examines your data, selects algorithms, trains multiple candidate models, and helps you find the best performing one, while still giving you visibility into the process.

The SageMaker Feature Store is a central place to store, retrieve, and share machine learning features. It helps ensure consistency between the features used during training and those used during inference.

SageMaker Training Jobs let you run model training at scale. You specify the training data, the algorithm, and the output location, and SageMaker manages the compute resources.

Automatic Model Tuning, also called hyperparameter tuning, automatically searches for the best values for settings like learning rate or batch size to improve your model's accuracy.

MLflow integration with SageMaker helps you track experiments, record parameters and metrics, and compare different model versions, making your work reproducible and organized.

SageMaker Pipelines automates your end-to-end machine learning workflow. You can define steps for preprocessing, training, evaluation, and deployment that run reliably every time.

The SageMaker Model Registry catalogs your model versions, tracks metadata and evaluation metrics, and lets you approve or reject models before promoting them to production.

SageMaker Model Monitor watches your deployed models for problems like data quality issues, model accuracy degradation, or bias drift over time.

SageMaker Clarify helps detect bias in your models and data, and provides explanations for why a model made a particular prediction, supporting fairness and transparency.

SageMaker Model Cards document important information about a model, such as its intended use, training details, evaluation metrics, and known limitations, for better governance.

ML Lineage Tracking records the relationships between data, processing jobs, experiments, and models. This supports reproducibility and helps with audits.

Managed Spot Training uses spare EC2 capacity for training jobs, which can significantly reduce cost, though the jobs may have flexible start and end times.

SageMaker Profiler analyzes resource usage during training to identify bottlenecks, such as CPU or GPU underutilization, helping you optimize performance and cost.

SageMaker offers four inference options. Real-time inference is for low-latency predictions with steady traffic. Serverless inference handles intermittent or unpredictable traffic. Asynchronous inference is for long-running requests with large payloads. Batch transform processes large datasets offline without a persistent endpoint.

AI Assistants and Agentic Development Tools

This section covers AWS tools that assist developers and businesses with generative AI, search, analytics, and automation. The key is matching the tool to the right job.

Amazon Q Developer — a generative AI assistant for developers that helps with code generation, debugging, and answering questions about AWS architectures.

Amazon Q Business — an enterprise assistant grounded in your company’s own data. It answers employee questions while strictly respecting document permissions.

Amazon Quick — an AI-powered business engine that creates analytics, dashboards, automations, and even web apps when you describe your needs in natural language.

Kiro — an agentic development environment that takes requirements, generates specifications, plans tasks, and produces code, speeding up the development lifecycle.

Strands Agents — an open-source SDK for building custom AI agents. It gives developers programmatic control over tools, multi-agent systems, and orchestration.

AWS Transform — uses agent-based AI to modernize legacy infrastructure, applications, and code, handling tasks like mainframe migration and technical debt reduction.

Use Q Developer when you need a coding helper for an individual developer. Use Q Business when you need a company-wide assistant that respects permissions. Use Quick for analytics and automation from natural language. Use Kiro when you want an environment that refines requirements and generates code. Use Strands Agents to build and code custom agents from scratch. Use Transform when you need to modernize old systems.

Managed AI Services

Managed AI services give you ready-to-use machine learning capabilities without any model training. You just call an application programming interface, or API, sending your data and getting results back. This covers everything from understanding text and speech to analyzing images, extracting documents, and even building chatbots or recommendation engines—all without writing ML code.

Amazon Comprehend — a natural language processing service that reads text and tells you the sentiment, picks out key phrases, identifies named entities like people or places, and can even spot personally identifiable information, or PII.

Amazon Translate — a service that translates text from one language to another, making it easy to localize content or communicate across languages.

How Amazon Comprehend differs from Amazon Translate: Comprehend is about understanding what the text says—its meaning, sentiment, and entities. Translate is about converting the text into a different language, without analyzing its content.

Amazon Polly — a text-to-speech service that turns written words into natural-sounding speech, useful for accessibility, e-learning, or giving a voice to applications.

Amazon Transcribe — a speech-to-text service that converts audio recordings into written transcripts, ideal for meeting notes, call analytics, or dictation.

How Amazon Polly differs from Amazon Transcribe: Polly speaks—it turns text into speech. Transcribe listens—it turns speech into text. One creates audio, the other creates written transcriptions.

Amazon Rekognition — an image and video analysis service that detects objects, scenes, and faces, and can also moderate content to flag inappropriate material.

Amazon Textract — a document analysis service that extracts printed text, handwriting, forms, and tables from scanned papers or PDFs, understanding the layout and structure.

How Amazon Rekognition differs from Amazon Textract: Rekognition looks at images and videos to identify objects, faces, or activities—it sees. Textract reads documents and pulls out words and data—it reads. One is for visual scenes, the other for structured paper and forms.

Amazon Kendra — an intelligent enterprise search service that lets employees ask natural language questions and find answers across company documents, intranets, or knowledge bases.

Amazon Lex — a service for building conversational chatbots and virtual assistants that understand both voice and text, the same technology that powers Alexa.

Amazon Personalize — a recommendation engine that analyzes user behavior to suggest products, content, or personalized search results, like a ‘you may also like’ feature.

Data Preparation, Analytics, and Storage

Amazon S3 is an object storage service perfect for holding training datasets, model artifacts, logs, and any unstructured data. Think of it as a limitless digital warehouse that scales automatically.

Amazon S3 Glacier — low-cost archival storage for data you rarely access, like old training sets or compliance records, where retrieval takes longer but costs much less.

S3 Standard versus S3 Glacier — your everyday active data lives in S3 Standard for quick access, while Glacier is the deep freezer for long-term storage at a fraction of the cost.

AWS Data Exchange lets you subscribe to third-party datasets—like weather, financial, or industry data—directly in the cloud, so you can enrich your models without manual downloads.

AWS Glue — a serverless data integration service that discovers, prepares, and transforms data across sources. It’s your behind-the-scenes worker for ETL pipelines.

Within Glue, the Data Catalog keeps metadata about your tables, DataBrew offers a visual no-code way to clean data, and Data Quality monitors your data for anomalies.

AWS Glue versus Amazon EMR — Glue is serverless, so you don’t manage clusters, while EMR gives you full control over big data frameworks like Spark and Hadoop for heavy lifting.

Amazon EMR — a managed big data platform that runs frameworks like Apache Spark and Hadoop, enabling distributed processing of massive datasets on clusters you can size as needed.

AWS Lake Formation builds and secures data lakes by organizing raw data in S3, applying fine-grained permissions, and working closely with the Glue Data Catalog.

Amazon Redshift — a petabyte-scale data warehouse optimized for running complex SQL analytical queries across huge structured datasets, perfect for business intelligence.

Amazon OpenSearch Service — a managed search engine that supports full-text search, log analytics, and vector search, letting you store and query embeddings for semantic applications.

Redshift versus OpenSearch — use Redshift for traditional SQL analytics on structured data; choose OpenSearch when you need fast text search or vector similarity for AI-driven retrieval.

Database Services

AWS offers a range of database services, each built for a specific type of data and access pattern. Choosing the right one is a key exam topic.

Amazon Aurora — a managed relational database that is compatible with both PostgreSQL and MySQL. It combines the familiarity of SQL with cloud-native performance and can also store vector embeddings using the pgvector extension.

Amazon R D S, or Relational Database Service — a managed service for running relational databases. It supports multiple engines, including PostgreSQL, MySQL, MariaDB, Oracle, and SQL Server. Think of it as the broader family that includes Aurora.

How Aurora differs from R D S. Aurora is a specific database engine within the R D S family, designed by AWS for higher performance and availability. R D S is the overall service that manages many different database engines, including Aurora.

Amazon DynamoDB — a serverless NoSQL database that works as both a key-value store and a document store. It delivers consistent single-digit millisecond latency at any scale, making it ideal for high-traffic applications like user profiles, session management, and leaderboards.

Amazon DocumentDB — a managed document database that is compatible with MongoDB. Use it when you need to store and query JSON documents with flexible schemas, such as content catalogs or application metadata.

Amazon Neptune — a managed graph database. It is purpose-built for storing and querying highly connected data, where relationships between entities are the star of the show. Common use cases include social networks, knowledge graphs, and fraud detection.

Amazon ElastiCache — a managed in-memory caching service. It supports two engines: Redis and Memcached. Use it to store frequently accessed data in memory, which reduces the load on your primary database and speeds up response times.

Compute, Containers, and Application Integration

Amazon EC2 gives you virtual servers with full control over the operating system and hardware. For AI, you can use GPU-powered instances for custom model training or specialized inference.

AWS Lambda — a serverless compute service that runs your code in response to events without you managing any servers.

Amazon ECS is the AWS-native container orchestration service. You define tasks and services, and ECS runs your containers across a cluster of EC2 instances or with Fargate for serverless containers.

Amazon EKS is a managed Kubernetes service. It runs the Kubernetes control plane for you, so you can use standard Kubernetes tools to deploy and manage applications.

ECS versus EKS: ECS is AWS's own orchestration engine, integrated tightly with AWS services. EKS provides the open-source Kubernetes platform, which is ideal if your team already uses Kubernetes or needs multi-cloud portability.

Amazon ECR — a container image registry. Think of it as a private Docker registry where you store your container images, ready to be pulled by ECS, EKS, or SageMaker.

Amazon API Gateway — a service to create, publish, and manage RESTful APIs. It sits in front of your application endpoints, Lambda functions, or AI model inference, handling authentication, throttling, and monitoring.

Amazon Kinesis Data Streams captures and stores streaming data in real time. It's designed for high-throughput data like application logs, user clickstreams, or sensor readings, which you can then process with Lambda or analytics services.

Amazon EventBridge is an event bus that routes events between services. You set up rules to trigger actions when something happens—like a file landing in S3, a new signup, or a model training job completing.

AWS CodePipeline automates the build, test, and deployment steps of your software release. In machine learning, you can use it to create a CI/CD pipeline for model training, testing, and deployment.

Networking, Security, and Identity Services

Amazon VPC, or Virtual Private Cloud, is your own isolated virtual network inside AWS. You control IP addresses, subnets, and routing, keeping your resources in a private, secure space.

VPC endpoints let your resources inside a VPC reach AWS services like S3 or DynamoDB privately, without crossing the public internet. This keeps traffic on the AWS backbone.

AWS PrivateLink is the technology behind VPC endpoints. It provides private connectivity to services hosted by AWS or third parties, all without exposing traffic to the internet. So think of PrivateLink as the how, and the VPC endpoint as the what.

Amazon CloudFront is a content delivery network, or CDN. It speeds up delivery of your website, videos, and files by caching copies at edge locations around the world, so users get content with very low latency.

AWS IAM, Identity and Access Management, is how you control who can do what in your AWS account. You create users, groups, and roles, then attach policies that spell out permissions. The golden rule is least privilege — grant only what’s needed.

When you need to manage employee access across many AWS accounts, AWS IAM Identity Center gives you a single place to control workforce sign‑ins. It can integrate with your existing corporate identity provider.

AWS KMS, Key Management Service, creates and manages encryption keys. Use it whenever you need to protect data at rest, like in S3, databases, or logs.

AWS Secrets Manager securely stores and automatically rotates secrets such as database passwords, API keys, and OAuth tokens. This way you never hard‑code credentials in your application or prompts.

Amazon Macie discovers and reports sensitive data stored in S3. It automatically finds personally identifiable information, financial details, and other secrets, then alerts you or even helps mask them.

Amazon Inspector scans your workloads — EC2 instances, containers, Lambda functions — for software vulnerabilities and unintended network exposure. It’s like a security scanner for your running code.

Bedrock Guardrails puts safety controls around generative AI. It can block harmful content, filter out personally identifiable information, and stop prohibited topics from entering or leaving a model.

Monitoring, Governance, and Compliance

This section covers the AWS services that help you watch over your cloud environment, prove what happened, check that your resources follow the rules, and gather the paperwork auditors need. Think of them as the oversight layer — they keep your systems visible, accountable, and compliant.

Amazon CloudWatch — the service that collects metrics, logs, and events from your AWS resources and applications, then lets you set alarms when something looks off. It is your unified operational dashboard.

AWS CloudTrail — the service that records every Application Programming Interface, or API, call made in your account. It tells you who did what, when, from which IP address, and which resource was affected. It is your audit log for user and service activity.

AWS Config — the service that tracks how your resources are configured over time and evaluates those configurations against rules you define. It tells you whether a resource is compliant or has drifted from the desired state.

AWS Artifact — a self-service portal where you can download official AWS compliance reports, certifications, and legal agreements, such as Service Organization Control, or SOC, reports. It is your on-demand compliance document library.

AWS Audit Manager — the service that helps you continuously collect, organize, and manage evidence for your audits. It maps your controls to evidence sources and builds a ready-to-review audit package.

AWS Trusted Advisor — an automated advisor that scans your account and gives recommendations across cost optimization, performance, security, reliability, and service limits. It is like a built-in best-practice coach.

AWS Well-Architected Tool — a guided review tool that helps you measure your workloads against the six pillars of the Well-Architected Framework: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

How CloudWatch differs from CloudTrail. CloudWatch watches the operational health — things like central processing unit, or CPU, utilization, error rates, and log patterns — and can trigger alarms. CloudTrail watches the actions — every API call made — and answers the question, 'Who touched this resource?' They complement each other: one monitors performance, the other audits activity.

How AWS Config differs from CloudTrail. CloudTrail records the API events that caused a change, like 'someone launched an instance.' AWS Config records the resulting state of that resource and checks whether it matches your compliance rules, like 'is this instance using an approved Amazon Machine Image, or AMI?' CloudTrail gives you the audit trail; Config gives you the configuration baseline and compliance score.

How AWS Artifact differs from AWS Audit Manager. Artifact is where you go to grab the pre-built compliance reports and certifications that AWS already holds. Audit Manager is where you go to build your own evidence collection for a specific audit, by mapping your controls to the data sources that prove they are working.

For the exam, remember the one-sentence job of each service. CloudWatch is for monitoring with metrics, logs, and alarms. CloudTrail is for auditing API calls. Config is for resource compliance. Artifact is for downloading compliance reports. Audit Manager is for collecting audit evidence. Trusted Advisor gives you recommendations. The Well-Architected Tool helps you review your architecture against best practices.

Cost Management Services

AWS Budgets lets you set limits on cost, usage, or savings plans and then sends alerts when you cross a threshold or are forecasted to cross it. It is your early warning system for spending.

AWS Cost Explorer gives you a deep dive into your past and current cloud spending. You can filter by service, view trends, and even see a forecast of future costs.

AWS Budgets — a service that monitors your spending against limits you define and proactively notifies you before or when those limits are breached.

AWS Cost Explorer — an analysis tool that helps you understand where your money is going in AWS, identify cost drivers, and predict upcoming bills.

The key difference is that Budgets is about setting thresholds and getting alerts, while Cost Explorer is about interactive analysis and forecasting. Think of Budgets as your alert system and Cost Explorer as your investigation tool.