Night 22 — Week 3 review: databases, DR, migration, hybrid networking

~2 hr. $0–low spend — paper architecture + timed quiz. No new AWS deploy tonight. Synthesizes Nights 15–21 before Week 4 (ElastiCache, Athena, Route 53).

Plain language first

What Week 3 was about

Week 3 moved from “how do packets move in a VPC?” (Week 2) to “where does data live, how do we protect it, move it, and reach it from on-prem?”

Tonight you connect the dots — one diagram, one quiz, one teardown decision.

Block 1 (~20 min) — Draw the 3-tier stack (exam artifact)

Assignment: On one page (paper or Excalidraw), draw GSA’s study stack as a classic three-tier web app in a 2-AZ VPC. Label every box. Time yourself: 15 minutes draw, 5 minutes explain aloud.

Reference architecture (draw from memory, then compare)

                         Internet / users
                               │
                               ▼
                    ┌──────────────────────┐
                    │  Route 53 (optional) │
                    └──────────┬───────────┘
                               │
         ┌─────────────────────▼─────────────────────┐
         │  VPC 10.0.0.0/16 (Night 9 — saa-study-gsa-vpc) │
         │                                                 │
         │  public-a / public-b (10.0.1.0/24, 10.0.2.0/24) │
         │       │ IGW route 0.0.0.0/0                      │
         │       ├── NAT Gateway (one AZ — exam cost trap)   │
         │       └── ALB (internet-facing) ────────────────┼──► WAF (optional, Night 4)
         │              │ listener :443                     │
         │              │ target group                       │
         │  private-a / private-b (10.0.11.0/24, 10.0.12.0/24) │
         │       │ route 0.0.0.0/0 → NAT (outbound only)    │
         │       ├── Fargate tasks OR Lambda (wiki API)      │
         │       │      SG: egress to Aurora :5432           │
         │       │      SG: egress to S3 via gateway endpoint│
         │       ├── Aurora Serverless v2 cluster            │
         │       │      subnet group → both private subnets  │
         │       │      aurora-sg ← lambda-stats-sg :5432    │
         │       │      no public accessibility              │
         │       └── (prod) DynamoDB — regional, no VPC ENI  │
         │                                                 │
         │  S3 gateway endpoint on private route table     │
         │  (Night 8/10 — skip NAT for S3)                   │
         └─────────────────────────────────────────────────┘

Optional hybrid overlay (Night 21 — annotate in a second color):
  On-prem 192.168.0.0/16 ──DX or Site-to-Site VPN──► TGW or VGW ──► same VPC

Checklist — every label the SAA exam expects

Three sentences to practice out loud

1. “Users hit the ALB in public subnets; application tier runs private; database tier runs private with no public accessibility.”
2. “Lambda in the VPC needs NAT (or VPC endpoints) to reach Secrets Manager and the internet; S3 uses a gateway endpoint so traffic stays on the AWS backbone.”
3. “Wiki counters live in DynamoDB for scale; relational resort_stats with JOINs live in Aurora — different access patterns, different stores.”

Block 2 (~40 min) — Week 3 domain recap

Database ladder (Nights 15–18)

Need SQL JOINs + ACID?
  └─ Aurora/RDS in private subnets (Nights 15–17)

Need simple key-value counter at huge scale?
  └─ DynamoDB (Night 18)

Too many Lambda → DB connections?
  └─ RDS Proxy (Night 15 theory)

Spiky dev workload, PostgreSQL compatible?
  └─ Aurora Serverless v2 — min ACU still billed (not scale-to-zero)

Cross-Region sub-second RPO on Aurora?
  └─ Aurora Global Database — not “promote read replica” alone

DR ladder (Night 19)

Slowest/cheapest → fastest/most expensive:

Backup & restore → Pilot light → Warm standby → Multi-site active-active

AWS Backup = one plan + vault + tag selection across DynamoDB, RDS, EBS. PITR (DynamoDB) = continuous second-level restore — different job, can coexist.

Migration ladder (Night 20)

Cutover: stop writes → wait for CDC lag ≈ 0 → point apps at target.

Hybrid ladder (Night 21)

Block 3 (~60 min) — Timed quiz

File: night-22-quiz.json — 30 scenario questions (~48 min at 96 sec each, or ~40 min if you are warmed up).

Topics span all of Week 3 — database, Aurora lab patterns, DynamoDB, DR, migration, hybrid. Answer without night-22-quiz-answers.json first.

Score on the study site: /aws-solutions-architect-study/quiz/22/ (restart npm run dev after adding new quiz files).

Target: ≥24/30 (80%) before starting Night 23 ElastiCache lab.

Week 3 master map

Teardown checklist (if you are done with Aurora labs)

Keep running if you plan Night 23+ labs that reuse Night 9 VPC, Aurora, or Lambda stats uploader.

Tear down in order when finished studying the database track:

Cost reminders:

• NAT Gateway bills hourly + per GB even when idle — delete if you are pausing study for a week.
• Aurora Serverless v2 bills minimum ACU while cluster exists — Night 16 teardown stops that meter.
• DynamoDB on-demand with a few study rows is pennies — low urgency unless you want a clean account.

Do not tear down (production / other weeks):

• Global Ski Atlas prod wiki tables, CloudFront, or Cognito
• Night 12–14 EventBridge / SQS / SNS stacks if you are continuing Week 2 integration labs
• night-9-vpc-ids.json — back it up before VPC teardown; Night 16–17 setup reads it

5 flashcards (write tonight)

1. Three-tier VPC — Which subnets host ALB, app tier, and Aurora?
   (ALB → public (or private with internal ALB); app + DB → private; DB has no public accessibility.)

2. RPO vs RTO — “We can lose 5 minutes of data but must be online in 1 hour.”
   (RPO = 5 min; RTO = 1 hour.)

3. DMS cutover — What do you check right before switching DNS to the target?
   (CDC replication lag ≈ 0 after stopping writes to source.)

4. VPC peering vs TGW — Dev, Staging, Logging VPCs all need to talk.
   (TGW transitive hub — peering is non-transitive and does not scale to full mesh.)

5. DynamoDB vs Aurora for GSA — wiki viewCount vs resort_stats monthly JOIN reports.
   (DynamoDB counter; Aurora relational SQL.)

Night 23 preview

Lab 3A — ElastiCache (Redis) — cache hot wiki reads in front of Aurora or compare CloudFront TTL at the edge. Redis vs Memcached, cache-aside pattern, and the Lambda-in-VPC tradeoff when the cache lives inside the same Night 9 VPC.

Reference links

• Aurora best practices
• DynamoDB PITR
• AWS Backup getting started
• DMS task types
• Site-to-Site VPN
• Transit Gateway