Compute and Storage Services

Domain 3 (Cloud Technology and Services) carries 34% of the CLF-C02 score, and two of its task statements do most of the work: Task 3.3 "Identify AWS compute services" and Task 3.6 "Identify AWS storage services". Task 3.3 asks you to recognise instance types, containers, serverless options, that "auto scaling provides elasticity" and the purposes of load balancers; Task 3.6 asks you to identify object, block and file services, the differences between S3 storage classes, lifecycle policies and AWS Backup. Add the compute half of Domain 4 Task 4.1, the seven purchasing options, and this single lesson covers material that shows up across two domains.

In this lesson you will:

• decode an EC2 instance name into series, generation, silicon and size;
• map the instance families (M/T, C, R, I/D, P/G/F) to their exam stems;
• work the launch checklist: AMI, instance type, key pair, security group, launch template;
• choose among the seven purchasing options with sourced discount percentages;
• run Auto Scaling arithmetic on min / desired / max and explain why multi-AZ is the default high-availability answer;
• price a Lambda invocation in requests and GB-seconds, and know when Lambda is the wrong answer;
• one-line ECS, EKS, Fargate, ECR, Batch, then place Elastic Beanstalk and Lightsail;
• walk the S3 storage-class lineup, versioning, lifecycle, encryption and static hosting;
• choose an EBS volume type, explain snapshots, and separate EBS from instance store;
• compare EFS vs FSx, place Storage Gateway, know the Snow Family's status, and use AWS Backup;
• decide S3 vs EBS vs EFS in one table;
• study two AWS-published case studies (NASA JPL and Box);
• practise with 10 exam-style questions plus three interactive checks.

October 2026 revision. Beyond the outline above, this lesson now also carries five AWS-published case studies, a sourced 2026 Updates box, 12 practice questions, four interactive checks and eight Did you know? boxes.

---

1. Amazon EC2: the virtual server you actually choose

1.1 What an instance is

AWS defines the building block in one sentence: "An EC2 instance is a virtual server in the AWS Cloud." Amazon EC2 "provides on-demand, scalable computing capacity", and the single most consequential choice you make at launch is this one: "When you launch an instance, the instance type that you specify determines the hardware of the host computer used for your instance." Instance type is therefore not a pricing toggle; it is a hardware decision (CPU generation, memory ratio, local disk, GPU, network) that then determines the price.

EC2 is the textbook IaaS example in the shared responsibility model: AWS owns the host, you own everything from the guest operating system up.

1.2 Reading an instance name: the most testable EC2 skill

AWS publishes a naming grammar: [series][generation][options].[size]. The first position is the series (for example c), the second is the generation (for example 7), letters after that are options, and everything after the period is the instance size.

Option letters:

• a = AMD
• g = Graviton
• i = Intel
• d = instance store volumes attached
• n = network and EBS optimized
• e = extra storage or memory
• z = high CPU frequency

After the dot: small, large, xlarge, 2xlarge … 4xlarge, and metal means bare metal. Two decode rules the exam loves: higher generation = newer hardware, and m7i ≠ m7g: the suffix changes the silicon and the operating-system support, so a Graviton option is not a cosmetic rename.

1.3 Families → workloads

Worked example E1, family from the stem (sourced wording, as of Oct 2026). Read the requirement, pick the letter, then the option: "an in-memory cache that must keep a working set resident" → R (memory optimized) → add g if the workload runs on Linux/Arm → r7g.xlarge. "A pegged-CPU video transcoder" → C → c6g.large. "An intermittent development box that must be cheap when idle" → T → t3.micro. The exam never asks you to name a real instance family list, it asks you to read the stem → category mapping.

1.4 Sizing: four decisions before you click Launch

1. Workload shape → family (balanced / CPU / memory / storage / GPU).
2. Size within the family → the number after the dot; memory-optimized families also carry a size-in-memory suffix.
3. AMI: "provides the software that is required to set up and boot an Amazon EC2 instance" and "you must specify an AMI when you launch an instance". An AMI is pinned to a Region, operating system, architecture, root-volume type and virtualization type, which is why you cannot launch a Windows AMI onto a Graviton instance type.
4. Purchase option and network: covered in §2, plus key pair and security group below.

• 📚 Did you know? The EC2 Free Tier changed era on 15 July 2025. Accounts created before that date kept the classic allowance, 750 hours per month of t2.micro/t3.micro for 12 months plus 30 GB of EBS. Accounts created on or after that date get a credit-based Free plan: $100 at sign-up plus up to $100 more, for 6 months or until the credits run out, on eligible sizes such as t3/t4g.micro, t3/t4g.small, c7i-flex.large and m7i-flex.large. A question stem that quotes "750 hours of t2.micro" is era-dependent, read the date (as of Oct 2026; verify current before use).

1.5 The launch checklist: AMI, type, key pair, security group

Two facts about security groups carry disproportionate weight: they are stateful (return traffic is allowed automatically), and they cannot express a deny: if a question needs "block this IP", the answer is a network ACL (subnet level, allow and deny, stateless), not a security group.

Worked example E2, from requirement to launch inputs. "A web tier needs Linux, balanced resources, and must scale across three AZs." Inputs: AMI = Linux/x86 or Arm image pinned to the Region; family = M (general purpose) or T (burstable, if spiky and cheap-when-idle); size = whatever the traffic model needs; security group = allow inbound 443 from the load balancer's security group (not 0.0.0.0/0 directly), allow all outbound; plus a launch template so an Auto Scaling group can reproduce it. Nothing in that list is optional, an Auto Scaling group without a launch template cannot launch anything.

---

2. The seven EC2 purchasing options

Domain 4 Task 4.1 names them explicitly: "On-Demand Instances, Reserved Instances, Spot Instances, AWS Savings Plans, Dedicated Hosts, Dedicated Instances, Capacity Reservations", plus "Describing Reserved Instance flexibility" and Reserved Instance behaviour in AWS Organizations. This table is the whole skill.

2.1 The purchasing table

⚠️ Reserved Instances are not reserved servers. AWS's own wording is a billing discount, not a box in a rack. Two consequences the exam tests: an AZ-scoped RI also reserves capacity, a Region-scoped RI is a discount only, and Savings Plans provide no capacity reservation at all. If the stem says "guaranteed capacity in AZ X", the answer is an AZ-scoped RI or a Capacity Reservation: never a Savings Plan.

2.2 Reserved Instances vs Savings Plans vs Spot: the three-way tie-breaker

2.3 Worked numeric examples: the arithmetic behind the discounts

Worked example E3: Spot savings (illustrative rate; the discount is sourced). AWS states Spot is available at "up to a 90% discount compared to On-Demand prices" (as of Oct 2026). Exact EC2 On-Demand hourly prices are region-, OS- and time-dependent and were not collected for this lesson, so use a labelled illustrative rate of $0.10 per hour:

Read the ceiling correctly: "up to 90%" is a maximum, not a quote, and you pay it with interruption risk: a two-minute notice, no termination protection, and no Savings Plan coverage.

Worked example E4: Savings Plan / RI savings (sourced ceilings, illustrative spend). Take a steady $1,000 per month On-Demand run rate (illustrative base):

Worked example E5: term arithmetic. A commitment term is a long time, and the exam asks you to feel that:

Before choosing a 3-year Savings Plan, answer one question: will this exact workload configuration still be right in 26,280 hours? If the answer might be "we will switch family or Region", Compute Savings Plans (any family, any Region) or Convertible RIs are the flexible answers; if it might be "we might not need it at all", On-Demand is cheaper than paying for unused commitment; because a Capacity Reservation is charged whether used or not, and an unused Savings Plan commitment simply stops saving.

• 📚 Did you know? The percentage you quote matters as much as the option. AWS publishes up to 72% (Standard RI, EC2 Instance Savings Plan), up to 66% (Compute Savings Plan, Convertible RI), up to 35% (Database Savings Plans), up to 64% (SageMaker AI Savings Plans) and up to 90% (Spot): all as of Oct 2026. A separate AWS cost-optimization page still shows "up to 75%" for Reserved Instances; that figure is not corroborated anywhere else in this research, so do not memorise it. Any discount question wants the option name first and a date-stamped number second.

---

3. Auto Scaling: elasticity, min / desired / max, multi-AZ

Task 3.3 lists "Recognizing that auto scaling provides elasticity", so the exam's split of labour is precise: Auto Scaling decides how many instances exist (elasticity), a load balancer decides where the traffic goes. AWS documents that Elastic Load Balancing "automatically distributes your incoming traffic across multiple targets … monitors the health of its registered targets, and routes traffic only to the healthy targets."

3.1 The three numbers

AWS's documented configuration, minimum four, desired six, maximum twelve, is worth memorising as a shape: min ≤ desired ≤ max is a hard invariant, and any option that puts desired above max (or min above desired) is invalid on its face.

3.2 Why multi-AZ is the high-availability answer

An Auto Scaling group spans Availability Zones; when one AZ degrades, the group launches replacements in the healthy AZs and rebalances. This is the standard Domain 3 pattern: multi-AZ = survive an AZ failure, multi-Region = survive a Region failure. Lifecycle order matters too: an instance goes launch → health check → InService, and AWS notes that an Auto Scaling group with a load balancer attached registers the instance with the load balancer before marking it InService, so traffic never reaches an unready instance.

Worked example E6: min / desired / max under pressure. Using AWS's documented group (min 4, desired 6, max 12) spread across three AZs (2 + 2 + 2):

Two exam points fall out of that arithmetic: the maximum is a hard ceiling that protects your budget, and the minimum is a hard floor that protects your availability: neither replaces the other.

---

4. AWS Lambda: serverless and event-driven

AWS defines it flatly: "AWS Lambda is a serverless compute service. With Lambda, you can run code without provisioning or managing servers." AWS owns "server maintenance, capacity provisioning, scaling, and patching"; you supply code plus configuration. It is event-driven: "Events can trigger a Lambda function in two ways: through direct invocation (push) and event source mappings (pull)."

4.1 What Lambda actually charges for

AWS's guidance on fit is blunt: Lambda is "best-suited for short invocations that last one second or less." Stateful, long-lived or always-on processes are the classic wrong answer.

Worked example E7: a Lambda micro-bill (sourced rates, as of Oct 2026). 2,000,000 requests per month, each running 100 ms at 1,024 MB (1 GB):

Worked example E8: the Always-Free ceiling (sourced). How much continuous execution does 400,000 GB-seconds actually buy?

The lesson the exam wants: idle costs nothing, running costs GB-seconds. A function that runs once a day for 50 ms is nearly free; the same logic that makes Lambda cheap makes it the wrong home for a process that must hold state for hours.

• 📚 Did you know? AWS's Capital One case study on Lambda and ECS reports that one application cut its cost by 90% after moving to Lambda, with checks running 80% faster using AWS Step Functions, and describes more than a third of Capital One's applications as serverless (aws.amazon.com/solutions/case-studies/capital-one-lambda-ecs-case-study, accessed Oct 2026; customer-claimed, unaudited). The exam-shaped reading is architectural: event-driven plus idle-costs-nothing is why a workload belongs on Lambda at all, and a figure such as 90% is that customer's result, never an AWS guarantee.

---

5. Containers: ECS, EKS, Fargate and ECR

Task 3.3 expects four one-liners, and the exam recombines them constantly:

Two responsibility distinctions carry most of the marks. Fargate vs EC2 launch type is about who manages the nodes, not about speed: with Fargate there are no instances to patch (per-task billing, 1-minute minimum); with the EC2 launch type you patch, scale and choose instances, and RI/Savings Plan/Spot discounts apply to those instances. ECS vs EKS is about portability vs a cluster fee: ECS is AWS-native with no orchestration fee; EKS gives you standard Kubernetes for a per-cluster hourly fee.

Worked example E9: Fargate and EKS arithmetic (sourced rates, us-east-1, as of Oct 2026).

That comparison is the exam's favourite container question: EKS costs extra for the managed control plane; ECS does not, and neither includes the cost of your nodes.

• 📚 Did you know? The Toronto AI startup WOMBO told AWS that it managed 12,000 GPUs while its apps drew 74 million downloads in 10 months across more than 180 countries, quoting: "Our infrastructure has been largely on autopilot. Using Amazon ECS definitely saves a lot of time for us." (aws.amazon.com/ecs/customers and aws.amazon.com/fargate/customers, accessed Oct 2026; customer voice). The exam-shaped detail is the pairing behind that quote, ECS as the AWS-native orchestrator with Fargate as the serverless engine, plus the reminder that viral scale first arrives as a traffic problem, which elasticity (§3) absorbs long before it becomes a purchasing problem (§2).

---

6. Elastic Beanstalk and Lightsail: PaaS and VPS

The expected arc on the exam is start simple, then grow: a personal blog or a small internal tool starts on Lightsail or Elastic Beanstalk; when you need Auto Scaling, VPC-level networking, Spot or Savings Plans, you move to EC2 with a launch template and an Auto Scaling group. AWS Batch is the fourth option in this family: queued containerised jobs that AWS scales for you on Spot or On-Demand capacity.

---

7. Amazon S3: object storage, classes, versioning, lifecycle

Task 3.6 opens with "Identifying the uses for object storage" and "Recognizing the differences in Amazon S3 storage classes". AWS defines the anatomy: "An object is a file and any metadata that describes the file. A bucket is a container for objects." Objects are addressed by key (plus an optional version ID) inside a bucket whose name is globally unique and whose Region is fixed at creation. A bucket is private by default, with Block Public Access on and ACLs off; the bucket policy ceiling is 20 KB. The maximum object size is 50 TB (raised from 5 TB on 2 December 2025); a single PUT is 5 GB.

Durability is the number to quote: 99.999999999% (11 nines) across a minimum of three Availability Zones by default: durability and availability are different things, and One Zone-IA proves it.

7.1 The storage-class lineup

Intelligent-Tiering is the only class that moves objects for you: 30 days without access → Infrequent Access tier, 90 days → Archive Instant Access (still millisecond), plus opt-in Archive (≥90 days) and Deep (≥180 days) tiers. It charges a monitoring fee of $0.0000025 per object per month and no retrieval fees, so it is perfect for unknown patterns and wrong for millions of tiny objects.

Glacier retrieval speeds (as of Oct 2026): Instant = milliseconds; Flexible = Expedited 1 to 5 minutes, Standard 3 to 5 hours, Bulk 5 to 12 hours and free; Deep Archive ≈ 12 hours / 48 hours. Note that AWS says "We don't recommend using the Amazon Glacier service": the examinable answer is the S3 Glacier storage classes, not a separate legacy service.

7.2 Versioning, lifecycle and replication

• Versioning has three states (disabled, enabled, suspended) and "can never return to an unversioned state". Deleting an object creates a delete marker; overwriting creates a new version; every version is charged in full, which is why lifecycle rules need a NoncurrentVersionExpiration action.
• Lifecycle rules have transition actions (move to another class) and expiration actions: "Amazon S3 deletes expired objects on your behalf". The model is a one-way waterfall: Standard → IA / Intelligent-Tiering / One Zone-IA → any Glacier class; One Zone-IA → Glacier only; Instant → Flexible → Deep; Deep Archive can go only one way.
• Replication (CRR/SRR) requires versioning enabled on both buckets, skips pre-existing objects unless you use Batch Replication, and S3 Replication Time Control guarantees 99.99% of new objects within 15 minutes (SLA). Deletions replicate, so replication is not a backup.

7.3 Encryption and static websites

SSE-S3 is the default encryption configuration for every bucket (since 5 January 2023) and costs nothing extra; SSE-KMS adds per-key cost and control, SSE-C brings your own key, and DSSE-KMS is double encryption. For EBS you cannot encrypt an existing unencrypted volume or snapshot in place. For hosting: an S3 static website needs an index document, Block Public Access off and a public-read s3:GetObject grant, and "static websites support only HTTP endpoints", so HTTPS requires CloudFront.

Worked example E10: one terabyte-month across classes (us-east-1, as of Oct 2026). Storage-only, 1,000 GB, ignoring requests:

S3 request prices (same region and date): PUT/COPY/POST/LIST $0.005 per 1,000, GET $0.0004 per 1,000, DELETE free.

• 📚 Did you know? The 30-day rule has two halves that moved independently. AWS's storage guidance (updated 5 October 2026) says S3 "no longer applies a 30-day minimum storage duration for transitions" into Standard-IA and One Zone-IA; you may transition on day 0. But the 30-day minimum storage duration billing rule for IA classes is still published on the pricing pages. Moving on day 10 and deleting on day 20 still bills you the full 30 days (as of Oct 2026; verify current before use).

---

8. Amazon EBS and instance store: block storage

Task 3.6 names the pair: "Identifying block storage solutions (for example, Amazon EBS, instance store)". Block storage is low-latency, single-attach, OS-filesystem storage: the disk your instance sees as /dev/xvda.

Amazon EBS is a "durable block volume" for EC2. Two structural facts: a volume is scoped to an Availability Zone (it is "automatically replicated within its Availability Zone") and may be attached to up to 16 instances only if they are io1/io2 in the same AZ (Multi-Attach, and the application must fence writes). Durability is not S3's 11 nines: io2 Block Express provides 99.999%, other volume types 99.8% to 99.9%.

8.1 Volume types

List prices published for gp3 $0.08/GB-month, gp2 $0.10, io1/io2 $0.125 (plus IOPS charges), st1 $0.045, sc1 $0.015: as published Oct 2026; the page states no Region, so verify current before use in your Region.

8.2 Snapshots

A snapshot is "an incremental backup" stored in S3, but invisible to S3 tools: you cannot see snapshots as S3 objects, list them in a bucket, or pay S3 request rates for them. They are replicated Region-wide (unlike volumes, which are AZ-bound). Critically, "AWS does not automatically back up your EBS volumes", you must use Amazon Data Lifecycle Manager, AWS Backup, or a manual script. Snapshot prices (as of Oct 2026): $0.05 per GB-month standard, $0.0125 per GB-month archived (90-day minimum), restore from archive $0.03 per GB.

8.3 Instance store vs EBS

Worked example E11: gp3 vs gp2 and snapshot archive (published prices, verify region).

• 📚 Did you know? gp3's baseline is size-independent: 3,000 IOPS and 125 MiB/s "at any volume size". Under the older gp2 model you needed a 3,000 GB volume to get 3,000 IOPS, because IOPS scaled at 3 per GB; which is why AWS describes gp3 as "up to 20% lower pricing per GB than existing gp2" while also being faster out of the box (as of Oct 2026).

---

9. File, hybrid and backup: EFS, FSx, Storage Gateway, Snow Family, AWS Backup

9.1 EFS versus FSx: the file answer

Task 3.6 says "Identifying file services (for example, Amazon EFS, Amazon FSx)".

EFS durability is 11 nines with 99.99% availability on the Regional class across ≥3 AZs; its lifecycle classes Standard → IA → Archive apply automatically after 90 days idle, with a 90-day minimum storage duration for Archive.

Worked example E12: EFS sizing (us-east-1, as of Oct 2026).

9.2 Storage Gateway: the hybrid, cached answer

AWS describes it as a service that "connects an on-premises software appliance with cloud-based storage", and task 3.6 explicitly names "cached file systems (for example, AWS Storage Gateway)".

9.3 Snow Family: status matters more than specs

AWS Snowball Edge is no longer available to new customers, closed to new customers on 7 November 2025, and AWS states: "On December 31, 2026, AWS will discontinue support for AWS Snowball devices in all AWS commercial Regions." The device itself offered roughly 210 TB on a Storage Optimized unit, with transfer jobs completed within 360 days. Crucially, the Snow Family appears on neither the in-scope nor the out-of-scope list in the current CLF-C02 guide, so it is context, never a correct answer. AWS's directed alternatives for large offline moves are AWS DataSync, Data Transfer Terminal and AWS Outposts.

9.4 AWS Backup: one policy engine for everything

Task 3.6 names "Understanding use cases for AWS Backup". It is a central, policy-driven backup service: plans select resources (typically by tag), vaults hold the copies (KMS-encrypted), and AWS Backup Vault Lock provides write-once-read-many (WORM) protection. Backups are incremental and can move warm → cold, run cross-Region and cross-account, and report through AWS Backup Audit Manager. It covers EC2/EBS, S3, EFS, FSx, RDS, DynamoDB and Storage Gateway volumes, but it "does not govern backups you take … outside of AWS Backup", and it is additive: it duplicates native snapshot mechanisms, so it costs money on top of them.

Retention numbers (as of Oct 2026): 1 day to 100 years for snapshots; 1 to 35 days for continuous PITR; cold tier minimum 90 days; a resource must sit in warm for at least 8 days before moving to cold. Companion service: AWS Elastic Disaster Recovery does "continuous block-level replication" with an RPO of seconds and an RTO typically 5 to 20 minutes: the pilot-light answer for whole servers.

Worked example E13: backup retention arithmetic (sourced rule). Cold-tier backups must be retained at least 90 days after the cold transition, and warm retention must be ≥8 days:

• 📚 Did you know? AWS Backup and native snapshots solve different problems. A snapshot is a mechanism (incremental, Region-wide, $0.05/GB-month as of Oct 2026); AWS Backup is governance: tag-based selection across accounts, one retention schedule, Vault Lock for WORM compliance, and cross-Region copies. A question asking "how do you apply one backup policy across 40 accounts" is asking for AWS Backup, not for a script that calls CreateSnapshot 40 times.

---

10. S3 vs EBS vs EFS: the decision table

Task 3.6's three data models are the fastest way to score here: block = low-latency, single instance/container; file = hierarchical, shared, NFS/SMB; object = API-addressed, key + metadata, cheapest at scale.

Reusable rule of thumb: one instance and an OS filesystem → EBS; many instances need the same files → EFS/FSx; anything you would email, host statically or archive → S3; on-premises without re-architecture → Storage Gateway; one cross-service, tag-driven, WORM-capable policy → AWS Backup.

2026 Updates (as of October 2026)

---

Real-World Case Studies

AWS publishes what these patterns look like in production. Every figure below is customer- or AWS-claimed and unaudited, quoted with its source so you can check it: the examinable point is the pattern (which purchasing option was chosen, which storage tier moved, which number), not the marketing.

Case A, NASA JPL: Auto Scaling with Spot, On-Demand and Capacity Reservations

Exam lesson: the answer to "which purchasing option" is often a blend, not one option. Spot's 90% is a ceiling, and it only works where the job is fault-tolerant and checkpointable; which is exactly why NASA's HPC-style processing is eligible and a stateful transactional database is not.

Case B, Box: Well-Architected cost optimization, mostly in storage

Exam lesson: this is Domain 4's cost pillar expressed in Domain 3 services. "We moved infrequent objects to a colder class and tidied EBS snapshots" is the same decision as our §7 and §8 tables, and note that the free lever (architectural best practice, Well-Architected review) produced the largest share of the savings.

What the two cases share

• 📚 Did you know? Amazon S3 itself is a 20-year-old case study: AWS launched it on 14 March 2006 with roughly 1 PB of capacity across about 400 storage nodes in 15 racks, a 5 GB maximum object size and a price of 15 cents per gigabyte; AWS reported on 13 March 2026 that the price today is "slightly over 2 cents per gigabyte", about an 85% reduction, while "the code you wrote for S3 in 2006 still works today, unchanged" (aws.amazon.com/blogs/aws, accessed Oct 2026). Today's maximum object size is 50 TB, a 10× increase made on 2 December 2025.

Three further AWS-published stories follow, and the caution above governs every number in them.

Case C, Canva: one workload, three purchasing options

Exam lesson: this is §2's tie-breaker run as an operating model, and note that Canva kept Reserved Instances as a fallback rather than a first choice, which mirrors AWS's current guidance to prefer Savings Plans over Reserved Instances. The 46% is Canva's measured result; AWS never guarantees it.

Case D, Shutterfly Business Solutions: 400 TB of objects plus a file-service lift-and-shift

Exam lesson: FSx shows up in a real migration as exactly the stem §9.1 teaches, "lift-and-shift an existing file service", while the ~25% opex cut from right-sizing and licence avoidance is Domain 4's cost pillar appearing inside a Domain 3 migration. The VMware bridge was a step, not the destination: the end state was native AWS.

Case E, FarEye: three compute levers stacked in one story

Exam lesson: −65% is FarEye's result, never an AWS guarantee, and Graviton savings are not free: the g in c7g means Arm-compatible images and code (§1.2), so "just move everything to Graviton" ignores the compatibility trap entirely.

Where all five stories land in this lesson

All figures above are customer-claimed or AWS-published and unaudited (accessed Oct 2026): attribute them to the case study, never to an AWS guarantee.

---

Practice Questions