PART 3 — CONFUSING SERVICE PAIRS (bẫy hay gặp)

Service	Latency	Use case	Retention	Consumer
Kinesis Data Streams	<1s (real-time)	Custom processing, multiple consumers	1-365 days	Your app / Lambda / Firehose
Kinesis Data Firehose	~60s (near real-time)	Load to S3/Redshift/OpenSearch	None (passthrough)	Managed destinations only
Kinesis Data Analytics	Real-time SQL	Query/aggregate streams	Depends on source	Output to another stream
MSK (Kafka)	<1s	Kafka-compatible, higher throughput	Configurable	Kafka consumers

Trigger: "real-time" → Streams. "load to S3/Redshift" → Firehose. "SQL on stream" → Analytics. "existing Kafka" → MSK.

LB	Layer	Best for
ALB	L7 (HTTP/HTTPS)	Web apps, path/host routing, WebSocket, Lambda target
NLB	L4 (TCP/UDP/TLS)	Ultra-low latency, static IP, PrivateLink, millions RPS
GLB	L3 (IP)	Chain 3rd-party firewalls/IDS (GENEVE)
CLB	L4/L7 (legacy)	❌ Never the answer, avoid

Trigger: "static IP" → NLB. "path-based routing" → ALB. "3rd-party firewall" → GLB. "WebSocket" → ALB.

Storage	Protocol	Use case
EBS	Block (attached to EC2)	Single EC2, DB, boot volume
EFS	NFS (Linux)	Shared POSIX filesystem, multi-AZ, Linux EC2/container
FSx Windows	SMB	Windows file share, AD integration
FSx Lustre	Lustre (HPC)	HPC, ML training, S3-linked scratch
FSx NetApp ONTAP	NFS/SMB	Migrate on-prem NetApp
FSx OpenZFS	NFS	Snapshots, clones
S3	Object (HTTP API)	Unstructured data, backup, data lake

Trigger: "Linux + shared" → EFS. "Windows + AD" → FSx Windows. "HPC" → FSx Lustre.

Policy	When to use
Simple	Single resource, no logic
Weighted	A/B test, gradual rollout
Latency	Multi-region, lowest latency for user
Failover	Primary + backup with health check
Geolocation	Content by user country (compliance/licensing)
Geoproximity	Bias traffic by distance + bias factor
Multivalue	Return multiple healthy IPs (poor man's LB)

Trigger: "compliance by country" → Geolocation. "DR" → Failover. "lowest latency" → Latency. "gradual rollout" → Weighted.

Option	Scalability	Transitive	Latency	When
VPC Peering	Low (mesh = N²)	❌ No	Lowest	2-3 VPCs, simple
Transit Gateway	High (hub-and-spoke)	✅ Yes	+small	Many VPCs, hybrid
PrivateLink	N/A (service-specific)	N/A	Low	Expose 1 service privately
VPN (S2S)	Medium	✅ via TGW	Higher (internet)	Hybrid, cheaper
Direct Connect	High	✅ via TGW	Lowest (dedicated)	Hybrid, high BW, consistent

Trigger: "3+ VPCs" → TGW. "expose service to customers" → PrivateLink. "dedicated line" → DX. "peering" chỉ đúng khi 2 VPCs.

Type	Scope	Can DENY?	Use
Identity policy	User/Role/Group	Yes	Grant permissions
Resource policy	Resource (S3 bucket, SQS, KMS)	Yes	Allow cross-account access
SCP	OU/Account (Organizations)	✅ Yes (guardrail)	Deny at org level
Permission boundary	Max permissions for IAM principal	Limits identity policy	Delegation
Session policy	Temporary session (assume-role)	Limits session	Federation

Trigger: "prevent root user" / "block action across OU" → SCP (IAM không làm được).

DB	Use case	Anti-pattern
RDS MySQL/Postgres	Relational, OLTP	Massive scale >64TB
Aurora	Relational + high throughput	Simple small DB (waste)
Aurora Global	Multi-region relational, <1s replication	Primary writes in multiple regions
DynamoDB	Key-value, scale, single-digit ms	Complex joins, relational
DynamoDB Global Tables	Multi-region NoSQL, active-active	Need strong consistency across regions
DocumentDB	MongoDB-compatible	MongoDB-specific features (check)
Neptune	Graph (social, fraud)	Everything else
Timestream	Time-series (IoT, metrics)	Non-time-series
Keyspaces	Cassandra-compatible	Non-Cassandra
QLDB	Immutable ledger, audit trail	Mutable data
ElastiCache Redis	Cache, session, pub/sub	Durable store
MemoryDB	In-memory durable	Cache only (use ElastiCache)
Redshift	Data warehouse, analytics	OLTP