Advanced AWS

Cut AWS cost by committing to Savings Plans for steady workloads, Spot for interruptible batch, right-sizing from CloudWatch metrics, S3 lifecycle tiering for old data, and shutting off dev/test when idle.

Trace the Transit Gateway path hop by hop in both directions -- source route, attachment, association, propagation, destination route, Security Groups, NACLs, and the return path -- because routing only works when both directions do.

You cannot grow a subnet in place because its range is fixed and in use; you add a secondary CIDR to the VPC, build new subnets, and migrate workloads into them gradually.

Use many AWS accounts to isolate blast radius, governed centrally by AWS Organizations with Service Control Policies and accessed through SSO, because one big account gives a mistake or breach unlimited reach across everything.

DR runs from cheap-and-slow to costly-and-instant -- Backup and Restore, Pilot Light, Warm Standby, Multi-Site Active-Active -- and you pick based on RPO (how much data you can lose) and RTO (how long you can be down).

The Well-Architected Framework is a six-pillar best-practice checklist -- Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, Sustainability -- that you review before production to catch risks while they are still cheap to fix.