AWS Certified Data Engineer – Associate Cheat Sheet (DEA-C01)
Every in-scope ingestion, transformation, storage and governance service the DEA-C01 exam actually tests — organised by the four exam domains with decision tables and runbooks
About This Cheat Sheet
- 13 pages
- Every in-scope DEA-C01 service
- For ~2 years of data-engineering experience
- 5 reference architectures
- 22 answer-pattern scenarios
- Updated April 2026
Exam domains
Share of the scored DEA-C01 content
- Data Ingestion and Transformation34%
- Data Store Management26%
- Data Operations and Support22%
- Data Security and Governance18%
Services covered
Ingestion & streaming
- Kinesis Data Streams
- Kinesis Data Firehose
- MSK
- MSK Serverless
- MSK Connect
- Managed Service for Apache Flink
- DataSync
- DMS
- Transfer Family
- AppFlow
Transformation & orchestration
- Glue
- Glue DataBrew
- EMR
- Lambda
- AWS Batch
- Step Functions
- MWAA
- EventBridge
- EventBridge Scheduler
Storage
- S3
- S3 Tables
- S3 Glacier
- EBS
- EFS
- AWS Backup
Analytics engines
- Athena
- Redshift
- OpenSearch
Catalog & governance
- Glue Data Catalog
- Lake Formation
- Data Exchange
Show 48 more servicesShow fewer
Migration & offline transfer
- Application Migration Service
- Application Discovery Service
- Snow Family
Containers for custom ETL
- Amazon ECS
- EKS
- ECR
Messaging
- SNS
- SQS
Databases
- RDS
- Aurora
- DynamoDB
- DocumentDB
- Keyspaces
- MemoryDB
- Neptune
Visualisation & AI
- QuickSuite
- Managed Grafana
- SageMaker AI
- Bedrock
- Kendra
- Amazon Q
Security
- IAM
- KMS
- Secrets Manager
- Macie
- WAF
- Shield
- CloudTrail
- Config
Networking
- VPC
- PrivateLink
- Route 53
- CloudFront
- API Gateway
Observability & cost
- CloudWatch
- CloudWatch Logs
- Systems Manager
- Well-Architected Tool
- Budgets
- Cost Explorer
DevOps
- CloudFormation
- CDK
- SAM
- CLI
- CodeBuild
- CodeDeploy
- CodePipeline
- Amazon Q Developer
Feature details
- Kinesis Data Streams
- Shard limits · Enhanced Fan-Out · On-Demand
- Kinesis Data Firehose
- Lambda transform · Parquet/ORC conversion · Dynamic partitioning
- DMS
- Full-load + CDC
- Snow Family
- PB-scale offline
- AppFlow
- SaaS connectors
- Glue
- Data Catalog · Crawlers · Jobs · Workflows · Triggers · Bookmarks · DataBrew · Data Quality DQDL · Schema Registry · Sensitive Data Detection · Glue Studio · Interactive Sessions
- Glue Data Catalog
- Partition projection
- EMR
- EMR Serverless · EMR on EC2 · EMR on EKS · Spark / Hive / Presto / Trino / HBase / Flink · Table formats Iceberg / Hudi / Delta Lake · EMR engine reference
- Step Functions
- Distributed Map
- MWAA
- Airflow-native DAGs
- S3
- Storage classes · Intelligent-Tiering · Lifecycle · Versioning · Object Lock · CRR · Replication Time Control · Access Points · S3 Select deprecation
- S3 Tables
- Managed Iceberg
- Athena
- Workgroups · Federated Query · Athena for Spark · CTAS / UNLOAD
- Redshift
- RA3 · Serverless · DISTKEY / SORTKEY / ENCODE · Spectrum · Zero-ETL · Data sharing · Redshift ML · Streaming Ingestion · Concurrency Scaling · Auto WLM · Materialized views
- OpenSearch
- UltraWarm + Cold tiers · k-NN · Neural plugin
- Lake Formation
- FGAC with LF-Tags · Row/column/cell-level
- DynamoDB
- Streams · Global Tables
- QuickSuite
- 2025 rebrand unifying QuickSight + Q · SPICE · Q for NL BI · Row-level security · Embedded analytics
- AI in pipelines
- SageMaker AI for ML-in-pipeline · Bedrock for enrichment
- VPC
- Gateway/interface endpoints
- Well-Architected Tool
- Data Analytics + ML Lenses
Concepts covered
- Fundamentals
- Structured / semi-structured / unstructured data · OLTP vs OLAP · Batch vs streaming · Lake vs warehouse vs lakehouse · Medallion architecture · ETL vs ELT · Partitioning vs bucketing · Columnar formats Parquet / ORC / Avro
- Streaming patterns
- Lambda vs Kappa architectures · CDC with Zero-ETL · Exactly-once semantics
- Security
- At-rest + in-transit + client-side encryption · Lake Formation FGAC
- Reference architectures
- Serverless lakehouse · Streaming ETL with CDC · Enterprise data mesh · Event-driven batch pipeline · Hybrid ingest for legacy
- Deep dives
- Glue deep dive (job types, bookmarks, Data Quality DQDL) · Redshift performance playbook (physical design, ingest patterns, concurrency + sharing) · Lakehouse table formats (Iceberg / Hudi / Delta)
- Runbooks
- Glue failure · Kinesis lag · Redshift slow query · Athena cost spike
- Exam practice
- 22-scenario answer patterns · 12 common pitfalls · Data quality + lineage + compliance framework · 17-row architectural decision cheatsheet
Built from the official DEA-C01 exam guide; every service on its in-scope list is audited present.
What's Inside
Data Engineering Fundamentals
The core data-engineering concepts and file formats the rest of the sheet builds on.
- Structured / semi-structured / unstructured data
- OLTP vs OLAP; batch vs streaming
- Data lake vs warehouse vs lakehouse
- Medallion architecture (Bronze / Silver / Gold)
- ETL vs ELT; partitioning vs bucketing
- Columnar formats: Parquet as the default, ORC for Hive ecosystems
- Avro for streaming with Schema Registry
Ingestion
Every way to get data into AWS, from real-time streams to SaaS connectors and petabyte-scale offline transfer.
- Kinesis Data Streams shard limits: 1 MB/s in + 2 MB/s out
- Data Streams Enhanced Fan-Out, On-Demand
- Kinesis Data Firehose: Lambda transform + Parquet/ORC conversion + dynamic partitioning
- MSK + MSK Serverless + MSK Connect; AppFlow SaaS connectors
- Managed Service for Apache Flink (Kinesis Data Analytics successor)
- Flink APIs: SQL + DataStream + CEP + windows
- DMS: full-load + CDC, serverless, SCT for schema conversion
- DataSync, Application Discovery + Migration Service
- Transfer Family (SFTP/FTPS/FTP/AS2/WebApp); Snow Family for PB-scale offline
Transformation & Orchestration
The services that transform data and orchestrate pipelines, with Glue and EMR covered feature by feature.
- Glue: Data Catalog, Crawlers, Workflows + Triggers, Bookmarks
- Glue Jobs: Spark + Spark Streaming + Python Shell + Ray
- DataBrew low-code; Data Quality with DQDL; Schema Registry
- Glue Sensitive Data Detection, Glue Studio, Interactive Sessions
- EMR: Serverless + EC2 + EKS; Spark / Hive / Presto / Trino / HBase / Flink
- EMR table formats: Iceberg / Hudi / Delta
- Lambda, Batch, ECS / EKS / ECR for custom ETL
- Step Functions (Standard + Express + distributed Map); MWAA for Airflow-native DAGs
- EventBridge + Scheduler; SNS + SQS
- SQS FIFO for ordering + extended client for >256 KB payloads
Storage
S3 as the analytical data lake, plus the block, file, archive and backup services around it.
- S3 storage classes: Standard, Intelligent-Tiering, IA, One Zone-IA
- Glacier Instant / Flexible / Deep Archive; Lifecycle policies
- Versioning + Object Lock; Replication (SRR / CRR + RTC 15-min SLA)
- Access Points + Multi-Region Access Points; Event Notifications for reactive pipelines
- S3 Tables for managed Apache Iceberg with auto-compaction + snapshot management
- S3 Glacier with Vault Lock for compliance
- EBS gp3 / io2 Block Express, EFS
- AWS Backup org-wide backup plans: EBS / EFS / RDS / Aurora / DynamoDB / FSx / S3
Analytical Engines & Warehouses
The query engines and warehouse features that decide speed and cost: Athena, Redshift and OpenSearch Service.
- Athena: Presto / Trino SQL on S3; Athena for Apache Spark
- Athena workgroups with per-query scan limit + enforced encryption
- Athena Federated Query via Lambda connectors; CTAS / UNLOAD for partitioned output
- Redshift: RA3 managed storage, DC2 fixed, Redshift Serverless pay-per-RPU-second
- DISTKEY / SORTKEY / ENCODE / VACUUM / ANALYZE; Auto WLM with query monitoring rules
- Spectrum over S3 including Iceberg; Zero-ETL from Aurora / RDS / DynamoDB / OpenSearch
- Data sharing across cluster / account / Region; Redshift ML; Streaming Ingestion
- Concurrency Scaling; materialized views + Auto Materialized Views
- OpenSearch Service: UltraWarm + Cold, k-NN + Neural plugin
- OpenSearch SAML SSO; domains + Serverless
Catalog, Lakehouse & Governance
How the lake is catalogued, governed and shared: Glue Data Catalog as central metastore, Lake Formation and AWS Data Exchange.
- Catalog used by Athena, EMR, Redshift Spectrum, Lake Formation, SageMaker
- Crawlers for schema inference
- Partition projection in Athena to avoid catalog partition explosion
- Lake Formation fine-grained access control (row / column / cell) with LF-Tags
- Cross-account + cross-Region sharing; hybrid-mode migration from IAM-only
- Data Exchange for subscribing to third-party data products
- Delivered as S3 datasets, Redshift shares, API, or LF grants
Databases
The relational, NoSQL and graph databases a data engineer reads from or feeds, with their scaling and replication limits.
- RDS: MySQL / PostgreSQL / MariaDB / Oracle / SQL Server / Db2
- RDS Multi-AZ + read replicas + Performance Insights + Blue/Green deployments
- Aurora (compatible MySQL / PostgreSQL): 128 TiB storage auto-growth, 15 read replicas
- Aurora Global Database + Serverless v2 + Zero-ETL to Redshift
- DynamoDB: Streams, GSI / LSI, TTL, Transactions, PITR
- DynamoDB Global Tables active-active, DAX
- DocumentDB (MongoDB-compatible); Keyspaces (Cassandra-compatible serverless)
- MemoryDB for Redis: durable, Multi-AZ transaction log
- Neptune (graph + Neptune Analytics vector + graph); Redshift
Streaming Patterns
The streaming architectures and delivery guarantees exam scenarios turn on, and how to get exactly-once and ordering on AWS.
- Lambda architecture (batch + speed merged view); Kappa architecture (single streaming path)
- Change Data Capture with DMS → Kinesis or Zero-ETL
- Event-driven lake: S3 PUT → EventBridge → Step Functions → Glue → Athena
- Backfill + reconciliation with Iceberg MERGE
- Kinesis at-least-once + idempotent downstream writes (Iceberg MERGE, DynamoDB conditional PutItem)
- Kafka idempotent producer + transactions for exactly-once within one app
- SQS FIFO 3,000 msg/s with message-group exactly-once
Security, Networking & Compliance
Securing data pipelines: least-privilege access, encryption at every layer, private networking and audit trails.
- IAM least-privilege roles for Glue / EMR / Lambda / SageMaker
- Encryption at-rest with KMS customer-managed keys everywhere
- Secrets Manager with rotation for DB + third-party API keys
- Macie for PII in S3; Config managed rules + auto-remediation
- CloudTrail org trail for every Glue / Athena / Redshift Data API call
- In-transit with TLS (rds.force_ssl, Redshift require_ssl); client-side with AWS Encryption SDK
- Column / row masking via Lake Formation and Redshift dynamic data masking
- VPC with private subnets for data stores; free S3 / DynamoDB Gateway endpoints
- PrivateLink interface endpoints for Glue / Athena / Kinesis / MSK / KMS / Secrets Manager / SageMaker
- Route 53, CloudFront, API Gateway with WAF + authorizers; Shield on data-intake APIs
Observability, Reliability & Cost
Monitoring pipelines through the metrics that matter, running them reliably, and the cost levers for each analytics service.
- CloudWatch metrics: Glue bytesRead, Kinesis IteratorAgeMilliseconds, Redshift WLMQueueLength, RDS CPUUtilization
- Alarms: standard + composite + anomaly + metric math; dashboards + Synthetics
- CloudWatch Logs with Logs Insights + subscription filters → Firehose → OpenSearch
- Managed Grafana for unified dashboards; Budgets with actions + Cost Explorer
- Systems Manager: Parameter Store + Patch Manager + Change Manager + Incident Manager
- Well-Architected Tool with Data Analytics + Machine Learning Lenses
- Cost patterns: Parquet + partitioning + compression for Athena
- RA3 + Spectrum + Concurrency Scaling + Reserved Nodes for Redshift
- EMR Serverless or Spot task nodes; S3 Intelligent-Tiering + Lifecycle
- Kinesis On-Demand; Glue Flex + Auto Scaling
Reference Architectures
Five full walkthroughs that assemble the services into complete data platforms, from a serverless lakehouse to hybrid ingest.
- Serverless lakehouse: Firehose → S3 Parquet → Glue PySpark → Iceberg via S3 Tables
- Lakehouse queries: Athena / Redshift Spectrum / QuickSuite
- Streaming ETL with CDC: Aurora Zero-ETL to Redshift, or DMS CDC → Kinesis
- Then Managed Flink → S3 Iceberg with DLQ + backfill
- Enterprise data mesh: domain accounts own data + central governance
- Lake Formation cross-account grants; discovery via SageMaker Unified Studio / QuickSuite / Q Business
- Event-driven batch pipeline: S3 PUT → EventBridge → Step Functions → Glue Data Quality gate
- Batch pipeline output: Athena + SNS alerts
- Hybrid ingest for legacy systems: DataSync + Transfer Family + DMS + Snow Family
- Plus Application Migration Service, all landing in governed S3 / Lake Formation
Scenarios, Pitfalls & Runbooks
Twenty-two scenario → answer mappings, twelve common pitfalls and four runbooks for the failures data engineers actually hit.
- Query: cheap serverless SQL, federated query, natural-language BI, Athena cost, cross-Region warehouse
- Lake: FGAC, ACID on lake, schema evolution for streaming, lineage, reprocessing
- Ingest: near-real-time Aurora→Redshift, SaaS ingest, late-arriving records, deduplication
- Platform: Airflow, replace on-prem Hadoop, batch containers, Kinesis Data Analytics replacement
- Governance: PII classification, rotating secrets, account isolation, cross-account Redshift
- Pitfalls: Firehose vs Streams, Crawler catalog explosion, Athena scan cost, Redshift WLM
- Pitfalls: DMS sizing, EMR Spot placement, Kinesis limits, LF vs IAM, data sovereignty
- Pitfalls: S3 Tables vs DIY Iceberg, Zero-ETL latency, Athena cost explosion
- Runbooks: Glue job failure, Kinesis consumer lag, Redshift slow query, Athena cost spike
Why This Cheat Sheet Helps
DEA-C01 is breadth-heavy: you must pick the right service for each stage of a pipeline — ingest, transform, store, secure, observe — without wasting money or introducing latency. Questions reliably distinguish Firehose from Streams, Glue from EMR, Athena partitioning from Redshift dist-keys, Lake Formation grants from S3 bucket policies, Zero-ETL from DMS CDC, S3 Tables (managed Iceberg) from classic Iceberg on S3. This cheat sheet puts those decisions side by side with the exact AWS vocabulary examiners use.
It assumes you've already written some Spark / SQL / Python on AWS. Use it in the final weeks to reinforce the Glue + Lake Formation + Athena + Redshift core, rehearse the streaming patterns (Kinesis / MSK / Flink / Zero-ETL), and memorise the operational runbooks for the failures the exam loves (Glue OOM / skew, Kinesis consumer lag, Redshift slow query, Athena cost spike).
How to Use It
Skim the whole sheet once to see how the four domains map to sections. Then hammer practice exams — for each wrong answer, find the relevant section and study the tables and decision trees. Pay extra attention to sections 2 (Ingestion), 3 (Transformation + Orchestration), 5 (Analytical engines), 6 (Catalog + Lake Formation), 15 (Scenario → Answer Patterns), 16 (Pitfalls), 17 (Glue deep dive), 18 (Redshift performance), and 22 (Architectural decision cheatsheet).
In the final week, walk through the four domain weights against your confidence: Ingestion & Transformation (34%) → sections 2–3, 9; Data Store Management (26%) → sections 4–7, 19; Operations & Support (22%) → sections 12–13, 20; Security & Governance (18%) → sections 6, 10, 21. Pair with CloudNinja's free DEA-C01 practice exam to surface gaps.
Frequently Asked Questions
Is this AWS Data Engineer Associate cheat sheet free?
Yes, completely free with no signup required. Download the PDF directly from CloudNinja and use it as a study reference for the DEA-C01 exam.
How much experience do I need before DEA-C01?
AWS recommends 2–3 years of data-engineering experience (ideally on AWS) and 1–2 years of hands-on AWS. You should be comfortable writing SQL and Python / PySpark, using S3 + Glue + Athena, and understanding at least one streaming technology (Kinesis or Kafka). If you do not already hold Solutions Architect Associate or have production data-pipeline experience on AWS, build that foundation first.
How is DEA-C01 different from the Solutions Architect Associate?
SAA-C03 spans all AWS services and tests which service fits a use case; DEA-C01 goes deep on the data lifecycle. Expect detailed decisions: Glue vs EMR vs Lambda for a given transform, Firehose vs Streams for an ingest pattern, Lake Formation row-level vs column-level grants, Iceberg vs Hudi, Redshift DISTKEY vs SORTKEY choices, Zero-ETL vs DMS CDC, S3 Tables vs classic Iceberg. Questions are scenario-heavy and lean on tradeoffs around cost, latency, and operational overhead.
Is this cheat sheet updated for the current DEA-C01 exam?
Yes, it is built directly from the current DEA-C01 exam guide (data-engineer-associate-01) and audited against the full in-scope services list. It reflects current services and recent changes — Amazon S3 Tables (managed Apache Iceberg), Amazon QuickSuite (the 2025 unification of QuickSight + Amazon Q), Zero-ETL integrations (Aurora / RDS MySQL + PostgreSQL / DynamoDB / OpenSearch to Redshift), Amazon Managed Service for Apache Flink as the successor to Kinesis Data Analytics, Redshift Streaming Ingestion, Glue Data Quality DQDL, Amazon Q Developer, and the S3 Select deprecation for new customers.
Keep Studying
Recommended courses
Affiliate links — if you enrol through them, CloudNinja may earn a commission at no extra cost to you.