DVA-02-Notes/.agents/tasks/dva-notes-review.md

DVA-C02 Notes Review: Findings Report

Scope: all 33 markdown files in c:\src\repos\DVA-02-Notes (read-only review; nothing modified). Images checked: ACM/terminating_diagram_at_alb.png, ACM/terminating_ssl_e2e.png, Route 53/route_53_routing_example.png all exist.

Severity key: high = factually wrong, medium = misleading/incomplete (likely to cost exam points), low = typo/formatting.

Summary answer

Yes, there are several real errors. The most important ones:

1. VPC is "Virtual Private Cloud", not "Virtual Private Connection" (VPC/_VPC.md), and the description actually describes VPC peering / VPN, not a VPC.
2. ACM pricing is wrong (ACM/_ACM.md): imported certificates are not $400/month. ACM public and imported certs are free; the $400/month is AWS Private CA (per private CA). "Public vs Private" is also conflated with "ACM-issued vs imported".
3. Elastic Beanstalk deployment policies are described incorrectly (_Concepts/Deployments.md): All-at-once doesn't recreate instances; Immutable and Traffic Splitting use a temporary ASG behind the same load balancer (not a new ELB); the policy is "Traffic splitting", not "Traffic Shifting"; Blue/Green swaps environment CNAMEs.
4. CodeDeploy blue/green does not support on-premises instances (_Concepts/Deployments.md says "EC2 / On-Prem, Lambda & ECS").
5. Route 53 is not a CloudFront origin (CloudFront/_CloudFront.md).
6. AppSync auth list is incomplete: missing OpenID Connect and AWS Lambda authorizers (5 modes, a common exam question).
7. Outdated info: CodeCommit is back to GA (since 24 Nov 2025), X-Ray SDKs/Daemon entered maintenance mode on 25 Feb 2026 (OpenTelemetry recommended), CloudFront Functions are no longer "only ES 5.1", OAI is "legacy" rather than "not available".
8. REST is not "a kind of CRUD" (_Concepts/Glossary/REST.md). This contradicts CRUD vs REST.md.
9. About 15 broken wiki-links, including CodePipeline's "Build" stage linking to CodePipeline itself instead of CodeBuild.

---

Evidence, by file

_Concepts/Deployments.md

#	Snippet	Problem	Correct info	Sev
D1	[[_Elastic BeanStalk|_Elastic BeanStalk]] (line 4)	Broken link; no Elastic Beanstalk note exists.	Create _Elastic BeanStalk.md or remove the link.	low
D2	CodeDeploy In-place: "Stops apps on every instance"	Misleading. Instances are taken down according to the deployment configuration (CodeDeployDefault.OneAtATime, HalfAtATime, AllAtOnce, or custom minimum healthy hosts), not all at once.	Note the deployment configs and minimum healthy hosts.	medium
D3	CodeDeploy Blue/Green scope: "EC2 / On-Prem, Lambda & ECS"	Wrong: AWS says EC2/On-Premises blue/green "work with Amazon EC2 instances only" (CodeDeploy docs).	Scope: EC2 (not on-prem), Lambda, ECS.	high
D4	CodeDeploy Blue/Green description ("Make a new set of instances…")	Only true for EC2. For Lambda and ECS, blue/green means traffic shifting between versions/task sets using Canary, Linear, or AllAtOnce configs (e.g. LambdaCanary10Percent5Minutes, ECSLinear10PercentEvery1Minutes). This is heavily tested.	Add a Lambda/ECS row with canary/linear/all-at-once.	medium
D5	EB All at Once: "Recreates the instances and boots them again"	Wrong. All-at-once deploys the new version to the existing instances simultaneously; no new instances are created.	"Deploys to all existing instances at once; short downtime; fastest; no extra cost."	high
D6	EB Rolling with Additional Batches: "switch out the old instances over time until one is left, which you discard"	Misleading. EB launches one extra batch first so full capacity is kept, then deploys in batches to existing instances. At the end the extra batch's worth of instances is terminated. Impact should read "full capacity maintained, small extra cost".	See EB deployment policies.	medium
D7	EB Immutable: "spin up an entire extra Auto Scailing Group, then once ready, point the ELB to the new ASG. The safest… because the old instances remain."	EB creates a temporary ASG behind the same load balancer. Old and new serve together, then new instances move to the original ASG and old instances are terminated. It's "safest" because rollback is just terminating the new instances. Typo "Scailing".	See Immutable updates.	medium
D8	EB Blue/Green: "You spin up an entire extra ELB, then switch out the URLs."	Blue/green in EB means cloning a whole separate environment (its own ASG, LB, etc.) and doing Swap Environment URLs (a CNAME swap). It isn't a built-in deployment policy.	"New environment, then swap CNAMEs; Route 53 weighted records also possible."	medium
D9	EB "Traffic Shifting": "spin up and extra ELB, the split the traffic"	Wrong name and mechanism. The policy is Traffic splitting (canary). It launches new instances in a temporary ASG behind the same load balancer and sends a set percentage of traffic to them for an evaluation period. Typos "and extra", "the split".	See AWS What's New, 2020 and the EB docs above.	high
D10	"the reregistered", "replace and existing instance"	Typos ("then re-registered", "replace the existing instances").		low
D11	Five empty rows and a dotted row at the end of the table	Formatting leftovers.	Remove them.	low

_Concepts/CRUD vs REST.md

• Content is fine. Note that REST.md contradicts it (see below). (medium, inconsistency)

_Concepts/Glossary/REST.md

• "A kind of CRUD": wrong. REST is an architectural style (stateless, resource-based, uniform interface). HTTP methods often map to CRUD (POST→Create, GET→Read, PUT/PATCH→Update, DELETE→Delete), but REST isn't a kind of CRUD. This contradicts CRUD vs REST.md, which is correct. (medium)

_Concepts/Glossary/HTTPS.md

• "a layer of encryption, either on the Application on IP layer": wrong. HTTPS is HTTP over TLS (sits between the application and transport/TCP layers). IP-layer encryption is IPsec, which isn't HTTPS. Also "on" should be "or". Default port 443 (HTTP is 80) is worth adding. (medium)

_Concepts/Glossary/HTTP.md

• "Web browser protocol": oversimplified. HTTP is an application-layer request/response protocol used by browsers and also by APIs (REST, GraphQL, AWS APIs). (low)

_Concepts/Glossary/VPN.md

• "Secures connections between two networks": incomplete. A VPN can also connect a single client to a network (client VPN versus site-to-site). (low)

_Concepts/Glossary/API.md, AWS.md, CRUD.md, SQL.md

• No errors. AWS.md heading # [[AWS]] links to itself (harmless). (low)

README.md

• No issues.

ACM/_ACM.md

#	Snippet	Problem	Correct info	Sev
A1	# Amazon Certificate Manager	The service is AWS Certificate Manager.		low
A2	"1. Public - Certificates provided by ACM (Free) 2. Privates - Certificates you import ($400 / month)"	Wrong. Two separate ideas are mixed up. (a) ACM-issued public certs used with integrated services are free. (b) Imported certs are also free to manage in ACM. (c) Private certs come from AWS Private CA, which costs about $400/month per CA (general-purpose mode) plus per-cert fees. ACM docs: no additional charge for certificates you manage with ACM (ACM user guide).	Re-split into: Public (ACM-issued, free) / Imported (free) / Private (via AWS Private CA, paid).	high
A3	"public and private SSL/TLS certificate"	"certificates" (plural).		low
A4	Attachable resources list	Missing the exam-relevant constraint: for CloudFront, the ACM cert must be in us-east-1. For ALB/NLB/API Gateway regional endpoints, the cert must be in the same Region. Also "ELB" should say ALB/NLB (CLB too). Note that ACM-issued certs can't be installed directly on EC2 (except by export, see A6).	Add the Region rule.	medium
A5	[[ELB]] (twice), [[API Gateway]], [[_Elastic BeanStalk|…]]	Broken links. The files are _ELB.md and _API Gateway.md. No Beanstalk note exists.	[[_ELB|ELB]], [[_API Gateway|API Gateway]].	low
A6	E2E: "You can't do this with ACM by itself. You can set up Let's Encrypt for it."	Partly outdated. ACM now supports exportable public certificates (paid) that can be installed on your own servers (ACM public certs doc). Also, ALB doesn't validate target certificates, so a self-signed cert on the instance is enough for ALB→EC2 encryption.	Mention both options.	medium
A7	"Terminating SSL at Load Balancer… beyond the ALB is unencrypted"	Fine, but worth noting that NLB can also do TLS passthrough (TCP listener) for true end-to-end.		low
A8	"on each instances"	"each instance".		low

ALB/_ALB.md, NLB/_NLB.md, S3/_S3.md

• Placeholders with no content, so nothing is wrong. These are core DVA-C02 topics (S3 especially) and are gaps. (medium, coverage gap)

ELB/_ELB.md

• Lists only ALB and NLB. ELB also includes the Gateway Load Balancer and the legacy Classic Load Balancer. (low)

API Gateway/_API Gateway.md

• REST / HTTP / WebSocket flavours are correct.
• [[REST]] and [[HTTP]] link to glossary terms, not to the API Gateway API types, which could mislead. (low)
• Placeholder: missing stages, integration types, caching (TTL default 300s), throttling (10,000 rps / 5,000 burst account default), usage plans/API keys, authorizers. (medium, coverage gap)

AppSync/_AppSync.md

#	Snippet	Problem	Correct info	Sev
P1	# Authorisation: API Key, AWS IAM, Cognito User Pools	Incomplete. AppSync has five auth types: API key, AWS Lambda, IAM, OpenID Connect, Cognito User Pools (AppSync docs). Several can be combined (multiple auth modes). Heading level # is inconsistent with the other ## sections.	Add OIDC and Lambda.	high
P2	"Full request caching: Self explanatory; caches all requests."	Oversimplified. AWS describes it as caching each resolver's result separately for all resolvers invoked during a request, keyed by request context (AppSync caching, API ref).		medium
P3	"Caching isn't serverless; you must provision an on-demand instance."	"On-demand" is misleading. You choose a cache instance type (dedicated, ElastiCache-backed) that's billed hourly while it exists.		low
P4	"Resolvers… used to implement the state-changing operations"	Resolvers fulfil all operations, reads (queries) included. Also missing: unit vs pipeline resolvers.		medium
P5	API Types: GraphQL APIs, Merged APIs	Missing AppSync Event APIs (WebSocket pub/sub, launched in 2024) (Event API docs). "a collection of Graph APIs" should be "source GraphQL APIs".		low
P6	Data sources	Fine. Could add the "None" data source (local resolvers). The RDS entry is really Aurora via the RDS Data API.		low
P7	"Resolvers attached to specific fields"	Grammar: "are attached"; "used" should be capitalised.		low

AppSync/GraphQL.md

• "GraphQL is an FOSS agnostic query adaptor": imprecise. GraphQL is an open-source query language and runtime specification for APIs. "adaptor" is the wrong word. (low)
• "composed on" should be "composed of". "Allow for data to be create" should be "created". (low)
• The Fields bullet is empty. (low)
• The examples don't match: the schema defines Query { me: User } and User { id, name }, but the query uses currentUser { name age }. age isn't on User and currentUser isn't a Query field. createUser and newPerson aren't defined either. This would fail validation. (low/medium)
• Missing: GraphQL APIs typically use one endpoint with POST. (low)

Athena/_Athena.md

• The analogy suggests the catalog decides which "boxes" to open. Data skipping actually comes from partitioning (partition pruning) and columnar formats (Parquet/ORC) with compression. The Glue Data Catalog stores schema and location. (medium)
• "query any book in any format (CSV, JSON, Parquet)": overstated. Athena supports specific SerDes/formats (CSV/TSV, JSON, Parquet, ORC, Avro, Ion, logs, etc.), not any format. (low)
• "never alters the original books": mostly true for standard tables, but Athena can write results/CTAS/INSERT INTO, and with Apache Iceberg tables it supports UPDATE/DELETE/MERGE. (low)
• Missing exam facts: serverless (Trino/Presto engine), priced per TB scanned, query results written to S3, workgroups for cost control. (medium, coverage gap)
• Typo: "a box contains fictions" should be "fiction". (low)

CloudFront/_CloudFront.md

#	Snippet	Problem	Correct info	Sev
C1	"Origin… Examples include: S3, EC2, ELB, Route53."	Wrong. Route 53 is DNS and can't be an origin.	Origins: S3, ALB/ELB, EC2, API Gateway, Lambda function URLs, MediaStore/MediaPackage, any custom HTTP server.	high
C2	Origin Request row use cases "Add security headers (CSP/HSTS), set cookies…, customise error messages" vs. Origin Response row "Rewrite URLs…, inject headers for origin authentication…"	The use cases look swapped. URL rewrites, adding origin-auth headers, and picking the origin by user agent are origin request tasks. Adding security headers and customising error responses are response tasks.		medium
C3	Origin Response description: "After CloudFront receives the request from the origin."	Should say "receives the response from the origin".		low
C4	"Max Memory… L@E 128MB-3,008MB"	Unclear: viewer triggers are fixed at 128 MB, and higher memory applies only to origin triggers. The exact current upper bound (3,008 MB versus Lambda's 10,240 MB) is unverified; the AWS doc page couldn't be fetched (TLS error) and third-party sources disagree.	Write "128 MB (viewer) / up to Lambda max (origin)" and check against AWS comparison page.	low
C5	"Lambda@Edge… JavaScript" / CF Functions "Only supports ECMAScript 5.1"	Outdated. CloudFront Functions runtime 2.0 is ES 5.1 compliant plus some ES6–ES12 features (AWS docs). Runtime 2.0 is also needed for CloudFront KeyValueStore.		medium
C6	CloudFront will failover on: GET, HEAD, and OPTION	Typo: OPTIONS. The status codes (400, 403, 404, 416, 500, 502, 503, 504) are correct. Failover also happens on connection failures/timeouts.		low
C7	"OAI… Lots of drawbacks. Not available anymore."	Overstated. OAI is legacy and AWS recommends OAC, but OAI still works on existing distributions (AWS re:Post KC). Name the drawbacks: no SSE-KMS, no S3 Regions launched after Dec 2022, limited PUT/POST support.		medium
C8	"can stream Videos On Demand using ISS Microsoft Smooth Streaming"	Typo "ISS" should be "IIS". Smooth Streaming is legacy. CloudFront more commonly serves HLS/DASH (e.g. with MediaPackage).		low
C9	"Regional Caches: Compute located in board geographical locations"	"broad". They're larger caches that sit between edge locations and the origin; calling them "compute" is odd. Edge locations are points of presence/caches, not general compute.		low
C10	"Distribution: A collection of Edge locations and Regional Cache…"	A distribution is a configuration (origins, cache behaviours, policies, certs, domain names) that tells CloudFront where to fetch content and how to cache/deliver it. It isn't a set of locations (the price class chooses which locations are used).		medium
C11	"Origin Request always returns:"	Should be "always includes". The list (URL path, body, Host, User-Agent, X-Amz-Cf-Id) is fine.		low
C12	"⚠️ If you are dealing with CORS, you will be setting things here, as this will mess with them."	Unclear. Suggest: "CORS response headers (Access-Control-Allow-*) can be set via a response headers policy (AWS has managed CORS policies). To forward the Origin header to the origin, use an origin request policy."		low
C13	"charged pre request"	"per request".		low
C14	[[AWS WAF]], [[Videos On Demand]], [[ISS Microsoft Smooth Streaming]]	Broken links (no such notes).		low
C15	Managed cache policies list	Correct but incomplete. Also UseOriginCacheControlHeaders and UseOriginCacheControlHeaders-QueryStrings.		low

CloudFront/CloudFront Functions.md

• "Only supports ECMAScript 5.1": outdated (see C5). (medium)
• "They live directly at Edge Locations": correct.

CloudFront/Lambda@Edge.md

• Python and Node.js: correct. "deployed at Regional Edge Caches": correct.
• Missing exam-relevant facts: functions must be authored in us-east-1 and replicated, you must reference a numbered version (not $LATEST or an alias), and there are no environment variables. (medium, gap)

CodeBuild/_CodeBuild.md

• "build tools such as Apache, Maven, Gradle": it's Apache Maven (one tool), not "Apache" and "Maven". (low)
• Workflow step 3 says buildspec.yaml, but the section header says buildspec.yml. The default filename is buildspec.yml. (medium, inconsistency)
• Step 4 "Push into a bucket, or any other AWS SDK action (I think?)": artifacts go to S3. Docker images are pushed to ECR by commands you write (usually in post_build). Also covers reports and cache. (medium)
• Build environments: "If you need specific software, you need to make an image and upload it to ECR and reference it in the pipeline". Not required: you can install software in the install phase (runtime-versions, package managers). Custom images can come from ECR or Docker Hub/other registries and are set on the build project, not the pipeline. (medium)
• Triggers: also webhooks (GitHub, Bitbucket, GitLab) and EventBridge schedules. (low)
• "Scaled automatically": should be "Scales". (low)
• Missing: env (variables, parameter-store, secrets-manager), artifacts, cache, reports sections, finally blocks, VPC config, logs to CloudWatch/S3, default timeout. (low, gap)

CodeCommit/_CodeCommit.md

• No mention of service status. AWS closed CodeCommit to new customers on 25 Jul 2024, then returned it to full GA on 24 Nov 2025 (AWS DevOps blog, InfoQ). Worth noting because study materials from 2024–25 call it deprecated. (medium)
• "HIPPA" should be "HIPAA". (low)
• "No limit on the size of your repositories": matches AWS marketing. Note that Git LFS wasn't supported historically (on the roadmap per InfoQ). (low)
• Missing exam-relevant auth options: HTTPS Git credentials, SSH keys, git-remote-codecommit (GRC), and triggers/notifications (SNS/Lambda/EventBridge). (low, gap)

CodeDeploy/_CodeDeploy.md

• Blue/Green section describes only EC2 (instances and ELB). It's missing (a) EC2 only; on-premises can't use blue/green (docs), and (b) Lambda/ECS blue/green via Canary/Linear/AllAtOnce traffic shifting. (medium)
• Deployment Groups: "A set of EC2 instances or Lambda Functions". For EC2/on-prem it's instances chosen by tags and/or ASGs; for ECS it's an ECS service plus load balancer; for Lambda, the group holds the deployment config/alarms. (low)
• Application: "revision deployment configuration, and group" is missing a comma ("revision, deployment configuration, and deployment group"). (low)
• Missing exam staples: the CodeDeploy agent (EC2/on-prem), appspec.yml location (root of revision) and lifecycle hooks (ApplicationStop, BeforeInstall, AfterInstall, ApplicationStart, ValidateService; Lambda: BeforeAllowTraffic/AfterAllowTraffic), and rollback on CloudWatch alarms. (medium, gap)
• Consistent with Deployments.md on in-place being EC2/On-Prem only (correct).

CodePipeline/_CodePipeline.md

• [[_CodePipeline|Build]]: the "Build" stage links to CodePipeline. It should be [[_CodeBuild|Build]]. (low but misleading)
• [[CodeDeploy||Deploy]] has a double pipe and the wrong target. It should be [[_CodeDeploy|Deploy]]. (low)
• [[_CloudFormation|CloudFormation]]: broken link (no note). (low)
• "Actions are not restricted to specific stages": wrong for Source actions. Source actions can only be in the first stage, and the first stage can only contain source actions. Every pipeline needs at least 2 stages. (medium)
• "Action Groups group several Actions": I couldn't confirm "action group" as an official CodePipeline concept. Actions in a stage run in series/parallel by runOrder. (unverified)
• "invoke a CloudFormation template": better put as "create/update a CloudFormation stack or change set". (low)
• Typos: "The can pull" should be "They can"; "Deploy Actions is a Build Stage" should be "in a Build Stage"; "Pipeline are only limited" should be "Pipelines are". (low)

Lambda/_Lambda.md

• "A Docker container or a runner that runs code for you": misleading. Lambda runs functions in Firecracker microVMs. Container images are one packaging option (zip is the other), but Lambda isn't a Docker container. (medium)
• [[API Gateway|API Gateway]] is broken (file is _API Gateway.md). [[_DynamoDB|DynamoDB]] is broken (no note). (low)
• Placeholder: missing limits (15 min timeout, 128 MB–10,240 MB memory, /tmp up to 10 GB, 1,000 default concurrency, 50 MB zipped / 250 MB unzipped deployment, 6 MB sync payload), versions/aliases, layers, invocation types, DLQ/destinations. (medium, coverage gap)

Route 53/_Route53.md

• "A DNS with AWS Services": Route 53 is a managed DNS service (registrar, authoritative DNS, health checks). (low)
• "Resolve VPC's outside of AWS": misleading. Route 53 Resolver inbound/outbound endpoints let on-premises networks resolve private VPC DNS names (and the reverse), which is hybrid DNS. (medium)
• Missing: routing policies (simple, weighted, latency, failover, geolocation, geoproximity, multivalue, IP-based) and alias vs CNAME (alias works at the zone apex and is free for AWS targets). These are exam staples. (medium, gap)

Route 53/Record Sets.md

• "Record sets are a collection of records which determine where to send traffic": a record set is the set of records with the same name and type (e.g. multiple A values). (low)
• "They are always changed in batch via the API": ChangeResourceRecordSets takes a change batch, which is roughly correct. (low)

Route 53/Route 53 Hosted Zone.md

• Correct overall. Private hosted zones can be associated with one or more VPCs. "Revisit this." is a leftover TODO. (low)

Route 53/Use Cases.md

• "our web backed by ALB" should be "our web app backed by ALB". The image exists. (low)

VPC/_VPC.md

• "Virtual Private Connection": wrong. VPC is Virtual Private Cloud, a logically isolated virtual network in an AWS Region (CIDR, subnets, route tables, IGW/NAT, security groups/NACLs). (high)
• The description ("a private link between 2 places… connect 2 AWS accounts… a VPN between two places") describes VPC peering, PrivateLink, or Site-to-Site VPN, not a VPC. (high)

X-Ray/_X-Ray.md

#	Snippet	Problem	Correct info	Sev
X1	X-Ray SDK / Daemon sections	Outdated. X-Ray SDKs/Daemon entered maintenance mode on 25 Feb 2026 (security fixes only) and AWS recommends migrating to OpenTelemetry/ADOT (support timeline). End of support is reported as 25 Feb 2027 (Classmethod, end date unverified on AWS's page). The X-Ray service itself is still supported.		medium
X2	X-Ray Daemon	Missing the key exam fact: the daemon listens on UDP port 2000.		medium
X3	"Comes with Elastic BeanStalk and Lambda by default"	Lambda runs the daemon only when Active tracing is enabled. On EB the daemon is pre-installed but must be enabled (XRayEnabled option or .ebextensions). On EC2/ECS you install/run it yourself (sidecar for ECS). Instances also need IAM permissions (AWSXRayDaemonWriteAccess).		medium
X4	Annotations: "Up to 50 annotations per trace"	Correct, but it misses the key contrast with Metadata: annotations are indexed key-value pairs (string/number/boolean) usable in filter expressions.		medium
X5	"Errors, Faults, and Exceptions"	Missing the definitions: Error = 4xx, Fault = 5xx, Throttle = 429.		medium
X6	"Tracing Header: All requests are traced up to a configurable minimum…"	This is sampling (reservoir + fixed rate) under the wrong heading. The header is X-Amzn-Trace-Id (correct) with Root, Parent, Sampled fields.		low
X7	"A Trace ID is the path of a request"	A trace is the collection of segments produced by one request. The trace ID is its identifier.		low
X8	Groups: "Groups only update after you update them, the data before still remains"	Garbled. A group's filter expression applies to new traces only after it's created or edited.		low
X9	Integration list "ELB"	X-Ray integrates with ALB (adds/propagates the trace header), not all ELB types. App Mesh is being discontinued (Sept 2026, unverified).		low
X10	[[_Elastic BeanStalk]]	Broken link.		low
X11	[...]{.underline}	Pandoc span syntax. It may not render outside Zettlr/Pandoc.		low
—	Sampling defaults (1 req/s reservoir + 5%)	Correct.		—

---

Broken internal links (consolidated)

Existing note names: API, AWS, CRUD, HTTP, HTTPS, REST, SQL, VPN, CRUD vs REST, Deployments, _ACM, _ALB, _API Gateway, _AppSync, GraphQL, _Athena, _CloudFront, CloudFront Functions, Lambda@Edge, _CodeBuild, _CodeCommit, _CodeDeploy, _CodePipeline, _ELB, _Lambda, _NLB, _Route53, Record Sets, Route 53 Hosted Zone, Use Cases, _S3, _VPC, _X-Ray.

File	Link	Issue
_Concepts/Deployments.md	[[_Elastic BeanStalk]]	note missing
ACM/_ACM.md	[[ELB]] ×2	should be _ELB
ACM/_ACM.md	[[API Gateway]]	should be _API Gateway
ACM/_ACM.md	[[_Elastic BeanStalk]]	note missing
CloudFront/_CloudFront.md	[[AWS WAF]], [[Videos On Demand]], [[ISS Microsoft Smooth Streaming]]	notes missing
CodePipeline/_CodePipeline.md	[[_CodePipeline|Build]]	wrong target, should be _CodeBuild
CodePipeline/_CodePipeline.md	[[CodeDeploy||Deploy]]	double pipe; should be _CodeDeploy
CodePipeline/_CodePipeline.md	[[_CloudFormation]]	note missing
Lambda/_Lambda.md	[[API Gateway|API Gateway]]	should be _API Gateway
Lambda/_Lambda.md	[[_DynamoDB]]	note missing
X-Ray/_X-Ray.md	[[_Elastic BeanStalk]]	note missing

All three image references resolve to existing PNGs.

Internal inconsistencies

• REST.md ("a kind of CRUD") contradicts CRUD vs REST.md ("an architectural style").
• Deployments.md says CodeDeploy Blue/Green covers On-Prem. _CodeDeploy.md describes only EC2 blue/green and never mentions Lambda/ECS traffic shifting. Both should state: EC2 (not on-prem), Lambda, ECS.
• _CodeBuild.md uses both buildspec.yaml and buildspec.yml.
• _ACM.md and _ELB.md treat "ELB" as a single attachable thing, while _ELB.md defines it as an umbrella term.
• _CloudFront.md and Lambda@Edge.md agree on Node.js/Python and Regional Edge Caches, which is consistent and correct.

Typos and grammar (grouped, low)

• Deployments: "Auto Scailing", "the reregistered", "replace and existing instance", "spin up and extra ELB, the split".
• ACM: "Amazon Certificate Manager", "certificate" (plural), "Privates", "each instances".
• AppSync: "Resolvers attached… used to…".
• GraphQL: "composed on", "data to be create".
• Athena: "a box contains fictions".
• CloudFront: "board geographical", "ISS", "OPTION", "pre request", "receives the request from the origin".
• CodeBuild: "Apache, Maven", "Scaled automatically".
• CodeCommit: "HIPPA".
• CodeDeploy: missing comma in the Application description.
• CodePipeline: "The can pull", "Deploy Actions is a Build Stage", "Pipeline are only limited".
• HTTPS: "Application on IP layer".
• Route 53 Use Cases: "our web backed by".

Could not verify

• Current Lambda@Edge origin-trigger memory maximum (3,008 MB vs 10,240 MB). The AWS comparison page failed to load (TLS error).
• Whether "Action Groups" is official CodePipeline terminology.
• X-Ray SDK end-of-support date (25 Feb 2027) on AWS's own page. The maintenance-mode date (25 Feb 2026) is confirmed by AWS docs.
• App Mesh discontinuation date.

Conclusions and recommendations

Fix these first, because they're wrong rather than just incomplete:

1. VPC/_VPC.md: rename to Virtual Private Cloud and rewrite the definition. Move the peering/VPN content to a "VPC connectivity" subsection.
2. ACM/_ACM.md: fix pricing (public and imported certs free; Private CA ~$400/month per CA). Add the CloudFront us-east-1 rule.
3. _Concepts/Deployments.md: rewrite the EB rows (all-at-once is in place; immutable and traffic splitting use a temporary ASG behind the same LB; blue/green is a CNAME swap). Remove "On-Prem" from CodeDeploy blue/green. Add Lambda/ECS canary/linear/all-at-once.
4. CloudFront/_CloudFront.md: remove Route 53 from origins, swap the origin request/response use cases, and update CF Functions (runtime 2.0) and OAI (legacy).
5. AppSync/_AppSync.md: add OIDC and Lambda authorization.
6. Glossary/REST.md, HTTPS.md: fix the definitions (REST is an architectural style; HTTPS is HTTP over TLS, port 443).
7. Update the status notes: CodeCommit is GA again (Nov 2025); X-Ray SDK/Daemon are in maintenance mode (Feb 2026), so prefer ADOT/OpenTelemetry. Add the daemon's UDP 2000 port.
8. Fix the broken wiki-links, especially CodePipeline's Build → _CodeBuild.

Then fill the exam-critical gaps: S3, ALB/NLB, API Gateway, Lambda limits, Route 53 routing policies, CodeDeploy AppSpec hooks.