SAP-C02
Deep Dive
The SAP-C02 evaluates your ability to design enterprise-scale microservices architectures. ECS, EKS, Fargate and API Gateway are the pillars of cloud-native applications on AWS.
Contents
Decoupling
Each service has its own database and communicates via APIs or messaging. No direct schema dependencies.
Independent scaling
Each microservice scales according to its own demand. The payments service can have more instances than the reporting one.
Fault tolerance
A service failure doesn't cascade to the rest. Patterns: Circuit Breaker, Bulkhead, Timeout.
Independent CI/CD
Each team can deploy its service without coordination. Separate pipelines per microservice.
ECS is AWS's native container orchestrator. It defines workloads as Tasks (individual containers) and Services (groups of Tasks with scaling and service discovery).
Key ECS concepts
ECS Launch Types
EC2 Launch Type
Fargate Launch Type
EKS is managed Kubernetes on AWS. AWS manages the control plane (kube-apiserver, etcd, scheduler). You manage the worker nodes (EC2 or Fargate). Native compatibility with the standard Kubernetes ecosystem.
Node Groups
Groups of EC2 instances (Managed or Self-Managed). Managed Node Groups use an ASG and automatic patching.
Fargate Profiles
Pods run on Fargate. AWS manages the infrastructure. No EC2 worker nodes.
EKS Anywhere
Runs EKS on-premises (VMware, bare metal). Same control plane for cloud and on-premises.
EKS Distro
Open-source Kubernetes distribution that powers EKS. For installing on any infrastructure.
IRSA
IAM Roles for Service Accounts. Assigns IAM roles to specific pods (least privilege at the pod level).
EKS Add-ons
CoreDNS, kube-proxy, VPC CNI, EBS CSI driver managed by AWS with automatic updates.
Fargate features
Fargate networking
| Type | Protocol | Deployment | Best for |
|---|---|---|---|
| REST API | HTTP/HTTPS | Edge / Regional / Private | REST APIs with transformations, caching, complex authentication |
| HTTP API | HTTP/HTTPS | Regional only | Simple APIs, lower cost (70% cheaper than REST), lower latency |
| WebSocket API | WebSocket | Regional | Chat, real-time notifications, persistent bidirectional connections |
Authentication in API Gateway
Throttling and protection
AWS App Mesh is discontinued on September 30, 2026. On ECS its replacement is Service Connect, which adds an AWS-managed proxy to each task with no sidecars to operate; for EKS, or to connect services across VPCs and accounts, use Amazon VPC Lattice. Both manage service-to-service traffic without modifying the code.
Observability: E-W traffic metrics in CloudWatch without code
Traffic shifting: blue/green and canary (ECS or Lattice weighted routing)
Automatic retries and outlier detection
Security: TLS with Service Connect and IAM auth policies with Lattice
| Criterion | ECS | EKS |
|---|---|---|
| Already using Kubernetes? | Not the natural fit | Yes — native k8s compatibility |
| Multi-cloud portability? | Limited to AWS | Yes — same YAML works on GKE/AKS |
| Operational overhead tolerable? | Low — native AWS API | Higher — k8s has a learning curve |
| Deep AWS integration? | Better — native across all services | Good — via plugins (CSI, CNI, etc.) |
| Granular scheduling control? | Limited | Full — taints, tolerations, affinity |
| Control plane cost? | Free | $0.10/h per cluster (~$73/month) |
| Large-scale workloads? | Works well | Better for complex orchestration |
Trap: "Fargate removes the need to manage ECS/EKS clusters"
Reality: Fargate removes the need to manage EC2 instances (worker nodes), but the ECS cluster or the EKS control plane still exist. Only who manages the compute infrastructure changes.
Trap: "API Gateway HTTP API has all the features of REST API"
Reality: HTTP API is cheaper but has fewer features: no caching, no request/response transformations, no usage plans, no private integrations to complex VPC Links.
Trap: "ECS Task Role and Instance Role are the same thing"
Reality: They're different. Instance Role applies to the EC2 running the Tasks. Task Role applies specifically to the containers in that Task Definition. Always use Task Role to follow the principle of least privilege.
Did you get this topic?
Test what you just learned
A company has microservices deployed on ECS Fargate. The payments service needs to access DynamoDB and Secrets Manager. The security team wants ONLY the payments service to have those permissions, not the other microservices in the same cluster. How should this be achieved correctly?
Put what you learned to the test with original SAP-C02 exam questions.
Start SAP-C02 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.