A free, open study guide for the AWS Certified Data Engineer – Associate (DEA-C01) exam: revision notes for every domain, side-by-side comparisons of commonly confused services, a glossary, 20 worked sample questions, and the official syllabus as a checklist with a full free lesson for every topic.
Maintained by SaveMyCert, where you can read every lesson free, practice with explained questions and take timed mock exams.
- Exam at a glance
- Exam domains
- What is in this repo
- Syllabus checklist
- How to study for DEA-C01
- Sample questions
- Free resources
| Exam code | DEA-C01 |
| Level | Associate |
| Questions | 65 |
| Time limit | 130 min |
| Passing score | 720 / 1000 |
| Format | Multiple choice & multiple response |
| Exam fee | $150 |
| Valid for | 3 years |
Exam details change. Always confirm them in the official AWS Certified Data Engineer – Associate (DEA-C01) exam guide from Amazon Web Services.
| # | Domain | Weight | Topics |
|---|---|---|---|
| 1 | Data Ingestion and Transformation | 34% | 4 |
| 2 | Data Store Management | 26% | 4 |
| 3 | Data Operations and Support | 22% | 4 |
| 4 | Data Security and Governance | 18% | 5 |
That is 4 domains and 17 topics. Spend your time in proportion to the weights: the heaviest domain decides more of your score than the lightest.
| File | What it gives you |
|---|---|
| Domain 1 notes | Data Ingestion and Transformation: condensed revision notes per topic |
| Domain 2 notes | Data Store Management: condensed revision notes per topic |
| Domain 3 notes | Data Operations and Support: condensed revision notes per topic |
| Domain 4 notes | Data Security and Governance: condensed revision notes per topic |
| Commonly confused services | Side-by-side tables of the services questions set against each other |
| Glossary | Every in-scope term and service in one sentence |
| Sample questions | 20 worked questions with answers and reasoning |
| Exam-day guide | Booking, testing options, scoring, results and retakes |
Tick each topic off once you can explain it without notes. The "Must know" facts are the ones questions turn on. Each lesson link goes to the complete, free lesson.
Weight: 34%. Ingesting streaming and batch data, transforming and processing it, orchestrating ETL pipelines, and applying programming concepts. Official weighting 34%.
📝 Revision notes: Domain 1: Data Ingestion and Transformation
- Perform data ingestion
1). Reading streaming sources (Amazon Kinesis, Amazon MSK, DynamoDB Streams, AWS DMS, AWS Glue, Amazon Redshift) and batch sources (Amazon S3, Glue, Amazon EMR, DMS, Redshift, AWS Lambda, Amazon AppFlow); batch-ingestion configuration; consuming data APIs; setting up schedulers (Amazon EventBridge, Apache Airflow, time-based) for jobs and crawlers; event triggers (S3 Event Notifications, EventBridge); calling a Lambda function from Kinesis; IP allowlists; throttling and rate limits (DynamoDB, Amazon RDS, Kinesis); managing fan-in/fan-out for streaming distribution; replayability of ingestion pipelines; stateful vs stateless transactions.- 📖 Lesson: Data Ingestion on AWS: Kinesis, MSK, DMS, Glue, and Batch Patterns
- Must know: Kinesis Data Streams for AWS-native streaming; MSK when the scenario needs Apache Kafka; SQS for independent work items with per-message retry.
- Must know: DMS task types: full load, CDC only, or full load and ongoing replication; MySQL CDC needs binary logging (automated backups on RDS) with ROW format.
- Transform and process data
Optimizing container usage (Amazon EKS, ECS); connecting via JDBC/ODBC; integrating data from multiple sources; optimizing cost while processing; implementing transformation services by requirement (Amazon EMR, AWS Glue, Lambda, Amazon Redshift); converting formats (CSV to Apache Parquet); troubleshooting transformation failures and performance; creating data APIs; defining volume, velocity, and variety; integrating large language models (LLMs) for data processing.- 📖 Lesson: Transform and Process Data on AWS: Glue, EMR, Lambda, and Redshift
- Must know: Glue for serverless Spark ETL (no Hive), EMR for scale and framework control, EMR Serverless for intermittent Spark or Hive, Lambda for short per-object or per-record transforms, Redshift SQL for ELT on data already loaded.
- Must know: Job bookmarks need job.init(), job.commit() and DynamicFrame reads with a transformation_ctx; Pause never advances state, and auto scaling never makes a job incremental.
- Orchestrate data pipelines
Using orchestration services to build ETL workflows (Lambda, EventBridge, Amazon Managed Workflows for Apache Airflow [MWAA], AWS Step Functions, AWS Glue workflows); building pipelines for performance, availability, scalability, resiliency, and fault tolerance; implementing and maintaining serverless workflows; using notification services for alerts (Amazon SNS, Amazon SQS).- 📖 Lesson: Orchestrating Data Pipelines on AWS: Step Functions, MWAA, and Glue Workflows
- Must know: AWS Step Functions is the default serverless orchestrator: direct integrations with Glue, EMR, Lambda and more, per-state Retry/Catch, and no infrastructure.
- Must know: Standard workflows are exactly-once, run up to a year, keep history, support .sync/callbacks and emit status events; Express workflows run up to five minutes and are at-least-once (async) or at-most-once (sync) — and the type is fixed at creation.
- Apply programming concepts
Optimizing code to reduce runtime; configuring Lambda concurrency and performance; using languages and frameworks (Python, SQL, Scala, R, Java, Bash, PowerShell); software-engineering best practices (version control, testing, logging, monitoring); packaging and deploying serverless data pipelines with AWS SAM; using and mounting storage volumes from within Lambda functions; Infrastructure as Code (AWS CloudFormation, AWS CDK); CI/CD for data pipelines; distributed computing; data structures and algorithms.- 📖 Lesson: Programming Concepts for AWS Data Engineering: IaC, CI/CD, and Lambda Tuning
- Must know: Reduce runtime by reading less: Parquet over CSV, filters on partition columns, push_down_predicate (or catalogPartitionPredicate with a partition index for huge partition counts), and built-in Spark functions instead of Python UDFs.
- Must know: Reserved concurrency caps and guarantees a function and is removed from the shared pool even when idle; provisioned concurrency pre-warms a version or alias and is not a cap.
Weight: 26%. Choosing and configuring data stores, cataloging data, managing data lifecycle, and designing data models with schema evolution. Official weighting 26%.
📝 Revision notes: Domain 2: Data Store Management
- Choose a data store
1). Selecting and configuring storage for cost, performance, and access patterns (Amazon Redshift, EMR, AWS Lake Formation, Amazon RDS, DynamoDB, Kinesis Data Streams, Amazon MSK); applying storage to use cases (HNSW indexing with Aurora PostgreSQL, Amazon MemoryDB for fast key/value); migration tools (AWS Transfer Family); remote access (Redshift federated queries, materialized views, Redshift Spectrum); managing locks; open table formats (Apache Iceberg); vector index types (HNSW, IVF).- 📖 Lesson: Choosing an AWS Data Store: Redshift, DynamoDB, Aurora, S3, and MemoryDB
- Must know: Read the access pattern first: analytics → Redshift or S3 + Athena, OLTP with joins and constraints → RDS/Aurora, key/value at scale → DynamoDB, durable microsecond in-memory → MemoryDB, replayable events → Kinesis/MSK.
- Must know: RA3 managed storage scales storage without compute and is required for data sharing; consumers query shared data live with their own compute and bill.
- Understand data cataloging systems
Using data catalogs to consume data at source; building and referencing a technical data catalog (AWS Glue Data Catalog, Apache Hive metastore); discovering schemas and using Glue crawlers; synchronizing partitions with a catalog; creating source/target connections; creating and managing business data catalogs (Amazon SageMaker Catalog).- 📖 Lesson: AWS Glue Data Catalog: Crawlers, Partitions, and the Hive Metastore
- Must know: The Glue Data Catalog is the single metadata source Athena, Redshift Spectrum, EMR, and Glue jobs all share — register a table once, query it at its source from every engine; Athena reaches DynamoDB and other non-S3 stores through Federated Query connectors.
- Must know: Redshift references lake tables through an external schema (FROM DATA CATALOG or FROM HIVE METASTORE), and its IAM role needs both catalog and S3 read access; datashares can only include lake tables already defined that way.
- Manage the lifecycle of data
Load and unload operations between Amazon S3 and Amazon Redshift; managing S3 Lifecycle policies to change storage tier and to expire data by age; S3 versioning and DynamoDB TTL; deleting data to meet business and legal requirements; protecting data with appropriate resiliency and availability.- 📖 Lesson: Managing the Data Lifecycle: S3 Storage Tiers, Expiration, and Redshift
- Must know: COPY loads in parallel per slice: split data into roughly equal files whose count is a multiple of the slice count, because a single gzip file cannot be split.
- Must know: A COPY path is a key prefix; use a manifest to load an exact file list, and mark entries "mandatory": true if a missing file must fail the load. Auto-copy (COPY JOB … AUTO ON) loads new files continuously without reloading old ones.
- Design data models and schema evolution
1). Designing schemas for Amazon Redshift, DynamoDB, and Lake Formation; addressing changes to data characteristics; schema conversion (AWS DMS Schema Conversion); establishing data lineage (Amazon SageMaker ML Lineage Tracking, SageMaker Catalog); indexing, partitioning, compression, and optimization; vectorization concepts (Amazon Bedrock knowledge base).- 📖 Lesson: Data Modeling on AWS: Redshift, DynamoDB, Lake Formation & Schema Evolution
- Must know: Redshift tables have one DISTKEY: collocate the largest, most frequent join and use ALL for small dimensions; a skewed DISTKEY needs a new key or a deep copy, because VACUUM and ANALYZE never move rows between slices.
- Must know: Star schemas (denormalized dimensions) beat snowflakes for BI; SCD type 1 overwrites, type 2 adds effective-dated rows with surrogate keys, type 3 keeps a previous-value column; Redshift PK/FK constraints are informational only.
Weight: 22%. Automating data processing, analyzing data, maintaining and monitoring pipelines, and ensuring data quality. Official weighting 22%.
📝 Revision notes: Domain 3: Data Operations and Support
- Automate data processing by using AWS services
Orchestrating pipelines (Amazon MWAA, AWS Step Functions); troubleshooting managed workflows; calling SDKs; using service features to process data (Amazon EMR, Redshift, AWS Glue); consuming and maintaining data APIs; preparing data for transformation (AWS Glue DataBrew, Amazon SageMaker Unified Studio); querying data (Amazon Athena); using AWS Lambda to automate processing; managing events and schedulers (Amazon EventBridge).- 📖 Lesson: Automate Data Processing on AWS: Step Functions, MWAA, Lambda & EventBridge
- Must know: Step Functions Standard is exactly-once, priced per state transition and keeps an execution history; Express is at-least-once when started asynchronously, priced per request and duration, and logs only to CloudWatch Logs.
- Must know: A provisioned MWAA environment bills every hour it exists, idle or not; Step Functions and MWAA Serverless charge nothing while no work runs.
- Analyze data by using AWS services
Visualizing data (AWS Glue DataBrew, Amazon QuickSight); verifying and cleaning data (Lambda, Athena, QuickSight, Jupyter notebooks, Amazon SageMaker Data Wrangler); using SQL in Amazon Redshift and Athena to query and create views; using Athena notebooks with Apache Spark; tradeoffs between provisioned and serverless services; data aggregation, rolling averages, grouping, and pivoting.- 📖 Lesson: Analyzing Data on AWS: Athena, Redshift SQL, QuickSight & Spark Notebooks
- Must know: Athena is serverless, pay-per-data-scanned SQL over S3 for ad hoc and spiky workloads; Redshift earns its cost on frequent, concurrent, latency-sensitive queries. Redshift Serverless can query S3 through Spectrum but bills RPU-hours, not bytes scanned.
- Must know: WHERE filters rows before grouping; HAVING filters groups after. ROLLUP, CUBE, and GROUPING SETS produce subtotals in one query, and GROUPING(col) = 1 marks a subtotal row even when the data has real NULLs.
- Maintain and monitor data pipelines
Extracting logs for audits; deploying logging and monitoring for traceability; using notifications to send alerts; troubleshooting performance; tracking API calls with AWS CloudTrail; troubleshooting and maintaining pipelines (AWS Glue, Amazon EMR); using Amazon CloudWatch Logs; analyzing logs (Athena, EMR, Amazon OpenSearch Service, CloudWatch Logs Insights).- 📖 Lesson: Monitoring Data Pipelines: CloudWatch, CloudTrail and Log Analysis
- Must know: Match the telemetry source to the question: CloudWatch metrics for performance thresholds, CloudWatch Logs for application behavior, CloudTrail for who-called-which-API audits.
- Must know: Metric filters and subscription filters act only on events ingested after they are created; use Logs Insights to analyze logs that already exist.
- Ensure data quality
Running data quality checks while processing (for example, checking for empty fields); defining data quality rules (AWS Glue DataBrew); investigating data consistency; data sampling techniques; implementing data skew mechanisms.- 📖 Lesson: Data Quality on AWS: Glue Data Quality, DataBrew and Skew Handling
- Must know: Memorize the quality dimensions — completeness, accuracy, consistency, validity, uniqueness, timeliness, integrity — and translate a symptom into a dimension, then into the rule that enforces it.
- Must know: The Evaluate Data Quality transform adds DataQualityRulesPass/Fail/Skip and DataQualityEvaluationResult columns; route on the result to quarantine failing rows. Dataset-level rules such as RowCount are skipped at row level.
Weight: 18%. Applying authentication and authorization, encrypting and masking data, preparing audit logs, and managing data privacy and governance. Official weighting 18%.
📝 Revision notes: Domain 4: Data Security and Governance
- Apply authentication mechanisms
1). Updating VPC security groups; creating and updating IAM groups, roles, endpoints, and services; creating and rotating credentials (AWS Secrets Manager); setting up IAM roles for access (Lambda, Amazon API Gateway, AWS CLI, CloudFormation); applying IAM policies to roles, endpoints, and services (S3 Access Points, AWS PrivateLink); managed vs unmanaged services; using domains, domain units, and projects for SageMaker Unified Studio.- 📖 Lesson: Applying Authentication Mechanisms: IAM, Secrets Manager, and Networks
- Must know: Authentication proves identity; authorization decides permissions — IAM resolves every signed request to a principal before any policy is evaluated.
- Must know: Prefer IAM roles with temporary STS credentials for all workloads; long-lived access keys in code or config are almost always the wrong answer.
- Apply authorization mechanisms
Creating custom IAM policies when managed policies fall short; storing application and database credentials (Secrets Manager, AWS Systems Manager Parameter Store); providing database users, groups, and roles access (Amazon Redshift); managing permissions through AWS Lake Formation (Redshift, EMR, Athena, S3); authorization methods (role-based, tag-based, attribute-based); constructing least-privilege policies.- 📖 Lesson: Applying Authorization Mechanisms: Lake Formation, IAM, and Redshift
- Must know: IAM authorizes API actions; Lake Formation authorizes data — its grants are enforced identically by Athena, Redshift Spectrum, EMR, and Glue via vended temporary S3 credentials.
- Must know: Same-account access needs an Allow in the identity or the resource policy (KMS key policies and role trust policies must allow themselves); cross-account needs both; SCPs and permissions boundaries never grant, and any matching explicit Deny wins.
- Ensure data encryption and masking
Applying data masking and anonymization per compliance laws or company policy; using encryption keys to encrypt/decrypt data (AWS KMS); configuring encryption across AWS account boundaries; enabling encryption in transit or before transit.- 📖 Lesson: Data Encryption and Masking on AWS: KMS, TLS, and Anonymization
- Must know: KMS uses envelope encryption: data keys encrypt the data, the KMS key encrypts the data keys. Encrypt takes at most 4,096 bytes; GenerateDataKeyWithoutPlaintext suits components that only store keys for later. Rotation re-encrypts no data.
- Must know: AWS managed keys (aws/s3, aws/rds, aws/redshift) can never be used across accounts — share encrypted data, RDS snapshots or Redshift snapshots with a customer managed key; an aws/rds snapshot must be copied under one first.
- Prepare logs for audit
Tracking API calls with AWS CloudTrail; storing application logs with Amazon CloudWatch Logs; centralized logging queries with AWS CloudTrail Lake; analyzing logs (Amazon Athena, CloudWatch Logs Insights, Amazon OpenSearch Service); integrating services for logging (Amazon EMR for large log volumes).- 📖 Lesson: Preparing Logs for Audit: CloudTrail, CloudTrail Lake, and CloudWatch Logs
- Must know: Event history keeps 90 days of management events with single-attribute lookups and no SQL; data events (S3 object reads/writes, Lambda invocations) must be enabled on a trail or event data store in advance, at extra cost.
- Must know: CloudTrail Insights baselines API call and error rates (management events, and data events on trails) to flag unusual activity without custom rules.
- Understand data privacy and governance
1). Granting permissions for data sharing (Amazon Redshift data sharing); implementing PII identification (Amazon Macie with Lake Formation); preventing backups/replications to disallowed AWS Regions; viewing configuration changes (AWS Config); maintaining data sovereignty; managing data access through SageMaker Catalog projects; governance data frameworks and data-sharing patterns.- 📖 Lesson: Data Privacy and Governance: Macie, Redshift Sharing, Config, and Sovereignty
- Must know: Amazon Macie discovers sensitive data in S3 only (managed and custom identifiers, policy findings, EventBridge and Security Hub CSPM output) and never masks, blocks or moves data itself.
- Must know: Custom data identifiers are immutable: refine false matches with keywords and a maximum match distance (or ignore words inside the match), then create a replacement identifier and use it in new or copied jobs.
- Read the lesson for each topic in the checklist above, starting with the heaviest domain. Every lesson is free on the DEA-C01 revision notes.
- Practice straight after reading. Answer DEA-C01 practice questions on the topic you just read. Each option comes with an explanation of why it is right or wrong.
- Review what you got wrong, re-read that lesson section, and tick the topic off only when you get its questions right.
- Take a full-length DEA-C01 mock exam under the real time limit. Aim to pass mocks comfortably before you book.
- On the last day, skim the DEA-C01 cheat sheet instead of starting anything new.
sample-questions.md has 20 worked DEA-C01 questions with the answer, why each option is right or wrong, and the reasoning steps.
- AWS Certified Data Engineer – Associate (DEA-C01) exam guide: the official source (Amazon Web Services)
- DEA-C01 certification overview
- DEA-C01 revision notes: every lesson, free to read
- DEA-C01 practice questions: with an explanation on every option
- DEA-C01 mock exams: full-length and timed
- DEA-C01 cheat sheet: the key facts on one page
- All certification study guides
Spotted an error or an out-of-date fact? Open an issue with the topic and a link to the official source. See CONTRIBUTING.md.
This guide is licensed under CC BY 4.0. You can reuse and adapt it, including commercially, as long as you credit SaveMyCert with a link to https://www.savemycert.com/.
This is an independent study resource. It is not affiliated with or endorsed by Amazon Web Services. AWS Certified Data Engineer – Associate and DEA-C01 are trademarks of their respective owner. Exam domains and weights are taken from the official exam guide linked above.