The most common thing standing between people and an associate-level pass is that they’ve read about AWS but never used it. The exam is scenario-based, and scenarios only click once you’ve built something.

You don’t need a cloud job for this. You need a free tier account and a few weekends.

Set up safely first

Before you build anything, do these three things. They take fifteen minutes and they prevent the horror stories.

**Set a billing alarm.** In the Billing console, create a budget with an alert at something small like $5. You’ll get an email long before anything hurts.

**Stop using your root account.** Create an IAM user with admin permissions for daily work and lock the root credentials away with MFA. This is also directly examinable material, so you’re studying while you do it.

**Know what’s actually free.** The free tier has three flavors: always free, 12-months free, and short trials. The thing that catches people isn’t EC2 hours, it’s the services with no free tier at all. NAT gateways, for example, bill by the hour whether you use them or not, and a forgotten one is the single most common surprise on a study bill. Delete what you’re not using, every time.

What to build, in order

Work through these in sequence. Each one teaches something the exam asks about directly.

1. A static website on S3

Create a bucket, upload an HTML file, enable static hosting, make it public. Then put CloudFront in front of it.

**What it teaches:** bucket policies versus IAM policies, public access blocks, the difference between an origin and a distribution, and why the exam keeps asking about caching.

2. A VPC from scratch

Do not use the default VPC. Build your own: two subnets, one public and one private, an internet gateway, route tables, and a NAT gateway so the private subnet can reach out.

Put an EC2 instance in each. SSH to the public one. Try to reach the private one and work out why you can’t.

**What it teaches:** more of the associate exam than anything else on this list. Routing, security groups versus NACLs, and what “private subnet” really means. Delete the NAT gateway when you’re done for the day.

3. A database in a private subnet

Launch an RDS instance with no public access. Connect to it from your public EC2 instance only.

**What it teaches:** subnet groups, security group chaining, and why the exam always wants the database off the internet.

4. A Lambda function with a trigger

Write something tiny that runs when a file lands in an S3 bucket. Have it write a line to CloudWatch Logs.

**What it teaches:** event-driven patterns, execution roles, and the IAM permissions model from the service side.

5. An Auto Scaling group behind a load balancer

Two instances, a target group, an application load balancer, a health check. Then terminate an instance and watch what happens.

**What it teaches:** high availability, health checks, and the difference between scaling and redundancy. Watching the group replace a dead instance by itself makes those questions permanent.

6. Break something on purpose

Remove a route. Detach the internet gateway. Revoke a security group rule. Then diagnose it from the symptoms.

This is the most valuable exercise on the page and almost nobody does it. Exam questions are frequently descriptions of broken systems.

Free options beyond your own account

**AWS Skill Builder** has a free tier with real content, including some hands-on material.

**AWS Workshops** are free, public, step-by-step builds published by AWS themselves. Good when you want a guided project rather than inventing one.

**CloudFormation or Terraform** is worth a weekend once you’re comfortable clicking. Being able to tear down and rebuild an environment in one command makes experimenting cheap, and infrastructure as code shows up on the exam and in interviews.

How much time this takes

Each project above is a two to four hour evening. All six is roughly two weekends of work, and it will move your practice scores more than another twenty hours of video.

Keeping the bill at zero

• **Delete everything when you’re done.** Especially NAT gateways, load balancers, and RDS instances. These bill by the hour regardless of traffic.
• **Check the console before bed.** Get in the habit of a final sweep.
• **Use the smallest instance sizes.** Nothing on this list needs anything bigger than the free tier default.
• **Watch your alarm.** If it fires, something’s still running. Go find it.

Done carefully, all of this costs a few dollars at most. And the money is beside the point. Every one of these builds turns a category of exam question from abstract recall into something you remember doing.