AWS Cloud Practitioner Study Notes · Part 40
AWS Global, Regional, and Zonal Services Explained
AWS Cloud Practitioner study notes explaining global, Regional, and zonal service scope, common examples, mixed-scope exceptions, and exam traps.
AWS resources have different scopes. A global service normally does not require you to choose a Region for its main control-plane resource. A Regional service requires a Region, while a zonal resource exists in one specific Availability Zone (AZ).
This distinction affects where you create resources, which endpoint you call, how you design high availability, and whether a resource must be recreated or replicated in another Region. It is also a frequent AWS Cloud Practitioner exam topic.
This is Part 40 of the AWS Cloud Practitioner Study Notes. The AWS Regions and Availability Zones documentation is the best reference for current service availability because not every service or feature is offered in every Region.
The quick mental model
Global service
→ The main resource is account-wide or globally distributed
Regional service
→ Choose an AWS Region for the resource
Zonal resource
→ The resource is placed in one Availability ZoneFor example, IAM users are global, an EC2 service deployment is Regional, and an individual EC2 instance runs in one AZ. A Regional service can therefore contain zonal resources.
Global services to remember
These services are commonly treated as global for Cloud Practitioner questions:
| Service | Main purpose | Scope clue |
|---|---|---|
| AWS IAM | Users, groups, roles, and policies | Identities normally apply across Regions |
| AWS Organizations | Central management of multiple accounts | Organization structure is account-wide |
| AWS Billing and Cost Management | Bills, payments, budgets, and cost views | Account-level billing scope |
| AWS Support Center | Support cases and account assistance | Account-level service |
| AWS Artifact | Compliance reports and agreements | Global account access |
| Amazon Route 53 public DNS | Domains, hosted zones, and health checks | Globally distributed DNS service |
| Amazon CloudFront | Content delivery through edge locations | Global distribution |
| AWS Global Accelerator | Global traffic acceleration | Anycast static IP addresses |
The exam pattern is useful: identity, account governance, billing, public DNS, and global edge networking are usually global or account-level services.
Global does not mean that every related feature is global. For example, Route 53 Resolver endpoints are Regional, and a cost report may be account-level while its S3 destination bucket is Regional.
Regional services
For a Regional service, select a Region such as Asia Pacific (Singapore), ap-southeast-1. A resource created in Singapore does not automatically exist in Virginia or Tokyo.
Compute
- Amazon EC2
- EC2 Auto Scaling groups
- AWS Lambda functions
- Amazon ECS clusters and services
- Amazon EKS clusters
- AWS Fargate workloads through ECS or EKS
- AWS Batch
- AWS Elastic Beanstalk environments
- Amazon Lightsail resources
- AWS App Runner services
The service operates through a Regional control plane. Individual compute resources may then be placed into particular subnets and AZs within that Region.
Storage and backup
- Amazon S3 buckets
- Amazon EFS file systems
- Amazon FSx file systems
- Amazon EBS volumes
- AWS Backup vaults and plans
- AWS Storage Gateway configuration
- AWS Elastic Disaster Recovery resources
Amazon S3 is the classic trap. General-purpose S3 bucket names traditionally use a shared global namespace, but AWS creates each bucket in a Region that you specify. Global name uniqueness does not make the bucket a global resource.
Globally unique S3 bucket name
≠
Global S3 bucketObjects in a bucket remain in that bucket’s Region unless you explicitly transfer or replicate them. S3 Cross-Region Replication and Multi-Region Access Points provide multi-Region capabilities, but the underlying buckets still have Regional locations.
Databases
- Amazon RDS DB instances and clusters
- Amazon Aurora clusters
- Amazon DynamoDB tables
- Amazon Redshift clusters and serverless workgroups
- Amazon ElastiCache
- Amazon MemoryDB
- Amazon DocumentDB
- Amazon Neptune
- Amazon OpenSearch Service domains and collections
DynamoDB is Regional by default. A DynamoDB global table replicates data across multiple Regions, but each replica is still associated with a Region.
The same principle applies to Aurora Global Database: the global architecture contains a primary Regional cluster and secondary Regional clusters. A global feature does not erase the scope of the underlying resources.
Networking and application integration
Common Regional networking resources include:
- Amazon VPCs
- Subnets
- Security groups and network ACLs
- NAT gateways
- Internet gateways attached to a VPC
- Transit gateways
- VPC peering connections
- AWS PrivateLink and VPC endpoints
- Elastic Load Balancing load balancers
- AWS Network Firewall
- Route 53 Resolver endpoints
Common Regional integration services include:
- Amazon SQS queues
- Amazon SNS topics
- Amazon EventBridge event buses and rules
- AWS Step Functions state machines
- Amazon API Gateway APIs
- Amazon MQ
AWS uses Amazon SQS and DynamoDB as examples of Regional services that are operated across multiple AZs. Regional scope does not mean that the service runs in only one physical building or one AZ.
Zonal resources
A zonal resource belongs to one AZ inside a Region. Common examples include:
| Resource | Why it is zonal |
|---|---|
| EC2 instance | Runs in a subnet in one AZ |
| EBS volume | Attached to resources in its AZ |
| Subnet | A subnet belongs to exactly one AZ |
| NAT gateway | Deployed in one AZ |
| Elastic network interface | Associated with one AZ |
| Single-AZ RDS instance | Runs in one AZ |
| EFS mount target | Created in a particular AZ |
| ElastiCache node | Runs in a particular AZ |
Example:
Region: ap-southeast-1
│
├── ap-southeast-1a
│ ├── Subnet A
│ ├── EC2-A
│ └── EBS-A
│
└── ap-southeast-1b
├── Subnet B
└── EC2-BIf an AZ has a problem, a workload with only one zonal resource may be unavailable. Deploying across multiple AZs improves resilience when the service and architecture support it.
Mixed-scope services and exceptions
Some services need a more precise answer than simply “global” or “Regional.”
AWS STS
AWS Security Token Service provides a global endpoint and Regional endpoints. AWS recommends considering Regional STS endpoints for resilience and lower latency. When an exam question asks whether STS can use Regional endpoints, the answer is yes; when it asks about the traditional global endpoint, that also exists.
AWS Certificate Manager
ACM certificates are Regional in normal use. A certificate for an Application Load Balancer in Singapore should generally be requested or imported in Singapore.
The important CloudFront exception is:
CloudFront distribution
→ ACM certificate in us-east-1This requirement applies when using ACM with a CloudFront distribution, even if the origin is in another Region.
AWS WAF
WAF scope follows the resource it protects:
WAF attached to CloudFront
→ Global scope
WAF attached to an ALB or API Gateway
→ Regional scopeRoute 53
Route 53 public hosted zones and domain registration are global-style services. Route 53 private hosted zones can be associated with VPCs in multiple Regions, but Route 53 Resolver endpoints are Regional. Always identify the specific Route 53 feature in the question.
CloudFormation
CloudFormation stacks are Regional. A stack created in Singapore manages the Regional resources defined for that stack; it does not automatically create the same resources in Virginia.
For multi-Region or multi-account deployments, use separate stacks, CloudFormation StackSets, or a deployment pipeline designed for those targets.
CloudWatch
CloudWatch metrics, logs, dashboards, and alarms commonly use Regional scope. A CloudWatch alarm in Singapore does not automatically monitor an equivalent metric in Virginia. Check the Region when diagnosing missing logs, metrics, or alarms.
A compact comparison
| Requirement | Scope |
|---|---|
| IAM users and roles | Global |
| AWS Organizations | Global |
| Billing information | Account-level/global |
| Route 53 public DNS | Global-style |
| CloudFront distribution | Global |
| Global Accelerator | Global |
| EC2 service | Regional |
| EC2 instance | Zonal |
| S3 bucket | Regional |
| VPC | Regional |
| Subnet | Zonal |
| EBS volume | Zonal |
| Lambda function | Regional |
| RDS database | Regional, with zonal or Multi-AZ placement |
| DynamoDB table | Regional by default |
| SQS queue | Regional |
| SNS topic | Regional |
| CloudWatch alarm | Regional |
| CloudFormation stack | Regional |
| KMS key | Regional |
| Secrets Manager secret | Regional |
| ACM certificate | Regional, except CloudFront uses us-east-1 |
| ALB, NLB, or GWLB | Regional |
| WAF for CloudFront | Global |
| WAF for ALB or API Gateway | Regional |
Common exam traps
Trap 1: S3 is not a global resource
S3 bucket names can be globally unique, but a bucket is created in a selected Region. “Global namespace” refers to naming, not storage location.
Trap 2: EC2 has both Regional and zonal aspects
EC2 is a Regional service, but an individual EC2 instance runs in one AZ. Auto Scaling groups are Regional and can distribute instances across multiple AZs.
Trap 3: IAM is global
You normally do not recreate IAM users and roles separately in every Region. However, IAM policies can still restrict actions according to the requested Region.
Trap 4: CloudFormation is Regional
A stack in one Region does not automatically deploy to every Region. Use StackSets or separate Regional deployments for that outcome.
Trap 5: global access does not always mean a global resource
Global DNS, edge delivery, replication, or a global endpoint can provide worldwide access while the underlying workload remains Regional. Identify whether the question refers to the service endpoint, the control plane, or the resource itself.
The exam memory map
Does it manage identity, accounts, billing, public DNS, or edge delivery?
↓
Usually global
Does it run or store your workload?
↓
Usually Regional
Does it physically run inside a subnet or attach to one AZ?
↓
Often zonalMemorise the high-value examples:
GLOBAL
IAM, Organizations, Billing, Support, Artifact,
Route 53 public DNS, CloudFront, Global Accelerator
REGIONAL
VPC, EC2, S3, RDS, DynamoDB, Lambda, ECS, EKS,
SQS, SNS, CloudWatch, CloudFormation, KMS, ACM
ZONAL
EC2 instance, EBS volume, subnet, NAT gateway, ENIFinal takeaway
Global services usually manage identity, accounts, billing, public DNS, or worldwide edge networking. Regional services host workload resources inside a selected AWS Region. Zonal resources are placed in one AZ. The most important exceptions are S3’s global naming versus Regional bucket location, CloudFront’s us-east-1 ACM certificate requirement, WAF’s scope depending on its association, and mixed-scope services such as STS and Route 53.