Amazon Keyspaces

What it is

Amazon Keyspaces (for Apache Cassandra) is a serverless, managed database compatible with Apache Cassandra. You run existing Cassandra workloads using the same Cassandra application code, drivers, and developer tools, including the Cassandra Query Language (CQL). There are no servers or clusters to provision, patch, or manage: tables scale up and down with traffic, and you pay only for what you use.

Cassandra is a wide-column database. Data lives in keyspaces and tables, and is spread across partitions by a Partition keyThe attribute that DynamoDB hashes to decide which partition stores an item. A primary key is a partition key alone, or a partition key with a sort key; keys with many distinct values spread the load evenly.Glossary entry. That makes it a good fit for high-volume writes and fast lookups by key, such as IoT and sensor data, time series, fleet tracking, and trade monitoring, at single-digit millisecond LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry.

Choose Keyspaces when a question mentions Apache Cassandra or CQL, especially moving a self-managed Cassandra cluster to a managed service. It doesn't support every Cassandra feature, so check the functional differences before you migrate.

Concepts

Keyspace: a group of related tables, like a database schema. A table has a primary key made of a partition key and optional clustering columns that sort rows within a partition.
Capacity modes: on-demand (the default) bills per read and write request and scales automatically. Provisioned sets read and WCU (Write capacity unit)The unit of write throughput in DynamoDB: one write per second of an item up to 1 KB. A transactional write uses two.Glossary entry, with optional auto scaling, for predictable traffic.
Consistency: every write is stored three times across multiple AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry and acknowledged with LOCAL_QUORUM consistency.
Limits to know: a row can be up to 1 MB.

Features to know

Multi-AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry replication: fully managed, Multi-site active/activeA disaster recovery strategy that runs the full workload in two or more Regions at once, all serving traffic. It recovers fastest, with almost no downtime, and costs the most.Glossary entry replication across the Regions you choose. Each Region can read and write on its own, and conflicts are resolved with last writer wins at the cell level.
PITR (Point-in-time recovery)Restoring a database to its state at a chosen moment within a retention period, using continuous backups. Amazon RDS, Amazon Aurora, Amazon DynamoDB, and AWS Backup support it.Glossary entry (PITR): restore a table to any second in the last 35 days, even after the table is deleted.
TTL (Time to live)How long something stays valid before it expires. A DNS record or cached item can be reused until its TTL runs out, then is fetched again; in DynamoDB, a TTL attribute deletes items after a set time.Glossary entry (TTL): set a default expiry for a table and override it for individual rows or columns; expired data is deleted automatically, with no effect on performance.
CDC (Change data capture)Capturing each insert, update, and delete in a source database as it happens, so that another system can be kept in step. AWS DMS uses CDC to keep replicating changes after the initial full load.Glossary entry (CDC) streams: an ordered record of row changes, kept for up to 24 hours, with no infrastructure to manage.

Security, resilience, performance, and cost

Security

IAM controls access to keyspaces and tables. Applications can authenticate with IAM credentials through the AWS SigV4 authentication plugin, or with service-specific credentials.
Encryption at restEncrypting data where it is stored, such as on disks, in databases, or in backups, so that it cannot be read without the key. On AWS it usually uses keys in AWS KMS.Glossary entry with AWS KMS (AES-256) is always on. The default is an AWS owned key at no extra charge, or you can choose a Customer managed keyA KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.Glossary entry.
Keyspaces accepts only TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry connections, so data is always encrypted in transit.
Use interface VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry (AWS PrivateLink) to keep traffic off the internet.
CloudTrail records API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls.

Resilience

Data is stored three times across multiple Availability Zones automatically.
Use PITR for backups and multi-Region replication for Regional resilience and low-latency reads and writes near users.

Performance

Scaling is automatic in on-demand mode. Design partition keys so traffic spreads evenly across partitions, as you would with Cassandra or DynamoDB.

Cost

On-demand: pay per read and write request unit. Provisioned: pay for capacity per hour.
Pay for storage, PITR, and multi-Region replication.
Database Savings Plans cover Keyspaces.
Compared with running Cassandra on EC2, there are no instances to size or keep idle.

Monitoring

CloudWatch metrics for capacity, latency, errors, and ThrottlingLimiting how many requests a client can make in a period. A throttled request is rejected, often with HTTP status 429 or a throttling error, and should be retried later with backoff.Glossary entry. CloudTrail for control-plane activity.

Keyspaces or another option?

If the requirement is	Choose
Existing Apache Cassandra or CQL workload, managed and serverless	Amazon Keyspaces
Full control of a Cassandra cluster and its configuration	Cassandra on EC2
A new serverless key-value application on AWS	Amazon DynamoDB
MongoDB-compatible documents	Amazon DocumentDB
Relationships and graph traversals	Amazon Neptune

Reverse mindmap: when the question points here

Is it Amazon Keyspaces?

Yes, when the question says
- Migrate Apache Cassandra to a managed service leads to Keyspaces
- Use CQL and existing Cassandra drivers leads to Keyspaces
- Serverless wide-column database leads to Keyspaces
Choose the feature
- Unpredictable traffic leads to On-demand capacity
- Active-active writes in several Regions leads to Multi-Region replication
- Restore to a second in the last 35 days leads to Point-in-time recovery
- Expire old rows automatically leads to TTL
- React to row changes leads to CDC streams
- Private access from a VPC leads to Interface VPC endpoint
No, when the question says
- New key-value app, no Cassandra leads to DynamoDB
- MongoDB-compatible leads to DocumentDB
- Need to tune Cassandra nodes yourself leads to Cassandra on EC2

Key takeaways

Keyspaces is serverless and Apache Cassandra-compatible: use the same CQL, drivers, and application code.
On-demand capacity is the default; provisioned with auto scaling suits steady traffic.
Writes are stored three times across Availability Zones with LOCAL_QUORUM consistency.
Multi-Region replication is active-active with last-writer-wins conflict resolution.
PITR covers 35 days; TTL expires data; CDC streams keep changes for up to 24 hours.
Encryption at rest is always on, with an AWS owned key or a customer managed key.