From Knowing to Doing: AWS Certifications, Microcredentials, and the Hands-On Reality

Last November I wrote about AWS Microcredentials when they first launched, sharing my experience with the Serverless and Agentic AI assessments during the beta programme. A lot has changed since then. The microcredential portfolio has expanded, the pricing model has shifted entirely, and I’ve just completed the three new data analytics microcredentials to complete the clean sweep of all AWS Certifications and Microcredentials!

For those unfamiliar, AWS Microcredentials are timed, hands-on assessments conducted in a live AWS environment. There are no multiple-choice questions. You’re presented with broken or incomplete infrastructure and scored on whether you can actually fix it. They complement traditional certifications - which validate knowledge through question-based exams - by proving you can apply that knowledge under real-world conditions.

This post picks up where that one left off. Rather than going deep on what microcredentials are (I covered that previously), I want to focus on what they actually test, what they prove about you as an engineer, and how the broader AWS hands-on ecosystem has evolved to help bridge the gap between certification knowledge and real-world capability.

Three New Microcredentials Just Dropped

AWS recently announced three new Data Analytics microcredentials: -

AWS Data Lakehouse Demonstrated - diagnosing and resolving issues across lakehouse architectures using Apache Iceberg, AWS Glue, Amazon Athena, Amazon Data Firehose, and AWS Lake Formation
AWS Data Streaming Demonstrated - troubleshooting real-time streaming infrastructure across Amazon Kinesis Data Streams, Amazon MSK, Amazon Data Firehose, and Amazon Managed Service for Apache Flink
AWS Data Visualization Demonstrated - building, securing, and troubleshooting analytics dashboards using Amazon QuickSight, Amazon Athena, Amazon Redshift Serverless, and AWS Glue

These aren’t theoretical exercises. You’re dropped into a live AWS environment with broken or misconfigured infrastructure and a ticking clock. No multiple-choice questions, you either fix the problem or you don’t.

What the Assessments Actually Look Like

To give you a sense of the technical depth, let me walk through some representative examples of the types of challenges you might encounter. These are illustrative rather than verbatim from the assessment, but they reflect the level of problem-solving required.

Data Lakehouse: Iceberg Table Operations

Imagine a Glue ETL job producing triple the expected record count. The root cause? The job reads from a broad S3 prefix containing multiple weekly snapshots without filtering to the target week: -

# Before: reads ALL snapshots
input_path = f"s3://{args['curated_bucket']}/staging/shipments/"

# After: scoped to the specific weekly snapshot
input_path = f"s3://{args['curated_bucket']}/staging/shipments/week-{args['snapshot_week']}/"

Simple in hindsight, but when you’re in a live environment working backwards from unexpected row counts through S3 path structures, job parameters, and export conventions, you need real hands-on experience to diagnose it efficiently under time pressure.

The lakehouse assessment also tests Iceberg-specific operations that certifications never touch. Partition evolution: -

spark.sql("""
    ALTER TABLE glue_catalog.warehouse_db.shipments
    ADD PARTITION FIELD days(shipped_date) AS shipped_day
""")

Schema evolution via type promotion: -

spark.sql("""
    ALTER TABLE glue_catalog.warehouse_db.shipments
    ALTER COLUMN weight_grams TYPE double
""")

Table maintenance operations via Athena: -

ALTER TABLE warehouse_db.inventory
SET TBLPROPERTIES ('optimize_rewrite_data_file_threshold' = '5');

OPTIMIZE warehouse_db.inventory REWRITE DATA USING BIN_PACK;

ALTER TABLE warehouse_db.inventory
SET TBLPROPERTIES ('vacuum_min_snapshots_to_keep' = '3',
                   'vacuum_max_snapshot_age_seconds' = '3600');

VACUUM warehouse_db.inventory;

These are the types of operations you perform regularly when maintaining production lakehouse environments. No certification exam tests whether you can actually execute them.

Data Streaming: Kafka, Kinesis, and Firehose Configuration

The streaming assessment throws you into a world of misconfigured Kafka topics, broken Firehose delivery, and Flink applications that need parameter changes.

One scenario might require you to fix a Kafka Connect S3 Sink Connector to consume from the correct set of topics: -

{
  "connector.class": "io.confluent.connect.s3.S3SinkConnector",
  "topics": "iot-telemetry,iot-alerts",
  "flush.size": "200",
  "format.class": "io.confluent.connect.s3.format.json.JsonFormat",
  "s3.bucket.name": "company-iot-lake-bucket"
}

Or configuring Firehose to deliver records into an Iceberg table with upsert behaviour. You need to enable inline parsing, set the correct operation expression, and ensure the destination table has unique keys configured for deduplication: -

{
  "DestinationDatabaseName": "iot_db",
  "DestinationTableName": "device_readings",
  "UniqueKeys": ["device_id", "reading_timestamp"]
}

Combined with a JQ operation expression to enforce upsert semantics:

.operation = "upsert"

Getting this right requires understanding how Firehose’s inline parsing interacts with Iceberg table configuration, how unique keys drive merge behaviour, and when to use append versus upsert based on your data model. These are decisions you make daily in production streaming architectures but never encounter in a certification exam.

Another challenge might involve fixing a Kinesis producer Lambda to partition records correctly: -

# Wrong: partitioning by region spreads related device readings across shards
batch.append({
    'Data': json.dumps(record).encode(),
    'PartitionKey': record['region_id']
})

# Right: partition by device_id to keep related readings ordered
batch.append({
    'Data': json.dumps(record).encode(),
    'PartitionKey': record['device_id']
})

Data Visualization: QuickSight Security and Datasets

The visualization microcredential isn’t just about building charts. You’re configuring row-level security, column-level permissions, building SPICE and Direct Query datasets, and writing calculated fields. You’ll work with Redshift Serverless VPC connections, Athena views as dataset sources using custom SQL, and multi-tenant security models.

Creating a dataset from a view requires using custom SQL since QuickSight’s table picker doesn’t surface views: -

SELECT * FROM analytics_db.quarterly_performance_summary

Metrics like cost-per-acquisition need correct aggregation (Average, not Sum, for ratio-based KPIs), and column-level security requires you to track down QuickSight user identities to assign granular access to sensitive columns like margin percentages.

The Complete AWS Credentials Landscape

AWS Certifications (12)

Certifications validate knowledge - your understanding of services, architectures, and best practices.

Foundational: -

Associate: -

Professional: -

Specialty: -

AWS Microcredentials (8)

Microcredentials validate capability - your ability to implement, troubleshoot, and fix things in a live AWS environment.

All eight are available free on AWS Skill Builder - no subscription required. This is a significant change from when they launched in late 2025 behind a paywall.

Bridging the Gap: What Each Really Gives You

I’ve long talked about “the gap” - that space between passing a certification and being able to deliver on a real project. Let me be specific about what each credential type proves.

Certifications prove you can:

Identify the correct service for a given requirement
Understand architectural patterns and trade-offs
Recognise security, cost, and performance implications
Select appropriate configurations from a set of options

Microcredentials prove you can:

Navigate the AWS Console and find the right settings
Write and debug infrastructure code (Spark SQL, Python, JQ, SQL)
Diagnose issues from symptoms
Work under time pressure with limited guidance
Apply documentation to solve unfamiliar problems in real time

The difference is profound. I hold all 12 certifications. I could tell you in a multiple-choice exam that Iceberg supports partition evolution as a metadata-only operation. But the microcredential proves I can actually execute the DDL, verify it through SHOW CREATE TABLE, understand that existing data won’t be repartitioned, and troubleshoot when the metadata views don’t immediately reflect the change.

The Broader Hands-On Ecosystem

Microcredentials aren’t the only way to build practical skills. AWS has invested heavily in experiential learning, and 2026 continues to see that evolve.

AWS Immersion Days

Half-day or full-day workshops, roughly 50/50 between theory and practical, with guided instructions. These are a gentle on-ramp — you follow a structured path but you’re working in real AWS accounts. Great for teams new to a particular domain (migration, containers, analytics). As an AWS Partner, Atos can run these for our customers.

AWS GameDays

Team-based, competitive, time-pressured events where you’re presented with broken or incomplete environments and scored on how quickly you resolve them. No instructions - just outcomes to achieve. Unexpected events can occur mid-game forcing you to adapt. AWS GameDay challenges test not just technical skill but collaboration and prioritisation under pressure. I think of these events as being analogous to a ‘major incident’, although the real life ones have rather fewer unicorns!

AWS AI League

A competition-based programme that transforms how builders engage with AWS AI services. Through gamified tournaments with leaderboards, timed challenges, and real-time scoring, participants build AI solutions that solve real-world problems. We’ve used this at Atos to help staff develop hands-on experience with Amazon SageMaker fine-tuning LLMs, as well as Bedrock and Bedrock AgentCore to develop Agentic AI skills.

The AI League gameplay screen - your agent navigates the map while the combat log shows events in real-time

Agentic Football Cup

The newest addition to the hands-on ecosystem. The Agentic Football Cup is a half-day workshop where you build a squad of five autonomous AI agents using Amazon Bedrock and AgentCore, then pit them against other teams in a live 5-a-side football match. Your agents make decisions every two seconds - passing, shooting, pressing, defending - with no human input once the whistle blows.

The Progression Model

Here’s how I think about skill development in the AWS space:

Stage	What it proves
Training/Courses	Certification (knowledge validated)
Immersion Days	Guided hands-on (structured practice)
Microcredentials	Hands-on capability validated (externally proven)
GameDays / AI League / Agentic Football	Unscripted hands-on (pressure-tested)
Real-world delivery	Production experience

Each step narrows the gap. Certifications give you the vocabulary and mental models. Guided labs give you initial muscle memory. Microcredentials provide external validation that you can actually do the work. Competitive events test you under pressure.

What’s Changed Since My Last Post

When I wrote about microcredentials nine months ago, there were two available behind a Skill Builder subscription ($29/month). Now there are eight, they’re completely free, and the technical domains covered have expanded significantly. The Data Analytics trio in particular tests skills that are immediately applicable to production data engineering roles - Iceberg table maintenance, streaming pipeline configuration, and business intelligence security models.

The assessment format has also matured. The challenges feel well-calibrated — difficult enough to genuinely validate capability, but achievable if you have real experience with the services. The error messages and feedback you receive when validating your solutions guide you toward next steps without giving away the answer, much like production debugging.

Final Thoughts

If you’re someone who holds AWS certifications but hasn’t yet put those services to work in anger, the microcredentials are the closest thing to debugging a real project you’ll find in a controlled environment. If you’re hiring and want to distinguish between candidates who know the theory and candidates who can do the work, these badges tell you something meaningful.

The fact that they’re now free removes the last barrier. Head to AWS Skill Builder, find the microcredential that matches your domain, and see how you get on. If the data analytics ones are anything to go by, you’ll need genuine hands-on experience to pass. And that’s exactly the point.

Mark Ross is an AWS Ambassador at Atos, holding all 12 AWS Certifications and all 8 AWS Microcredentials.