ACA CCE cheat sheet

Cloud service models: IaaS (virtual machines, storage, networks), PaaS (managed runtimes and databases), SaaS (finished applications); responsibility for OS patching moves from customer to provider as you go IaaS to PaaS to SaaS.

Shared responsibility split: the provider secures the physical facility, host hardware, and virtualization layer; the customer secures guest OS configuration, identity and access, data, and application code.

Elasticity vs scalability: elasticity automatically adds and removes capacity in response to demand; scalability is the ability to grow capacity, whether manually or automatically.

Regions are geographic areas containing one or more zones; zones within a region have independent power and network, so multi-zone deployment raises availability without cross-region latency.

Availability is usually expressed as a percentage of uptime per year: 99.9% allows about 8.8 hours downtime per year, 99.99% about 52.6 minutes, and 99.999% about 5.3 minutes.

Latency is bounded by the speed of light over fiber, so placing compute near users (region selection) matters more than adding CPU for latency-sensitive workloads.

Horizontal scaling (adding instances behind a load balancer) is generally preferred for stateless web tiers; vertical scaling (larger instance type) requires downtime or a restart.

Serverless/FaaS removes server management: the provider runs code on demand, scales automatically, and bills per invocation and execution duration rather than per running instance.

ECS (Elastic Compute Service) provides virtual machines; instance families are optimized for general purpose, compute, memory, or storage, and billing can be subscription or pay-as-you-go.

OSS (Object Storage Service) is unlimited-capacity object storage organized into buckets; storage classes include Standard, Infrequent Access, Archive, and Cold Archive, with lower cost and longer retrieval time as you move down the tiers.

VPC (Virtual Private Cloud) is an isolated network with a CIDR block; vSwitches partition a VPC into subnets tied to a single zone, and security groups act as stateful instance-level firewalls.

SLB (Server Load Balancer) distributes traffic across backend servers; CLB is the classic layer-4/7 balancer, ALB targets application-layer HTTP/HTTPS, and NLB handles high-performance layer-4 traffic.

ApsaraDB RDS is a managed relational database (MySQL, SQL Server, PostgreSQL, etc.) handling backups, patching, and high availability; PolarDB is a cloud-native relational engine with compute-storage separation.

Auto Scaling automatically adjusts ECS instance count using scaling groups and scaling rules triggered by schedules or metrics such as CPU utilization.

CDN caches static content at edge nodes close to users, reducing origin load and latency; it is typically paired with OSS as origin for web assets.

Resource Access Management (RAM) controls who can call which Alibaba Cloud API actions on which resources, using users, groups, roles, and policies.

Model Studio (Bailian) is the platform for accessing foundation models via API, including the Qwen family, with model selection by capability, context length, and price.

Qwen is Alibaba Cloud's foundation model family, offered in multiple sizes and modalities (text, vision, audio) so workloads can trade cost against capability.

API calls to model services are metered by input tokens and output tokens, priced separately; output tokens typically cost more per token than input tokens.

Context window is the maximum number of tokens a model can consider in one request (prompt plus completion); exceeding it requires truncation, summarization, or chunking.

Retrieval-Augmented Generation (RAG) combines a vector/knowledge base search with model generation so answers are grounded in private or current documents rather than only pretraining.

Embeddings convert text into vectors so semantic similarity search can be performed; a vector store indexes them for nearest-neighbor retrieval.

Prompt engineering patterns: system prompt sets role and constraints, few-shot examples demonstrate the desired output format, and temperature controls randomness (lower is more deterministic).

PAI (Platform for AI) provides the machine learning lifecycle - training, notebooks, and model deployment - for custom models, complementing hosted foundation-model APIs.

Principle of least privilege: grant RAM policies only the actions and resources needed; attach policies to groups and roles rather than individual users where possible.

RAM roles with STS temporary credentials are the correct pattern for granting Alibaba Cloud services or federated identities access without embedding long-term AccessKey secrets.

Never place AccessKey ID/Secret in source code or public repositories; rotate keys, use RAM users rather than the root account, and enable MFA on privileged accounts.

Security groups are stateful and default to denying inbound traffic; rules specify protocol, port range, and source (CIDR or another security group).

WAF (Web Application Firewall) filters HTTP/HTTPS attacks such as SQL injection and XSS; Anti-DDoS protects against volumetric network attacks - they address different threat layers.

ActionTrail records API activity for audit; Cloud Config tracks resource configuration changes; combining them supports compliance and forensic investigation.

Encryption: OSS and RDS support server-side encryption, and KMS manages keys; TLS protects data in transit while encryption at rest protects stored data.

Data classification drives controls: identify sensitive data, restrict access via RAM and network boundaries, and log access for regulated workloads.

Subscription (prepaid) billing commits to a term, usually monthly or yearly, at a lower unit price; pay-as-you-go (postpaid) bills by actual usage with no commitment.

Pay-as-you-go ECS is billed by the second or hour of running time; stopping an instance may still incur charges for attached storage and public IP unless released.

OSS charges separately for storage volume, requests/operations, and outbound internet traffic; traffic between OSS and ECS in the same region over an internal endpoint is typically not charged as internet egress.

Internet outbound traffic (data transfer out) is a distinct cost line from inbound traffic; designing to keep traffic internal to a region reduces egress charges.

Savings instruments: savings plans and reserved capacity commit to spend or capacity for a discount; spot/preemptible instances offer deep discounts but can be reclaimed.

Budgets and cost alerts notify when spend crosses thresholds; cost allocation tags let you attribute charges to projects, teams, or environments.

The billing console's bills and cost analysis views break down charges by product and by resource; use them to find idle or oversized resources before optimizing.

Auto-renewal on subscription resources prevents accidental expiry and service interruption; unused subscription capacity is generally not refunded pro-rata.

Support plans differ in response time and channel: higher tiers add faster response SLAs, phone/chat access, and a technical account manager.

Severity determines response time: production-down incidents are handled faster than general how-to questions; classify tickets accurately to get the right SLA.

The Trust Center publishes compliance certifications and security documentation; it is the reference for audit and regulatory questions.

Health status and service notifications report ongoing incidents and maintenance; subscribe to notifications to learn about events affecting your resources.

Self-service resources - documentation, API references, and knowledge base articles - resolve most configuration questions without a paid ticket.

A support ticket should include resource IDs, region, timestamps, error messages, and reproduction steps to reduce back-and-forth and speed resolution.

Architectural reviews and best-practice guidance are typically part of higher support tiers; basic tiers focus on break-fix assistance.

Escalation paths: unresolved tickets can be escalated per the plan's process; severity and business impact justify escalation.