ACA CCO cheat sheet

IaaS supplies virtualized compute, storage, and network; PaaS supplies a managed runtime; SaaS supplies finished applications - the customer's management burden decreases in that order.

Elasticity = automatic, rapid scale-out/scale-in matching demand; scalability = capacity to grow; vertical scaling resizes one instance, horizontal scaling adds instances.

Multi-tenant public cloud isolates tenants logically (virtualization, VPC, IAM), not physically; dedicated-host offerings change the physical tenancy model.

Shared responsibility: provider secures physical facilities, hypervisor, and managed-service internals; customer secures guest OS, data, identities, and configuration of owned resources.

Region > Availability Zone > zone-local resource: an AZ maps to one or more discrete data centers with independent power and network; cross-AZ replication tolerates AZ failure, cross-Region tolerates regional failure.

Pay-as-you-go billing meters resource-seconds (or hours), storage capacity-time, and data transfer; reserved or commitment pricing trades flexibility for a discount.

SLA credit percentages are remedies, not guarantees: a 99.9% monthly SLA permits roughly 43 minutes of downtime before credits apply.

A cloud resource is identified by Region + resource type + ID; the same logical name in two Regions denotes two independent resources.

ECS instance lifecycle: Pending → Running → Stopping → Stopped → Starting → Running; Stopped retains disks and IP allocations, while Released destroys the instance and its non-persistent local data.

Instance families are purpose-built: general-purpose balanced CPU/memory, compute-optimized high CPU-to-memory, memory-optimized high memory-to-CPU, and GPU/accelerated for parallel workloads - match the ratio to the workload.

A security group is a stateful virtual firewall attached at the instance ENI level; allow rules only, and return traffic for permitted flows is automatically allowed.

User data runs once at first boot (cloud-init); replacing user data on a running instance does not re-execute it, and reboot does not re-run it.

Stop vs. restart: stopping may release the public IP unless it is an elastic (static) IP; restarting preserves all runtime state and IPs.

Auto Scaling composes a launch template (image, instance type, key pair, user data, security groups) with scaling rules and a min/max/desired capacity triple.

Instance metadata is reachable from inside the guest at the link-local metadata endpoint and yields instance ID, Region, and RAM role credentials - never place secrets in user data.

Replacing the system disk requires a stop-and-replace operation; snapshots of the system disk enable rollback and are the basis for custom images.

A VPC is Region-scoped; a vSwitch (subnet) is AZ-scoped, so an instance's subnet fixes its AZ and multi-AZ design requires subnets in each AZ.

CIDR sizing: a /24 yields 256 addresses, a /16 yields 65,536; plan address space so VPCs can be peered without overlap - overlapping CIDRs block peering.

Route tables choose the next hop per destination prefix; the most specific (longest-prefix) match wins, and a default route 0.0.0.0/0 typically targets the NAT gateway or internet gateway.

Internet gateway enables inbound and outbound internet for instances with public IPs; NAT gateway enables outbound-only internet for private-subnet instances.

Security groups are instance-level and stateful; network ACLs are subnet-level, stateless, evaluated in numbered order, and require explicit rules for both directions.

Load balancer choice: Layer 4 (TCP/UDP) for raw throughput and preserved source IP; Layer 7 (HTTP/HTTPS) for host/path routing, TLS termination, and session stickiness.

CDN caching reduces origin load and latency; cache hit ratio rises with TTL, and cache invalidation or versioned URLs force refresh of stale objects.

DNS record types: A/AAAA map names to IPv4/IPv6, CNAME aliases one name to another (not allowed at the zone apex), MX and TXT serve mail routing and verification.

Object storage is flat with a bucket-plus-key namespace, offers virtually unlimited capacity, and suits unstructured data and static assets; block storage attaches to one instance and suits databases and OS volumes.

Storage durability vs. availability: durability is the annual probability of not losing data (e.g., 99.999999999%), availability is the fraction of time the service is reachable - they are distinct metrics.

Object storage consistency and lifecycle: lifecycle rules transition objects to colder tiers or expire them by age; versioning protects against overwrites and deletions.

Block volume performance is bounded by volume type IOPS and throughput; provisioned-IOPS volumes decouple performance from capacity, while burst-capable types deplete credits under sustained load.

Relational databases enforce schema and ACID transactions and scale vertically with read replicas; NoSQL key-value/wide-column stores trade joins for horizontal scale and tunable consistency.

Read replicas serve read traffic and are asynchronous; failover to a standby is a separate high-availability mechanism with different data-loss characteristics.

Backups: snapshots are incremental after the first full copy and are stored independently of the source volume; deletion of the source does not delete existing snapshots.

Caching layers (in-memory or CDN) reduce database read pressure; cache-aside requires explicit invalidation, and stale reads are the primary correctness risk.

RAM (resource access management) principals: users have long-term credentials, roles are assumed temporarily and issue short-lived STS tokens - prefer roles over embedded access keys.

Policy evaluation: explicit deny overrides any allow; with no matching allow the request is denied by default (implicit deny).

Least privilege means scoping both Action and Resource in a policy statement; wildcard actions combined with wildcard resources grant full account access.

Federated identity lets external IdPs (SAML/OIDC) assume roles, so users authenticate once and receive scoped temporary credentials - no per-user cloud accounts.

Encryption at rest uses service-managed or customer-managed keys; envelope encryption wraps data keys with a master key, and key rotation limits blast radius of key compromise.

Encryption in transit requires TLS; disabling legacy protocol versions and enforcing HTTPS-only bucket or listener policies closes downgrade paths.

Audit trails record API calls with principal, source IP, timestamp, and result; log integrity requires write-once storage and separation of log-admin from resource-admin duties.

Secrets belong in a managed secret store with rotation, never in code, images, user data, or environment variables committed to version control.

Metric types: gauge (instantaneous value such as CPU%), counter (monotonically increasing such as request count), and derived aggregates (average, p95, max) - averaging hides tail latency, so alert on percentiles.

Alarm states are OK, ALARM, and INSUFFICIENT_DATA; an alarm evaluates a metric over a period and triggers when the threshold is breached for N consecutive periods.

The four golden signals are latency, traffic, errors, and saturation; USE (utilization, saturation, errors) suits resources, RED (rate, errors, duration) suits services.

Logs answer 'what happened in this request', metrics answer 'how much/how often', and traces answer 'where in the call graph did time go' - pick the signal matching the question.

Troubleshooting order for connectivity: security group rules → network ACL rules → route table next hop → public IP/NAT presence → guest OS firewall → DNS resolution.

Troubleshooting order for a slow instance: CPU/memory saturation → disk IOPS or burst-credit exhaustion → network throughput limits → application-level thread or connection pool limits.

Infrastructure as code makes environments reproducible and idempotent; drift is the divergence between declared and actual state and is detected by a plan/diff step.

Automation triggers: scheduled (cron-style), event-driven (resource state change or metric alarm), and pipeline-driven (commit) - event-driven reacts fastest to failure.