ACA CCP cheat sheet

Cloud service models: IaaS provides virtualized compute/storage/network; PaaS adds managed runtime and middleware; SaaS delivers finished applications; the customer's management burden decreases from IaaS to SaaS.

Deployment models: public cloud is multi-tenant and provider-operated; private cloud is dedicated to one organization; hybrid connects both, typically via VPN or dedicated line; community cloud is shared by several organizations with common requirements.

Essential characteristics (NIST): on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.

Elasticity is automatic scaling in and out to match demand; scalability is the capacity to grow; vertical scaling resizes an instance, horizontal scaling adds instances.

Regions are geographic areas; zones within a region have independent power and network, so multi-zone deployment removes single points of failure; a region is selected for latency, data residency, and compliance.

CAP theorem: under a network partition a distributed system must choose consistency or availability; most cloud databases are tunable between strong and eventual consistency.

Shared responsibility: the provider secures the physical facility, hypervisor, and managed-service infrastructure; the customer secures its data, identities, access policies, and guest-OS configuration.

Pay-as-you-go billing meters resources by duration or usage; reserved/subscription pricing trades commitment for discount; spot/preemptible capacity is cheapest but can be reclaimed.

ECS instances are billed Subscription (prepaid), Pay-As-You-Go (hourly), or Preemptible (spot, reclaimable); instance families are typed by workload: general purpose (g), compute optimized (c), memory optimized (r), and others.

ECS disks: system disk holds the OS; data disks are attached separately; disk categories include ESSD, SSD, and ultra disk, chosen by IOPS and latency need.

Security groups are stateful virtual firewalls attached to ECS instances; rules are allow-only (no deny rules), and a single instance can belong to multiple security groups.

OSS is object storage organized by bucket and object with a globally unique bucket name; redundancy options include locally redundant (LRS) and zone-redundant (ZRS); storage classes include Standard, Infrequent Access, Archive, and Cold Archive with descending cost and rising retrieval time.

VPC provides an isolated private network with a CIDR block, vSwitches (subnets) bound to one zone, route tables, and security controls; ECS, SLB, and RDS resources are deployed into vSwitches.

SLB distributes traffic across backend servers; SLB types include the classic load balancer and the application load balancer (layer 7, HTTP/HTTPS); health checks remove unhealthy backends.

ApsaraDB RDS is a managed relational database (MySQL, SQL Server, PostgreSQL, etc.) offering automatic backup, HA, and read-only instances; Auto Scaling adjusts ECS capacity by scaling group and scaling rules.

Server Load Balancer, CDN, and DNS (Alibaba Cloud DNS) sit in the traffic path; CDN caches content at edge nodes and reduces origin load and latency for static content.

RAM (Resource Access Management) manages identities: users, groups, and roles; permissions are granted by attaching policies to identities, and roles are assumed by trusted entities without sharing long-term credentials.

RAM policy structure: Effect (Allow/Deny), Action, Resource, and Condition; explicit Deny overrides any Allow; least privilege means granting only the actions and resources required.

STS (Security Token Service) issues temporary credentials with a defined validity period and policy, used for federated access and for granting temporary access to applications.

Encryption at rest: OSS supports server-side encryption (SSE) and client-side encryption; KMS manages customer master keys and envelope encryption; encryption in transit uses TLS/HTTPS.

Network security layers: security groups (instance level), network ACLs (subnet level), and Anti-DDoS (traffic scrubbing) plus WAF (HTTP/HTTPS application attacks) and Cloud Firewall.

ActionTrail records API actions for audit; Cloud Config evaluates resource configuration against rules; these support compliance and forensic investigation.

Data classification drives controls: public, internal, confidential, and sensitive data each get distinct access, encryption, and retention requirements.

Identity best practices: enable MFA for privileged accounts, avoid using the root account for daily operations, rotate access keys, and prefer roles over long-lived keys.

High availability pattern: deploy across multiple zones, use SLB health checks, and keep stateless application tiers so failed instances can be replaced without data loss.

Disaster recovery metrics: RTO is the maximum acceptable downtime; RPO is the maximum acceptable data loss; strategies range from backup/restore (high RTO/RPO) to active-active (near zero).

Decoupling: use message queues to buffer spikes and asynchronous workers to process them; this smooths load and isolates failures between components.

Caching reduces database load and latency; cache invalidation strategy (TTL, write-through, or explicit purge) must be defined to avoid stale data.

Monitoring and operations: collect metrics (CPU, memory, disk, network), set alarms on thresholds, centralize logs, and define auto-recovery actions such as Auto Scaling or instance restart.

Backup strategy follows the 3-2-1 rule: three copies, on two media types, with one copy offsite; snapshots and cross-region replication implement this on cloud storage.

Cost and performance trade-off: right-size instances to observed utilization, use reserved capacity for steady-state load, and spot capacity for fault-tolerant batch work.

Change management: stage changes in a test environment, use infrastructure-as-code for repeatability, and roll back on failed health checks; blue-green and canary releases limit blast radius.