Akamai Cloud Computing Foundations cheat sheet

IaaS scope: Akamai Cloud supplies virtual machines, block and object storage, and private networking; the customer owns the guest OS, runtime, application, and data layers.

Managed layers: LKE handles the Kubernetes control plane and App Platform handles build-and-run of applications, moving more of the stack under provider responsibility.

Placement rule: every Linode, block volume, and NodeBalancer is bound to one data center; resources are not migrated across regions automatically, so moving means redeploying or copying data.

Redundancy pattern: place instances in at least two data centers, then fail over with DNS or a NodeBalancer to survive a single-site outage.

Scaling decision: resize the plan (vertical, requires reboot) for monolithic or memory-bound workloads; add instances behind a load balancer (horizontal) for stateless application tiers.

Service map: compute = Linode; containers = LKE; PaaS = App Platform; storage = Block and Object Storage; network = NodeBalancer, VPC, VLAN; data = Managed Databases.

Shared responsibility split: Akamai secures facilities, hardware, hypervisor, and physical network; the customer secures patching, firewall rules, identities, TLS configuration, and application backups.

SLA: 99.99% uptime commitment for eligible services; credits are not issued automatically and must be claimed through a support ticket within the stated window.

Plan families: Shared CPU (Nanode, Standard), Dedicated CPU, High Memory, and GPU/Accelerated; each plan fixes vCPU count, RAM, local disk, and monthly transfer.

Shared vs dedicated: shared plans can burst but may be throttled when neighbors are busy; dedicated plans reserve physical cores for consistent, latency-sensitive performance.

Resize rules: upgrading requires a shutdown and reboot; a plan cannot be smaller than the disk space already in use, so local disks may need resizing to match the new plan.

Block Storage: network-attached volume attached to one Linode at a time, must sit in the same data center, billed per GB-month even while detached; detach and reattach to move data between instances.

Object Storage: S3-compatible API with buckets and access keys; billed per GB-month of stored data plus outbound transfer; it is not a mountable POSIX filesystem.

Images: capture a disk as a custom image to clone a configured server; Marketplace and Community images supply prebuilt stacks; the image must exist in a region you deploy to.

Backups: automatic daily and weekly snapshot tiers that restore to an existing or new Linode; because snapshots follow a schedule, recovery point objective is hours, not seconds.

StackScripts: boot-time scripts with user-defined fields that automate first-boot configuration and can be reused across many deployments.

Managed Databases: MySQL, PostgreSQL, MongoDB, and Redis with automated backups, replication, and failover; there is no root or OS access, so engine tuning is limited to exposed settings.

NodeBalancer: managed L4 (TCP) and L7 (HTTP/HTTPS) load balancing with health checks, TLS termination, session stickiness, and round-robin, least-connections, or source algorithms.

VPC: region-scoped private network you define with subnets; attach Linodes, NodeBalancers, and managed databases; isolated from other accounts and from the public internet.

VLAN: Layer 2 segment inside a single data center; each Linode needs a network interface assigned to the VLAN; there is no DHCP or gateway unless you build one.

Cloud Firewall: stateful; inbound traffic is denied by default; rules match protocol, port range, and IPv4/IPv6 CIDR; a single firewall can be attached to many instances.

Private IP traffic between Linodes in the same data center stays off the public internet and does not count against the transfer allowance.

Transfer allowance: each plan contributes monthly outbound transfer to an account-wide pool; all services draw from the same pool and overage is billed per GB.

DNS Manager: authoritative hosting for primary and secondary zones with API-manageable A, AAAA, CNAME, MX, and TXT records; used for failover and blue-green cutovers.

IPv4/IPv6: instances receive a public IPv4 and IPv6 address; additional IPv4 addresses can be routed to an instance to host multiple TLS sites.

Account roles: the account owner is unrestricted; additional users can be restricted with per-resource grants set to read-only or read-write.

API tokens: scoped personal access tokens with configurable expiry and read/write permissions per resource area; each is revocable individually and its secret is displayed only at creation.

Two-factor authentication: configured per user, and the account owner can enforce it for every user on the account.

Instance access: SSH key pairs are injected at deploy time; a root password is optional, and key-only authentication removes password brute-force exposure.

Cloud Firewall defaults: all inbound traffic is dropped until a rule permits it; outbound traffic is allowed by default until an outbound rule denies it.

Object Storage keys: an access key and secret key sign S3 API requests, are separate from the account login, and can be revoked without changing the account password.

LKE separation: Akamai manages the control plane; worker nodes run inside your account, so node OS patching, Kubernetes RBAC, and network policies remain your responsibility.

Rotation rule: rotate tokens and keys on staff departure or suspected exposure, and scope each token to one integration so revocation is contained.

One control plane: Cloud Manager, the CLI, and Terraform all call API v4 (REST/JSON) with a bearer token; anything possible in the UI is possible programmatically.

Billing: usage is metered hourly and capped at the monthly list price; deleting a resource stops future charges, but hours already consumed remain billable.

Separate line items: compute plans, block volumes, NodeBalancers, Object Storage, managed databases, and backup service each bill independently.

Transfer overage: billed per GB beyond the pooled allowance at roughly $5 per terabyte; inbound traffic and private-network traffic are not charged.

Infrastructure as code: Terraform provider and Ansible modules give repeatable builds, while StackScripts or cloud-init handle first-boot configuration inside the instance.

Monitoring: Cloud Manager alerts trigger on metrics such as CPU, disk I/O, network, and transfer; the Longview agent adds per-process and historical system metrics.

Kubernetes cost: LKE bills worker nodes at standard compute rates; the standard control plane carries no additional cluster fee.

SLA claims: service credits require a support ticket with incident details submitted inside the window defined in the SLA; refunds are never automatic.

Audit: account events in Cloud Manager record who created, resized, or deleted resources, supporting change review and incident investigation.